From 2c655f52ca51bfe4c882a8bb3b3d46a8917cf95c Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 17 May 2022 14:07:03 -0700 Subject: [PATCH] test --- .../adapter/data/default/collections.conf | 1 + .../adapter/data/default/transforms.conf | 3 +- .../adapter/data/lookups/mitre_enrichment.csv | 392 ++++++++++-------- .../lookups/prohibited_apps_launching_cmd.csv | 1 + .../obj_to_json_adapter_data/stories.json | 2 +- 5 files changed, 213 insertions(+), 186 deletions(-) diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/collections.conf b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/collections.conf index f9e4d705c8..2e9500c3a7 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/collections.conf +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/collections.conf @@ -8,3 +8,4 @@ [api_call_by_user_baseline] enforceTypes = false replicate = false + diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/transforms.conf b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/transforms.conf index fc29301671..e8444796d0 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/transforms.conf +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2022-05-16T20:34:53 UTC +# On Date: 2020-12-25T17:05:55 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -19,6 +19,7 @@ case_sensitive_match = false match_type = WILDCARD(attacker_tool_names) min_matches = 1 + ### Default transforms definitions for the lookup files we ship ### [mitre_enrichment] filename = mitre_enrichment.csv diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/mitre_enrichment.csv b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/mitre_enrichment.csv index 2719dde5e6..deb2019d49 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/mitre_enrichment.csv +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/mitre_enrichment.csv @@ -1,18 +1,30 @@ mitre_id,technique,tactics,groups +T1647,Plist File Modification,Defense Evasion,no +T1622,Debugger Evasion,Defense Evasion|Discovery,no +T1621,Multi-Factor Authentication Request Generation,Credential Access,APT29 +T1505.005,Terminal Services DLL,Persistence,no +T1557.003,DHCP Spoofing,Credential Access|Collection,no +T1595.003,Wordlist Scanning,Reconnaissance,Volatile Cedar +T1098.005,Device Registration,Persistence,APT29 +T1574.013,KernelCallbackTable,Persistence|Privilege Escalation|Defense Evasion,Lazarus Group +T1556.005,Reversible Encryption,Credential Access|Defense Evasion|Persistence,no +T1055.015,ListPlanting,Defense Evasion|Privilege Escalation,no +T1564.010,Process Argument Spoofing,Defense Evasion,no T1564.009,Resource Forking,Defense Evasion,no +T1559.003,XPC Services,Execution,no T1562.010,Downgrade Attack,Defense Evasion,no T1547.015,Login Items,Persistence|Privilege Escalation,no -T1620,Reflective Code Loading,Defense Evasion,no +T1620,Reflective Code Loading,Defense Evasion,Lazarus Group T1619,Cloud Storage Object Discovery,Discovery,no T1218.014,MMC,Defense Evasion,no T1218.013,Mavinject,Defense Evasion,no -T1614.001,System Language Discovery,Discovery,no +T1614.001,System Language Discovery,Discovery,Ke3chang|Lazarus Group T1615,Group Policy Discovery,Discovery,Turla T1036.007,Double File Extension,Defense Evasion,Mustang Panda T1562.009,Safe Mode Boot,Defense Evasion,no T1564.008,Email Hiding Rules,Defense Evasion,FIN4 T1505.004,IIS Components,Persistence,no -T1027.006,HTML Smuggling,Defense Evasion,no +T1027.006,HTML Smuggling,Defense Evasion,APT29 T1213.003,Code Repositories,Collection,APT29 T1553.006,Code Signing Policy Modification,Defense Evasion,Turla|APT39 T1614,System Location Discovery,Discovery,no @@ -25,19 +37,19 @@ T1053.007,Container Orchestration Job,Execution|Persistence|Privilege Escalation T1610,Deploy Container,Defense Evasion|Execution,TeamTNT T1609,Container Administration Command,Execution,TeamTNT T1608.005,Link Target,Resource Development,Silent Librarian -T1608.004,Drive-by Target,Resource Development,Transparent Tribe|APT32|Threat Group-3390 +T1608.004,Drive-by Target,Resource Development,Dragonfly|Transparent Tribe|APT32|Threat Group-3390 T1608.003,Install Digital Certificate,Resource Development,no -T1608.002,Upload Tool,Resource Development,Threat Group-3390 -T1608.001,Upload Malware,Resource Development,TeamTNT|APT32 -T1608,Stage Capabilities,Resource Development,no -T1016.001,Internet Connection Discovery,Discovery,APT29|Turla -T1553.005,Mark-of-the-Web Bypass,Defense Evasion,TA505 -T1555.005,Password Managers,Credential Access,Fox Kitten|Operation Wocao -T1484.002,Domain Trust Modification,Defense Evasion|Privilege Escalation,APT29 +T1608.002,Upload Tool,Resource Development,Lazarus Group|Threat Group-3390 +T1608.001,Upload Malware,Resource Development,Threat Group-3390|LazyScripter|Mustang Panda|Gamaredon Group|Kimsuky|Lazarus Group|TeamTNT|APT32 +T1608,Stage Capabilities,Resource Development,Mustang Panda +T1016.001,Internet Connection Discovery,Discovery,Gamaredon Group|APT29|UNC2452|Turla +T1553.005,Mark-of-the-Web Bypass,Defense Evasion,APT29|TA505 +T1555.005,Password Managers,Credential Access,Threat Group-3390|Fox Kitten|Operation Wocao +T1484.002,Domain Trust Modification,Defense Evasion|Privilege Escalation,APT29|UNC2452 T1484.001,Group Policy Modification,Defense Evasion|Privilege Escalation,Indrik Spider T1547.014,Active Setup,Persistence|Privilege Escalation,no -T1606.002,SAML Tokens,Credential Access,APT29 -T1606.001,Web Cookies,Credential Access,APT29 +T1606.002,SAML Tokens,Credential Access,APT29|UNC2452 +T1606.001,Web Cookies,Credential Access,APT29|UNC2452 T1606,Forge Web Credentials,Credential Access,no T1555.004,Windows Credential Manager,Credential Access,Stealth Falcon|OilRig|Turla T1059.008,Network Device CLI,Execution,no @@ -61,8 +73,8 @@ T1588.006,Vulnerabilities,Resource Development,Sandworm Team T1053.006,Systemd Timers,Execution|Persistence|Privilege Escalation,no T1562.008,Disable Cloud Logs,Defense Evasion,no T1547.012,Print Processors,Persistence|Privilege Escalation,no -T1598.003,Spearphishing Link,Reconnaissance,Magic Hound|Silent Librarian|Sidewinder|Sandworm Team|APT32|Kimsuky -T1598.002,Spearphishing Attachment,Reconnaissance,Sidewinder +T1598.003,Spearphishing Link,Reconnaissance,APT28|Dragonfly|Magic Hound|Silent Librarian|Sidewinder|Sandworm Team|APT32|Kimsuky +T1598.002,Spearphishing Attachment,Reconnaissance,Dragonfly|Sidewinder T1598.001,Spearphishing Service,Reconnaissance,no T1598,Phishing for Information,Reconnaissance,ZIRCONIUM|APT28 T1597.002,Purchase Technical Data,Reconnaissance,no @@ -74,23 +86,23 @@ T1596.003,Digital Certificates,Reconnaissance,no T1596.001,DNS/Passive DNS,Reconnaissance,no T1596.002,WHOIS,Reconnaissance,no T1596,Search Open Technical Databases,Reconnaissance,no -T1595.002,Vulnerability Scanning,Reconnaissance,TeamTNT|APT29|Volatile Cedar|APT28|Sandworm Team +T1595.002,Vulnerability Scanning,Reconnaissance,Magic Hound|Aquatic Panda|Dragonfly|TeamTNT|APT29|Volatile Cedar|APT28|Sandworm Team T1595.001,Scanning IP Blocks,Reconnaissance,TeamTNT T1595,Active Scanning,Reconnaissance,no -T1594,Search Victim-Owned Websites,Reconnaissance,Silent Librarian|Sandworm Team -T1593.002,Search Engines,Reconnaissance,no -T1593.001,Social Media,Reconnaissance,Kimsuky +T1594,Search Victim-Owned Websites,Reconnaissance,Kimsuky|Silent Librarian|Sandworm Team +T1593.002,Search Engines,Reconnaissance,Kimsuky +T1593.001,Social Media,Reconnaissance,Lazarus Group|Kimsuky T1593,Search Open Websites/Domains,Reconnaissance,Sandworm Team T1592.004,Client Configurations,Reconnaissance,HAFNIUM T1592.003,Firmware,Reconnaissance,no T1592.002,Software,Reconnaissance,Andariel|Sandworm Team T1592.001,Hardware,Reconnaissance,no T1592,Gather Victim Host Information,Reconnaissance,no -T1591.004,Identify Roles,Reconnaissance,no +T1591.004,Identify Roles,Reconnaissance,Lazarus Group T1591.003,Identify Business Tempo,Reconnaissance,no T1591.001,Determine Physical Locations,Reconnaissance,no -T1591.002,Business Relationships,Reconnaissance,Sandworm Team -T1591,Gather Victim Org Information,Reconnaissance,no +T1591.002,Business Relationships,Reconnaissance,Dragonfly|Sandworm Team +T1591,Gather Victim Org Information,Reconnaissance,Kimsuky|Lazarus Group T1590.006,Network Security Appliances,Reconnaissance,no T1590.005,IP Addresses,Reconnaissance,Andariel|HAFNIUM T1590.004,Network Topology,Reconnaissance,no @@ -98,40 +110,40 @@ T1590.003,Network Trust Dependencies,Reconnaissance,no T1590.002,DNS,Reconnaissance,no T1590.001,Domain Properties,Reconnaissance,Sandworm Team T1590,Gather Victim Network Information,Reconnaissance,HAFNIUM -T1589.003,Employee Names,Reconnaissance,Silent Librarian|Sandworm Team -T1589.002,Email Addresses,Reconnaissance,Kimsuky|Magic Hound|TA551|MuddyWater|HAFNIUM|APT32|Silent Librarian|Sandworm Team -T1589.001,Credentials,Reconnaissance,Leviathan|APT28|Magic Hound|Chimera +T1589.003,Employee Names,Reconnaissance,Kimsuky|Silent Librarian|Sandworm Team +T1589.002,Email Addresses,Reconnaissance,Lazarus Group|Kimsuky|Magic Hound|TA551|MuddyWater|HAFNIUM|APT32|Silent Librarian|Sandworm Team +T1589.001,Credentials,Reconnaissance,APT29|Leviathan|APT28|Magic Hound|Chimera T1589,Gather Victim Identity Information,Reconnaissance,Magic Hound|APT32 -T1588.005,Exploits,Resource Development,no -T1588.004,Digital Certificates,Resource Development,Lazarus Group|Silent Librarian -T1588.003,Code Signing Certificates,Resource Development,Wizard Spider -T1588.002,Tool,Resource Development,CostaRicto|Night Dragon|DarkVishnya|FIN5|Gorgon Group|Patchwork|Chimera|Dragonfly|Blue Mockingbird|Whitefly|APT41|FIN6|TEMP.Veles|Kimsuky|PittyTiger|Cobalt Group|APT29|Thrip|Ke3chang|DarkHydrus|APT32|APT38|BRONZE BUTLER|Carbanak|Cleaver|Inception|Leafminer|Threat Group-3390|Ferocious Kitten|IndigoZebra|BackdoorDiplomacy|menuPass|APT-C-36|Magic Hound|APT28|Wizard Spider|Frankenstein|Silence|WIRTE|Turla|APT33|APT19|FIN10|CopyKittens|APT39|APT1|MuddyWater|Silent Librarian|GALLIUM|Sandworm Team -T1588.001,Malware,Resource Development,Andariel|BackdoorDiplomacy|Turla|APT1 +T1588.005,Exploits,Resource Development,Kimsuky +T1588.004,Digital Certificates,Resource Development,BlackTech|Lazarus Group|Silent Librarian +T1588.003,Code Signing Certificates,Resource Development,BlackTech|Lazarus Group|Wizard Spider +T1588.002,Tool,Resource Development,Aquatic Panda|BlackTech|Lazarus Group|CostaRicto|Night Dragon|DarkVishnya|FIN5|Gorgon Group|Patchwork|Chimera|Dragonfly|Blue Mockingbird|Whitefly|APT41|FIN6|TEMP.Veles|Kimsuky|PittyTiger|Cobalt Group|APT29|Thrip|Ke3chang|DarkHydrus|APT32|APT38|BRONZE