{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1083","id":"T1083","name":"File and Directory Discovery","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1083","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"4f92c37ea984fd56bc78bc82f67709df6931fe2cfff0a9c7c28614b86f6fea20","description":"Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.\n\nMany command shell utilities can be used to obtain this information. Examples include <code>dir</code>, <code>tree</code>, <code>ls</code>, <code>find</code>, and <code>locate</code>.(Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the [Native API](https://attack.mitre.org/techniques/T1106). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather file and directory information (e.g. <code>dir</code>, <code>show flash</code>, and/or <code>nvram</code>).(Citation: US-CERT-TA18-106A)\n\nSome files and directories may require elevated or specific user permissions to access.","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1083","external_id":"T1083"},{"source_name":"Windows Commands JPCERT","description":"Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.","url":"https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html"},{"source_name":"US-CERT-TA18-106A","description":"US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.","url":"https://www.us-cert.gov/ncas/alerts/TA18-106A"}],"platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0055","name":"File Access","page":"telemetry/DC0055/","kind":"attack_component","category":"Windows and directory audit","description":"Access to file objects with user, process and access-right context.","collection_focus":"Enable Audit File System plus a narrow SACL on a lab directory; on Linux select path/syscall rules and join associated Audit records.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["path","access","actor","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0039","name":"File Creation","page":"telemetry/DC0039/","kind":"attack_component","category":"Endpoint activity","description":"Creation or overwrite of a file at an observed path.","collection_focus":"Scope Sysmon FileCreate (11) to the lab directory; retain the process and file path. Differentiate creation/overwrite if the sensor can.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["process_id","path","action","size_bytes"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."}],"detection":{"key":"enterprise/T1083","id":"T1083","name":"File and Directory Discovery","domain":"enterprise","platforms":["ESXi","Linux","macOS","Network Devices","Windows"],"environments":["cloud-hosted-endpoint","network-infrastructure","onprem","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1083","technique_page":"techniques/enterprise/T1083/","page":"detections/enterprise/T1083/","status":"rule_source_available","counts":{"sigma":22,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":5,"live_validated":0},"sigma_rules":[{"id":"fe10751f-1995-40a5-aaa2-c97ccb4123fe","title":"Linux Capabilities Discovery","status":"test","level":"low","logsource":{"product":"linux","service":"auditd"},"data_path":"data/detection-rules/fe10751f-1995-40a5-aaa2-c97ccb4123fe.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/auditd/execve/lnx_auditd_capabilities_discovery.yml","author":"Pawel Mazur","kind":"sigma"},{"id":"bb382fd5-b454-47ea-a264-1828e4c766d6","title":"Shell Invocation via Apt - Linux","status":"test","level":"medium","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/bb382fd5-b454-47ea-a264-1828e4c766d6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_apt_shell_execution.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"d8d97d51-122d-4cdd-9e2f-01b4b4933530","title":"Capabilities Discovery - Linux","status":"test","level":"low","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/d8d97d51-122d-4cdd-9e2f-01b4b4933530.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_capa_discovery.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"d3feb4ee-ff1d-4d3d-bd10-5b28a238cc72","title":"File and Directory Discovery - Linux","status":"test","level":"informational","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/d3feb4ee-ff1d-4d3d-bd10-5b28a238cc72.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_file_and_directory_discovery.yml","author":"Daniil Yugoslavskiy, oscd.community, CheraghiMilad","kind":"sigma"},{"id":"6adfbf8f-52be-4444-9bac-81b539624146","title":"Shell Execution via Find - Linux","status":"test","level":"high","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/6adfbf8f-52be-4444-9bac-81b539624146.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_find_shell_execution.yml","author":"Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)","kind":"sigma"},{"id":"4b09c71e-4269-4111-9cdd-107d8867f0cc","title":"Shell Execution via Flock - Linux","status":"test","level":"high","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/4b09c71e-4269-4111-9cdd-107d8867f0cc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_flock_shell_execution.yml","author":"Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)","kind":"sigma"},{"id":"9b5de532-a757-4d70-946c-1f3e44f48b4d","title":"Shell Execution GCC  - Linux","status":"test","level":"high","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/9b5de532-a757-4d70-946c-1f3e44f48b4d.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_gcc_shell_execution.yml","author":"Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)","kind":"sigma"},{"id":"093d68c7-762a-42f4-9f46-95e79142571a","title":"Shell Execution via Nice - Linux","status":"test","level":"high","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/093d68c7-762a-42f4-9f46-95e79142571a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_nice_shell_execution.yml","author":"Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)","kind":"sigma"},{"id":"d7a650c4-226c-451e-948f-cc490db506aa","title":"PUA - TruffleHog Execution - Linux","status":"experimental","level":"medium","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/d7a650c4-226c-451e-948f-cc490db506aa.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_pua_trufflehog.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"8344c0e5-5783-47cc-9cf9-a0f7fd03e6cf","title":"Potential Discovery Activity Using Find - Linux","status":"test","level":"medium","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/8344c0e5-5783-47cc-9cf9-a0f7fd03e6cf.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_susp_find_execution.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"7ab8f73a-fcff-428b-84aa-6a5ff7877dea","title":"Vim GTFOBin Abuse - Linux","status":"test","level":"high","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/7ab8f73a-fcff-428b-84aa-6a5ff7877dea.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_vim_shell_execution.yml","author":"Nasreddine Bencherchali (Nextron Systems), Luc Génaux","kind":"sigma"},{"id":"089dbdf6-b960-4bcc-90e3-ffc3480c20f6","title":"File and Directory Discovery - MacOS","status":"test","level":"informational","logsource":{"category":"process_creation","product":"macos"},"data_path":"data/detection-rules/089dbdf6-b960-4bcc-90e3-ffc3480c20f6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_file_and_directory_discovery.yml","author":"Daniil Yugoslavskiy, oscd.community","kind":"sigma"},{"id":"85de3a19-b675-4a51-bfc6-b11a5186c971","title":"Potential Discovery Activity Using Find - MacOS","status":"test","level":"medium","logsource":{"category":"process_creation","product":"macos"},"data_path":"data/detection-rules/85de3a19-b675-4a51-bfc6-b11a5186c971.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_susp_find_execution.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"9705a6a1-6db6-4a16-a987-15b7151e299b","title":"Cisco Discovery","status":"test","level":"low","logsource":{"product":"cisco","service":"aaa"},"data_path":"data/detection-rules/9705a6a1-6db6-4a16-a987-15b7151e299b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/cisco/aaa/cisco_cli_discovery.yml","author":"Austin Clark","kind":"sigma"},{"id":"953d460b-f810-420a-97a2-cfca4c98e602","title":"Source Code Enumeration Detection by Keyword","status":"test","level":"medium","logsource":{"category":"webserver"},"data_path":"data/detection-rules/953d460b-f810-420a-97a2-cfca4c98e602.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/web/webserver_generic/web_source_code_enumeration.yml","author":"James Ahearn","kind":"sigma"},{"id":"7d416556-6502-45b2-9bad-9d2f05f38997","title":"Powershell Sensitive File Discovery","status":"test","level":"medium","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/7d416556-6502-45b2-9bad-9d2f05f38997.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_sensitive_file_discovery.yml","author":"frack113","kind":"sigma"},{"id":"162e69a7-7981-4344-84a9-0f1c9a217a52","title":"Powershell Directory Enumeration","status":"test","level":"medium","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/162e69a7-7981-4344-84a9-0f1c9a217a52.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_susp_directory_enum.yml","author":"frack113","kind":"sigma"},{"id":"b4dc61f5-6cce-468e-a608-b48b469feaa2","title":"DirLister Execution","status":"test","level":"low","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/b4dc61f5-6cce-468e-a608-b48b469feaa2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_dirlister_execution.yml","author":"frack113","kind":"sigma"},{"id":"fca949cc-79ca-446e-8064-01aa7e52ece5","title":"HackTool - PCHunter Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/fca949cc-79ca-446e-8064-01aa7e52ece5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_hktl_pchunter.yml","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali","kind":"sigma"},{"id":"3b4e950b-a3ea-44d3-877e-432071990709","title":"Notepad Password Files Discovery","status":"experimental","level":"low","logsource":{"product":"windows","category":"process_creation"},"data_path":"data/detection-rules/3b4e950b-a3ea-44d3-877e-432071990709.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_notepad_local_passwd_discovery.yml","author":"The DFIR Report","kind":"sigma"},{"id":"38646daa-e78f-4ace-9de0-55547b2d30da","title":"PUA - Seatbelt Execution","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/38646daa-e78f-4ace-9de0-55547b2d30da.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_seatbelt.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"44030449-b0df-4c94-aae1-502359ab28ee","title":"PUA - TruffleHog Execution","status":"experimental","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/44030449-b0df-4c94-aae1-502359ab28ee.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_pua_trufflehog.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1083-1","technique_id":"T1083","title":"T1083 File and Directory Discovery","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#discovery","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":129,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L129","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"4696880bfcec1f5731a2b51b43f0a8b2201371ad512acfe4b06cebbb524160ef","validation":"published_concept_not_executable_or_live_validated","logic":"COUNT(directory_listing_or_object_list BY actor, 5m) >= threshold -> ALERT","log_sources":[{"title":"File-System Activity Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#13-file-system-activity-logs"},{"title":"Cloud Object-Storage Access Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#108-cloud-object-storage-access-logs"},{"title":"Process Execution Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#6-process-execution-logs"}]}],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0370","name":"Recursive Enumeration of Files and Directories Across Privilege Contexts","url":"https://attack.mitre.org/detectionstrategies/DET0370","stix_id":"x-mitre-detection-strategy--33ab9d0c-5671-48e6-8465-f80560909c65","relationship_id":"relationship--a6822af7-4da4-42c4-8649-2789a4127950","description":"","analytics":[{"id":"AN1040","name":"Analytic 1040","guidance":"Execution of file enumeration commands (e.g., 'dir', 'tree') from non-standard processes or unusual user contexts, followed by recursive directory traversal or access to sensitive locations.","url":"https://attack.mitre.org/detectionstrategies/DET0370#AN1040","platforms":["Windows"],"tuning":[{"field":"CommandLineRegex","description":"Allows tuning based on tools/scripts used for enumeration (e.g., tree, dir /s /b)"},{"field":"UserContext","description":"Scoping for standard vs elevated or service accounts"},{"field":"TimeWindow","description":"Defines burst activity over short periods (e.g., >50 directory queries in 30s)"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Security","channel":"EventCode=4688","platforms":["Windows"],"analytic_id":"AN1040","source_url":"https://attack.mitre.org/detectionstrategies/DET0370#AN1040","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0039","component":"File Creation","name":"WinEventLog:Sysmon","channel":"EventCode=11","platforms":["Windows"],"analytic_id":"AN1040","source_url":"https://attack.mitre.org/detectionstrategies/DET0370#AN1040","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0039/"}]},{"id":"AN1041","name":"Analytic 1041","guidance":"Use of file enumeration commands (e.g., 'ls', 'find', 'locate') executed by suspicious users or scripts accessing broad file hierarchies or restricted directories.","url":"https://attack.mitre.org/detectionstrategies/DET0370#AN1041","platforms":["Linux"],"tuning":[{"field":"FilePathDepth","description":"Max depth of recursive access to tune noise vs anomaly"},{"field":"UserContext","description":"Helpful to exclude known scripts or automation accounts"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"execve","platforms":["Linux"],"analytic_id":"AN1041","source_url":"https://attack.mitre.org/detectionstrategies/DET0370#AN1041","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0055","component":"File Access","name":"auditd:PATH","channel":"PATH","platforms":["Linux"],"analytic_id":"AN1041","source_url":"https://attack.mitre.org/detectionstrategies/DET0370#AN1041","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"}]},{"id":"AN1042","name":"Analytic 1042","guidance":"Execution of file or directory discovery commands (e.g., 'ls', 'find') from terminal or script-based tooling, especially outside normal user workflows.","url":"https://attack.mitre.org/detectionstrategies/DET0370#AN1042","platforms":["macOS"],"tuning":[{"field":"PredicateScope","description":"Adjust macOS unified log filter to include/exclude system paths"},{"field":"TimeWindow","description":"Tune based on burst access patterns"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"macos:unifiedlog","channel":"log collect --predicate","platforms":["macOS"],"analytic_id":"AN1042","source_url":"https://attack.mitre.org/detectionstrategies/DET0370#AN1042","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0055","component":"File Access","name":"fs:fsusage","channel":"Filesystem Call Monitoring","platforms":["macOS"],"analytic_id":"AN1042","source_url":"https://attack.mitre.org/detectionstrategies/DET0370#AN1042","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"}]},{"id":"AN1043","name":"Analytic 1043","guidance":"Execution of esxcli commands to enumerate datastore, configuration files, or directory structures by unauthorized or remote users.","url":"https://attack.mitre.org/detectionstrategies/DET0370#AN1043","platforms":["ESXi"],"tuning":[{"field":"CLICommandPattern","description":"Match on esxcli storage|filesystem commands"},{"field":"AccessSource","description":"Limit alerting to non-vCenter or remote IPs"}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"esxi:shell","channel":"Shell Access/Command Execution","platforms":["ESXi"],"analytic_id":"AN1043","source_url":"https://attack.mitre.org/detectionstrategies/DET0370#AN1043","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0055","component":"File Access","name":"esxi:hostd","channel":"vSphere File API Access","platforms":["ESXi"],"analytic_id":"AN1043","source_url":"https://attack.mitre.org/detectionstrategies/DET0370#AN1043","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0055/"}]},{"id":"AN1044","name":"Analytic 1044","guidance":"Execution of file discovery commands (e.g., 'dir', 'show flash', 'nvram:') from CLI interfaces, especially by unauthorized users or from abnormal source IPs.","url":"https://attack.mitre.org/detectionstrategies/DET0370#AN1044","platforms":["Network Devices"],"tuning":[{"field":"CommandWhitelist","description":"Filter allowed commands by account or IP"},{"field":"SessionOrigin","description":"Tunable to restrict detection to remote terminal or Telnet/SSH"}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"networkdevice:syslog","channel":"CLI Command Logging","platforms":["Network Devices"],"analytic_id":"AN1044","source_url":"https://attack.mitre.org/detectionstrategies/DET0370#AN1044","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0055","name":"File Access","tag":"File Access","page":"telemetry/DC0055/","kind":"attack_component"},{"id":"DC0039","name":"File Creation","tag":"File Creation","page":"telemetry/DC0039/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0106","name":"cmd","page":"tools/S0106/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0488","name":"CrackMapExec","page":"tools/S0488/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S9002","name":"Diskpart","page":"tools/S9002/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0193","name":"Forfiles","page":"tools/S0193/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0434","name":"Imminent Monitor","page":"tools/S0434/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0250","name":"Koadic","page":"tools/S0250/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0378","name":"PoshC2","page":"tools/S0378/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0192","name":"Pupy","page":"tools/S0192/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1040","name":"Rclone","page":"tools/S1040/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0592","name":"RemoteUtilities","page":"tools/S0592/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0633","name":"Sliver","page":"tools/S0633/","kind":"attack_tool","bases":["attack_uses"],"guides":[{"id":"38602f432e5c","title":"Lab Architecture — Operation DragonRx","published_at":"2026-05-02","url":"https://1200km.com/articles/read/2026/2026-05-02-lab-architecture-operation-dragonrx-38602f432e5c/","original_url":"https://medium.com/@1200km/lab-architecture-operation-dragonrx-38602f432e5c","archive_path":"docs/articles/2026/2026-05-02-lab-architecture-operation-dragonrx-38602f432e5c.md","source_sha256":"51e18974e1481d1b83f58c3bff3a997c21e58fd027e2a159389ace500f2bc289","tool_ids":["S0633"]},{"id":"91339316f0df","title":"Attack Playbook — Operation DragonRx","published_at":"2026-05-04","url":"https://1200km.com/articles/read/2026/2026-05-04-attack-playbook-operation-dragonrx-91339316f0df/","original_url":"https://medium.com/@1200km/attack-playbook-operation-dragonrx-91339316f0df","archive_path":"docs/articles/2026/2026-05-04-attack-playbook-operation-dragonrx-91339316f0df.md","source_sha256":"9b81bd1fd3daa8174dfb523b4b050f4710e62a9ce176029571975b56f6d246a0","tool_ids":["S0633"]}]},{"id":"S9009","name":"TruffleHog","page":"tools/S9009/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0106","name":"cmd","page":"tools/S0106/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0154","name":"Cobalt Strike","page":"tools/S0154/","kind":"selected_framework","bases":["attack_uses"],"guides":[]},{"id":"S0488","name":"CrackMapExec","page":"tools/S0488/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S9002","name":"Diskpart","page":"tools/S9002/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0363","name":"Empire","page":"tools/S0363/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0193","name":"Forfiles","page":"tools/S0193/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0434","name":"Imminent Monitor","page":"tools/S0434/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0250","name":"Koadic","page":"tools/S0250/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0378","name":"PoshC2","page":"tools/S0378/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0192","name":"Pupy","page":"tools/S0192/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S1040","name":"Rclone","page":"tools/S1040/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0332","name":"Remcos","page":"tools/S0332/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0592","name":"RemoteUtilities","page":"tools/S0592/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0692","name":"SILENTTRINITY","page":"tools/S0692/","kind":"attack_tool","bases":["attack_uses"],"guides":[]},{"id":"S0633","name":"Sliver","page":"tools/S0633/","kind":"attack_tool","bases":["attack_uses"],"guides":[{"id":"38602f432e5c","title":"Lab Architecture — Operation DragonRx","published_at":"2026-05-02","url":"https://1200km.com/articles/read/2026/2026-05-02-lab-architecture-operation-dragonrx-38602f432e5c/","original_url":"https://medium.com/@1200km/lab-architecture-operation-dragonrx-38602f432e5c","archive_path":"docs/articles/2026/2026-05-02-lab-architecture-operation-dragonrx-38602f432e5c.md","source_sha256":"51e18974e1481d1b83f58c3bff3a997c21e58fd027e2a159389ace500f2bc289","tool_ids":["S0633"]},{"id":"91339316f0df","title":"Attack Playbook — Operation DragonRx","published_at":"2026-05-04","url":"https://1200km.com/articles/read/2026/2026-05-04-attack-playbook-operation-dragonrx-91339316f0df/","original_url":"https://medium.com/@1200km/attack-playbook-operation-dragonrx-91339316f0df","archive_path":"docs/articles/2026/2026-05-04-attack-playbook-operation-dragonrx-91339316f0df.md","source_sha256":"9b81bd1fd3daa8174dfb523b4b050f4710e62a9ce176029571975b56f6d246a0","tool_ids":["S0633"]}]},{"id":"S9009","name":"TruffleHog","page":"tools/S9009/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0011","name":"Taidoor","url":"https://attack.mitre.org/software/S0011","kind":"malware","description":"[Taidoor](https://attack.mitre.org/software/S0011) can search for specific files.(Citation: CISA MAR-10292089-1.v2 TAIDOOR August 2021)","relationship_id":"relationship--c9349d94-ea50-4446-a50e-bb920812aded","references":[{"source_name":"CISA MAR-10292089-1.v2 TAIDOOR August 2021","description":"CISA, FBI, DOD. (2021, August). MAR-10292089-1.v2 – Chinese Remote Access Trojan: TAIDOOR. Retrieved August 24, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-216a"}]},{"id":"S0013","name":"PlugX","url":"https://attack.mitre.org/software/S0013","kind":"malware","description":"[PlugX](https://attack.mitre.org/software/S0013) has a module to enumerate drives and find files recursively.(Citation: Eset PlugX Korplug Mustang Panda March 2022)(Citation: Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022)(Citation: CIRCL PlugX March 2013)(Citation: Proofpoint TA416 Europe March 2022) [PlugX](https://attack.mitre.org/software/S0013) has also checked the path from which it is running for specific parameters prior to execution. (Citation: Eset PlugX Korplug Mustang Panda March 2022)(Citation: DOJ Affidavit Search and Seizure PlugX December 2024)(Citation: Sophos Mustang Panda PLUGX)","relationship_id":"relationship--07702379-2d40-48ae-a077-d68e0da5e4be","references":[{"source_name":"Eset PlugX Korplug Mustang Panda March 2022","description":"Alexandre Cote Cyr. (2022, March 23). Mustang Panda’s Hodur: Old tricks, new Korplug variant. Retrieved September 9, 2025.","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source_name":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","description":"Asheer Malhotra, Jungsoo An, Kendall Mc. (2022, May 5). Mustang Panda deploys a new wave of malware targeting Europe. Retrieved August 4, 2025.","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source_name":"CIRCL PlugX March 2013","description":"Computer Incident Response Center Luxembourg. (2013, March 29). Analysis of a PlugX variant. Retrieved November 5, 2018.","url":"http://circl.lu/assets/files/tr-12/tr-12-circl-plugx-analysis-v1.pdf"},{"source_name":"DOJ Affidavit Search and Seizure PlugX December 2024","description":"DOJ. (2024, December 20). Mag. No. 24-mj-1387 AFFIDAVIT IN SUPPORT OF AN APPLICATION  FOR A NINTH SEARCH AND SEIZURE WARRANT- IN THE MATTER OF THE SEARCH AND  SEIZURE OF COMPUTERS IN THE  UNITED STATES INFECTED WITH  PLUGX MALWARE . Retrieved September 9, 2025.","url":"https://www.justice.gov/archives/opa/media/1384136/dl"},{"source_name":"Proofpoint TA416 Europe March 2022","description":"Raggi, M. et al. (2022, March 7). The Good, the Bad, and the Web Bug: TA416 Increases Operational Tempo Against European Governments as Conflict in Ukraine Escalates. Retrieved March 16, 2022.","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"},{"source_name":"Sophos Mustang Panda PLUGX","description":"Secureworks Counter Threat Unit Research Team. (2022, September 8). BRONZE PRESIDENT Targets Government Officials. Retrieved September 9, 2025.","url":"https://www.secureworks.com/blog/bronze-president-targets-government-officials"}]},{"id":"S0015","name":"Ixeshe","url":"https://attack.mitre.org/software/S0015","kind":"malware","description":"[Ixeshe](https://attack.mitre.org/software/S0015) can list file and directory information.(Citation: Trend Micro IXESHE 2012)","relationship_id":"relationship--b7999bd1-4704-489d-8fc3-80661592b6dc","references":[{"source_name":"Trend Micro IXESHE 2012","description":"Sancho, D., et al. (2012, May 22). IXESHE An APT Campaign. Retrieved June 7, 2019.","url":"https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_ixeshe.pdf"}]},{"id":"S0020","name":"China Chopper","url":"https://attack.mitre.org/software/S0020","kind":"malware","description":"[China Chopper](https://attack.mitre.org/software/S0020)'s server component can list directory contents.(Citation: FireEye Periscope March 2018)(Citation: Rapid7 HAFNIUM Mar 2021)","relationship_id":"relationship--fbfa0807-ce03-4448-a50d-f0337d2446f2","references":[{"source_name":"Rapid7 HAFNIUM Mar 2021","description":"Eoin Miller. (2021, March 23). Defending Against the Zero Day: Analyzing Attacker Behavior Post-Exploitation of Microsoft Exchange. Retrieved October 27, 2022.","url":"https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/"},{"source_name":"FireEye Periscope March 2018","description":"FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}]},{"id":"S0021","name":"Derusbi","url":"https://attack.mitre.org/software/S0021","kind":"malware","description":"[Derusbi](https://attack.mitre.org/software/S0021) is capable of obtaining directory, file, and drive listings.(Citation: Fidelis Turbo)(Citation: FireEye Periscope March 2018)","relationship_id":"relationship--b9fe8dd4-a3c9-4e58-9a74-937e4de677a8","references":[{"source_name":"Fidelis Turbo","description":"Fidelis Cybersecurity. (2016, February 29). The Turbo Campaign, Featuring Derusbi for 64-bit Linux. Retrieved March 2, 2016.","url":"https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2016/2016.02.29.Turbo_Campaign_Derusbi/TA_Fidelis_Turbo_1602_0.pdf"},{"source_name":"FireEye Periscope March 2018","description":"FireEye. (2018, March 16). Suspected Chinese Cyber Espionage Group (TEMP.Periscope) Targeting U.S. Engineering and Maritime Industries. Retrieved April 11, 2018.","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}]},{"id":"S0022","name":"Uroburos","url":"https://attack.mitre.org/software/S0022","kind":"malware","description":"[Uroburos](https://attack.mitre.org/software/S0022) can search for specific files on a compromised system.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)","relationship_id":"relationship--fc825f8c-ee7a-4b03-9d67-cd736d61b893","references":[{"source_name":"Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023","description":"FBI et al. (2023, May 9). Hunting Russian Intelligence “Snake” Malware. Retrieved June 8, 2023.","url":"https://www.cisa.gov/sites/default/files/2023-05/aa23-129a_snake_malware_2.pdf"}]},{"id":"S0023","name":"CHOPSTICK","url":"https://attack.mitre.org/software/S0023","kind":"malware","description":"An older version of [CHOPSTICK](https://attack.mitre.org/software/S0023) has a module that monitors all mounted volumes for files with the extensions .doc, .docx, .pgp, .gpg, .m2f, or .m2o.(Citation: ESET Sednit Part 2)","relationship_id":"relationship--838b4a52-1360-4ca7-ab25-1b549508e687","references":[{"source_name":"ESET Sednit Part 2","description":"ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"}]},{"id":"S0031","name":"BACKSPACE","url":"https://attack.mitre.org/software/S0031","kind":"malware","description":"[BACKSPACE](https://attack.mitre.org/software/S0031) allows adversaries to search for files.(Citation: FireEye APT30)","relationship_id":"relationship--991c16bd-c17b-479a-8f45-385467323c0a","references":[{"source_name":"FireEye APT30","description":"FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved November 17, 2024.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}]},{"id":"S0034","name":"NETEAGLE","url":"https://attack.mitre.org/software/S0034","kind":"malware","description":"[NETEAGLE](https://attack.mitre.org/software/S0034) allows adversaries to enumerate and modify the infected host's file system. It supports searching for directories, creating directories, listing directory contents, reading and writing to files, retrieving file attributes, and retrieving volume information.(Citation: FireEye APT30)","relationship_id":"relationship--5bb94c21-96c6-4c71-ae46-b222a69a493a","references":[{"source_name":"FireEye APT30","description":"FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved November 17, 2024.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}]},{"id":"S0035","name":"SPACESHIP","url":"https://attack.mitre.org/software/S0035","kind":"malware","description":"[SPACESHIP](https://attack.mitre.org/software/S0035) identifies files and directories for collection by searching for specific file extensions or file modification time.(Citation: FireEye APT30)","relationship_id":"relationship--d0332cfa-d932-4bc3-b661-9cd72c00b390","references":[{"source_name":"FireEye APT30","description":"FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved November 17, 2024.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}]},{"id":"S0036","name":"FLASHFLOOD","url":"https://attack.mitre.org/software/S0036","kind":"malware","description":"[FLASHFLOOD](https://attack.mitre.org/software/S0036) searches for interesting files (either a default or customized set of file extensions) on the local system and removable media.(Citation: FireEye APT30)","relationship_id":"relationship--512e16e9-634c-45d3-b569-c25a3072bbdc","references":[{"source_name":"FireEye APT30","description":"FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved November 17, 2024.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}]},{"id":"S0045","name":"ADVSTORESHELL","url":"https://attack.mitre.org/software/S0045","kind":"malware","description":"[ADVSTORESHELL](https://attack.mitre.org/software/S0045) can list files and directories.(Citation: ESET Sednit Part 2)(Citation: Bitdefender APT28 Dec 2015)","relationship_id":"relationship--7105ecea-8da8-4723-b717-ae9c3152cfdd","references":[{"source_name":"ESET Sednit Part 2","description":"ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016.","url":"http://www.welivesecurity.com/wp-content/uploads/2016/10/eset-sednit-part-2.pdf"},{"source_name":"Bitdefender APT28 Dec 2015","description":"Bitdefender. (2015, December). APT28 Under the Scope. Retrieved February 23, 2017.","url":"https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf"}]},{"id":"S0048","name":"PinchDuke","url":"https://attack.mitre.org/software/S0048","kind":"malware","description":"[PinchDuke](https://attack.mitre.org/software/S0048) searches for files created within a certain timeframe and whose file extension matches a predefined list.(Citation: F-Secure The Dukes)","relationship_id":"relationship--1fbde0c8-1b00-40bf-8fef-11892d103d63","references":[{"source_name":"F-Secure The Dukes","description":"F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.","url":"https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"}]},{"id":"S0049","name":"GeminiDuke","url":"https://attack.mitre.org/software/S0049","kind":"malware","description":"[GeminiDuke](https://attack.mitre.org/software/S0049) collects information from the victim, including installed drivers, programs previously executed by users, programs and services configured to automatically run at startup, files and folders present in any user's home folder, files and folders present in any user's My Documents, programs installed to the Program Files folder, and recently accessed files, folders, and programs.(Citation: F-Secure The Dukes)","relationship_id":"relationship--1b3cc0cb-de43-405b-bfa5-f0bececabf8c","references":[{"source_name":"F-Secure The Dukes","description":"F-Secure Labs. (2015, September 17). The Dukes: 7 years of Russian cyberespionage. Retrieved December 10, 2015.","url":"https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"}]},{"id":"S0050","name":"CosmicDuke","url":"https://attack.mitre.org/software/S0050","kind":"malware","description":"[CosmicDuke](https://attack.mitre.org/software/S0050) searches attached and mounted drives for file extensions and keywords that match a predefined list.(Citation: F-Secure Cosmicduke)","relationship_id":"relationship--62507790-a137-409e-a655-9190ff78cb52","references":[{"source_name":"F-Secure Cosmicduke","description":"F-Secure Labs. (2014, July). COSMICDUKE Cosmu with a twist of MiniDuke. Retrieved July 3, 2014.","url":"https://blog.f-secure.com/wp-content/uploads/2019/10/CosmicDuke.pdf"}]},{"id":"S0051","name":"MiniDuke","url":"https://attack.mitre.org/software/S0051","kind":"malware","description":"[MiniDuke](https://attack.mitre.org/software/S0051) can enumerate local drives.(Citation: ESET Dukes October 2019)","relationship_id":"relationship--6ed5bd9a-3f94-4ed0-94fb-0d3b93bc984e","references":[{"source_name":"ESET Dukes October 2019","description":"Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}]},{"id":"S0055","name":"RARSTONE","url":"https://attack.mitre.org/software/S0055","kind":"malware","description":"[RARSTONE](https://attack.mitre.org/software/S0055) obtains installer properties from Uninstall Registry Key entries to obtain information about installed applications and how to uninstall certain applications.(Citation: Camba RARSTONE)","relationship_id":"relationship--35ec37ba-44aa-49b1-9379-3f6070554c62","references":[{"source_name":"Camba RARSTONE","description":"Camba, A. (2013, February 27). BKDR_RARSTONE: New RAT to Watch Out For. Retrieved January 8, 2016.","url":"http://blog.trendmicro.com/trendlabs-security-intelligence/bkdr_rarstone-new-rat-to-watch-out-for/"}]},{"id":"S0059","name":"WinMM","url":"https://attack.mitre.org/software/S0059","kind":"malware","description":"[WinMM](https://attack.mitre.org/software/S0059) sets a WH_CBT Windows hook to search for and capture files on the victim.(Citation: Baumgartner Naikon 2015)","relationship_id":"relationship--1684e405-53bd-4951-a26d-e7c39887b06a","references":[{"source_name":"Baumgartner Naikon 2015","description":"Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"}]},{"id":"S0062","name":"DustySky","url":"https://attack.mitre.org/software/S0062","kind":"malware","description":"[DustySky](https://attack.mitre.org/software/S0062) scans the victim for files that contain certain keywords and document types including PDF, DOC, DOCX, XLS, and XLSX, from a list that is obtained from the C2 as a text file. It can also identify logical drives for the infected machine.(Citation: DustySky)(Citation: Kaspersky MoleRATs April 2019)","relationship_id":"relationship--f9773935-853e-4d5e-9345-9587fd77340d","references":[{"source_name":"DustySky","description":"ClearSky. (2016, January 7). Operation DustySky. Retrieved January 8, 2016.","url":"https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf"},{"source_name":"Kaspersky MoleRATs April 2019","description":"GReAT. (2019, April 10). Gaza Cybergang Group1, operation SneakyPastes. Retrieved May 13, 2020.","url":"https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"}]},{"id":"S0063","name":"SHOTPUT","url":"https://attack.mitre.org/software/S0063","kind":"malware","description":"[SHOTPUT](https://attack.mitre.org/software/S0063) has a command to obtain a directory listing.(Citation: Palo Alto CVE-2015-3113 July 2015)","relationship_id":"relationship--32ee78b3-58de-4de5-bc3d-34ea8dc90ca3","references":[{"source_name":"Palo Alto CVE-2015-3113 July 2015","description":"Falcone, R. and Wartell, R.. (2015, July 27). Observations on CVE-2015-3113, Prior Zero-Days and the Pirpi Payload. Retrieved January 22, 2016.","url":"http://researchcenter.paloaltonetworks.com/2015/07/ups-observations-on-cve-2015-3113-prior-zero-days-and-the-pirpi-payload/"}]},{"id":"S0064","name":"ELMER","url":"https://attack.mitre.org/software/S0064","kind":"malware","description":"[ELMER](https://attack.mitre.org/software/S0064) is capable of performing directory listings.(Citation: FireEye EPS Awakens Part 2)","relationship_id":"relationship--10619fa8-c479-4b61-9aac-ee08f00114d1","references":[{"source_name":"FireEye EPS Awakens Part 2","description":"Winters, R. (2015, December 20). The EPS Awakens - Part 2. Retrieved January 22, 2016.","url":"https://web.archive.org/web/20151226205946/https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html"}]},{"id":"S0065","name":"4H RAT","url":"https://attack.mitre.org/software/S0065","kind":"malware","description":"[4H RAT](https://attack.mitre.org/software/S0065) has the capability to obtain file and directory listings.(Citation: CrowdStrike Putter Panda)","relationship_id":"relationship--26968975-5f01-4b4b-9cdc-ef3b76710304","references":[{"source_name":"CrowdStrike Putter Panda","description":"Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016.","url":"http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf"}]},{"id":"S0066","name":"3PARA RAT","url":"https://attack.mitre.org/software/S0066","kind":"malware","description":"[3PARA RAT](https://attack.mitre.org/software/S0066) has a command to retrieve metadata for files on disk as well as a command to list the current working directory.