madox81/Adema_ATTACK_DS huggingface dataset:
Input: Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.014
Input: When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Account Control).

Tactics: TA0006, TA0009
Techniques: T1056.002, T1056
Input: The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group.

Tactics: TA0007
Techniques: T1069.002, T1069
Input: Axiom has used large groups of compromised machines for use as proxy nodes.

Tactics: TA0042
Techniques: T1584, T1584.005
Input: RainyDay has used names to mimic legitimate software including "vmtoolsd.exe" to spoof Vmtools.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Adversaries may use credentials obtained from breach dumps of unrelated accounts to gain access to target accounts through credential overlap.

Tactics: TA0006
Techniques: T1110.004, T1110
Input: SodaMaster has the ability to put itself to "sleep" for a specified time.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Higaisa used HTTP and HTTPS to send data back to its C2 server.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Pysa has laterally moved using RDP connections.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications.

Tactics: TA0005
Techniques: T1564, T1564.009
Input: TYPEFRAME variants can add malicious DLL modules as new services.TYPEFRAME can also delete services from the victim’s machine.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: CARROTBAT has the ability to determine the operating system of the compromised host and whether Windows is being run with x86 or x64 architecture.

Tactics: TA0007
Techniques: T1082
Input: They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket.

Tactics: TA0009
Techniques: T1213, T1213.003
Input: The module loader can load DLLs via EXPORT forwarded to another DLL, specified with (fully-qualified or relative) pathname (but without extension);

Tactics: TA0002
Techniques: T1129
Input: Similar to a standard ACL, DACLs identifies the accounts that are allowed or denied access to a securable object.

Tactics: TA0005
Techniques: T1222, T1222.001
Input: In some cases it may be possible to pivot on known pieces of information to uncover other adversary infrastructure.

Tactics: TA0042
Techniques: T1587
Input: Shamoon attempts to copy itself to remote machines on the network.

Tactics: TA0008
Techniques: T1570
Input: Cobalt Strike can collect data from a local system.

Tactics: TA0009
Techniques: T1005
Input: Adversaries may send spearphishing messages with a malicious link to elicit sensitive information that can be used during targeting.

Tactics: TA0043
Techniques: T1598, T1598.003
Input: Stealth Falcon malware gathers the Address Resolution Protocol (ARP) table from the victim.

Tactics: TA0007
Techniques: T1016
Input: Kwampirs collects a list of domain groups with the command net localgroup /domain.

Tactics: TA0007
Techniques: T1069.002, T1069
Input: Ke3chang has used batch scripts in its malware to install persistence mechanisms.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: APT32 has abused the PasswordChangeNotify to monitor for and capture account password changes.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Monitor executed commands and arguments that may leverage Microsoft Office-based applications for persistence between startups.

Tactics: TA0003
Techniques: T1137
Input: Kimsuky has collected victim employee name information.

Tactics: TA0043
Techniques: T1589.003, T1589
Input: AdFind can enumerate domain groups.

Tactics: TA0007
Techniques: T1069.002, T1069
Input: FIN7 actors have mailed USB drives to potential victims containing malware that downloads and installs various backdoors, including in some cases for ransomware operations.

Tactics: TA0001, TA0008
Techniques: T1091
Input: Timers can be set to run on a calendar event or after a time span relative to a starting point.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.006, T1053
Input: Dtrack packs collected data into a password protected archive.

Tactics: TA0009
Techniques: T1560
Input: A scheduled task is also generated to maintain persistence of the payload

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: ChChes copies itself to an .exe file with a filename that is likely intended to imitate Norton Antivirus but has several letters reversed ( notron.exe).

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Misdat is capable of running commands to obtain a list of files and directories, as well as enumerating logical drives.

Tactics: TA0007
Techniques: T1083
Input: APT18 can upload a file to the victim’s machine.

Tactics: TA0011
Techniques: T1105
Input: Adversaries may also obtain leaked credentials in source repositories, logs, or other means as a way to gain access to cloud storage objects that have access permission controls.

Tactics: TA0009
Techniques: T1530
Input: Monitor for execution of commands and arguments associated with enumeration or information gathering of local accounts and groups such as net user, net account, net localgroup, Get-LocalUser, and  dscl.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Attack Flow and Exfiltration After injecting into the targeted processes, the modules continue their malicious activity through those processes

Tactics: TA0004, TA0005, TA0007
Techniques: T1057, T1055
Input: Information about victim domains and their properties may also be exposed to adversaries via online or other accessible data sets (ex: WHOIS).

Tactics: TA0043
Techniques: T1590, T1590.001
Input: Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about computers listed in AD.

Tactics: TA0007
Techniques: T1018
Input: Dtrack can remove its persistence and delete itself.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: A 256-bit AES session key is generated and used to encrypt both message headers and bodies separately

Tactics: TA0011
Techniques: T1573
Input: Use of a dead drop resolver may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).

