TTPs - Ransomware Monitor

View

Highlight Group

209 techniques

Initial Access
(7)

T1078
Valid Accounts 29

T1133
External Remote Services 20

T1189
Drive-by Compromise 16

T1190
Exploit Public-Facing Application 19

T1195.002
Compromise Software Supply Chain 17

T1566.001
Spearphishing Attachment 19

T1566.002
Spearphishing Link 14

Execution
(8)

T1047
Windows Management Instrumentation 17

T1053.005
Scheduled Task 19

T1059.001
PowerShell 21

T1059.003
Windows Command Shell 21

T1059.005
Visual Basic 14

T1059.006
Python 20

T1204.001
Malicious Link 21

T1204.002
Malicious File 20

Persistence
(5)

T1098
Account Manipulation 24

T1136.001
Local Account 18

T1543.003
Windows Service 16

T1547.001
Registry Run Keys 24

T1547.009
Shortcut Modification 22

Privilege Escalation
(3)

T1068
Exploitation for Privilege Escalation 24

T1134
Access Token Manipulation 17

T1548.002
Bypass UAC 15

Defense Evasion
(9)

T1027
Obfuscated Files or Information 20

T1036.005
Match Legitimate Name or Location 26

T1055
Process Injection 20

T1070.004
File Deletion 25

T1140
Deobfuscate/Decode Files 22

T1218.011
Rundll32 16

T1562.001
Disable or Modify Tools 16

T1562.004
Disable or Modify System Firewall 23

T1562.009
Safe Mode Boot 22

Credential Access
(7)

T1003.001
LSASS Memory 21

T1003.003
NTDS 19

T1110.001
Password Guessing 23

T1110.003
Password Spraying 18

T1552.001
Credentials In Files 16

T1555.003
Credentials from Web Browsers 20

T1558.003
Kerberoasting 19

Discovery
(8)

T1016
System Network Configuration Discovery 17

T1018
Remote System Discovery 21

T1049
System Network Connections Discovery 29

T1069
Permission Groups Discovery 21

T1082
System Information Discovery 21

T1083
File and Directory Discovery 15

T1087
Account Discovery 24

T1135
Network Share Discovery 19

Lateral Movement
(5)

T1021.001
Remote Desktop Protocol 19

T1021.002
SMB/Windows Admin Shares 14

T1021.004
SSH 19

T1080
Taint Shared Content 15

T1570
Lateral Tool Transfer 18

Collection
(4)

T1005
Data from Local System 19

T1039
Data from Network Shared Drive 23

T1074.001
Local Data Staging 23

T1560.001
Archive via Utility 20

Command and Control
(6)

T1071.001
Web Protocols 26

T1090
Proxy 15

T1105
Ingress Tool Transfer 25

T1219
Remote Access Software 26

T1572
Protocol Tunneling 26

T1573.002
Asymmetric Cryptography 13

Exfiltration
(3)

T1041
Exfiltration Over C2 Channel 21

T1048.003
Exfiltration Over Unencrypted Non-C2 Protocol 14

T1567.002
Exfiltration to Cloud Storage 22

Impact
(8)

T1485
Data Destruction 14

T1486
Data Encrypted for Impact 27

T1489
Service Stop 22

T1490
Inhibit System Recovery 17

T1491.001
Internal Defacement 23

T1529
System Shutdown/Reboot 20

T1531
Account Access Removal 20

T1561.001
Disk Wipe 20

Other
(136)

