madox81/Adema_ATTACK_DS huggingface dataset:
Input: Consider monitoring accesses and modifications to local storage repositories (such as the Windows Registry), especially from suspicious processes that could be related to malicious data collection.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: FIN5 has cleared event logs from victims.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: Once the QUADAGENT payload has executed, it will use rdppath[.]com as the C2, first via HTTPS, then HTTP, then via DNS tunneling, each being used as a corresponding fallback channel if the former fails

Tactics: TA0011
Techniques: T1071, T1008
Input: PUNCHTRACK scrapes memory for properly formatted payment card data.

Tactics: TA0009
Techniques: T1005
Input: Many of the Fetch samples we analyzed attempted to obfuscate their functionality by encrypting their embedded strings using AES

Tactics: TA0005
Techniques: T1027
Input: FatDuke has been packed with junk code and strings.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: Attor’s plugin deletes the collected files and log files after exfiltration.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Adversaries may search the Registry on compromised systems for insecurely stored credentials.

Tactics: TA0006
Techniques: T1552, T1552.002
Input: SUNSPOT modified its security token to grants itself debugging privileges by adding SeDebugPrivilege.

Tactics: TA0004, TA0005
Techniques: T1134
Input: SQLRat has scripts that are responsible for deobfuscating additional scripts.

Tactics: TA0005
Techniques: T1140
Input: TinyZBot can create a shortcut in the Windows startup folder for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547.001, T1547
Input: Chimera has used PsExec to deploy beacons on compromised systems.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: WastedLocker's custom cryptor, CryptOne, used an XOR based algorithm to decrypt the payload.

Tactics: TA0005
Techniques: T1140
Input: API hooking

Tactics: TA0006, TA0009
Techniques: T1056.004, T1056
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users.

Tactics: TA0040
Techniques: T1491.002, T1491
Input: Sandworm Team researched Ukraine's unique legal entity identifier (called an "EDRPOU" number), including running queries on the EDRPOU website, in preparation for the NotPetya attack.

Tactics: TA0043
Techniques: T1593
Input: record audio

Tactics: TA0009
Techniques: T1123
Input: Adversaries have been observed leveraging third-party drivers like RawDisk to directly access disk content.

Tactics: TA0040
Techniques: T1561.001, T1561
Input: Attor has a plugin that collects information about inserted storage devices, modems, and phone devices.

Tactics: TA0007
Techniques: T1120
Input: Stealth Falcon malware gathers system information via Windows Management Instrumentation (WMI).

Tactics: TA0002
Techniques: T1047
Input: Higaisa performed padding with null bytes before calculating its hash.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: Gallmaker sent emails with malicious Microsoft Office documents attached.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: VERMIN gathers the local IP address.

Tactics: TA0007
Techniques: T1016
Input: PowerSploit's Install-SSP Persistence module can be used to establish by installing a SSP DLL.

Tactics: TA0003, TA0004
Techniques: T1547.005, T1547
Input: Monitor for API calls (such as GetForegroundWindow()) that may attempt to get a listing of open application windows.

Tactics: TA0007
Techniques: T1010
Input: A malicious password filter would receive these plain-text credentials every time a password request is made.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.002, T1556
Input: NOKKI has used FTP for C2 communications.

Tactics: TA0011
Techniques: T1071.002, T1071
Input: Metamorfo has used mshta.exe to execute a HTA payload.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: The sudoers file, /etc/sudoers, describes which users can run which commands and from which terminals.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: OnDrawClipboard

Tactics: TA0009
Techniques: T1115
Input: APT28 has collected information from Microsoft SharePoint services within target networks.

Tactics: TA0009
Techniques: T1213, T1213.002
Input: QakBot can delete folders and files including overwriting its executable with legitimate programs.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Adversaries may target user email to collect sensitive information.