Tactics: TA0011
Techniques: T1102.001, T1102
Input: Monitor for newly executed processes when removable media is mounted

Tactics: TA0010
Techniques: T1052, T1052.001
Input: menuPass executes commands using a command-line interface and reverse shell.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: CaddyWiper can work alphabetically through drives on a compromised system to take ownership of and overwrite all files.

Tactics: TA0040
Techniques: T1485
Input: SpeakUp uses the ifconfig -a command.

Tactics: TA0007
Techniques: T1016
Input: Raindrop used a custom packer for its Cobalt Strike payload, which was compressed using the LZMA algorithm.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Since it may be signed and native on Windows systems, msiexec.exe can be used to bypass application control solutions that do not account for its potential abuse.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way.

Tactics: TA0043, TA0001
Techniques: T1598.001, T1566.003, T1566, T1598
Input: SMOKEDHAM has used reg.exe to create a Registry Run key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Chaes has decrypted an AES encrypted binary file to trigger the download of other files.

Tactics: TA0005
Techniques: T1140
Input: Ensure that all accounts use the least privileges they require.

Tactics: TA0003
Techniques: T1098, T1098.003
Input: ShimRat has been delivered as a package that includes compressed DLL and shellcode payloads within a .dat file.

Tactics: TA0005
Techniques: T1027
Input: Calisto runs the ifconfig command to obtain the IP address from the victim’s machine.

Tactics: TA0007
Techniques: T1016
Input: Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: The x command treats the supplied data as a PowerShell script that it will write to the current PowerShell script (Office365DCOMCheck.ps1/SystemDiskClean.ps1), effectively overwriting the initial PowerShell script with a secondary payload script

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Combine this information with web credentials usage events to identify authentication events that do not fit the organization baseline.

Tactics: TA0005, TA0008
Techniques: T1550.004, T1550
Input: GALLIUM has used VPN services, including SoftEther VPN, to access and maintain persistence in victim environments.

Tactics: TA0001, TA0003
Techniques: T1133
Input: PipeMon, its installer, and tools are signed with stolen code-signing certificates.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: BadPatch attempts to detect if it is being run in a Virtual Machine (VM) using a WMI query for disk drive name, BIOS, and motherboard information.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: By default, Word has a Normal.dotm template created that can be modified to include a malicious macro.

Tactics: TA0003
Techniques: T1137, T1137.001
Input: All forms of phishing are electronically delivered social engineering.

Tactics: TA0043, TA0001
Techniques: T1566, T1598
Input: Additionally, backdoor files are encrypted using DES as a stream cipher.

Tactics: TA0005
Techniques: T1027
Input: These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may send phishing messages to gain access to victim systems.

Tactics: TA0001
Techniques: T1566
Input: HELLOKITTY has the ability to enumerate network resources.

Tactics: TA0007
Techniques: T1135
Input: PHOREAL communicates via ICMP for C2.

Tactics: TA0011
Techniques: T1095
Input: If an application is hosted on cloud-based infrastructure and/or is containerized, then exploiting it may lead to compromise of the underlying instance or container.

Tactics: TA0001
Techniques: T1190
Input: BITSadmin

Tactics: TA0003, TA0005
Techniques: T1197
Input: Unix shells also support scripts that enable sequential execution of commands as well as other typical programming operations such as conditionals and loops.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: Threat Group-3390 actors obtain legitimate credentials using a variety of methods and use them to further lateral movement on victim networks.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: POWERSTATS has created a scheduled task named "MicrosoftEdge" to establish persistence.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Carbanak encrypts the message body of HTTP traffic with RC2 (in CBC mode).

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Carbanak encodes the message body of HTTP traffic with Base64.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: PLAINTEE gains persistence by adding the Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Chaes has used Python scripts for execution and the installation of additional files.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Pysa can stop services and processes.

Tactics: TA0040
Techniques: T1489
Input: Ferocious Kitten has attempted to convince victims to enable malicious content within a spearphishing email by including an odd decoy message.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: winlogon

Tactics: TA0003, TA0004
Techniques: T1547.004, T1547
Input: Adversaries may directly leverage compromised email accounts for Phishing for Information or Phishing.

Tactics: TA0042
Techniques: T1586
Input: Agent Tesla has the ability to extract credentials from the Registry.

Tactics: TA0006
Techniques: T1552, T1552.002
Input: Zox has been encoded with Base64.

Tactics: TA0005
Techniques: T1027
Input: Pysa can perform network reconnaissance using the Advanced Port Scanner tool.

Tactics: TA0007
Techniques: T1046
Input: Emotet has used custom packers to protect its payloads.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: APT29 has used the meek domain fronting plugin for Tor to hide the destination of C2 traffic.