T1005
Data from Local System 2

T1560.002
Archive via Library 1

T1560.003
Archive via Custom Method 1

T1056.001
Keylogging 1

T1071.001
Web Protocols 6

T1090
Proxy 1

T1090.003
Multi-hop Proxy 1

T1095
Non-Application Layer Protocol 1

T1105
Ingress Tool Transfer 5

T1132.001
Standard Encoding 1

T1132.002
Non-Standard Encoding 1

T1568
Dynamic Resolution 1

T1571
Non-Standard Port 1

T1572
Protocol Tunneling 1

T1573.001
Symmetric Cryptography 2

T1573.002
Asymmetric Cryptography 2

T1003.001
LSASS Memory 2

T1110
Brute Force 1

T1552.001
Credentials In Files 1

T1552.004
Private Keys 1

T1040
Network Sniffing 1

T1014
Rootkit 1

T1027
Obfuscated Files or Information 5

T1027.001
Binary Padding 1

T1027.002
Software Packing 4

T1027.003
Steganography 1

T1027.004
Compile After Delivery 1

T1027.007
Dynamic API Resolution 1

T1027.011
Fileless Storage 1

T1027.013
Encrypted/Encoded File 6

T1027.016
Junk Code Insertion 1

T1036
Masquerading 2

T1036.004
Masquerade Task or Service 2

T1036.005
Match Legitimate Resource Name or Location 7

T1036.008
Masquerade File Type 1

T1070
Indicator Removal 1

T1070.001
Clear Windows Event Logs 4

T1070.004
File Deletion 7

T1070.006
Timestomp 1

T1140
Deobfuscate/Decode Files or Information 10

T1218.003
CMSTP 1

T1218.007
Msiexec 3

T1218.010
Regsvr32 1

T1218.011
Rundll32 1

T1222
File and Directory Permissions Modification 1

T1222.001
Windows File and Directory Permissions Modification 2

T1222.002
Linux and Mac File and Directory Permissions Modification 1

T1480
Execution Guardrails 4

T1480.002
Mutual Exclusion 4

T1553.002
Code Signing 2

T1562.001
Disable or Modify Tools 11

T1562.004
Disable or Modify System Firewall 1

T1562.009
Safe Mode Boot 6

T1564.003
Hidden Window 4

T1564.006
Run Virtual Instance 2

T1620
Reflective Code Loading 2

T1679
Selective Exclusion 1

T1497
Virtualization/Sandbox Evasion 1

T1497.001
System Checks 1

T1497.003
Time Based Checks 2

T1622
Debugger Evasion 2

T1550
Use Alternate Authentication Material 1

T1112
Modify Registry 7

T1205
Traffic Signaling 1

T1078.002
Domain Accounts 1

T1078.003
Local Accounts 1

T1055
Process Injection 2

T1055.001
Dynamic-link Library Injection 3

T1134
Access Token Manipulation 4

T1134.001
Token Impersonation/Theft 1

T1134.002
Create Process with Token 1

T1484.001
Group Policy Modification 2

T1007
System Service Discovery 6

T1012
Query Registry 2

T1016
System Network Configuration Discovery 7

T1018
Remote System Discovery 5

T1033
System Owner/User Discovery 2

T1046
Network Service Discovery 2

T1049
System Network Connections Discovery 4

T1057
Process Discovery 15

T1069.002
Domain Groups 2

T1082
System Information Discovery 11

T1083
File and Directory Discovery 18

T1087.001
Local Account 1

T1087.002
Domain Account 1

T1120
Peripheral Device Discovery 3

T1124
System Time Discovery 2

T1135
Network Share Discovery 13

T1518.001
Security Software Discovery 2

T1614
System Location Discovery 1

T1614.001
System Language Discovery 6

T1652
Device Driver Discovery 1

T1654
Log Enumeration 1

T1673
Virtual Machine Discovery 1

T1680
Local Storage Discovery 11

T1047
Windows Management Instrumentation 7

T1059.001
PowerShell 9

T1059.003
Windows Command Shell 14