Tactics: TA0009
Techniques: T1114
Input: Previous related research: https://sec0wn.blogspot.com/2018/05/clearing-muddywater-analysis-of-new.html?m=1 https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/ https://blog.malwarebytes.com/threat-analysis/2017/09/elaborate-scripting-fu-used-in-espionage-attack-against-saudi-arabia-government_entity/ https://www.sekoia.fr/blog/falling-on-muddywater/  Decoy images by country Jordan     The Hashemite Kingdom of Jordan, Ministry of Justice (mwjo.doc) DAMAMAX.doc    Turkey     Turkey’s General Directorate of Security Turkey’s Directorate General of Coastal Safety        Turkey’s General Directorate of Security (Onemli Rapor.doc) Turkey’s Ministry of the Interior (Early election.doc)    Saudi Arabia Document signed by the Major General Pilot, commander of the Saudi Royal Air Force     KSA King Saud University (KSU) KSA King Saud University (KSU)    Azerbaijan İnkişaf üçün görüş.doc (meeting for development) Iraq     Iraqi Ministry of Foreign Affairs Government of Iraq, the Treasury of the Council of Ministers    Pakistan     ECP.doc National Assembly of Pakistan.doc        P.Police.doc     Afghanistan President.doc, E-government of Afghanistan Technical details Below is a description of the malware extraction and execution flow, starting from the initial infection vector, running VBA code via a macro and then dropping the PowerShell code that establishes command-center communications, sends victim system information and then receives commands supported by the malware

Tactics: TA0011
Techniques: T1071
Input: Adversaries may abuse security support providers (SSPs) to execute DLLs when the system boots.

Tactics: TA0003, TA0004
Techniques: T1547.005, T1547
Input: OwaAuth DES-encrypts captured credentials using the key 12345678 before writing the credentials to a log file.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: EnvyScout can call window.location.pathname to ensure that embedded files are being executed from the C: drive, and will terminate if they are not.

Tactics: TA0005
Techniques: T1480
Input: BADNEWS checks for new hard drives on the victim, such as USB devices, by listening for the WM_DEVICECHANGE window message.

Tactics: TA0007
Techniques: T1120
Input: Cannon can take a screenshot of the desktop.

Tactics: TA0009
Techniques: T1113
Input: Here is a list of the platforms used by this variant: Twitter, Yandex and Mediafire

Tactics: TA0011
Techniques: T1102
Input: StrongPity can delete previously exfiltrated files from the compromised host.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: LightNeuron uses SMTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.003
Input: SHUTTERSPEED can collect system information.

Tactics: TA0007
Techniques: T1082
Input: To validate the location of the cron log file, check the syslog config at /etc/rsyslog.conf or /etc/syslog.conf

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: lists the running processes

Tactics: TA0007
Techniques: T1057
Input: Clambling can use Dropbox to download malicious payloads, send commands, and receive information.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: WastedLocker can execute itself as a service.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Pony has used batch scripts to delete itself after execution.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: launchctl

Tactics: TA0002
Techniques: T1569.001, T1569
Input: For example, in Windows 10 and Windows Server 2016 and above, Windows Defender Application Control (WDAC) policy rules may be applied to block the wmic.exe application and to prevent abuse.

Tactics: TA0002
Techniques: T1047
Input: This presentation by Christopher Glyer and Devon Kerr contains additional information on attacker use of WMI in past Mandiant investigations

Tactics: TA0002
Techniques: T1047
Input: Patchwork hides base64-encoded and encrypted C2 server locations in comments on legitimate websites.

Tactics: TA0011
Techniques: T1102.001, T1102
Input: Monitor for newly constructed active directory objects, such as Windows EID 5137.

Tactics: TA0004, TA0005
Techniques: T1484.001, T1484, T1484.002
Input: When a user logs out or restarts via the macOS Graphical User Interface (GUI), a prompt is provided to the user with a checkbox to "Reopen windows when logging back in".

Tactics: TA0003, TA0004
Techniques: T1547, T1547.007
Input: njRAT is capable of manipulating and deleting registry keys.

Tactics: TA0005
Techniques: T1070
Input: The encoded payload was a Cobalt Strike httpsstager that was injected into the PowerShell process that ran the command

Tactics: TA0004, TA0005
Techniques: T1055
Input: winrm

Tactics: TA0008
Techniques: T1021, T1021.006
Input: DRATzarus can search for other machines connected to compromised host and attempt to map the network.

Tactics: TA0007
Techniques: T1018
Input: AADInternals can gather encryption keys from Azure AD services such as ADSync and Active Directory Federated Services servers.

Tactics: TA0006
Techniques: T1552.004, T1552
Input: Bazar can identity the current process on a compromised host.

