madox81/Adema_ATTACK_DS huggingface dataset:
Input: Attor's dispatcher can inject itself into running processes to gain higher privileges and to evade detection.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Monitor executed commands and arguments associated with making configuration changes to boot settings, such as bcdedit.exe and bootcfg.exe.

Tactics: TA0005
Techniques: T1562.009, T1562
Input: ScreenSaveTimeout - sets user inactivity timeout before screensaver is executed

Tactics: TA0003, TA0004
Techniques: T1546, T1546.002
Input: Hi-Zor deletes its RAT installer file as it executes its DLL payload file.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Axiom has been known to dump credentials.

Tactics: TA0006
Techniques: T1003
Input: Clambling has the ability to use Telnet for communication.

Tactics: TA0011
Techniques: T1071
Input: PROMETHIUM has used watering hole attacks to deliver malicious versions of legitimate installers.

Tactics: TA0001
Techniques: T1189
Input: Adversaries may abuse the RTLO character as a means of tricking a user into executing what they think is a benign file type.

Tactics: TA0005
Techniques: T1036, T1036.002
Input: Andariel has conducted spearphishing campaigns that included malicious Word or Excel attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Goopy has the ability to side-load malicious DLLs with legitimate applications from Kaspersky, Microsoft, and Google.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: Ke3chang has gained access through VPNs including with compromised accounts and stolen VPN certificates.

Tactics: TA0001, TA0003
Techniques: T1133
Input: iKitten collects the keychains on the system.

Tactics: TA0006
Techniques: T1555.001, T1555
Input: An APT32 backdoor can use HTTP over a non-standard TCP port (e.g 14146) which is specified in the backdoor configuration.

Tactics: TA0011
Techniques: T1571
Input: Creating a new instance may allow an adversary to bypass firewall rules and permissions that exist on instances currently residing within an account.

Tactics: TA0005
Techniques: T1578.002, T1578
Input: Axiom has used RDP during operations.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: FELIXROOT collects the username from the victim’s machine.

Tactics: TA0007
Techniques: T1033
Input: WINERACK can gather information on the victim username.

Tactics: TA0007
Techniques: T1033
Input: Valak has the ability to enumerate local admin accounts.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Dark Caracal spearphished victims via Facebook and Whatsapp.

Tactics: TA0001
Techniques: T1566.003, T1566
Input: FoggyWeb can retrieve configuration data from a compromised AD FS server.

Tactics: TA0009
Techniques: T1005
Input: Figure 5 shows Phishery’s output to the command that injects a URL into a file named “good_test.docx”, which it will save the resulting file to “bad_test.docx”

Tactics: TA0004, TA0005
Techniques: T1055
Input: Net Crawler uses a list of known credentials gathered through credential dumping to guess passwords to accounts as it spreads throughout a network.

Tactics: TA0006
Techniques: T1110, T1110.002
Input: In default environments, LDAP and Kerberos connection attempts are less likely to trigger events over SMB, which creates Windows "logon failure" event ID 4625.

Tactics: TA0006
Techniques: T1110, T1110.001, T1110.003
Input: Epic recursively searches for all .doc files on the system and collects a directory listing of the Desktop, %TEMP%, and %WINDOWS%\Temp directories.

Tactics: TA0007
Techniques: T1083
Input: down_new has the ability to gather information on installed applications.

Tactics: TA0007
Techniques: T1518
Input: GravityRAT has used HTTP over a non-standard port, such as TCP port 46769.

Tactics: TA0011
Techniques: T1571
Input: OilRig used the Plink utility and other tools to create tunnels to C2 servers.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: A FinFisher variant uses DLL search order hijacking.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence.

Tactics: TA0003
Techniques: T1505.004, T1505
Input: Executing browser-based behaviors such as pivoting may require specific process permissions, such as SeDebugPrivilege and/or high-integrity/administrator rights.

Tactics: TA0009
Techniques: T1185
Input: Each .timer file must have a corresponding .service file with the same name, , example.timer and example.service.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.006, T1053
Input: Adversaries may also leverage a Network Device CLI on network devices to discover password policy information.

Tactics: TA0007
Techniques: T1201
Input: Figure 3 Targeted lure content In one of the documents, the victim is presented with what appears to be an obfuscated document with the NATO EOD seal and text alluding to the targeted nation state

Tactics: TA0005
Techniques: T1027
Input: Monitor library metadata, such as a hash, and compare libraries that are loaded at process execution time against previous executions to detect differences that do not correlate with patching or updates.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.006, T1574
Input: DarkHydrus has sent spearphishing emails with password-protected RAR archives containing malicious Excel Web Query files (.iqy).

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Mustang Panda has sent malicious links including links directing victims to a Google Drive folder.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Many email clients allow users to create inbox rules for various email functions, including moving emails to other folders, marking emails as read, or deleting emails.

