madox81/Adema_ATTACK_DS huggingface dataset:
Input: WMIC is a good tool for managing windows hosts and is widely favored by desktop administrators

Tactics: TA0002
Techniques: T1047
Input: Ecipekac can download additional payloads to a compromised host.

Tactics: TA0011
Techniques: T1105
Input: OilRig has used macros to deliver malware such as QUADAGENT and OopsIE.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Smoke Loader injects into the Internet Explorer process.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Remexi gathers and exfiltrates keystrokes from the machine.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Monitor executed commands and arguments used before and after invocation of the utilities may also be useful in determining the origin and purpose of the binary being executed.

Tactics: TA0005
Techniques: T1127.001, T1127
Input: Other accessibility features exist that may also be leveraged in a similar fashion:

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: SILENTTRINITY can create a WMI Event to execute a payload for persistence.

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: Prevent users from installing Python where not required.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Lokibot can search for specific files on an infected host.

Tactics: TA0007
Techniques: T1083
Input: The server-side component provides a simple graphical user interface for threat actors interacting with web shells

Tactics: TA0002, TA0003
Techniques: T1505.003, T1505, T1059
Input: Gold Dragon enumerates registry keys with the command regkeyenum and obtains information for the Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.

Tactics: TA0007
Techniques: T1012
Input: Hard Disk Check The Trojan will perform the following WMI query:   Select * from Win32_DiskDrive   The Trojan will check the Caption and Model fields in the results for the strings Virtual, VMWare, VM, VBox or Oracle

Tactics: TA0005, TA0007
Techniques: T1497
Input: Managed encryption keys can be rotated by most providers.

Tactics: TA0009
Techniques: T1530
Input: When this occurs, the process also takes on the security context associated with the new token.

Tactics: TA0004, TA0005
Techniques: T1134
Input: Higaisa used a payload that creates a hidden window.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Organizations that Buckeye targeted over time, per region Malware and tools Buckeye uses a number of hacking tools as well as malware

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Consider monitoring file reads to Vault locations, &percnt;Systemdrive&percnt;&bsol;Users&bsol;&bsol;&lsqb;Username&rsqb;&bsol;AppData&bsol;Local&bsol;Microsoft&bsol;&bsol;&lsqb;Vault&sol;Credentials&rsqb;&bsol;, for suspicious activity.

Tactics: TA0006
Techniques: T1555, T1555.004
Input: GALLIUM compressed and staged files in multi-part archives in the Recycle Bin prior to exfiltration.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Get-PassPol

Tactics: TA0007
Techniques: T1201
Input: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager

Tactics: TA0003, TA0004
Techniques: T1546.009, T1546
Input: Some archival libraries are preinstalled on systems, such as bzip2 on macOS and Linux, and zip on Windows.

Tactics: TA0009
Techniques: T1560.002, T1560
Input: FIN6 has used encoded PowerShell commands.

Tactics: TA0005
Techniques: T1027
Input: MS Office documents with embedded VBA content store source code inside of module streams.

Tactics: TA0005
Techniques: T1564, T1564.007
Input: Cardinal RAT can uninstall itself, including deleting its executable.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: TeamViewer

Tactics: TA0011
Techniques: T1219
Input: NETWIRE can persist via startup options for Login items.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.015
Input: Ammy

Tactics: TA0011
Techniques: T1219
Input: Bankshot implants are distributed from a domain with a name similar to that of the cryptocurrency-lending platform Falcon Coin, but the similarly named domain is not associated with the legitimate entity

Tactics: TA0005
Techniques: T1036
Input: The Winlogon key controls actions that occur when a user logs on to a computer running Windows 7.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: capturing audio

Tactics: TA0009
Techniques: T1123
Input: DRIVE Lists the logical drives and the type, as well the total/free space of the fixed devices

Tactics: TA0007
Techniques: T1083
Input: rundll32.exe

Tactics: TA0005
Techniques: T1218, T1218.011
Input: APT41 used the WMIEXEC utility to execute whoami commands on remote machines.

