TeamTNT has the

TeamTNT has also used a custom user agent HTTP header in shell scripts.(Citation: Trend Micro TeamTNT)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1070.003|Clear Command History|

TeamTNT has cleared command history with

TeamTNT has run

TeamTNT has also used

TeamTNT has checked for running containers with

TeamTNT has also searched for Kubernetes pods running in a local network.(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|PRE|T1595.001|Scanning IP Blocks|

TeamTNT has scanned specific lists of target IP addresses.(Citation: Trend Micro TeamTNT)|
|mitre-attack|enterprise-attack|IaaS|T1552.005|Cloud Instance Metadata API|

TeamTNT has queried the AWS instance metadata service for credentials.(Citation: Trend Micro TeamTNT)(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|Linux|T1543.002|Systemd Service|

TeamTNT has established persistence through the creation of a cryptocurrency mining system service using

TeamTNT has encrypted its binaries via AES and encoded files using Base64.(Citation: Trend Micro TeamTNT)(Citation: Aqua TeamTNT August 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

TeamTNT has searched for rival malware and removes it if found.(Citation: Trend Micro TeamTNT)

TeamTNT has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools.(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|PRE|T1595.002|Vulnerability Scanning|

TeamTNT has scanned for vulnerabilities in IoT devices and other related resources such as the Docker API.(Citation: Trend Micro TeamTNT)|
|mitre-attack|enterprise-attack|macOS,Linux|T1222.002|Linux and Mac File and Directory Permissions Modification|

TeamTNT has modified the permissions on binaries with