(Citation: CrowdStrike Putter Panda)","relationship_id":"relationship--7c0995ef-ab5d-48f9-8884-7d953c4c3247","references":[{"source_name":"CrowdStrike Putter Panda","description":"Crowdstrike Global Intelligence Team. (2014, June 9). CrowdStrike Intelligence Report: Putter Panda. Retrieved January 22, 2016.","url":"http://cdn0.vox-cdn.com/assets/4589853/crowdstrike-intelligence-report-putter-panda.original.pdf"}]},{"id":"S0069","name":"BLACKCOFFEE","url":"https://attack.mitre.org/software/S0069","kind":"malware","description":"[BLACKCOFFEE](https://attack.mitre.org/software/S0069) has the capability to enumerate files.(Citation: FireEye APT17)","relationship_id":"relationship--007cc21a-685a-4701-99c1-20f258cedc7c","references":[{"source_name":"FireEye APT17","description":"FireEye Labs/FireEye Threat Intelligence. (2015, May 14). Hiding in Plain Sight: FireEye and Microsoft Expose Obfuscation Tactic. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20240119213200/https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf"}]},{"id":"S0070","name":"HTTPBrowser","url":"https://attack.mitre.org/software/S0070","kind":"malware","description":"[HTTPBrowser](https://attack.mitre.org/software/S0070) is capable of listing files, folders, and drives on a victim.(Citation: Dell TG-3390)(Citation: ZScaler Hacking Team)","relationship_id":"relationship--a3251b26-7012-4f26-9c5d-1fb9d69b8569","references":[{"source_name":"Dell TG-3390","description":"Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018.","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"},{"source_name":"ZScaler Hacking Team","description":"Desai, D.. (2015, August 14). Chinese cyber espionage APT group leveraging recently leaked Hacking Team exploits to target a Financial Services Firm. Retrieved January 26, 2016.","url":"http://research.zscaler.com/2015/08/chinese-cyber-espionage-apt-group.html"}]},{"id":"S0072","name":"OwaAuth","url":"https://attack.mitre.org/software/S0072","kind":"malware","description":"[OwaAuth](https://attack.mitre.org/software/S0072) has a command to list its directory and logical drives.(Citation: Dell TG-3390)","relationship_id":"relationship--358047bf-1dd3-4fc4-bc1a-b7004bd54b8d","references":[{"source_name":"Dell TG-3390","description":"Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, August 5). Threat Group-3390 Targets Organizations for Cyberespionage. Retrieved August 18, 2018.","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"}]},{"id":"S0078","name":"Psylo","url":"https://attack.mitre.org/software/S0078","kind":"malware","description":"[Psylo](https://attack.mitre.org/software/S0078) has commands to enumerate all storage devices and to find all files that start with a particular string.(Citation: Scarlet Mimic Jan 2016)","relationship_id":"relationship--922c214d-ad32-4490-bb3f-a4db73b718d5","references":[{"source_name":"Scarlet Mimic Jan 2016","description":"Falcone, R. and Miller-Osborn, J.. (2016, January 24). Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists. Retrieved February 10, 2016.","url":"http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"}]},{"id":"S0079","name":"MobileOrder","url":"https://attack.mitre.org/software/S0079","kind":"malware","description":"[MobileOrder](https://attack.mitre.org/software/S0079) has a command to upload to its C2 server information about files on the victim mobile device, including SD card size, installed app list, SMS content, contacts, and calling history.(Citation: Scarlet Mimic Jan 2016)","relationship_id":"relationship--bc72acee-e417-4de8-8084-153e141917b6","references":[{"source_name":"Scarlet Mimic Jan 2016","description":"Falcone, R. and Miller-Osborn, J.. (2016, January 24). Scarlet Mimic: Years-Long Espionage Campaign Targets Minority Activists. Retrieved February 10, 2016.","url":"http://researchcenter.paloaltonetworks.com/2016/01/scarlet-mimic-years-long-espionage-targets-minority-activists/"}]},{"id":"S0081","name":"Elise","url":"https://attack.mitre.org/software/S0081","kind":"malware","description":"A variant of [Elise](https://attack.mitre.org/software/S0081) executes <code>dir C:\\progra~1</code> when initially run.(Citation: Lotus Blossom Jun 2015)(Citation: Accenture Dragonfish Jan 2018)","relationship_id":"relationship--6e39f6fe-3808-41ae-9263-1fd23865bd7b","references":[{"source_name":"Accenture Dragonfish Jan 2018","description":"Accenture Security. (2018, January 27). DRAGONFISH DELIVERS NEW FORM OF ELISE MALWARE TARGETING ASEAN DEFENCE MINISTERS’ MEETING AND ASSOCIATES. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20190508165226/https://www.accenture.com/t20180127T003755Z_w_/us-en/_acnmedia/PDF-46/Accenture-Security-Dragonfish-Threat-Analysis.pdf"},{"source_name":"Lotus Blossom Jun 2015","description":"Falcone, R., et al.. (2015, June 16). Operation Lotus Blossom. Retrieved February 15, 2016.","url":"https://www.paloaltonetworks.com/resources/research/unit42-operation-lotus-blossom.html"}]},{"id":"S0083","name":"Misdat","url":"https://attack.mitre.org/software/S0083","kind":"malware","description":"[Misdat](https://attack.mitre.org/software/S0083) is capable of running commands to obtain a list of files and directories, as well as enumerating logical drives.(Citation: Cylance Dust Storm)","relationship_id":"relationship--1a4c94a1-6362-42b3-b1d9-41ae3fbf5ea5","references":[{"source_name":"Cylance Dust Storm","description":"Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}]},{"id":"S0086","name":"ZLib","url":"https://attack.mitre.org/software/S0086","kind":"malware","description":"[ZLib](https://attack.mitre.org/software/S0086) has the ability to enumerate files and drives.(Citation: Cylance Dust Storm)","relationship_id":"relationship--50271beb-48b1-411e-86b5-990b4cbb1fb5","references":[{"source_name":"Cylance Dust Storm","description":"Gross, J. (2016, February 23). Operation Dust Storm. Retrieved December 22, 2021.","url":"https://s7d2.scene7.com/is/content/cylance/prod/cylance-web/en-us/resources/knowledge-center/resource-library/reports/Op_Dust_Storm_Report.pdf"}]},{"id":"S0088","name":"Kasidet","url":"https://attack.mitre.org/software/S0088","kind":"malware","description":"[Kasidet](https://attack.mitre.org/software/S0088) has the ability to search for a given filename on a victim.(Citation: Zscaler Kasidet)","relationship_id":"relationship--ccb67d98-71d6-4a26-86b6-281174ca07b0","references":[{"source_name":"Zscaler Kasidet","description":"Yadav, A., et al. (2016, January 29). Malicious Office files dropping Kasidet and Dridex. Retrieved March 24, 2016.","url":"http://research.zscaler.com/2016/01/malicious-office-files-dropping-kasidet.html"}]},{"id":"S0089","name":"BlackEnergy","url":"https://attack.mitre.org/software/S0089","kind":"malware","description":"[BlackEnergy](https://attack.mitre.org/software/S0089) gathers a list of installed apps from the uninstall program Registry. It also gathers registered mail, browser, and instant messaging clients from the Registry. [BlackEnergy](https://attack.mitre.org/software/S0089) has searched for given file types.(Citation: F-Secure BlackEnergy 2014)(Citation: Securelist BlackEnergy Nov 2014)","relationship_id":"relationship--37f94533-8fbe-48d2-bf4f-f825ad75ff98","references":[{"source_name":"F-Secure BlackEnergy 2014","description":"F-Secure Labs. (2014). BlackEnergy & Quedagh: The convergence of crimeware and APT attacks. Retrieved March 24, 2016.","url":"https://blog-assets.f-secure.com/wp-content/uploads/2019/10/15163408/BlackEnergy_Quedagh.pdf"},{"source_name":"Securelist BlackEnergy Nov 2014","description":"Baumgartner, K. and Garnaeva, M.. (2014, November 3). BE2 custom plugins, router abuse, and target profiles. Retrieved March 24, 2016.","url":"https://securelist.com/be2-custom-plugins-router-abuse-and-target-profiles/67353/"}]},{"id":"S0090","name":"Rover","url":"https://attack.mitre.org/software/S0090","kind":"malware","description":"[Rover](https://attack.mitre.org/software/S0090) automatically searches for files on local drives based on a predefined list of file extensions.(Citation: Palo Alto Rover)","relationship_id":"relationship--e90717f3-fad2-4978-be15-7dfb647d034d","references":[{"source_name":"Palo Alto Rover","description":"Ray, V., Hayashi, K. (2016, February 29). New Malware ‘Rover’ Targets Indian Ambassador to Afghanistan. Retrieved February 29, 2016.","url":"http://researchcenter.paloaltonetworks.com/2016/02/new-malware-rover-targets-indian-ambassador-to-afghanistan/"}]},{"id":"S0091","name":"Epic","url":"https://attack.mitre.org/software/S0091","kind":"malware","description":"[Epic](https://attack.mitre.org/software/S0091) recursively searches for all .doc files on the system and collects a directory listing of the Desktop, %TEMP%, and %WINDOWS%\\Temp directories.(Citation: Kaspersky Turla)(Citation: Kaspersky Turla Aug 2014)","relationship_id":"relationship--291e908e-1d2e-4b29-a564-5a33149d1dbb","references":[{"source_name":"Kaspersky Turla","description":"Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.","url":"https://securelist.com/the-epic-turla-operation/65545/"},{"source_name":"Kaspersky Turla Aug 2014","description":"Kaspersky Lab's Global Research & Analysis Team. (2014, August 06). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroboros. Retrieved November 7, 2018.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08080105/KL_Epic_Turla_Technical_Appendix_20140806.pdf"}]},{"id":"S0093","name":"Backdoor.Oldrea","url":"https://attack.mitre.org/software/S0093","kind":"malware","description":"[Backdoor.Oldrea](https://attack.mitre.org/software/S0093) collects information about available drives, default browser, desktop file list, My Documents, Internet history, program files, and root of available drives. It also searches for ICS-related software files.(Citation: Symantec Dragonfly)","relationship_id":"relationship--b8f1354c-9cff-40ef-aa47-591952c735c3","references":[{"source_name":"Symantec Dragonfly","description":"Symantec Security Response. (2014, June 30). Dragonfly: Cyberespionage Attacks Against Energy Suppliers. Retrieved April 8, 2016.","url":"https://community.broadcom.com/symantecenterprise/communities/community-home/librarydocuments/viewdocument?DocumentKey=7382dce7-0260-4782-84cc-890971ed3f17&CommunityKey=1ecf5f55-9545-44d6-b0f4-4e4a7f5f5e68&tab=librarydocuments"}]},{"id":"S0094","name":"Trojan.Karagany","url":"https://attack.mitre.org/software/S0094","kind":"malware","description":"[Trojan.Karagany](https://attack.mitre.org/software/S0094) can enumerate files and directories on a compromised host.(Citation: Secureworks Karagany July 2019)","relationship_id":"relationship--7adebe2e-97f7-4a1a-8ac7-01b795dadc36","references":[{"source_name":"Secureworks Karagany July 2019","description":"Secureworks. (2019, July 24). Updated Karagany Malware Targets Energy Sector. Retrieved August 12, 2020.","url":"https://www.secureworks.com/research/updated-karagany-malware-targets-energy-sector"}]},{"id":"S0106","name":"cmd","url":"https://attack.mitre.org/software/S0106","kind":"tool","description":"[cmd](https://attack.mitre.org/software/S0106) can be used to find files and directories with native functionality such as <code>dir</code> commands.(Citation: TechNet Dir)","relationship_id":"relationship--2c09a27c-2eea-4287-9908-964533234e71","references":[{"source_name":"TechNet Dir","description":"Microsoft. (n.d.). Dir. Retrieved April 18, 2016.","url":"https://technet.microsoft.com/en-us/library/cc755121.aspx"}]},{"id":"S0113","name":"Prikormka","url":"https://attack.mitre.org/software/S0113","kind":"malware","description":"A module in [Prikormka](https://attack.mitre.org/software/S0113) collects information about the paths, size, and creation time of files with specific file extensions, but not the actual content of the file.(Citation: ESET Operation Groundbait)","relationship_id":"relationship--e64a09d0-4205-4aca-8acb-f6926233d107","references":[{"source_name":"ESET Operation Groundbait","description":"Cherepanov, A.. (2016, May 17). Operation Groundbait: Analysis of a surveillance toolkit. Retrieved May 18, 2016.","url":"http://www.welivesecurity.com/wp-content/uploads/2016/05/Operation-Groundbait.pdf"}]},{"id":"S0115","name":"Crimson","url":"https://attack.mitre.org/software/S0115","kind":"malware","description":"[Crimson](https://attack.mitre.org/software/S0115) contains commands to list files and directories, as well as search for files matching certain extensions from a defined list.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)","relationship_id":"relationship--0d8aa058-426a-45c9-af5b-898746ae5862","references":[{"source_name":"Kaspersky Transparent Tribe August 2020","description":"Dedola, G. (2020, August 20). Transparent Tribe: Evolution analysis, part 1. Retrieved September 2, 2021.","url":"https://securelist.com/transparent-tribe-part-1/98127/"},{"source_name":"Proofpoint Operation Transparent Tribe March 2016","description":"Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"},{"source_name":"Cisco Talos Transparent Tribe Education Campaign July 2022","description":"N. Baisini. (2022, July 13). Transparent Tribe begins targeting education sector in latest campaign. Retrieved September 22, 2022.","url":"https://blog.talosintelligence.com/2022/07/transparent-tribe-targets-education.html"}]},{"id":"S0124","name":"Pisloader","url":"https://attack.mitre.org/software/S0124","kind":"malware","description":"[Pisloader](https://attack.mitre.org/software/S0124) has commands to list drives on the victim machine and to list file information for a given directory.(Citation: Palo Alto DNS Requests)","relationship_id":"relationship--ed8b5029-835d-492c-a1f4-10ccbf084a76","references":[{"source_name":"Palo Alto DNS Requests","description":"Grunzweig, J., et al. (2016, May 24). New Wekby Attacks Use DNS Requests As Command and Control Mechanism. Retrieved August 17, 2016.","url":"http://researchcenter.paloaltonetworks.com/2016/05/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/"}]},{"id":"S0125","name":"Remsec","url":"https://attack.mitre.org/software/S0125","kind":"malware","description":"[Remsec](https://attack.mitre.org/software/S0125) is capable of listing contents of folders on the victim. [Remsec](https://attack.mitre.org/software/S0125) also searches for custom network encryption software on victims.(Citation: Symantec Remsec IOCs)(Citation: Kaspersky ProjectSauron Full Report)(Citation: Kaspersky ProjectSauron Technical Analysis)","relationship_id":"relationship--147e009d-48db-40bc-999c-70aa1e770a0c","references":[{"source_name":"Symantec Remsec IOCs","description":"Symantec Security Response. (2016, August 8). Backdoor.Remsec indicators of compromise. Retrieved August 17, 2016.","url":"http://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/Symantec_Remsec_IOCs.pdf"},{"source_name":"Kaspersky ProjectSauron Full Report","description":"Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Retrieved August 17, 2016.","url":"https://securelist.com/files/2016/07/The-ProjectSauron-APT_research_KL.pdf"},{"source_name":"Kaspersky ProjectSauron Technical Analysis","description":"Kaspersky Lab's Global Research & Analysis Team. (2016, August 9). The ProjectSauron APT. Technical Analysis. Retrieved August 17, 2016.","url":"https://securelist.com/files/2016/07/The-ProjectSauron-APT_Technical_Analysis_KL.pdf"}]},{"id":"S0127","name":"BBSRAT","url":"https://attack.mitre.org/software/S0127","kind":"malware","description":"[BBSRAT](https://attack.mitre.org/software/S0127) can list file and directory information.(Citation: Palo Alto Networks BBSRAT)","relationship_id":"relationship--8beb37e3-5cf0-4229-ae27-186a37133521","references":[{"source_name":"Palo Alto Networks BBSRAT","description":"Lee, B. Grunzweig, J. (2015, December 22). BBSRAT Attacks Targeting Russian Organizations Linked to Roaming Tiger. Retrieved August 19, 2016.","url":"http://researchcenter.paloaltonetworks.com/2015/12/bbsrat-attacks-targeting-russian-organizations-linked-to-roaming-tiger/"}]},{"id":"S0128","name":"BADNEWS","url":"https://attack.mitre.org/software/S0128","kind":"malware","description":"[BADNEWS](https://attack.mitre.org/software/S0128) identifies files with certain extensions from USB devices, then copies them to a predefined directory.(Citation: TrendMicro Patchwork Dec 2017)","relationship_id":"relationship--f761e63a-5c5a-47e3-8256-08bd299f329e","references":[{"source_name":"TrendMicro Patchwork Dec 2017","description":"Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"id":"S0129","name":"AutoIt backdoor","url":"https://attack.mitre.org/software/S0129","kind":"malware","description":"[AutoIt backdoor](https://attack.mitre.org/software/S0129) is capable of identifying documents on the victim with the following extensions: .doc; .pdf, .csv, .ppt, .docx, .pst, .xls, .xlsx, .pptx, and .jpeg.(Citation: Forcepoint Monsoon)","relationship_id":"relationship--3de749e5-353a-4bdc-8951-9e0fa387bc70","references":[{"source_name":"Forcepoint Monsoon","description":"Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.","url":"https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"}]},{"id":"S0131","name":"TINYTYPHON","url":"https://attack.mitre.org/software/S0131","kind":"malware","description":"[TINYTYPHON](https://attack.mitre.org/software/S0131) searches through the drive containing the OS, then all drive letters C through to Z, for documents matching certain extensions.(Citation: Forcepoint Monsoon)","relationship_id":"relationship--6cfd1f0f-0355-4b1a-af29-84ed992bbb71","references":[{"source_name":"Forcepoint Monsoon","description":"Settle, A., et al. (2016, August 8). MONSOON - Analysis Of An APT Campaign. Retrieved September 22, 2016.","url":"https://www.forcepoint.com/sites/default/files/resources/files/forcepoint-security-labs-monsoon-analysis-report.pdf"}]},{"id":"S0136","name":"USBStealer","url":"https://attack.mitre.org/software/S0136","kind":"malware","description":"[USBStealer](https://attack.mitre.org/software/S0136) searches victim drives for files matching certain extensions (“.skr”,“.pkr” or “.key”) or names.(Citation: ESET Sednit USBStealer 2014)(Citation: Kaspersky Sofacy)","relationship_id":"relationship--03ab3120-4c6e-4de2-982a-fe22d466f748","references":[{"source_name":"ESET Sednit USBStealer 2014","description":"Calvet, J. (2014, November 11). Sednit Espionage Group Attacking Air-Gapped Networks. Retrieved January 4, 2017.","url":"http://www.welivesecurity.com/2014/11/11/sednit-espionage-group-attacking-air-gapped-networks/"},{"source_name":"Kaspersky Sofacy","description":"Kaspersky Lab's Global Research and Analysis Team. (2015, December 4). Sofacy APT hits high profile targets with updated toolset. Retrieved December 10, 2015.","url":"https://securelist.com/sofacy-apt-hits-high-profile-targets-with-updated-toolset/72924/"}]},{"id":"S0139","name":"PowerDuke","url":"https://attack.mitre.org/software/S0139","kind":"malware","description":"[PowerDuke](https://attack.mitre.org/software/S0139) has commands to get the current directory name as well as the size of a file. It also has commands to obtain information about logical drives, drive type, and free space.(Citation: Volexity PowerDuke November 2016)","relationship_id":"relationship--24ea53e3-a51f-4c4a-b3de-2e1d09ed69e8","references":[{"source_name":"Volexity PowerDuke November 2016","description":"Adair, S.. (2016, November 9). PowerDuke: Widespread Post-Election Spear Phishing Campaigns Targeting Think Tanks and NGOs. Retrieved January 11, 2017.","url":"https://www.volexity.com/blog/2016/11/09/powerduke-post-election-spear-phishing-campaigns-targeting-think-tanks-and-ngos/"}]},{"id":"S0141","name":"Winnti for Windows","url":"https://attack.mitre.org/software/S0141","kind":"malware","description":"[Winnti for Windows](https://attack.mitre.org/software/S0141) can check for the presence of specific files prior to moving to the next phase of execution.(Citation: Novetta Winnti April 2015)","relationship_id":"relationship--1a4f5197-ec9f-4607-984c-4a09978acd8e","references":[{"source_name":"Novetta Winnti April 2015","description":"Novetta Threat Research Group. (2015, April 7). Winnti Analysis. Retrieved February 8, 2017.","url":"https://web.archive.org/web/20150412223949/http://www.novetta.com/wp-content/uploads/2015/04/novetta_winntianalysis.pdf"}]},{"id":"S0142","name":"StreamEx","url":"https://attack.mitre.org/software/S0142","kind":"malware","description":"[StreamEx](https://attack.mitre.org/software/S0142) has the ability to enumerate drive types.(Citation: Cylance Shell Crew Feb 2017)","relationship_id":"relationship--c8b0afbb-12eb-4b45-a1e1-b11755de2976","references":[{"source_name":"Cylance Shell Crew Feb 2017","description":"Cylance SPEAR Team. (2017, February 9). Shell Crew Variants Continue to Fly Under Big AV’s Radar. Retrieved February 15, 2017.","url":"https://www.cylance.com/shell-crew-variants-continue-to-fly-under-big-avs-radar"}]},{"id":"S0144","name":"ChChes","url":"https://attack.mitre.org/software/S0144","kind":"malware","description":"[ChChes](https://attack.mitre.org/software/S0144) collects the victim's %TEMP% directory path and version of Internet Explorer.(Citation: FireEye APT10 April 2017)","relationship_id":"relationship--a802d52a-01f4-44c8-b80d-d2c746e1e31d","references":[{"source_name":"FireEye APT10 April 2017","description":"FireEye iSIGHT Intelligence. (2017, April 6). APT10 (MenuPass Group): New Tools, Global Campaign Latest Manifestation of Longstanding Threat. Retrieved June 29, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html"}]},{"id":"S0147","name":"Pteranodon","url":"https://attack.mitre.org/software/S0147","kind":"malware","description":"[Pteranodon](https://attack.mitre.org/software/S0147) identifies files matching certain file extension and copies them to subdirectories it created.(Citation: Palo Alto Gamaredon Feb 2017)","relationship_id":"relationship--5d46a519-1ef9-4cdb-b737-8c7b3ffb4f0e","references":[{"source_name":"Palo Alto Gamaredon Feb 2017","description":"Kasza, A. and Reichel, D. (2017, February 27). The Gamaredon Group Toolset Evolution. Retrieved March 1, 2017.","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/"}]},{"id":"S0148","name":"RTM","url":"https://attack.mitre.org/software/S0148","kind":"malware","description":"[RTM](https://attack.mitre.org/software/S0148) can check for specific files and directories associated with virtualization and malware analysis.(Citation: Unit42 Redaman January 2019)","relationship_id":"relationship--d412ff4a-d9d0-44a9-b8b3-36a650f18036","references":[{"source_name":"Unit42 Redaman January 2019","description":"Duncan, B., Harbison, M. (2019, January 23). Russian Language Malspam Pushing Redaman Banking Malware. Retrieved June 16, 2020.","url":"https://unit42.paloaltonetworks.com/russian-language-malspam-pushing-redaman-banking-malware/"}]},{"id":"S0149","name":"MoonWind","url":"https://attack.mitre.org/software/S0149","kind":"malware","description":"[MoonWind](https://attack.mitre.org/software/S0149) has a command to return a directory listing for a specified directory.(Citation: Palo Alto MoonWind March 2017)","relationship_id":"relationship--5c84d301-b6d1-4af8-9c25-1260e05fa924","references":[{"source_name":"Palo Alto MoonWind March 2017","description":"Miller-Osborn, J. and Grunzweig, J.. (2017, March 30). Trochilus and New MoonWind RATs Used In Attack Against Thai Organizations. Retrieved March 30, 2017.","url":"http://researchcenter.paloaltonetworks.com/2017/03/unit42-trochilus-rat-new-moonwind-rat-used-attack-thai-utility-organizations/"}]},{"id":"S0153","name":"RedLeaves","url":"https://attack.mitre.org/software/S0153","kind":"malware","description":"[RedLeaves](https://attack.mitre.org/software/S0153) can enumerate and search for files and directories.(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: FireEye APT10 April 2017)","relationship_id":"relationship--d4ca926c-6976-4ee8-a5b0-89aa11931bea","references":[{"source_name":"FireEye APT10 April 2017","description":"FireEye iSIGHT Intelligence. (2017, April 6). APT10 (MenuPass Group): New Tools, Global Campaign Latest Manifestation of Longstanding Threat. Retrieved June 29, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html"},{"source_name":"PWC Cloud Hopper Technical Annex April 2017","description":"PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"}]},{"id":"S0154","name":"Cobalt Strike","url":"https://attack.mitre.org/software/S0154","kind":"malware","description":"[Cobalt Strike](https://attack.mitre.org/software/S0154) can explore files on a compromised system.(Citation: Cobalt Strike Manual 4.3 November 2020)","relationship_id":"relationship--6747d237-8156-453c-9751-3afd1b36bdca","references":[{"source_name":"Cobalt Strike Manual 4.3 November 2020","description":"Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021.","url":"https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf"}]},{"id":"S0157","name":"SOUNDBITE","url":"https://attack.mitre.org/software/S0157","kind":"malware","description":"[SOUNDBITE](https://attack.mitre.org/software/S0157) is capable of enumerating and manipulating files and directories.(Citation: FireEye APT32 May 2017)","relationship_id":"relationship--c3ee174d-fd40-4636-97b2-afe80854f987","references":[{"source_name":"FireEye APT32 May 2017","description":"Carr, N.. (2017, May 14). Cyber Espionage is Alive and Well: APT32 and the Threat to Global Corporations. Retrieved June 18, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"}]},{"id":"S0161","name":"XAgentOSX","url":"https://attack.mitre.org/software/S0161","kind":"malware","description":"[XAgentOSX](https://attack.mitre.org/software/S0161) contains the readFiles function to return a detailed listing (sometimes recursive) of a specified directory.(Citation: XAgentOSX 2017) [XAgentOSX](https://attack.mitre.org/software/S0161) contains the showBackupIosFolder function to check for IOS device backups by running <code>ls -la ~/Library/Application\\ Support/MobileSync/Backup/</code>.(Citation: XAgentOSX 2017)","relationship_id":"relationship--63a7bbf6-bb2e-41e7-8893-c3f7f207a7a7","references":[{"source_name":"XAgentOSX 2017","description":"Robert Falcone. (2017, February 14). XAgentOSX: Sofacy's Xagent macOS Tool. Retrieved July 12, 2017.","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-xagentosx-sofacys-xagent-macos-tool/"},{"source_name":"XAgentOSX 2017","description":"Robert Falcone. (2017, February 14). XAgentOSX: Sofacy's Xagent macOS Tool. Retrieved July 12, 2017.","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-xagentosx-sofacys-xagent-macos-tool/"}]},{"id":"S0180","name":"Volgmer","url":"https://attack.mitre.org/software/S0180","kind":"malware","description":"[Volgmer](https://attack.mitre.org/software/S0180) can list directories on a victim.(Citation: US-CERT Volgmer Nov 2017)","relationship_id":"relationship--084ac639-2502-4020-8938-65352349acbb","references":[{"source_name":"US-CERT Volgmer Nov 2017","description":"US-CERT. (2017, November 22). Alert (TA17-318B): HIDDEN COBRA – North Korean Trojan: Volgmer. Retrieved December 7, 2017.","url":"https://www.us-cert.gov/ncas/alerts/TA17-318B"}]},{"id":"S0181","name":"FALLCHILL","url":"https://attack.mitre.org/software/S0181","kind":"malware","description":"[FALLCHILL](https://attack.mitre.org/software/S0181) can search files on a victim.(Citation: US-CERT FALLCHILL Nov 2017)","relationship_id":"relationship--27834043-1004-4a70-9023-a318bd6db7c6","references":[{"source_name":"US-CERT FALLCHILL Nov 2017","description":"US-CERT. (2017, November 22). Alert (TA17-318A): HIDDEN COBRA – North Korean Remote Administration Tool: FALLCHILL. Retrieved December 7, 2017.","url":"https://www.us-cert.gov/ncas/alerts/TA17-318A"}]},{"id":"S0182","name":"FinFisher","url":"https://attack.mitre.org/software/S0182","kind":"malware","description":"[FinFisher](https://attack.mitre.org/software/S0182) enumerates directories and scans for certain files.(Citation: FinFisher Citation)(Citation: Microsoft FinFisher March 2018)","relationship_id":"relationship--714ecf14-6200-4edf-9a9c-dd9830831266","references":[{"source_name":"Microsoft FinFisher March 2018","description":"Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.","url":"https://cloudblogs.microsoft.com/microsoftsecure/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/"},{"source_name":"FinFisher Citation","description":"FinFisher. (n.d.). Retrieved September 12, 2024.","url":"https://web.archive.org/web/20171222050934/http://www.finfisher.com/FinFisher/index.html"}]},{"id":"S0184","name":"POWRUNER","url":"https://attack.mitre.org/software/S0184","kind":"malware","description":"[POWRUNER](https://attack.mitre.org/software/S0184) may enumerate user directories on a victim.(Citation: FireEye APT34 Dec 2017)","relationship_id":"relationship--9670979e-9785-45f0-a470-f591c97f6f8a","references":[{"source_name":"FireEye APT34 Dec 2017","description":"Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.","url":"https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"}]},{"id":"S0192","name":"Pupy","url":"https://attack.mitre.org/software/S0192","kind":"tool","description":"[Pupy](https://attack.mitre.org/software/S0192) can walk through directories and recursively search for strings in files.(Citation: GitHub Pupy)","relationship_id":"relationship--75d124da-bb01-422f-bbf1-a472c841741b","references":[{"source_name":"GitHub Pupy","description":"Nicolas Verdier. (n.d.). Retrieved January 29, 2018.","url":"https://github.com/n1nj4sec/pupy"}]},{"id":"S0193","name":"Forfiles","url":"https://attack.mitre.org/software/S0193","kind":"tool","description":"[Forfiles](https://attack.mitre.org/software/S0193) can be used to locate certain types of files/directories in a system.(ex: locate all files with a specific extension, name, and/or age)(Citation: Überwachung APT28 Forfiles June 2015)","relationship_id":"relationship--9e235097-0a3a-410f-b3a1-ec50ea910d47","references":[{"source_name":"Überwachung APT28 Forfiles June 2015","description":"Guarnieri, C. (2015, June 19). Digital Attack on German Parliament: Investigative Report on the Hack of the Left Party Infrastructure in Bundestag. Retrieved January 22, 2018.","url":"https://netzpolitik.org/2015/digital-attack-on-german-parliament-investigative-report-on-the-hack-of-the-left-party-infrastructure-in-bundestag/"}]},{"id":"S0198","name":"NETWIRE","url":"https://attack.mitre.org/software/S0198","kind":"malware","description":"[NETWIRE](https://attack.mitre.org/software/S0198) has the ability to search for files on the compromised host.(Citation: Proofpoint NETWIRE December 2020)","relationship_id":"relationship--6c320415-f45c-438a-9671-c4c831ebd7fc","references":[{"source_name":"Proofpoint NETWIRE December 2020","description":"Proofpoint. (2020, December 2). Geofenced NetWire Campaigns. Retrieved January 7, 2021.","url":"https://www.proofpoint.com/us/blog/threat-insight/geofenced-netwire-campaigns"}]},{"id":"S0201","name":"JPIN","url":"https://attack.mitre.org/software/S0201","kind":"malware","description":"[JPIN](https://attack.mitre.org/software/S0201) can enumerate drives and their types. It can also change file permissions using cacls.exe.(Citation: Microsoft PLATINUM April 2016)","relationship_id":"relationship--4ffd0780-b8ed-4b8f-b5b8-ff5b0afd4f1f","references":[{"source_name":"Microsoft PLATINUM April 2016","description":"Windows Defender Advanced Threat Hunting Team. (2016, April 29). PLATINUM: Targeted attacks in South and Southeast Asia. Retrieved February 15, 2018.","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}]},{"id":"S0203","name":"Hydraq","url":"https://attack.mitre.org/software/S0203","kind":"malware","description":"[Hydraq](https://attack.mitre.org/software/S0203) creates a backdoor through which remote attackers can check for the existence of files, including its own components, as well as retrieve a list of logical drives.(Citation: Symantec Trojan.Hydraq Jan 2010)(Citation: Symantec Hydraq Jan 2010)","relationship_id":"relationship--c7fee556-41c2-43bd-a732-e11ff34fb129","references":[{"source_name":"Symantec Trojan.Hydraq Jan 2010","description":"Symantec Security Response. (2010, January 18). The Trojan.Hydraq Incident. Retrieved February 20, 2018.","url":"https://www.symantec.com/connect/blogs/trojanhydraq-incident"},{"source_name":"Symantec Hydraq Jan 2010","description":"Lelli, A. (2010, January 11). Trojan.Hydraq. Retrieved February 20, 2018.","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2010-011114-1830-99"}]},{"id":"S0208","name":"Pasam","url":"https://attack.mitre.org/software/S0208","kind":"malware","description":"[Pasam](https://attack.mitre.org/software/S0208) creates a backdoor through which remote attackers can retrieve lists of files.(Citation: Symantec Pasam May 2012)","relationship_id":"relationship--ab27d055-77bb-4a3d-89b2-771e532f7384","references":[{"source_name":"Symantec Pasam May 2012","description":"Mullaney, C. & Honda, H. (2012, May 4). Trojan.Pasam. Retrieved February 22, 2018.","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2012-050412-4128-99"}]},{"id":"S0211","name":"Linfo","url":"https://attack.mitre.org/software/S0211","kind":"malware","description":"[Linfo](https://attack.mitre.org/software/S0211) creates a backdoor through which remote attackers can list contents of drives and search for files.(Citation: Symantec Linfo May 2012)","relationship_id":"relationship--6203e555-d5f9-4b3c-978b-d10db7575dbc","references":[{"source_name":"Symantec Linfo May 2012","description":"Zhou, R. (2012, May 15). Backdoor.Linfo. Retrieved February 23, 2018.","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2012-051605-2535-99"}]},{"id":"S0212","name":"CORALDECK","url":"https://attack.mitre.org/software/S0212","kind":"malware","description":"[CORALDECK](https://attack.mitre.org/software/S0212) searches for specified files.(Citation: FireEye APT37 Feb 2018)","relationship_id":"relationship--a00bb928-c644-4b77-ae9c-18c3165daa00","references":[{"source_name":"FireEye APT37 Feb 2018","description":"FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}]},{"id":"S0216","name":"POORAIM","url":"https://attack.mitre.org/software/S0216","kind":"malware","description":"[POORAIM](https://attack.mitre.org/software/S0216) can conduct file browsing.(Citation: FireEye APT37 Feb 2018)","relationship_id":"relationship--17c43eed-f8a2-42cb-8f0a-f31978e9e351","references":[{"source_name":"FireEye APT37 Feb 2018","description":"FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}]},{"id":"S0219","name":"WINERACK","url":"https://attack.mitre.org/software/S0219","kind":"malware","description":"[WINERACK](https://attack.mitre.org/software/S0219) can enumerate files and directories.(Citation: FireEye APT37 Feb 2018)","relationship_id":"relationship--33327a36-9f05-4a27-ac6a-d36e4cee0b21","references":[{"source_name":"FireEye APT37 Feb 2018","description":"FireEye. (2018, February 20). APT37 (Reaper): The Overlooked North Korean Actor. Retrieved November 17, 2024.","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}]},{"id":"S0226","name":"Smoke Loader","url":"https://attack.mitre.org/software/S0226","kind":"malware","description":"[Smoke Loader](https://attack.mitre.org/software/S0226) recursively searches through directories for files.(Citation: Talos Smoke Loader July 2018)","relationship_id":"relationship--f7484ee2-6d98-4f5b-8788-2cf1675b349d","references":[{"source_name":"Talos Smoke Loader July 2018","description":"Baker, B., Unterbrink H. (2018, July 03). Smoking Guns - Smoke Loader learned new tricks. Retrieved July 5, 2018.","url":"https://blog.talosintelligence.com/2018/07/smoking-guns-smoke-loader-learned-new.html#more"}]},{"id":"S0229","name":"Orz","url":"https://attack.mitre.org/software/S0229","kind":"malware","description":"[Orz](https://attack.mitre.org/software/S0229) can gather victim drive information.(Citation: Proofpoint Leviathan Oct 2017)","relationship_id":"relationship--0188b7af-d060-4715-baf2-ad69333482dc","references":[{"source_name":"Proofpoint Leviathan Oct 2017","description":"Axel F, Pierre T. (2017, October 16). Leviathan: Espionage actor spearphishes maritime and defense targets. Retrieved February 15, 2018.","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"}]},{"id":"S0234","name":"Bandook","url":"https://attack.mitre.org/software/S0234","kind":"malware","description":"[Bandook](https://attack.mitre.org/software/S0234) has a command to list files on a system.(Citation: CheckPoint Bandook Nov 2020)","relationship_id":"relationship--7a453aab-789d-4fd5-9360-37c3f88ee3c6","references":[{"source_name":"CheckPoint Bandook Nov 2020","description":"Check Point. (2020, November 26). Bandook: Signed & Delivered. Retrieved May 31, 2021.","url":"https://research.checkpoint.com/2020/bandook-signed-delivered/"}]},{"id":"S0235","name":"CrossRAT","url":"https://attack.mitre.org/software/S0235","kind":"malware","description":"[CrossRAT](https://attack.mitre.org/software/S0235) can list all files on a system.(Citation: Lookout Dark Caracal Jan 2018)","relationship_id":"relationship--5f4c8795-68b6-4935-beb4-adde242f44f6","references":[{"source_name":"Lookout Dark Caracal Jan 2018","description":"Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}]},{"id":"S0236","name":"Kwampirs","url":"https://attack.mitre.org/software/S0236","kind":"malware","description":"[Kwampirs](https://attack.mitre.org/software/S0236) collects a list of files and directories in C:\\ with the command <code>dir /s /a c:\\ >> \"C:\\windows\\TEMP\\[RANDOM].tmp\"</code>.(Citation: Symantec Orangeworm April 2018)","relationship_id":"relationship--4e07996d-c9d9-49a8-9800-94daf69cd3b3","references":[{"source_name":"Symantec Orangeworm April 2018","description":"Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.","url":"https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"}]},{"id":"S0237","name":"GravityRAT","url":"https://attack.mitre.org/software/S0237","kind":"malware","description":"[GravityRAT](https://attack.mitre.org/software/S0237) collects the volumes mapped on the system, and also steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.