Tactics: TA0007
Techniques: T1057
Input: Remote access tools with built-in features may interact directly using APIs to gather information.

Tactics: TA0007
Techniques: T1217
Input: VERMIN decrypts code, strings, and commands to use once it's on the victim's machine.

Tactics: TA0005
Techniques: T1140
Input: Unlike Exploit Public-Facing Application, the focus of this technique is to exploit software on a client endpoint upon visiting a website.

Tactics: TA0001
Techniques: T1189
Input: Consider use of services that may aid in the tracking of certificates in use on sites across the Internet.

Tactics: TA0042
Techniques: T1608.003, T1587, T1608, T1587.003
Input: ShadowPad has injected a DLL into svchost.exe.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: It loads the module with parameter vShow set to zero, which opens the application with a hidden window.  Alternatively, if Avast is not installed on the machine, the malicious module loads using regsvr32.exe

Tactics: TA0005
Techniques: T1218, T1218.010
Input: SMOKEDHAM has used whoami commands to identify system owners.

Tactics: TA0007
Techniques: T1033
Input: Message 3:    Headers Received: by mailcenter.support   Sender Mercator Institute for China Studies <publications@mericcs.org>   Subject Authoritarian advance Responding to Chinas growing political influence in Europe   Body Content and images included within the e-mail body were a direct copy of the following MERICS report:  https://www.merics.org/sites/default/files/2018-02/GPPi_MERICS_Authoritarian_Advance_2018_1.pdf   Notes The hyperlinked text Click here to download the report within the e-mail body lead to a malicious RTF document located at the URL hxxp://www.mericcs.org/GPPi_MERICS_Authoritarian_Advance_2018_1Q.doc

Tactics: TA0002
Techniques: T1204
Input: ZxShell can use ports 1985 and 1986 in HTTP/S communication.

Tactics: TA0011
Techniques: T1571
Input: A BlackEnergy 2 plug-in uses WMI to gather victim host details.

Tactics: TA0002
Techniques: T1047
Input: Monitor for contextual data about a scheduled job, which may include information such as name, timing, command(s),

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Monitor for suspicious processes modifying the authorized_keys or /etc/ssh/sshd_config files.

Tactics: TA0003
Techniques: T1098.004, T1098
Input: capture video

Tactics: TA0009
Techniques: T1125
Input: Gazer uses custom encryption for C2 that uses 3DES.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: VNC is a platform-independent desktop sharing system that uses the RFB ("remote framebuffer") protocol to enable users to remotely control another computer’s display by relaying the screen, mouse, and keyboard inputs over the network.

Tactics: TA0008
Techniques: T1021.005, T1021
Input: NETWIRE can collect the IP address of a compromised host.

Tactics: TA0007
Techniques: T1016
Input: The unique strings mainly consist of “Mobile/BADDAD“, “Mobile/7B405” and “E9BC3BD76216AFA560BFB5ACAF5731A3”

Tactics: TA0005
Techniques: T1140
Input: PowerShell scripts also exist that contain credential dumping functionality, such as PowerSploit's Invoke-Mimikatz module, which may require additional logging features to be configured in the operating system to collect necessary information for analysis.

Tactics: TA0006
Techniques: T1003, T1003.004, T1003.001
Input: The second file is a PowerShell script which appears to be based on a Rapid7 Ruby Exploitation script that loads arbitrary shellcode

Tactics: TA0002
Techniques: T1059
Input: Revenge RAT uses the PowerShell command Reflection.Assembly to load itself into memory to aid in execution.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: APT1 used the commands net localgroup,net user, and net group to find accounts on the system.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Detecting the use of environmental keying may be difficult depending on the implementation.

Tactics: TA0005
Techniques: T1480, T1480.001
Input: PoisonIvy creates a Registry key in the Active Setup pointing to a malicious executable.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.014
Input: WIRTE has used Base64 to decode malicious VBS script.

Tactics: TA0005
Techniques: T1140
Input: ChangeServiceConfigW

Tactics: TA0040
Techniques: T1489
Input: Monitor for queried domain name system (DNS) registry data that may purchase domains that can be used during targeting.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: There are tools available to perform these changes.