Tactics: TA0011
Techniques: T1090.004, T1090
Input: APT37 uses steganography to send images to users that are embedded with shellcode.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: Monitor for newly constructed processes and/or command-lines that aid in compression or encrypting data that is collected prior to exfiltration, such as 7-Zip, WinRAR, and WinZip.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: APT33 has used base64 to encode payloads.

Tactics: TA0005
Techniques: T1027
Input: Crutch can exfiltrate data over the primary C2 channel (Dropbox HTTP API).

Tactics: TA0010
Techniques: T1041
Input: njRAT has used AutoIt to compile the payload and main script into a single executable after delivery.

Tactics: TA0005
Techniques: T1027.004, T1027
Input: Mustang Panda has used ipconfig and arp to determine network configuration information.

Tactics: TA0007
Techniques: T1016
Input: Because of Poseidon’s longevity, there are samples targeting Windows systems as early as Windows NT 4.0 Server and Windows 95 Workstation up to current versions like Windows 8.1, as well as server variants (very important to them, given the emphasis on reaching Domain Controllers in corporate environments.) How is this different from any other targeted attack? The extortion elements of this campaign are what set it apart from others

Tactics: TA0007
Techniques: T1010
Input: Finally, the Trojan creates a scheduled task to run itself every three minutes by running the following command on the command prompt after replacing the %path% string with the path to the srvResesponded.vbs VBScript:SchTasks /Create /SC MINUTE /MO 3 /TN “InetlSecurityAssistManager” /TR “wscript %path%” /f The Trojan uses HTTP to communicate with its C2 server, specifically using the InternetExplorer application object within an embedded Microsoft .NET Framework assembly called Interop.SHDocVw

Tactics: TA0002, TA0003, TA0004, TA0011
Techniques: T1053.005, T1053, T1071
Input: MuddyWater has used malware that leveraged rundll32.exe in a Registry Run key to execute a .dll.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Monitor cloud logs for API calls and other potentially unusual activity related to cloud data object storage enumeration.

Tactics: TA0007
Techniques: T1580
Input: The "ZJ" variant of BACKSPACE allows "ZJ link" infections with Internet access to relay traffic from "ZJ listen" to a command server.

Tactics: TA0011
Techniques: T1090.001, T1090
Input: yty runs ipconfig /all and collects the domain name.

Tactics: TA0007
Techniques: T1016
Input: MuddyWater has used one C2 to obtain enumeration scripts and monitor web logs, but a different C2 to send data back.

Tactics: TA0011
Techniques: T1104
Input: Mosquito uses COM hijacking as a method of persistence.

Tactics: TA0003, TA0004
Techniques: T1546.015, T1546
Input: Monitor for unexpected files accessed on removable media.

Tactics: TA0001, TA0008
Techniques: T1091
Input: Monitor for newly constructed instances that may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel.

Tactics: TA0002
Techniques: T1204
Input: Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Clambling can execute binaries through process hollowing.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: Command and control (C2) information can be encoded using a standard data encoding system.

Tactics: TA0011
Techniques: T1132
Input: BadPatch captures screenshots in .jpg format and then exfiltrates them.

Tactics: TA0009
Techniques: T1113
Input: NanHaiShu executes additional VBScript code on the victim's machine.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: RemoteCMD can execute commands remotely by creating a new schedule task on the remote system

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Chaes can capture screenshots of the infected machine.

Tactics: TA0009
Techniques: T1113
Input: Ramsay can extract its agent from the body of a malicious document.

Tactics: TA0005
Techniques: T1140
Input: Safe mode starts up the Windows operating system with a limited set of drivers and services.

Tactics: TA0005
Techniques: T1562.009, T1562
Input: Once macros were enabled on the target system, the malicious macros created two named scheduled tasks as persistence mechanisms for two backdoors on the infected system

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053, T1059
Input: yty collects the victim’s username.

Tactics: TA0007
Techniques: T1033
Input: HAFNIUM has obtained IP addresses for publicly-accessible Exchange servers.

Tactics: TA0043
Techniques: T1590, T1590.005
Input: Arp can be used to display a host's ARP cache, which may include address resolutions for remote systems.

Tactics: TA0007
Techniques: T1018
Input: In Kerberos environments, referred to as "realms", there are three basic participants: client, service, and Key Distribution Center (KDC).

Tactics: TA0006
Techniques: T1558
Input: Windshift has used malware to enumerate active processes.

Tactics: TA0007
Techniques: T1057
Input: SMOKEDHAM has exfiltrated data to its C2 server.

Tactics: TA0010
Techniques: T1041
Input: Babuk can use multiple Windows API calls for actions on compromised hosts including discovery and execution.

Tactics: TA0002
Techniques: T1106
Input: Containerized environments may also be targeted due to the ease of deployment via exposed APIs and the potential for scaling mining activities by deploying or compromising multiple containers within an environment or cluster.