BUTLER|Carbanak|Cleaver|Inception|Leafminer|Threat Group-3390|Ferocious Kitten|IndigoZebra|BackdoorDiplomacy|menuPass|APT-C-36|Magic Hound|APT28|Wizard Spider|Frankenstein|Silence|WIRTE|Turla|APT33|APT19|FIN10|CopyKittens|APT39|APT1|MuddyWater|Silent Librarian|GALLIUM|Sandworm Team +T1588.001,Malware,Resource Development,Aquatic Panda|LazyScripter|Andariel|BackdoorDiplomacy|Turla|APT1 T1588,Obtain Capabilities,Resource Development,no T1587.004,Exploits,Resource Development,no T1587.003,Digital Certificates,Resource Development,APT29|PROMETHIUM T1587.002,Code Signing Certificates,Resource Development,PROMETHIUM|Patchwork -T1587.001,Malware,Resource Development,TeamTNT|APT29|Lazarus Group|Sandworm Team|Turla|FIN7|Night Dragon|Cleaver +T1587.001,Malware,Resource Development,Ke3chang|Kimsuky|TeamTNT|APT29|Lazarus Group|UNC2452|Sandworm Team|Turla|FIN7|Night Dragon|Cleaver T1587,Develop Capabilities,Resource Development,Kimsuky -T1586.002,Email Accounts,Resource Development,IndigoZebra|Leviathan|Magic Hound|Kimsuky +T1586.002,Email Accounts,Resource Development,APT29|APT28|IndigoZebra|Leviathan|Magic Hound|Kimsuky T1586.001,Social Media Accounts,Resource Development,Leviathan T1586,Compromise Accounts,Resource Development,no -T1585.002,Email Accounts,Resource Development,Leviathan|Magic Hound|Silent Librarian|Sandworm Team|APT1 -T1585.001,Social Media Accounts,Resource Development,Leviathan|Magic Hound|Fox Kitten|Sandworm Team|APT32|Cleaver +T1585.002,Email Accounts,Resource Development,Mustang Panda|Kimsuky|Lazarus Group|Leviathan|Magic Hound|Silent Librarian|Sandworm Team|APT1 +T1585.001,Social Media Accounts,Resource Development,Kimsuky|Lazarus Group|Leviathan|Magic Hound|Fox Kitten|Sandworm Team|APT32|Cleaver T1585,Establish Accounts,Resource Development,Fox Kitten|APT17 T1584.006,Web Services,Resource Development,Turla -T1584.005,Botnet,Resource Development,no -T1584.004,Server,Resource Development,Indrik Spider|Turla|APT16 +T1584.005,Botnet,Resource Development,Sandworm Team|Axiom +T1584.004,Server,Resource Development,Lazarus Group|Dragonfly|Indrik Spider|Turla|APT16 T1584.003,Virtual Private Server,Resource Development,Turla T1584.002,DNS Server,Resource Development,no -T1584.001,Domains,Resource Development,Transparent Tribe|Magic Hound|APT29|APT1 -T1583.006,Web Services,Resource Development,IndigoZebra|ZIRCONIUM|MuddyWater|HAFNIUM|Lazarus Group|Turla|APT32|APT17|APT29 +T1584.001,Domains,Resource Development,Kimsuky|Lazarus Group|Transparent Tribe|Magic Hound|APT29|UNC2452|APT1 +T1583.006,Web Services,Resource Development,APT28|Confucius|LazyScripter|Kimsuky|Magic Hound|IndigoZebra|ZIRCONIUM|MuddyWater|HAFNIUM|Lazarus Group|Turla|APT32|APT17|APT29 T1583.005,Botnet,Resource Development,no -T1583.004,Server,Resource Development,GALLIUM|Sandworm Team -T1583.003,Virtual Private Server,Resource Development,HAFNIUM|TEMP.Veles -T1583.002,DNS Server,Resource Development,no +T1583.004,Server,Resource Development,Kimsuky|Lazarus Group|Gelsemium|GALLIUM|Sandworm Team +T1583.003,Virtual Private Server,Resource Development,Axiom|Dragonfly|HAFNIUM|TEMP.Veles +T1583.002,DNS Server,Resource Development,Axiom T1584,Compromise Infrastructure,Resource Development,no -T1583.001,Domains,Resource Development,IndigoZebra|TeamTNT|Ferocious Kitten|FIN7|Transparent Tribe|Leviathan|Magic Hound|APT29|Mustang Panda|ZIRCONIUM|Lazarus Group|Silent Librarian|menuPass|Sandworm Team|APT32|Kimsuky|APT1|APT28 +T1583.001,Domains,Resource Development,LazyScripter|Gamaredon Group|Winnti Group|Dragonfly|IndigoZebra|TeamTNT|Ferocious Kitten|FIN7|Transparent Tribe|Leviathan|Magic Hound|APT29|Mustang Panda|ZIRCONIUM|UNC2452|Lazarus Group|Silent Librarian|menuPass|Sandworm Team|APT32|Kimsuky|APT1|APT28 T1583,Acquire Infrastructure,Resource Development,no T1564.007,VBA Stomping,Defense Evasion,no T1558.004,AS-REP Roasting,Credential Access,no @@ -145,7 +157,7 @@ T1574.012,COR_PROFILER,Persistence|Privilege Escalation|Defense Evasion,Blue Moc T1562.007,Disable or Modify Cloud Firewall,Defense Evasion,no T1098.004,SSH Authorized Keys,Persistence,TeamTNT T1480.001,Environmental Keying,Defense Evasion,APT41|Equation -T1059.007,JavaScript,Execution,Indrik Spider|MuddyWater|Turla|Higaisa|Sidewinder|Evilnum|Kimsuky|FIN6|APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer +T1059.007,JavaScript,Execution,LazyScripter|Indrik Spider|MuddyWater|Turla|Higaisa|Sidewinder|Evilnum|Kimsuky|FIN6|APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer T1578.004,Revert Cloud Instance,Defense Evasion,no T1578.003,Delete Cloud Instance,Defense Evasion,no T1578.001,Create Snapshot,Defense Evasion,no @@ -155,17 +167,17 @@ T1027.005,Indicator Removal from Tools,Defense Evasion,Operation Wocao|GALLIUM|T T1562.006,Indicator Blocking,Defense Evasion,no T1573.002,Asymmetric Cryptography,Command And Control,Operation Wocao|Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6 T1573.001,Symmetric Cryptography,Command And Control,Mustang Panda|Darkhotel|ZIRCONIUM|Higaisa|Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group -T1573,Encrypted Channel,Command And Control,Tropic Trooper +T1573,Encrypted Channel,Command And Control,APT29|Tropic Trooper T1027.004,Compile After Delivery,Defense Evasion,Gamaredon Group|Rocke|MuddyWater T1574.004,Dylib Hijacking,Persistence|Privilege Escalation|Defense Evasion,no T1546.015,Component Object Model Hijacking,Privilege Escalation|Persistence,APT28 -T1071.004,DNS,Command And Control,Chimera|APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7 +T1071.004,DNS,Command And Control,LazyScripter|Chimera|APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7 T1071.003,Mail Protocols,Command And Control,Turla|Kimsuky|APT32|SilverTerrier|APT28 T1071.002,File Transfer Protocols,Command And Control,Kimsuky|APT41|SilverTerrier|Honeybee -T1071.001,Web Protocols,Command And Control,TeamTNT|FIN8|APT29|Mustang Panda|Windshift|TA551|Higaisa|HAFNIUM|Sidewinder|Chimera|Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Rancor|Ke3chang|Orangeworm|APT37|APT19|Cobalt Group|Threat Group-3390|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|Magic Hound|APT32|OilRig|Gamaredon Group|Stealth Falcon +T1071.001,Web Protocols,Command And Control,Kimsuky|Confucius|TeamTNT|FIN8|APT29|Mustang Panda|Windshift|TA551|Higaisa|HAFNIUM|Sidewinder|Chimera|UNC2452|Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Rancor|Ke3chang|Orangeworm|APT37|APT19|Cobalt Group|Threat Group-3390|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|Magic Hound|APT32|OilRig|Gamaredon Group|Stealth Falcon T1572,Protocol Tunneling,Command And Control,Leviathan|CostaRicto|Chimera|Fox Kitten|OilRig|Cobalt Group|FIN6 T1048.003,Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol,Exfiltration,Wizard Spider|FIN6|APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group -T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,APT28|APT29 +T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,APT28|APT29|UNC2452 T1048.001,Exfiltration Over Symmetric Encrypted Non-C2 Protocol,Exfiltration,no T1001.003,Protocol Impersonation,Command And Control,Higaisa|Lazarus Group T1001.002,Steganography,Command And Control,APT29|Axiom @@ -175,23 +187,23 @@ T1132.001,Standard Encoding,Command And Control,HAFNIUM|TA551|Sandworm Team|Trop T1090.004,Domain Fronting,Command And Control,APT29 T1090.003,Multi-hop Proxy,Command And Control,Leviathan|CostaRicto|APT28|Operation Wocao|Inception|FIN4|APT29 T1090.002,External Proxy,Command And Control,Tonto Team|APT39|Silence|GALLIUM|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28 -T1090.001,Internal Proxy,Command And Control,APT29|Higaisa|Operation Wocao|APT39|Strider +T1090.001,Internal Proxy,Command And Control,Lazarus Group|Turla|APT29|Higaisa|UNC2452|Operation Wocao|APT39|Strider T1102.003,One-Way Communication,Command And Control,Leviathan -T1102.002,Bidirectional Communication,Command And Control,ZIRCONIUM|MuddyWater|APT28|APT29|Sandworm Team|APT39|APT12|Turla|FIN7|APT37|Magic Hound|Carbanak +T1102.002,Bidirectional Communication,Command And Control,Kimsuky|Lazarus Group|ZIRCONIUM|MuddyWater|APT28|APT29|Sandworm Team|APT39|APT12|Turla|FIN7|APT37|Magic Hound|Carbanak T1102.001,Dead Drop Resolver,Command And Control,Rocke|APT41|BRONZE BUTLER|RTM|Patchwork -T1571,Non-Standard Port,Command And Control,Sandworm Team|Rocke|DarkVishnya|Silence|APT-C-36|Magic Hound|APT33|APT32|TEMP.Veles|Lazarus Group|FIN7 -T1074.002,Remote Data Staging,Collection,Leviathan|APT28|APT29|Chimera|Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8 -T1074.001,Local Data Staging,Collection,Indrik Spider|BackdoorDiplomacy|Mustang Panda|Sidewinder|Chimera|Kimsuky|APT39|Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|Honeybee|Dragonfly 2.0|Leviathan|APT3|FIN5|menuPass|Lazarus Group|Threat Group-3390|APT28 -T1078.004,Cloud Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT28|APT33 +T1571,Non-Standard Port,Command And Control,WIRTE|Sandworm Team|Rocke|DarkVishnya|Silence|APT-C-36|Magic Hound|APT33|APT32|TEMP.Veles|Lazarus Group|FIN7 +T1074.002,Remote Data Staging,Collection,Leviathan|APT28|APT29|Chimera|UNC2452|Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8 +T1074.001,Local Data Staging,Collection,Dragonfly|Indrik Spider|BackdoorDiplomacy|Mustang Panda|Sidewinder|Chimera|Kimsuky|APT39|Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|Honeybee|Dragonfly 2.0|Leviathan|APT3|FIN5|menuPass|Lazarus Group|Threat Group-3390|APT28 +T1078.004,Cloud Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Ke3chang|APT29|APT28|APT33 T1564.004,NTFS File Attributes,Defense Evasion,APT32 -T1564.003,Hidden Window,Defense Evasion,Nomadic Octopus|Higaisa|Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound -T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Kimsuky|HAFNIUM|Turla|Operation Wocao|PROMETHIUM|Tropic Trooper|FIN10|APT32 +T1564.003,Hidden Window,Defense Evasion,Gamaredon Group|Kimsuky|Nomadic Octopus|Higaisa|Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound +T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT29|Kimsuky|HAFNIUM|Turla|Operation Wocao|PROMETHIUM|Tropic Trooper|FIN10|Stolen Pencil|APT32 T1078.002,Domain Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Naikon|Indrik Spider|Chimera|Operation Wocao|Sandworm Team|Wizard Spider|APT29|TA505|APT3|Threat Group-1314 T1078.001,Default Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,no -T1564.002,Hidden Users,Defense Evasion,Dragonfly 2.0 +T1564.002,Hidden Users,Defense Evasion,Kimsuky|Dragonfly|Dragonfly 2.0 T1574.006,Dynamic Linker Hijacking,Persistence|Privilege