T1059.005
Visual Basic 1

T1059.006
Python 1

T1059.012
Hypervisor CLI 1

T1106
Native API 16

T1129
Shared Modules 1

T1204.001
Malicious Link 1

T1204.002
Malicious File 3

T1559
Inter-Process Communication 2

T1569.002
Service Execution 3

T1053.005
Scheduled Task 4

T1041
Exfiltration Over C2 Channel 3

T1485
Data Destruction 2

T1486
Data Encrypted for Impact 20

T1489
Service Stop 18

T1490
Inhibit System Recovery 18

T1491.001
Internal Defacement 6

T1529
System Shutdown/Reboot 4

T1561.001
Disk Content Wipe 1

T1189
Drive-by Compromise 1

T1190
Exploit Public-Facing Application 1

T1566
Phishing 2

T1566.001
Spearphishing Attachment 2

T1566.002
Spearphishing Link 1

T1021.001
Remote Desktop Protocol 1

T1021.002
SMB/Windows Admin Shares 6

T1080
Taint Shared Content 1

T1563.001
SSH Hijacking 1

T1570
Lateral Tool Transfer 2

T1136
Create Account 1

T1542.002
Component Firmware 1

T1037.004
RC Scripts 1

T1543
Create or Modify System Process 1

T1543.003
Windows Service 5

T1547.001
Registry Run Keys / Startup Folder 6

T1547.004
Winlogon Helper DLL 2

T1574.001
DLL 1

T1574.006
Dynamic Linker Hijacking 1

T1548.002
Bypass User Account Control 3

Technique ID	Technique Name	Tactic	Groups Using It
T1078	Valid Accounts	Initial Access	AjaxLeak TeslaCrypt Quantum Red Ransomware Fracture Minos ElectraHack TombDark +21 more
T1133	External Remote Services	Initial Access	Phoenix Locker RuinStorm Red Ransomware Black Basta (Post-Leak) Lynx v2 Fracture CollapseGroup PoseidonCrew +12 more
T1189	Drive-by Compromise	Initial Access	Tornado ElectraHack Yanluowang Gamma NetWalker BlightFury FateRage FragmentDark +8 more
T1190	Exploit Public-Facing Application	Initial Access	Quantum NW Generation Fortress Black Basta (Post-Leak) Minos Typhon Gamma PoseidonCrew +11 more
T1195.002	Compromise Software Supply Chain	Initial Access	Red Ransomware Minos TombDark Glitch Hypnos SingularityWare NetWalker FateRage +9 more
T1566.001	Spearphishing Attachment	Initial Access	TeslaCrypt Fortress Red Ransomware Pixel Horde Minos ElectraHack Typhon +11 more
T1566.002	Spearphishing Link	Initial Access	TeslaCrypt Quantum Red Ransomware JupiterLock PoseidonCrew FragmentDark Storm-0501 Magniber +6 more
T1047	Windows Management Instrumentation	Execution	TorrentForce Fortress HornetTeam TombDark Yanluowang FrostUnit LynxLeak Vice Society (PolyVice) +9 more
T1053.005	Scheduled Task	Execution	CoreSec Armor TeslaCrypt HornetTeam Fracture Pixel Typhon FateRage +11 more
T1059.001	PowerShell	Execution	AjaxLeak TeslaCrypt Quantum Red Ransomware MambaCrew TombDark JupiterLock Glitch +13 more
T1059.003	Windows Command Shell	Execution	RuinStorm HornetTeam Red Ransomware Fracture Horde Minos Harbinger PoseidonCrew +13 more
T1059.005	Visual Basic	Execution	CoreSec Banshee RuinStorm CollapseGroup NetWalker Hades DominionStrike TartarusRansom +6 more
T1059.006	Python	Execution	TeslaCrypt Quantum RuinStorm Black Basta (Post-Leak) Lynx v2 JupiterLock Kernel TartarusRansom +12 more
T1204.001	Malicious Link	Execution	Conti Remnants RuinStorm HornetTeam Fracture Pixel Minos Yanluowang SingularityWare +13 more
T1204.002	Malicious File	Execution	Armor NW Generation Red Ransomware TombDark Typhon SingularityWare NetWalker FateRage +12 more