(Citation: Talos GravityRAT)","relationship_id":"relationship--79d23451-095d-445d-a61e-3351b55eafde","references":[{"source_name":"Talos GravityRAT","description":"Mercer, W., Rascagneres, P. (2018, April 26). GravityRAT - The Two-Year Evolution Of An APT Targeting India. Retrieved May 16, 2018.","url":"https://blog.talosintelligence.com/2018/04/gravityrat-two-year-evolution-of-apt.html"}]},{"id":"S0238","name":"Proxysvc","url":"https://attack.mitre.org/software/S0238","kind":"malware","description":"[Proxysvc](https://attack.mitre.org/software/S0238) lists files in directories.(Citation: McAfee GhostSecret)","relationship_id":"relationship--77270a5a-c2e7-4cf0-8d73-129758454bcc","references":[{"source_name":"McAfee GhostSecret","description":"Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}]},{"id":"S0239","name":"Bankshot","url":"https://attack.mitre.org/software/S0239","kind":"malware","description":"[Bankshot](https://attack.mitre.org/software/S0239) searches for files on the victim's machine.(Citation: US-CERT Bankshot Dec 2017)","relationship_id":"relationship--25d926a0-d2b5-473d-b27b-fb69cf763b77","references":[{"source_name":"US-CERT Bankshot Dec 2017","description":"US-CERT. (2017, December 13). Malware Analysis Report (MAR) - 10135536-B. Retrieved July 17, 2018.","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536-B_WHITE.PDF"}]},{"id":"S0240","name":"ROKRAT","url":"https://attack.mitre.org/software/S0240","kind":"malware","description":"[ROKRAT](https://attack.mitre.org/software/S0240) has the ability to gather a list of files and directories on the infected system.(Citation: Securelist ScarCruft May 2019)(Citation: NCCGroup RokRat Nov 2018)(Citation: Volexity InkySquid RokRAT August 2021)","relationship_id":"relationship--90be71e4-6b38-4411-aac5-09711a334393","references":[{"source_name":"Securelist ScarCruft May 2019","description":"GReAT. (2019, May 13). ScarCruft continues to evolve, introduces Bluetooth harvester. Retrieved June 4, 2019.","url":"https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/"},{"source_name":"NCCGroup RokRat Nov 2018","description":"Pantazopoulos, N.. (2018, November 8). RokRat Analysis. Retrieved May 21, 2020.","url":"https://research.nccgroup.com/2018/11/08/rokrat-analysis/"},{"source_name":"Volexity InkySquid RokRAT August 2021","description":"Cash, D., Grunzweig, J., Adair, S., Lancaster, T. (2021, August 25). North Korean BLUELIGHT Special: InkySquid Deploys RokRAT. Retrieved October 1, 2021.","url":"https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"}]},{"id":"S0242","name":"SynAck","url":"https://attack.mitre.org/software/S0242","kind":"malware","description":"[SynAck](https://attack.mitre.org/software/S0242) checks its directory location in an attempt to avoid launching in a sandbox.(Citation: SecureList SynAck Doppelgänging May 2018)(Citation: Kaspersky Lab SynAck May 2018)","relationship_id":"relationship--0dba319b-0d1e-4c73-8153-9ce13d27c98c","references":[{"source_name":"SecureList SynAck Doppelgänging May 2018","description":"Ivanov, A. et al. (2018, May 7). SynAck targeted ransomware uses the Doppelgänging technique. Retrieved May 22, 2018.","url":"https://securelist.com/synack-targeted-ransomware-uses-the-doppelganging-technique/85431/"},{"source_name":"Kaspersky Lab SynAck May 2018","description":"Bettencourt, J. (2018, May 7). Kaspersky Lab finds new variant of SynAck ransomware using sophisticated Doppelgänging technique. Retrieved May 24, 2018.","url":"https://usa.kaspersky.com/about/press-releases/2018_synack-doppelganging"}]},{"id":"S0248","name":"yty","url":"https://attack.mitre.org/software/S0248","kind":"malware","description":"[yty](https://attack.mitre.org/software/S0248) gathers information on victim’s drives and has a plugin for document listing.(Citation: ASERT Donot March 2018)","relationship_id":"relationship--0efc2bef-9227-4af2-b73b-bfa61a3073aa","references":[{"source_name":"ASERT Donot March 2018","description":"Schwarz, D., Sopko J. (2018, March 08). Donot Team Leverages New Modular Malware Framework in South Asia. Retrieved June 11, 2018.","url":"https://www.arbornetworks.com/blog/asert/donot-team-leverages-new-modular-malware-framework-south-asia/"}]},{"id":"S0249","name":"Gold Dragon","url":"https://attack.mitre.org/software/S0249","kind":"malware","description":"[Gold Dragon](https://attack.mitre.org/software/S0249) lists the directories for Desktop, program files, and the user’s recently accessed files.(Citation: McAfee Gold Dragon)","relationship_id":"relationship--b106375b-8359-41fa-b979-c883fa827346","references":[{"source_name":"McAfee Gold Dragon","description":"Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"}]},{"id":"S0250","name":"Koadic","url":"https://attack.mitre.org/software/S0250","kind":"tool","description":"[Koadic](https://attack.mitre.org/software/S0250) can obtain a list of directories.(Citation: MalwareBytes LazyScripter Feb 2021)","relationship_id":"relationship--94472a50-e097-4b67-9f59-2840a1633a0f","references":[{"source_name":"MalwareBytes LazyScripter Feb 2021","description":"Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"id":"S0251","name":"Zebrocy","url":"https://attack.mitre.org/software/S0251","kind":"malware","description":"[Zebrocy](https://attack.mitre.org/software/S0251) searches for files that are 60mb and less and contain the following extensions: .doc, .docx, .xls, .xlsx, .ppt, .pptx, .exe, .zip, and .rar. [Zebrocy](https://attack.mitre.org/software/S0251) also runs the <code>echo %APPDATA%</code> command to list the contents of the directory.(Citation: Securelist Sofacy Feb 2018)(Citation: ESET Zebrocy Nov 2018)(Citation: ESET Zebrocy May 2019) [Zebrocy](https://attack.mitre.org/software/S0251) can obtain the current execution path as well as perform drive enumeration.(Citation: Accenture SNAKEMACKEREL Nov 2018)(Citation: CISA Zebrocy Oct 2020) ","relationship_id":"relationship--86b7bab7-a1d6-4820-be55-c379f3967f1a","references":[{"source_name":"Securelist Sofacy Feb 2018","description":"Kaspersky Lab's Global Research & Analysis Team. (2018, February 20). A Slice of 2017 Sofacy Activity. Retrieved November 27, 2018.","url":"https://securelist.com/a-slice-of-2017-sofacy-activity/83930/"},{"source_name":"ESET Zebrocy Nov 2018","description":"ESET. (2018, November 20). Sednit: What’s going on with Zebrocy?. Retrieved February 12, 2019.","url":"https://www.welivesecurity.com/2018/11/20/sednit-whats-going-zebrocy/"},{"source_name":"ESET Zebrocy May 2019","description":"ESET Research. (2019, May 22). A journey to Zebrocy land. Retrieved June 20, 2019.","url":"https://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/"},{"source_name":"Accenture SNAKEMACKEREL Nov 2018","description":"Accenture Security. (2018, November 29). SNAKEMACKEREL. Retrieved April 15, 2019.","url":"https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50"},{"source_name":"CISA Zebrocy Oct 2020","description":"CISA. (2020, October 29). Malware Analysis Report (AR20-303B). Retrieved December 9, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-303b"}]},{"id":"S0252","name":"Brave Prince","url":"https://attack.mitre.org/software/S0252","kind":"malware","description":"[Brave Prince](https://attack.mitre.org/software/S0252) gathers file and directory information from the victim’s machine.(Citation: McAfee Gold Dragon)","relationship_id":"relationship--69127424-40bb-4b92-8558-6fe1561e0a59","references":[{"source_name":"McAfee Gold Dragon","description":"Sherstobitoff, R., Saavedra-Morales, J. (2018, February 02). Gold Dragon Widens Olympics Malware Attacks, Gains Permanent Presence on Victims’ Systems. Retrieved June 6, 2018.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/gold-dragon-widens-olympics-malware-attacks-gains-permanent-presence-on-victims-systems/"}]},{"id":"S0255","name":"DDKONG","url":"https://attack.mitre.org/software/S0255","kind":"malware","description":"[DDKONG](https://attack.mitre.org/software/S0255) lists files on the victim’s machine.(Citation: Rancor Unit42 June 2018)","relationship_id":"relationship--992c7f74-c6d8-43e9-98e7-5818ca9524e3","references":[{"source_name":"Rancor Unit42 June 2018","description":"Ash, B., et al. (2018, June 26). RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families. Retrieved July 2, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}]},{"id":"S0259","name":"InnaputRAT","url":"https://attack.mitre.org/software/S0259","kind":"malware","description":"[InnaputRAT](https://attack.mitre.org/software/S0259) enumerates directories and obtains file attributes on a system.(Citation: ASERT InnaputRAT April 2018)","relationship_id":"relationship--60c352ec-eb4c-451a-a56e-43a9dc4ee91f","references":[{"source_name":"ASERT InnaputRAT April 2018","description":"ASERT Team. (2018, April 04). Innaput Actors Utilize Remote Access Trojan Since 2016, Presumably Targeting Victim Files. Retrieved July 9, 2018.","url":"https://asert.arbornetworks.com/innaput-actors-utilize-remote-access-trojan-since-2016-presumably-targeting-victim-files/"}]},{"id":"S0260","name":"InvisiMole","url":"https://attack.mitre.org/software/S0260","kind":"malware","description":"[InvisiMole](https://attack.mitre.org/software/S0260) can list information about files in a directory and recently opened or used documents. [InvisiMole](https://attack.mitre.org/software/S0260) can also search for specific files by supplied file mask.(Citation: ESET InvisiMole June 2018)","relationship_id":"relationship--aef68e46-d1e1-49b9-aade-6c1bf226e053","references":[{"source_name":"ESET InvisiMole June 2018","description":"Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018.","url":"https://www.welivesecurity.com/2018/06/07/invisimole-equipped-spyware-undercover/"}]},{"id":"S0263","name":"TYPEFRAME","url":"https://attack.mitre.org/software/S0263","kind":"malware","description":"[TYPEFRAME](https://attack.mitre.org/software/S0263) can search directories for files on the victim’s machine.(Citation: US-CERT TYPEFRAME June 2018)","relationship_id":"relationship--fe1c5e06-ea4b-4286-af2d-984a095f7924","references":[{"source_name":"US-CERT TYPEFRAME June 2018","description":"US-CERT. (2018, June 14). MAR-10135536-12 – North Korean Trojan: TYPEFRAME. Retrieved July 13, 2018.","url":"https://www.us-cert.gov/ncas/analysis-reports/AR18-165A"}]},{"id":"S0265","name":"Kazuar","url":"https://attack.mitre.org/software/S0265","kind":"malware","description":"[Kazuar](https://attack.mitre.org/software/S0265) finds a specified directory, lists the files and metadata about those files.(Citation: Unit 42 Kazuar May 2017)","relationship_id":"relationship--636be06a-5c19-45c8-b6be-c38634c583dc","references":[{"source_name":"Unit 42 Kazuar May 2017","description":"Levene, B, et al. (2017, May 03). Kazuar: Multiplatform Espionage Backdoor with API Access. Retrieved July 17, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/05/unit42-kazuar-multiplatform-espionage-backdoor-api-access/"}]},{"id":"S0266","name":"TrickBot","url":"https://attack.mitre.org/software/S0266","kind":"malware","description":"[TrickBot](https://attack.mitre.org/software/S0266) searches the system for all of the following file extensions: .avi, .mov, .mkv, .mpeg, .mpeg4, .mp4, .mp3, .wav, .ogg, .jpeg, .jpg, .png, .bmp, .gif, .tiff, .ico, .xlsx, and .zip. It can also obtain browsing history, cookies, and plug-in information.(Citation: S2 Grupo TrickBot June 2017)(Citation: Trend Micro Trickbot Nov 2018)","relationship_id":"relationship--caef212a-7ed2-4cb9-a155-7ce79a9784b8","references":[{"source_name":"S2 Grupo TrickBot June 2017","description":"Salinas, M., Holguin, J. (2017, June). Evolution of Trickbot. Retrieved July 31, 2018.","url":"https://www.securityartwork.es/wp-content/uploads/2017/07/Trickbot-report-S2-Grupo.pdf"},{"source_name":"Trend Micro Trickbot Nov 2018","description":"Anthony, N., Pascual, C.. (2018, November 1). Trickbot Shows Off New Trick: Password Grabber Module. Retrieved November 16, 2018.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-shows-off-new-trick-password-grabber-module/"}]},{"id":"S0268","name":"Bisonal","url":"https://attack.mitre.org/software/S0268","kind":"malware","description":"[Bisonal](https://attack.mitre.org/software/S0268) can retrieve a file listing from the system.(Citation: Kaspersky CactusPete Aug 2020)(Citation: Talos Bisonal Mar 2020) ","relationship_id":"relationship--6ec66973-8ba0-4ec4-a4ca-c49a304f56b7","references":[{"source_name":"Kaspersky CactusPete Aug 2020","description":"Zykov, K. (2020, August 13). CactusPete APT group’s updated Bisonal backdoor. Retrieved May 5, 2021.","url":"https://securelist.com/cactuspete-apt-groups-updated-bisonal-backdoor/97962/"},{"source_name":"Talos Bisonal Mar 2020","description":"Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022.","url":"https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"}]},{"id":"S0271","name":"KEYMARBLE","url":"https://attack.mitre.org/software/S0271","kind":"malware","description":"[KEYMARBLE](https://attack.mitre.org/software/S0271) has a command to search for files on the victim’s machine.(Citation: US-CERT KEYMARBLE Aug 2018)","relationship_id":"relationship--30ab931e-9cc1-4e95-a3f5-364be094b54e","references":[{"source_name":"US-CERT KEYMARBLE Aug 2018","description":"US-CERT. (2018, August 09). MAR-10135536-17 – North Korean Trojan: KEYMARBLE. Retrieved August 16, 2018.","url":"https://www.us-cert.gov/ncas/analysis-reports/AR18-221A"}]},{"id":"S0272","name":"NDiskMonitor","url":"https://attack.mitre.org/software/S0272","kind":"malware","description":"[NDiskMonitor](https://attack.mitre.org/software/S0272) can obtain a list of all files and directories as well as logical drives.(Citation: TrendMicro Patchwork Dec 2017)","relationship_id":"relationship--b7226792-d4ae-472c-a407-853d56fc887d","references":[{"source_name":"TrendMicro Patchwork Dec 2017","description":"Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"id":"S0275","name":"UPPERCUT","url":"https://attack.mitre.org/software/S0275","kind":"malware","description":"[UPPERCUT](https://attack.mitre.org/software/S0275) has the capability to gather the victim's current directory.(Citation: FireEye APT10 Sept 2018)","relationship_id":"relationship--f757a567-97b2-41b0-b58a-1530156ba457","references":[{"source_name":"FireEye APT10 Sept 2018","description":"Matsuda, A., Muhammad I. (2018, September 13). APT10 Targeting Japanese Corporations Using Updated TTPs. Retrieved September 17, 2018.","url":"https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"}]},{"id":"S0277","name":"FruitFly","url":"https://attack.mitre.org/software/S0277","kind":"malware","description":"[FruitFly](https://attack.mitre.org/software/S0277) looks for specific files and file types.(Citation: objsee mac malware 2017)","relationship_id":"relationship--ddbbd283-6874-4348-82c7-98df6d59ac41","references":[{"source_name":"objsee mac malware 2017","description":"Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.","url":"https://objective-see.com/blog/blog_0x25.html"}]},{"id":"S0283","name":"jRAT","url":"https://attack.mitre.org/software/S0283","kind":"malware","description":"[jRAT](https://attack.mitre.org/software/S0283) can browse file systems.(Citation: Kaspersky Adwind Feb 2016)(Citation: Symantec Frutas Feb 2013)","relationship_id":"relationship--7de1c513-5141-45ed-aeb0-b1b221f4dc3f","references":[{"source_name":"Kaspersky Adwind Feb 2016","description":"Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07195002/KL_AdwindPublicReport_2016.pdf"},{"source_name":"Symantec Frutas Feb 2013","description":"Bingham, J. (2013, February 11). Cross-Platform Frutas RAT Builder and Back Door. Retrieved April 23, 2019.","url":"https://www.symantec.com/connect/blogs/cross-platform-frutas-rat-builder-and-back-door"}]},{"id":"S0330","name":"Zeus Panda","url":"https://attack.mitre.org/software/S0330","kind":"malware","description":"[Zeus Panda](https://attack.mitre.org/software/S0330) searches for specific directories on the victim’s machine.(Citation: GDATA Zeus Panda June 2017)","relationship_id":"relationship--e8906575-d90c-4d56-9fb7-bba3560bbeba","references":[{"source_name":"GDATA Zeus Panda June 2017","description":"Ebach, L. (2017, June 22). Analysis Results of Zeus.Variant.Panda. Retrieved November 5, 2018.","url":"https://cyberwtf.files.wordpress.com/2017/07/panda-whitepaper.pdf"}]},{"id":"S0332","name":"Remcos","url":"https://attack.mitre.org/software/S0332","kind":"tool","description":"[Remcos](https://attack.mitre.org/software/S0332) can search for files on the infected machine.(Citation: Riskiq Remcos Jan 2018)(Citation: Fortinet Remcos Campaign NOV 2024)","relationship_id":"relationship--cafaa08a-1f40-40cb-a3fd-c507a1cc6e40","references":[{"source_name":"Riskiq Remcos Jan 2018","description":"Klijnsma, Y. (2018, January 23). Espionage Campaign Leverages Spear Phishing, RATs Against Turkish Defense Contractors. Retrieved November 6, 2018.","url":"https://web.archive.org/web/20180124082756/https://www.riskiq.com/blog/labs/spear-phishing-turkish-defense-contractors/"},{"source_name":"Fortinet Remcos Campaign NOV 2024","description":"Zhang, X. (2024, November 8). New Campaign Uses Remcos RAT to Exploit Victims. Retrieved April 16, 2026.","url":"https://www.fortinet.com/blog/threat-research/new-campaign-uses-remcos-rat-to-exploit-victims"}]},{"id":"S0337","name":"BadPatch","url":"https://attack.mitre.org/software/S0337","kind":"malware","description":"[BadPatch](https://attack.mitre.org/software/S0337) searches for files with specific file extensions.(Citation: Unit 42 BadPatch Oct 2017)","relationship_id":"relationship--5b83337c-5030-402d-ad28-1b9f5cf782cc","references":[{"source_name":"Unit 42 BadPatch Oct 2017","description":"Bar, T., Conant, S. (2017, October 20). BadPatch. Retrieved November 13, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/10/unit42-badpatch/"}]},{"id":"S0339","name":"Micropsia","url":"https://attack.mitre.org/software/S0339","kind":"malware","description":"[Micropsia](https://attack.mitre.org/software/S0339) can perform a recursive directory listing for all volume drives available on the victim's machine and can also fetch specific files by their paths.(Citation: Radware Micropsia July 2018)","relationship_id":"relationship--19f512b8-6869-460d-97d8-7e1f9b3c51cb","references":[{"source_name":"Radware Micropsia July 2018","description":"Tsarfaty, Y. (2018, July 25). Micropsia Malware. Retrieved November 13, 2018.","url":"https://www.radware.com/blog/security/2018/07/micropsia-malware/"}]},{"id":"S0340","name":"Octopus","url":"https://attack.mitre.org/software/S0340","kind":"malware","description":"[Octopus](https://attack.mitre.org/software/S0340) can collect information on the Windows directory and searches for compressed RAR files on the host.(Citation: Securelist Octopus Oct 2018)(Citation: Security Affairs DustSquad Oct 2018)(Citation: ESET Nomadic Octopus 2018)","relationship_id":"relationship--6d3fee1f-1c19-4ad8-9cd9-e5b00e5b040a","references":[{"source_name":"Securelist Octopus Oct 2018","description":"Kaspersky Lab's Global Research & Analysis Team. (2018, October 15). Octopus-infested seas of Central Asia. Retrieved November 14, 2018.","url":"https://securelist.com/octopus-infested-seas-of-central-asia/88200/"},{"source_name":"Security Affairs DustSquad Oct 2018","description":"Paganini, P. (2018, October 16). Russia-linked APT group DustSquad targets diplomatic entities in Central Asia. Retrieved August 24, 2021.","url":"https://securityaffairs.co/wordpress/77165/apt/russia-linked-apt-dustsquad.html"},{"source_name":"ESET Nomadic Octopus 2018","description":"Cherepanov, A. (2018, October 4). Nomadic Octopus Cyber espionage in Central Asia. Retrieved October 13, 2021.","url":"https://www.virusbulletin.com/uploads/pdf/conference_slides/2018/Cherepanov-VB2018-Octopus.pdf"}]},{"id":"S0344","name":"Azorult","url":"https://attack.mitre.org/software/S0344","kind":"malware","description":"[Azorult](https://attack.mitre.org/software/S0344) can recursively search for files in folders and collects files from the desktop with certain extensions.(Citation: Unit42 Azorult Nov 2018)","relationship_id":"relationship--de7c6e69-dd8f-4063-aaa2-569ab767629e","references":[{"source_name":"Unit42 Azorult Nov 2018","description":"Yan, T., et al. (2018, November 21). New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit. Retrieved November 29, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-new-wine-old-bottle-new-azorult-variant-found-findmyname-campaign-using-fallout-exploit-kit/"}]},{"id":"S0345","name":"Seasalt","url":"https://attack.mitre.org/software/S0345","kind":"malware","description":"[Seasalt](https://attack.mitre.org/software/S0345) has the capability to identify the drive type on a victim.(Citation: McAfee Oceansalt Oct 2018)","relationship_id":"relationship--2d76d7b2-ec41-4630-8405-ec7db2c0607c","references":[{"source_name":"McAfee Oceansalt Oct 2018","description":"Sherstobitoff, R., Malhotra, A. (2018, October 18). ‘Operation Oceansalt’ Attacks South Korea, U.S., and Canada With Source Code From Chinese Hacker Group. Retrieved November 30, 2018.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-oceansalt.pdf"}]},{"id":"S0346","name":"OceanSalt","url":"https://attack.mitre.org/software/S0346","kind":"malware","description":"[OceanSalt](https://attack.mitre.org/software/S0346) can extract drive information from the endpoint and search files on the system.(Citation: McAfee Oceansalt Oct 2018)","relationship_id":"relationship--6c130c97-8623-4d14-829e-0e90dd0757a0","references":[{"source_name":"McAfee Oceansalt Oct 2018","description":"Sherstobitoff, R., Malhotra, A. (2018, October 18). ‘Operation Oceansalt’ Attacks South Korea, U.S., and Canada With Source Code From Chinese Hacker Group. Retrieved November 30, 2018.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-oceansalt.pdf"}]},{"id":"S0347","name":"AuditCred","url":"https://attack.mitre.org/software/S0347","kind":"malware","description":"[AuditCred](https://attack.mitre.org/software/S0347) can search through folders and files on the system.(Citation: TrendMicro Lazarus Nov 2018)","relationship_id":"relationship--227abd66-91cc-436e-aad8-c1fb82691357","references":[{"source_name":"TrendMicro Lazarus Nov 2018","description":"Trend Micro. (2018, November 20). Lazarus Continues Heists, Mounts Attacks on Financial Organizations in Latin America. Retrieved December 3, 2018.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/lazarus-continues-heists-mounts-attacks-on-financial-organizations-in-latin-america/"}]},{"id":"S0348","name":"Cardinal RAT","url":"https://attack.mitre.org/software/S0348","kind":"malware","description":"[Cardinal RAT](https://attack.mitre.org/software/S0348) checks its current working directory upon execution and also contains watchdog functionality that ensures its executable is located in the correct path (else it will rewrite the payload).(Citation: PaloAlto CardinalRat Apr 2017)","relationship_id":"relationship--3572a770-9151-42d5-82b5-360002725052","references":[{"source_name":"PaloAlto CardinalRat Apr 2017","description":"Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018.","url":"https://researchcenter.paloaltonetworks.com/2017/04/unit42-cardinal-rat-active-two-years/"}]},{"id":"S0350","name":"zwShell","url":"https://attack.mitre.org/software/S0350","kind":"malware","description":"[zwShell](https://attack.mitre.org/software/S0350) can browse the file system.(Citation: McAfee Night Dragon)","relationship_id":"relationship--4990cf9a-9041-45c6-9d31-232ddb770341","references":[{"source_name":"McAfee Night Dragon","description":"McAfee® Foundstone® Professional Services and McAfee Labs™. (2011, February 10). Global Energy Cyberattacks: “Night Dragon”. Retrieved February 19, 2018.","url":"https://scadahacker.com/library/Documents/Cyber_Events/McAfee%20-%20Night%20Dragon%20-%20Global%20Energy%20Cyberattacks.pdf"}]},{"id":"S0351","name":"Cannon","url":"https://attack.mitre.org/software/S0351","kind":"malware","description":"[Cannon](https://attack.mitre.org/software/S0351) can obtain victim drive information as well as a list of folders in C:\\Program Files.(Citation: Unit42 Cannon Nov 2018)","relationship_id":"relationship--b3c69087-f989-4f93-924a-0d6df6c75315","references":[{"source_name":"Unit42 Cannon Nov 2018","description":"Falcone, R., Lee, B. (2018, November 20). Sofacy Continues Global Attacks and Wheels Out New ‘Cannon’ Trojan. Retrieved November 26, 2018.","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"}]},{"id":"S0354","name":"Denis","url":"https://attack.mitre.org/software/S0354","kind":"malware","description":"[Denis](https://attack.mitre.org/software/S0354) has several commands to search directories for files.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)","relationship_id":"relationship--9c3faa58-eb39-407a-8233-8f43f53aa777","references":[{"source_name":"Cybereason Oceanlotus May 2017","description":"Dahan, A. (2017, May 24). OPERATION COBALT KITTY: A LARGE-SCALE APT IN ASIA CARRIED OUT BY THE OCEANLOTUS GROUP. Retrieved November 5, 2018.","url":"https://www.cybereason.com/blog/operation-cobalt-kitty-apt"},{"source_name":"Cybereason Cobalt Kitty 2017","description":"Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"id":"S0356","name":"KONNI","url":"https://attack.mitre.org/software/S0356","kind":"malware","description":"A version of [KONNI](https://attack.mitre.org/software/S0356) searches for filenames created with a previous version of the malware, suggesting different versions targeted the same victims and the versions may work together.(Citation: Talos Konni May 2017)","relationship_id":"relationship--d4c9b3cb-44ca-47be-b10f-2371ef1c23df","references":[{"source_name":"Talos Konni May 2017","description":"Rascagneres, P. (2017, May 03). KONNI: A Malware Under The Radar For Years. Retrieved November 5, 2018.","url":"https://blog.talosintelligence.com/2017/05/konni-malware-under-radar-for-years.html"}]},{"id":"S0363","name":"Empire","url":"https://attack.mitre.org/software/S0363","kind":"tool","description":"[Empire](https://attack.mitre.org/software/S0363) includes various modules for finding files of interest on hosts and network shares.(Citation: Github PowerShell Empire)","relationship_id":"relationship--75cc19f5-00b4-43e2-8eae-f633693dbe56","references":[{"source_name":"Github PowerShell Empire","description":"Schroeder, W., Warner, J., Nelson, M. (n.d.). Github PowerShellEmpire. Retrieved April 28, 2016.","url":"https://github.com/PowerShellEmpire/Empire"}]},{"id":"S0366","name":"WannaCry","url":"https://attack.mitre.org/software/S0366","kind":"malware","description":"[WannaCry](https://attack.mitre.org/software/S0366) searches for variety of user files by file extension before encrypting them using RSA and AES, including Office, PDF, image, audio, video, source code, archive/compression format, and key and certificate files.(Citation: LogRhythm WannaCry)(Citation: FireEye WannaCry 2017)","relationship_id":"relationship--3ca496bf-41f9-4d0b-b36d-576f90db340e","references":[{"source_name":"FireEye WannaCry 2017","description":"Berry, A., Homan, J., and Eitzman, R. (2017, May 23). WannaCry Malware Profile. Retrieved March 15, 2019.","url":"https://www.fireeye.com/blog/threat-research/2017/05/wannacry-malware-profile.html"},{"source_name":"LogRhythm WannaCry","description":"Noerenberg, E., Costis, A., and Quist, N. (2017, May 16). A Technical Analysis of WannaCry Ransomware. Retrieved December 8, 2024.","url":"https://web.archive.org/web/20230522041200/https://logrhythm.com/blog/a-technical-analysis-of-wannacry-ransomware/"}]},{"id":"S0368","name":"NotPetya","url":"https://attack.mitre.org/software/S0368","kind":"malware","description":"[NotPetya](https://attack.mitre.org/software/S0368) searches for files ending with dozens of different file extensions prior to encryption.(Citation: US District Court Indictment GRU Unit 74455 October 2020)","relationship_id":"relationship--7c958b31-ef21-4231-9a8f-a66cb7db3355","references":[{"source_name":"US District Court Indictment GRU Unit 74455 October 2020","description":"Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"id":"S0375","name":"Remexi","url":"https://attack.mitre.org/software/S0375","kind":"malware","description":"[Remexi](https://attack.mitre.org/software/S0375) searches for files on the system. (Citation: Securelist Remexi Jan 2019)","relationship_id":"relationship--df0cfac5-fe50-4cc3-bc47-9a1d49c53e0a","references":[{"source_name":"Securelist Remexi Jan 2019","description":"Legezo, D. (2019, January 30). Chafer used Remexi malware to spy on Iran-based foreign diplomatic entities. Retrieved April 17, 2019.","url":"https://securelist.com/chafer-used-remexi-malware/89538/"}]},{"id":"S0376","name":"HOPLIGHT","url":"https://attack.mitre.org/software/S0376","kind":"malware","description":"[HOPLIGHT](https://attack.mitre.org/software/S0376) has been observed enumerating system drives and partitions.(Citation: US-CERT HOPLIGHT Apr 2019)\t","relationship_id":"relationship--536a0d57-9faf-4baa-83de-40c7aaafe28c","references":[{"source_name":"US-CERT HOPLIGHT Apr 2019","description":"US-CERT. (2019, April 10). MAR-10135536-8 – North Korean Trojan: HOPLIGHT. Retrieved April 19, 2019.","url":"https://www.us-cert.gov/ncas/analysis-reports/AR19-100A"}]},{"id":"S0378","name":"PoshC2","url":"https://attack.mitre.org/software/S0378","kind":"tool","description":"[PoshC2](https://attack.mitre.org/software/S0378) can enumerate files on the local file system and includes a module for enumerating recently accessed files.(Citation: GitHub PoshC2)","relationship_id":"relationship--7af39008-1480-4524-b8ce-e285628f61be","references":[{"source_name":"GitHub PoshC2","description":"Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.","url":"https://github.com/nettitude/PoshC2_Python"}]},{"id":"S0385","name":"njRAT","url":"https://attack.mitre.org/software/S0385","kind":"malware","description":"[njRAT](https://attack.mitre.org/software/S0385) can browse file systems using a file manager module.(Citation: Fidelis njRAT June 2013)","relationship_id":"relationship--1daaea6e-527f-4c3d-9387-72ea68d7140d","references":[{"source_name":"Fidelis njRAT June 2013","description":"Fidelis Cybersecurity. (2013, June 28). Fidelis Threat Advisory #1009: \"njRAT\" Uncovered. Retrieved June 4, 2019.","url":"https://www.threatminer.org/_reports/2013/fta-1009---njrat-uncovered-1.pdf"}]},{"id":"S0387","name":"KeyBoy","url":"https://attack.mitre.org/software/S0387","kind":"malware","description":"[KeyBoy](https://attack.mitre.org/software/S0387) has a command to launch a file browser or explorer on the system.(Citation: PWC KeyBoys Feb 2017)","relationship_id":"relationship--96ea567d-7113-4c2e-82c4-2ae6c6916ae9","references":[{"source_name":"PWC KeyBoys Feb 2017","description":"Parys, B. (2017, February 11). The KeyBoys are back in town. Retrieved June 13, 2019.","url":"https://web.archive.org/web/20211129064701/https://www.pwc.co.uk/issues/cyber-security-services/research/the-keyboys-are-back-in-town.html"}]},{"id":"S0402","name":"OSX/Shlayer","url":"https://attack.mitre.org/software/S0402","kind":"malware","description":"[OSX/Shlayer](https://attack.mitre.org/software/S0402) has used the command <code>appDir=\"$(dirname $(dirname \"$currentDir\"))\"</code> and <code>$(dirname \"$(pwd -P)\")</code> to construct installation paths.(Citation: sentinelone shlayer to zshlayer)(Citation: 20 macOS Common Tools and Techniques)","relationship_id":"relationship--9cbfc2f6-0b87-402c-b536-2d9688b2e0ea","references":[{"source_name":"sentinelone shlayer to zshlayer","description":"Phil Stokes. (2020, September 8). Coming Out of Your Shell: From Shlayer to ZShlayer. Retrieved September 13, 2021.","url":"https://www.sentinelone.com/blog/coming-out-of-your-shell-from-shlayer-to-zshlayer/"},{"source_name":"20 macOS Common Tools and Techniques","description":"Phil Stokes. (2021, February 16). 20 Common Tools & Techniques Used by macOS Threat Actors & Malware. Retrieved August 23, 2021.","url":"https://labs.sentinelone.com/20-common-tools-techniques-used-by-macos-threat-actors-malware/"}]},{"id":"S0409","name":"Machete","url":"https://attack.mitre.org/software/S0409","kind":"malware","description":"[Machete](https://attack.mitre.org/software/S0409) produces file listings in order to search for files to be exfiltrated.(Citation: ESET Machete July 2019)(Citation: Cylance Machete Mar 2017)(Citation: 360 Machete Sep 2020)","relationship_id":"relationship--d0c60722-e668-4597-a25f-f7e1eb1a5962","references":[{"source_name":"ESET Machete July 2019","description":"ESET. (2019, July). MACHETE JUST GOT SHARPER Venezuelan government institutions under attack. Retrieved September 13, 2019.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"},{"source_name":"Cylance Machete Mar 2017","description":"The Cylance Threat Research Team. (2017, March 22). El Machete's Malware Attacks Cut Through LATAM. Retrieved September 13, 2019.","url":"https://threatvector.cylance.com/en_us/home/el-machete-malware-attacks-cut-through-latam.html"},{"source_name":"360 Machete Sep 2020","description":"kate. (2020, September 25). APT-C-43 steals Venezuelan military secrets to provide intelligence support for the reactionaries — HpReact campaign. Retrieved November 20, 2020.","url":"https://blog.360totalsecurity.com/en/apt-c-43-steals-venezuelan-military-secrets-to-provide-intelligence-support-for-the-reactionaries-hpreact-campaign/"}]},{"id":"S0410","name":"Fysbis","url":"https://attack.mitre.org/software/S0410","kind":"malware","description":"[Fysbis](https://attack.mitre.org/software/S0410) has the ability to search for files.(Citation: Fysbis Dr Web Analysis) ","relationship_id":"relationship--13b78b09-00b6-4307-87b7-7cd8c9360b39","references":[{"source_name":"Fysbis Dr Web Analysis","description":"Doctor Web. (2014, November 21). Linux.BackDoor.Fysbis.1. Retrieved December 7, 2017.","url":"https://vms.drweb.com/virus/?i=4276269"}]},{"id":"S0412","name":"ZxShell","url":"https://attack.mitre.org/software/S0412","kind":"malware","description":"[ZxShell](https://attack.mitre.org/software/S0412) has a command to open a file manager and explorer on the system.(Citation: Talos ZxShell Oct 2014) ","relationship_id":"relationship--49dbde7a-a8ac-4d86-8216-1055f7536467","references":[{"source_name":"Talos ZxShell Oct 2014","description":"Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.","url":"https://blogs.cisco.com/security/talos/opening-zxshell"}]},{"id":"S0414","name":"BabyShark","url":"https://attack.mitre.org/software/S0414","kind":"malware","description":"[BabyShark](https://attack.mitre.org/software/S0414) has used <code>dir</code> to search for \"programfiles\" and \"appdata\".(Citation: Unit42 BabyShark Feb 2019)\t","relationship_id":"relationship--5c738353-868a-4e4d-8628-e1d14e502980","references":[{"source_name":"Unit42 BabyShark Feb 2019","description":"Unit 42. (2019, February 22). New BabyShark Malware Targets U.S. National Security Think Tanks. Retrieved October 7, 2019.","url":"https://unit42.paloaltonetworks.com/new-babyshark-malware-targets-u-s-national-security-think-tanks/"}]},{"id":"S0428","name":"PoetRAT","url":"https://attack.mitre.org/software/S0428","kind":"malware","description":"[PoetRAT](https://attack.mitre.org/software/S0428) has the ability to list files upon receiving the <code>ls</code> command from C2.(Citation: Talos PoetRAT April 2020)","relationship_id":"relationship--2bcaf336-cd02-47e3-b73f-6f0c5cc3592f","references":[{"source_name":"Talos PoetRAT April 2020","description":"Mercer, W, et al. (2020, April 16). PoetRAT: Python RAT uses COVID-19 lures to target Azerbaijan public and private sectors. Retrieved April 27, 2020.","url":"https://blog.talosintelligence.com/2020/04/poetrat-covid-19-lures.html"}]},{"id":"S0431","name":"HotCroissant","url":"https://attack.mitre.org/software/S0431","kind":"malware","description":"[HotCroissant](https://attack.mitre.org/software/S0431) has the ability to retrieve a list of files in a given directory as well as drives and drive types.(Citation: Carbon Black HotCroissant April 2020)","relationship_id":"relationship--911d7f27-a32e-45fb-a66b-e7b195023c43","references":[{"source_name":"Carbon Black HotCroissant April 2020","description":"Knight, S.. (2020, April 16). VMware Carbon Black TAU Threat Analysis: The Evolution of Lazarus. Retrieved May 1, 2020.","url":"https://www.carbonblack.com/2020/04/16/vmware-carbon-black-tau-threat-analysis-the-evolution-of-lazarus/"}]},{"id":"S0434","name":"Imminent Monitor","url":"https://attack.mitre.org/software/S0434","kind":"tool","description":"[Imminent Monitor](https://attack.mitre.org/software/S0434) has a dynamic debugging feature to check whether it is located in the %TEMP% directory, otherwise it copies itself there.(Citation: QiAnXin APT-C-36 Feb2019)","relationship_id":"relationship--e80f97df-4984-4e62-bba6-1333d4c2c977","references":[{"source_name":"QiAnXin APT-C-36 Feb2019","description":"QiAnXin Threat Intelligence Center. (2019, February 18). APT-C-36: Continuous Attacks Targeting Colombian Government Institutions and Corporations. Retrieved May 5, 2020.","url":"https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"}]},{"id":"S0435","name":"PLEAD","url":"https://attack.mitre.org/software/S0435","kind":"malware","description":"[PLEAD](https://attack.mitre.org/software/S0435) has the ability to list drives and files on the compromised host.(Citation: TrendMicro BlackTech June 2017)(Citation: JPCert PLEAD Downloader June 2018)","relationship_id":"relationship--884019ca-fca8-46a8-8dc4-71f60427db0f","references":[{"source_name":"TrendMicro BlackTech June 2017","description":"Bermejo, L., et al. (2017, June 22). Following the Trail of BlackTech’s Cyber Espionage Campaigns. Retrieved May 5, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/"},{"source_name":"JPCert PLEAD Downloader June 2018","description":"Tomonaga, S. (2018, June 8). PLEAD Downloader Used by BlackTech. Retrieved May 6, 2020.","url":"https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html"}]},{"id":"S0436","name":"TSCookie","url":"https://attack.mitre.org/software/S0436","kind":"malware","description":"[TSCookie](https://attack.mitre.org/software/S0436) has the ability to discover drive information on the infected host.