attacker_tools.csv

attacker_tool_names,description
advanced_port_scanner.exe,Advanced Port Scanner is a free network scanner allowing you to quickly find open ports on network computers and retrieve versions of programs running on the detected ports.
cain.exe,This process is associated with a tool used to collect user credentials and execute attacks.
certify.exe,A tool used to enumerate and abuse misconfigurations in Active Directory Certificate Services (AD CS)
certipy.exe,A tool used to enumerate and abuse misconfigurations in Active Directory Certificate Services (AD CS)
FolderContentsDeleteToFolderDelete.exe, This process is associated with code for taking advantage of filesystem-based exploit primitives.
FolderOrFileDeleteToSystem.exe, This process is associated with code for taking advantage of filesystem-based exploit primitives.
fscan.exe,Fscan is a tool used to scan for open ports and services on a network.
getmail.exe,This process is seen to be used by attackers to extract email files from host machines.
hash32.exe,This process is used to dump password hashes on a Windows system.
hash64.exe,This process is used to dump password hashes on a Windows system.
htran.exe,This process is used to dump password hashes on a Windows system.
isass.exe,This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
kidlogger.exe,This process is associated with a tool used to collect keyboard input on a host.
KPortScan3.exe, KPortScan 3.0 is a widely used port scanning tool on Hacking Forums to perform network scanning on the internal networks.
mailpv.exe,This process was identified by DHS Alert TA18-201A and attackers use this tool is a password-recovery tool that reveals the passwords and other account details from various email clients.
masscan.exe,This executable was delivered in the XMRig Crypto Miner
Massscan_GUI.exe,This executable was delivered in the XMRig Crypto Miner
mimikatz.exe,Mimikatz is an open-source application that allows users to view and save authentication credentials such as Kerberos tickets.
mm32.exe,This is a process name was seen being used as a rename of mimikatz.exe.
mm64.exe,This is a process name was seen being used as a rename of mimikatz.exe.
nc.exe,This process is an open source tool used for network communications.
netpass.exe,This process was identified as malicious by DHS Alert TA18-201A and attackers use this tool to recover all network passwords stored on your system for the current logged-on user.
NLAChecker.exe,A scanner tool that checks for Windows hosts for Network Level Authentication. This tool allows attackers to detect Windows Servers with RDP without NLA enabled which facilitates the use of brute force non microsoft rdp tools or exploits
NLBrute.exe,A RDP brute force tool found in botnets for further expansion and and acquisition of targets. This process was identified in the SamSam Ransomware Campaign and attackers use this tool to brute force RDP instances with a range of commonly used passwords.
nmap.exe,This process is an open source network mapping tool used to identify hosts and listening services on a network.
netscan.exe,NetScan is a network scanning tool used to discover hosts and services on a network. It is commonly leveraged by threat actors during the discovery phase to enumerate active hosts and open ports within a target environment.
ns.exe,A commonly used tool used by attackers to scan and map file shares
ntdll.exe,This process was identified as malicious by DHS Alert TA18-074A.
OutlookAddressBookView.exe,This process was identified as malicious by DHS Alert TA18-201A and is used by attackers to steal the details of all recipients stored in the address books of Microsoft Outlook.
pwdump.exe,This process is associated with a tool used to dump password hashes on a Windows system.
pwdump2.exe,This process is associated with a tool used to dump password hashes on a Windows system.
quarkpwdMtCrt.exe,This process is associated with a tool used to dump password hashes on a Windows system.
remcom.exe,This process is an open source replacement to psexec and is not typically seen in an enterprise environment.
seatbelt.exe,A tool used to collect detailed information about a system—such as remote access configurations network shares and other security-relevant data on victim machine.
selfdel.exe,This executable was delivered in the SamSam Ransomware Campaign and the attackers leveraged this binary to delete its malicious activities.
SharpGPOAbuse.exe,SharpGPOAbuse is a tool that allows you to abuse and enumerate GPOs on a Windows system.
SharpHide.exe,SharpHide is a tool that allows you to hide a process from the task manager.
SharpStay.exe,SharpStay is a tool that allows you to stay hidden from the task manager.
sharpTask.exe,SharpTask is a tool that allows you to create scheduled tasks on a Windows system.
SilverBullet.exe,Malware was discovered in our monitoring of honey pots that abuses this open source software for scanning and connecting to hosts.
svch0st.exe,This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process.
wce.exe,This process is associated with a tool used to dump hashes and execute pass-the-hash and pass-the-ticket attacks.
wce32.exe,This process is associated with a tool used to dump hashes and execute pass-the-hash and pass-the-ticket attacks.
wce64.exe,This process is associated with a tool used to dump hashes and execute pass-the-hash and pass-the-ticket attacks.
WebBrowserPassView.exe,This process was identified as malicious by DHS Alert TA18-201A and is used by attackers as a password recovery tool that reveals the passwords stored in Web Browsers.