Tactics: TA0040
Techniques: T1496
Input: FIN5 has has used the tool GET2 Penetrator to look for remote login and hard-coded credentials.

Tactics: TA0006
Techniques: T1110
Input: MegaCortex was used to kill endpoint security processes.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Adversaries may leverage Spearphishing Attachment or Spearphishing Link as part of internal spearphishing to deliver a payload or redirect to an external site to capture credentials through Input Capture on sites that mimic email login interfaces.

Tactics: TA0008
Techniques: T1534
Input: Goopy has the ability to exfiltrate documents from infected systems.

Tactics: TA0009
Techniques: T1005
Input: Lazarus Group malware IndiaIndia checks Registry keys within HKCU and HKLM to determine if certain applications are present, including SecureCRT, Terminal Services, RealVNC, TightVNC, UltraVNC, Radmin, mRemote, TeamViewer, FileZilla, pcAnyware, and Remote Desktop.

Tactics: TA0007
Techniques: T1012
Input: Monitor for any new items written to the Registry or PE files written to disk.

Tactics: TA0003
Techniques: T1176
Input: Malicious systemd timers may be detected by using the systemctl utility to examine system wide timers: systemctl list-timers –all.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.006, T1053
Input: Xbash uses HTTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: An example of one of these emails is below:Figure 1: Example email messageWhile the current email contains leverage malicious Microsoft Excel files, earlier campaigns have also been observed leveraging RTF and DOC files

Tactics: TA0001, TA0007, TA0011
Techniques: T1090.003, T1566.003, T1566, T1083, T1566.001, T1090
Input: [9] “HKU concern group raises proxy fears in key vote.” EIJ Insight

Tactics: TA0011
Techniques: T1090
Input: Attor's dispatcher disguises itself as a legitimate task (, the task name and description appear legitimate).

Tactics: TA0005
Techniques: T1036.004, T1036
Input: OSX_OCEANLOTUS.D has the ability to upload files from a compromised host.

Tactics: TA0009
Techniques: T1005
Input: Crimson can determine when it has been installed on a host for at least 15 days before downloading the final payload.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Narrator: C:\Windows\System32\Narrator.exe

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: WellMess can write files to a compromised host.

Tactics: TA0011
Techniques: T1105
Input: APT19 used Base64 to obfuscate commands and the payload.

Tactics: TA0005
Techniques: T1027
Input: By default, VNC uses the system's authentication, but it can be configured to use credentials specific to VNC.

Tactics: TA0008
Techniques: T1021.005, T1021
Input: Additional Observed Malware Files    Filename  Armed-Forces-Officers.doc    File Size  3226435 bytes    MD5  89beb207e7095d237c4d25c4c6e17e97    SHA1  15010f7cea913f2a36c56da7d73c2b9eb5a3878f    Notes Malicious RTF document that exploits CVE-2017-8570 and drops a Delphi RAT with the file name vsrss.exe

Tactics: TA0005, TA0007, TA0011
Techniques: T1036, T1090.003, T1083, T1090
Input: TA505 has used TinyMet to enumerate members of privileged groups.

Tactics: TA0007
Techniques: T1069
Input: APT41 leveraged PowerShell to deploy malware families in victims’ environments.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: On Windows Vista and newer, the hash format is DCC2 (Domain Cached Credentials version 2) hash, also known as MS-Cache v2 hash.

Tactics: TA0006
Techniques: T1003, T1003.005
Input: SUNBURST collected information from a compromised host.

Tactics: TA0009
Techniques: T1005
Input: Flagpro has encoded bidirectional data communications between a target system and C2 server using Base64.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: FIN4 has used spearphishing emails (often sent from compromised accounts) containing malicious links.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: This technique is the execution used in conjunction with Windows Service during service persistence or privilege escalation.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: FIN6 actors have compressed data from remote systems and moved it to another staging system before exfiltration.

Tactics: TA0009
Techniques: T1074.002, T1074
Input: Examining passive DNS (pDNS) records from PassiveTotal revealed several domain names associated with this IP that mimic popular technology companies

Tactics: TA0007
Techniques: T1016
Input: Similarly, preventing the modification of the /Library/Preferences/com.apple.loginwindow Hide500Users value will force all users to be visible.

Tactics: TA0005
Techniques: T1564.002, T1564
Input: Adversaries may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM).

Tactics: TA0008
Techniques: T1021, T1021.006
Input: Lokibot has used cmd /c commands embedded within batch scripts.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Once FT learned of the campaign and began warning employees of the threat, the SEA sent phishing emails mimicking the Financial Times IT department and were able to compromise even more users.

Tactics: TA0008
Techniques: T1534
Input: Filter network traffic to prevent use of protocols across the network boundary that are unnecessary.

Tactics: TA0011
Techniques: T1095