(Citation: JPCert TSCookie March 2018)","relationship_id":"relationship--4b2baed3-8e3c-4ab6-9b92-f147a9ab7d13","references":[{"source_name":"JPCert TSCookie March 2018","description":"Tomonaga, S. (2018, March 6). Malware “TSCookie”. Retrieved May 6, 2020.","url":"https://blogs.jpcert.or.jp/en/2018/03/malware-tscooki-7aa0.html"}]},{"id":"S0437","name":"Kivars","url":"https://attack.mitre.org/software/S0437","kind":"malware","description":"[Kivars](https://attack.mitre.org/software/S0437) has the ability to list drives on the infected host.(Citation: TrendMicro BlackTech June 2017)","relationship_id":"relationship--37e4bb23-505b-41bb-a2f4-98501b065598","references":[{"source_name":"TrendMicro BlackTech June 2017","description":"Bermejo, L., et al. (2017, June 22). Following the Trail of BlackTech’s Cyber Espionage Campaigns. Retrieved May 5, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/"}]},{"id":"S0438","name":"Attor","url":"https://attack.mitre.org/software/S0438","kind":"malware","description":"[Attor](https://attack.mitre.org/software/S0438) has a plugin that enumerates files with specific extensions on all hard disk drives and stores file information in encrypted log files.(Citation: ESET Attor Oct 2019)","relationship_id":"relationship--01a01a28-19e5-4e32-8a24-a98f2b69ced5","references":[{"source_name":"ESET Attor Oct 2019","description":"Hromcova, Z. (2019, October). AT COMMANDS, TOR-BASED COMMUNICATIONS: MEET ATTOR, A FANTASY CREATURE AND ALSO A SPY PLATFORM. Retrieved May 6, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Attor.pdf"}]},{"id":"S0439","name":"Okrum","url":"https://attack.mitre.org/software/S0439","kind":"malware","description":"[Okrum](https://attack.mitre.org/software/S0439) has used DriveLetterView to enumerate drive information.(Citation: ESET Okrum July 2019)","relationship_id":"relationship--8908a544-e6b6-485a-8251-6c8dd1fbc040","references":[{"source_name":"ESET Okrum July 2019","description":"Hromcova, Z. (2019, July). OKRUM AND KETRICAN: AN OVERVIEW OF RECENT KE3CHANG GROUP ACTIVITY. Retrieved May 6, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/07/ESET_Okrum_and_Ketrican.pdf"}]},{"id":"S0443","name":"MESSAGETAP","url":"https://attack.mitre.org/software/S0443","kind":"malware","description":"[MESSAGETAP](https://attack.mitre.org/software/S0443) checks for the existence of two configuration files (keyword_parm.txt and parm.txt) and attempts to read the files every 30 seconds.(Citation: FireEye MESSAGETAP October 2019)","relationship_id":"relationship--f9c13c35-a493-4733-b51c-ab4857692e18","references":[{"source_name":"FireEye MESSAGETAP October 2019","description":"Leong, R., Perez, D., Dean, T. (2019, October 31). MESSAGETAP: Who’s Reading Your Text Messages?. Retrieved May 11, 2020.","url":"https://www.fireeye.com/blog/threat-research/2019/10/messagetap-who-is-reading-your-text-messages.html"}]},{"id":"S0444","name":"ShimRat","url":"https://attack.mitre.org/software/S0444","kind":"malware","description":"[ShimRat](https://attack.mitre.org/software/S0444) can list directories.(Citation: FOX-IT May 2016 Mofang)","relationship_id":"relationship--ec095867-cb54-4fcf-b2c7-00e805bf7500","references":[{"source_name":"FOX-IT May 2016 Mofang","description":"Yonathan Klijnsma. (2016, May 17). Mofang: A politically motivated information stealing adversary. Retrieved May 12, 2020.","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}]},{"id":"S0446","name":"Ryuk","url":"https://attack.mitre.org/software/S0446","kind":"malware","description":"[Ryuk](https://attack.mitre.org/software/S0446) has enumerated files and folders on all mounted drives.(Citation: CrowdStrike Ryuk January 2019)\t","relationship_id":"relationship--2b196fe7-93e1-4575-8818-578305fc1fae","references":[{"source_name":"CrowdStrike Ryuk January 2019","description":"Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.","url":"https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/"}]},{"id":"S0447","name":"Lokibot","url":"https://attack.mitre.org/software/S0447","kind":"malware","description":"[Lokibot](https://attack.mitre.org/software/S0447) can search for specific files on an infected host.(Citation: Talos Lokibot Jan 2021)","relationship_id":"relationship--53339b8f-f66b-4bcc-86a8-31daaeebb0e6","references":[{"source_name":"Talos Lokibot Jan 2021","description":"Muhammad, I., Unterbrink, H.. (2021, January 6). A Deep Dive into Lokibot Infection Chain. Retrieved August 31, 2021.","url":"https://blog.talosintelligence.com/2021/01/a-deep-dive-into-lokibot-infection-chain.html"}]},{"id":"S0448","name":"Rising Sun","url":"https://attack.mitre.org/software/S0448","kind":"malware","description":"[Rising Sun](https://attack.mitre.org/software/S0448) can enumerate information about files from the infected system, including file size, attributes, creation time, last access time, and write time. [Rising Sun](https://attack.mitre.org/software/S0448) can enumerate the compilation timestamp of Windows executable files.(Citation: McAfee Sharpshooter December 2018)\t","relationship_id":"relationship--cfaf6b8e-1ee0-40bf-8a60-27f9c68d86c5","references":[{"source_name":"McAfee Sharpshooter December 2018","description":"Sherstobitoff, R., Malhotra, A., et. al.. (2018, December 18). Operation Sharpshooter Campaign Targets Global Defense, Critical Infrastructure. Retrieved May 14, 2020.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf"}]},{"id":"S0452","name":"USBferry","url":"https://attack.mitre.org/software/S0452","kind":"malware","description":"[USBferry](https://attack.mitre.org/software/S0452) can detect the victim's file or folder list.(Citation: TrendMicro Tropic Trooper May 2020)\t","relationship_id":"relationship--416c98b4-221d-4e2f-aed4-43b844a89ad0","references":[{"source_name":"TrendMicro Tropic Trooper May 2020","description":"Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"id":"S0455","name":"Metamorfo","url":"https://attack.mitre.org/software/S0455","kind":"malware","description":"[Metamorfo](https://attack.mitre.org/software/S0455) has searched the Program Files directories for specific folders and has searched for strings related to its mutexes.(Citation: Medium Metamorfo Apr 2020)(Citation: Fortinet Metamorfo Feb 2020)(Citation: FireEye Metamorfo Apr 2018) ","relationship_id":"relationship--f45f18e9-4a0c-4f22-8ef6-5a18314535ea","references":[{"source_name":"Medium Metamorfo Apr 2020","description":"Erlich, C. (2020, April 3). The Avast Abuser: Metamorfo Banking Malware Hides By Abusing Avast Executable. Retrieved May 26, 2020.","url":"https://medium.com/@chenerlich/the-avast-abuser-metamorfo-banking-malware-hides-by-abusing-avast-executable-ac9b8b392767"},{"source_name":"Fortinet Metamorfo Feb 2020","description":"Zhang, X. (2020, February 4). Another Metamorfo Variant Targeting Customers of Financial Institutions in More Countries. Retrieved July 30, 2020.","url":"https://www.fortinet.com/blog/threat-research/another-metamorfo-variant-targeting-customers-of-financial-institutions"},{"source_name":"FireEye Metamorfo Apr 2018","description":"Sierra, E., Iglesias, G.. (2018, April 24). Metamorfo Campaigns Targeting Brazilian Users. Retrieved July 30, 2020.","url":"https://www.fireeye.com/blog/threat-research/2018/04/metamorfo-campaign-targeting-brazilian-users.html"}]},{"id":"S0456","name":"Aria-body","url":"https://attack.mitre.org/software/S0456","kind":"malware","description":"[Aria-body](https://attack.mitre.org/software/S0456) has the ability to gather metadata from a file and to search for file and directory names.(Citation: CheckPoint Naikon May 2020)","relationship_id":"relationship--cbc2cb80-8f07-46dd-b167-3f237e39f39d","references":[{"source_name":"CheckPoint Naikon May 2020","description":"CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.","url":"https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"}]},{"id":"S0458","name":"Ramsay","url":"https://attack.mitre.org/software/S0458","kind":"malware","description":"[Ramsay](https://attack.mitre.org/software/S0458) can collect directory and file lists.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)\t","relationship_id":"relationship--cde9af4e-4bf9-4235-9d27-496eb78e3608","references":[{"source_name":"Eset Ramsay May 2020","description":"Sanmillan, I.. (2020, May 13). Ramsay: A cyber‑espionage toolkit tailored for air‑gapped networks. Retrieved May 27, 2020.","url":"https://www.welivesecurity.com/2020/05/13/ramsay-cyberespionage-toolkit-airgapped-networks/"},{"source_name":"Antiy CERT Ramsay April 2020","description":"Antiy CERT. (2020, April 20). Analysis of Ramsay components of Darkhotel's infiltration and isolation network. Retrieved March 24, 2021.","url":"https://www.programmersought.com/article/62493896999/"}]},{"id":"S0461","name":"SDBbot","url":"https://attack.mitre.org/software/S0461","kind":"malware","description":"[SDBbot](https://attack.mitre.org/software/S0461) has the ability to get directory listings or drive information on a compromised host.(Citation: Proofpoint TA505 October 2019)","relationship_id":"relationship--03b12a66-789a-4480-8903-deab828d08b6","references":[{"source_name":"Proofpoint TA505 October 2019","description":"Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"}]},{"id":"S0466","name":"WindTail","url":"https://attack.mitre.org/software/S0466","kind":"malware","description":"[WindTail](https://attack.mitre.org/software/S0466) has the ability to enumerate the users home directory and the path to its own application bundle.(Citation: objective-see windtail1 dec 2018)(Citation: objective-see windtail2 jan 2019)","relationship_id":"relationship--1fe64d85-29ca-4cf0-9b30-8d41ebad37fc","references":[{"source_name":"objective-see windtail1 dec 2018","description":"Wardle, Patrick. (2018, December 20). Middle East Cyber-Espionage analyzing WindShift's implant: OSX.WindTail (part 1). Retrieved October 3, 2019.","url":"https://objective-see.com/blog/blog_0x3B.html"},{"source_name":"objective-see windtail2 jan 2019","description":"Wardle, Patrick. (2019, January 15). Middle East Cyber-Espionage analyzing WindShift's implant: OSX.WindTail (part 2). Retrieved October 3, 2019.","url":"https://objective-see.com/blog/blog_0x3D.html"}]},{"id":"S0467","name":"TajMahal","url":"https://attack.mitre.org/software/S0467","kind":"malware","description":"[TajMahal](https://attack.mitre.org/software/S0467) has the ability to index files from drives, user profiles, and removable drives.(Citation: Kaspersky TajMahal April 2019)","relationship_id":"relationship--bfd1c3ca-ea2c-4b0e-8b0a-815b8ebb4dfb","references":[{"source_name":"Kaspersky TajMahal April 2019","description":"GReAT. (2019, April 10). Project TajMahal – a sophisticated new APT framework. Retrieved October 14, 2019.","url":"https://securelist.com/project-tajmahal/90240/"}]},{"id":"S0468","name":"Skidmap","url":"https://attack.mitre.org/software/S0468","kind":"malware","description":"[Skidmap](https://attack.mitre.org/software/S0468) has checked for the existence of specific files including <code>/usr/sbin/setenforce</code> and <code> /etc/selinux/config</code>. It also has the ability to monitor the cryptocurrency miner file and process. (Citation: Trend Micro Skidmap) ","relationship_id":"relationship--472c61e4-e839-4766-b1ce-d9095203e538","references":[{"source_name":"Trend Micro Skidmap","description":"Remillano, A., Urbanec, J. (2019, September 19). Skidmap Linux Malware Uses Rootkit Capabilities to Hide Cryptocurrency-Mining Payload. Retrieved June 4, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/skidmap-linux-malware-uses-rootkit-capabilities-to-hide-cryptocurrency-mining-payload/"}]},{"id":"S0472","name":"down_new","url":"https://attack.mitre.org/software/S0472","kind":"malware","description":"[down_new](https://attack.mitre.org/software/S0472) has the ability to list the directories on a compromised host.(Citation: Trend Micro Tick November 2019)","relationship_id":"relationship--29be6a34-6a89-42e8-a6b1-dca821ed7f94","references":[{"source_name":"Trend Micro Tick November 2019","description":"Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"id":"S0473","name":"Avenger","url":"https://attack.mitre.org/software/S0473","kind":"malware","description":"[Avenger](https://attack.mitre.org/software/S0473) has the ability to browse files in directories such as Program Files and the Desktop.(Citation: Trend Micro Tick November 2019) ","relationship_id":"relationship--73af2cc2-699d-4183-b69f-f15b3e8c0494","references":[{"source_name":"Trend Micro Tick November 2019","description":"Chen, J. et al. (2019, November). Operation ENDTRADE: TICK’s Multi-Stage Backdoors for Attacking Industries and Stealing Classified Data. Retrieved June 9, 2020.","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"id":"S0475","name":"BackConfig","url":"https://attack.mitre.org/software/S0475","kind":"malware","description":"[BackConfig](https://attack.mitre.org/software/S0475) has the ability to identify folders and files related to previous infections.(Citation: Unit 42 BackConfig May 2020)\t","relationship_id":"relationship--2597e12c-c342-4ca0-a235-b05752b2bfa5","references":[{"source_name":"Unit 42 BackConfig May 2020","description":"Hinchliffe, A. and Falcone, R. (2020, May 11). Updated BackConfig Malware Targeting Government and Military Organizations in South Asia. Retrieved June 17, 2020.","url":"https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/"}]},{"id":"S0488","name":"CrackMapExec","url":"https://attack.mitre.org/software/S0488","kind":"tool","description":"[CrackMapExec](https://attack.mitre.org/software/S0488) can discover specified filetypes and log files on a targeted system.(Citation: CME Github September 2018)","relationship_id":"relationship--b37173c1-b29d-4a95-b79c-787b1acab673","references":[{"source_name":"CME Github September 2018","description":"byt3bl33d3r. (2018, September 8). SMB: Command Reference. Retrieved July 17, 2020.","url":"https://github.com/byt3bl33d3r/CrackMapExec/wiki/SMB-Command-Reference"}]},{"id":"S0491","name":"StrongPity","url":"https://attack.mitre.org/software/S0491","kind":"malware","description":"[StrongPity](https://attack.mitre.org/software/S0491) can parse the hard drive on a compromised host to identify specific file extensions.(Citation: Talos Promethium June 2020)","relationship_id":"relationship--8e08658c-78f5-4bd5-a6e8-d74200ed776c","references":[{"source_name":"Talos Promethium June 2020","description":"Mercer, W. et al. (2020, June 29). PROMETHIUM extends global reach with StrongPity3 APT. Retrieved July 20, 2020.","url":"https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"}]},{"id":"S0492","name":"CookieMiner","url":"https://attack.mitre.org/software/S0492","kind":"malware","description":"[CookieMiner](https://attack.mitre.org/software/S0492) has looked for files in the user's home directory with \"wallet\" in their name using <code>find</code>.(Citation: Unit42 CookieMiner Jan 2019)","relationship_id":"relationship--5ea439b8-ca9d-462b-9bb5-e0f13651b10c","references":[{"source_name":"Unit42 CookieMiner Jan 2019","description":"Chen, y., et al. (2019, January 31). Mac Malware Steals Cryptocurrency Exchanges’ Cookies. Retrieved July 22, 2020.","url":"https://unit42.paloaltonetworks.com/mac-malware-steals-cryptocurrency-exchanges-cookies/"}]},{"id":"S0493","name":"GoldenSpy","url":"https://attack.mitre.org/software/S0493","kind":"malware","description":"[GoldenSpy](https://attack.mitre.org/software/S0493) has included a program \"ExeProtector\", which monitors for the existence of [GoldenSpy](https://attack.mitre.org/software/S0493) on the infected system and redownloads if necessary.(Citation: Trustwave GoldenSpy June 2020)\t","relationship_id":"relationship--7f499274-44b7-4415-a8e8-6b2134a7873e","references":[{"source_name":"Trustwave GoldenSpy June 2020","description":"Trustwave SpiderLabs. (2020, June 25). The Golden Tax Department and Emergence of GoldenSpy Malware. Retrieved July 23, 2020.","url":"https://www.trustwave.com/en-us/resources/library/documents/the-golden-tax-department-and-the-emergence-of-goldenspy-malware/"}]},{"id":"S0496","name":"REvil","url":"https://attack.mitre.org/software/S0496","kind":"malware","description":"[REvil](https://attack.mitre.org/software/S0496) has the ability to identify specific files and directories that are not to be encrypted.(Citation: Kaspersky Sodin July 2019)(Citation: Cylance Sodinokibi July 2019)(Citation: Secureworks GandCrab and REvil September 2019)(Citation: McAfee Sodinokibi October 2019)(Citation: Intel 471 REvil March 2020)(Citation: Secureworks REvil September 2019)","relationship_id":"relationship--74972bfd-6910-4602-8327-5cc6db07e48a","references":[{"source_name":"Kaspersky Sodin July 2019","description":"Mamedov, O, et al. (2019, July 3). Sodin ransomware exploits Windows vulnerability and processor architecture. Retrieved August 4, 2020.","url":"https://securelist.com/sodin-ransomware/91473/"},{"source_name":"Cylance Sodinokibi July 2019","description":"Cylance. (2019, July 3). hreat Spotlight: Sodinokibi Ransomware. Retrieved August 4, 2020.","url":"https://threatvector.cylance.com/en_us/home/threat-spotlight-sodinokibi-ransomware.html"},{"source_name":"Secureworks GandCrab and REvil September 2019","description":"Secureworks . (2019, September 24). REvil: The GandCrab Connection. Retrieved August 4, 2020.","url":"https://www.secureworks.com/blog/revil-the-gandcrab-connection"},{"source_name":"McAfee Sodinokibi October 2019","description":"McAfee. (2019, October 2). McAfee ATR Analyzes Sodinokibi aka REvil Ransomware-as-a-Service – What The Code Tells Us. Retrieved August 4, 2020.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/mcafee-atr-analyzes-sodinokibi-aka-revil-ransomware-as-a-service-what-the-code-tells-us/"},{"source_name":"Intel 471 REvil March 2020","description":"Intel 471 Malware Intelligence team. (2020, March 31). REvil Ransomware-as-a-Service – An analysis of a ransomware affiliate operation. Retrieved August 4, 2020.","url":"https://intel471.com/blog/revil-ransomware-as-a-service-an-analysis-of-a-ransomware-affiliate-operation/"},{"source_name":"Secureworks REvil September 2019","description":"Counter Threat Unit Research Team. (2019, September 24). REvil/Sodinokibi Ransomware. Retrieved August 4, 2020.","url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware"}]},{"id":"S0497","name":"Dacls","url":"https://attack.mitre.org/software/S0497","kind":"malware","description":"[Dacls](https://attack.mitre.org/software/S0497) can scan directories on a compromised host.(Citation: TrendMicro macOS Dacls May 2020)","relationship_id":"relationship--e76a5485-4008-4096-820c-87b7dede9e02","references":[{"source_name":"TrendMicro macOS Dacls May 2020","description":"Mabutas, G. (2020, May 11). New MacOS Dacls RAT Backdoor Shows Lazarus’ Multi-Platform Attack Capability. Retrieved August 10, 2020.","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/"}]},{"id":"S0498","name":"Cryptoistic","url":"https://attack.mitre.org/software/S0498","kind":"malware","description":"[Cryptoistic](https://attack.mitre.org/software/S0498) can scan a directory to identify files for deletion.(Citation: SentinelOne Lazarus macOS July 2020)","relationship_id":"relationship--9e9b9874-f853-4945-9389-54174c2a7bfc","references":[{"source_name":"SentinelOne Lazarus macOS July 2020","description":"Stokes, P. (2020, July 27). Four Distinct Families of Lazarus Malware Target Apple’s macOS Platform. Retrieved August 7, 2020.","url":"https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/"}]},{"id":"S0512","name":"FatDuke","url":"https://attack.mitre.org/software/S0512","kind":"malware","description":"[FatDuke](https://attack.mitre.org/software/S0512) can enumerate directories on target machines.(Citation: ESET Dukes October 2019)","relationship_id":"relationship--ea6a1c47-237a-4bc6-a048-9f45dd48fe02","references":[{"source_name":"ESET Dukes October 2019","description":"Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2019/10/ESET_Operation_Ghost_Dukes.pdf"}]},{"id":"S0516","name":"SoreFang","url":"https://attack.mitre.org/software/S0516","kind":"malware","description":"[SoreFang](https://attack.mitre.org/software/S0516) has the ability to list directories.(Citation: CISA SoreFang July 2016)","relationship_id":"relationship--3dd2f874-57e3-4670-9c0a-7d8c35741bb6","references":[{"source_name":"CISA SoreFang July 2016","description":"CISA. (2020, July 16). MAR-10296782-1.v1 – SOREFANG. Retrieved September 29, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-198a"}]},{"id":"S0520","name":"BLINDINGCAN","url":"https://attack.mitre.org/software/S0520","kind":"malware","description":"[BLINDINGCAN](https://attack.mitre.org/software/S0520) can search, read, write, move, and execute files.(Citation: US-CERT BLINDINGCAN Aug 2020)(Citation: NHS UK BLINDINGCAN Aug 2020)","relationship_id":"relationship--ca2f6580-fb02-4687-b514-94bad87f7bf8","references":[{"source_name":"US-CERT BLINDINGCAN Aug 2020","description":"US-CERT. (2020, August 19). MAR-10295134-1.v1 – North Korean Remote Access Trojan: BLINDINGCAN. Retrieved August 19, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a"},{"source_name":"NHS UK BLINDINGCAN Aug 2020","description":"NHS Digital . (2020, August 20). BLINDINGCAN Remote Access Trojan. Retrieved August 20, 2020.","url":"https://digital.nhs.uk/cyber-alerts/2020/cc-3603"}]},{"id":"S0526","name":"KGH_SPY","url":"https://attack.mitre.org/software/S0526","kind":"malware","description":"[KGH_SPY](https://attack.mitre.org/software/S0526) can enumerate files and directories on a compromised host.(Citation: Cybereason Kimsuky November 2020)","relationship_id":"relationship--b567c4eb-669f-4e1b-b3dd-a5f3b9bdf567","references":[{"source_name":"Cybereason Kimsuky November 2020","description":"Dahan, A. et al. (2020, November 2). Back to the Future: Inside the Kimsuky KGH Spyware Suite. Retrieved November 6, 2020.","url":"https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"}]},{"id":"S0533","name":"SLOTHFULMEDIA","url":"https://attack.mitre.org/software/S0533","kind":"malware","description":"[SLOTHFULMEDIA](https://attack.mitre.org/software/S0533) can enumerate files and directories.(Citation: CISA MAR SLOTHFULMEDIA October 2020)","relationship_id":"relationship--70fa48cc-4acf-4df3-b8a0-d862b2b67f33","references":[{"source_name":"CISA MAR SLOTHFULMEDIA October 2020","description":"DHS/CISA, Cyber National Mission Force. (2020, October 1). Malware Analysis Report (MAR) MAR-10303705-1.v1 – Remote Access Trojan: SLOTHFULMEDIA. Retrieved October 2, 2020.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-275a"}]},{"id":"S0534","name":"Bazar","url":"https://attack.mitre.org/software/S0534","kind":"malware","description":"[Bazar](https://attack.mitre.org/software/S0534) can enumerate the victim's desktop.(Citation: Cybereason Bazar July 2020)(Citation: NCC Group Team9 June 2020)","relationship_id":"relationship--0a2c9965-291c-4724-829b-3cd5e8b26b58","references":[{"source_name":"Cybereason Bazar July 2020","description":"Cybereason Nocturnus. (2020, July 16). A BAZAR OF TRICKS: FOLLOWING TEAM9’S DEVELOPMENT CYCLES. Retrieved November 18, 2020.","url":"https://www.cybereason.com/blog/a-bazar-of-tricks-following-team9s-development-cycles"},{"source_name":"NCC Group Team9 June 2020","description":"Pantazopoulos, N. (2020, June 2). In-depth analysis of the new Team9 malware family. Retrieved December 1, 2020.","url":"https://research.nccgroup.com/2020/06/02/in-depth-analysis-of-the-new-team9-malware-family/"}]},{"id":"S0547","name":"DropBook","url":"https://attack.mitre.org/software/S0547","kind":"malware","description":"[DropBook](https://attack.mitre.org/software/S0547) can collect the names of all files and folders in the Program Files directories.(Citation: Cybereason Molerats Dec 2020)(Citation: BleepingComputer Molerats Dec 2020) ","relationship_id":"relationship--4a358258-d616-4f15-aead-d4e6f6153aae","references":[{"source_name":"Cybereason Molerats Dec 2020","description":"Cybereason Nocturnus Team. (2020, December 9). MOLERATS IN THE CLOUD: New Malware Arsenal Abuses Cloud Platforms in Middle East Espionage Campaign. Retrieved December 22, 2020.","url":"https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf"},{"source_name":"BleepingComputer Molerats Dec 2020","description":"Ilascu, I. (2020, December 14). Hacking group’s new malware abuses Google and Facebook services. Retrieved December 28, 2020.","url":"https://www.bleepingcomputer.com/news/security/hacking-group-s-new-malware-abuses-google-and-facebook-services/"}]},{"id":"S0559","name":"SUNBURST","url":"https://attack.mitre.org/software/S0559","kind":"malware","description":"[SUNBURST](https://attack.mitre.org/software/S0559) had commands to enumerate files and directories.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: Microsoft Analyzing Solorigate Dec 2020)","relationship_id":"relationship--6189bf91-d755-47e6-9f3c-dd621e3f64fd","references":[{"source_name":"FireEye SUNBURST Backdoor December 2020","description":"FireEye. (2020, December 13). Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims With SUNBURST Backdoor. Retrieved January 4, 2021.","url":"https://www.fireeye.com/blog/threat-research/2020/12/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor.html"},{"source_name":"Microsoft Analyzing Solorigate Dec 2020","description":"MSTIC. (2020, December 18). Analyzing Solorigate, the compromised DLL file that started a sophisticated cyberattack, and how Microsoft Defender helps protect customers . Retrieved January 5, 2021.","url":"https://www.microsoft.com/security/blog/2020/12/18/analyzing-solorigate-the-compromised-dll-file-that-started-a-sophisticated-cyberattack-and-how-microsoft-defender-helps-protect/"}]},{"id":"S0562","name":"SUNSPOT","url":"https://attack.mitre.org/software/S0562","kind":"malware","description":"[SUNSPOT](https://attack.mitre.org/software/S0562) enumerated the Orion software Visual Studio solution directory path.(Citation: CrowdStrike SUNSPOT Implant January 2021)","relationship_id":"relationship--6d8b4863-f8db-4776-a70f-ea16255d45bd","references":[{"source_name":"CrowdStrike SUNSPOT Implant January 2021","description":"CrowdStrike Intelligence Team. (2021, January 11). SUNSPOT: An Implant in the Build Process. Retrieved January 11, 2021.","url":"https://www.crowdstrike.com/blog/sunspot-malware-technical-analysis/"}]},{"id":"S0564","name":"BlackMould","url":"https://attack.mitre.org/software/S0564","kind":"malware","description":"[BlackMould](https://attack.mitre.org/software/S0564) has the ability to find files on the targeted system.(Citation: Microsoft GALLIUM December 2019)","relationship_id":"relationship--95801883-3fa4-4385-a48f-4a92dd8e1e09","references":[{"source_name":"Microsoft GALLIUM December 2019","description":"MSTIC. (2019, December 12). GALLIUM: Targeting global telecom. Retrieved January 13, 2021.","url":"https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/"}]},{"id":"S0567","name":"Dtrack","url":"https://attack.mitre.org/software/S0567","kind":"malware","description":"[Dtrack](https://attack.mitre.org/software/S0567) can list files on available disk volumes.(Citation: Securelist Dtrack)(Citation: CyberBit Dtrack)","relationship_id":"relationship--9866c9ca-d769-458c-9797-112beb97498d","references":[{"source_name":"Securelist Dtrack","description":"Konstantin Zykov. (2019, September 23). Hello! My name is Dtrack. Retrieved January 20, 2021.","url":"https://securelist.com/my-name-is-dtrack/93338/"},{"source_name":"CyberBit Dtrack","description":"Hod Gavriel. (2019, November 21). Dtrack: In-depth analysis of APT on a nuclear power plant. Retrieved January 20, 2021.","url":"https://www.cyberbit.com/blog/endpoint-security/dtrack-apt-malware-found-in-nuclear-power-plant/"}]},{"id":"S0572","name":"Caterpillar WebShell","url":"https://attack.mitre.org/software/S0572","kind":"malware","description":"[Caterpillar WebShell](https://attack.mitre.org/software/S0572) can search for files in directories.(Citation: ClearSky Lebanese Cedar Jan 2021) ","relationship_id":"relationship--3f824a1b-70d5-4859-bd55-6b084f602a52","references":[{"source_name":"ClearSky Lebanese Cedar Jan 2021","description":"ClearSky Cyber Security. (2021, January). “Lebanese Cedar” APT Global Lebanese Espionage Campaign Leveraging Web Servers. Retrieved February 10, 2021.","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"}]},{"id":"S0575","name":"Conti","url":"https://attack.mitre.org/software/S0575","kind":"malware","description":"[Conti](https://attack.mitre.org/software/S0575) can discover files on a local system.(Citation: CarbonBlack Conti July 2020)","relationship_id":"relationship--707f2ce7-a09f-4df4-8b48-3106a63da041","references":[{"source_name":"CarbonBlack Conti July 2020","description":"Baskin, B. (2020, July 8). TAU Threat Discovery: Conti Ransomware. Retrieved February 17, 2021.","url":"https://www.carbonblack.com/blog/tau-threat-discovery-conti-ransomware/"}]},{"id":"S0576","name":"MegaCortex","url":"https://attack.mitre.org/software/S0576","kind":"malware","description":"[MegaCortex](https://attack.mitre.org/software/S0576) can parse the available drives and directories to determine which files to encrypt.(Citation: IBM MegaCortex) ","relationship_id":"relationship--5cc7ade7-2e21-41a3-8535-4274c138dcc4","references":[{"source_name":"IBM MegaCortex","description":"Del Fierro, C. Kessem, L.. (2020, January 8). From Mega to Giga: Cross-Version Comparison of Top MegaCortex Modifications. Retrieved February 15, 2021.","url":"https://securityintelligence.com/posts/from-mega-to-giga-cross-version-comparison-of-top-megacortex-modifications/"}]},{"id":"S0582","name":"LookBack","url":"https://attack.mitre.org/software/S0582","kind":"malware","description":"[LookBack](https://attack.mitre.org/software/S0582) can retrieve file listings from the victim machine.(Citation: Proofpoint LookBack Malware Aug 2019)","relationship_id":"relationship--cb62e09c-5092-418e-99d3-ab7b5fc73017","references":[{"source_name":"Proofpoint LookBack Malware Aug 2019","description":"Raggi, M. Schwarz, D.. (2019, August 1). LookBack Malware Targets the United States Utilities Sector with Phishing Attacks Impersonating Engineering Licensing Boards. Retrieved February 25, 2021.","url":"https://www.proofpoint.com/us/threat-insight/post/lookback-malware-targets-united-states-utilities-sector-phishing-attacks"}]},{"id":"S0586","name":"TAINTEDSCRIBE","url":"https://attack.mitre.org/software/S0586","kind":"malware","description":"[TAINTEDSCRIBE](https://attack.mitre.org/software/S0586) can use <code>DirectoryList</code> to enumerate files in a specified directory.(Citation: CISA MAR-10288834-2.v1  TAINTEDSCRIBE MAY 2020)","relationship_id":"relationship--1039ed0e-216f-4eef-9a7e-c4eaa3ca0152","references":[{"source_name":"CISA MAR-10288834-2.v1  TAINTEDSCRIBE MAY 2020","description":"USG. (2020, May 12). MAR-10288834-2.v1 – North Korean Trojan: TAINTEDSCRIBE. Retrieved March 5, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b"}]},{"id":"S0587","name":"Penquin","url":"https://attack.mitre.org/software/S0587","kind":"malware","description":"[Penquin](https://attack.mitre.org/software/S0587) can use the command code <code>do_vslist</code> to send file names, size, and status to C2.(Citation: Leonardo Turla Penquin May 2020)","relationship_id":"relationship--d0a2aa1e-a824-47b8-99a5-c2d026c9432d","references":[{"source_name":"Leonardo Turla Penquin May 2020","description":"Leonardo. (2020, May 29). MALWARE TECHNICAL INSIGHT TURLA “Penquin_x64”. Retrieved March 11, 2021.","url":"https://www.leonardo.com/documents/20142/10868623/Malware+Technical+Insight+_Turla+%E2%80%9CPenquin_x64%E2%80%9D.pdf"}]},{"id":"S0592","name":"RemoteUtilities","url":"https://attack.mitre.org/software/S0592","kind":"tool","description":"[RemoteUtilities](https://attack.mitre.org/software/S0592) can enumerate files and directories on a target machine.(Citation: Trend Micro Muddy Water March 2021)","relationship_id":"relationship--c767aaab-168c-4585-af3e-f4fb95fede69","references":[{"source_name":"Trend Micro Muddy Water March 2021","description":"Peretz, A. and Theck, E. (2021, March 5). Earth Vetala – MuddyWater Continues to Target Organizations in the Middle East. Retrieved March 18, 2021.","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"}]},{"id":"S0598","name":"P.A.S. Webshell","url":"https://attack.mitre.org/software/S0598","kind":"malware","description":"[P.A.S. Webshell](https://attack.mitre.org/software/S0598) has the ability to list files and file characteristics including extension, size, ownership, and permissions.(Citation: ANSSI Sandworm January 2021)","relationship_id":"relationship--093bc793-3edd-4096-bd7b-aeb5c855128b","references":[{"source_name":"ANSSI Sandworm January 2021","description":"ANSSI. (2021, January 27). SANDWORM INTRUSION SET CAMPAIGN TARGETING CENTREON SYSTEMS. Retrieved March 30, 2021.","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"}]},{"id":"S0599","name":"Kinsing","url":"https://attack.mitre.org/software/S0599","kind":"malware","description":"[Kinsing](https://attack.mitre.org/software/S0599) has used the find command to search for specific files.(Citation: Aqua Kinsing April 2020)","relationship_id":"relationship--05282a2d-21c6-4150-94e0-d57c2f84c887","references":[{"source_name":"Aqua Kinsing April 2020","description":"Singer, G. (2020, April 3). Threat Alert: Kinsing Malware Attacks Targeting Container Environments. Retrieved April 1, 2021.","url":"https://blog.aquasec.com/threat-alert-kinsing-malware-container-vulnerability"}]},{"id":"S0600","name":"Doki","url":"https://attack.mitre.org/software/S0600","kind":"malware","description":"[Doki](https://attack.mitre.org/software/S0600) has resolved the path of a process PID to use as a script argument.(Citation: Intezer Doki July 20)","relationship_id":"relationship--93189ca3-7dfd-4c82-a7c7-a457a093d1d3","references":[{"source_name":"Intezer Doki July 20","description":"Fishbein, N., Kajiloti, M.. (2020, July 28). Watch Your Containers: Doki Infecting Docker Servers in the Cloud. Retrieved March 30, 2021.","url":"https://www.intezer.com/blog/cloud-security/watch-your-containers-doki-infecting-docker-servers-in-the-cloud/"}]},{"id":"S0603","name":"Stuxnet","url":"https://attack.mitre.org/software/S0603","kind":"malware","description":"[Stuxnet](https://attack.mitre.org/software/S0603) uses a driver to scan for specific filesystem driver objects.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)","relationship_id":"relationship--8363c29c-b5f4-4b0b-8396-52628c773430","references":[{"source_name":"Nicolas Falliere, Liam O Murchu, Eric Chien February 2011","description":"Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved November 17, 2024.","url":"https://docs.broadcom.com/doc/security-response-w32-stuxnet-dossier-11-en"}]},{"id":"S0604","name":"Industroyer","url":"https://attack.mitre.org/software/S0604","kind":"malware","description":"[Industroyer](https://attack.mitre.org/software/S0604)’s data wiper component enumerates specific files on all the Windows drives.(Citation: ESET Industroyer)","relationship_id":"relationship--6832f4b5-3f36-4def-9b97-d0228da33964","references":[{"source_name":"ESET Industroyer","description":"Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"}]},{"id":"S0607","name":"KillDisk","url":"https://attack.mitre.org/software/S0607","kind":"malware","description":"[KillDisk](https://attack.mitre.org/software/S0607) has used the <code>FindNextFile</code> command as part of its file deletion process.(Citation: Trend Micro KillDisk 2)","relationship_id":"relationship--1530b5b9-a559-42ac-a668-8133cb18e944","references":[{"source_name":"Trend Micro KillDisk 2","description":"Gilbert Sison, Rheniel Ramos, Jay Yaneza, Alfredo Oliveira. (2018, January 15). KillDisk Variant Hits Latin American Financial Groups. Retrieved January 12, 2021.","url":"https://www.trendmicro.com/en_us/research/18/a/new-killdisk-variant-hits-financial-organizations-in-latin-america.html"}]},{"id":"S0610","name":"SideTwist","url":"https://attack.mitre.org/software/S0610","kind":"malware","description":"[SideTwist](https://attack.mitre.org/software/S0610) has the ability to search for specific files.(Citation: Check Point APT34 April 2021)","relationship_id":"relationship--44a9f8e6-7b16-4c19-a1ac-df57a67b329a","references":[{"source_name":"Check Point APT34 April 2021","description":"Check Point. (2021, April 8). Iran’s APT34 Returns with an Updated Arsenal. Retrieved May 5, 2021.","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"}]},{"id":"S0611","name":"Clop","url":"https://attack.mitre.org/software/S0611","kind":"malware","description":"[Clop](https://attack.mitre.org/software/S0611) has searched folders and subfolders for files to encrypt.(Citation: Mcafee Clop Aug 2019)","relationship_id":"relationship--7e836d44-0047-4192-81fd-6fb8ff0cdbda","references":[{"source_name":"Mcafee Clop Aug 2019","description":"Mundo, A. (2019, August 1). Clop Ransomware. Retrieved May 10, 2021.","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/clop-ransomware/"}]},{"id":"S0612","name":"WastedLocker","url":"https://attack.mitre.org/software/S0612","kind":"malware","description":"[WastedLocker](https://attack.mitre.org/software/S0612) can enumerate files and directories just prior to encryption.(Citation: NCC Group WastedLocker June 2020)","relationship_id":"relationship--b580bd73-72e4-479a-b8c8-221e12dc00db","references":[{"source_name":"NCC Group WastedLocker June 2020","description":"Antenucci, S., Pantazopoulos, N., Sandee, M. (2020, June 23). WastedLocker: A New Ransomware Variant Developed By The Evil Corp Group. Retrieved September 14, 2021.","url":"https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/"}]},{"id":"S0615","name":"SombRAT","url":"https://attack.mitre.org/software/S0615","kind":"malware","description":"[SombRAT](https://attack.mitre.org/software/S0615) can execute <code>enum</code> to enumerate files in storage on a compromised system.