Tactics: TA0003, TA0004
Techniques: T1546.006, T1546
Input: ISMInjector uses the certutil command to decode a payload file.

Tactics: TA0005
Techniques: T1140
Input: Also analyze Autoruns data for oddities and anomalies, specifically malicious files attempting persistent execution by hiding within auto-starting locations.

Tactics: TA0005
Techniques: T1553, T1553.003
Input: Local network traffic metadata (such as source MAC addressing) as well as usage of network management protocols such as DHCP may be helpful in identifying hardware.

Tactics: TA0001, TA0003, TA0006, TA0008, TA0009, TA0010
Techniques: T1557.001, T1557, T1200, T1557.002, T1029, T1570, T1133
Input: GoldenSpy's uninstaller can delete registry entries, files and folders, and finally itself once these tasks have been completed.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: OSX_OCEANLOTUS.D has a command to delete a file from the system.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: RTM samples have been signed with a code-signing certificates.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Dragonfly has used various types of scripting to perform operations, including batch scripts.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: FIN7 has used RDP to move laterally in victim environments.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Sometimes a user's action may be required to open it for deobfuscation or decryption as part of User Execution.

Tactics: TA0005
Techniques: T1140
Input: Consider monitoring file locations associated with the installation of new application software components such as paths from which applications typically load such extensible components.

Tactics: TA0003
Techniques: T1505.002, T1505
Input: An adversary may create a new instance or virtual machine (VM) within the compute service of a cloud account to evade defenses.

Tactics: TA0005
Techniques: T1578.002, T1578
Input: Skidmap has checked for the existence of specific files including /usr/sbin/setenforce and  /etc/selinux/config.

Tactics: TA0007
Techniques: T1083
Input: Seasalt uses cmd.exe to create a reverse shell on the infected endpoint.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: UPPERCUT uses cmd.exe to execute commands on the victim’s machine.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Meteor has the ability to download additional files for execution on the victim's machine.

Tactics: TA0011
Techniques: T1105
Input: QuasarRAT contains a .NET wrapper DLL for creating and managing scheduled tasks for maintaining persistence upon reboot.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Other factors, such as access patterns and activity that occurs after a remote login, may indicate suspicious or malicious behavior with RDP.

Tactics: TA0008
Techniques: T1563.002, T1021.001, T1021, T1563
Input: CSPY Downloader can use the schtasks utility to bypass UAC.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: DDE is a client-server protocol for one-time and/or continuous inter-process communication (IPC) between applications.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: H1N1 dumps usernames and passwords from Firefox, Internet Explorer, and Outlook.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: The author of GravityRAT submitted samples to VirusTotal for testing, showing that the author modified the code to try to hide the DDE object in a different part of the document.

Tactics: TA0005
Techniques: T1027, T1027.005
Input: Conti can spread via SMB and encrypts files on different hosts, potentially compromising an entire network.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: net accounts

Tactics: TA0007
Techniques: T1201
Input: A patch management process should be implemented to check unused dependencies, unmaintained and/or previously vulnerable dependencies, unnecessary features, components, files, and documentation.

Tactics: TA0001
Techniques: T1195.001, T1195
Input: Pisloader has a command to collect victim system information, including the system name and OS version.

Tactics: TA0007
Techniques: T1082
Input: Monitor newly executed processes that may establish persistence by executing malicious content triggered by user inactivity.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.002
Input: Kimsuky has used modified versions of open source PHP web shells to maintain access, often adding "Dinosaur" references within the code.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: APT41 deployed rootkits on Linux systems.

Tactics: TA0005
Techniques: T1014
Input: Adversaries may also use knowledge of system time as part of a time bomb, or delaying execution until a specified date/time.

Tactics: TA0007
Techniques: T1124
Input: master boot record wiper

Tactics: TA0040
Techniques: T1561, T1561.002
Input: Credentialing and authentication mechanisms may be targeted for exploitation by adversaries as a means to gain access to useful credentials or circumvent the process to gain access to systems.

Tactics: TA0006
Techniques: T1212
Input: Monitor executed commands and arguments for actions that could be taken to gather system and network information.

Tactics: TA0007
Techniques: T1010
Input: Ramsay can gather a list of running processes by using Tasklist.