Tactics: TA0007
Techniques: T1033
Input: These settings may be stored on the system in configuration files and/or in the Registry as well as being accessible via administrative utilities such as PowerShell or Windows Management Instrumentation.

Tactics: TA0005
Techniques: T1562.006, T1562
Input: Dust Storm has used Android backdoors capable of exfiltrating specific files directly from the infected devices.

Tactics: TA0009
Techniques: T1005
Input: PoshC2 contains modules for searching for passwords in local and remote files.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: Whitefly has used an open-source tool to exploit a known Windows privilege escalation vulnerability (CVE-2016-0051) on unpatched computers.

Tactics: TA0004
Techniques: T1068
Input: Pony has used the Adobe Reader icon for the downloaded file to look more trustworthy.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: QakBot can RC4 encrypt strings in C2 communication.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: VBScript

Tactics: TA0002
Techniques: T1059
Input: regsvcs.exe

Tactics: TA0005
Techniques: T1218.009, T1218
Input: Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk.

Tactics: TA0004, TA0005
Techniques: T1548
Input: RogueRobin checks the running processes for evidence it may be running in a sandbox environment.

Tactics: TA0007
Techniques: T1057
Input: NETWIRE has used .NET packer tools to evade detection.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Ke3chang malware including RoyalCli and BS2005 have communicated over HTTP with the C2 server through Internet Explorer (IE) by using the COM interface IWebBrowser2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Bad Rabbit has used an executable that installs a modified bootloader to prevent normal boot-up.

Tactics: TA0040
Techniques: T1495
Input: Invoke-Kerberoast

Tactics: TA0006
Techniques: T1558.003, T1558
Input: ZIRCONIUM has used a tool to open a Windows Command Shell on a remote host.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: MBR + overwrite/wipe

Tactics: TA0040
Techniques: T1561, T1561.002
Input: GravityRAT collects the volumes mapped on the system, and also steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.

Tactics: TA0007
Techniques: T1083
Input: The White Company has checked the current date on the victim system.

Tactics: TA0007
Techniques: T1124
Input: By default, the NTDS file (NTDS.dit) is located in %SystemRoot%\NTDS\Ntds.dit of a domain controller.

Tactics: TA0006
Techniques: T1003.003, T1003
Input: OSX/Shlayer collects the IOPlatformUUID, session UID, and the OS version using the command sw_vers -productVersion.

Tactics: TA0007
Techniques: T1082
Input: Crimson can identify the user on a targeted system.

Tactics: TA0007
Techniques: T1033
Input: MS\d{2}-\d{3}

Tactics: TA0008
Techniques: T1210
Input: APT18 can list files information for specific directories.

Tactics: TA0007
Techniques: T1083
Input: reg query HKLM /f password /t REG_SZ /s

Tactics: TA0006
Techniques: T1552, T1552.002
Input: Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: APT41 has transferred implant files using Windows Admin Shares.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: regasm.exe

Tactics: TA0005
Techniques: T1218.009, T1218
Input: Elevated privileges are required to edit this file though.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: Kimsuky has used attempted to lure victims into opening malicious e-mail attachments.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: msiexec, odbcconf

Tactics: TA0005
Techniques: T1218
Input: regsvr32.exe

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Chrommme can download its code from C2.

Tactics: TA0011
Techniques: T1105
Input: jRAT has the capability to take screenshots of the victim’s machine.

Tactics: TA0009
Techniques: T1113
Input: PoetRAT has used LZMA and base64 libraries to decode obfuscated scripts.

Tactics: TA0005
Techniques: T1140
Input: Trojan.Karagany can use Tasklist to collect a list of running tasks.

Tactics: TA0007
Techniques: T1057
Input: Deep Panda has used PowerShell scripts to download and execute programs in memory, without writing to disk.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Use auditing tools capable of detecting file system permissions abuse opportunities on systems within an enterprise and correct them.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.010, T1574
Input: Tor plugin

Tactics: TA0011
Techniques: T1090.004, T1090
Input: Grandoreiro can hook APIs, kill processes, break file system paths, and change ACLs to prevent security tools from running.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: On Windows 10, update Windows Defender Application Control policies to include rules that block the older, vulnerable versions of PubPrn.