(Citation: BlackBerry CostaRicto November 2020)","relationship_id":"relationship--e260b882-0f57-4e44-b6fe-efaefccd1c3f","references":[{"source_name":"BlackBerry CostaRicto November 2020","description":"The BlackBerry Research and Intelligence Team. (2020, November 12). The CostaRicto Campaign: Cyber-Espionage Outsourced. Retrieved May 24, 2021.","url":"https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced"}]},{"id":"S0616","name":"DEATHRANSOM","url":"https://attack.mitre.org/software/S0616","kind":"malware","description":"[DEATHRANSOM](https://attack.mitre.org/software/S0616) can use loop operations to enumerate directories on a compromised host.(Citation: FireEye FiveHands April 2021)","relationship_id":"relationship--6043fd33-6e50-439a-9ee4-1d24a96fe913","references":[{"source_name":"FireEye FiveHands April 2021","description":"McLellan, T.  and Moore, J. et al. (2021, April 29). UNC2447 SOMBRAT and FIVEHANDS Ransomware: A Sophisticated Financial Threat. Retrieved June 2, 2021.","url":"https://www.fireeye.com/blog/threat-research/2021/04/unc2447-sombrat-and-fivehands-ransomware-sophisticated-financial-threat.html"}]},{"id":"S0618","name":"FIVEHANDS","url":"https://attack.mitre.org/software/S0618","kind":"malware","description":"[FIVEHANDS](https://attack.mitre.org/software/S0618) has the ability to enumerate files on a compromised host in order to encrypt files with specific extensions.(Citation: CISA AR21-126A FIVEHANDS May 2021)(Citation: NCC Group Fivehands June 2021)","relationship_id":"relationship--66b5808f-b124-4736-bb6b-289503d07fa2","references":[{"source_name":"CISA AR21-126A FIVEHANDS May 2021","description":"CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a"},{"source_name":"NCC Group Fivehands June 2021","description":"Matthews, M. and Backhouse, W. (2021, June 15). Handy guide to a new Fivehands ransomware variant. Retrieved June 24, 2021.","url":"https://research.nccgroup.com/2021/06/15/handy-guide-to-a-new-fivehands-ransomware-variant/"}]},{"id":"S0622","name":"AppleSeed","url":"https://attack.mitre.org/software/S0622","kind":"malware","description":"[AppleSeed](https://attack.mitre.org/software/S0622) has the ability to search for .txt, .ppt, .hwp, .pdf, and .doc files in specified directories.(Citation: Malwarebytes Kimsuky June 2021)","relationship_id":"relationship--b2c4bc70-088c-4e99-863b-65c4267c7220","references":[{"source_name":"Malwarebytes Kimsuky June 2021","description":"Jazi, H. (2021, June 1). Kimsuky APT continues to target South Korean government using AppleSeed backdoor. Retrieved June 10, 2021.","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"}]},{"id":"S0623","name":"Siloscape","url":"https://attack.mitre.org/software/S0623","kind":"malware","description":" [Siloscape](https://attack.mitre.org/software/S0623) searches for the Kubernetes config file and other related files using a regular expression.(Citation: Unit 42 Siloscape Jun 2021) ","relationship_id":"relationship--ba0d8cf0-e6a7-4465-b818-d7b71b441919","references":[{"source_name":"Unit 42 Siloscape Jun 2021","description":"Prizmant, D. (2021, June 7). Siloscape: First Known Malware Targeting Windows Containers to Compromise Cloud Environments. Retrieved June 9, 2021.","url":"https://unit42.paloaltonetworks.com/siloscape/"}]},{"id":"S0625","name":"Cuba","url":"https://attack.mitre.org/software/S0625","kind":"malware","description":"[Cuba](https://attack.mitre.org/software/S0625) can enumerate files by using a variety of functions.(Citation: McAfee Cuba April 2021)","relationship_id":"relationship--61a3d7e0-3663-4fb7-9bb3-20a73257f27d","references":[{"source_name":"McAfee Cuba April 2021","description":"Roccio, T., et al. (2021, April). Technical Analysis of Cuba Ransomware. Retrieved June 18, 2021.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-cuba-ransomware.pdf"}]},{"id":"S0628","name":"FYAnti","url":"https://attack.mitre.org/software/S0628","kind":"malware","description":"[FYAnti](https://attack.mitre.org/software/S0628) can search the <code>C:\\Windows\\Microsoft.NET\\</code> directory for files of a specified size.(Citation: Securelist APT10 March 2021)","relationship_id":"relationship--807b9e89-a895-4c9b-aace-1d1ced5824b9","references":[{"source_name":"Securelist APT10 March 2021","description":"GREAT. (2021, March 30). APT10: sophisticated multi-layered loader Ecipekac discovered in A41APT campaign. Retrieved June 17, 2021.","url":"https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"}]},{"id":"S0629","name":"RainyDay","url":"https://attack.mitre.org/software/S0629","kind":"malware","description":"[RainyDay](https://attack.mitre.org/software/S0629) can use a file exfiltration tool to collect recently changed files with specific extensions.(Citation: Bitdefender Naikon April 2021)","relationship_id":"relationship--ad3f239b-8a48-40dd-aa07-71fddb19e275","references":[{"source_name":"Bitdefender Naikon April 2021","description":"Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}]},{"id":"S0630","name":"Nebulae","url":"https://attack.mitre.org/software/S0630","kind":"malware","description":"[Nebulae](https://attack.mitre.org/software/S0630) can list files and directories on a compromised host.(Citation: Bitdefender Naikon April 2021)","relationship_id":"relationship--dd88acc4-a6c0-43ac-9967-6158469d97bb","references":[{"source_name":"Bitdefender Naikon April 2021","description":"Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}]},{"id":"S0632","name":"GrimAgent","url":"https://attack.mitre.org/software/S0632","kind":"malware","description":"[GrimAgent](https://attack.mitre.org/software/S0632) has the ability to enumerate files and directories on a compromised host.(Citation: Group IB GrimAgent July 2021)","relationship_id":"relationship--44ddb228-ec4e-495e-b930-04a49fe58a7d","references":[{"source_name":"Group IB GrimAgent July 2021","description":"Priego, A. (2021, July). THE BROTHERS GRIM: THE REVERSING TALE OF GRIMAGENT MALWARE USED BY RYUK. Retrieved September 19, 2024.","url":"https://www.group-ib.com/blog/grimagent/"}]},{"id":"S0633","name":"Sliver","url":"https://attack.mitre.org/software/S0633","kind":"tool","description":"[Sliver](https://attack.mitre.org/software/S0633) can enumerate files on a target system.(Citation: GitHub Sliver File System August 2021)","relationship_id":"relationship--23149a27-cccf-4fb4-bc35-fc4ebf4c6664","references":[{"source_name":"GitHub Sliver File System August 2021","description":"BishopFox. (2021, August 18). Sliver Filesystem. Retrieved September 22, 2021.","url":"https://github.com/BishopFox/sliver/tree/master/client/command/filesystem"}]},{"id":"S0635","name":"BoomBox","url":"https://attack.mitre.org/software/S0635","kind":"malware","description":"[BoomBox](https://attack.mitre.org/software/S0635) can search for specific files and directories on a machine.(Citation: MSTIC Nobelium Toolset May 2021)","relationship_id":"relationship--7d72dfaf-3ba5-4420-985c-b0cd16716428","references":[{"source_name":"MSTIC Nobelium Toolset May 2021","description":"MSTIC. (2021, May 28). Breaking down NOBELIUM’s latest early-stage toolset. Retrieved August 4, 2021.","url":"https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"}]},{"id":"S0638","name":"Babuk","url":"https://attack.mitre.org/software/S0638","kind":"malware","description":"[Babuk](https://attack.mitre.org/software/S0638) has the ability to enumerate files on a targeted system.(Citation: McAfee Babuk February 2021)(Citation: Trend Micro Ransomware February 2021)","relationship_id":"relationship--fb819161-4916-4f25-ad81-eab9f02a337e","references":[{"source_name":"McAfee Babuk February 2021","description":"Mundo, A. et al. (2021, February). Technical Analysis of Babuk Ransomware. Retrieved August 11, 2021.","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-babuk-ransomware.pdf"},{"source_name":"Trend Micro Ransomware February 2021","description":"Centero, R. et al. (2021, February 5). New in Ransomware: Seth-Locker, Babuk Locker, Maoloa, TeslaCrypt, and CobraLocker. Retrieved August 11, 2021.","url":"https://www.trendmicro.com/en_us/research/21/b/new-in-ransomware.html"}]},{"id":"S0640","name":"Avaddon","url":"https://attack.mitre.org/software/S0640","kind":"malware","description":"[Avaddon](https://attack.mitre.org/software/S0640) has searched for specific files prior to encryption.(Citation: Arxiv Avaddon Feb 2021)","relationship_id":"relationship--431043b7-f0e8-411b-8eec-0d602867b028","references":[{"source_name":"Arxiv Avaddon Feb 2021","description":"Yuste, J. Pastrana, S. (2021, February 9). Avaddon ransomware: an in-depth analysis and decryption of infected systems. Retrieved August 19, 2021.","url":"https://arxiv.org/pdf/2102.04796.pdf"}]},{"id":"S0642","name":"BADFLICK","url":"https://attack.mitre.org/software/S0642","kind":"malware","description":"[BADFLICK](https://attack.mitre.org/software/S0642) has searched for files on the infected host.(Citation: Accenture MUDCARP March 2019)","relationship_id":"relationship--8170e34e-8342-4cbf-ae24-7bce63fb4d48","references":[{"source_name":"Accenture MUDCARP March 2019","description":"Accenture iDefense Unit. (2019, March 5). Mudcarp's Focus on Submarine Technologies. Retrieved August 24, 2021.","url":"https://web.archive.org/web/20210722005437/https://www.accenture.com/_acnmedia/PDF-96/Accenture-Security-MUDCARP.pdf"}]},{"id":"S0643","name":"Peppy","url":"https://attack.mitre.org/software/S0643","kind":"malware","description":"[Peppy](https://attack.mitre.org/software/S0643) can identify specific files for exfiltration.(Citation: Proofpoint Operation Transparent Tribe March 2016)","relationship_id":"relationship--922af0dd-415c-4512-9fe2-710a954f4c80","references":[{"source_name":"Proofpoint Operation Transparent Tribe March 2016","description":"Huss, D. (2016, March 1). Operation Transparent Tribe. Retrieved June 8, 2016.","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"}]},{"id":"S0644","name":"ObliqueRAT","url":"https://attack.mitre.org/software/S0644","kind":"malware","description":"[ObliqueRAT](https://attack.mitre.org/software/S0644) has the ability to recursively enumerate files on an infected endpoint.(Citation: Talos Oblique RAT March 2021)","relationship_id":"relationship--898416fc-2061-47ae-a642-25442906a2d8","references":[{"source_name":"Talos Oblique RAT March 2021","description":"Malhotra, A. (2021, March 2). ObliqueRAT returns with new campaign using hijacked websites. Retrieved September 2, 2021.","url":"https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html"}]},{"id":"S0647","name":"Turian","url":"https://attack.mitre.org/software/S0647","kind":"malware","description":"[Turian](https://attack.mitre.org/software/S0647) can search for specific files and list directories.(Citation: ESET BackdoorDiplomacy Jun 2021)","relationship_id":"relationship--17a2eeb2-2221-4292-b584-d39d19a6409f","references":[{"source_name":"ESET BackdoorDiplomacy Jun 2021","description":"Adam Burgher. (2021, June 10). BackdoorDiplomacy: Upgrading from Quarian to Turian. Retrieved September 1, 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}]},{"id":"S0650","name":"QakBot","url":"https://attack.mitre.org/software/S0650","kind":"malware","description":"[QakBot](https://attack.mitre.org/software/S0650) can identify whether it has been run previously on a host by checking for a specified folder.(Citation: ATT QakBot April 2021)","relationship_id":"relationship--2b4bd264-4c8b-4303-9c54-113284c9e9a0","references":[{"source_name":"ATT QakBot April 2021","description":"Morrow, D. (2021, April 15). The rise of QakBot. Retrieved September 27, 2021.","url":"https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot"}]},{"id":"S0651","name":"BoxCaon","url":"https://attack.mitre.org/software/S0651","kind":"malware","description":"[BoxCaon](https://attack.mitre.org/software/S0651) has searched for files on the system, such as documents located in the desktop folder.(Citation: Checkpoint IndigoZebra July 2021)","relationship_id":"relationship--1c4fd1a5-c3a4-4f71-8310-785962dc65d4","references":[{"source_name":"Checkpoint IndigoZebra July 2021","description":"CheckPoint Research. (2021, July 1). IndigoZebra APT continues to attack Central Asia with evolving tools. Retrieved September 24, 2021.","url":"https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"}]},{"id":"S0652","name":"MarkiRAT","url":"https://attack.mitre.org/software/S0652","kind":"malware","description":"[MarkiRAT](https://attack.mitre.org/software/S0652) can look for files carrying specific extensions such as: .rtf, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .pps, .ppsx, .txt, .gpg, .pkr, .kdbx, .key, and .jpb.(Citation: Kaspersky Ferocious Kitten Jun 2021)","relationship_id":"relationship--27c7f9ed-dd66-4bc0-a186-2f05aac6d6df","references":[{"source_name":"Kaspersky Ferocious Kitten Jun 2021","description":"GReAT. (2021, June 16). Ferocious Kitten: 6 Years of Covert Surveillance in Iran. Retrieved September 22, 2021.","url":"https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"}]},{"id":"S0657","name":"BLUELIGHT","url":"https://attack.mitre.org/software/S0657","kind":"malware","description":"[BLUELIGHT](https://attack.mitre.org/software/S0657) can enumerate files and collect associated metadata.(Citation: Volexity InkySquid BLUELIGHT August 2021)","relationship_id":"relationship--bc74cabe-b8bc-4873-a6ff-e16d8f91299f","references":[{"source_name":"Volexity InkySquid BLUELIGHT August 2021","description":"Cash, D., Grunzweig, J., Meltzer, M., Adair, S., Lancaster, T. (2021, August 17). North Korean APT InkySquid Infects Victims Using Browser Exploits. Retrieved September 30, 2021.","url":"https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"}]},{"id":"S0658","name":"XCSSET","url":"https://attack.mitre.org/software/S0658","kind":"malware","description":"[XCSSET](https://attack.mitre.org/software/S0658) has used `mdfind` to enumerate a list of apps known to grant screen sharing permissions and leverages a module to run the command `ls -la ~/Desktop`.(Citation: Application Bundle Manipulation Brandon Dalton)(Citation: Microsoft March 2025 XCSSET)\n","relationship_id":"relationship--de15c868-b002-415c-937b-b365e4c60597","references":[{"source_name":"Application Bundle Manipulation Brandon Dalton","description":"Brandon Dalton. (2022, August 9). A bundle of nerves: Tweaking macOS security controls to thwart application bundle manipulation. Retrieved September 27, 2022.","url":"https://redcanary.com/blog/mac-application-bundles/"},{"source_name":"Microsoft March 2025 XCSSET","description":"Microsoft Threat Intelligence. (2025, March 11). New XCSSET malware adds new obfuscation, persistence techniques to infect Xcode projects. Retrieved April 2, 2025.","url":"https://www.microsoft.com/en-us/security/blog/2025/03/11/new-xcsset-malware-adds-new-obfuscation-persistence-techniques-to-infect-xcode-projects/"}]},{"id":"S0659","name":"Diavol","url":"https://attack.mitre.org/software/S0659","kind":"malware","description":"[Diavol](https://attack.mitre.org/software/S0659) has a command to traverse the files and directories in a given path.(Citation: Fortinet Diavol July 2021) ","relationship_id":"relationship--22a1c738-6d0f-4abd-b00c-ee0b37ba1db6","references":[{"source_name":"Fortinet Diavol July 2021","description":"Neeamni, D., Rubinfeld, A.. (2021, July 1). Diavol - A New Ransomware Used By Wizard Spider?. Retrieved November 12, 2021.","url":"https://www.fortinet.com/blog/threat-research/diavol-new-ransomware-used-by-wizard-spider"}]},{"id":"S0660","name":"Clambling","url":"https://attack.mitre.org/software/S0660","kind":"malware","description":"[Clambling](https://attack.mitre.org/software/S0660) can browse directories on a compromised host.(Citation: Trend Micro DRBControl February 2020)(Citation: Talent-Jump Clambling February 2020)","relationship_id":"relationship--292fd2a5-45fa-4125-84ea-8b5f341dc579","references":[{"source_name":"Trend Micro DRBControl February 2020","description":"Lunghi, D. et al. (2020, February). Uncovering DRBControl. Retrieved November 12, 2021.","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"},{"source_name":"Talent-Jump Clambling February 2020","description":"Chen, T. and Chen, Z. (2020, February 17). CLAMBLING - A New Backdoor Base On Dropbox. Retrieved November 12, 2021.","url":"https://www.talent-jump.com/article/2020/02/17/CLAMBLING-A-New-Backdoor-Base-On-Dropbox-en/"}]},{"id":"S0661","name":"FoggyWeb","url":"https://attack.mitre.org/software/S0661","kind":"malware","description":"[FoggyWeb](https://attack.mitre.org/software/S0661)'s loader can check for the [FoggyWeb](https://attack.mitre.org/software/S0661) backdoor .pri file on a compromised AD FS server.(Citation: MSTIC FoggyWeb September 2021)","relationship_id":"relationship--b3c50e22-4f4c-490c-9284-0af1c0543821","references":[{"source_name":"MSTIC FoggyWeb September 2021","description":"Ramin Nafisi. (2021, September 27). FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor. Retrieved October 4, 2021.","url":"https://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor/"}]},{"id":"S0663","name":"SysUpdate","url":"https://attack.mitre.org/software/S0663","kind":"malware","description":"[SysUpdate](https://attack.mitre.org/software/S0663) can search files on a compromised host.(Citation: Trend Micro Iron Tiger April 2021)(Citation: Lunghi Iron Tiger Linux)","relationship_id":"relationship--5c0bb793-ced9-4b3c-80c2-af33e1fa6213","references":[{"source_name":"Lunghi Iron Tiger Linux","description":"Daniel Lunghi. (2023, March 1). Iron Tiger’s SysUpdate Reappears, Adds Linux Targeting. Retrieved March 20, 2023.","url":"https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html"},{"source_name":"Trend Micro Iron Tiger April 2021","description":"Lunghi, D. and Lu, K. (2021, April 9). Iron Tiger APT Updates Toolkit With Evolved SysUpdate Malware. Retrieved November 12, 2021.","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}]},{"id":"S0665","name":"ThreatNeedle","url":"https://attack.mitre.org/software/S0665","kind":"malware","description":"[ThreatNeedle](https://attack.mitre.org/software/S0665) can obtain file and directory information.(Citation: Kaspersky ThreatNeedle Feb 2021)","relationship_id":"relationship--7d584a95-3253-4093-bc03-8933374652a0","references":[{"source_name":"Kaspersky ThreatNeedle Feb 2021","description":"Vyacheslav Kopeytsev and Seongsu Park. (2021, February 25). Lazarus targets defense industry with ThreatNeedle. Retrieved October 27, 2021.","url":"https://securelist.com/lazarus-threatneedle/100803/"}]},{"id":"S0666","name":"Gelsemium","url":"https://attack.mitre.org/software/S0666","kind":"malware","description":"[Gelsemium](https://attack.mitre.org/software/S0666) can retrieve data from specific Windows directories, as well as open random files as part of [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497).(Citation: ESET Gelsemium June 2021)","relationship_id":"relationship--75f2e135-5c45-4b27-a7dc-f62e68f6a5ce","references":[{"source_name":"ESET Gelsemium June 2021","description":"Dupuy, T. and Faou, M. (2021, June). Gelsemium. Retrieved November 30, 2021.","url":"https://www.welivesecurity.com/wp-content/uploads/2021/06/eset_gelsemium.pdf"}]},{"id":"S0670","name":"WarzoneRAT","url":"https://attack.mitre.org/software/S0670","kind":"malware","description":"[WarzoneRAT](https://attack.mitre.org/software/S0670) can enumerate directories on a compromise host.(Citation: Check Point Warzone Feb 2020)","relationship_id":"relationship--d6624fc4-3aed-47c9-a4d9-aafc008f876f","references":[{"source_name":"Check Point Warzone Feb 2020","description":"Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.","url":"https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/"}]},{"id":"S0672","name":"Zox","url":"https://attack.mitre.org/software/S0672","kind":"malware","description":"[Zox](https://attack.mitre.org/software/S0672) can enumerate files on a compromised host.(Citation: Novetta-Axiom)","relationship_id":"relationship--6e1346fe-507c-4ab3-a254-ea00e226fafd","references":[{"source_name":"Novetta-Axiom","description":"Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014.","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}]},{"id":"S0673","name":"DarkWatchman","url":"https://attack.mitre.org/software/S0673","kind":"malware","description":"[DarkWatchman](https://attack.mitre.org/software/S0673) has the ability to enumerate file and folder names.(Citation: Prevailion DarkWatchman 2021)","relationship_id":"relationship--68130387-da58-4676-889b-0b8c5b2c3a65","references":[{"source_name":"Prevailion DarkWatchman 2021","description":"Smith, S., Stafford, M. (2021, December 14). DarkWatchman: A new evolution in fileless techniques. Retrieved January 10, 2022.","url":"https://web.archive.org/web/20220629230035/https://www.prevailion.com/darkwatchman-new-fileless-techniques/"}]},{"id":"S0674","name":"CharmPower","url":"https://attack.mitre.org/software/S0674","kind":"malware","description":"[CharmPower](https://attack.mitre.org/software/S0674) can enumerate drives and list the contents of the C: drive on a victim's computer.(Citation: Check Point APT35 CharmPower January 2022)","relationship_id":"relationship--74754640-5989-43de-9fab-5a986d9fc8f5","references":[{"source_name":"Check Point APT35 CharmPower January 2022","description":"Check Point. (2022, January 11). APT35 exploits Log4j vulnerability to distribute new modular PowerShell toolkit. Retrieved January 24, 2022.","url":"https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"}]},{"id":"S0686","name":"QuietSieve","url":"https://attack.mitre.org/software/S0686","kind":"malware","description":"[QuietSieve](https://attack.mitre.org/software/S0686) can search files on the target host by extension, including doc, docx, xls, rtf, odt, txt, jpg, pdf, rar, zip, and 7z.(Citation: Microsoft Actinium February 2022) ","relationship_id":"relationship--8f389f41-9588-4a67-a186-c25bef45e4cc","references":[{"source_name":"Microsoft Actinium February 2022","description":"Microsoft Threat Intelligence Center. (2022, February 4). ACTINIUM targets Ukrainian organizations. Retrieved February 18, 2022.","url":"https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"}]},{"id":"S0687","name":"Cyclops Blink","url":"https://attack.mitre.org/software/S0687","kind":"malware","description":"[Cyclops Blink](https://attack.mitre.org/software/S0687) can use the Linux API `statvfs` to enumerate the current working directory.(Citation: NCSC Cyclops Blink February 2022)(Citation: Trend Micro Cyclops Blink March 2022)","relationship_id":"relationship--650fddda-8aa5-4311-9772-ba8ab0ed4afa","references":[{"source_name":"NCSC Cyclops Blink February 2022","description":"NCSC. (2022, February 23). Cyclops Blink Malware Analysis Report. Retrieved March 3, 2022.","url":"https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf"},{"source_name":"Trend Micro Cyclops Blink March 2022","description":"Haquebord, F. et al. (2022, March 17). Cyclops Blink Sets Sights on Asus Routers. Retrieved March 17, 2022.","url":"https://www.trendmicro.com/en_us/research/22/c/cyclops-blink-sets-sights-on-asus-routers--.html"}]},{"id":"S0689","name":"WhisperGate","url":"https://attack.mitre.org/software/S0689","kind":"malware","description":"[WhisperGate](https://attack.mitre.org/software/S0689) can locate files based on hardcoded file extensions.(Citation: Microsoft WhisperGate January 2022)(Citation: Unit 42 WhisperGate January 2022)(Citation: Cisco Ukraine Wipers January 2022)(Citation: Medium S2W WhisperGate January 2022)","relationship_id":"relationship--2bce15a3-cf65-48a5-8a07-1c85c9c33a1a","references":[{"source_name":"Cisco Ukraine Wipers January 2022","description":"Biasini, N. et al.. (2022, January 21). Ukraine Campaign Delivers Defacement and Wipers, in Continued Escalation. Retrieved March 14, 2022.","url":"https://blog.talosintelligence.com/2022/01/ukraine-campaign-delivers-defacement.html"},{"source_name":"Unit 42 WhisperGate January 2022","description":"Falcone, R. et al.. (2022, January 20). Threat Brief: Ongoing Russia and Ukraine Cyber Conflict. Retrieved March 10, 2022.","url":"https://unit42.paloaltonetworks.com/ukraine-cyber-conflict-cve-2021-32648-whispergate/#whispergate-malware-family"},{"source_name":"Microsoft WhisperGate January 2022","description":"MSTIC. (2022, January 15). Destructive malware targeting Ukrainian organizations. Retrieved March 10, 2022.","url":"https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/"},{"source_name":"Medium S2W WhisperGate January 2022","description":"S2W. (2022, January 18). Analysis of Destructive Malware (WhisperGate) targeting Ukraine. Retrieved March 14, 2022.","url":"https://medium.com/s2wblog/analysis-of-destructive-malware-whispergate-targeting-ukraine-9d5d158f19f3"}]},{"id":"S0692","name":"SILENTTRINITY","url":"https://attack.mitre.org/software/S0692","kind":"tool","description":"[SILENTTRINITY](https://attack.mitre.org/software/S0692) has several modules, such as `ls.py`, `pwd.py`, and `recentFiles.py`, to enumerate directories and files.(Citation: GitHub SILENTTRINITY Modules July 2019) ","relationship_id":"relationship--bee5895c-6671-4563-831b-38cb510e29fe","references":[{"source_name":"GitHub SILENTTRINITY Modules July 2019","description":"Salvati, M. (2019, August 6). SILENTTRINITY Modules. Retrieved March 24, 2022.","url":"https://github.com/byt3bl33d3r/SILENTTRINITY/tree/master/silenttrinity/core/teamserver/modules/boo"}]},{"id":"S0693","name":"CaddyWiper","url":"https://attack.mitre.org/software/S0693","kind":"malware","description":"[CaddyWiper](https://attack.mitre.org/software/S0693) can enumerate all files and directories on a compromised host.(Citation: Malwarebytes IssacWiper CaddyWiper March 2022 )","relationship_id":"relationship--827b0e8c-857b-4ccd-b0ef-4effe2bb7fb0","references":[{"source_name":"Malwarebytes IssacWiper CaddyWiper March 2022 ","description":"Threat Intelligence Team. (2022, March 18). Double header: IsaacWiper and CaddyWiper . Retrieved April 11, 2022.","url":"https://blog.malwarebytes.com/threat-intelligence/2022/03/double-header-isaacwiper-and-caddywiper/"}]},{"id":"S0697","name":"HermeticWiper","url":"https://attack.mitre.org/software/S0697","kind":"malware","description":"[HermeticWiper](https://attack.mitre.org/software/S0697) can enumerate common folders such as My Documents, Desktop, and AppData.(Citation: SentinelOne Hermetic Wiper February 2022)(Citation: Qualys Hermetic Wiper March 2022)","relationship_id":"relationship--6435a96b-f3b5-4a16-876f-901650257d36","references":[{"source_name":"SentinelOne Hermetic Wiper February 2022","description":"Guerrero-Saade, J. (2022, February 23). HermeticWiper | New Destructive Malware Used In Cyber Attacks on Ukraine. Retrieved March 25, 2022.","url":"https://www.sentinelone.com/labs/hermetic-wiper-ukraine-under-attack"},{"source_name":"Qualys Hermetic Wiper March 2022","description":"Dani, M. (2022, March 1). Ukrainian Targets Hit by HermeticWiper, New Datawiper Malware. Retrieved March 25, 2022.","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/03/01/ukrainian-targets-hit-by-hermeticwiper-new-datawiper-malware"}]},{"id":"S1016","name":"MacMa","url":"https://attack.mitre.org/software/S1016","kind":"malware","description":"[MacMa](https://attack.mitre.org/software/S1016) can search for a specific file on the compromised computer and can enumerate files in Desktop, Downloads, and Documents folders.(Citation: ESET DazzleSpy Jan 2022)","relationship_id":"relationship--f16f6118-810f-4e08-9178-001156c95b53","references":[{"source_name":"ESET DazzleSpy Jan 2022","description":"M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.","url":"https://www.welivesecurity.com/2022/01/25/watering-hole-deploys-new-macos-malware-dazzlespy-asia/"}]},{"id":"S1017","name":"OutSteel","url":"https://attack.mitre.org/software/S1017","kind":"malware","description":"[OutSteel](https://attack.mitre.org/software/S1017) can search for specific file extensions, including zipped files.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )","relationship_id":"relationship--8060addd-e961-41e2-a835-9343153b7522","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","description":"Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"id":"S1018","name":"Saint Bot","url":"https://attack.mitre.org/software/S1018","kind":"malware","description":"[Saint Bot](https://attack.mitre.org/software/S1018) can search a compromised host for specific files.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )","relationship_id":"relationship--dbc56199-173e-4325-af52-ee6fd26dbdb6","references":[{"source_name":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","description":"Unit 42. (2022, February 25). Spear Phishing Attacks Target Organizations in Ukraine, Payloads Include the Document Stealer OutSteel and the Downloader SaintBot. Retrieved June 9, 2022.","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"id":"S1022","name":"IceApple","url":"https://attack.mitre.org/software/S1022","kind":"malware","description":"The [IceApple](https://attack.mitre.org/software/S1022) Directory Lister module can list information about files and directories including creation time, last write time, name, and size.(Citation: CrowdStrike IceApple May 2022)","relationship_id":"relationship--ce67a5bb-66a8-4926-ae72-64ef08040770","references":[{"source_name":"CrowdStrike IceApple May 2022","description":"CrowdStrike. (2022, May). ICEAPPLE: A NOVEL INTERNET INFORMATION SERVICES (IIS) POST-EXPLOITATION FRAMEWORK. Retrieved June 27, 2022.","url":"https://www.crowdstrike.com/wp-content/uploads/2022/05/crowdstrike-iceapple-a-novel-internet-information-services-post-exploitation-framework.pdf"}]},{"id":"S1023","name":"CreepyDrive","url":"https://attack.mitre.org/software/S1023","kind":"malware","description":"[CreepyDrive](https://attack.mitre.org/software/S1023) can specify the local file path to upload files from.(Citation: Microsoft POLONIUM June 2022)","relationship_id":"relationship--95a8788a-b36c-4234-94bc-951eb1f72cce","references":[{"source_name":"Microsoft POLONIUM June 2022","description":"Microsoft. (2022, June 2). Exposing POLONIUM activity and infrastructure targeting Israeli organizations. Retrieved July 1, 2022.","url":"https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"}]},{"id":"S1025","name":"Amadey","url":"https://attack.mitre.org/software/S1025","kind":"malware","description":"[Amadey](https://attack.mitre.org/software/S1025) has searched for folders associated with antivirus software.(Citation: Korean FSI TA505 2020)","relationship_id":"relationship--062059e8-21cb-4030-8244-ce7f6643e3c9","references":[{"source_name":"Korean FSI TA505 2020","description":"Financial Security Institute. (2020, February 28). Profiling of TA505 Threat Group That Continues to Attack the Financial Sector. Retrieved July 14, 2022.","url":"https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="}]},{"id":"S1027","name":"Heyoka Backdoor","url":"https://attack.mitre.org/software/S1027","kind":"malware","description":"[Heyoka Backdoor](https://attack.mitre.org/software/S1027) has the ability to search the compromised host for files.(Citation: SentinelOne Aoqin Dragon June 2022)","relationship_id":"relationship--9d28bf78-0fde-4efd-85b2-fc1960f1b386","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","description":"Chen, Joey. (2022, June 9). Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years. Retrieved July 14, 2022.","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}]},{"id":"S1028","name":"Action RAT","url":"https://attack.mitre.org/software/S1028","kind":"malware","description":"[Action RAT](https://attack.mitre.org/software/S1028) has the ability to collect drive and file information on an infected machine.(Citation: MalwareBytes SideCopy Dec 2021)","relationship_id":"relationship--ce85101e-baca-4a1a-9352-9c9db89706a4","references":[{"source_name":"MalwareBytes SideCopy Dec 2021","description":"Threat Intelligence Team. (2021, December 2). SideCopy APT: Connecting lures victims, payloads to infrastructure. Retrieved June 13, 2022.","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}]},{"id":"S1031","name":"PingPull","url":"https://attack.mitre.org/software/S1031","kind":"malware","description":"[PingPull](https://attack.mitre.org/software/S1031) can enumerate storage volumes and folder contents of a compromised host.(Citation: Unit 42 PingPull Jun 2022)","relationship_id":"relationship--262fe71a-a2d5-4624-ac50-5a76c0dd862e","references":[{"source_name":"Unit 42 PingPull Jun 2022","description":"Unit 42. (2022, June 13). GALLIUM Expands Targeting Across Telecommunications, Government and Finance Sectors With New PingPull Tool. Retrieved August 7, 2022.","url":"https://unit42.paloaltonetworks.com/pingpull-gallium/"}]},{"id":"S1034","name":"StrifeWater","url":"https://attack.mitre.org/software/S1034","kind":"malware","description":"[StrifeWater](https://attack.mitre.org/software/S1034) can enumerate files on a compromised host.(Citation: Cybereason StrifeWater Feb 2022)","relationship_id":"relationship--bae19e73-3612-42a3-be35-5f5b2adfc5b7","references":[{"source_name":"Cybereason StrifeWater Feb 2022","description":"Cybereason Nocturnus. (2022, February 1). StrifeWater RAT: Iranian APT Moses Staff Adds New Trojan to Ransomware Operations. Retrieved August 15, 2022.","url":"https://www.cybereason.com/blog/research/strifewater-rat-iranian-apt-moses-staff-adds-new-trojan-to-ransomware-operations"}]},{"id":"S1040","name":"Rclone","url":"https://attack.mitre.org/software/S1040","kind":"tool","description":"[Rclone](https://attack.mitre.org/software/S1040) can list files and directories with the `ls`, `lsd`, and `lsl` commands.(Citation: Rclone)","relationship_id":"relationship--4322a0e4-1653-416a-81c1-cfc8a7cfd69e","references":[{"source_name":"Rclone","description":"Nick Craig-Wood. (n.d.). Rclone syncs your files to cloud storage. Retrieved August 30, 2022.","url":"https://rclone.org"}]},{"id":"S1042","name":"SUGARDUMP","url":"https://attack.mitre.org/software/S1042","kind":"malware","description":"[SUGARDUMP](https://attack.mitre.org/software/S1042) can search for and collect data from specific Chrome, Opera, Microsoft Edge, and Firefox files, including any folders that have the string `Profile` in its name.(Citation: Mandiant UNC3890 Aug 2022)","relationship_id":"relationship--12e62986-c406-4767-9cc5-49d05c5c34b7","references":[{"source_name":"Mandiant UNC3890 Aug 2022","description":"Mandiant Israel Research Team. (2022, August 17). Suspected Iranian Actor Targeting Israeli Shipping, Healthcare, Government and Energy Sectors. Retrieved September 21, 2022.","url":"https://www.mandiant.com/resources/blog/suspected-iranian-actor-targeting-israeli-shipping"}]},{"id":"S1043","name":"ccf32","url":"https://attack.mitre.org/software/S1043","kind":"malware","description":"[ccf32](https://attack.mitre.org/software/S1043) can parse collected files to identify specific file extensions.(Citation: Bitdefender FunnyDream Campaign November 2020)","relationship_id":"relationship--bd610e42-b791-4322-8451-5fab556b6c28","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","description":"Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}]},{"id":"S1044","name":"FunnyDream","url":"https://attack.mitre.org/software/S1044","kind":"malware","description":"[FunnyDream](https://attack.mitre.org/software/S1044) can identify files with .doc, .docx, .ppt, .pptx, .xls, .xlsx, and .pdf extensions and specific timestamps for collection.(Citation: Bitdefender FunnyDream Campaign November 2020)","relationship_id":"relationship--fc268488-a74d-4100-917f-be04cc81826b","references":[{"source_name":"Bitdefender FunnyDream Campaign November 2020","description":"Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.","url":"https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf"}]},{"id":"S1053","name":"AvosLocker","url":"https://attack.mitre.org/software/S1053","kind":"malware","description":"[AvosLocker](https://attack.mitre.org/software/S1053) has searched for files and directories on a compromised network.(Citation: Malwarebytes AvosLocker Jul 2021)(Citation: Trend Micro AvosLocker Apr 2022)","relationship_id":"relationship--86ca25c9-8cc3-43f8-bf19-2aca39bcf05e","references":[{"source_name":"Malwarebytes AvosLocker Jul 2021","description":"Hasherezade. (2021, July 23). AvosLocker enters the ransomware scene, asks for partners. Retrieved January 11, 2023.","url":"https://www.malwarebytes.com/blog/threat-intelligence/2021/07/avoslocker-enters-the-ransomware-scene-asks-for-partners"},{"source_name":"Trend Micro AvosLocker Apr 2022","description":"Trend Micro Research. (2022, April 4). Ransomware Spotlight AvosLocker. Retrieved January 11, 2023.","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-avoslocker"}]},{"id":"S1058","name":"Prestige","url":"https://attack.mitre.org/software/S1058","kind":"malware","description":"[Prestige](https://attack.mitre.org/software/S1058) can traverse the file system to discover files to encrypt by identifying specific extensions defined in a hardcoded list.(Citation: Microsoft Prestige ransomware October 2022)","relationship_id":"relationship--bfe5c795-c95c-4387-b3d9-813078e7e99a","references":[{"source_name":"Microsoft Prestige ransomware October 2022","description":"MSTIC. (2022, October 14). New “Prestige” ransomware impacts organizations in Ukraine and Poland. Retrieved January 19, 2023.","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"}]},{"id":"S1059","name":"metaMain","url":"https://attack.mitre.org/software/S1059","kind":"malware","description":"[metaMain](https://attack.mitre.org/software/S1059) can recursively enumerate files in an operator-provided directory.(Citation: SentinelLabs Metador Sept 2022)(Citation: SentinelLabs Metador Technical Appendix Sept 2022)","relationship_id":"relationship--ac0de65d-dc44-4575-a175-167e9c85cde9","references":[{"source_name":"SentinelLabs Metador Sept 2022","description":"Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"},{"source_name":"SentinelLabs Metador Technical Appendix Sept 2022","description":"SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023.","url":"https://docs.google.com/document/d/1e9ZTW9b71YwFWS_18ZwDAxa-cYbV8q1wUefmKZLYVsA/edit#heading=h.lmnbtht1ikzm"}]},{"id":"S1060","name":"Mafalda","url":"https://attack.mitre.org/software/S1060","kind":"malware","description":"[Mafalda](https://attack.mitre.org/software/S1060) can search for files and directories.