Tactics: TA0005
Techniques: T1564, T1564.008
Input: It also deleted previously-created Image File Execution Options (IFEO) Debugger registry values and registry keys related to HTTP proxy to clean up traces of its activity.

Tactics: TA0005
Techniques: T1112
Input: For many networks there should not be any, but it depends on how systems on the network are configured and where resources are located.

Tactics: TA0006
Techniques: T1187
Input: On a MSSQL Server, consider monitoring for xp_cmdshell usage.

Tactics: TA0003
Techniques: T1505.001, T1505
Input: Lock PowerShell Execution Policy, must be set to “AllSigned” via GPO

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Pysa can perform network reconnaissance using the Advanced IP Scanner tool.

Tactics: TA0007
Techniques: T1016
Input: Ruler can be used to automate the abuse of Outlook Home Pages to establish persistence.

Tactics: TA0003
Techniques: T1137, T1137.004
Input: Disable or block remotely available services that may be unnecessary.

Tactics: TA0001, TA0003
Techniques: T1133
Input: The login shell executes scripts from the system (/etc) and the user’s home directory (~/) to configure the environment.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: Grandoreiro can identify installed security tools based on process names.

Tactics: TA0007
Techniques: T1057
Input: WIRTE has sent emails to intended victims with malicious MS Word and Excel attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: For the Outlook methods, blocking macros may be ineffective as the Visual Basic engine used for these features is separate from the macro scripting engine.

Tactics: TA0003
Techniques: T1137, T1137.004, T1137.003, T1137.005
Input: An adversary may abuse configurations where an application has the setuid or setgid bits set in order to get code running in a different (and possibly more privileged) user’s context.

Tactics: TA0004, TA0005
Techniques: T1548, T1548.001
Input: TinyZBot can disable Avira anti-virus.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Monitor interactions with images and containers by users to identify ones that are modified anomalously.In containerized environments, changes may be detectable by monitoring the Docker daemon logs or setting up and monitoring Kubernetes audit logs depending on registry configuration.

Tactics: TA0003
Techniques: T1525
Input: Websites compromised by an adversary and used to stage a drive-by may be ones visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest.

Tactics: TA0042
Techniques: T1608.004, T1608
Input: NETWIRE has been spread via e-mail campaigns utilizing malicious attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: TajMahal has the ability to take screenshots on an infected host including capturing content from windows of instant messaging applications.

Tactics: TA0009
Techniques: T1113
Input: Some variants of FakeM use RC4 to encrypt C2 traffic.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: An adversary may obtain root access (allowing them to read securityd’s memory), then they can scan through memory to find the correct sequence of keys in relatively few tries to decrypt the user’s logon keychain.

Tactics: TA0006
Techniques: T1555.002, T1555
Input: Passwords are stored in several places on a system, depending on the operating system or application holding the credentials.

Tactics: TA0006
Techniques: T1555
Input: Zeus Panda encrypts strings with XOR and obfuscates the macro code from the initial payload.

Tactics: TA0005
Techniques: T1027
Input: To establish persistence, Okrum can install itself as a new service named NtmSsvc.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Zebrocy uses netstat -aon to gather network connection information.

Tactics: TA0007
Techniques: T1049
Input: NDiskMonitor uses AES to encrypt certain information sent over its C2 channel.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: ScreenSaverIsSecure - set to '0' to not require a password to unlock

Tactics: TA0003, TA0004
Techniques: T1546, T1546.002
Input: Unpacking routine for SWF exploit The exploit is a memory corruption vulnerability that exists in the “com.adobe.tvsdk.mediacore.BufferControlParameters” class.  If the exploit is successful, it will gain arbitrary read / write operations within memory, thus allowing it to execute a second stage shellcode

Tactics: TA0002, TA0004
Techniques: T1203, T1068
Input: For example, on macOS systems the screensharingd process may be related to VNC connection activity.

Tactics: TA0008
Techniques: T1021.005, T1021
Input: Chaes has collected system information, including the machine name and OS version.

Tactics: TA0007
Techniques: T1082
Input: Adversaries can direct BACKSPACE to upload files to the C2 Server.

Tactics: TA0010
Techniques: T1041
Input: Winlogon.exe is a Windows component responsible for actions at logon/logoff as well as the secure attention sequence (SAS) triggered by Ctrl-Alt-Delete.

Tactics: TA0003, TA0004
Techniques: T1547.004, T1547
Input: Lazarus Group malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.

Tactics: TA0003
Techniques: T1098
Input: Monitor for changes made to files related to account settings, such as /etc/ssh/sshd_config and the authorized_keys file for each user on a system.