T1098	Account Manipulation	Persistence	Quantum TorrentForce Fortress Red Ransomware Fracture Altair FrostUnit Nitrogen +16 more
T1136.001	Local Account	Persistence	Banshee Tornado NW Generation HornetTeam Typhon BlightFury FragmentDark NoEscape +10 more
T1543.003	Windows Service	Persistence	TeslaCrypt NW Generation HornetTeam Black Basta (Post-Leak) Gamma FragmentDark DiomedesBlack PenumbraBreach +8 more
T1547.001	Registry Run Keys	Persistence	Conti Remnants Banshee Phoenix Locker AjaxLeak Fortress Red Ransomware Black Basta (Post-Leak) Harbinger +16 more
T1547.009	Shortcut Modification	Persistence	Dusk Conti Remnants RuinStorm TorrentForce Fortress Harbinger Typhon Gamma +14 more
T1068	Exploitation for Privilege Escalation	Privilege Escalation	Phoenix Locker Fortress HornetTeam Lynx v2 Minos ElectraHack Typhon Gamma +16 more
T1134	Access Token Manipulation	Privilege Escalation	TeslaCrypt Pixel Gamma HadesSec Hades TartarusRansom Satan/DBGer Falcon +9 more
T1548.002	Bypass UAC	Privilege Escalation	Banshee Quantum NW Generation Black Basta (Post-Leak) Horde Minos Typhon BlightFury +7 more
T1027	Obfuscated Files or Information	Defense Evasion	Dusk TeslaCrypt Fortress Minos ElectraHack CollapseGroup Typhon Gamma +12 more
T1036.005	Match Legitimate Name or Location	Defense Evasion	CoreSec Banshee TorrentForce Lynx v2 Fracture ElectraHack Glitch Altair +18 more
T1055	Process Injection	Defense Evasion	RuinStorm NW Generation Harbinger Yanluowang Typhon SingularityWare HadesSec LynxLeak +12 more
T1070.004	File Deletion	Defense Evasion	Dusk Red Ransomware Black Basta (Post-Leak) Fracture Typhon Glitch FragmentDark NoEscape +17 more
T1140	Deobfuscate/Decode Files	Defense Evasion	Banshee AjaxLeak TeslaCrypt TorrentForce Harbinger TombDark Typhon HadesSec +14 more
T1218.011	Rundll32	Defense Evasion	Red Ransomware Lynx v2 Horde JupiterLock PoseidonCrew BlightFury Dispossessor Onyx +8 more
T1562.001	Disable or Modify Tools	Defense Evasion	Dusk TeslaCrypt Quantum TombDark SingularityWare FateRage Hades DominionStrike +8 more
T1562.004	Disable or Modify System Firewall	Defense Evasion	CoreSec RuinStorm NW Generation Lynx v2 Pixel Horde CollapseGroup JupiterLock +15 more
T1562.009	Safe Mode Boot	Defense Evasion	TorrentForce Black Basta (Post-Leak) Pixel Harbinger Altair PoseidonCrew HadesSec FateRage +14 more
T1003.001	LSASS Memory	Credential Access	Conti Remnants Banshee TeslaCrypt TorrentForce Red Ransomware Black Basta (Post-Leak) Lynx v2 ElectraHack +13 more
T1003.003	NTDS	Credential Access	Dusk Phoenix Locker RuinStorm Red Ransomware Lynx v2 ElectraHack Altair FragmentDark +11 more
T1110.001	Password Guessing	Credential Access	Phoenix Locker TeslaCrypt Quantum RuinStorm Fortress Red Ransomware Minos MambaCrew +15 more
T1110.003	Password Spraying	Credential Access	Dusk Banshee Armor Fortress Lynx v2 TombDark JupiterLock Nitrogen +10 more
T1552.001	Credentials In Files	Credential Access	Quantum RuinStorm CollapseGroup Gamma SingularityWare NetWalker Hades CipherStrike +8 more
T1555.003	Credentials from Web Browsers	Credential Access	Dusk AjaxLeak TeslaCrypt NW Generation Fortress Minos Gamma Nitrogen +12 more
T1558.003	Kerberoasting	Credential Access	Banshee RuinStorm Horde Typhon Gamma Altair NetWalker Dispossessor +11 more