(Citation: SentinelLabs Metador Sept 2022)","relationship_id":"relationship--cb11835b-c16e-4877-8769-806277b994fc","references":[{"source_name":"SentinelLabs Metador Sept 2022","description":"Ehrlich, A., et al. (2022, September). THE MYSTERY OF METADOR | AN UNATTRIBUTED THREAT HIDING IN TELCOS, ISPS, AND UNIVERSITIES. Retrieved January 23, 2023.","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}]},{"id":"S1065","name":"Woody RAT","url":"https://attack.mitre.org/software/S1065","kind":"malware","description":"[Woody RAT](https://attack.mitre.org/software/S1065) can list all files and their associated attributes, including filename, type, owner, creation time, last access time, last write time, size, and permissions.(Citation: MalwareBytes WoodyRAT Aug 2022) ","relationship_id":"relationship--06ab6825-89f4-4bb7-8c82-ae9a5d4cdf61","references":[{"source_name":"MalwareBytes WoodyRAT Aug 2022","description":"MalwareBytes Threat Intelligence Team. (2022, August 3). Woody RAT: A new feature-rich malware spotted in the wild. Retrieved December 6, 2022.","url":"https://www.malwarebytes.com/blog/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild"}]},{"id":"S1068","name":"BlackCat","url":"https://attack.mitre.org/software/S1068","kind":"malware","description":"[BlackCat](https://attack.mitre.org/software/S1068) can enumerate files for encryption.(Citation: Microsoft BlackCat Jun 2022)","relationship_id":"relationship--f6fe7167-0788-4062-9f59-d8ee8398db15","references":[{"source_name":"Microsoft BlackCat Jun 2022","description":"Microsoft Defender Threat Intelligence. (2022, June 13). The many lives of BlackCat ransomware. Retrieved December 20, 2022.","url":"https://www.microsoft.com/en-us/security/blog/2022/06/13/the-many-lives-of-blackcat-ransomware/"}]},{"id":"S1070","name":"Black Basta","url":"https://attack.mitre.org/software/S1070","kind":"malware","description":"[Black Basta](https://attack.mitre.org/software/S1070) can enumerate specific files for encryption.(Citation: Cyble Black Basta May 2022)(Citation: Avertium Black Basta June 2022)(Citation: NCC Group Black Basta June 2022)(Citation: Uptycs Black Basta ESXi June 2022)(Citation: Deep Instinct Black Basta August 2022)(Citation: Palo Alto Networks Black Basta August 2022)(Citation: Trend Micro Black Basta Spotlight September 2022)(Citation: Check Point Black Basta October 2022)","relationship_id":"relationship--66e7e1f3-5113-407f-a07a-299c4b9b68e2","references":[{"source_name":"Avertium Black Basta June 2022","description":"Avertium. (2022, June 1). AN IN-DEPTH LOOK AT BLACK BASTA RANSOMWARE. Retrieved March 7, 2023.","url":"https://www.avertium.com/resources/threat-reports/in-depth-look-at-black-basta-ransomware"},{"source_name":"Check Point Black Basta October 2022","description":"Check Point. (2022, October 20). BLACK BASTA AND THE UNNOTICED DELIVERY. Retrieved March 8, 2023.","url":"https://research.checkpoint.com/2022/black-basta-and-the-unnoticed-delivery/"},{"source_name":"Cyble Black Basta May 2022","description":"Cyble. (2022, May 6). New ransomware variant targeting high-value organizations. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20220506143054/https://blog.cyble.com/2022/05/06/black-basta-ransomware/"},{"source_name":"Palo Alto Networks Black Basta August 2022","description":"Elsad, A. (2022, August 25). Threat Assessment: Black Basta Ransomware. Retrieved March 8, 2023.","url":"https://unit42.paloaltonetworks.com/threat-assessment-black-basta-ransomware"},{"source_name":"NCC Group Black Basta June 2022","description":"Inman, R. and Gurney, P. (2022, June 6). Shining the Light on Black Basta. Retrieved March 8, 2023.","url":"https://research.nccgroup.com/2022/06/06/shining-the-light-on-black-basta/"},{"source_name":"Uptycs Black Basta ESXi June 2022","description":"Sharma, S. and Hegde, N. (2022, June 7). Black basta Ransomware Goes Cross-Platform, Now Targets ESXi Systems. Retrieved March 8, 2023.","url":"https://www.uptycs.com/blog/black-basta-ransomware-goes-cross-platform-now-targets-esxi-systems"},{"source_name":"Trend Micro Black Basta Spotlight September 2022","description":"Trend Micro. (2022, September 1). Ransomware Spotlight Black Basta. Retrieved March 8, 2023.","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbasta"},{"source_name":"Deep Instinct Black Basta August 2022","description":"Vilkomir-Preisman, S. (2022, August 18). Beating Black Basta Ransomware. Retrieved March 8, 2023.","url":"https://www.deepinstinct.com/blog/black-basta-ransomware-threat-emergence"}]},{"id":"S1073","name":"Royal","url":"https://attack.mitre.org/software/S1073","kind":"malware","description":"[Royal](https://attack.mitre.org/software/S1073) can identify specific files and directories to exclude from the encryption process.(Citation: Cybereason Royal December 2022)(Citation: Kroll Royal Deep Dive February 2023)(Citation: Trend Micro Royal Linux ESXi February 2023)","relationship_id":"relationship--f1aa297a-1b61-4bfc-9e4b-18b4b82b4d8c","references":[{"source_name":"Cybereason Royal December 2022","description":"Cybereason Global SOC and Cybereason Security Research Teams. (2022, December 14). Royal Rumble: Analysis of Royal Ransomware. Retrieved March 30, 2023.","url":"https://www.cybereason.com/blog/royal-ransomware-analysis"},{"source_name":"Kroll Royal Deep Dive February 2023","description":"Iacono, L. and Green, S. (2023, February 13). Royal Ransomware Deep Dive. Retrieved March 30, 2023.","url":"https://www.kroll.com/en/insights/publications/cyber/royal-ransomware-deep-dive"},{"source_name":"Trend Micro Royal Linux ESXi February 2023","description":"Morales, N. et al. (2023, February 20). Royal Ransomware Expands Attacks by Targeting Linux ESXi Servers. Retrieved March 30, 2023.","url":"https://www.trendmicro.com/en_us/research/23/b/royal-ransomware-expands-attacks-by-targeting-linux-esxi-servers.html"}]},{"id":"S1089","name":"SharpDisco","url":"https://attack.mitre.org/software/S1089","kind":"malware","description":"[SharpDisco](https://attack.mitre.org/software/S1089) can identify recently opened files by using an LNK format parser to extract the original file path from LNK files found in either `%USERPROFILE%\\Recent` (Windows XP) or `%APPDATA%\\Microsoft\\Windows\\Recent` (newer Windows versions) .(Citation: MoustachedBouncer ESET August 2023)","relationship_id":"relationship--f5d2b140-1267-405b-8085-e02c135504f9","references":[{"source_name":"MoustachedBouncer ESET August 2023","description":"Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}]},{"id":"S1090","name":"NightClub","url":"https://attack.mitre.org/software/S1090","kind":"malware","description":"[NightClub](https://attack.mitre.org/software/S1090) can use a file monitor to identify .lnk, .doc, .docx, .xls, .xslx, and .pdf files.(Citation: MoustachedBouncer ESET August 2023)","relationship_id":"relationship--3ad23432-af84-4887-bbf2-733d12d03395","references":[{"source_name":"MoustachedBouncer ESET August 2023","description":"Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023.","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}]},{"id":"S1096","name":"Cheerscrypt","url":"https://attack.mitre.org/software/S1096","kind":"malware","description":"[Cheerscrypt](https://attack.mitre.org/software/S1096) can search for log and VMware-related files with .log, .vmdk, .vmem, .vswp, and .vmsn extensions.(Citation: Trend Micro Cheerscrypt May 2022)","relationship_id":"relationship--e2f772c3-0822-4c4c-8a8d-51094349ccc5","references":[{"source_name":"Trend Micro Cheerscrypt May 2022","description":"Dela Cruz, A. et al. (2022, May 25). New Linux-Based Ransomware Cheerscrypt Targeting ESXi Devices Linked to Leaked Babuk Source Code. Retrieved December 19, 2023.","url":"https://www.trendmicro.com/en_se/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html"}]},{"id":"S1099","name":"Samurai","url":"https://attack.mitre.org/software/S1099","kind":"malware","description":"[Samurai](https://attack.mitre.org/software/S1099) can use a specific module for file enumeration.(Citation: Kaspersky ToddyCat June 2022)","relationship_id":"relationship--7d95669c-e4e9-40d5-a36b-cadbc922270d","references":[{"source_name":"Kaspersky ToddyCat June 2022","description":"Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat/106799/"}]},{"id":"S1100","name":"Ninja","url":"https://attack.mitre.org/software/S1100","kind":"malware","description":"[Ninja](https://attack.mitre.org/software/S1100) has the ability to enumerate directory content.(Citation: Kaspersky ToddyCat June 2022)(Citation: Kaspersky ToddyCat Check Logs October 2023)","relationship_id":"relationship--4ebc45da-6c79-4d9f-9c25-144ff55f70c9","references":[{"source_name":"Kaspersky ToddyCat June 2022","description":"Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat/106799/"},{"source_name":"Kaspersky ToddyCat Check Logs October 2023","description":"Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"id":"S1101","name":"LoFiSe","url":"https://attack.mitre.org/software/S1101","kind":"malware","description":"[LoFiSe](https://attack.mitre.org/software/S1101) can monitor the file system to identify files less than 6.4 MB in size with file extensions including .doc, .docx, .xls, .xlsx, .ppt, .pptx, .pdf, .rtf, .tif, .odt, .ods, .odp, .eml, and .msg.(Citation: Kaspersky ToddyCat Check Logs October 2023)","relationship_id":"relationship--734b4d88-1203-4ffc-8f49-393dfebfe162","references":[{"source_name":"Kaspersky ToddyCat Check Logs October 2023","description":"Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"id":"S1102","name":"Pcexter","url":"https://attack.mitre.org/software/S1102","kind":"malware","description":"[Pcexter](https://attack.mitre.org/software/S1102) has the ability to search for files in specified directories.(Citation: Kaspersky ToddyCat Check Logs October 2023)","relationship_id":"relationship--72a914ff-e640-4ea3-9c61-d144a988e3a7","references":[{"source_name":"Kaspersky ToddyCat Check Logs October 2023","description":"Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"id":"S1105","name":"COATHANGER","url":"https://attack.mitre.org/software/S1105","kind":"malware","description":"[COATHANGER](https://attack.mitre.org/software/S1105) will survey the contents of system files during installation.(Citation: NCSC-NL COATHANGER Feb 2024)","relationship_id":"relationship--741fd887-1d55-489b-a77f-3a1d28016305","references":[{"source_name":"NCSC-NL COATHANGER Feb 2024","description":"Dutch Military Intelligence and Security Service (MIVD) & Dutch General Intelligence and Security Service (AIVD). (2024, February 6). Ministry of Defense of the Netherlands uncovers COATHANGER, a stealthy Chinese FortiGate RAT. Retrieved February 7, 2024.","url":"https://www.ncsc.nl/binaries/ncsc/documenten/publicaties/2024/februari/6/mivd-aivd-advisory-coathanger-tlp-clear/TLP-CLEAR+MIVD+AIVD+Advisory+COATHANGER.pdf"}]},{"id":"S1109","name":"PACEMAKER","url":"https://attack.mitre.org/software/S1109","kind":"malware","description":"[PACEMAKER](https://attack.mitre.org/software/S1109) can parse `/proc/\"process_name\"/cmdline` to look for the string `dswsd` within the command line.(Citation: Mandiant Pulse Secure Zero-Day April 2021)","relationship_id":"relationship--dee2ef91-fe07-423a-8ad3-551c99b7a112","references":[{"source_name":"Mandiant Pulse Secure Zero-Day April 2021","description":"Perez, D. et al. (2021, April 20). Check Your Pulse: Suspected APT Actors Leverage Authentication Bypass Techniques and Pulse Secure Zero-Day. Retrieved February 5, 2024.","url":"https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"}]},{"id":"S1111","name":"DarkGate","url":"https://attack.mitre.org/software/S1111","kind":"malware","description":"Some versions of [DarkGate](https://attack.mitre.org/software/S1111) search for the hard-coded folder <code>C:\\Program Files\\e Carte Bleue</code>.(Citation: Ensilo Darkgate 2018)","relationship_id":"relationship--9f44fb67-6ad0-44c3-bc84-8b12b50819a9","references":[{"source_name":"Ensilo Darkgate 2018","description":"Adi Zeligson & Rotem Kerner. (2018, November 13). Enter The DarkGate - New Cryptocurrency Mining and Ransomware Campaign. Retrieved February 9, 2024.","url":"https://www.fortinet.com/blog/threat-research/enter-the-darkgate-new-cryptocurrency-mining-and-ransomware-campaign"}]},{"id":"S1114","name":"ZIPLINE","url":"https://attack.mitre.org/software/S1114","kind":"malware","description":"[ZIPLINE](https://attack.mitre.org/software/S1114) can find and append specific files on Ivanti Connect Secure VPNs based upon received commands.(Citation: Mandiant Cutting Edge January 2024)","relationship_id":"relationship--93cf8ff7-a559-4fc9-ba31-18c0ebdc5244","references":[{"source_name":"Mandiant Cutting Edge January 2024","description":"McLellan, T. et al. (2024, January 12). Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation. Retrieved February 27, 2024.","url":"https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day"}]},{"id":"S1121","name":"LITTLELAMB.WOOLTEA","url":"https://attack.mitre.org/software/S1121","kind":"malware","description":"[LITTLELAMB.WOOLTEA](https://attack.mitre.org/software/S1121) can monitor for system upgrade events by checking for the presence of `/tmp/data/root/dev`.(Citation: Mandiant Cutting Edge Part 3 February 2024)","relationship_id":"relationship--efba0428-a817-4783-b04f-a9af95362c5e","references":[{"source_name":"Mandiant Cutting Edge Part 3 February 2024","description":"Lin, M. et al. (2024, February 27). Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts. Retrieved March 1, 2024.","url":"https://www.mandiant.com/resources/blog/investigating-ivanti-exploitation-persistence"}]},{"id":"S1122","name":"Mispadu","url":"https://attack.mitre.org/software/S1122","kind":"malware","description":"[Mispadu](https://attack.mitre.org/software/S1122) searches for various filesystem paths to determine what banking applications are installed on the victim’s machine.(Citation: ESET Security Mispadu Facebook Ads 2019)","relationship_id":"relationship--b57b7604-1b4c-4ee2-aa1a-737f459df99f","references":[{"source_name":"ESET Security Mispadu Facebook Ads 2019","description":"ESET Security. (2019, November 19). Mispadu: Advertisement for a discounted Unhappy Meal. Retrieved March 13, 2024.","url":"https://www.welivesecurity.com/2019/11/19/mispadu-advertisement-discounted-unhappy-meal/"}]},{"id":"S1125","name":"AcidRain","url":"https://attack.mitre.org/software/S1125","kind":"malware","description":"[AcidRain](https://attack.mitre.org/software/S1125) identifies specific files and directories in the Linux operating system associated with storage devices.(Citation: AcidRain JAGS 2022)","relationship_id":"relationship--dbc22e6e-df81-4f17-924e-3ce456ee2f16","references":[{"source_name":"AcidRain JAGS 2022","description":"Juan Andres Guerrero-Saade and Max van Amerongen, SentinelOne. (2022, March 31). AcidRain | A Modem Wiper Rains Down on Europe. Retrieved March 25, 2024.","url":"https://www.sentinelone.com/labs/acidrain-a-modem-wiper-rains-down-on-europe/"}]},{"id":"S1129","name":"Akira","url":"https://attack.mitre.org/software/S1129","kind":"malware","description":"[Akira](https://attack.mitre.org/software/S1129) examines files prior to encryption to determine if they meet requirements for encryption and can be encrypted by the ransomware. These checks are performed through native Windows functions such as <code>GetFileAttributesW</code>.(Citation: Kersten Akira 2023)(Citation: Cisco Akira Ransomware OCT 2024)","relationship_id":"relationship--079b3956-d020-4b9d-a230-e43b391e261f","references":[{"source_name":"Kersten Akira 2023","description":"Max Kersten & Alexandre Mundo. (2023, November 29). Akira Ransomware. Retrieved April 4, 2024.","url":"https://www.trellix.com/blogs/research/akira-ransomware/"},{"source_name":"Cisco Akira Ransomware OCT 2024","description":"Nutland, J. and Szeliga, M. (2024, October 21). Akira ransomware continues to evolve. Retrieved December 10, 2024.","url":"https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/"}]},{"id":"S1130","name":"Raspberry Robin","url":"https://attack.mitre.org/software/S1130","kind":"malware","description":"[Raspberry Robin](https://attack.mitre.org/software/S1130) will check to see if the initial executing script is located on the user's Desktop as an anti-analysis check.(Citation: HP RaspberryRobin 2024)","relationship_id":"relationship--91e69232-941e-43bf-9f10-b0e4cf8b43d1","references":[{"source_name":"HP RaspberryRobin 2024","description":"Patrick Schläpfer . (2024, April 10). Raspberry Robin Now Spreading Through Windows Script Files. Retrieved May 17, 2024.","url":"https://threatresearch.ext.hp.com/raspberry-robin-now-spreading-through-windows-script-files/"}]},{"id":"S1135","name":"MultiLayer Wiper","url":"https://attack.mitre.org/software/S1135","kind":"malware","description":"[MultiLayer Wiper](https://attack.mitre.org/software/S1135) generates a list of all files and paths on the fixed drives of an infected system, enumerating all files on the system except specific folders defined in a hardcoded list.(Citation: Unit42 Agrius 2023)","relationship_id":"relationship--e28f72fc-86ae-481a-9181-d06380eeb859","references":[{"source_name":"Unit42 Agrius 2023","description":"Or Chechik, Tom Fakterman, Daniel Frank & Assaf Dahan. (2023, November 6). Agonizing Serpens (Aka Agrius) Targeting the Israeli Higher Education and Tech Sectors. Retrieved May 22, 2024.","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}]},{"id":"S1139","name":"INC Ransomware","url":"https://attack.mitre.org/software/S1139","kind":"malware","description":"[INC Ransomware](https://attack.mitre.org/software/S1139) can receive command line arguments to encrypt specific files and directories.(Citation: Cybereason INC Ransomware November 2023)(Citation: SentinelOne INC Ransomware)","relationship_id":"relationship--9ca67039-be32-4fed-a40a-5ddfe4d6fff2","references":[{"source_name":"Cybereason INC Ransomware November 2023","description":"Cybereason Security Research Team. (2023, November 20). Threat Alert: INC Ransomware. Retrieved June 5, 2024.","url":"https://web.archive.org/web/20231202022946/https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf"},{"source_name":"SentinelOne INC Ransomware","description":"SentinelOne. (n.d.). What Is Inc. Ransomware?. Retrieved June 5, 2024.","url":"https://www.sentinelone.com/anthology/inc-ransom/"}]},{"id":"S1140","name":"Spica","url":"https://attack.mitre.org/software/S1140","kind":"malware","description":"[Spica](https://attack.mitre.org/software/S1140) can list filesystem contents on targeted systems.(Citation: Google TAG COLDRIVER January 2024)","relationship_id":"relationship--6369c7fa-ec7b-4fff-a4b7-83348318814a","references":[{"source_name":"Google TAG COLDRIVER January 2024","description":"Shields, W. (2024, January 18). Russian threat group COLDRIVER expands its targeting of Western officials to include the use of malware. Retrieved June 13, 2024.","url":"https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/"}]},{"id":"S1141","name":"LunarWeb","url":"https://attack.mitre.org/software/S1141","kind":"malware","description":"[LunarWeb](https://attack.mitre.org/software/S1141) has the ability to retrieve directory listings.(Citation: ESET Turla Lunar toolset May 2024)","relationship_id":"relationship--3b79c4a0-aaa4-430d-9f15-4acbc5e1b0a3","references":[{"source_name":"ESET Turla Lunar toolset May 2024","description":"Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}]},{"id":"S1142","name":"LunarMail","url":"https://attack.mitre.org/software/S1142","kind":"malware","description":"[LunarMail](https://attack.mitre.org/software/S1142) can search its staging directory for output files it has produced.(Citation: ESET Turla Lunar toolset May 2024)","relationship_id":"relationship--9c75cda8-5656-4968-8a74-738d1b2b0399","references":[{"source_name":"ESET Turla Lunar toolset May 2024","description":"Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}]},{"id":"S1148","name":"Raccoon Stealer","url":"https://attack.mitre.org/software/S1148","kind":"malware","description":"[Raccoon Stealer](https://attack.mitre.org/software/S1148) identifies target files and directories for collection based on a configuration file.(Citation: S2W Racoon 2022)(Citation: Sekoia Raccoon2 2022)","relationship_id":"relationship--ee683bba-698d-4fde-be42-1aa7e3ed3211","references":[{"source_name":"Sekoia Raccoon2 2022","description":"Pierre Le Bourhis, Quentin Bourgue, & Sekoia TDR. (2022, June 29). Raccoon Stealer v2 - Part 2: In-depth analysis. Retrieved August 1, 2024.","url":"https://blog.sekoia.io/raccoon-stealer-v2-part-2-in-depth-analysis/"},{"source_name":"S2W Racoon 2022","description":"S2W TALON. (2022, June 16). Raccoon Stealer is Back with a New Version. Retrieved August 1, 2024.","url":"https://medium.com/s2wblog/raccoon-stealer-is-back-with-a-new-version-5f436e04b20d"}]},{"id":"S1149","name":"CHIMNEYSWEEP","url":"https://attack.mitre.org/software/S1149","kind":"malware","description":"[CHIMNEYSWEEP](https://attack.mitre.org/software/S1149) has the ability to enumerate directories for files that match a set list.(Citation: Mandiant ROADSWEEP August 2022)","relationship_id":"relationship--4a0c829e-1590-407a-bc3f-64793050e039","references":[{"source_name":"Mandiant ROADSWEEP August 2022","description":"Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"}]},{"id":"S1150","name":"ROADSWEEP","url":"https://attack.mitre.org/software/S1150","kind":"malware","description":"[ROADSWEEP](https://attack.mitre.org/software/S1150) can enumerate files on infected devices and avoid encrypting files with .exe, .dll, \t.sys, .lnk, or . lck extensions.(Citation: Mandiant ROADSWEEP August 2022)(Citation: CISA Iran Albanian Attacks September 2022)(Citation: Microsoft Albanian Government Attacks September 2022)","relationship_id":"relationship--d3d69fb7-c6f3-43d7-bb38-ac26fe22b5be","references":[{"source_name":"CISA Iran Albanian Attacks September 2022","description":"CISA. (2022, September 23). AA22-264A Iranian State Actors Conduct Cyber Operations Against the Government of Albania. Retrieved August 6, 2024.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-264a"},{"source_name":"Mandiant ROADSWEEP August 2022","description":"Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/likely-iranian-threat-actor-conducts-politically-motivated-disruptive-activity-against/"},{"source_name":"Microsoft Albanian Government Attacks September 2022","description":"MSTIC. (2022, September 8). Microsoft investigates Iranian attacks against the Albanian government. Retrieved August 6, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government/"}]},{"id":"S1153","name":"Cuckoo Stealer","url":"https://attack.mitre.org/software/S1153","kind":"malware","description":"[Cuckoo Stealer](https://attack.mitre.org/software/S1153) can search for files associated with specific applications.(Citation: Kandji Cuckoo April 2024)(Citation: SentinelOne Cuckoo Stealer May 2024)","relationship_id":"relationship--5d3f0b01-04e0-43d0-9fa5-7d2dd2d3910f","references":[{"source_name":"Kandji Cuckoo April 2024","description":"Kohler, A. and Lopez, C. (2024, April 30). Malware: Cuckoo Behaves Like Cross Between Infostealer and Spyware. Retrieved August 20, 2024.","url":"https://www.kandji.io/blog/malware-cuckoo-infostealer-spyware"},{"source_name":"SentinelOne Cuckoo Stealer May 2024","description":"Stokes, P. (2024, May 9). macOS Cuckoo Stealer | Ensuring Detection and Defense as New Samples Rapidly Emerge. Retrieved August 20, 2024.","url":"https://www.sentinelone.com/blog/macos-cuckoo-stealer-ensuring-detection-and-defense-as-new-samples-rapidly-emerge/"}]},{"id":"S1156","name":"Manjusaka","url":"https://attack.mitre.org/software/S1156","kind":"malware","description":"[Manjusaka](https://attack.mitre.org/software/S1156) can gather information about specific files on the victim system.(Citation: Talos Manjusaka 2022)","relationship_id":"relationship--6c3d4f83-49e2-42fa-a4b8-823f04b3cd32","references":[{"source_name":"Talos Manjusaka 2022","description":"Asheer Malhotra & Vitor Ventura. (2022, August 2). Manjusaka: A Chinese sibling of Sliver and Cobalt Strike. Retrieved September 4, 2024.","url":"https://blog.talosintelligence.com/manjusaka-offensive-framework/"}]},{"id":"S1159","name":"DUSTTRAP","url":"https://attack.mitre.org/software/S1159","kind":"malware","description":"[DUSTTRAP](https://attack.mitre.org/software/S1159) can enumerate files and directories.(Citation: Google Cloud APT41 2024)","relationship_id":"relationship--7c7b8fe8-4dfd-4367-b4a7-22321938a3b3","references":[{"source_name":"Google Cloud APT41 2024","description":"Mike Stokkel et al. (2024, July 18). APT41 Has Arisen From the DUST. Retrieved September 16, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust"}]},{"id":"S1160","name":"Latrodectus","url":"https://attack.mitre.org/software/S1160","kind":"malware","description":"[Latrodectus](https://attack.mitre.org/software/S1160) can collect desktop filenames.(Citation: Latrodectus APR 2024)(Citation: Bitsight Latrodectus June 2024)(Citation: Elastic Latrodectus May 2024)","relationship_id":"relationship--5c15936e-ed4a-4a6e-a126-eb36084019b5","references":[{"source_name":"Bitsight Latrodectus June 2024","description":"Batista, J. (2024, June 17). Latrodectus, are you coming back?. Retrieved September 13, 2024.","url":"https://www.bitsight.com/blog/latrodectus-are-you-coming-back"},{"source_name":"Latrodectus APR 2024","description":"Proofpoint Threat Research and Team Cymru S2 Threat Research. (2024, April 4). Latrodectus: This Spider Bytes Like Ice . Retrieved May 31, 2024.","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"},{"source_name":"Elastic Latrodectus May 2024","description":"Stepanic, D. and Bousseaden, S. (2024, May 15). Spring Cleaning with LATRODECTUS: A Potential Replacement for ICEDID. Retrieved September 13, 2024.","url":"https://www.elastic.co/security-labs/spring-cleaning-with-latrodectus"}]},{"id":"S1162","name":"Playcrypt","url":"https://attack.mitre.org/software/S1162","kind":"malware","description":"[Playcrypt](https://attack.mitre.org/software/S1162) can avoid encrypting files with a .PLAY, .exe, .msi, .dll, .lnk, or .sys file extension.(Citation: Trend Micro Ransomware Spotlight Play July 2023)","relationship_id":"relationship--b1c5e842-5fdd-445e-a778-ffc9ca7ef219","references":[{"source_name":"Trend Micro Ransomware Spotlight Play July 2023","description":"Trend Micro Research. (2023, July 21). Ransomware Spotlight: Play. Retrieved September 24, 2024.","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"id":"S1167","name":"AcidPour","url":"https://attack.mitre.org/software/S1167","kind":"malware","description":"[AcidPour](https://attack.mitre.org/software/S1167) can identify specific files and directories within the Linux operating system corresponding with storage devices for follow-on wiping activity, similar to [AcidRain](https://attack.mitre.org/software/S1125).(Citation: SentinelOne AcidPour 2024)","relationship_id":"relationship--d67b8cc9-00e4-4f9b-8771-03a34739e01b","references":[{"source_name":"SentinelOne AcidPour 2024","description":"Juan Andrés Guerrero-Saade & Tom Hegel. (2024, March 21). AcidPour | New Embedded Wiper Variant of AcidRain Appears in Ukraine. Retrieved November 25, 2024.","url":"https://www.sentinelone.com/labs/acidpour-new-embedded-wiper-variant-of-acidrain-appears-in-ukraine/"}]},{"id":"S1169","name":"Mango","url":"https://attack.mitre.org/software/S1169","kind":"malware","description":"[Mango](https://attack.mitre.org/software/S1169) can enumerate the contents of current working or other specified directories.(Citation: ESET OilRig Campaigns Sep 2023)","relationship_id":"relationship--58a589e3-1ed8-42b0-90d2-0b1744beecc6","references":[{"source_name":"ESET OilRig Campaigns Sep 2023","description":"Hromcova, Z. and Burgher, A. (2023, September 21). OilRig’s Outer Space and Juicy Mix: Same ol’ rig, new drill pipes. Retrieved November 21, 2024.","url":"https://www.welivesecurity.com/en/eset-research/oilrigs-outer-space-juicy-mix-same-ol-rig-new-drill-pipes/"}]},{"id":"S1170","name":"ODAgent","url":"https://attack.mitre.org/software/S1170","kind":"malware","description":"[ODAgent](https://attack.mitre.org/software/S1170) can identify the current working directory.(Citation: ESET OilRig Downloaders DEC 2023)","relationship_id":"relationship--9105b1f2-17a4-4c2c-9ec9-3bff60b0b898","references":[{"source_name":"ESET OilRig Downloaders DEC 2023","description":"Hromcova, Z. and Burgher, A. (2023, December 14). OilRig’s persistent attacks using cloud service-powered downloaders. Retrieved November 26, 2024.","url":"https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/"}]},{"id":"S1179","name":"Exbyte","url":"https://attack.mitre.org/software/S1179","kind":"malware","description":"[Exbyte](https://attack.mitre.org/software/S1179) enumerates all document files on an infected machine, then creates a summary of these items including filename and directory location prior to exfiltration to cloud hosting services.(Citation: Symantec BlackByte 2022)","relationship_id":"relationship--721d7ab2-4191-4b54-a91a-90d1b23f523e","references":[{"source_name":"Symantec BlackByte 2022","description":"Symantec Threat Hunter Team. (2022, October 21). Exbyte: BlackByte Ransomware Attackers Deploy New Exfiltration Tool. Retrieved December 16, 2024.","url":"https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware"}]},{"id":"S1184","name":"BOLDMOVE","url":"https://attack.mitre.org/software/S1184","kind":"malware","description":"[BOLDMOVE](https://attack.mitre.org/software/S1184) can list information of all files in the system recursively from the root directory or from a specified directory.(Citation: Google Cloud BOLDMOVE 2023)","relationship_id":"relationship--618b5859-2518-424a-8345-6e4826586f9f","references":[{"source_name":"Google Cloud BOLDMOVE 2023","description":"Scott Henderson, Cristiana Kittner, Sarah Hawley & Mark Lechtik, Google Cloud. (2023, January 19). Suspected Chinese Threat Actors Exploiting FortiOS Vulnerability (CVE-2022-42475). Retrieved December 31, 2024.","url":"https://cloud.google.com/blog/topics/threat-intelligence/chinese-actors-exploit-fortios-flaw/"}]},{"id":"S1185","name":"LightSpy","url":"https://attack.mitre.org/software/S1185","kind":"malware","description":"[LightSpy](https://attack.mitre.org/software/S1185) uses the `NSFileManager` to move, create and delete files. [LightSpy](https://attack.mitre.org/software/S1185) can also use the assembly `bt` instruction to determine a file's executable permissions.(Citation: Huntress LightSpy macOS 2024)","relationship_id":"relationship--75ee501b-1283-4ccb-8999-00239eda55fb","references":[{"source_name":"Huntress LightSpy macOS 2024","description":"Stuart Ashenbrenner, Alden Schmidt. (2024, April 25). LightSpy Malware Variant Targeting macOS. Retrieved January 3, 2025.","url":"https://www.huntress.com/blog/lightspy-malware-variant-targeting-macos"}]},{"id":"S1191","name":"Megazord","url":"https://attack.mitre.org/software/S1191","kind":"malware","description":"[Megazord](https://attack.mitre.org/software/S1191) can ignore specified directories for encryption.(Citation: Palo Alto Howling Scorpius DEC 2024)\n","relationship_id":"relationship--f4a42928-1bf7-4177-b798-1fd254acc522","references":[{"source_name":"Palo Alto Howling Scorpius DEC 2024","description":"Zemah, Y. (2024, December 2). Threat Assessment: Howling Scorpius (Akira Ransomware). Retrieved January 8, 2025.","url":"https://unit42.paloaltonetworks.com/threat-assessment-howling-scorpius-akira-ransomware/"}]},{"id":"S1194","name":"Akira _v2","url":"https://attack.mitre.org/software/S1194","kind":"malware","description":"[Akira _v2](https://attack.mitre.org/software/S1194) can target specific files and folders for encryption.(Citation: CISA Akira Ransomware APR 2024)(Citation: Cisco Akira Ransomware OCT 2024)(Citation: Palo Alto Howling Scorpius DEC 2024)","relationship_id":"relationship--b7cd4d27-492d-4abf-8fee-27e2449ba26d","references":[{"source_name":"CISA Akira Ransomware APR 2024","description":"CISA et al. (2024, April 18). #StopRansomware: Akira Ransomware. Retrieved December 10, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-akira-ransomware_2.pdf"},{"source_name":"Cisco Akira Ransomware OCT 2024","description":"Nutland, J. and Szeliga, M. (2024, October 21). Akira ransomware continues to evolve. Retrieved December 10, 2024.","url":"https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/"},{"source_name":"Palo Alto Howling Scorpius DEC 2024","description":"Zemah, Y. (2024, December 2). Threat Assessment: Howling Scorpius (Akira Ransomware). Retrieved January 8, 2025.","url":"https://unit42.paloaltonetworks.com/threat-assessment-howling-scorpius-akira-ransomware/"}]},{"id":"S1196","name":"Troll Stealer","url":"https://attack.mitre.org/software/S1196","kind":"malware","description":"[Troll Stealer](https://attack.mitre.org/software/S1196) can enumerate and collect items from local drives and folders.(Citation: S2W Troll Stealer 2024)","relationship_id":"relationship--8eac9312-1c3f-41b7-973d-a7177a56af92","references":[{"source_name":"S2W Troll Stealer 2024","description":"Jiho Kim & Sebin Lee, S2W. (2024, February 7). Kimsuky disguised as a Korean company signed with a valid certificate to distribute Troll Stealer (English ver.). Retrieved January 17, 2025.","url":"https://medium.com/s2wblog/kimsuky-disguised-as-a-korean-company-signed-with-a-valid-certificate-to-distribute-troll-stealer-cfa5d54314e2"}]},{"id":"S1198","name":"Gomir","url":"https://attack.mitre.org/software/S1198","kind":"malware","description":"[Gomir](https://attack.mitre.org/software/S1198) collects information about directory and file structures, including total number of subdirectories, total number of files, and total size of files on infected systems.(Citation: Symantec Troll Stealer 2024)","relationship_id":"relationship--c108cde7-50d1-4472-9061-0055abcba3f6","references":[{"source_name":"Symantec Troll Stealer 2024","description":"Symantec Threat Hunter Team. (2024, May 16). Springtail: New Linux Backdoor Added to Toolkit. Retrieved January 17, 2025.","url":"https://www.security.com/threat-intelligence/springtail-kimsuky-backdoor-espionage"}]},{"id":"S1199","name":"LockBit 2.0","url":"https://attack.mitre.org/software/S1199","kind":"malware","description":"[LockBit 2.0](https://attack.mitre.org/software/S1199) can exclude files associated with core system functions from encryption.(Citation: FBI Lockbit 2.0 FEB 2022)","relationship_id":"relationship--784e4454-00c9-482e-a8a8-d5db7b034d3c","references":[{"source_name":"FBI Lockbit 2.0 FEB 2022","description":"FBI. (2022, February 4). Indicators of Compromise Associated with LockBit 2.0 Ransomware. Retrieved January 24, 2025.","url":"https://www.ic3.gov/CSA/2022/220204.pdf"}]},{"id":"S1200","name":"StealBit","url":"https://attack.mitre.org/software/S1200","kind":"malware","description":"[StealBit](https://attack.mitre.org/software/S1200) can be configured to exfiltrate specific file types.(Citation: FBI Lockbit 2.0 FEB 2022)(Citation: Cybereason StealBit Exfiltration Tool)","relationship_id":"relationship--ffb9fa57-09be-4812-ae15-b7b16b024811","references":[{"source_name":"Cybereason StealBit Exfiltration Tool","description":"Cybereason Global SOC Team. (n.d.). THREAT ANALYSIS REPORT: Inside the LockBit Arsenal - The StealBit Exfiltration Tool. Retrieved January 29, 2025.","url":"https://www.cybereason.com/blog/research/threat-analysis-report-inside-the-lockbit-arsenal-the-stealbit-exfiltration-tool"},{"source_name":"FBI Lockbit 2.0 FEB 2022","description":"FBI. (2022, February 4). Indicators of Compromise Associated with LockBit 2.0 Ransomware. Retrieved January 24, 2025.","url":"https://www.ic3.gov/CSA/2022/220204.pdf"}]},{"id":"S1202","name":"LockBit 3.0","url":"https://attack.mitre.org/software/S1202","kind":"malware","description":"[LockBit 3.0](https://attack.mitre.org/software/S1202) can exclude files associated with core system functions from encryption.(Citation: Joint Cybersecurity Advisory LockBit 3.0 MAR 2023)","relationship_id":"relationship--5c5ac8b1-745e-4727-9735-a7d1ff049fb2","references":[{"source_name":"Joint Cybersecurity Advisory LockBit 3.0 MAR 2023","description":"FBI et al. (2023, March 16). #StopRansomware: LockBit 3.0. Retrieved February 5, 2025.","url":"https://www.cisa.gov/sites/default/files/2023-03/aa23-075a-stop-ransomware-lockbit.pdf"}]},{"id":"S1212","name":"RansomHub","url":"https://attack.mitre.org/software/S1212","kind":"malware","description":"[RansomHub](https://attack.mitre.org/software/S1212) has the ability to only encrypt specific files.(Citation: Group-IB RansomHub FEB 2025)","relationship_id":"relationship--9fcdfab7-1388-4eb1-8cd0-44c42692bb83","references":[{"source_name":"Group-IB RansomHub FEB 2025","description":"Alfano, V. et al. (2025, February 12). RansomHub Never Sleeps Episode 1: The evolution of modern ransomware. Retrieved March 17, 2025.","url":"https://www.group-ib.com/blog/ransomhub-never-sleeps-episode-1/"}]},{"id":"S1229","name":"Havoc","url":"https://attack.mitre.org/software/S1229","kind":"malware","description":"The [Havoc](https://attack.mitre.org/software/S1229) interface can display a file explorer view of the compromised host.(Citation: Havoc Framework Documentation)","relationship_id":"relationship--6b8ccd02-050f-40fa-8d03-36f1cc8f952b","references":[{"source_name":"Havoc Framework Documentation","description":"Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025.","url":"https://havocframework.com/docs/welcome"}]},{"id":"S1234","name":"SplatCloak","url":"https://attack.mitre.org/software/S1234","kind":"malware","description":"[SplatCloak](https://attack.mitre.org/software/S1234) has used Windows API to identify files associated with Windows Defender and Kaspersky.