Meta tags:

Headings (most frequently used words):

tajmahal, techniques, used, references, enterprise, layer,

Text of the page (most frequently used words):
the (34), tajmahal (30), #enterprise (29), has (24), ability (22), and (14), att (11), all (10), host (9), data (8), discovery (8), infected (8), from (8), software (7), capture (7), files (7), system (6), identify (6), use (5), ics (5), mobile (5), none (5), steal (5), version (5), mitre (4), techniques (4), information (4), for (4), plugins (4), are (3), cti (3), defenses (3), local (3), 001 (3), into (3), running (3), processes (3), windows (3), can (3), drives (3), removable (3), exfiltration (3), queue (3), automated (3), 2026 (2), corporation (2), cookie (2), domains (2), resources (2), reference (2), campaigns (2), groups (2), components (2), analytics (2), detection (2), strategies (2), assets (2), mitigations (2), tactics (2), matrices (2), core (2), objects (2), 2019 (2), april (2), framework (2), october (2), video (2), time (2), name (2), web (2), session (2), internet (2), explorer (2), navigator (2), applications (2), anti (2), products (2), inject (2), including (2), library (2), injection (2), process (2), connected (2), used (2), file (2), printers (2), print (2), index (2), send (2), collected (2), over (2), its (2), clipboard (2), compress (2), audio (2), open (2), archive (2), s0467 (2), ckcon (2), person (2), tickets (2), faq (2), 2015, registered, trademarks, preferences, website, changelog, privacy, policy, terms, contact, reset, filters, sub, great, project, sophisticated, new, apt, retrieved, references, webcam, t1125, determine, compromised, t1124, mac, address, network, configuration, t1016, hardware, computer, t1082, cookies, netscape, firefox, realnetworks, t1539, which, virus, firewalls, spyware, security, t1518, call, template, dll, loadlibrary, shared, modules, t1129, take, screenshots, capturing, content, instant, messaging, screen, t1113, dlls, malicious, dynamic, link, t1055, associated, t1057, apple, devices, peripheral, device, t1120, encrypted, virtual, store, obfuscated, t1027, set, attribute, configured, enable, document, stealing, microsoft, currentversion, keepprintedjobs, modify, registry, t1112, keystrokes, keylogging, input, t1056, user, profiles, directory, t1083, channel, t1041, written, images, interest, previously, when, they, become, available, again, media, t1025, documents, spooler, t1005, t1115, manage, egress, commands, sent, t1020, collection, t1119, voiceip, application, t1123, source, libraries, xzip, xunzip, zlib, via, 002, t1560, domain, view, download, layer, layers, live, permalink, 2025, last, modified, june, 2020, created, platforms, malware, type, multifunctional, spying, that, been, since, least, 2014, comprised, two, separate, packages, named, tokyo, yokohama, deploy, home, join, mclean, hotel, location, details, found, register, here, search, blog, contribute, benefactors, legal, branding, updates, history, engage, with, tools, advisory, council, learn, more, about, get, started, detections,

Text of the page (random words):
tajmahal software s0467 mitre att ck matrices enterprise mobile ics tactics enterprise mobile ics techniques enterprise mobile ics defenses mitigations enterprise mobile ics assets detections detection strategies analytics data components cti groups software campaigns resources get started learn more about att ck att ck advisory council att ckcon att ck data tools faq engage with att ck version history updates legal branding benefactors contribute blog search att ckcon 7 0 in person tickets are open join us october 27 28 2026 in mclean va register here for in person tickets hotel and location details can be found in the faq home software tajmahal tajmahal tajmahal is a multifunctional spying framework that has been in use since at least 2014 tajmahal is comprised of two separate packages named tokyo and yokohama and can deploy up to 80 plugins 1 id s0467 ⓘ type malware ⓘ platforms windows version 1 0 created 08 june 2020 last modified 25 april 2025 version permalink live version att ck navigator layers enterprise layer download view techniques used domain id name use enterprise t1560 002 archive collected data archive via library tajmahal has the ability to use the open source libraries xzip xunzip and zlib to compress files 1 enterprise t1123 audio capture tajmahal has the ability to capture voiceip application audio on an infected host 1 enterprise t1119 automated collection tajmahal has the ability to index and compress files into a send queue for exfiltration 1 enterprise t1020 automated exfiltration tajmahal has the ability to manage an automated queue of egress files and commands sent to its c2 1 enterprise t1115 clipboard data tajmahal has the ability to steal data from the clipboard of an infected host 1 enterprise t1005 data from local system tajmahal has the ability to steal documents from the local system including the print spooler queue 1 enterprise t1025 data from removable media tajmahal has the ability to steal written cd images and files of interest from previously connected removable drives when they become available again 1 enterprise t1041 exfiltration over c2 channel tajmahal has the ability to send collected files over its c2 1 enterprise t1083 file and directory discovery tajmahal has the ability to index files from drives user profiles and removable drives 1 enterprise t1056 001 input capture keylogging tajmahal has the ability to capture keystrokes on an infected host 1 enterprise t1112 modify registry tajmahal can set the keepprintedjobs attribute for configured printers in software microsoft windows nt currentversion print printers to enable document stealing 1 enterprise t1027 obfuscated files or information tajmahal has used an encrypted virtual file system to store plugins 1 enterprise t1120 peripheral device discovery tajmahal has the ability to identify connected apple devices 1 enterprise t1057 process discovery tajmahal has the ability to identify running processes and associated plugins on an infected host 1 enterprise t1055 001 process injection dynamic link library injection tajmahal has the ability to inject dlls for malicious plugins into running processes 1 enterprise t1113 screen capture tajmahal has the ability to take screenshots on an infected host including capturing content from windows of instant messaging applications 1 enterprise t1129 shared modules tajmahal has the ability to inject the loadlibrary call template dll into running processes 1 enterprise t1518 software discovery tajmahal has the ability to identify the internet explorer ie version on an infected host 1 001 security software discovery tajmahal has the ability to identify which anti virus products firewalls and anti spyware products are in use 1 enterprise t1539 steal web session cookie tajmahal has the ability to steal web session cookies from internet explorer netscape navigator firefox and realnetworks applications 1 enterprise t1082 system information discovery tajmahal has the ability to identify hardware information the computer name and os information on an infected host 1 enterprise t1016 system network configuration discovery tajmahal has the ability to identify the mac address on an infected host 1 enterprise t1124 system time discovery tajmahal has the ability to determine local time on a compromised host 1 enterprise t1125 video capture tajmahal has the ability to capture webcam video 1 references great 2019 april 10 project tajmahal a sophisticated new apt framework retrieved october 14 2019 core objects all core att ck objects all none matrices tactics techniques sub techniques defenses all defenses all none mitigations assets detection strategies analytics data components cti all cti all none groups software campaigns reference all reference all none resources domains all domains all none enterprise mobile ics reset filters contact us terms of use privacy policy website changelog cookie preferences 2015 2026 the mitre corporation mitre att ck and att ck are registered trademarks of the mitre corporation