T1016	System Network Configuration Discovery	Discovery	Dusk TeslaCrypt TorrentForce Black Basta (Post-Leak) ElectraHack Hypnos SingularityWare LynxLeak +9 more
T1018	Remote System Discovery	Discovery	Conti Remnants Banshee NW Generation JupiterLock Yanluowang Hypnos HadesSec BlightFury +13 more
T1049	System Network Connections Discovery	Discovery	Tornado TeslaCrypt Quantum RuinStorm TorrentForce NW Generation Fortress ElectraHack +21 more
T1069	Permission Groups Discovery	Discovery	Armor Tornado Pixel Harbinger Typhon FragmentDark Hades Vice Society (PolyVice) +13 more
T1082	System Information Discovery	Discovery	Dusk Banshee Red Ransomware Black Basta (Post-Leak) Fracture Altair PoseidonCrew BlightFury +13 more
T1083	File and Directory Discovery	Discovery	Banshee Lynx v2 Pixel Horde MambaCrew FateRage FrostUnit AtomSilo +7 more
T1087	Account Discovery	Discovery	TeslaCrypt Quantum NW Generation Fortress Red Ransomware Black Basta (Post-Leak) Lynx v2 Fracture +16 more
T1135	Network Share Discovery	Discovery	Banshee TorrentForce Pixel MambaCrew ElectraHack TombDark Yanluowang FragmentDark +11 more
T1021.001	Remote Desktop Protocol	Lateral Movement	Dusk NW Generation Fortress Red Ransomware Black Basta (Post-Leak) Fracture Minos TombDark +11 more
T1021.002	SMB/Windows Admin Shares	Lateral Movement	Dusk Armor Tornado RuinStorm NetWalker BlightFury LynxLeak Onyx +6 more
T1021.004	SSH	Lateral Movement	Dusk Banshee Red Ransomware Black Basta (Post-Leak) Harbinger Yanluowang Gamma PoseidonCrew +11 more
T1080	Taint Shared Content	Lateral Movement	AjaxLeak TeslaCrypt Fortress CollapseGroup SingularityWare Vice Society (PolyVice) Dispossessor Satan/DBGer +7 more
T1570	Lateral Tool Transfer	Lateral Movement	Dusk Banshee HornetTeam Fracture Glitch Altair PoseidonCrew NetWalker +10 more
T1005	Data from Local System	Collection	RuinStorm Fortress Red Ransomware Horde Minos JupiterLock Altair BlightFury +11 more
T1039	Data from Network Shared Drive	Collection	Dusk AjaxLeak NW Generation Typhon SingularityWare HadesSec NetWalker BlightFury +15 more
T1074.001	Local Data Staging	Collection	Banshee Fortress Red Ransomware Black Basta (Post-Leak) Harbinger MambaCrew PoseidonCrew SingularityWare +15 more
T1560.001	Archive via Utility	Collection	CoreSec AjaxLeak NW Generation Fortress Black Basta (Post-Leak) Fracture Minos NetWalker +12 more
T1071.001	Web Protocols	Command and Control	Dusk Banshee Fortress HornetTeam Lynx v2 Pixel ElectraHack TombDark +18 more
T1090	Proxy	Command and Control	Dusk Phoenix Locker RuinStorm Fortress Harbinger Gamma HadesSec Nitrogen +7 more
T1105	Ingress Tool Transfer	Command and Control	CoreSec RuinStorm HornetTeam Minos ElectraHack Altair HadesSec NetWalker +17 more
T1219	Remote Access Software	Command and Control	Dusk Banshee Red Ransomware Black Basta (Post-Leak) Lynx v2 Fracture Horde Minos +18 more
T1572	Protocol Tunneling	Command and Control	Banshee AjaxLeak Red Ransomware Black Basta (Post-Leak) Fracture Minos Harbinger PoseidonCrew +18 more
T1573.002	Asymmetric Cryptography	Command and Control	TeslaCrypt Horde MambaCrew FateRage FrostUnit Nitrogen DiomedesBlack DominionStrike +5 more
