---
title: Malware
layout: tag
author_profile: false
taxonomy: Malware
permalink: /stories/malware/
sidebar:
  nav: "stories"
---

| Name        | Technique   | Tactic       |
| ----------- | ----------- |--------------|
| [BlackMatter Ransomware](/stories/blackmatter_ransomware/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) |
| [Clop Ransomware](/stories/clop_ransomware/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) |
| [ColdRoot MacOS RAT]() | None | None |
| [DHS Report TA18-074A](/stories/dhs_report_ta18-074a/) | [Modify Registry](/tags/#modify-registry) | [Defense Evasion](/tags/#defense-evasion) |
| [DarkSide Ransomware](/stories/darkside_ransomware/) | [Bypass User Account Control](/tags/#bypass-user-account-control), [Abuse Elevation Control Mechanism](/tags/#abuse-elevation-control-mechanism) | [Privilege Escalation](/tags/#privilege-escalation) |
| [Dynamic DNS](/stories/dynamic_dns/) | [Exfiltration Over Alternative Protocol](/tags/#exfiltration-over-alternative-protocol) | [Exfiltration](/tags/#exfiltration) |
| [Emotet Malware  DHS Report TA18-201A ](/stories/emotet_malware__dhs_report_ta18-201a_/) | [Spearphishing Attachment](/tags/#spearphishing-attachment), [Phishing](/tags/#phishing) | [Initial Access](/tags/#initial-access) |
| [FIN7](/stories/fin7/) | [XSL Script Processing](/tags/#xsl-script-processing) | [Defense Evasion](/tags/#defense-evasion) |
| [Hidden Cobra Malware](/stories/hidden_cobra_malware/) | [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares), [Remote Services](/tags/#remote-services) | [Lateral Movement](/tags/#lateral-movement) |
| [IcedID](/stories/icedid/) | [Scheduled Task](/tags/#scheduled-task), [Scheduled Task/Job](/tags/#scheduled-task/job) | [Execution](/tags/#execution) |
| [Orangeworm Attack Group](/stories/orangeworm_attack_group/) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) |
| [Ransomware](/stories/ransomware/) | [Indicator Removal on Host](/tags/#indicator-removal-on-host), [Clear Windows Event Logs](/tags/#clear-windows-event-logs) | [Defense Evasion](/tags/#defense-evasion) |
| [Ransomware Cloud](/stories/ransomware_cloud/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) |
| [Remcos](/stories/remcos/) | [Process Injection](/tags/#process-injection), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | [Defense Evasion](/tags/#defense-evasion) |
| [Revil Ransomware](/stories/revil_ransomware/) | [Signed Binary Proxy Execution](/tags/#signed-binary-proxy-execution), [CMSTP](/tags/#cmstp) | [Defense Evasion](/tags/#defense-evasion) |
| [Ryuk Ransomware](/stories/ryuk_ransomware/) | [Service Stop](/tags/#service-stop) | [Impact](/tags/#impact) |
| [SamSam Ransomware](/stories/samsam_ransomware/) | [Data Encrypted for Impact](/tags/#data-encrypted-for-impact) | [Impact](/tags/#impact) |
| [Trickbot](/stories/trickbot/) | [Remote Services](/tags/#remote-services), [SMB/Windows Admin Shares](/tags/#smb/windows-admin-shares) | [Lateral Movement](/tags/#lateral-movement) |
| [Unusual Processes](/stories/unusual_processes/) | [Process Injection](/tags/#process-injection), [Create or Modify System Process](/tags/#create-or-modify-system-process), [Parent PID Spoofing](/tags/#parent-pid-spoofing), [Access Token Manipulation](/tags/#access-token-manipulation) | [Defense Evasion](/tags/#defense-evasion) |
| [Windows File Extension and Association Abuse](/stories/windows_file_extension_and_association_abuse/) | [Masquerading](/tags/#masquerading), [Rename System Utilities](/tags/#rename-system-utilities) | [Defense Evasion](/tags/#defense-evasion) |
| [Windows Service Abuse](/stories/windows_service_abuse/) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) |
| [XMRig](/stories/xmrig/) | [Windows Service](/tags/#windows-service), [Create or Modify System Process](/tags/#create-or-modify-system-process) | [Persistence](/tags/#persistence) |