Tactics: TA0003
Techniques: T1098
Input: Monitor for file modifications that collects information on file handle opens and can compare timestamp values

Tactics: TA0005
Techniques: T1070, T1070.006
Input: BRONZE BUTLER has created forged Kerberos Ticket Granting Ticket (TGT) and Ticket Granting Service (TGS) tickets to maintain administrative access.

Tactics: TA0005, TA0008
Techniques: T1550.003, T1550
Input: There are many utilities used for software development related tasks that can be used to execute code in various forms to assist in development, debugging, and reverse engineering.

Tactics: TA0005
Techniques: T1127
Input: The first dropped file, doc.exe, contains the CVE-2014-4113 exploit and then attempts to execute test.exe with the elevated privileges

Tactics: TA0004
Techniques: T1068
Input: Bandook has used lure documents to convince the user to enable macros.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: HawkEye offers the following exfiltration options based on the configuration: email, FTP, SFTP, HTTP POST to PanelURL API or ProxyURL.As mentioned above, in the comments of the main loop section, it also comes with several anti-analysis features, including starting an anti-debugging thread or disabling certain AV-related programs via the Image File Execution Options (IFEO) evasion technique by registering invalid debuggers that redirect and effectively disable various system and security applications.The following diagram summarizes the full infection process:ConclusionRecent changes in both the ownership and development efforts of the HawkEye Reborn keylogger/stealer demonstrate that this is a threat that will continue to experience ongoing development and improvement moving forward

Tactics: TA0005, TA0011
Techniques: T1071, T1562.001, T1562
Input: ThiefQuest can download and execute payloads in-memory or from disk.

Tactics: TA0011
Techniques: T1105
Input: menuPass has registered malicious domains for use in intrusion campaigns.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: Elise injects DLL files into iexplore.exe.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Also consider analyzing hook chains (which hold pointers to hook procedures for each type of hook) using tools or by programmatically examining internal kernel structures.

Tactics: TA0006, TA0009
Techniques: T1056.004, T1056
Input: MoonWind can delete itself or specified files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: An adversary may hijack the execution flow of a process using the KernelCallbackTable by replacing an original callback function with a malicious payload.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.013, T1574
Input: The resulting plaintext password resulting from a successfully cracked hash may be used to log into systems, resources, and services in which the account has access.

Tactics: TA0006
Techniques: T1110, T1110.002
Input: We suspect the attacker was trying to generate sympathy by reminding the reader that Munchon and the province it is in, Kangwon, were part of a unified province that included South Korea's Gangwon-do prior to the division of Korea in 1945.A second email contained a story about a person called 'Ewing Kim' who was looking for help:The email's attachments are two different HWP documents, both leveraging same vulnerability (CVE-2013-0808)

Tactics: TA0001
Techniques: T1566, T1566.001
Input: TeamTNT has added batch scripts to the startup folder.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: REvil can connect to and disable the Symantec server on the victim's network.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Microsoft Office is a fairly common application suite on Windows-based operating systems within an enterprise network.

Tactics: TA0003
Techniques: T1137
Input: However, the campaign that the PDC has recently observed has been delivering this keylogger exclusively

Tactics: TA0006, TA0009
Techniques: T1056
Input: Symantec determined a more accurate picture of Buckeye’s targets by looking at where Buckeye remained active on the network longer than a day, deployed additional tools, and spread onto multiple computers

Tactics: TA0011
Techniques: T1105
Input: Figure 2: WindowsParentalControlsMigration CommandLineTemplate Figure 3 contains the decoded PowerShell command from the “CommandLineTemplate.”      Figure 3: Decoded CommandLineTemplate PowerShell code POSHSPY PowerShell Component The full code for a POSHSPY sample is available here

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Monitor for newly assigned drive letters or mount points to a data storage device that may attempt to exfiltrate data over a USB connected physical device.

Tactics: TA0010
Techniques: T1052, T1052.001
Input: For user level permissions, adversaries can insert malicious commands into ~/.bash_profile, ~/.bash_login, or ~/.profile which are sourced when a user opens a command-line interface or connects remotely.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: Attor's installer plugin can schedule a new task that loads the dispatcher on boot/logon.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Explosive can scan all .exe files located in the USB drive.

Tactics: TA0009
Techniques: T1025
Input: Monitor for newly constructed files for files named after partial directories and in locations that may be searched for common processes through the environment variable, or otherwise should not be user writable.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.007, T1574
Input: TrickBot establishes persistence in the Startup folder.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: overwrite or delete MBR in same sentence

Tactics: TA0040
Techniques: T1561, T1561.002
Input: Command arguments used with the rundll32.exe invocation may also be useful in determining the origin and purpose of the DLL being loaded.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Adversaries may post content, known as a dead drop resolver, on Web services with embedded (and often obfuscated/encoded) domains or IP addresses.