Escalation|Defense Evasion,APT41|Rocke -T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,Mustang Panda|Higaisa|BlackTech|Sidewinder|Chimera|BRONZE BUTLER|Naikon|APT41|GALLIUM|Tropic Trooper|APT19|Patchwork|APT32|APT3|menuPass|Threat Group-3390 -T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,BackdoorDiplomacy|Tonto Team|Evilnum|APT41|Whitefly|RTM|Threat Group-3390|menuPass +T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,Lazarus Group|Mustang Panda|Higaisa|BlackTech|Sidewinder|Chimera|BRONZE BUTLER|Naikon|APT41|GALLIUM|Tropic Trooper|APT19|Patchwork|APT32|APT3|menuPass|Threat Group-3390 +T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,Aquatic Panda|BackdoorDiplomacy|Tonto Team|Evilnum|APT41|Whitefly|RTM|Threat Group-3390|menuPass T1574.008,Path Interception by Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,no T1574.007,Path Interception by PATH Environment Variable,Persistence|Privilege Escalation|Defense Evasion,no T1574.009,Path Interception by Unquoted Path,Persistence|Privilege Escalation|Defense Evasion,no @@ -202,10 +214,10 @@ T1574,Hijack Execution Flow,Persistence|Privilege Escalation|Defense Evasion,no T1069.001,Local Groups,Discovery,Tonto Team|Chimera|Operation Wocao|Turla|OilRig|admin@338 T1570,Lateral Tool Transfer,Lateral Movement,Sandworm Team|Chimera|GALLIUM|Operation Wocao|APT32|Wizard Spider|Turla|FIN10 T1568.003,DNS Calculation,Command And Control,APT12 -T1204.002,Malicious File,Execution,Nomadic Octopus|Indrik Spider|APT38|Andariel|Ferocious Kitten|IndigoZebra|Transparent Tribe|Tonto Team|Magic Hound|Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|Kimsuky|FIN6|PROMETHIUM|APT30|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Dragonfly 2.0|FIN7|BRONZE BUTLER|Gorgon Group|OilRig|Dark Caracal|Cobalt Group|DarkHydrus|Rancor|Patchwork|APT32|APT19|MuddyWater|Lazarus Group|menuPass|APT37|Leviathan|TA459|APT29|APT28|FIN8|PLATINUM|Elderwood -T1204.001,Malicious Link,Execution,FIN7|Transparent Tribe|APT3|Magic Hound|APT28|APT29|Mustang Panda|Sidewinder|ZIRCONIUM|MuddyWater|Evilnum|Sandworm Team|Wizard Spider|Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|Turla|APT33 +T1204.002,Malicious File,Execution,LazyScripter|WIRTE|Confucius|Dragonfly|Threat Group-3390|Nomadic Octopus|Indrik Spider|APT38|Andariel|Ferocious Kitten|IndigoZebra|Transparent Tribe|Tonto Team|Magic Hound|Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|Kimsuky|FIN6|PROMETHIUM|APT30|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Dragonfly 2.0|FIN7|BRONZE BUTLER|Gorgon Group|OilRig|Dark Caracal|Cobalt Group|DarkHydrus|Rancor|Patchwork|APT32|APT19|MuddyWater|Lazarus Group|menuPass|APT37|Leviathan|TA459|APT29|APT28|FIN8|PLATINUM|Elderwood +T1204.001,Malicious Link,Execution,LazyScripter|Kimsuky|Lazarus Group|Confucius|FIN7|Transparent Tribe|APT3|Magic Hound|APT28|APT29|Mustang Panda|Sidewinder|ZIRCONIUM|MuddyWater|Evilnum|Sandworm Team|Wizard Spider|Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|Turla|APT33 T1195.003,Compromise Hardware Supply Chain,Initial Access,no -T1195.002,Compromise Software Supply Chain,Initial Access,APT29|Cobalt Group|GOLD SOUTHFIELD|Dragonfly|Sandworm Team|APT41 +T1195.002,Compromise Software Supply Chain,Initial Access,Gelsemium|Threat Group-3390|APT29|UNC2452|Cobalt Group|GOLD SOUTHFIELD|Dragonfly|Sandworm Team|APT41 T1195.001,Compromise Software Dependencies and Development Tools,Initial Access,no T1568.001,Fast Flux DNS,Command And Control,menuPass|TA505 T1052.001,Exfiltration over USB,Exfiltration,Mustang Panda|Tropic Trooper @@ -213,65 +225,65 @@ T1569.002,Service Execution,Execution,APT38|Chimera|Operation Wocao|Wizard Spide T1569.001,Launchctl,Execution,no T1569,System Services,Execution,no T1568.002,Domain Generation Algorithms,Command And Control,TA551|APT41 -T1568,Dynamic Resolution,Command And Control,Transparent Tribe|APT29 +T1568,Dynamic Resolution,Command And Control,Gamaredon Group|Gelsemium|Transparent Tribe|APT29|UNC2452 T1011.001,Exfiltration Over Bluetooth,Exfiltration,no -T1567.002,Exfiltration to Cloud Storage,Exfiltration,FIN7|ZIRCONIUM|HAFNIUM|Chimera|Leviathan|Turla +T1567.002,Exfiltration to Cloud Storage,Exfiltration,Kimsuky|Threat Group-3390|Confucius|Lazarus Group|FIN7|ZIRCONIUM|HAFNIUM|Chimera|Leviathan|Turla T1567.001,Exfiltration to Code Repository,Exfiltration,no -T1059.006,Python,Execution,Tonto Team|APT37|ZIRCONIUM|MuddyWater|Turla|Operation Wocao|Kimsuky|APT29|Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete -T1059.005,Visual Basic,Execution,OilRig|APT38|Transparent Tribe|APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|APT39|Machete|Operation Wocao|Kimsuky|APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound +T1059.006,Python,Execution,Dragonfly|Tonto Team|APT37|ZIRCONIUM|MuddyWater|Turla|Operation Wocao|Kimsuky|APT29|Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete +T1059.005,Visual Basic,Execution,Confucius|Lazarus Group|LazyScripter|OilRig|APT38|Transparent Tribe|APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|APT39|Machete|Operation Wocao|Kimsuky|APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound T1059.004,Unix Shell,Execution,TeamTNT|Rocke|APT41 -T1059.003,Windows Command Shell,Execution,Sandworm Team|Nomadic Octopus|TeamTNT|APT29|Mustang Panda|ZIRCONIUM|TA551|Higaisa|Indrik Spider|Chimera|Fox Kitten|Machete|Operation Wocao|Wizard Spider|FIN6|TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|GALLIUM|Turla|Silence|APT32|Darkhotel|MuddyWater|APT18|APT38|Gorgon Group|Dark Caracal|Ke3chang|Dragonfly 2.0|Rancor|FIN8|APT28|APT37|Magic Hound|BRONZE BUTLER|Sowbug|menuPass|FIN10|Threat Group-3390|Gamaredon Group|Patchwork|Suckfly|Threat Group-1314|APT3|admin@338|APT1 +T1059.003,Windows Command Shell,Execution,Kimsuky|Aquatic Panda|Dragonfly|LazyScripter|Sandworm Team|Nomadic Octopus|TeamTNT|APT29|Mustang Panda|ZIRCONIUM|TA551|Higaisa|Indrik Spider|Chimera|UNC2452|Fox Kitten|Machete|Operation Wocao|Wizard Spider|FIN6|TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|GALLIUM|Turla|Silence|APT32|Darkhotel|MuddyWater|APT18|APT38|Gorgon Group|Dark Caracal|Ke3chang|Dragonfly 2.0|Rancor|FIN8|APT28|APT37|Magic Hound|BRONZE BUTLER|Sowbug|menuPass|FIN10|Threat Group-3390|Gamaredon Group|Patchwork|Suckfly|Threat Group-1314|APT3|admin@338|APT1 T1059.002,AppleScript,Execution,no -T1059.001,PowerShell,Execution,Nomadic Octopus|TeamTNT|APT38|Tonto Team|Mustang Panda|Indrik Spider|HAFNIUM|Sidewinder|Fox Kitten|GOLD SOUTHFIELD|Sandworm Team|Operation Wocao|Chimera|Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|GALLIUM|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|Thrip|Cobalt Group|APT28|DarkHydrus|Dragonfly 2.0|APT19|Gorgon Group|TA459|Leviathan|MuddyWater|FIN8|CopyKittens|OilRig|Magic Hound|BRONZE BUTLER|FIN7|APT32|menuPass|FIN10|Threat Group-3390|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda +T1059.001,PowerShell,Execution,Gamaredon Group|Lazarus Group|Aquatic Panda|Confucius|Dragonfly|LazyScripter|Nomadic Octopus|TeamTNT|APT38|Tonto Team|Mustang Panda|Indrik Spider|HAFNIUM|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Sandworm Team|Operation Wocao|Chimera|Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|GALLIUM|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|Thrip|Cobalt Group|APT28|DarkHydrus|Dragonfly 2.0|APT19|Gorgon Group|TA459|Leviathan|MuddyWater|FIN8|CopyKittens|OilRig|Magic Hound|BRONZE BUTLER|FIN7|APT32|menuPass|FIN10|Threat Group-3390|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda T1567,Exfiltration Over Web Service,Exfiltration,APT28 T1497.003,Time Based Evasion,Defense Evasion|Discovery,no T1497.002,User Activity Based Checks,Defense Evasion|Discovery,Darkhotel|FIN7 -T1497.001,System Checks,Defense Evasion|Discovery,OilRig|Darkhotel|Evilnum|Frankenstein +T1497.001,System Checks,Defense Evasion|Discovery,Lazarus Group|OilRig|Darkhotel|Evilnum|Frankenstein T1498.002,Reflection Amplification,Impact,no T1498.001,Direct Network Flood,Impact,no -T1566.003,Spearphishing via Service,Initial Access,APT29|Ajax Security Team|Magic Hound|Windshift|FIN6|OilRig|Dark Caracal -T1566.002,Spearphishing Link,Initial Access,Transparent Tribe|FIN7|APT3|Mustang Panda|ZIRCONIUM|MuddyWater|Sidewinder|Evilnum|Sandworm Team|Wizard Spider|APT1|Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|APT39|FIN4|APT32|Night Dragon|APT28|Cobalt Group|Turla|Dragonfly 2.0|OilRig|Elderwood|APT33|APT29|Leviathan|FIN8|Patchwork|Magic Hound -T1566.001,Spearphishing Attachment,Initial Access,APT38|Andariel|Ferocious Kitten|IndigoZebra|Transparent Tribe|Nomadic Octopus|Tonto Team|Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|APT1|FIN6|APT30|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|DarkHydrus|Lazarus Group|Gorgon Group|OilRig|BRONZE BUTLER|APT19|APT32|Cobalt Group|Rancor|FIN7|Dragonfly 2.0|MuddyWater|APT28|TA459|APT29|APT37|Leviathan|FIN8|Patchwork|menuPass|Elderwood|PLATINUM -T1566,Phishing,Initial Access,GOLD SOUTHFIELD|Dragonfly +T1566.003,Spearphishing via Service,Initial Access,Lazarus Group|APT29|Ajax Security Team|Magic Hound|Windshift|FIN6|OilRig|Dark Caracal +T1566.002,Spearphishing Link,Initial Access,Lazarus Group|Confucius|LazyScripter|Transparent Tribe|FIN7|APT3|Mustang Panda|ZIRCONIUM|MuddyWater|Sidewinder|Evilnum|Sandworm Team|Wizard Spider|APT1|Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|APT28|Cobalt Group|Turla|Dragonfly 2.0|OilRig|Elderwood|APT33|APT29|Leviathan|FIN8|Patchwork|Magic Hound +T1566.001,Spearphishing Attachment,Initial Access,WIRTE|Confucius|Dragonfly|LazyScripter|Threat Group-3390|APT38|Andariel|Ferocious Kitten|IndigoZebra|Transparent Tribe|Nomadic Octopus|Tonto Team|Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|APT1|FIN6|APT30|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|DarkHydrus|Lazarus Group|Gorgon Group|OilRig|BRONZE BUTLER|APT19|APT32|Cobalt Group|Rancor|FIN7|Dragonfly 2.0|MuddyWater|APT28|TA459|APT29|APT37|Leviathan|FIN8|Patchwork|menuPass|Elderwood|PLATINUM +T1566,Phishing,Initial Access,Axiom|GOLD SOUTHFIELD|Dragonfly T1565.003,Runtime Data Manipulation,Impact,APT38 T1565.002,Transmitted Data Manipulation,Impact,APT38 T1565.001,Stored Data Manipulation,Impact,APT38 T1565,Data Manipulation,Impact,no T1564.001,Hidden Files and Directories,Defense Evasion,Transparent Tribe|Mustang Panda|Rocke|APT32|Tropic Trooper|APT28|Lazarus Group T1564,Hide Artifacts,Defense Evasion,no -T1563.002,RDP Hijacking,Lateral Movement,no +T1563.002,RDP Hijacking,Lateral Movement,Axiom T1563.001,SSH Hijacking,Lateral Movement,no T1563,Remote Service Session