Tactics: TA0007
Techniques: T1057
Input: RDAT has used Windows Video Service as a name for malicious services.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Remsec is capable of using HTTP and HTTPS for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Some endpoint security solutions can be configured to block some types of process injection based on common sequences of behavior that occur during the injection process.

Tactics: TA0004, TA0005
Techniques: T1055.003, T1055.013, T1055.004, T1055.011, T1055.002, T1055.012, T1055.005, T1055, T1055.015, T1055.001
Input: WannaCry uses attrib +h to make some of its files hidden.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Also monitor software update frameworks that may strip this flag when performing updates.

Tactics: TA0005
Techniques: T1553.001, T1553
Input: StrongPity has been bundled with legitimate software installation files for disguise.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: This may lead to Use Alternate Authentication Material, which may bypass multi-factor and other authentication protection mechanisms.

Tactics: TA0006
Techniques: T1606, T1606.002
Input: LoudMiner adds plist files with the naming format com.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: Chimera has used gzip for Linux OS and a modified RAR software to archive data on Windows hosts.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: The CARROTBAT malware family is a somewhat unique dropper and while it supports various types of decoy documents, and employs rudimentary command obfuscation, it should be made clear that it is not sophisticated

Tactics: TA0005
Techniques: T1027
Input: TYPEFRAME can search directories for files on the victim’s machine.

Tactics: TA0007
Techniques: T1083
Input: PS1 can use an XOR key to decrypt a PowerShell loader and payload binary.

Tactics: TA0005
Techniques: T1140
Input: Carberp has installed a bootkit on the system to maintain persistence.

Tactics: TA0003, TA0005
Techniques: T1542.003, T1542
Input: Ramsay can use UACMe for privilege escalation.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: VBShower has attempted to complicate forensic analysis by deleting all the files contained in %APPDATA%..\Local\Temporary Internet Files\Content.Word and %APPDATA%..\Local Settings\Temporary Internet Files\Content.Word\.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: This file is then copied to a filename of ‘Windows Update.lnk’, which is placed in the startup path previously identified

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Volgmer can gather a list of processes.

Tactics: TA0007
Techniques: T1057
Input: Exfiltration servers can be separately configured from C2 servers.

Tactics: TA0010
Techniques: T1048.003, T1048
Input: Team Viewer

Tactics: TA0011
Techniques: T1219
Input: InnaputRAT variants have attempted to appear legitimate by using the file names SafeApp.exe and NeutralApp.exe.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Monitor executed commands and arguments resulting from RC scripts for unusual or unknown applications or behavior

Tactics: TA0003, TA0004
Techniques: T1037.004, T1037
Input: Commands   Description    0x97A168D9697D40DD  Download and validate file (XXHash comparison) from C2 server    0x7CF812296CCC68D5  Upload file to C2 server    0x652CB1CEFF1C0A00  Load PE file    0x27595F1F74B55278  Download, validate (XXHash comparison), execute file, and send output to C2 server    0xD290626C85FB1CE3  Format the current timestamp    0x409C7A89CFF0A727  Capture the desktop screenshot in PNG format and send it to C2    None of the above  The received buffer is executed via cmd.exe and the output is then sent to the C2 server    Table 5: Supported commands  Conclusion While APT10 consistently targets the same geolocation and industry, the malware they use is actively evolving

Tactics: TA0009, TA0011, TA0010
Techniques: T1041, T1132, T1071, T1105, T1113
Input: Guardrails can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within.

Tactics: TA0005
Techniques: T1480
Input: Calisto collects information on bookmarks from Google Chrome.

Tactics: TA0007
Techniques: T1217
Input: HermeticWiper can use AdjustTokenPrivileges to grant itself privileges for debugging with SeDebugPrivilege, creating backups with SeBackupPrivilege, loading drivers with SeLoadDriverPrivilege, and shutting down a local system with SeShutdownPrivilege.

Tactics: TA0004, TA0005
Techniques: T1134
Input: CharmPower can exfiltrate gathered data to a hardcoded C2 URL via HTTP POST.

Tactics: TA0010
Techniques: T1041
Input: Machete has sent data over HTTP if FTP failed, and has also used a fallback server.

Tactics: TA0011
Techniques: T1008
Input: pass-the-ticket

Tactics: TA0005, TA0008
Techniques: T1550.003, T1550