Tactics: TA0011
Techniques: T1102.001, T1102
Input: Ursnif has used HTTP POSTs to exfil gathered information.

Tactics: TA0010
Techniques: T1041
Input: A login hook is a plist file that points to a specific script to execute with root privileges upon user logon.

Tactics: TA0003, TA0004
Techniques: T1037.002, T1037
Input: Okrum uses HTTP for communication with its C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Monitor newly executed processes that may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

Tactics: TA0007
Techniques: T1082
Input: PUNCHTRACK aggregates collected data in a tmp file.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Use multi-factor authentication on remote service logons where possible.

Tactics: TA0008
Techniques: T1021
Input: Information repositories generally have a considerably large user base, detection of malicious use can be non-trivial.

Tactics: TA0009
Techniques: T1213
Input: PlugX has the ability to use DLL search order hijacking for installation on targeted systems.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: admin@338 has sent emails with malicious Microsoft Office documents attached.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: LazyScripter has used spam emails that contain a link that redirects the victim to download a malicious document.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Penquin can use Cron to create periodic and pre-scheduled background jobs.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: After creating a new service for persistence, TDTESS sets the file creation time for the service to the creation time of the victim's legitimate svchost.exe file.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: Turla established persistence by adding a Shell value under the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon.

Tactics: TA0003, TA0004
Techniques: T1547.004, T1547
Input: HTRAN can install a rootkit to hide network connections from the host OS.

Tactics: TA0005
Techniques: T1014
Input: Time-based evasion will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.

Tactics: TA0006, TA0007
Techniques: T1003.003, T1087.002, T1003, T1087
Input: Gamaredon Group has registered domains to stage payloads.

Tactics: TA0042
Techniques: T1608.001, T1608
Input: Ryuk has used the Windows command line to create a Registry entry under HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: ARD leverages a blend of protocols, including VNC to send the screen and control buffers and SSH for secure file transfer.

Tactics: TA0008
Techniques: T1021
Input: This manipulation may result in elevated access to local resources and/or access to otherwise inaccessible domains via lateral movement techniques such as Remote Services, SMB/Windows Admin Shares, or Windows Remote Management.

Tactics: TA0004, TA0005
Techniques: T1134.005, T1134
Input: PowerSploit contains a collection of ScriptModification modules that compress and encode scripts and payloads.

Tactics: TA0005
Techniques: T1027
Input: Ferocious has the ability to use Visual Basic scripts for execution.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Hikit has used DLL Search Order Hijacking to load oci.dll as a persistence mechanism.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Monitor for newly constructed drive letters or mount points to removable media

Tactics: TA0001, TA0008
Techniques: T1091
Input: Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult.

Tactics: TA0011
Techniques: T1001, T1001.002
Input: Emotet has been observed leveraging a module that scrapes email data from Outlook.

Tactics: TA0009
Techniques: T1114, T1114.001
Input: Ferocious Kitten has named malicious files update.exe and loaded them into the compromise host's "Public" folder.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: They include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct.

Tactics: TA0042
Techniques: T1588.004, T1588, T1587, T1587.003
Input: UACMe contains many methods for bypassing Windows User Account Control on multiple versions of the operating system.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Remsec contains a keylogger component.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: HermeticWiper has the ability to deploy through an infected system's default domain policy.

Tactics: TA0004, TA0005
Techniques: T1484.001, T1484
Input: QakBot can deobfuscate and re-assemble code strings for execution.

Tactics: TA0005
Techniques: T1140
Input: Monitor executed commands and arguments of vaultcmd.exe for suspicious activity, such as listing credentials from the Windows Credentials locker (, vaultcmd /listcreds:"Windows Credentials").

Tactics: TA0006
Techniques: T1555, T1555.004
Input: Two common accessibility programs are C:\Windows\System32\sethc.exe, launched when the shift key is pressed five times and C:\Windows\System32\utilman.exe, launched when the Windows + U key combination is pressed.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: This information may also include specifics regarding network devices (gateways, routers, ) and other infrastructure.

Tactics: TA0043
Techniques: T1590, T1590.004
Input: Downdelph uses search order hijacking of the Windows executable sysprep.exe to escalate privileges.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls.

Tactics: TA0004, TA0005
Techniques: T1134
Input: Consider implementing IT disaster recovery plans that contain procedures for regularly taking and testing data backups that can be used to restore organizational data.

Tactics: TA0040
Techniques: T1486
Input: APT3 replaces the Sticky Keys binary C:\Windows\System32\sethc.exe for persistence.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: Sandworm Team has scanned network infrastructure for vulnerabilities as part of its operational planning.

Tactics: TA0043
Techniques: T1595, T1595.002
Input: TeamTNT has searched for system version and architecture information.

Tactics: TA0007
Techniques: T1082