Hijacking,Lateral Movement,no -T1518.001,Security Software Discovery,Discovery,TeamTNT|APT38|Windshift|Sidewinder|Operation Wocao|Wizard Spider|Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon +T1518.001,Security Software Discovery,Discovery,Kimsuky|Aquatic Panda|TeamTNT|APT38|Windshift|Sidewinder|Operation Wocao|Wizard Spider|Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon T1069.003,Cloud Groups,Discovery,no -T1069.002,Domain Groups,Discovery,Turla|Inception|OilRig|Dragonfly 2.0|Ke3chang -T1087.004,Cloud Account,Discovery,no +T1069.002,Domain Groups,Discovery,APT29|Dragonfly|Turla|Inception|OilRig|Dragonfly 2.0|Ke3chang +T1087.004,Cloud Account,Discovery,APT29 T1087.003,Email Account,Discovery,Sandworm Team|TA505 -T1087.002,Domain Account,Discovery,MuddyWater|Fox Kitten|Operation Wocao|Wizard Spider|Chimera|Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang +T1087.002,Domain Account,Discovery,APT29|Lazarus Group|Dragonfly|MuddyWater|Fox Kitten|Operation Wocao|Wizard Spider|Chimera|Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang T1087.001,Local Account,Discovery,Chimera|Fox Kitten|Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338 T1553.004,Install Root Certificate,Defense Evasion,no -T1562.004,Disable or Modify System Firewall,Defense Evasion,TeamTNT|APT38|APT29|Operation Wocao|Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak +T1562.004,Disable or Modify System Firewall,Defense Evasion,Dragonfly|TeamTNT|APT38|APT29|UNC2452|Operation Wocao|Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak T1562.003,Impair Command History Logging,Defense Evasion,APT38 -T1562.002,Disable Windows Event Logging,Defense Evasion,Sandworm Team|APT29|Threat Group-3390 -T1562.001,Disable or Modify Tools,Defense Evasion,TeamTNT|Indrik Spider|APT29|MuddyWater|Wizard Spider|FIN6|Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda +T1562.002,Disable Windows Event Logging,Defense Evasion,Sandworm Team|APT29|UNC2452|Threat Group-3390 +T1562.001,Disable or Modify Tools,Defense Evasion,Aquatic Panda|TeamTNT|Indrik Spider|APT29|MuddyWater|UNC2452|Wizard Spider|FIN6|Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda T1562,Impair Defenses,Defense Evasion,no -T1003.004,LSA Secrets,Credential Access,OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|Dragonfly 2.0|APT33|Threat Group-3390 +T1003.004,LSA Secrets,Credential Access,Dragonfly|OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|Dragonfly 2.0|APT33|Threat Group-3390 T1003.005,Cached Domain Credentials,Credential Access,OilRig|MuddyWater|Leafminer|APT33 T1561.002,Disk Structure Wipe,Impact,Sandworm Team|Lazarus Group|APT38|APT37 T1561.001,Disk Content Wipe,Impact,Lazarus Group T1561,Disk Wipe,Impact,no T1560.003,Archive via Custom Method,Collection,Mustang Panda|Lazarus Group|Kimsuky|CopyKittens|FIN6 T1560.002,Archive via Library,Collection,Lazarus Group|Threat Group-3390 -T1560.001,Archive via Utility,Collection,APT28|APT29|Mustang Panda|HAFNIUM|Fox Kitten|Operation Wocao|Chimera|APT41|GALLIUM|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|APT1|Ke3chang -T1560,Archive Collected Data,Collection,Leviathan|menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang +T1560.001,Archive via Utility,Collection,Kimsuky|Aquatic Panda|APT28|APT29|Mustang Panda|HAFNIUM|UNC2452|Fox Kitten|Operation Wocao|Chimera|APT41|GALLIUM|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|APT1|Ke3chang +T1560,Archive Collected Data,Collection,Axiom|Dragonfly|Leviathan|menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang T1499.004,Application or System Exploitation,Impact,no T1499.003,Application Exhaustion Flood,Impact,no T1499.002,Service Exhaustion Flood,Impact,no T1499.001,OS Exhaustion Flood,Impact,no T1491.002,External Defacement,Impact,Sandworm Team -T1491.001,Internal Defacement,Impact,Lazarus Group +T1491.001,Internal Defacement,Impact,Gamaredon Group|Lazarus Group T1114.003,Email Forwarding Rule,Collection,Silent Librarian|Kimsuky -T1114.002,Remote Email Collection,Collection,APT29|HAFNIUM|Chimera|APT1|FIN4|Ke3chang|Leafminer|Dragonfly 2.0|APT28 +T1114.002,Remote Email Collection,Collection,Kimsuky|Dragonfly|APT29|HAFNIUM|Chimera|UNC2452|APT1|FIN4|Ke3chang|Leafminer|Dragonfly 2.0|APT28 T1114.001,Local Email Collection,Collection,Chimera|Magic Hound|APT1 T1134.005,SID-History Injection,Defense Evasion|Privilege Escalation,no T1134.004,Parent PID Spoofing,Defense Evasion|Privilege Escalation,no @@ -280,7 +292,7 @@ T1134.002,Create Process with Token,Defense Evasion|Privilege Escalation,Turla|L T1134.001,Token Impersonation/Theft,Defense Evasion|Privilege Escalation,FIN8|APT28 T1213.002,Sharepoint,Collection,Chimera|Ke3chang|APT28 T1213.001,Confluence,Collection,no -T1555.003,Credentials from Web Browsers,Credential Access,Ajax Security Team|ZIRCONIUM|FIN6|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|MuddyWater|APT37|Patchwork|Molerats +T1555.003,Credentials from Web Browsers,Credential Access,APT29|Ajax Security Team|ZIRCONIUM|FIN6|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats T1555.002,Securityd Memory,Credential Access,no T1555.001,Keychain,Credential Access,no T1559.002,Dynamic Data Exchange,Execution,Leviathan|Sidewinder|Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|FIN7|APT28 @@ -289,7 +301,7 @@ T1559,Inter-Process Communication,Execution,no T1558.002,Silver Ticket,Credential Access,no T1558.001,Golden Ticket,Credential Access,Ke3chang T1558,Steal or Forge Kerberos Tickets,Credential Access,no -T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Credential Access|Collection,Wizard Spider +T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Credential Access|Collection,Lazarus Group|Wizard Spider T1557,Adversary-in-the-Middle,Credential Access|Collection,Kimsuky T1556.002,Password Filter DLL,Credential Access|Defense Evasion|Persistence,Strider T1556.001,Domain Controller Authentication,Credential Access|Defense Evasion|Persistence,Chimera @@ -297,71 +309,71 @@ T1556,Modify Authentication Process,Credential Access|Defense Evasion|Persistenc T1056.004,Credential API Hooking,Collection|Credential Access,PLATINUM T1056.003,Web Portal Capture,Collection|Credential Access,no T1056.002,GUI Input Capture,Collection|Credential Access,FIN4 -T1056.001,Keylogging,Collection|Credential Access,Tonto Team|Ajax Security Team|Operation Wocao|APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|FIN4|APT38|OilRig|Ke3chang|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28 -T1555,Credentials from Password Stores,Credential Access,APT29|Evilnum|FIN6|APT39|OilRig|MuddyWater|Leafminer|APT33|Stealth Falcon +T1056.001,Keylogging,Collection|Credential Access,Tonto Team|Ajax Security Team|Operation Wocao|APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|OilRig|Ke3chang|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28 +T1555,Credentials from Password Stores,Credential Access,APT29|Evilnum|UNC2452|FIN6|APT39|OilRig|MuddyWater|Leafminer|APT33|Stealth Falcon T1552.005,Cloud Instance Metadata API,Credential Access,TeamTNT T1003.008,/etc/passwd and /etc/shadow,Credential Access,no T1003.007,Proc Filesystem,Credential Access,no -T1003.006,DCSync,Credential Access,APT29|Operation Wocao -T1558.003,Kerberoasting,Credential Access,FIN7|APT29|Operation Wocao|Wizard Spider +T1003.006,DCSync,Credential Access,APT29|UNC2452|Operation Wocao +T1558.003,Kerberoasting,Credential Access,FIN7|APT29|UNC2452|Operation Wocao|Wizard Spider T1552.006,Group Policy Preferences,Credential Access,APT33 -T1003.003,NTDS,Credential Access,APT28|Mustang Panda|HAFNIUM|Fox Kitten|menuPass|Wizard Spider|Chimera|FIN6|Dragonfly 2.0 -T1003.002,Security Account Manager,Credential Access,Wizard Spider|Threat Group-3390|Ke3chang|GALLIUM|Night Dragon|Dragonfly 2.0|menuPass -T1003.001,LSASS Memory,Credential Access,Indrik Spider|HAFNIUM|Fox Kitten|Operation Wocao|Kimsuky|Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|GALLIUM|TEMP.Veles|APT33|APT39|APT32|Leafminer|Magic Hound|FIN8|PLATINUM|MuddyWater|OilRig|BRONZE BUTLER|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver +T1003.003,NTDS,Credential Access,Ke3chang|Dragonfly|APT28|Mustang Panda|HAFNIUM|Fox Kitten|menuPass|Wizard Spider|Chimera|FIN6|Dragonfly 2.0 +T1003.002,Security Account Manager,Credential Access,Dragonfly|Wizard Spider|Threat Group-3390|Ke3chang|GALLIUM|Night Dragon|Dragonfly 2.0|menuPass +T1003.001,LSASS Memory,Credential Access,Aquatic Panda|Indrik Spider|HAFNIUM|Fox Kitten|Operation Wocao|Kimsuky|Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|GALLIUM|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Leafminer|Magic Hound|FIN8|PLATINUM|MuddyWater|OilRig|BRONZE BUTLER|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver T1110.004,Credential Stuffing,Credential Access,Chimera T1110.003,Password Spraying,Credential Access,Sandworm Team|APT29|Silent Librarian|Chimera|APT28|APT33|Leafminer|Lazarus Group -T1110.002,Password Cracking,Credential Access,FIN6|APT41|Dragonfly 2.0|APT3 +T1110.002,Password Cracking,Credential Access,Dragonfly|FIN6|APT41|Dragonfly 2.0|APT3 T1110.001,Password Guessing,Credential Access,APT28 -T1021.006,Windows Remote Management,Lateral Movement,APT29|Chimera|Wizard Spider|Threat Group-3390 -T1021.005,VNC,Lateral Movement,FIN7|Fox Kitten|GCMAN -T1021.004,SSH,Lateral Movement,TeamTNT|FIN7|Fox Kitten|Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN +T1021.006,Windows Remote Management,Lateral Movement,APT29|UNC2452|Chimera|Wizard Spider|Threat Group-3390 +T1021.005,VNC,Lateral Movement,Gamaredon Group|FIN7|Fox Kitten|GCMAN +T1021.004,SSH,Lateral Movement,BlackTech|Lazarus Group|TeamTNT|FIN7|Fox Kitten|Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN T1021.003,Distributed Component Object Model,Lateral Movement,no -T1021.002,SMB/Windows Admin Shares,Lateral Movement,Sandworm Team|APT28|Fox Kitten|APT41|Operation Wocao|Wizard Spider|Chimera|Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang -T1021.001,Remote Desktop Protocol,Lateral Movement,Kimsuky|FIN7|Fox Kitten|Chimera|Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|FIN10|menuPass|Patchwork|FIN6|Lazarus Group|APT1|Axiom +T1021.002,SMB/Windows Admin Shares,Lateral Movement,APT29|Sandworm Team|APT28|Fox Kitten|APT41|Operation Wocao|Wizard Spider|Chimera|Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang +T1021.001,Remote Desktop Protocol,Lateral Movement,APT29|Dragonfly|Kimsuky|FIN7|Fox Kitten|Chimera|Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|FIN10|menuPass|Patchwork|FIN6|Lazarus Group|APT1|Axiom T1554,Compromise