T1041	Exfiltration Over C2 Channel	Exfiltration	RuinStorm Fracture ElectraHack Typhon PoseidonCrew HadesSec NetWalker Nitrogen +13 more
T1048.003	Exfiltration Over Unencrypted Non-C2 Protocol	Exfiltration	Quantum TorrentForce MambaCrew Typhon NetWalker DiomedesBlack TartarusRansom NestorRansom +6 more
T1567.002	Exfiltration to Cloud Storage	Exfiltration	Quantum HornetTeam Minos JupiterLock Typhon PoseidonCrew NetWalker NoEscape +14 more
T1485	Data Destruction	Impact	Dusk Banshee TeslaCrypt TorrentForce Black Basta (Post-Leak) ElectraHack TombDark LynxLeak +6 more
T1486	Data Encrypted for Impact	Impact	Armor TeslaCrypt TorrentForce MambaCrew ElectraHack Typhon Altair BlightFury +19 more
T1489	Service Stop	Impact	Dusk Armor TeslaCrypt Quantum Black Basta (Post-Leak) Lynx v2 Horde Harbinger +14 more
T1490	Inhibit System Recovery	Impact	RuinStorm NW Generation Black Basta (Post-Leak) Fracture Pixel CollapseGroup Yanluowang BlightFury +9 more
T1491.001	Internal Defacement	Impact	RuinStorm TorrentForce NW Generation Red Ransomware Minos TombDark Typhon HadesSec +15 more
T1529	System Shutdown/Reboot	Impact	Dusk TeslaCrypt RuinStorm NW Generation Fortress Minos MambaCrew TombDark +12 more
T1531	Account Access Removal	Impact	Red Ransomware Minos SingularityWare NetWalker FragmentDark LynxLeak Hades DominionStrike +12 more
T1561.001	Disk Wipe	Impact	Dusk Quantum Harbinger TombDark Typhon Gamma SingularityWare FateRage +12 more
T1005	Data from Local System	Other	Fog Cl0p
T1560.002	Archive via Library	Other	Fog
T1560.003	Archive via Custom Method	Other	Fog
T1056.001	Keylogging	Other	Cuba
T1071.001	Web Protocols	Other	Conti LockBit 3.0 Fog Maze REvil/Sodinokibi Cl0p
T1090	Proxy	Other	RansomHub
T1090.003	Multi-hop Proxy	Other	Cl0p
T1095	Non-Application Layer Protocol	Other	Royal
T1105	Ingress Tool Transfer	Other	Cuba Fog REvil/Sodinokibi Cl0p Conti
T1132.001	Standard Encoding	Other	LockBit 3.0
T1132.002	Non-Standard Encoding	Other	Cl0p
T1568	Dynamic Resolution	Other	Maze
T1571	Non-Standard Port	Other	Cl0p
T1572	Protocol Tunneling	Other	Cl0p
T1573.001	Symmetric Cryptography	Other	LockBit 3.0 Fog
T1573.002	Asymmetric Cryptography	Other	Cl0p REvil/Sodinokibi
T1003.001	LSASS Memory	Other	Qilin Pysa/Mespinoza
T1110	Brute Force	Other	Pysa/Mespinoza
T1552.001	Credentials In Files	Other	Pysa/Mespinoza
T1552.004	Private Keys	Other	Fog
T1040	Network Sniffing	Other	Fog
T1014	Rootkit	Other	Medusa
T1027	Obfuscated Files or Information	Other	Ryuk Cuba Conti AvosLocker Maze
T1027.001	Binary Padding	Other	BlackBasta
T1027.002	Software Packing	Other	Cuba LockBit 3.0 Babuk Cl0p
T1027.003	Steganography	Other	Conti
T1027.004	Compile After Delivery	Other	Fog
T1027.007	Dynamic API Resolution	Other	AvosLocker
T1027.011	Fileless Storage	Other	REvil/Sodinokibi
T1027.013	Encrypted/Encoded File	Other	Qilin RansomHub Medusa LockBit 3.0 Fog REvil/Sodinokibi
T1027.016	Junk Code Insertion	Other	Maze
T1036	Masquerading	Other	Fog Ryuk
T1036.004	Masquerade Task or Service	Other	Maze BlackBasta
T1036.005	Match Legitimate Resource Name or Location	Other	Cl0p REvil/Sodinokibi Ryuk Fog Pysa/Mespinoza BlackBasta Cuba
T1036.008	Masquerade File Type	Other	AvosLocker
T1070	Indicator Removal	Other	Maze
T1070.001	Clear Windows Event Logs	Other	LockBit 3.0 RansomHub BlackCat/ALPHV Qilin