Tactics: TA0005
Techniques: T1216.001, T1216
Input: SID-History

Tactics: TA0004, TA0005
Techniques: T1134.005, T1134
Input: Neoichor has the ability to configure browser settings by modifying Registry entries under HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer.

Tactics: TA0005
Techniques: T1112
Input: Restricting these privileges may prevent malware from running or limit its capability to spread through the network.Carefully consider the risks before granting administrative rights to users on their own machines.Scrub and verify all administrator accounts regularly.Configure Group Policy to restrict all users to only one login session, where possible.Enforce secure network authentication, where possible.Instruct administrators to use non-privileged accounts for standard functions such as web browsing or checking webmail.Segment networks into logical enclaves and restrict host-to-host communication paths

Tactics: TA0007
Techniques: T1087
Input: Ragnar Locker has used VirtualBox and a stripped Windows XP virtual machine to run itself.

Tactics: TA0005
Techniques: T1564, T1564.006
Input: Kazuar gathers information on the system and local drives.

Tactics: TA0007
Techniques: T1082
Input: The persona may exist on a single social media site or across multiple sites (ex: Facebook, LinkedIn, Twitter, ).

Tactics: TA0042
Techniques: T1585, T1585.001
Input: APT41 malware TIDYELF loaded the main WINTERLOVE component by injecting it into the iexplore.exe process.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Ensure proper process and file permissions are in place to prevent adversaries from disabling or interfering with security services.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: COM + hijack in same sentence

Tactics: TA0003, TA0004
Techniques: T1546.015, T1546
Input: PolyglotDuke can use a custom algorithm to decrypt strings used by the malware.

Tactics: TA0005
Techniques: T1140
Input: The hook main module contained encrypted strings and handled all the function calls and strings as the references in a large structure

Tactics: TA0005
Techniques: T1140, T1027
Input: Consider monitoring social media activity related to your organization.

Tactics: TA0042
Techniques: T1586.001, T1585, T1585.001, T1586
Input: Babuk can stop specific services related to backups.

Tactics: TA0040
Techniques: T1489
Input: Ursnif has used Registry modifications as part of its installation routine.

Tactics: TA0005
Techniques: T1112
Input: cron

Tactics: TA0002, TA0003, TA0004
Techniques: T1053
Input: Password hashes for target services may be obtained using OS Credential Dumping or Kerberoasting.

Tactics: TA0006
Techniques: T1558.002, T1558
Input: UEFI BIOS

Tactics: TA0003, TA0005
Techniques: T1542.001, T1542
Input: Similar to Domain Accounts, compromise of federated cloud accounts may allow adversaries to more easily move laterally within an environment.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078.004, T1078
Input: DarkWatchman can use WMI to execute commands.

Tactics: TA0002
Techniques: T1047
Input: PittyTiger has obtained and used tools such as Mimikatz and gsecdump.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Users are advised to avoid opening attachments and click links on unsolicited emails

Tactics: TA0002
Techniques: T1204
Input: bootkit

Tactics: TA0003, TA0005
Techniques: T1542.003, T1542
Input: SetWindowsHookEx

Tactics: TA0006, TA0009
Techniques: T1056.004, T1056
Input: Limit the accounts that may use remote services.

Tactics: TA0008
Techniques: T1021
Input: Adversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems.

Tactics: TA0011
Techniques: T1572
Input: The MIB is a configuration repository that stores variable information accessible via SNMP in the form of object identifiers (OID).

Tactics: TA0009
Techniques: T1602.001, T1602
Input: Adversaries may use traffic signaling to hide open ports or other malicious functionality used for persistence or command and control.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205
Input: Machete sends stolen data to the C2 server every 10 minutes.

Tactics: TA0010
Techniques: T1029
Input: AppCertDLL

Tactics: TA0003, TA0004
Techniques: T1546.009, T1546
Input: PoshC2 has modules for brute forcing local administrator and AD user accounts.