Client Software Binary,Persistence,no T1036.006,Space after Filename,Defense Evasion,no -T1036.005,Match Legitimate Name or Location,Defense Evasion,APT28|Ferocious Kitten|FIN7|BackdoorDiplomacy|Transparent Tribe|Naikon|APT29|Mustang Panda|Sidewinder|Darkhotel|Lazarus Group|Indrik Spider|Fox Kitten|Machete|Chimera|PROMETHIUM|Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|Sowbug|BRONZE BUTLER|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1 -T1036.004,Masquerade Task or Service,Defense Evasion,BackdoorDiplomacy|APT41|Naikon|ZIRCONIUM|APT29|Higaisa|Fox Kitten|Kimsuky|PROMETHIUM|Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7 -T1036.003,Rename System Utilities,Defense Evasion,menuPass|APT32|GALLIUM +T1036.005,Match Legitimate Name or Location,Defense Evasion,Ke3chang|Kimsuky|Gamaredon Group|WIRTE|APT28|Ferocious Kitten|FIN7|BackdoorDiplomacy|Transparent Tribe|Naikon|APT29|Mustang Panda|Sidewinder|Darkhotel|Lazarus Group|Indrik Spider|UNC2452|Fox Kitten|Machete|Chimera|PROMETHIUM|Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|Sowbug|BRONZE BUTLER|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1 +T1036.004,Masquerade Task or Service,Defense Evasion,Lazarus Group|BackdoorDiplomacy|APT41|Naikon|ZIRCONIUM|APT29|Higaisa|UNC2452|Fox Kitten|Kimsuky|PROMETHIUM|Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7 +T1036.003,Rename System Utilities,Defense Evasion,Lazarus Group|menuPass|APT32|GALLIUM T1036.002,Right-to-Left Override,Defense Evasion,Ferocious Kitten|BRONZE BUTLER|BlackTech|Ke3chang|Scarlet Mimic T1036.001,Invalid Code Signature,Defense Evasion,Windshift|APT37 T1553.003,SIP and Trust Provider Hijacking,Defense Evasion,no -T1553.002,Code Signing,Defense Evasion,menuPass|APT29|GALLIUM|Wizard Spider|Kimsuky|PROMETHIUM|Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel +T1553.002,Code Signing,Defense Evasion,Lazarus Group|menuPass|APT29|GALLIUM|UNC2452|Wizard Spider|Kimsuky|PROMETHIUM|Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel T1553.001,Gatekeeper Bypass,Defense Evasion,no -T1553,Subvert Trust Controls,Defense Evasion,no +T1553,Subvert Trust Controls,Defense Evasion,Axiom T1027.003,Steganography,Defense Evasion,Andariel|Leviathan|TA551|BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37 -T1027.002,Software Packing,Defense Evasion,Sandworm Team|Kimsuky|TeamTNT|ZIRCONIUM|TA505|Rocke|GALLIUM|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon +T1027.002,Software Packing,Defense Evasion,Threat Group-3390|Lazarus Group|Sandworm Team|Kimsuky|TeamTNT|ZIRCONIUM|TA505|Rocke|GALLIUM|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon T1027.001,Binary Padding,Defense Evasion,APT29|Mustang Panda|Higaisa|Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee T1222.002,Linux and Mac File and Directory Permissions Modification,Defense Evasion,TeamTNT|Rocke|APT32 T1222.001,Windows File and Directory Permissions Modification,Defense Evasion,Wizard Spider -T1552.004,Private Keys,Credential Access,TeamTNT|APT29|Operation Wocao|Rocke +T1552.004,Private Keys,Credential Access,TeamTNT|APT29|UNC2452|Operation Wocao|Rocke T1552.003,Bash History,Credential Access,no T1552.002,Credentials in Registry,Credential Access,APT32 -T1552.001,Credentials In Files,Credential Access,TeamTNT|Kimsuky|Fox Kitten|Leafminer|APT33|OilRig|TA505|MuddyWater|APT3 +T1552.001,Credentials In Files,Credential Access,TeamTNT|Kimsuky|Fox Kitten|Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3 T1552,Unsecured Credentials,Credential Access,no T1216.001,PubPrn,Defense Evasion,APT32 -T1070.006,Timestomp,Defense Evasion,APT38|APT29|Chimera|Kimsuky|Rocke|TEMP.Veles|APT32|Lazarus Group|APT28 +T1070.006,Timestomp,Defense Evasion,APT38|APT29|UNC2452|Chimera|Kimsuky|Rocke|TEMP.Veles|APT32|Lazarus Group|APT28 T1070.005,Network Share Connection Removal,Defense Evasion,Threat Group-3390 -T1070.004,File Deletion,Defense Evasion,TeamTNT|APT39|Mustang Panda|Chimera|Evilnum|Operation Wocao|FIN6|Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Cobalt Group|Dragonfly 2.0|Honeybee|Patchwork|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|APT3|Magic Hound|Threat Group-3390|APT28|FIN10|Group5|Lazarus Group|APT18|APT29 -T1070.003,Clear Command History,Defense Evasion,TeamTNT|menuPass|APT41 -T1550.004,Web Session Cookie,Defense Evasion|Lateral Movement,APT29 -T1550.001,Application Access Token,Defense Evasion|Lateral Movement,APT28 +T1070.004,File Deletion,Defense Evasion,Aquatic Panda|Dragonfly|TeamTNT|APT39|Mustang Panda|Chimera|Evilnum|UNC2452|Operation Wocao|FIN6|Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Cobalt Group|Dragonfly 2.0|Honeybee|Patchwork|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|APT3|Magic Hound|Threat Group-3390|APT28|FIN10|Group5|Lazarus Group|APT18|APT29 +T1070.003,Clear Command History,Defense Evasion,Lazarus Group|TeamTNT|menuPass|APT41 +T1550.004,Web Session Cookie,Defense Evasion|Lateral Movement,APT29|UNC2452 +T1550.001,Application Access Token,Defense Evasion|Lateral Movement,APT29|APT28 T1550.003,Pass the Ticket,Defense Evasion|Lateral Movement,APT32|BRONZE BUTLER|APT29 T1550.002,Pass the Hash,Defense Evasion|Lateral Movement,Chimera|Kimsuky|GALLIUM|APT32|Night Dragon|APT28|APT1 -T1550,Use Alternate Authentication Material,Defense Evasion|Lateral Movement,APT29 +T1550,Use Alternate Authentication Material,Defense Evasion|Lateral Movement,APT29|UNC2452 T1548.004,Elevated Execution with Prompt,Privilege Escalation|Defense Evasion,no T1548.003,Sudo and Sudo Caching,Privilege Escalation|Defense Evasion,no T1548.002,Bypass User Account Control,Privilege Escalation|Defense Evasion,Evilnum|APT37|MuddyWater|Threat Group-3390|Honeybee|Cobalt Group|BRONZE BUTLER|Patchwork|APT29 T1548.001,Setuid and Setgid,Privilege Escalation|Defense Evasion,no T1548,Abuse Elevation Control Mechanism,Privilege Escalation|Defense Evasion,no -T1136.003,Cloud Account,Persistence,no +T1136.003,Cloud Account,Persistence,APT29 T1070.002,Clear Linux or Mac System Logs,Defense Evasion,TeamTNT|Rocke -T1070.001,Clear Windows Event Logs,Defense Evasion,Indrik Spider|Chimera|Operation Wocao|APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28 +T1070.001,Clear Windows Event Logs,Defense Evasion,Dragonfly|Indrik Spider|Chimera|Operation Wocao|APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28 T1136.002,Domain Account,Persistence,Sandworm Team|HAFNIUM|GALLIUM -T1136.001,Local Account,Persistence,TeamTNT|Fox Kitten|APT39|APT41|Leafminer|Dragonfly 2.0|APT3 +T1136.001,Local Account,Persistence,Kimsuky|Dragonfly|TeamTNT|Fox Kitten|APT39|APT41|Leafminer|Dragonfly 2.0|APT3 T1547.011,Plist Modification,Persistence|Privilege Escalation,no T1547.010,Port Monitors,Persistence|Privilege Escalation,no -T1547.009,Shortcut Modification,Persistence|Privilege Escalation,APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Lazarus Group|Leviathan +T1547.009,Shortcut Modification,Persistence|Privilege Escalation,Dragonfly|APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Lazarus Group|Leviathan T1547.008,LSASS Driver,Persistence|Privilege Escalation,no T1547.007,Re-opened Applications,Persistence|Privilege Escalation,no T1547.006,Kernel Modules and Extensions,Persistence|Privilege Escalation,no @@ -382,30 +394,30 @@ T1546.007,Netsh Helper DLL,Privilege Escalation|Persistence,no T1546.006,LC_LOAD_DYLIB Addition,Privilege Escalation|Persistence,no T1546.005,Trap,Privilege Escalation|Persistence,no T1546.004,Unix Shell Configuration Modification,Privilege Escalation|Persistence,no -T1546.003,Windows Management Instrumentation Event Subscription,Privilege Escalation|Persistence,FIN8|Mustang Panda|APT33|Blue Mockingbird|Turla|Leviathan|APT29 +T1546.003,Windows Management Instrumentation Event Subscription,Privilege Escalation|Persistence,FIN8|Mustang Panda|UNC2452|APT33|Blue Mockingbird|Turla|Leviathan|APT29 T1546.002,Screensaver,Privilege Escalation|Persistence,no T1546.001,Change Default File Association,Privilege Escalation|Persistence,Kimsuky -T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,TeamTNT|Naikon|Windshift|Mustang Panda|ZIRCONIUM|Higaisa|Sidewinder|APT28|Wizard Spider|PROMETHIUM|Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Kimsuky|APT33|APT39|APT32|APT18|Dark Caracal|Threat Group-3390|Honeybee|Turla|Cobalt Group|Ke3chang|Dragonfly 2.0|APT19|Gorgon Group|MuddyWater|APT37|Leviathan|BRONZE BUTLER|APT3|Magic Hound|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel +T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,Confucius|Dragonfly|LazyScripter|TeamTNT|Naikon|Windshift|Mustang Panda|ZIRCONIUM|Higaisa|Sidewinder|APT28|Wizard Spider|PROMETHIUM|Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Kimsuky|APT33|APT39|APT32|APT18|Dark Caracal|Threat Group-3390|Honeybee|Turla|Cobalt Group|Ke3chang|Dragonfly 2.0|APT19|Gorgon Group|MuddyWater|APT37|Leviathan|BRONZE BUTLER|APT3|Magic Hound|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel T1218.002,Control Panel,Defense Evasion,no -T1218.010,Regsvr32,Defense Evasion,TA551|Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda +T1218.010,Regsvr32,Defense Evasion,Kimsuky|Lazarus Group|TA551|Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda T1218.009,Regsvcs/Regasm,Defense Evasion,no -T1218.005,Mshta,Defense Evasion,Mustang Panda|TA551|Sidewinder|Inception|Kimsuky|APT32|MuddyWater|FIN7 +T1218.005,Mshta,Defense Evasion,Gamaredon Group|Confucius|Lazarus Group|APT29|LazyScripter|Mustang Panda|TA551|Sidewinder|Inception|Kimsuky|APT32|MuddyWater|FIN7 T1218.004,InstallUtil,Defense Evasion,Mustang Panda|menuPass -T1218.001,Compiled HTML File,Defense Evasion,APT41|Silence|Dark Caracal|OilRig|Lazarus Group +T1218.001,Compiled HTML File,Defense Evasion,APT38|APT41|Silence|Dark Caracal|OilRig|Lazarus Group T1218.003,CMSTP,Defense Evasion,Cobalt Group|MuddyWater -T1218.011,Rundll32,Defense Evasion,APT38|HAFNIUM|TA551|APT41|Gamaredon Group|APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28 +T1218.011,Rundll32,Defense Evasion,Kimsuky|Lazarus Group|LazyScripter|APT38|HAFNIUM|TA551|UNC2452|APT41|Gamaredon Group|APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28 T1547,Boot or Logon Autostart Execution,Persistence|Privilege Escalation,no T1546,Event Triggered Execution,Privilege Escalation|Persistence,no -T1098.003,Add Office 365 Global Administrator Role,Persistence,no -T1098.002,Exchange Email Delegate Permissions,Persistence,APT28|APT29|Magic Hound -T1098.001,Additional Cloud Credentials,Persistence,APT29 +T1098.003,Add Office 365 Global Administrator Role,Persistence,APT29 +T1098.002,Exchange