| BlackMatter Ransomware |
Credentials in Registry, Inhibit System Recovery, Defacement, Data Encrypted for Impact |
Credential Access |
| Clop Ransomware |
User Execution, Create or Modify System Process, Data Destruction, Service Execution, Inhibit System Recovery, Data Encrypted for Impact, Indicator Removal on Host, Service Stop, Clear Windows Event Logs |
Execution |
| ColdRoot MacOS RAT |
None |
None |
| DHS Report TA18-074A |
Local Account, File Transfer Protocols, SMB/Windows Admin Shares, Service Execution, PowerShell, Disable or Modify System Firewall, Registry Run Keys / Startup Folder, Windows Service, Scheduled Task, Malicious File, Modify Registry |
Persistence |
| DarkSide Ransomware |
Security Account Manager, BITS Jobs, Ingress Tool Transfer, CMSTP, Process Injection, Inhibit System Recovery, LSASS Memory, SMB/Windows Admin Shares, Automated Exfiltration, Service Execution, Data Encrypted for Impact, Bypass User Account Control |
Credential Access |
| Dynamic DNS |
Exfiltration Over Alternative Protocol, DNS, Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, Non-Application Layer Protocol, Exfiltration Over C2 Channel, Drive-by Compromise, Transfer Data to Cloud Account, Local Email Collection, Email Collection, Email Forwarding Rule, Web Protocols |
Exfiltration |
| Emotet Malware DHS Report TA18-201A |
Windows Command Shell, Software Deployment Tools, Registry Run Keys / Startup Folder, SMB/Windows Admin Shares, Spearphishing Attachment |
Execution |
| FIN7 |
System Owner/User Discovery, JavaScript, Credentials from Web Browsers, Spearphishing Attachment, XSL Script Processing |
Discovery |
| Hidden Cobra Malware |
Network Share Connection Removal, DNS, Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol, File Transfer Protocols, Remote Desktop Protocol, SMB/Windows Admin Shares |
Defense Evasion |
| IcedID |
Domain Account, Disable or Modify Tools, Command and Scripting Interpreter, Process Injection, Malicious File, Bypass User Account Control, Modify Registry, Archive via Utility, Mshta, Domain Trust Discovery, Spearphishing Attachment, Registry Run Keys / Startup Folder, Rundll32, Scheduled Task/Job, Data from Local System, Regsvr32, IP Addresses, Obfuscated Files or Information, Scheduled Task, SMB/Windows Admin Shares |
Discovery |
| Orangeworm Attack Group |
Service Execution, Process Injection, Native API, System Services, Services Registry Permissions Weakness, Windows Service |
Execution |
| Ransomware |
Archive via Utility, Disable or Modify Cloud Firewall, Abuse Elevation Control Mechanism, Service Stop, Inhibit System Recovery, CMSTP, File Deletion, Data Destruction, User Execution, Automated Exfiltration, Domain Account, Local Account, Domain Trust Discovery, Domain Groups, Local Groups, Disable or Modify Tools, Clear Windows Event Logs, Account Access Removal, Service Execution, Visual Basic, Indicator Removal on Host, File and Directory Permissions Modification, Defacement, DLL Side-Loading, Indicator Removal from Tools, Component Object Model Hijacking, Exfiltration Over Alternative Protocol, Gather Victim Host Information, Registry Run Keys / Startup Folder, Windows Management Instrumentation, Modify Registry, SMB/Windows Admin Shares, Scheduled Task, Rename System Utilities, Web Protocols, Msiexec |
Collection |
| Ransomware Cloud |
Data Encrypted for Impact |
Impact |
| Remcos |
Bypass User Account Control, Masquerading, Port Monitors, Indicator Removal on Host, Registry Run Keys / Startup Folder, Image File Execution Options Injection, Application Shimming, Screen Capture, Create or Modify System Process |
Privilege Escalation |
| Revil Ransomware |
Disable or Modify Cloud Firewall, Inhibit System Recovery, Disable or Modify Tools, Defacement, DLL Side-Loading, User Execution, Modify Registry, CMSTP |
Defense Evasion |
| Ryuk Ransomware |
Inhibit System Recovery, Data Destruction, Domain Trust Discovery, Remote Desktop Protocol, Data Encrypted for Impact, Windows Command Shell, Scheduled Task, Disable or Modify Tools, Service Stop |
Impact |
| SamSam Ransomware |
Match Legitimate Name or Location, Active Scanning, OS Credential Dumping, Service Stop, Malicious File, Data Destruction, Account Access Removal, Inhibit System Recovery, File and Directory Permissions Modification, SMB/Windows Admin Shares, Service Execution, System Information Discovery, System Network Configuration Discovery, Disable or Modify Tools, Ingress Tool Transfer, Account Discovery, Masquerading, Command and Scripting Interpreter, Regsvr32, Indirect Command Execution, Scheduled Task/Job, Exploitation for Client Execution, Software Deployment Tools, Remote Desktop Protocol, Rundll32, Data Encrypted for Impact, Windows Service, Create or Modify System Process, Rename System Utilities, Exploit Public-Facing Application |
Defense Evasion |
| Trickbot |
Domain Account, Disable or Modify Tools, Command and Scripting Interpreter, Process Injection, Malicious File, Bypass User Account Control, Modify Registry, Archive via Utility, Mshta, Domain Trust Discovery, Spearphishing Attachment, Registry Run Keys / Startup Folder, Rundll32, Scheduled Task/Job, Data from Local System, Regsvr32, IP Addresses, Obfuscated Files or Information, Scheduled Task, SMB/Windows Admin Shares |
Discovery |
| Unusual Processes |
Match Legitimate Name or Location, Active Scanning, OS Credential Dumping, Service Stop, Malicious File, Data Destruction, Account Access Removal, Inhibit System Recovery, File and Directory Permissions Modification, SMB/Windows Admin Shares, Service Execution, System Information Discovery, System Network Configuration Discovery, Disable or Modify Tools, Ingress Tool Transfer, Account Discovery, Masquerading, Command and Scripting Interpreter, Regsvr32, Indirect Command Execution, Scheduled Task/Job, Exploitation for Client Execution, Software Deployment Tools, Remote Desktop Protocol, Rundll32, Data Encrypted for Impact, Windows Service, Create or Modify System Process, Rename System Utilities, Exploit Public-Facing Application |
Defense Evasion |
| Windows File Extension and Association Abuse |
Rename System Utilities, MSBuild, Rundll32, Trusted Developer Utilities Proxy Execution, Masquerading |
Defense Evasion |
| Windows Service Abuse |
Service Execution, Process Injection, Native API, System Services, Services Registry Permissions Weakness, Windows Service |
Execution |
| XMRig |
Match Legitimate Name or Location, Active Scanning, OS Credential Dumping, Service Stop, Malicious File, Data Destruction, Account Access Removal, Inhibit System Recovery, File and Directory Permissions Modification, SMB/Windows Admin Shares, Service Execution, System Information Discovery, System Network Configuration Discovery, Disable or Modify Tools, Ingress Tool Transfer, Account Discovery, Masquerading, Command and Scripting Interpreter, Regsvr32, Indirect Command Execution, Scheduled Task/Job, Exploitation for Client Execution, Software Deployment Tools, Remote Desktop Protocol, Rundll32, Data Encrypted for Impact, Windows Service, Create or Modify System Process, Rename System Utilities, Exploit Public-Facing Application |
Defense Evasion |
research bot