Tactics: TA0006
Techniques: T1110
Input: net use

Tactics: TA0007
Techniques: T1049
Input: Monitor for changes made to windows registry keys and/or values that may abuse the Windows service control manager to execute malicious commands or payloads.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Kwampirs collects registered owner details by using the commands systeminfo and net config workstation.

Tactics: TA0007
Techniques: T1033
Input: Derusbi collects current and parent process IDs.

Tactics: TA0007
Techniques: T1057
Input: Koadic has 2 methods for elevating integrity.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: The net start and net stop commands can be used in Net to execute or stop Windows services.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Inline hooking, which overwrites the first bytes in an API function to redirect code flow.

Tactics: TA0006, TA0009
Techniques: T1056.004, T1056
Input: Detection of compromised  Valid Accounts in-use by adversaries may help as well.

Tactics: TA0007
Techniques: T1033
Input: Monitor for unusual permissions changes that may indicate excessively broad permissions being granted to compromised accounts.

Tactics: TA0003
Techniques: T1098
Input: Empire can find information about processes running on local and remote systems.

Tactics: TA0007
Techniques: T1057
Input: Crimson uses a custom TCP protocol for C2.

Tactics: TA0011
Techniques: T1095
Input: Botnets have been used in some of the most high-profile DDoS attacks, such as the 2012 series of incidents that targeted major US banks.

Tactics: TA0040
Techniques: T1499
Input: Adversaries can use a compromised email account to hijack existing email threads with targets of interest.

Tactics: TA0042
Techniques: T1586.002, T1586
Input: By manipulating runtime data, adversaries may attempt to affect a business process, organizational understanding, and decision making.

Tactics: TA0040
Techniques: T1565.003, T1565
Input: Kinsing has used the find command to search for specific files.

Tactics: TA0007
Techniques: T1083
Input: Lazarus Group has used PowerShell to execute commands and malicious code.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: The malware demonstrates its evasive behavior by checking for the presence of specific processes related to antimalware products:  The presence of any process with the keywords “v3” and “cleaner.”   Checking for antimalware or cleaner processes

Tactics: TA0005, TA0007
Techniques: T1057, T1562.001, T1562
Input: Once adversaries leverage the abused web service as infrastructure (ex: for command and control), it may be possible to look for unique characteristics associated with adversary software, if known.Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult.

Tactics: TA0042
Techniques: T1584, T1584.006
Input: In one instance, a log file recovered from an open indexed server revealed that an IP address (112.66.188.28) located in Hainan, China had been used to administer the command and control node that was communicating with malware on victim machines

Tactics: TA0007
Techniques: T1016
Input: JSS Loader has the ability to download malicious executables to a compromised host.

Tactics: TA0011
Techniques: T1105
Input: Kasidet has the ability to change firewall settings to allow a plug-in to be downloaded.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: PipeMon can collect and send OS version and computer name as a part of its C2 beacon.

Tactics: TA0007
Techniques: T1082
Input: The message sent to the C2 will be “file is deleted.” if successful or “file is not deleted.” if unsuccessful

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Sibot has retrieved a GUID associated with a present LAN connection on a compromised machine.

Tactics: TA0007
Techniques: T1049
Input: Sliver can exfiltrate files from the victim using the download command.

Tactics: TA0010
Techniques: T1041
Input: Monitor for newly constructed services/daemons that may carry out malicious operations using a virtual instance to avoid detection.

Tactics: TA0005
Techniques: T1564, T1564.006
Input: Raindrop encrypted its payload using a simple XOR algorithm with a single-byte key.

Tactics: TA0005
Techniques: T1027
Input: Mosquito can upload and download files to the victim.

Tactics: TA0011
Techniques: T1105
Input: This technique does not touch Kerberos.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: AmmyAdmin

Tactics: TA0011
Techniques: T1219
Input: Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.

Tactics: TA0005
Techniques: T1480
Input: Microsoft Management Console (MMC) is a binary that may be signed by Microsoft and is used in several ways in either its GUI or in a command prompt.

Tactics: TA0005
Techniques: T1218, T1218.014
Input: Chimera has used tasklist to enumerate processes.