Email Delegate Permissions,Persistence,APT28|APT29|UNC2452|Magic Hound +T1098.001,Additional Cloud Credentials,Persistence,APT29|UNC2452 T1543.004,Launch Daemon,Persistence|Privilege Escalation,no T1543.003,Windows Service,Persistence|Privilege Escalation,TeamTNT|APT38|PROMETHIUM|Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|FIN7|APT19|Threat Group-3390|Honeybee|APT3|Lazarus Group|Carbanak T1543.002,Systemd Service,Persistence|Privilege Escalation,TeamTNT|Rocke T1543.001,Launch Agent,Persistence|Privilege Escalation,no T1037.005,Startup Items,Persistence|Privilege Escalation,no T1037.004,RC Scripts,Persistence|Privilege Escalation,no -T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Threat Group-3390|menuPass|Gorgon Group|Patchwork +T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Kimsuky|Threat Group-3390|menuPass|Gorgon Group|Patchwork T1055.013,Process Doppelgänging,Defense Evasion|Privilege Escalation,Leafminer T1055.011,Extra Window Memory Injection,Defense Evasion|Privilege Escalation,no T1055.014,VDSO Hijacking,Defense Evasion|Privilege Escalation,no @@ -423,12 +435,13 @@ T1037.001,Logon Script (Windows),Persistence|Privilege Escalation,Cobalt Group|A T1542.003,Bootkit,Persistence|Defense Evasion,APT41|Lazarus Group|APT28 T1542.002,Component Firmware,Persistence|Defense Evasion,Equation T1542.001,System Firmware,Persistence|Defense Evasion,no -T1505.003,Web Shell,Persistence,BackdoorDiplomacy|APT38|APT29|APT28|Tonto Team|Sandworm Team|HAFNIUM|Volatile Cedar|Fox Kitten|Operation Wocao|Kimsuky|Tropic Trooper|GALLIUM|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda +T1505.003,Web Shell,Persistence,Dragonfly|BackdoorDiplomacy|APT38|APT29|APT28|Tonto Team|Sandworm Team|HAFNIUM|Volatile Cedar|Fox Kitten|Operation Wocao|Kimsuky|Tropic Trooper|GALLIUM|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda T1505.002,Transport Agent,Persistence,no T1505.001,SQL Stored Procedures,Persistence,Sandworm Team T1053.003,Cron,Execution|Persistence|Privilege Escalation,APT38|Rocke +T1053.004,Launchd,Execution|Persistence|Privilege Escalation,no T1053.001,At (Linux),Execution|Persistence|Privilege Escalation,no -T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,APT37|APT38|Naikon|CostaRicto|Mustang Panda|Higaisa|Fox Kitten|Molerats|Machete|Operation Wocao|Chimera|Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|GALLIUM|Silence|TEMP.Veles|APT33|APT39|Rancor|OilRig|Patchwork|Dragonfly 2.0|Cobalt Group|FIN8|menuPass|FIN10|FIN7|APT32|Stealth Falcon|FIN6|APT3|APT29 +T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,Kimsuky|Lazarus Group|Confucius|Dragonfly|APT37|APT38|Naikon|CostaRicto|Mustang Panda|Higaisa|UNC2452|Fox Kitten|Molerats|Machete|Operation Wocao|Chimera|Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|GALLIUM|Silence|TEMP.Veles|APT33|APT39|Rancor|OilRig|Patchwork|Dragonfly 2.0|Cobalt Group|FIN8|menuPass|FIN10|FIN7|APT32|Stealth Falcon|FIN6|APT3|APT29 T1053.002,At (Windows),Execution|Persistence|Privilege Escalation,BRONZE BUTLER|Threat Group-3390|APT18 T1542,Pre-OS Boot,Defense Evasion|Persistence,no T1137.001,Office Template Macros,Persistence,MuddyWater @@ -438,11 +451,11 @@ T1137.005,Outlook Rules,Persistence,no T1137.006,Add-ins,Persistence,Naikon T1137.002,Office Test,Persistence,APT28 T1531,Account Access Removal,Impact,no -T1539,Steal Web Session Cookie,Credential Access,Evilnum +T1539,Steal Web Session Cookie,Credential Access,APT29|Evilnum T1529,System Shutdown/Reboot,Impact,Lazarus Group|APT38|APT37 T1518,Software Discovery,Discovery,Mustang Panda|Windshift|MuddyWater|Windigo|Sidewinder|Operation Wocao|BRONZE BUTLER|Tropic Trooper|Inception T1547.013,XDG Autostart Entries,Persistence|Privilege Escalation,no -T1534,Internal Spearphishing,Lateral Movement,Leviathan|Gamaredon Group +T1534,Internal Spearphishing,Lateral Movement,Kimsuky|Lazarus Group|Leviathan|Gamaredon Group T1528,Steal Application Access Token,Credential Access,APT28 T1535,Unused/Unsupported Cloud Regions,Defense Evasion,no T1525,Implant Internal Image,Persistence,no @@ -461,42 +474,45 @@ T1491,Defacement,Impact,no T1490,Inhibit System Recovery,Impact,no T1489,Service Stop,Impact,Indrik Spider|Wizard Spider|Lazarus Group T1486,Data Encrypted for Impact,Impact,FIN7|Indrik Spider|APT41|TA505|APT38 -T1485,Data Destruction,Impact,Sandworm Team|Lazarus Group|APT38 +T1485,Data Destruction,Impact,Gamaredon Group|Sandworm Team|Lazarus Group|APT38 T1484,Domain Policy Modification,Defense Evasion|Privilege Escalation,no -T1482,Domain Trust Discovery,Discovery,FIN8|APT29|Chimera +T1482,Domain Trust Discovery,Discovery,FIN8|APT29|Chimera|UNC2452 T1480,Execution Guardrails,Defense Evasion,no -T1221,Template Injection,Defense Evasion,Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|DarkHydrus|Dragonfly 2.0 +T1221,Template Injection,Defense Evasion,Lazarus Group|Confucius|Dragonfly|Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|DarkHydrus|Dragonfly 2.0 T1222,File and Directory Permissions Modification,Defense Evasion,no -T1220,XSL Script Processing,Defense Evasion,Higaisa|Cobalt Group +T1220,XSL Script Processing,Defense Evasion,Lazarus Group|Higaisa|Cobalt Group T1217,Browser Bookmark Discovery,Discovery,APT38|Chimera|Fox Kitten T1212,Exploitation for Credential Access,Credential Access,no -T1189,Drive-by Compromise,Initial Access,Transparent Tribe|Andariel|Leviathan|Machete|Windigo|Dragonfly|PROMETHIUM|Turla|Windshift|RTM|Darkhotel|APT38|APT19|Lazarus Group|Threat Group-3390|BRONZE BUTLER|APT32|Dark Caracal|Dragonfly 2.0|Leafminer|Patchwork|APT37|Elderwood|PLATINUM +T1189,Drive-by Compromise,Initial Access,Magic Hound|APT28|Axiom|Transparent Tribe|Andariel|Leviathan|Machete|Windigo|Dragonfly|PROMETHIUM|Turla|Windshift|RTM|Darkhotel|APT38|APT19|Lazarus Group|Threat Group-3390|BRONZE BUTLER|APT32|Dark Caracal|Dragonfly 2.0|Leafminer|Patchwork|APT37|Elderwood|PLATINUM T1211,Exploitation for Defense Evasion,Defense Evasion,APT28 T1197,BITS Jobs,Defense Evasion|Persistence,APT39|Patchwork|APT41|Leviathan -T1203,Exploitation for Client Execution,Execution,Andariel|Transparent Tribe|APT3|Tonto Team|Mustang Panda|Darkhotel|Higaisa|HAFNIUM|Sidewinder|Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Cobalt Group|Lazarus Group|Patchwork|Elderwood|APT29|TA459|APT37|Leviathan +T1203,Exploitation for Client Execution,Execution,Axiom|Confucius|Dragonfly|Andariel|Transparent Tribe|APT3|Tonto Team|Mustang Panda|Darkhotel|Higaisa|HAFNIUM|Sidewinder|Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Cobalt Group|Lazarus Group|Patchwork|Elderwood|APT29|TA459|APT37|Leviathan T1201,Password Policy Discovery,Discovery,Chimera|Turla|OilRig T1195,Supply Chain Compromise,Initial Access,no -T1199,Trusted Relationship,Initial Access,APT29|Sandworm Team|GOLD SOUTHFIELD|APT28|menuPass -T1218,Signed Binary Proxy Execution,Defense Evasion,no +T1199,Trusted Relationship,Initial Access,Threat Group-3390|APT29|Sandworm Team|GOLD SOUTHFIELD|APT28|menuPass +T1218,Signed Binary Proxy Execution,Defense Evasion,Lazarus Group T1204,User Execution,Execution,no -T1213,Data from Information Repositories,Collection,APT28|Fox Kitten|FIN6|Turla -T1190,Exploit Public-Facing Application,Initial Access,BackdoorDiplomacy|menuPass|Volatile Cedar|Fox Kitten|Operation Wocao|APT28|APT29|GOLD SOUTHFIELD|Blue Mockingbird|Rocke|APT39|BlackTech|APT41|GALLIUM|Night Dragon|Axiom -T1210,Exploitation of Remote Services,Lateral Movement,Tonto Team|FIN7|Fox Kitten|menuPass|Wizard Spider|Threat Group-3390|APT28 +T1213,Data from Information Repositories,Collection,APT29|APT28|Fox Kitten|FIN6|Turla +T1190,Exploit Public-Facing Application,Initial Access,Threat Group-3390|Ke3chang|Kimsuky|Magic Hound|Dragonfly|BackdoorDiplomacy|menuPass|Volatile Cedar|UNC2452|Fox Kitten|Operation Wocao|APT28|APT29|GOLD SOUTHFIELD|Blue Mockingbird|Rocke|APT39|BlackTech|APT41|GALLIUM|Night Dragon|Axiom +T1210,Exploitation of Remote Services,Lateral Movement,Dragonfly|Tonto Team|FIN7|Fox Kitten|menuPass|Wizard Spider|Threat Group-3390|APT28 T1200,Hardware Additions,Initial Access,DarkVishnya -T1202,Indirect Command Execution,Defense Evasion,no +T1202,Indirect Command Execution,Defense Evasion,Lazarus Group T1219,Remote Access Software,Command And Control,TeamTNT|Mustang Panda|MuddyWater|Evilnum|GOLD SOUTHFIELD|Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Cobalt Group|Thrip|Carbanak T1207,Rogue Domain Controller,Defense Evasion,no T1216,Signed Script Proxy Execution,Defense Evasion,no T1205,Traffic Signaling,Defense Evasion|Persistence|Command And Control,no -T1176,Browser Extensions,Persistence,Kimsuky -T1187,Forced Authentication,Credential Access,DarkHydrus|Dragonfly 2.0 +T1176,Browser Extensions,Persistence,Kimsuky|Stolen Pencil +T1187,Forced Authentication,Credential Access,Dragonfly|DarkHydrus|Dragonfly 2.0 +T1175,Component Object Model and Distributed COM,Lateral Movement|Execution,no T1185,Browser Session Hijacking,Collection,no -T1140,Deobfuscate/Decode Files or Information,Defense Evasion,APT39|APT29|ZIRCONIUM|Higaisa|Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|Honeybee|Gorgon Group|Threat Group-3390|menuPass|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER +T1140,Deobfuscate/Decode Files or Information,Defense Evasion,Lazarus Group|Ke3chang|Kimsuky|APT39|APT29|ZIRCONIUM|Higaisa|UNC2452|Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|Honeybee|Gorgon Group|Threat Group-3390|menuPass|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,FIN6|Blue Mockingbird +T1149,LC_MAIN Hijacking,Defense Evasion,no T1136,Create Account,Persistence,Sandworm Team|Indrik Spider -T1135,Network Share Discovery,Discovery,Tonto Team|APT38|Chimera|Operation Wocao|Wizard Spider|APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug +T1135,Network Share Discovery,Discovery,Dragonfly|Tonto Team|APT38|Chimera|Operation Wocao|Wizard Spider|APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug T1137,Office Application Startup,Persistence,Gamaredon Group|APT32 -T1133,External Remote Services,Persistence|Initial Access,TeamTNT|Leviathan|APT28|APT29|Operation Wocao|Wizard Spider|Kimsuky|GOLD SOUTHFIELD|Chimera|Sandworm Team|APT41|GALLIUM|TEMP.Veles|Night Dragon|Ke3chang|OilRig|Dragonfly 2.0|FIN5|Threat Group-3390|APT18 +T1153,Source,Execution,no +T1133,External Remote Services,Persistence|Initial Access,Dragonfly|TeamTNT|Leviathan|APT28|APT29|UNC2452|Operation Wocao|Wizard Spider|Kimsuky|GOLD SOUTHFIELD|Chimera|Sandworm Team|APT41|GALLIUM|TEMP.Veles|Night Dragon|Ke3chang|OilRig|Dragonfly 2.0|FIN5|Threat Group-3390|APT18 T1132,Data