(Citation: Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025)","relationship_id":"relationship--cca42159-8fb2-4278-b6f9-e4a6550a99d7","references":[{"source_name":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","description":"Sudeep Singh. (2025, April 16). Latest Mustang Panda Arsenal: PAKLOG, CorKLOG, and SplatCloak | P2. Retrieved September 12, 2025.","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"}]},{"id":"S1242","name":"Qilin","url":"https://attack.mitre.org/software/S1242","kind":"malware","description":"[Qilin](https://attack.mitre.org/software/S1242) can exclude specific directories and files from encryption.(Citation: Trend Micro Agenda Ransomware AUG 2022)(Citation: Trend Micro Agenda Ransomware OCT 2025)","relationship_id":"relationship--c85dc67b-42f9-4fdd-a91c-7fc24ef4c9fe","references":[{"source_name":"Trend Micro Agenda Ransomware AUG 2022","description":"Magdy, S. et al. (2022, August 25). New Golang Ransomware Agenda Customizes Attacks. Retrieved September 26, 2025.","url":"https://www.trendmicro.com/en_us/research/22/h/new-golang-ransomware-agenda-customizes-attacks.html"},{"source_name":"Trend Micro Agenda Ransomware OCT 2025","description":"Trend Micro. (2025, October 23). Agenda Ransomware Deploys Linux Variant on Windows Systems Through Remote Management Tools and BYOVD Techniques. Retrieved March 26, 2026.","url":"https://www.trendmicro.com/en_us/research/25/j/agenda-ransomware-deploys-linux-variant-on-windows-systems.html"}]},{"id":"S1244","name":"Medusa Ransomware","url":"https://attack.mitre.org/software/S1244","kind":"malware","description":"[Medusa Ransomware](https://attack.mitre.org/software/S1244) has searched for files within the victim environment for encryption and exfiltration.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)(Citation: CISA Medusa Group Medusa Ransomware March 2025)(Citation: Security Scorecard Medusa Ransomware January 2024)  [Medusa Ransomware](https://attack.mitre.org/software/S1244) has also identified files associated with remote management services.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)(Citation: CISA Medusa Group Medusa Ransomware March 2025)","relationship_id":"relationship--a4710756-98de-4242-b908-f9a0d6148a97","references":[{"source_name":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","description":"Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source_name":"CISA Medusa Group Medusa Ransomware March 2025","description":"Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source_name":"Security Scorecard Medusa Ransomware January 2024","description":"Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}]},{"id":"S1245","name":"InvisibleFerret","url":"https://attack.mitre.org/software/S1245","kind":"malware","description":"[InvisibleFerret](https://attack.mitre.org/software/S1245) has identified specific directories and files for exfiltration using the `ssh_upload` command which contains subcommands of `.sdira`, `sdir`, `sfile`, `sfinda`, `sfindr`, `sfind`.(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025)(Citation: Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024) [InvisibleFerret](https://attack.mitre.org/software/S1245) also has the capability to scan and upload files of interest from multiple OS systems through the use of scripts that check file names, file extensions, and avoids certain path names.(Citation: Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024)(Citation: PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023) [InvisibleFerret](https://attack.mitre.org/software/S1245) has utilized the `findstr` on Windows or the macOS `find` commands to search for files of interest.(Citation: PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024) ","relationship_id":"relationship--15cde143-4ede-475f-9b8c-813d6c23083a","references":[{"source_name":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","description":"eSentire Threat Response Unit (TRU). (2024, November 14). Bored BeaverTail & InvisibleFerret Yacht Club – A Lazarus Lure Pt.2. Retrieved October 17, 2025.","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","description":"Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025.","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source_name":"Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024","description":"Seongsu Park. (2024, November 4). From Pyongyang to Your Payroll: The Rise of North Korean Remote Workers in the West. Retrieved October 17, 2025.","url":"https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"},{"source_name":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","description":"Unit 42. (2023, November 21). Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors. Retrieved October 17, 2025.","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"},{"source_name":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","description":"Unit42. (2024, October 9). Contagious Interview: DPRK Threat Actors Lure Tech Industry Job Seekers to Install New Variants of BeaverTail and InvisibleFerret Malware. Retrieved October 17, 2025.","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}]},{"id":"S1246","name":"BeaverTail","url":"https://attack.mitre.org/software/S1246","kind":"malware","description":"[BeaverTail](https://attack.mitre.org/software/S1246) has searched for .ldb and .log files stored in browser extension directories for collection and exfiltration.(Citation: Socket BeaverTail XORIndex HexEval Contagious Interview July 2025)(Citation: Socket HexEval BeaverTail Contagious Interview June 2025)(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025)","relationship_id":"relationship--cb61aee9-03ac-4170-bfcc-3dda0f12f9f0","references":[{"source_name":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","description":"Kirill Boychenko. (2025, July 14). Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader. Retrieved October 19, 2025.","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"},{"source_name":"Socket HexEval BeaverTail Contagious Interview June 2025","description":"Kirill Boychenko. (2025, June 25). Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages. Retrieved October 19, 2025.","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"},{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","description":"Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025.","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"}]},{"id":"S1247","name":"Embargo","url":"https://attack.mitre.org/software/S1247","kind":"malware","description":"[Embargo](https://attack.mitre.org/software/S1247) has searched for folders, subfolders and other networked or mounted drives for follow on encryption actions.(Citation: Cyble Embargo Ransomware May 2024) [Embargo](https://attack.mitre.org/software/S1247) has also iterated device volumes using `FindFirstVolumeW()` and `FindNextVolumeW()` functions and then calls the `GetVolumePathNamesForVolumeNameW()` function to retrieve a list of drive letters and mounted folder paths for each specified volume.(Citation: Cyble Embargo Ransomware May 2024)","relationship_id":"relationship--165b726a-1e4c-49ce-af28-92586883dcdf","references":[{"source_name":"Cyble Embargo Ransomware May 2024","description":"Cyble. (2024, May 24). The Rust Revolution: New Embargo Ransomware Steps In. Retrieved October 19, 2025.","url":"https://cyble.com/blog/the-rust-revolution-new-embargo-ransomware-steps-in/"}]},{"id":"S9002","name":"Diskpart","url":"https://attack.mitre.org/software/S9002","kind":"tool","description":"If executed with elevated privileges, [Diskpart](https://attack.mitre.org/software/S9002) can list all volumes, including virtual disks.(Citation: Halcyon_CloakRansomware_Dec2024)   ","relationship_id":"relationship--f7f5185d-3e7a-4b5c-8a54-44eac8083780","references":[{"source_name":"Halcyon_CloakRansomware_Dec2024","description":"Halcyon RISE Team. (2024, December 12). Cloak Ransomware Variant Exhibits Advanced Persistence, Evasion and VHD Extraction Capabilities. Retrieved December 23, 2025.","url":"https://www.halcyon.ai/blog/cloak-ransomware-variant-exhibits-advanced-persistence-evasion-and-vhd-extraction-capabilities"}]},{"id":"S9009","name":"TruffleHog","url":"https://attack.mitre.org/software/S9009","kind":"tool","description":"[TruffleHog](https://attack.mitre.org/software/S9009) has can browse and scan individual files and directories.(Citation: Black Hills Information Security TruffleHog January 2024)(Citation: Netskope Shai-Hulud November 2025)(Citation: Github TruffleSecurity Trufflehog April 2025)","relationship_id":"relationship--b7b24f8b-e156-407b-aa3d-3d2c18c84c2d","references":[{"source_name":"Black Hills Information Security TruffleHog January 2024","description":"Chris Traynor. (2024, January 18). Rooting For Secrets with TruffleHog. Retrieved April 15, 2026.","url":"https://www.blackhillsinfosec.com/rooting-for-secrets-with-trufflehog/"},{"source_name":"Netskope Shai-Hulud November 2025","description":"Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.","url":"https://www.netskope.com/blog/shai-hulud-2-0-aggressive-automated-one-of-fastest-spreading-npm-supply-chain-attacks-ever-observed"},{"source_name":"Github TruffleSecurity Trufflehog April 2025","description":"Trufflesecurity. (2026, April 8). TruffleHog Enterprise. Retrieved April 15, 2026.","url":"https://github.com/trufflesecurity/trufflehog"}]},{"id":"S9015","name":"BRICKSTORM","url":"https://attack.mitre.org/software/S9015","kind":"malware","description":"[BRICKSTORM](https://attack.mitre.org/software/S9015) has identified specific files and directories within targeted hosts and systems for modification, execution, collection and exfiltration.(Citation: CrowdStrike BRICKSTORM WARP PANDA UNC5221 December 2025)(Citation: CISA BRICKSTORM UNC5221 AR25-338A February 2026)(Citation: Picus Security BRICKSTORM UNC5221 October 2025)(Citation: Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024)(Citation: NVISO BRICKSTORM April 2025)(Citation: Google BRICKSTORM September 2025)","relationship_id":"relationship--da68918d-d389-4e05-a5fa-980888e57157","references":[{"source_name":"CrowdStrike BRICKSTORM WARP PANDA UNC5221 December 2025","description":"CrowdStrike. (2025, December 4). Unveiling WARP PANDA: A New Sophisticated China-Nexus Adversary. Retrieved April 16, 2026.","url":"https://www.crowdstrike.com/en-us/blog/warp-panda-cloud-threats/"},{"source_name":"CISA BRICKSTORM UNC5221 AR25-338A February 2026","description":"DHS/CISA. (2026, February 11). AR25-338A: BRICKSTORM Backdoor. Retrieved April 16, 2026.","url":"https://www.cisa.gov/news-events/analysis-reports/ar25-338a"},{"source_name":"Picus Security BRICKSTORM UNC5221 October 2025","description":"Huseyin Can Yuceel. (2025, October 1). BRICKSTORM Malware: UNC5221 Targets Tech and Legal Sectors in the United States. Retrieved April 16, 2026.","url":"https://www.picussecurity.com/resource/blog/brickstorm-malware-unc5221-targets-tech-and-legal-sectors-in-the-united-states"},{"source_name":"Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024","description":"Matt Lin, Austin Larsen, John Wolfram, Ashley Pearson, Josh Murchie, Lukasz Lamparski, Joseph Pisano, Ryan Hall, Ron Craft, Shawn Crew, Billy Wong, Tyler McLellan. (2024, April 4). Cutting Edge, Part 4: Ivanti Connect Secure VPN Post-Exploitation Lateral Movement Case Studies. Retrieved April 16, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-post-exploitation-lateral-movement"},{"source_name":"NVISO BRICKSTORM April 2025","description":"NVISO Incident Response. (2025, April 1). BRICKSTORM  Backdoor Analysis: A Persistent Espionage Threat  to European Industries. Retrieved April 16, 2026.","url":"https://blog.nviso.eu/wp-content/uploads/2025/04/NVISO-BRICKSTORM-Report.pdf"},{"source_name":"Google BRICKSTORM September 2025","description":"Sarah Yoder, John Wolfram, Ashley Pearson, Doug Bienstock, Josh Madeley, Josh Murchie, Brad Slaybaugh, Matt Lin, Geoff Carstairs, Austin Larsen. (2025, September 24). Another BRICKSTORM: Stealthy Backdoor Enabling Espionage into Tech and Legal Sectors. Retrieved April 16, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/brickstorm-espionage-campaign"}]},{"id":"S9020","name":"LODEINFO","url":"https://attack.mitre.org/software/S9020","kind":"malware","description":"\n[LODEINFO](https://attack.mitre.org/software/S9020) has the ability to designate specific files and folders to encryption.(Citation: ESET MirrorFace DEC 2022)(Citation: ITOCHU LODEINFO JAN 2024)","relationship_id":"relationship--ca5fef73-8710-4c03-a9ea-2012d6287cae","references":[{"source_name":"ESET MirrorFace DEC 2022","description":"Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"},{"source_name":"ITOCHU LODEINFO JAN 2024","description":"ITOCHU. (2024, January 24). The Endless Struggle Against APT10: Insights from LODEINFO v0.6.6 - v0.7.3 Analysis. Retrieved April 17, 2026.","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"}]},{"id":"S9027","name":"ANELLDR","url":"https://attack.mitre.org/software/S9027","kind":"malware","description":"[ANELLDR](https://attack.mitre.org/software/S9027) can enumerate files in the current directory to search for encrypted payload files.(Citation: Trend Micro Earth Kasha Anel NOV 2024)","relationship_id":"relationship--37440d78-4ced-42c2-9a9c-fd71f10e6cd6","references":[{"source_name":"Trend Micro Earth Kasha Anel NOV 2024","description":"Hiroaki, H. (2024, November 26). Guess Who’s Back - The Return of ANEL in the Recent Earth Kasha Spear-phishing Campaign in 2024. Retrieved April 17, 2026.","url":"https://www.trendmicro.com/en_us/research/24/k/return-of-anel-in-the-recent-earth-kasha-spearphishing-campaign.html"}]},{"id":"S9030","name":"SameCoin","url":"https://attack.mitre.org/software/S9030","kind":"malware","description":"[SameCoin](https://attack.mitre.org/software/S9030) can list all system files and can avoid wiping specific directories such as Program Files, Windows, and Users.(Citation: Check Point Wirte NOV 2024)","relationship_id":"relationship--a7c4675f-bc26-4dcf-977c-2966f195260f","references":[{"source_name":"Check Point Wirte NOV 2024","description":"Check Point. (2024, November 12). Hamas-affiliated Threat Actor WIRTE Continues its Middle East Operations and Moves to Disruptive Activity. Retrieved April 20, 2026.","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"}]},{"id":"S9031","name":"AshTag","url":"https://attack.mitre.org/software/S9031","kind":"malware","description":"The [AshTag](https://attack.mitre.org/software/S9031) AshenOrchestrator component can enumerate files on victim hosts.(Citation: Palo Alto Ashen Lepus DEC 2025)","relationship_id":"relationship--08a444cf-9159-4f35-aa4a-691a434940e5","references":[{"source_name":"Palo Alto Ashen Lepus DEC 2025","description":"Unit 42. (2025, December 11). Hamas-Affiliated Ashen Lepus Targets Middle Eastern Diplomatic Entities With New AshTag Malware Suite. Retrieved April 20, 2026.","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}]},{"id":"S9035","name":"LAMEHUG","url":"https://attack.mitre.org/software/S9035","kind":"malware","description":"[LAMEHUG](https://attack.mitre.org/software/S9035) can target directories on victim machines for file collection.(Citation: Splunk LAMEHUG SEP 2025)(Citation: Nov AI Threat Tracker)","relationship_id":"relationship--e67b8df0-ca16-467a-9d42-57ac9dee685a","references":[{"source_name":"Splunk LAMEHUG SEP 2025","description":"Conteras, T., Splunk Research Team. (2025, September 25). From Prompt to Payload: LAMEHUG’s LLM-Driven Cyber Intrusion. Retrieved April 21, 2026.","url":"https://www.splunk.com/en_us/blog/security/lamehug-ai-driven-malware-llm-cyber-intrusion-analysis.html"},{"source_name":"Nov AI Threat Tracker","description":"Google Threat Intelligence Group. (2025, November 5). GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools. Retrieved March 31, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools"}]},{"id":"S9038","name":"DynoWiper","url":"https://attack.mitre.org/software/S9038","kind":"malware","description":"[DynoWiper](https://attack.mitre.org/software/S9038) has used the Microsoft Windows native `FindFirstFile()` and `FindNextFile()` to recursively enumerate directories and files on the system.(Citation: CERT Polska)","relationship_id":"relationship--5f013e67-6f7b-4ea5-86d4-91940f3b74cb","references":[{"source_name":"CERT Polska","description":"CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.","url":"https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"}]},{"id":"S9039","name":"LazyWiper","url":"https://attack.mitre.org/software/S9039","kind":"malware","description":"[LazyWiper](https://attack.mitre.org/software/S9039) can specifically target multiple files by extension including: .rar, .tar.gz, .zip, .7z, .json, .bcp, .bak, .gho, .erf, .edb, .onepkg, .pst, and .ldiff.(Citation: CERT Polska)","relationship_id":"relationship--1ca295b2-6865-4daf-a41f-e9333f0561bc","references":[{"source_name":"CERT Polska","description":"CERT Polska. (2026, January 30). Energy Sector Incident  Report – 29 December. Retrieved April 22, 2026.","url":"https://cert.pl/uploads/docs/CERT_Polska_Energy_Sector_Incident_Report_2025.pdf"}]},{"id":"S9041","name":"TeamPCP Cloud Stealer","url":"https://attack.mitre.org/software/S9041","kind":"malware","description":"[TeamPCP Cloud Stealer](https://attack.mitre.org/software/S9041) can identify files containing environment variables, SSH keys, cloud credentials, access tokens, and cryptocurrency wallets.(Citation: Wiz Trivy Compromise MAR 2026)(Citation: Aqua Security Trivy Compromise MAR 2026)(Citation: Aqua Security Blog Trivy Compromise APR 2026)(Citation: Wiz TeamPCP KICS MAR 2026)","relationship_id":"relationship--7a79128c-d9e3-4345-941f-05e434d99911","references":[{"source_name":"Aqua Security Trivy Compromise MAR 2026","description":"Aqua Security . (2026, March 21). Trivy ecosystem supply chain temporarily compromised. Retrieved July 1, 2026.","url":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23"},{"source_name":"Aqua Security Blog Trivy Compromise APR 2026","description":"Aqua Team. (2026, April 1). Update: Ongoing Investigation and Continued Remediation. Retrieved July 1, 2026.","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"},{"source_name":"Wiz Trivy Compromise MAR 2026","description":"McCarthy, R. (2026, March 20). Trivy Compromised: Everything You Need to Know about the Latest Supply Chain Attack. Retrieved July 1, 2026.","url":"https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"},{"source_name":"Wiz TeamPCP KICS MAR 2026","description":"McCarthy, R., Haughom, J., Read, B. (2026, March 23). KICS GitHub Action Compromised: TeamPCP Strikes Again in Supply Chain Attack. Retrieved July 1, 2026.","url":"https://www.wiz.io/blog/teampcp-attack-kics-github-action"}]},{"id":"S9042","name":"CanisterWorm","url":"https://attack.mitre.org/software/S9042","kind":"malware","description":"[CanisterWorm](https://attack.mitre.org/software/S9042) has discovered npm pathways and directories that frequently store .npmrc files to check for _authToken values.(Citation: Aikido TeamPCP Trivy MAR 2026)","relationship_id":"relationship--b2b29042-e638-446f-94c6-c7de3711884f","references":[{"source_name":"Aikido TeamPCP Trivy MAR 2026","description":"Eriksen, C. (2026, March 20). TeamPCP deploys CanisterWorm on NPM following Trivy compromise. Retrieved July 27, 2026.","url":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise"}]},{"id":"S9043","name":"Mini Shai-Hulud","url":"https://attack.mitre.org/software/S9043","kind":"malware","description":"[Mini Shai-Hulud](https://attack.mitre.org/software/S9043) has enumerated home directories, file paths and files associated with storing or containing credentials and other secrets.(Citation: Hunt.io TeamPCP Toolkit MAY 2026)","relationship_id":"relationship--0449fd1f-35ee-4c99-ac63-716da2a2276d","references":[{"source_name":"Hunt.io TeamPCP Toolkit MAY 2026","description":"Hunt.io. (2026, May 14). How TeamPCP's Python Toolkit Survives a C2 Takedown: FIRESCALE, GitHub, and the Victim's Own Account. Retrieved July 16, 2026.","url":"https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown"}]},{"id":"S9050","name":"Vidar","url":"https://attack.mitre.org/software/S9050","kind":"malware","description":"[Vidar](https://attack.mitre.org/software/S9050) has gathered information about files on the victim machine.(Citation: Unit42_Vidar_July2026) Specifically, [Vidar](https://attack.mitre.org/software/S9050) has used `FindFirstFileExW` and `FindNextFileW`.(Citation: Cyfirma_Vidar_June2024)(Citation: Logpoint_StealerMalwareFamilies_2024) [Vidar](https://attack.mitre.org/software/S9050) has attempted to read hidden system directories, such as `$Recycle.Bin`, `$Windows.~BT`, and `$SysReset`, and the `C:\\Windows\\System32\\config\\SOFTWARE` directory using the `ReadFile` function. [Vidar](https://attack.mitre.org/software/S9050) has also accessed internal streams, such as `$SDH`, and has read Jump Lists, which include recently opened files, programs and tasks.(Citation: Cyfirma_Vidar_June2024)","relationship_id":"relationship--90f5c230-407d-45ba-85db-44cd3ecea06d","references":[{"source_name":"Cyfirma_Vidar_June2024","description":"CYFIRMA. (2024, June 3). Vidar Stealer: An In-depth Analysis of an Information-Stealing Malware. Retrieved August 13, 2026.","url":"https://www.cyfirma.com/research/vidar-stealer-an-in-depth-analysis-of-an-information-stealing-malware/"},{"source_name":"Logpoint_StealerMalwareFamilies_2024","description":"Khadgi, N. (n.d.). A Comprehensive Overview on Stealer Malware Families. Retrieved August 25, 2026.","url":"https://web.archive.org/web/20240517205011/https://www.logpoint.com/wp-content/uploads/2024/03/logpoint-etpr-a-comprehensive-overview-on-stealer-malware-families-1.pdf"},{"source_name":"Unit42_Vidar_July2026","description":"Nannaka, B., Chhaparwal, P. (2026, July 7). Vidar Stealer Unmasked: Code Signing Abuse, Go Loaders and File Inflation. Retrieved July 8, 2026.","url":"https://unit42.paloaltonetworks.com/vidar-stealer-xmrig-miner-campaign-analysis/"}]},{"id":"S9051","name":"The Gentlemen Ransomware","url":"https://attack.mitre.org/software/S9051","kind":"malware","description":"[The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) has enumerated files and directories using WMI and PowerShell commands.(Citation: MSTI_GentelmenRansomware_May2026) ","relationship_id":"relationship--ff83e828-168e-4702-8682-63f8e9633a48","references":[{"source_name":"MSTI_GentelmenRansomware_May2026","description":"Microsoft Threat Intelligence. (2026, May 28). The Gentlemen ransomware: Dissecting a self-propagating Go encryptor . Retrieved September 18, 2026.","url":"https://www.microsoft.com/en-us/security/blog/2026/05/28/the-gentlemen-ransomware-dissecting-a-self-propagating-go-encryptor/"}]},{"id":"S9052","name":"MiniFast","url":"https://attack.mitre.org/software/S9052","kind":"malware","description":"[MiniFast](https://attack.mitre.org/software/S9052) has listed files and folders within a specified directory.(Citation: CheckPoint_NimbusManticore_May2026) ","relationship_id":"relationship--c388ff7b-98ec-4f91-97a3-b4fb1772e661","references":[{"source_name":"CheckPoint_NimbusManticore_May2026","description":"Check Point. (2026, May 22). Fast and Furious – Nimbus Manticore Operations During the Iranian Conflict. Retrieved September 23, 2026.","url":"https://research.checkpoint.com/2026/fast-and-furious-nimbus-manticore-operations-during-the-iranian-conflict/"}]},{"id":"S9053","name":"MiniJunk","url":"https://attack.mitre.org/software/S9053","kind":"malware","description":"[MiniJunk](https://attack.mitre.org/software/S9053) has listed all hard drives or has listed files within a specified directory.(Citation: CheckPoint_NimbusManticoreEurope_Sept2025)","relationship_id":"relationship--2f142216-22ad-4c34-b787-8bfeb2fcd57b","references":[{"source_name":"CheckPoint_NimbusManticoreEurope_Sept2025","description":"Check Point. (2025, September 22). Nimbus Manticore Deploys New Malware Targeting Europe. Retrieved September 24, 2026.","url":"https://research.checkpoint.com/2025/nimbus-manticore-deploys-new-malware-targeting-europe/"}]},{"id":"S9059","name":"MiniBike","url":"https://attack.mitre.org/software/S9059","kind":"malware","description":"[MiniBike](https://attack.mitre.org/software/S9059) has enumerated directories and files on victim machines.(Citation: Mandiant_UNC1549_Feb2024) ","relationship_id":"relationship--d466eac7-775f-4f63-98cc-31d719ea109d","references":[{"source_name":"Mandiant_UNC1549_Feb2024","description":"Rozmann, O., et al. (2024, February 27). When Cats Fly: Suspected Iranian Threat Actor UNC1549 Targets Israeli and Middle East Aerospace and Defense Sectors. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/suspected-iranian-unc1549-targets-israel-middle-east"}]},{"id":"S9063","name":"DEEPROOT","url":"https://attack.mitre.org/software/S9063","kind":"malware","description":"[DEEPROOT](https://attack.mitre.org/software/S9063) can gather file and directory details.(Citation: Mandiant_UNC1549_Nov2025)\n\n","relationship_id":"relationship--1f5fcc10-0902-4395-8dff-0353f7ae6189","references":[{"source_name":"Mandiant_UNC1549_Nov2025","description":"El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}]},{"id":"S9067","name":"TWOSTROKE","url":"https://attack.mitre.org/software/S9067","kind":"malware","description":"[TWOSTROKE](https://attack.mitre.org/software/S9067) has the ability list the directory.(Citation: Mandiant_UNC1549_Nov2025)","relationship_id":"relationship--bcc26139-8236-4703-9b71-a261e7642dc6","references":[{"source_name":"Mandiant_UNC1549_Nov2025","description":"El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}]}],"actors":[{"id":"G0004","name":"Ke3chang","url":"https://attack.mitre.org/groups/G0004","kind":"intrusion-set","description":"[Ke3chang](https://attack.mitre.org/groups/G0004) uses command-line interaction to search files and directories.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: Microsoft NICKEL December 2021)","relationship_id":"relationship--5c8fba10-9d8a-4257-a458-8f58efc8d912","references":[{"source_name":"Mandiant Operation Ke3chang November 2014","description":"Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"},{"source_name":"Microsoft NICKEL December 2021","description":"MSTIC. (2021, December 6). NICKEL targeting government organizations across Latin America and Europe. Retrieved March 18, 2022.","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"id":"G0007","name":"APT28","url":"https://attack.mitre.org/groups/G0007","kind":"intrusion-set","description":"[APT28](https://attack.mitre.org/groups/G0007) has used [Forfiles](https://attack.mitre.org/software/S0193) to locate PDF, Excel, and Word documents during collection. The group also searched a compromised DCCC computer for specific terms.(Citation: Überwachung APT28 Forfiles June 2015)(Citation: DOJ GRU Indictment Jul 2018)","relationship_id":"relationship--3094a14f-ccd2-4ba4-a3f6-c6d2721f02db","references":[{"source_name":"Überwachung APT28 Forfiles June 2015","description":"Guarnieri, C. (2015, June 19). Digital Attack on German Parliament: Investigative Report on the Hack of the Left Party Infrastructure in Bundestag. Retrieved January 22, 2018.","url":"https://netzpolitik.org/2015/digital-attack-on-german-parliament-investigative-report-on-the-hack-of-the-left-party-infrastructure-in-bundestag/"},{"source_name":"DOJ GRU Indictment Jul 2018","description":"Mueller, R. (2018, July 13). Indictment - United States of America vs. VIKTOR BORISOVICH NETYKSHO, et al. Retrieved November 17, 2024.","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"}]},{"id":"G0010","name":"Turla","url":"https://attack.mitre.org/groups/G0010","kind":"intrusion-set","description":"[Turla](https://attack.mitre.org/groups/G0010) surveys a system upon check-in to discover files in specific locations on the hard disk %TEMP% directory, the current user's desktop, the Program Files directory, and Recent.(Citation: Kaspersky Turla)(Citation: ESET ComRAT May 2020) [Turla](https://attack.mitre.org/groups/G0010) RPC backdoors have also searched for files matching the <code>lPH*.dll</code> pattern.(Citation: ESET Turla PowerShell May 2019)","relationship_id":"relationship--fa6292a2-c184-4bc9-a37f-0c1ac61e1135","references":[{"source_name":"Kaspersky Turla","description":"Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.","url":"https://securelist.com/the-epic-turla-operation/65545/"},{"source_name":"ESET ComRAT May 2020","description":"Faou, M. (2020, May). From Agent.btz to ComRAT v4: A ten-year journey. Retrieved June 15, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"},{"source_name":"ESET Turla PowerShell May 2019","description":"Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}]},{"id":"G0012","name":"Darkhotel","url":"https://attack.mitre.org/groups/G0012","kind":"intrusion-set","description":"[Darkhotel](https://attack.mitre.org/groups/G0012) has used malware that searched for files with specific patterns.(Citation: Microsoft DUBNIUM July 2016)","relationship_id":"relationship--bfc84868-c168-4db4-be39-641cfab0619a","references":[{"source_name":"Microsoft DUBNIUM July 2016","description":"Microsoft. (2016, July 14). Reverse engineering DUBNIUM – Stage 2 payload analysis . Retrieved March 31, 2021.","url":"https://www.microsoft.com/security/blog/2016/07/14/reverse-engineering-dubnium-stage-2-payload-analysis/"}]},{"id":"G0018","name":"admin@338","url":"https://attack.mitre.org/groups/G0018","kind":"intrusion-set","description":"[admin@338](https://attack.mitre.org/groups/G0018) actors used the following commands after exploiting a machine with [LOWBALL](https://attack.mitre.org/software/S0042) malware to obtain information about files and directories: <code>dir c:\\ >> %temp%\\download</code> <code>dir \"c:\\Documents and Settings\" >> %temp%\\download</code> <code>dir \"c:\\Program Files\\\" >> %temp%\\download</code> <code>dir d:\\ >> %temp%\\download</code>(Citation: FireEye admin@338)","relationship_id":"relationship--5c816fc0-c4e3-47ef-8193-ef88eabdfc7e","references":[{"source_name":"FireEye admin@338","description":"FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved December 4, 2015.","url":"https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html"}]},{"id":"G0022","name":"APT3","url":"https://attack.mitre.org/groups/G0022","kind":"intrusion-set","description":"[APT3](https://attack.mitre.org/groups/G0022) has a tool that looks for files and directories on the local file system.(Citation: FireEye Clandestine Fox)(Citation: evolution of pirpi)","relationship_id":"relationship--a8b248fe-a27c-40fd-83d5-f4382035d656","references":[{"source_name":"FireEye Clandestine Fox","description":"Chen, X., Scott, M., Caselden, D.. (2014, April 26). New Zero-Day Exploit targeting Internet Explorer Versions 9 through 11 Identified in Targeted Attacks. Retrieved January 14, 2016.","url":"https://www.fireeye.com/blog/threat-research/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html"},{"source_name":"evolution of pirpi","description":"Yates, M. (2017, June 18). APT3 Uncovered: The code evolution of Pirpi. Retrieved September 28, 2017.","url":"https://recon.cx/2017/montreal/resources/slides/RECON-MTL-2017-evolution_of_pirpi.pdf"}]},{"id":"G0026","name":"APT18","url":"https://attack.mitre.org/groups/G0026","kind":"intrusion-set","description":"[APT18](https://attack.mitre.org/groups/G0026) can list files information for specific directories.(Citation: PaloAlto DNS Requests May 2016)","relationship_id":"relationship--e3417dc3-f784-4306-8466-65a0067b63f1","references":[{"source_name":"PaloAlto DNS Requests May 2016","description":"Grunzweig, J., et al. (2016, May 24). New Wekby Attacks Use DNS Requests As Command and Control Mechanism. Retrieved November 15, 2018.","url":"https://researchcenter.paloaltonetworks.com/2016/05/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/"}]},{"id":"G0030","name":"Lotus Blossom","url":"https://attack.mitre.org/groups/G0030","kind":"intrusion-set","description":"[Lotus Blossom](https://attack.mitre.org/groups/G0030) has used commands such as `dir` to examine the local filesystem of victim machines.(Citation: Cisco LotusBlossom 2025)","relationship_id":"relationship--941c2dbc-ca93-4206-b023-fabc7476ac16","references":[{"source_name":"Cisco LotusBlossom 2025","description":"Joey Chen, Cisco Talos. (2025, February 27). Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools. Retrieved March 15, 2025.","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}]},{"id":"G0032","name":"Lazarus Group","url":"https://attack.mitre.org/groups/G0032","kind":"intrusion-set","description":"[Lazarus Group](https://attack.mitre.org/groups/G0032) malware can use a common function to identify target files by their extension, and some also enumerate files and directories, including a Destover-like variant that lists files and gathers information for all drives.(Citation: Novetta Blockbuster)(Citation: McAfee GhostSecret)(Citation: Lazarus APT January 2022)(Citation: Qualys LolZarus)","relationship_id":"relationship--bd745d11-93d8-45db-8a68-08a52383375a","references":[{"source_name":"Novetta Blockbuster","description":"Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source_name":"Qualys LolZarus","description":"Pradhan, A. (2022, February 8). LolZarus: Lazarus Group Incorporating Lolbins into Campaigns. Retrieved March 22, 2022.","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"},{"source_name":"Lazarus APT January 2022","description":"Saini, A. and Hossein, J. (2022, January 27). North Korea’s Lazarus APT leverages Windows Update client, GitHub in latest campaign. Retrieved January 27, 2022.","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source_name":"McAfee GhostSecret","description":"Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}]},{"id":"G0034","name":"Sandworm Team","url":"https://attack.mitre.org/groups/G0034","kind":"intrusion-set","description":"[Sandworm Team](https://attack.mitre.org/groups/G0034) has enumerated files on a compromised host.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: Dragos Crashoverride 2018)","relationship_id":"relationship--62f2c1a6-3019-44a0-a750-794677ddabd0","references":[{"source_name":"Dragos Crashoverride 2018","description":"Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.","url":"https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"},{"source_name":"US District Court Indictment GRU Unit 74455 October 2020","description":"Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020.","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"id":"G0035","name":"Dragonfly","url":"https://attack.mitre.org/groups/G0035","kind":"intrusion-set","description":"[Dragonfly](https://attack.mitre.org/groups/G0035) has used a batch script to gather folder and file names from victim hosts.(Citation: US-CERT TA18-074A)(Citation: Gigamon Berserk Bear October 2021)(Citation: CISA AA20-296A Berserk Bear December 2020)","relationship_id":"relationship--21382ce2-a504-4adf-81d2-dc1306285553","references":[{"source_name":"CISA AA20-296A Berserk Bear December 2020","description":"CISA. (2020, December 1). Russian State-Sponsored Advanced Persistent Threat Actor Compromises U.S. Government Targets. Retrieved December 9, 2021.","url":"https://www.cisa.gov/uscert/ncas/alerts/aa20-296a#revisions"},{"source_name":"Gigamon Berserk Bear October 2021","description":"Slowik, J. (2021, October). THE BAFFLING BERSERK BEAR: A DECADE’S ACTIVITY TARGETING CRITICAL INFRASTRUCTURE. Retrieved December 6, 2021.","url":"https://vblocalhost.com/uploads/VB2021-Slowik.pdf"},{"source_name":"US-CERT TA18-074A","description":"US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"id":"G0040","name":"Patchwork","url":"https://attack.mitre.org/groups/G0040","kind":"intrusion-set","description":"A [Patchwork](https://attack.mitre.org/groups/G0040) payload has searched all fixed drives on the victim for files matching a specified list of extensions.(Citation: Cymmetria Patchwork)(Citation: TrendMicro Patchwork Dec 2017)","relationship_id":"relationship--0e89ca75-b73e-476e-b56d-1cf815fa7868","references":[{"source_name":"Cymmetria Patchwork","description":"Cymmetria. (2016). Unveiling Patchwork - The Copy-Paste APT. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"},{"source_name":"TrendMicro Patchwork Dec 2017","description":"Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"id":"G0044","name":"Winnti Group","url":"https://attack.mitre.org/groups/G0044","kind":"intrusion-set","description":"[Winnti Group](https://attack.mitre.org/groups/G0044) has used a program named ff.exe to search for specific documents on compromised hosts.(Citation: Kaspersky Winnti April 2013)","relationship_id":"relationship--db0b0cf9-cb49-43ed-aa61-d4215d1775b8","references":[{"source_name":"Kaspersky Winnti April 2013","description":"Kaspersky Lab's Global Research and Analysis Team. (2013, April 11). Winnti. More than just a game. Retrieved February 8, 2017.","url":"https://securelist.com/winnti-more-than-just-a-game/37029/"}]},{"id":"G0045","name":"menuPass","url":"https://attack.mitre.org/groups/G0045","kind":"intrusion-set","description":"[menuPass](https://attack.mitre.org/groups/G0045) has searched compromised systems for folders of interest including those related to HR, audit and expense, and meeting memos.(Citation: Symantec Cicada November 2020)","relationship_id":"relationship--ca295c89-bee0-4702-b0e1-61416023bacb","references":[{"source_name":"Symantec Cicada November 2020","description":"Symantec. (2020, November 17). Japan-Linked Organizations Targeted in Long-Running and Sophisticated Attack Campaign. Retrieved December 17, 2020.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"}]},{"id":"G0047","name":"Gamaredon Group","url":"https://attack.mitre.org/groups/G0047","kind":"intrusion-set","description":"[Gamaredon Group](https://attack.mitre.org/groups/G0047) macros can scan for Microsoft Word and Excel files to inject with additional malicious macros. [Gamaredon Group](https://attack.mitre.org/groups/G0047) has also used its backdoors to automatically list interesting files (such as Office documents) found on a system.