Tactics: TA0007
Techniques: T1057
Input: Volgmer installs a copy of itself in a randomly selected service, then overwrites the ServiceDLL entry in the service's Registry entry.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: icacls . /grant Everyone:F /T /C /Q

Tactics: TA0005
Techniques: T1222
Input: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: Use remote desktop gateways.

Tactics: TA0008
Techniques: T1563.002, T1021.001, T1021, T1563
Input: In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.

Tactics: TA0001, TA0008
Techniques: T1091
Input: These programs will be executed under the context of the user and will have the account's associated permissions level.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547, T1547.014
Input: RATANKBA gathers information about the OS architecture, OS name, and OS version/Service pack.

Tactics: TA0007
Techniques: T1082
Input: Agent Tesla has been executed through malicious e-mail attachments

Tactics: TA0002
Techniques: T1204.002, T1204
Input: After the encryption of file, it will delete shadow copies with the command “ vssadmin delete shadows /all ” to ensure that all the data cannot be restored easily.

Tactics: TA0040
Techniques: T1485
Input: Consider monitoring for /usr/libexec/security_authtrampoline executions which may indicate that AuthorizationExecuteWithPrivileges is being executed.

Tactics: TA0004, TA0005
Techniques: T1548.004, T1548
Input: This private data includes stored passwords, login credential information from Web browsers, and a variety of cryptocurrency wallets

Tactics: TA0006
Techniques: T1003
Input: A module in Prikormka collects information from the victim about Windows OS version, computer name, battery info, and physical memory.

Tactics: TA0007
Techniques: T1082
Input: These may be indicators of automated/scripted credential access behavior.

Tactics: TA0006
Techniques: T1552
Input: Sandworm Team has used the BlackEnergy KillDisk component to overwrite files on Windows-based Human-Machine Interfaces.

Tactics: TA0040
Techniques: T1485
Input: Once the pointer is located, the KernelCallbackTable can be duplicated, and a function in the table (, fnCOPYDATA) set to the address of a malicious payload (ex: via WriteProcessMemory()).

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.013, T1574
Input: Linux Rabbit brute forces SSH passwords in order to attempt to gain access and install its malware onto the server.

Tactics: TA0006
Techniques: T1110, T1110.003
Input: Comnie achieves persistence by adding a shortcut of itself to the startup path in the Registry.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Tropic Trooper has used a delivered trojan to download additional files.

Tactics: TA0011
Techniques: T1105
Input: Regularly check component software on critical services that adversaries may target for persistence to verify the integrity of the systems and identify if unexpected changes have been made.

Tactics: TA0003
Techniques: T1505.002, T1505.001, T1505
Input: Ryuk has attempted to adjust its token privileges to have the SeDebugPrivilege.

Tactics: TA0004, TA0005
Techniques: T1134
Input: BackdoorDiplomacy has downloaded additional files and tools onto a compromised host.

Tactics: TA0011
Techniques: T1105
Input: I download my tools from GitHub, and so do my victims

Tactics: TA0011
Techniques: T1105
Input: sticky key

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: TrickBot has used printf and file I/O loops to delay process execution as part of API hammering.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Stuxnet installs an RPC server for P2P communications.

Tactics: TA0011
Techniques: T1090.001, T1090
Input: APT39 has used the post exploitation tool CrackMapExec to enumerate network shares.

Tactics: TA0007
Techniques: T1135
Input: Anchor has used ICMP in C2 communications.

Tactics: TA0011
Techniques: T1095
Input: MS14-068

Tactics: TA0006
Techniques: T1212
Input: Lizar can search for processes associated with an anti-virus product from list.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Inception has maintained persistence by modifying Registry run key value  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Cobalt Group has added persistence by registering the file name for the next stage malware under HKCU\Environment\UserInitMprLogonScript.

Tactics: TA0003, TA0004
Techniques: T1037.001, T1037
Input: REvil can download a copy of itself from an attacker controlled IP address to the victim machine.

Tactics: TA0011
Techniques: T1105
Input: nbtstat

Tactics: TA0007
Techniques: T1016
Input: capture microphone

Tactics: TA0009
Techniques: T1123