Encoding,Command And Control,no T1129,Shared Modules,Execution,no T1127,Trusted Developer Utilities Proxy Execution,Defense Evasion,no @@ -504,64 +520,72 @@ T1125,Video Capture,Collection,Silence|FIN7 T1124,System Time Discovery,Discovery,Darkhotel|ZIRCONIUM|Higaisa|Sidewinder|Chimera|Operation Wocao|The White Company|Lazarus Group|BRONZE BUTLER|Turla T1123,Audio Capture,Collection,APT37 T1120,Peripheral Device Discovery,Discovery,OilRig|BackdoorDiplomacy|Operation Wocao|Turla|APT37|Gamaredon Group|Equation|APT28 -T1119,Automated Collection,Collection,Mustang Panda|Sidewinder|Chimera|menuPass|Operation Wocao|Gamaredon Group|Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6 +T1119,Automated Collection,Collection,Ke3chang|Confucius|Mustang Panda|Sidewinder|Chimera|menuPass|Operation Wocao|Gamaredon Group|Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6 T1115,Clipboard Data,Collection,Operation Wocao|APT39|APT38 T1114,Email Collection,Collection,Magic Hound|Silent Librarian -T1113,Screen Capture,Collection,GOLD SOUTHFIELD|Gamaredon Group|APT39|Silence|MuddyWater|Dragonfly 2.0|OilRig|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28 -T1112,Modify Registry,Defense Evasion,Operation Wocao|Kimsuky|Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Patchwork|Gorgon Group|Threat Group-3390|Dragonfly 2.0|APT19|Honeybee|FIN8 -T1111,Two-Factor Authentication Interception,Credential Access,Chimera|Operation Wocao -T1110,Brute Force,Credential Access,APT38|APT28|Fox Kitten|DarkVishnya|APT39|OilRig|FIN5|Turla -T1106,Native API,Execution,APT38|Higaisa|menuPass|Operation Wocao|Chimera|Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|APT37|Gorgon Group -T1105,Ingress Tool Transfer,Command And Control,TeamTNT|Nomadic Octopus|IndigoZebra|Andariel|BackdoorDiplomacy|Tonto Team|HAFNIUM|APT29|Ajax Security Team|Mustang Panda|Windshift|Darkhotel|ZIRCONIUM|TA551|Volatile Cedar|Indrik Spider|Evilnum|Sidewinder|Fox Kitten|Kimsuky|Operation Wocao|Chimera|Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|GALLIUM|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Gorgon Group|OilRig|Turla|Cobalt Group|Dragonfly 2.0|FIN8|PLATINUM|APT37|Elderwood|Leviathan|APT32|Magic Hound|BRONZE BUTLER|APT3|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28 -T1104,Multi-Stage Channels,Command And Control,APT41|MuddyWater|APT3 -T1102,Web Service,Command And Control,TeamTNT|FIN8|Fox Kitten|Turla|APT32|Gamaredon Group|Rocke|Inception|FIN6 -T1098,Account Manipulation,Persistence,Sandworm Team|APT3|Dragonfly 2.0|Lazarus Group +T1113,Screen Capture,Collection,Dragonfly|GOLD SOUTHFIELD|Gamaredon Group|APT39|Silence|MuddyWater|Dragonfly 2.0|OilRig|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28 +T1112,Modify Registry,Defense Evasion,Dragonfly|Operation Wocao|Kimsuky|Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Patchwork|Gorgon Group|Threat Group-3390|Dragonfly 2.0|APT19|Honeybee|FIN8 +T1111,Two-Factor Authentication Interception,Credential Access,Kimsuky|Chimera|Operation Wocao +T1110,Brute Force,Credential Access,Lazarus Group|Dragonfly|APT38|APT28|Fox Kitten|DarkVishnya|APT39|OilRig|FIN5|Turla +T1108,Redundant Access,Defense Evasion|Persistence,no +T1106,Native API,Execution,BlackTech|Lazarus Group|APT38|Higaisa|menuPass|Operation Wocao|Chimera|Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|APT37|Gorgon Group +T1105,Ingress Tool Transfer,Command And Control,LazyScripter|Ke3chang|Aquatic Panda|Winnti Group|Confucius|Dragonfly|TeamTNT|Nomadic Octopus|IndigoZebra|Andariel|BackdoorDiplomacy|Tonto Team|HAFNIUM|APT29|Ajax Security Team|Mustang Panda|Windshift|Darkhotel|ZIRCONIUM|TA551|Volatile Cedar|Indrik Spider|Evilnum|Sidewinder|UNC2452|Fox Kitten|Kimsuky|Operation Wocao|Chimera|Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|GALLIUM|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Gorgon Group|OilRig|Turla|Cobalt Group|Dragonfly 2.0|FIN8|PLATINUM|APT37|Elderwood|Leviathan|APT32|Magic Hound|BRONZE BUTLER|APT3|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28 +T1104,Multi-Stage Channels,Command And Control,Lazarus Group|APT41|MuddyWater|APT3 +T1102,Web Service,Command And Control,Mustang Panda|LazyScripter|TeamTNT|FIN8|Fox Kitten|Turla|APT32|Gamaredon Group|Rocke|Inception|FIN6 +T1098,Account Manipulation,Persistence,Kimsuky|Dragonfly|Sandworm Team|APT3|Dragonfly 2.0|Lazarus Group T1095,Non-Application Layer Protocol,Command And Control,BackdoorDiplomacy|HAFNIUM|Operation Wocao|FIN6|APT29|PLATINUM|APT3 T1092,Communication Through Removable Media,Command And Control,APT28 -T1091,Replication Through Removable Media,Lateral Movement|Initial Access,Mustang Panda|Tropic Trooper|Darkhotel|APT28 +T1091,Replication Through Removable Media,Lateral Movement|Initial Access,FIN7|Mustang Panda|Tropic Trooper|Darkhotel|APT28 T1090,Proxy,Command And Control,Windigo|Fox Kitten|Operation Wocao|Sandworm Team|Blue Mockingbird|APT41|Turla -T1087,Account Discovery,Discovery,APT29 -T1083,File and Directory Discovery,Discovery,APT38|APT29|Mustang Panda|Darkhotel|Windigo|Sidewinder|Chimera|Fox Kitten|menuPass|APT39|Sandworm Team|Operation Wocao|Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dark Caracal|Dragonfly 2.0|APT3|Sowbug|Magic Hound|BRONZE BUTLER|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang -T1082,System Information Discovery,Discovery,TeamTNT|APT38|APT29|Mustang Panda|Windshift|ZIRCONIUM|Higaisa|Windigo|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|APT32|APT37|Honeybee|APT19|Magic Hound|Sowbug|OilRig|APT3|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang +T1087,Account Discovery,Discovery,APT29|UNC2452 +T1083,File and Directory Discovery,Discovery,Winnti Group|Confucius|Dragonfly|APT38|APT29|Mustang Panda|Darkhotel|Windigo|Sidewinder|Chimera|UNC2452|Fox Kitten|menuPass|APT39|Sandworm Team|Operation Wocao|Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dark Caracal|Dragonfly 2.0|APT3|Sowbug|Magic Hound|BRONZE BUTLER|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang +T1082,System Information Discovery,Discovery,Aquatic Panda|Confucius|TeamTNT|APT38|APT29|Mustang Panda|Windshift|ZIRCONIUM|Higaisa|Windigo|Sidewinder|UNC2452|Chimera|Operation Wocao|Wizard Spider|Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|APT32|APT37|Honeybee|APT19|Magic Hound|Sowbug|OilRig|APT3|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang T1080,Taint Shared Content,Lateral Movement,Gamaredon Group|BRONZE BUTLER|Darkhotel -T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,FIN7|Leviathan|APT29|Silent Librarian|Fox Kitten|Operation Wocao|Chimera|Sandworm Team|Wizard Spider|Silence|APT41|GALLIUM|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|APT33|FIN5|OilRig|APT28|menuPass|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak +T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Ke3chang|Lazarus Group|Axiom|Dragonfly|FIN7|Leviathan|APT29|Silent Librarian|UNC2452|Fox Kitten|Operation Wocao|Chimera|Sandworm Team|Wizard Spider|Silence|APT41|GALLIUM|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|APT33|FIN5|OilRig|APT28|menuPass|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak T1074,Data Staged,Collection,Wizard Spider T1072,Software Deployment Tools,Execution|Lateral Movement,Silence|APT32|Threat Group-1314 -T1071,Application Layer Protocol,Command And Control,TeamTNT|Rocke|Magic Hound|Dragonfly 2.0 -T1070,Indicator Removal on Host,Defense Evasion,APT29 -T1069,Permission Groups Discovery,Discovery,APT29|TA505|APT3 -T1068,Exploitation for Privilege Escalation,Privilege Escalation,Tonto Team|ZIRCONIUM|Turla|Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28 -T1059,Command and Scripting Interpreter,Execution,APT37|Windigo|Fox Kitten|APT32|Whitefly|APT39|Dragonfly 2.0|FIN7|APT19|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang -T1057,Process Discovery,Discovery,TeamTNT|Andariel|APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|Chimera|Operation Wocao|Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang +T1071,Application Layer Protocol,Command And Control,Dragonfly|TeamTNT|Rocke|Magic Hound|Dragonfly 2.0 +T1070,Indicator Removal on Host,Defense Evasion,Lazarus Group|APT29|UNC2452 +T1069,Permission Groups Discovery,Discovery,APT29|UNC2452|TA505|APT3 +T1068,Exploitation for Privilege Escalation,Privilege Escalation,APT29|Tonto Team|ZIRCONIUM|Turla|Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28 +T1064,Scripting,Defense Evasion|Execution,no +T1062,Hypervisor,Persistence,no +T1061,Graphical User Interface,Execution,no +T1059,Command and Scripting Interpreter,Execution,Dragonfly|APT37|Windigo|Fox Kitten|APT32|Whitefly|APT39|Dragonfly 2.0|FIN7|APT19|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang +T1057,Process Discovery,Discovery,Gamaredon Group|Kimsuky|TeamTNT|Andariel|APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|Chimera|UNC2452|Operation Wocao|Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang T1056,Input Capture,Collection|Credential Access,APT39 T1055,Process Injection,Defense Evasion|Privilege Escalation,Operation Wocao|APT32|Sharpshooter|Silence|APT41|Kimsuky|Cobalt Group|Turla|APT37|Honeybee|PLATINUM T1053,Scheduled Task/Job,Execution|Persistence|Privilege Escalation,no T1052,Exfiltration Over Physical Medium,Exfiltration,no -T1049,System Network Connections Discovery,Discovery,TeamTNT|Andariel|BackdoorDiplomacy|Mustang Panda|MuddyWater|Chimera|Sandworm Team|Operation Wocao|Tropic Trooper|APT41|APT38|GALLIUM|APT32|APT1|OilRig|APT3|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang +T1051,Shared Webroot,Lateral Movement,no +T1049,System Network Connections Discovery,Discovery,Lazarus Group|TeamTNT|Andariel|BackdoorDiplomacy|Mustang Panda|MuddyWater|Chimera|Sandworm Team|Operation Wocao|Tropic Trooper|APT41|APT38|GALLIUM|APT32|APT1|OilRig|APT3|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang T1048,Exfiltration Over Alternative Protocol,Exfiltration,no -T1047,Windows Management Instrumentation,Execution,Sandworm Team|FIN7|Indrik Spider|Naikon|Mustang Panda|Windshift|Operation Wocao|Chimera|Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|GALLIUM|APT32|MuddyWater|Threat Group-3390|OilRig|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda -T1046,Network Service Scanning,Discovery,TeamTNT|BackdoorDiplomacy|Naikon|CostaRicto|Chimera|Fox Kitten|Operation Wocao|Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|OilRig|Cobalt Group|Leafminer|menuPass|Suckfly|FIN6|Threat Group-3390 -T1041,Exfiltration Over C2 Channel,Exfiltration,Leviathan|ZIRCONIUM|Higaisa|Chimera|APT39|Operation