T1070.004	File Deletion	Other	RansomHub Cuba LockBit 3.0 Medusa REvil/Sodinokibi Qilin Pysa/Mespinoza
T1070.006	Timestomp	Other	Cl0p
T1140	Deobfuscate/Decode Files or Information	Other	LockBit 3.0 Cl0p Babuk Fog Conti RansomHub AvosLocker Medusa +2 more
T1218.003	CMSTP	Other	LockBit 3.0
T1218.007	Msiexec	Other	Ragnar Locker Maze Cl0p
T1218.010	Regsvr32	Other	Ragnar Locker
T1218.011	Rundll32	Other	Ragnar Locker
T1222	File and Directory Permissions Modification	Other	Qilin
T1222.001	Windows File and Directory Permissions Modification	Other	Ryuk BlackCat/ALPHV
T1222.002	Linux and Mac File and Directory Permissions Modification	Other	BlackBasta
T1480	Execution Guardrails	Other	RansomHub LockBit 3.0 Qilin Akira
T1480.002	Mutual Exclusion	Other	Qilin LockBit 3.0 REvil/Sodinokibi BlackBasta
T1553.002	Code Signing	Other	BlackBasta Cl0p
T1562.001	Disable or Modify Tools	Other	Conti Ryuk REvil/Sodinokibi Cl0p Pysa/Mespinoza Babuk LockBit 3.0 Medusa +3 more
T1562.004	Disable or Modify System Firewall	Other	Cl0p
T1562.009	Safe Mode Boot	Other	REvil/Sodinokibi RansomHub BlackBasta LockBit 3.0 Qilin AvosLocker
T1564.003	Hidden Window	Other	LockBit 3.0 Medusa AvosLocker Cuba
T1564.006	Run Virtual Instance	Other	Maze Ragnar Locker
T1620	Reflective Code Loading	Other	Cuba Fog
T1679	Selective Exclusion	Other	Medusa
T1497	Virtualization/Sandbox Evasion	Other	BlackBasta
T1497.001	System Checks	Other	BlackBasta
T1497.003	Time Based Checks	Other	Cl0p RansomHub
T1622	Debugger Evasion	Other	BlackBasta LockBit 3.0
T1550	Use Alternate Authentication Material	Other	Fog
T1112	Modify Registry	Other	LockBit 3.0 REvil/Sodinokibi BlackCat/ALPHV BlackBasta Qilin Pysa/Mespinoza Cl0p
T1205	Traffic Signaling	Other	Ryuk
T1078.002	Domain Accounts	Other	Ryuk
T1078.003	Local Accounts	Other	LockBit 3.0
T1055	Process Injection	Other	REvil/Sodinokibi Ryuk
T1055.001	Dynamic-link Library Injection	Other	Maze Qilin Conti
T1134	Access Token Manipulation	Other	Qilin Cuba Ryuk BlackCat/ALPHV
T1134.001	Token Impersonation/Theft	Other	REvil/Sodinokibi
T1134.002	Create Process with Token	Other	REvil/Sodinokibi
T1484.001	Group Policy Modification	Other	LockBit 3.0 Qilin
T1007	System Service Discovery	Other	Medusa Qilin BlackBasta REvil/Sodinokibi Cuba Babuk
T1012	Query Registry	Other	REvil/Sodinokibi Qilin
T1016	System Network Configuration Discovery	Other	Pysa/Mespinoza Conti Cuba Qilin Royal Cl0p Ryuk
T1018	Remote System Discovery	Other	BlackCat/ALPHV BlackBasta RansomHub Conti Qilin
T1033	System Owner/User Discovery	Other	Conti BlackCat/ALPHV
T1046	Network Service Discovery	Other	Royal Pysa/Mespinoza
T1049	System Network Connections Discovery	Other	Babuk Maze Cuba Conti
T1057	Process Discovery	Other	Ryuk Conti Medusa Qilin Fog LockBit 3.0 Cl0p RansomHub +7 more
T1069.002	Domain Groups	Other	BlackCat/ALPHV REvil/Sodinokibi
T1082	System Information Discovery	Other	Maze Akira BlackBasta Royal Cl0p BlackCat/ALPHV REvil/Sodinokibi LockBit 3.0 +3 more
T1083	File and Directory Discovery	Other	Akira Conti Ryuk LockBit 3.0 Cuba Cl0p BlackBasta REvil/Sodinokibi +10 more
T1087.001	Local Account	Other	Qilin
T1087.002	Domain Account	Other	BlackCat/ALPHV
T1120	Peripheral Device Discovery	Other	INC Ransom LockBit 3.0 Ragnar Locker