(Citation: ESET Gamaredon June 2020)(Citation: Unit 42 Gamaredon February 2022)(Citation: ESET Gamaredon Sept2024) Gamaredon Group has also identified directory trees, folders and files on the compromised host.(Citation: SymantecCarbonBlack_ShuckwormUSB_Apr2025) ","relationship_id":"relationship--16b915ff-7bf5-4032-b39a-9c8073847d77","references":[{"source_name":"ESET Gamaredon June 2020","description":"Boutin, J. (2020, June 11). Gamaredon group grows its game. Retrieved June 16, 2020.","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source_name":"ESET Gamaredon Sept2024","description":"Rusnák, Z. (2024, September 26). Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023. Retrieved October 30, 2024.","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source_name":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","description":"Threat Hunter Team, Symantec and Carbon Black. (2025, April 10). Shuckworm Targets Foreign Military Mission Based in Ukraine. Retrieved July 23, 2025.","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"},{"source_name":"Unit 42 Gamaredon February 2022","description":"Unit 42. (2022, February 3). Russia’s Gamaredon aka Primitive Bear APT Group Actively Targeting Ukraine. Retrieved February 21, 2022.","url":"https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"}]},{"id":"G0050","name":"APT32","url":"https://attack.mitre.org/groups/G0050","kind":"intrusion-set","description":"[APT32](https://attack.mitre.org/groups/G0050)'s backdoor possesses the capability to list files and directories on a machine. (Citation: ESET OceanLotus Mar 2019)\t\n","relationship_id":"relationship--a933bad9-0f92-4a25-9b46-19120737caee","references":[{"source_name":"ESET OceanLotus Mar 2019","description":"Dumont, R. (2019, March 20). Fake or Fake: Keeping up with OceanLotus decoys. Retrieved April 1, 2019.","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"}]},{"id":"G0054","name":"Sowbug","url":"https://attack.mitre.org/groups/G0054","kind":"intrusion-set","description":"[Sowbug](https://attack.mitre.org/groups/G0054) identified and extracted all Word documents on a server by using a command containing * .doc and *.docx. The actors also searched for documents based on a specific date range and attempted to identify all installed software on a victim.(Citation: Symantec Sowbug Nov 2017)","relationship_id":"relationship--0efa0a7a-545d-49e2-b0c4-0e251226404a","references":[{"source_name":"Symantec Sowbug Nov 2017","description":"Symantec Security Response. (2017, November 7). Sowbug: Cyber espionage group targets South American and Southeast Asian governments. Retrieved November 16, 2017.","url":"https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments"}]},{"id":"G0059","name":"Magic Hound","url":"https://attack.mitre.org/groups/G0059","kind":"intrusion-set","description":"[Magic Hound](https://attack.mitre.org/groups/G0059) malware can list a victim's logical drives and the type, as well the total/free space of the fixed devices. Other malware can list a directory's contents.(Citation: Unit 42 Magic Hound Feb 2017)","relationship_id":"relationship--87b8b451-bf9b-4e93-b591-05ef502970f5","references":[{"source_name":"Unit 42 Magic Hound Feb 2017","description":"Lee, B. and Falcone, R. (2017, February 15). Magic Hound Campaign Attacks Saudi Targets. Retrieved December 27, 2017.","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"}]},{"id":"G0060","name":"BRONZE BUTLER","url":"https://attack.mitre.org/groups/G0060","kind":"intrusion-set","description":"[BRONZE BUTLER](https://attack.mitre.org/groups/G0060) has collected a list of files from the victim and uploaded it to its C2 server, and then created a new list of specific files to steal.(Citation: Secureworks BRONZE BUTLER Oct 2017)","relationship_id":"relationship--fc4dd2b6-63a0-46fe-bfc4-90e58e5d1422","references":[{"source_name":"Secureworks BRONZE BUTLER Oct 2017","description":"Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018.","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"id":"G0069","name":"MuddyWater","url":"https://attack.mitre.org/groups/G0069","kind":"intrusion-set","description":"[MuddyWater](https://attack.mitre.org/groups/G0069) has used malware that checked if the ProgramData folder had folders or files with the keywords \"Kasper,\" \"Panda,\" or \"ESET.\"(Citation: Securelist MuddyWater Oct 2018)","relationship_id":"relationship--7aab9015-1839-4672-9a9a-76f478c858a8","references":[{"source_name":"Securelist MuddyWater Oct 2018","description":"Kaspersky Lab's Global Research & Analysis Team. (2018, October 10). MuddyWater expands operations. Retrieved November 2, 2018.","url":"https://securelist.com/muddywater/88059/"}]},{"id":"G0070","name":"Dark Caracal","url":"https://attack.mitre.org/groups/G0070","kind":"intrusion-set","description":"[Dark Caracal](https://attack.mitre.org/groups/G0070) collected file listings of all default Windows directories.(Citation: Lookout Dark Caracal Jan 2018)","relationship_id":"relationship--79826a7e-d9dd-4c4f-bc1f-e5f2d4c6465b","references":[{"source_name":"Lookout Dark Caracal Jan 2018","description":"Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}]},{"id":"G0077","name":"Leafminer","url":"https://attack.mitre.org/groups/G0077","kind":"intrusion-set","description":"[Leafminer](https://attack.mitre.org/groups/G0077) used a tool called MailSniper to search for files on the desktop and another utility called Sobolsoft to extract attachments from EML files.(Citation: Symantec Leafminer July 2018)","relationship_id":"relationship--f8a21871-d67b-4e89-82db-580d117d28fb","references":[{"source_name":"Symantec Leafminer July 2018","description":"Symantec Security Response. (2018, July 25). Leafminer: New Espionage Campaigns Targeting Middle Eastern Regions. Retrieved August 28, 2018.","url":"https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east"}]},{"id":"G0081","name":"Tropic Trooper","url":"https://attack.mitre.org/groups/G0081","kind":"intrusion-set","description":"[Tropic Trooper](https://attack.mitre.org/groups/G0081) has monitored files' modified time.(Citation: TrendMicro Tropic Trooper May 2020)\t","relationship_id":"relationship--78731c00-1f22-4dab-a3cd-d19fac57e82f","references":[{"source_name":"TrendMicro Tropic Trooper May 2020","description":"Chen, J.. (2020, May 12). Tropic Trooper’s Back: USBferry Attack Targets Air gapped Environments. Retrieved May 20, 2020.","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"id":"G0082","name":"APT38","url":"https://attack.mitre.org/groups/G0082","kind":"intrusion-set","description":"[APT38](https://attack.mitre.org/groups/G0082) has enumerated files and directories, or searched in specific locations within a compromised host.(Citation: CISA AA20-239A BeagleBoyz August 2020)(Citation: Microsoft Axios Compromise APR 2026)(Citation: Microsoft Sapphire Sleet APR 2026)","relationship_id":"relationship--2f19f736-a547-47c3-ae26-40a0d13cdf41","references":[{"source_name":"CISA AA20-239A BeagleBoyz August 2020","description":"DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"},{"source_name":"Microsoft Axios Compromise APR 2026","description":"Microsoft Threat Intelligence. (2026, April 1). Mitigating the Axios npm supply chain compromise. Retrieved September 30, 2026.","url":"https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/"},{"source_name":"Microsoft Sapphire Sleet APR 2026","description":"Microsoft Threat Intelligence. (2026, April 16). Dissecting Sapphire Sleet’s macOS intrusion from lure to compromise. Retrieved September 30, 2026.","url":"https://www.microsoft.com/en-us/security/blog/2026/04/16/dissecting-sapphire-sleets-macos-intrusion-from-lure-to-compromise/"}]},{"id":"G0087","name":"APT39","url":"https://attack.mitre.org/groups/G0087","kind":"intrusion-set","description":"[APT39](https://attack.mitre.org/groups/G0087) has used tools with the ability to search for files on a compromised host.(Citation: FBI FLASH APT39 September 2020)","relationship_id":"relationship--ba65edc3-e0ef-477f-92c8-ffa2e2a943c5","references":[{"source_name":"FBI FLASH APT39 September 2020","description":"FBI. (2020, September 17). Indicators of Compromise Associated with Rana Intelligence Computing, also known as Advanced Persistent Threat 39, Chafer, Cadelspy, Remexi, and ITG07. Retrieved December 10, 2020.","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}]},{"id":"G0094","name":"Kimsuky","url":"https://attack.mitre.org/groups/G0094","kind":"intrusion-set","description":"[Kimsuky](https://attack.mitre.org/groups/G0094) has the ability to enumerate all files and directories on an infected system.(Citation: Securelist Kimsuky Sept 2013)(Citation: Talos Kimsuky Nov 2021)(Citation: KISA Operation Muzabi) [Kimsuky](https://attack.mitre.org/groups/G0094) has used a custom script with a function called CreateFileList() that can scan all filesystem drives, prioritizing C:\\Users, to locate files and file extensions of interest that ultimately generates a file called `FileList.txt` saved within the victims %TEMP% Directory that contains the findings and the respective pathways.(Citation: Aryaka Kimsuky July 2025)","relationship_id":"relationship--cdd92791-3bc2-4a1f-89b4-3eced4aa667f","references":[{"source_name":"Talos Kimsuky Nov 2021","description":"An, J and Malhotra, A. (2021, November 10). North Korean attackers use malicious blogs to deliver malware to high-profile South Korean targets. Retrieved December 29, 2021.","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source_name":"KISA Operation Muzabi","description":"KISA. (2021). Phishing Target Reconnaissance and Attack Resource Analysis Operation Muzabi. Retrieved March 8, 2024.","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"},{"source_name":"Securelist Kimsuky Sept 2013","description":"Tarakanov , D.. (2013, September 11). The “Kimsuky” Operation: A North Korean APT?. Retrieved August 13, 2019.","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"},{"source_name":"Aryaka Kimsuky July 2025","description":"Varadharajan Krishnasamy, Aditya K Sood. (2025, July 29). From Reconnaissance  to Control: The Operational Blueprint of Kimsuky APT  for Cyber Espionage. Retrieved April 18, 2026.","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"id":"G0096","name":"APT41","url":"https://attack.mitre.org/groups/G0096","kind":"intrusion-set","description":"[APT41](https://attack.mitre.org/groups/G0096) has executed <code>file /bin/pwd</code> on exploited victims, perhaps to return architecture related information.(Citation: FireEye APT41 March 2020)","relationship_id":"relationship--d9416afb-0aeb-4ee3-bd96-dc331f40f37d","references":[{"source_name":"FireEye APT41 March 2020","description":"Glyer, C, et al. (2020, March). This Is Not a Test: APT41 Initiates Global Intrusion Campaign Using Multiple Exploits. Retrieved April 28, 2020.","url":"https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html"}]},{"id":"G0100","name":"Inception","url":"https://attack.mitre.org/groups/G0100","kind":"intrusion-set","description":"[Inception](https://attack.mitre.org/groups/G0100) used a file listing plugin to collect information about file and directories both on local and remote drives.(Citation: Symantec Inception Framework March 2018)","relationship_id":"relationship--40e6721c-f5fd-4c51-aec9-93b70e7e312c","references":[{"source_name":"Symantec Inception Framework March 2018","description":"Symantec. (2018, March 14). Inception Framework: Alive and Well, and Hiding Behind Proxies. Retrieved May 8, 2020.","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies"}]},{"id":"G0114","name":"Chimera","url":"https://attack.mitre.org/groups/G0114","kind":"intrusion-set","description":"[Chimera](https://attack.mitre.org/groups/G0114) has utilized multiple commands to identify data of interest in file and directory listings.(Citation: NCC Group Chimera January 2021)","relationship_id":"relationship--577a7635-c4e3-42ab-8f16-d59330fdd535","references":[{"source_name":"NCC Group Chimera January 2021","description":"Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"id":"G0117","name":"Fox Kitten","url":"https://attack.mitre.org/groups/G0117","kind":"intrusion-set","description":"[Fox Kitten](https://attack.mitre.org/groups/G0117) has used WizTree to obtain network files and directory listings.(Citation: CISA AA20-259A Iran-Based Actor September 2020)","relationship_id":"relationship--f0026b7c-9a9a-468d-a152-1b214efe066a","references":[{"source_name":"CISA AA20-259A Iran-Based Actor September 2020","description":"CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"id":"G0121","name":"Sidewinder","url":"https://attack.mitre.org/groups/G0121","kind":"intrusion-set","description":"[Sidewinder](https://attack.mitre.org/groups/G0121) has used malware to collect information on files and directories.(Citation: ATT Sidewinder January 2021)","relationship_id":"relationship--6cce15df-4e0c-4eac-b597-5a301d450546","references":[{"source_name":"ATT Sidewinder January 2021","description":"Hegel, T. (2021, January 13). A Global Perspective of the SideWinder APT. Retrieved January 27, 2021.","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"}]},{"id":"G0124","name":"Windigo","url":"https://attack.mitre.org/groups/G0124","kind":"intrusion-set","description":"[Windigo](https://attack.mitre.org/groups/G0124) has used a script to check for the presence of files created by OpenSSH backdoors.(Citation: ESET ForSSHe December 2018)","relationship_id":"relationship--e2116500-b22a-44f6-ad5b-c3e579a67491","references":[{"source_name":"ESET ForSSHe December 2018","description":"Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.","url":"https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"}]},{"id":"G0125","name":"HAFNIUM","url":"https://attack.mitre.org/groups/G0125","kind":"intrusion-set","description":"[HAFNIUM](https://attack.mitre.org/groups/G0125) has searched file contents on a compromised host.(Citation: Rapid7 HAFNIUM Mar 2021)","relationship_id":"relationship--cf249a85-b0e9-4264-899f-164cdfa5a7c8","references":[{"source_name":"Rapid7 HAFNIUM Mar 2021","description":"Eoin Miller. (2021, March 23). Defending Against the Zero Day: Analyzing Attacker Behavior Post-Exploitation of Microsoft Exchange. Retrieved October 27, 2022.","url":"https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/"}]},{"id":"G0129","name":"Mustang Panda","url":"https://attack.mitre.org/groups/G0129","kind":"intrusion-set","description":"[Mustang Panda](https://attack.mitre.org/groups/G0129) has searched the entire target system for DOC, DOCX, PPT, PPTX, XLS, XLSX, and PDF files.(Citation: Avira Mustang Panda January 2020)(Citation: Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023)","relationship_id":"relationship--ab1b96ad-3ad8-4b16-b886-559f693496ff","references":[{"source_name":"Avira Mustang Panda January 2020","description":"Hamzeloofard, S. (2020, January 31). New wave of PlugX targets Hong Kong | Avira Blog. Retrieved April 13, 2021.","url":"https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"},{"source_name":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","description":"Lior Rochberger, Tom Fakterman, Robert Falcone. (2023, September 22). Cyberespionage Attacks Against Southeast Asian Government Linked to Stately Taurus, Aka Mustang Panda. Retrieved September 9, 2025.","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"}]},{"id":"G0139","name":"TeamTNT","url":"https://attack.mitre.org/groups/G0139","kind":"intrusion-set","description":"[TeamTNT](https://attack.mitre.org/groups/G0139) has used a script that checks `/proc/*/environ` for environment variables related to AWS.(Citation: Cisco Talos Intelligence Group)","relationship_id":"relationship--90cb412d-399d-4009-8aa0-63f411eb34ff","references":[{"source_name":"Cisco Talos Intelligence Group","description":"Darin Smith. (2022, April 21). TeamTNT targeting AWS, Alibaba. Retrieved August 4, 2022.","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}]},{"id":"G0142","name":"Confucius","url":"https://attack.mitre.org/groups/G0142","kind":"intrusion-set","description":"[Confucius](https://attack.mitre.org/groups/G0142) has used a file stealer that checks the Document, Downloads, Desktop, and Picture folders for documents and images with specific extensions.(Citation: TrendMicro Confucius APT Aug 2021)","relationship_id":"relationship--d618ef5e-5d76-4014-8c86-9357c4c7f749","references":[{"source_name":"TrendMicro Confucius APT Aug 2021","description":"Lunghi, D. (2021, August 17). Confucius Uses Pegasus Spyware-related Lures to Target Pakistani Military. Retrieved December 26, 2021.","url":"https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html"}]},{"id":"G1007","name":"Aoqin Dragon","url":"https://attack.mitre.org/groups/G1007","kind":"intrusion-set","description":"[Aoqin Dragon](https://attack.mitre.org/groups/G1007) has run scripts to identify file formats including Microsoft Word.(Citation: SentinelOne Aoqin Dragon June 2022)","relationship_id":"relationship--767ce5fe-06f5-4efc-aa41-129fad867c65","references":[{"source_name":"SentinelOne Aoqin Dragon June 2022","description":"Chen, Joey. (2022, June 9). Aoqin Dragon | Newly-Discovered Chinese-linked APT Has Been Quietly Spying On Organizations For 10 Years. Retrieved July 14, 2022.","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}]},{"id":"G1014","name":"LuminousMoth","url":"https://attack.mitre.org/groups/G1014","kind":"intrusion-set","description":"[LuminousMoth](https://attack.mitre.org/groups/G1014) has used malware that scans for files in the Documents, Desktop, and Download folders and in other drives.(Citation: Kaspersky LuminousMoth July 2021)(Citation: Bitdefender LuminousMoth July 2021)","relationship_id":"relationship--95e83e36-ba44-4e8f-8afe-ff6622fd6f84","references":[{"source_name":"Bitdefender LuminousMoth July 2021","description":"Botezatu, B and etl. (2021, July 21). LuminousMoth - PlugX, File Exfiltration and Persistence Revisited. Retrieved October 20, 2022.","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"},{"source_name":"Kaspersky LuminousMoth July 2021","description":"Lechtik, M, and etl. (2021, July 14). LuminousMoth APT: Sweeping attacks for the chosen few. Retrieved October 20, 2022.","url":"https://securelist.com/apt-luminousmoth/103332/"}]},{"id":"G1015","name":"Scattered Spider","url":"https://attack.mitre.org/groups/G1015","kind":"intrusion-set","description":"[Scattered Spider](https://attack.mitre.org/groups/G1015) Spider enumerates a target organization for files and directories of interest, including source code, user provisioning, MFA device registration, network diagrams, and shared credentials in documents or spreadsheets.(Citation: CISA Scattered Spider Advisory November 2023)(Citation: MSTIC Octo Tempest Operations October 2023)(Citation: Mandiant UNC3944 May 2025)(Citation: CrowdStrike Scattered Spider JUL 2025)(Citation: Mandiant VMware vSphere JUL 2025)","relationship_id":"relationship--75dcfc1b-016e-44ac-97c9-5a2eb3b76e50","references":[{"source_name":"CrowdStrike Scattered Spider JUL 2025","description":" Counter Adversary Operations. (2025, July 2). CrowdStrike Services Observes SCATTERED SPIDER Escalate Attacks Across Industries. Retrieved October 13, 2025.","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"},{"source_name":"CISA Scattered Spider Advisory November 2023","description":"CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"},{"source_name":"Mandiant VMware vSphere JUL 2025","description":"Mandiant Incident Response. (2025, July 23). From Help Desk to Hypervisor: Defending Your VMware vSphere Estate from UNC3944. Retrieved October 13, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"},{"source_name":"Mandiant UNC3944 May 2025","description":"Mandiant Incident Response. (2025, May 6). Defending Against UNC3944: Cybercrime Hardening Guidance from the Frontlines. Retrieved October 13, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations"},{"source_name":"MSTIC Octo Tempest Operations October 2023","description":"Microsoft. (2023, October 25). Octo Tempest crosses boundaries to facilitate extortion, encryption, and destruction. Retrieved March 18, 2024.","url":"https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/"}]},{"id":"G1016","name":"FIN13","url":"https://attack.mitre.org/groups/G1016","kind":"intrusion-set","description":"[FIN13](https://attack.mitre.org/groups/G1016) has used the Windows `dir` command to enumerate files and directories in a victim's network.(Citation: Mandiant FIN13 Aug 2022)","relationship_id":"relationship--f97798e2-ec1a-4cad-ab07-f61ef6cb8f78","references":[{"source_name":"Mandiant FIN13 Aug 2022","description":"Ta, V., et al. (2022, August 8). FIN13: A Cybercriminal Threat Actor Focused on Mexico. Retrieved February 9, 2023.","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"id":"G1017","name":"Volt Typhoon","url":"https://attack.mitre.org/groups/G1017","kind":"intrusion-set","description":"[Volt Typhoon](https://attack.mitre.org/groups/G1017) has enumerated directories containing vulnerability testing and cyber related content and facilities data such as construction drawings.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)","relationship_id":"relationship--0925dc87-1a47-4248-ad5b-316f5a1ce22a","references":[{"source_name":"CISA AA24-038A PRC Critical Infrastructure February 2024","description":"CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"id":"G1022","name":"ToddyCat","url":"https://attack.mitre.org/groups/G1022","kind":"intrusion-set","description":"[ToddyCat](https://attack.mitre.org/groups/G1022) has run scripts to enumerate recently modified documents having either a .pdf, .doc, .docx, .xls or .xlsx extension.(Citation: Kaspersky ToddyCat Check Logs October 2023)","relationship_id":"relationship--bad38b14-93b7-42a3-b0a3-6170aa895734","references":[{"source_name":"Kaspersky ToddyCat Check Logs October 2023","description":"Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"id":"G1023","name":"APT5","url":"https://attack.mitre.org/groups/G1023","kind":"intrusion-set","description":"[APT5](https://attack.mitre.org/groups/G1023) has used the BLOODMINE utility to discover files with .css, .jpg, .png, .gif, .ico, .js, and .jsp extensions in Pulse Secure Connect logs.(Citation: Mandiant Pulse Secure Update May 2021)","relationship_id":"relationship--edda676e-bd01-4983-b491-bf6c5d9a84db","references":[{"source_name":"Mandiant Pulse Secure Update May 2021","description":"Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"id":"G1035","name":"Winter Vivern","url":"https://attack.mitre.org/groups/G1035","kind":"intrusion-set","description":"[Winter Vivern](https://attack.mitre.org/groups/G1035) delivered malicious JavaScript payloads capable of listing folders and emails in exploited email servers.(Citation: ESET WinterVivern 2023)","relationship_id":"relationship--e0922165-ba76-4dc0-8625-b77a82818d77","references":[{"source_name":"ESET WinterVivern 2023","description":"Matthieu Faou. (2023, October 25). Winter Vivern exploits zero-day vulnerability in Roundcube Webmail servers. Retrieved July 29, 2024.","url":"https://www.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers/"}]},{"id":"G1039","name":"RedCurl","url":"https://attack.mitre.org/groups/G1039","kind":"intrusion-set","description":"[RedCurl](https://attack.mitre.org/groups/G1039) has searched for and collected files on local and network drives.(Citation: therecord_redcurl)(Citation: group-ib_redcurl1)(Citation: group-ib_redcurl2)","relationship_id":"relationship--47ad4b99-a600-4788-b90d-ba8e2799107a","references":[{"source_name":"therecord_redcurl","description":"Antoniuk, D. (2023, July 17). RedCurl hackers return to spy on 'major Russian bank,' Australian company. Retrieved August 9, 2024.","url":"https://therecord.media/redcurl-hackers-russian-bank-australian-company"},{"source_name":"group-ib_redcurl1","description":"Group-IB. (2020, August). RedCurl: The Pentest You Didn’t Know About. Retrieved August 9, 2024.","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source_name":"group-ib_redcurl2","description":"Group-IB. (2021, November). RedCurl: The Awakening. Retrieved August 14, 2024.","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"id":"G1040","name":"Play","url":"https://attack.mitre.org/groups/G1040","kind":"intrusion-set","description":"[Play](https://attack.mitre.org/groups/G1040) has used the Grixba information stealer to list security files and processes.(Citation: Trend Micro Ransomware Spotlight Play July 2023)","relationship_id":"relationship--c33b2278-04ef-4506-8406-37700b797af6","references":[{"source_name":"Trend Micro Ransomware Spotlight Play July 2023","description":"Trend Micro Research. (2023, July 21). Ransomware Spotlight: Play. Retrieved September 24, 2024.","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"id":"G1047","name":"Velvet Ant","url":"https://attack.mitre.org/groups/G1047","kind":"intrusion-set","description":"[Velvet Ant](https://attack.mitre.org/groups/G1047) has enumerated local files and folders on victim devices.(Citation: Sygnia VelvetAnt 2024A)","relationship_id":"relationship--4d453252-ae9c-48c0-a9ab-2ca700855e3f","references":[{"source_name":"Sygnia VelvetAnt 2024A","description":"Sygnia Team. (2024, June 3). China-Nexus Threat Group ‘Velvet Ant’ Abuses F5 Load Balancers for Persistence. Retrieved March 14, 2025.","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]},{"id":"G1048","name":"UNC3886","url":"https://attack.mitre.org/groups/G1048","kind":"intrusion-set","description":" [UNC3886](https://attack.mitre.org/groups/G1048) has used `vmtoolsd.exe` to enumerate files on guest machines.(Citation: Google Cloud Threat Intelligence ESXi VIBs 2022)(Citation: Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023)","relationship_id":"relationship--0c75b350-2996-47f8-9e01-38b7cf53481c","references":[{"source_name":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","description":"Alexander Marvi, Brad Slaybaugh, Ron Craft, and Rufus Brown. (2023, June 13). VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors. Retrieved March 26, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"},{"source_name":"Google Cloud Threat Intelligence ESXi VIBs 2022","description":"Alexander Marvi, Jeremy Koppen, Tufail Ahmed, and Jonathan Lepore. (2022, September 29). Bad VIB(E)s Part One: Investigating Novel Malware Persistence Within ESXi Hypervisors. Retrieved March 26, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence"}]},{"id":"G1051","name":"Medusa Group","url":"https://attack.mitre.org/groups/G1051","kind":"intrusion-set","description":"[Medusa Group](https://attack.mitre.org/groups/G1051) has searched for files within the victim environment for encryption and exfiltration.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)(Citation: CISA Medusa Group Medusa Ransomware March 2025)(Citation: Security Scorecard Medusa Ransomware January 2024) [Medusa Group](https://attack.mitre.org/groups/G1051) has also identified files associated with remote management services.(Citation: Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024)(Citation: CISA Medusa Group Medusa Ransomware March 2025)","relationship_id":"relationship--204086ef-c546-47fd-8844-b8af57085f26","references":[{"source_name":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","description":"Anthony Galiette, Doel Santos. (2024, January 11). Medusa Ransomware Turning Your Files into Stone. Retrieved October 15, 2025.","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source_name":"CISA Medusa Group Medusa Ransomware March 2025","description":"Cybersecurity and Infrastructure Security Agency. (2025, March 12). AA25-071A #StopRansomware: Medusa Ransomware. Retrieved October 15, 2025.","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source_name":"Security Scorecard Medusa Ransomware January 2024","description":"Vlad Pasca. (2024, January 1). A Deep Dive into Medusa Ransomware. Retrieved October 15, 2025.","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}]},{"id":"G1052","name":"Contagious Interview","url":"https://attack.mitre.org/groups/G1052","kind":"intrusion-set","description":"[Contagious Interview](https://attack.mitre.org/groups/G1052) has conducted key word searches within files and directories on a compromised hosts to identify files for exfiltration.(Citation: ESET Contagious Interview BeaverTail InvisibleFerret February 2025)(Citation: PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023)","relationship_id":"relationship--0c53d506-c557-43be-99e2-04a907341c8a","references":[{"source_name":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","description":"Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025.","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source_name":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","description":"Unit 42. (2023, November 21). Hacking Employers and Seeking Employment: Two Job-Related Campaigns Bear Hallmarks of North Korean Threat Actors. Retrieved October 17, 2025.","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"}]},{"id":"G1054","name":"MirrorFace","url":"https://attack.mitre.org/groups/G1054","kind":"intrusion-set","description":"[MirrorFace](https://attack.mitre.org/groups/G1054) has run commands to check the content of folders on compromised hosts and has specifically targeted files with .doc, .ppt, .xls, .jtd, .eml, .xps, and .pdf extensions.(Citation: ESET MirrorFace DEC 2022)(Citation: Trend Micro Earth Kasha NOV 2024)(Citation: JPCERT MirrorFace JUL 2024)","relationship_id":"relationship--44356f01-27ae-45f5-b37f-85ce8c22fa44","references":[{"source_name":"ESET MirrorFace DEC 2022","description":"Breitenbacher, D. (2022, December 14). Unmasking MirrorFace: Operation LiberalFace targeting Japanese political entities. Retrieved April 17, 2026.","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"},{"source_name":"JPCERT MirrorFace JUL 2024","description":"Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"},{"source_name":"Trend Micro Earth Kasha NOV 2024","description":"Trend Micro. (2024, November 19). Spot the Difference: Earth Kasha's New LODEINFO Campaign And The Correlation Analysis With The APT10 Umbrella. Retrieved April 17, 2026.","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]},{"id":"G1057","name":"ShinyHunters","url":"https://attack.mitre.org/groups/G1057","kind":"intrusion-set","description":"[ShinyHunters](https://attack.mitre.org/groups/G1057) has checked mount points for Oracle PeopleSoft configurations and has checked the process scheduler configuration file psappsrv.cfg. Additionally, [ShinyHunters](https://attack.mitre.org/groups/G1057) has read WebLogic server XML configurations files (config.xml).(Citation: Google_SHOracle_Jun2026)","relationship_id":"relationship--69d75d5b-0780-4618-aca4-3a9c9b1e2aee","references":[{"source_name":"Google_SHOracle_Jun2026","description":"Mandiant, Google Threat Intelligence Group. (2026, June 11). ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit. Retrieved June 11, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"}]}],"mitigations":[],"candidates":[{"id":"0e36303b-6762-4500-b003-127743b80ba6","name":"File and Directory Discovery (cmd.exe)","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1083/T1083.yaml","description":"Find or discover files on the file system.  Upon successful execution, this test will output the results of all the data discovery commands to a specified file.\n","inputs":{"output_file":{"description":"File to output results to","type":"string","default":"%temp%\\T1083Test1.txt"}},"dependencies":[],"source_definition_sha256":"7d6668dd93bfde0b427ce665f081093ff15decf78f453d406598a25a77f78f75"},{"id":"13c5e1ae-605b-46c4-a79f-db28c77ff24e","name":"Nix File and Directory Discovery 2","platforms":["linux","macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1083/T1083.yaml","description":"Find or discover files on the file system\n","inputs":{"output_file":{"description":"Output file used to store the results.","type":"path","default":"/tmp/T1083.txt"}},"dependencies":[],"source_definition_sha256":"99b60b2da2be9ebdb61b1d4380ad48bf63ebeb4212c2ea53c7b06f75fefdc722"},{"id":"2158908e-b7ef-4c21-8a83-3ce4dd05a924","name":"File and Directory Discovery (PowerShell)","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1083/T1083.yaml","description":"Find or discover files on the file system. Upon execution, file and folder information will be displayed.\n","inputs":{},"dependencies":[],"source_definition_sha256":"beeaf915c42b8323474613f88b66a639b9e67ebee540ce1825d60e8c82aa22f4"},{"id":"361fe49d-0c19-46ec-a483-ccb92d38e88e","name":"Identifying Network Shares - Linux","platforms":["linux"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1083/T1083.yaml","description":"If the system uses network file systems (e.g., NFS, CIFS), findmnt can help locate paths to remote shares.\nAttackers may then attempt to access these shares for lateral movement or data exfiltration.\n","inputs":{},"dependencies":[],"source_definition_sha256":"111c063a33aaf41d7272fd5bcd9808fb8efc29de8e4afcf47af58f549fc3446e"},{"id":"4a233a40-caf7-4cf1-890a-c6331bbc72cf","name":"ESXi - Enumerate VMDKs available on an ESXi Host","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1083/T1083.yaml","description":"An adversary uses the find command to enumerate vmdks on an ESXi host.\n[Reference](https://www.crowdstrike.com/blog/hypervisor-jackpotting-ecrime-actors-increase-targeting-of-esxi-servers/)\n","inputs":{"vm_host":{"description":"Specify the host name of the ESXi Server","type":"string","default":"atomic.local"},"vm_user":{"description":"Specify the privilege user account on ESXi Server","type":"string","default":"root"},"vm_pass":{"description":"Specify the privilege user password on ESXi Server","type":"string","default":"pass"},"plink_file":{"description":"Path to Plink","type":"path","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\plink.exe"},"cli_script":{"description":"Path to script with file discovery commands","type":"path","default":"PathToAtomicsFolder\\T1083\\src\\esxi_file_discovery.txt"}},"dependencies":[{"description":"Check if plink is available.\n"}],"source_definition_sha256":"3b612f3c8755636bb4804ff153e95fd56ac943f2664af20801906073ca89efad"},{"id":"95a21323-770d-434c-80cd-6f6fbf7af432","name":"Recursive Enumerate Files And Directories By Powershell","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1083/T1083.yaml","description":"Adversary attempting to discover and collect sensitive documents and archives\nfrom a user’s system. The test recursively enumerates common user folders\n(Documents, Downloads, Desktop, OneDrive) for file types of interest such as .pdf, .doc,\n.docx, .xls, .xlsx, .txt, .zip, .rar, and .7z.\nThis behavior is similar to malware like LOSTKEYS used by COLDRIVER in January 2025,\nwhere attackers perform targeted file discovery to support strategic intelligence collection https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix.\n","inputs":{"output_file":{"description":"File to output results.","type":"string","default":"$env:TEMP\\T1083-Enumerate-net.txt"}},"dependencies":[],"source_definition_sha256":"b2477c34d6202f2d2e3f4ebe897a2e1bd299feed66c977a0460408996bb8b2d9"},{"id":"c5bec457-43c9-4a18-9a24-fe151d8971b7","name":"Launch DirLister Executable","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1083/T1083.yaml","description":"Launches the DirLister executable for a short period of time and then exits.\n\nRecently seen used by [BlackCat ransomware](https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely-a-byproduct-of-bad-luck/) to create a list of accessible directories and files.","inputs":{"dirlister_path":{"description":"Path to the DirLister executable ","type":"string","default":"PathToAtomicsFolder\\..\\ExternalPayloads\\DirLister.exe"}},"dependencies":[{"description":"DirLister.exe must exist in the specified path #{dirlister_path}\n"}],"source_definition_sha256":"a0bf9e7ad611b71b2902c31edbd4ab9eed24b979245a3426e599391478778d67"},{"id":"c6c34f61-1c3e-40fb-8a58-d017d88286d8","name":"Simulating MAZE Directory Enumeration","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1083/T1083.yaml","description":"This test emulates MAZE ransomware's ability to enumerate directories using Powershell.\nUpon successful execution, this test will output the directory enumeration results to a specified file, as well as display them in the active window.\nSee https://www.mandiant.com/resources/tactics-techniques-procedures-associated-with-maze-ransomware-incidents\n","inputs":{"File_to_output":{"description":"File to output results to","type":"string","default":"$env:temp\\T1083Test5.txt"}},"dependencies":[],"source_definition_sha256":"18ea6fde186c14d268a5c2e58050451fe6aab020c1d8f21cb1cbbcf9c01fa243"},{"id":"ffc8b249-372a-4b74-adcd-e4c0430842de","name":"Nix File and Directory Discovery","platforms":["linux","macos"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1083/T1083.yaml","description":"Find or discover files on the file system\n\nReferences:\n\nhttp://osxdaily.com/2013/01/29/list-all-files-subdirectory-contents-recursively/\n\nhttps://perishablepress.com/list-files-folders-recursively-terminal/\n","inputs":{"output_file":{"description":"Output file used to store the results.","type":"path","default":"/tmp/T1083.txt"}},"dependencies":[],"source_definition_sha256":"335c76809c6953dfc72d6f0805c39b563f1b201a58090f56287b20b2ce1179da"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1083":"/ttp-simulation/techniques/enterprise/T1083/","T1106":"/ttp-simulation/techniques/enterprise/T1106/","T1059.008":"/ttp-simulation/techniques/enterprise/T1059.008/","T1497":"/ttp-simulation/techniques/enterprise/T1497/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1083","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0055","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","access":"read","actor":"LAB\\analyst","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0039","collector":"illustrative-lab-collector","observation":{"process_id":4200,"path":"C:\\Lab\\demo.txt","action":"create","size_bytes":64}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}}]}}