Wocao|Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|GALLIUM|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang -T1040,Network Sniffing,Credential Access|Discovery,Kimsuky|Sandworm Team|DarkVishnya|APT33|APT28 +T1047,Windows Management Instrumentation,Execution,Gamaredon Group|Sandworm Team|FIN7|Indrik Spider|Naikon|Mustang Panda|Windshift|UNC2452|Operation Wocao|Chimera|Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|GALLIUM|APT32|MuddyWater|Threat Group-3390|OilRig|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda +T1046,Network Service Scanning,Discovery,BlackTech|Lazarus Group|TeamTNT|BackdoorDiplomacy|Naikon|CostaRicto|Chimera|Fox Kitten|Operation Wocao|Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|OilRig|Cobalt Group|Leafminer|menuPass|Suckfly|FIN6|Threat Group-3390 +T1043,Commonly Used Port,Command And Control,OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|FIN7|APT19|Dragonfly 2.0|FIN8|APT37|APT3|Magic Hound|Lazarus Group|Threat Group-3390 +T1041,Exfiltration Over C2 Channel,Exfiltration,Confucius|Leviathan|ZIRCONIUM|Higaisa|Chimera|APT39|Operation Wocao|Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|GALLIUM|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang +T1040,Network Sniffing,Credential Access|Discovery,Kimsuky|Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28 T1039,Data from Network Shared Drive,Collection,APT28|Chimera|Fox Kitten|Gamaredon Group|BRONZE BUTLER|Sowbug|menuPass T1037,Boot or Logon Initialization Scripts,Persistence|Privilege Escalation,Rocke -T1036,Masquerading,Defense Evasion,APT28|Nomadic Octopus|OilRig|APT29|ZIRCONIUM|TA551|Windshift|APT32|BRONZE BUTLER|menuPass|PLATINUM|Dragonfly 2.0 -T1033,System Owner/User Discovery,Discovery,APT38|Windshift|ZIRCONIUM|Sidewinder|Chimera|Sandworm Team|Operation Wocao|Wizard Spider|Frankenstein|APT41|GALLIUM|Tropic Trooper|APT39|MuddyWater|APT37|Dragonfly 2.0|APT19|APT32|Magic Hound|OilRig|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3 +T1036,Masquerading,Defense Evasion,Kimsuky|Lazarus Group|Dragonfly|LazyScripter|APT28|Nomadic Octopus|OilRig|APT29|ZIRCONIUM|TA551|UNC2452|Windshift|APT32|BRONZE BUTLER|menuPass|PLATINUM|Dragonfly 2.0 +T1034,Path Interception,Persistence|Privilege Escalation,no +T1033,System Owner/User Discovery,Discovery,Threat Group-3390|Ke3chang|Dragonfly|APT38|Windshift|ZIRCONIUM|Sidewinder|Chimera|Sandworm Team|Operation Wocao|Wizard Spider|Frankenstein|APT41|GALLIUM|Tropic Trooper|APT39|MuddyWater|APT37|Dragonfly 2.0|APT19|APT32|Magic Hound|OilRig|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3 T1030,Data Transfer Size Limits,Exfiltration,APT28|Threat Group-3390 T1029,Scheduled Transfer,Exfiltration,Higaisa -T1027,Obfuscated Files or Information,Defense Evasion,TeamTNT|BackdoorDiplomacy|Transparent Tribe|APT39|Mustang Panda|Windshift|TA551|Higaisa|Sidewinder|Fox Kitten|GOLD SOUTHFIELD|Operation Wocao|Kimsuky|FIN6|Chimera|Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|GALLIUM|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Patchwork|menuPass|APT37|Threat Group-3390|Cobalt Group|Dark Caracal|Leafminer|Honeybee|APT19|BlackOasis|Leviathan|FIN8|MuddyWater|FIN7|Elderwood|OilRig|Magic Hound|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28 +T1027,Obfuscated Files or Information,Defense Evasion,Aquatic Panda|Ke3chang|LazyScripter|TeamTNT|BackdoorDiplomacy|Transparent Tribe|APT39|Mustang Panda|Windshift|TA551|Higaisa|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Operation Wocao|Kimsuky|FIN6|Chimera|Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|GALLIUM|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Patchwork|menuPass|APT37|Threat Group-3390|Cobalt Group|Dark Caracal|Leafminer|Honeybee|APT19|BlackOasis|Leviathan|FIN8|MuddyWater|FIN7|Elderwood|OilRig|Magic Hound|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28 +T1026,Multiband Communication,Command And Control,Lazarus Group T1025,Data from Removable Media,Collection,Turla|Gamaredon Group|APT28 T1021,Remote Services,Lateral Movement,no -T1020,Automated Exfiltration,Exfiltration,Sidewinder|Gamaredon Group|Tropic Trooper|Frankenstein|Honeybee -T1018,Remote System Discovery,Discovery,Indrik Spider|Naikon|APT29|Chimera|Fox Kitten|Operation Wocao|Sandworm Team|Rocke|Wizard Spider|Silence|GALLIUM|APT39|APT32|Deep Panda|Ke3chang|Threat Group-3390|Dragonfly 2.0|Leafminer|FIN8|FIN5|APT3|BRONZE BUTLER|menuPass|FIN6|Turla -T1016,System Network Configuration Discovery,Discovery,TeamTNT|ZIRCONIUM|Mustang Panda|Higaisa|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Sandworm Team|Tropic Trooper|Frankenstein|APT41|GALLIUM|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|Magic Hound|OilRig|Threat Group-3390|menuPass|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang +T1020,Automated Exfiltration,Exfiltration,Ke3chang|Sidewinder|Gamaredon Group|Tropic Trooper|Frankenstein|Honeybee +T1018,Remote System Discovery,Discovery,Dragonfly|Indrik Spider|Naikon|APT29|UNC2452|Chimera|Fox Kitten|Operation Wocao|Sandworm Team|Rocke|Wizard Spider|Silence|GALLIUM|APT39|APT32|Deep Panda|Ke3chang|Threat Group-3390|Dragonfly 2.0|Leafminer|FIN8|FIN5|APT3|BRONZE BUTLER|menuPass|FIN6|Turla +T1016,System Network Configuration Discovery,Discovery,Kimsuky|Dragonfly|TeamTNT|ZIRCONIUM|Mustang Panda|Higaisa|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Sandworm Team|Tropic Trooper|Frankenstein|APT41|GALLIUM|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|Magic Hound|OilRig|Threat Group-3390|menuPass|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang T1014,Rootkit,Defense Evasion,TeamTNT|Rocke|APT41|APT28|Winnti Group -T1012,Query Registry,Discovery,ZIRCONIUM|Chimera|Fox Kitten|APT39|Operation Wocao|APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla +T1012,Query Registry,Discovery,Kimsuky|Dragonfly|ZIRCONIUM|Chimera|Fox Kitten|APT39|Operation Wocao|APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla T1011,Exfiltration Over Other Network Medium,Exfiltration,no T1010,Application Window Discovery,Discovery,Lazarus Group T1008,Fallback Channels,Command And Control,FIN7|APT41|OilRig|Lazarus Group -T1007,System Service Discovery,Discovery,Indrik Spider|Chimera|Operation Wocao|BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang +T1007,System Service Discovery,Discovery,Kimsuky|Aquatic Panda|Indrik Spider|Chimera|Operation Wocao|BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang T1006,Direct Volume Access,Defense Evasion,no -T1005,Data from Local System,Collection,FIN7|APT41|APT38|Andariel|APT29|Windigo|Fox Kitten|Sandworm Team|Operation Wocao|FIN6|Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|GALLIUM|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang +T1005,Data from Local System,Collection,Axiom|Dragonfly|FIN7|APT41|APT38|Andariel|APT29|Windigo|UNC2452|Fox Kitten|Sandworm Team|Operation Wocao|FIN6|Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|GALLIUM|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang T1003,OS Credential Dumping,Credential Access,Tonto Team|APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom T1001,Data Obfuscation,Command And Control,Operation Wocao|Axiom diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/prohibited_apps_launching_cmd.csv b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/prohibited_apps_launching_cmd.csv index 5e4a2cf651..7ebd89b2b4 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/prohibited_apps_launching_cmd.csv +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/data/lookups/prohibited_apps_launching_cmd.csv @@ -15,3 +15,4 @@ java.exe,prohibited powershell.exe,prohibited mshta.exe, prohibited zoom.exe,prohibitied +node.exe,prohibited diff --git a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json index 27fafbee37..32eae4074f 100644 --- a/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json +++ b/bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_json_adapter_data/stories.json @@ -1 +1 @@ -{"stories": [{"name": "DarkSide Ransomware", "id": "507edc74-13d5-4339-878e-b9114ded1f35", "version": 1, "date": "2021-05-12", "author": "Bhavin Patel, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware", "narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.", "references": ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"], "tags": {"name": "DarkSide Ransomware", "analytic_story": "DarkSide Ransomware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly 2.0", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}], "mitre_attack_tactics": ["Credential Access"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule"], "investigation_names": ["ESCU - Get Parent Process Info - Response Task"], "baseline_names": ["ESCU - Baseline Of Cloud Instances Launched"], "author_company": "Splunk", "author_name": "Bhavin Patel"}]} \ No newline at end of file +{"stories": [{"name": "DarkSide Ransomware", "id": "507edc74-13d5-4339-878e-b9114ded1f35", "version": 1, "date": "2021-05-12", "author": "Bhavin Patel, Splunk", "description": "Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware", "narrative": "This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.", "references": ["https://www.splunk.com/en_us/blog/security/the-darkside-of-the-ransomware-pipeline.htmlbig-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"], "tags": {"name": "DarkSide Ransomware", "analytic_story": "DarkSide Ransomware", "category": ["Malware"], "product": ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"], "usecase": "Advanced Threat Detection", "mitre_attack_enrichments": [{"mitre_attack_id": "T1003.002", "mitre_attack_technique": "Security Account Manager", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["Dragonfly", "Dragonfly 2.0", "GALLIUM", "Ke3chang", "Night Dragon", "Threat Group-3390", "Wizard Spider", "menuPass"]}, {"mitre_attack_id": "T1003", "mitre_attack_technique": "OS Credential Dumping", "mitre_attack_tactics": ["Credential Access"], "mitre_attack_groups": ["APT28", "APT32", "APT39", "Axiom", "Frankenstein", "Leviathan", "Poseidon Group", "Sowbug", "Suckfly", "Tonto Team"]}], "mitre_attack_tactics": ["Credential Access"], "datamodels": ["Endpoint"], "kill_chain_phases": ["Actions on Objectives"]}, "detection_names": ["ESCU - Attempted Credential Dump From Registry via Reg exe - Rule"], "investigation_names": ["ESCU - Get Parent Process Info - Response Task"], "baseline_names": ["ESCU - Baseline Of Cloud Instances Launched"], "author_company": "Splunk", "author_name": "Bhavin Patel"}]} \ No newline at end of file