T1124	System Time Discovery	Other	Medusa AvosLocker
T1135	Network Share Discovery	Other	Conti Medusa Cuba INC Ransom Qilin Akira LockBit 3.0 Royal +5 more
T1518.001	Security Software Discovery	Other	Cl0p Medusa
T1614	System Location Discovery	Other	Ragnar Locker
T1614.001	System Language Discovery	Other	Cuba Maze Ryuk Cl0p LockBit 3.0 REvil/Sodinokibi
T1652	Device Driver Discovery	Other	INC Ransom
T1654	Log Enumeration	Other	Akira
T1673	Virtual Machine Discovery	Other	Qilin
T1680	Local Storage Discovery	Other	Cuba LockBit 3.0 Medusa INC Ransom BlackCat/ALPHV Qilin BlackBasta Ryuk +3 more
T1047	Windows Management Instrumentation	Other	Akira INC Ransom BlackCat/ALPHV REvil/Sodinokibi LockBit 3.0 BlackBasta Maze
T1059.001	PowerShell	Other	RansomHub LockBit 3.0 REvil/Sodinokibi Akira Cuba Pysa/Mespinoza BlackBasta Medusa +1 more
T1059.003	Windows Command Shell	Other	REvil/Sodinokibi LockBit 3.0 RansomHub Ragnar Locker Cuba Ryuk Akira Babuk +6 more
T1059.005	Visual Basic	Other	REvil/Sodinokibi
T1059.006	Python	Other	Pysa/Mespinoza
T1059.012	Hypervisor CLI	Other	Royal
T1106	Native API	Other	Cl0p Babuk Cuba Ryuk AvosLocker INC Ransom Qilin LockBit 3.0 +8 more
T1129	Shared Modules	Other	Fog
T1204.001	Malicious Link	Other	Qilin
T1204.002	Malicious File	Other	REvil/Sodinokibi BlackBasta Qilin
T1559	Inter-Process Communication	Other	Medusa Cl0p
T1569.002	Service Execution	Other	Ragnar Locker LockBit 3.0 Pysa/Mespinoza
T1053.005	Scheduled Task	Other	LockBit 3.0 Qilin Ryuk Maze
T1041	Exfiltration Over C2 Channel	Other	Fog REvil/Sodinokibi Cl0p
T1485	Data Destruction	Other	Conti REvil/Sodinokibi
T1486	Data Encrypted for Impact	Other	Maze Ragnar Locker Royal Babuk REvil/Sodinokibi Conti Cuba Play +12 more
T1489	Service Stop	Other	Cl0p Royal Conti BlackCat/ALPHV Qilin LockBit 3.0 Babuk REvil/Sodinokibi +10 more
T1490	Inhibit System Recovery	Other	BlackBasta Ragnar Locker Play Ryuk Medusa INC Ransom Royal Babuk +10 more
T1491.001	Internal Defacement	Other	BlackBasta Conti RansomHub BlackCat/ALPHV Qilin INC Ransom
T1529	System Shutdown/Reboot	Other	Qilin Maze BlackBasta AvosLocker
T1561.001	Disk Content Wipe	Other	BlackCat/ALPHV
T1189	Drive-by Compromise	Other	REvil/Sodinokibi
T1190	Exploit Public-Facing Application	Other	Qilin
T1566	Phishing	Other	INC Ransom Royal
T1566.001	Spearphishing Attachment	Other	REvil/Sodinokibi Qilin
T1566.002	Spearphishing Link	Other	Qilin
T1021.001	Remote Desktop Protocol	Other	Pysa/Mespinoza
T1021.002	SMB/Windows Admin Shares	Other	Conti Ryuk Royal Qilin RansomHub LockBit 3.0
T1080	Taint Shared Content	Other	Conti
T1563.001	SSH Hijacking	Other	Medusa
T1570	Lateral Tool Transfer	Other	INC Ransom BlackCat/ALPHV
T1136	Create Account	Other	LockBit 3.0
T1542.002	Component Firmware	Other	Cl0p
T1037.004	RC Scripts	Other	Cl0p
T1543	Create or Modify System Process	Other	Akira
T1543.003	Windows Service	Other	Cuba LockBit 3.0 Medusa BlackBasta Ragnar Locker
T1547.001	Registry Run Keys / Startup Folder	Other	Maze LockBit 3.0 RansomHub AvosLocker Qilin Ryuk
T1547.004	Winlogon Helper DLL	Other	Qilin LockBit 3.0
T1574.001	DLL	Other	Fog
T1574.006	Dynamic Linker Hijacking	Other	Medusa
T1548.002	Bypass User Account Control	Other	LockBit 3.0 BlackCat/ALPHV Qilin

MITRE ATT&CK MATRIX