madox81/Adema_ATTACK_DS huggingface dataset:
Input: Sandworm Team used a backdoor which could execute a supplied DLL using rundll32.exe.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Information about business relationships may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites).

Tactics: TA0043
Techniques: T1591.002, T1591
Input: Emissary is capable of configuring itself as a service.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Peppy can log keystrokes on compromised hosts.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: It was sent to exhibitors in an email with an Excel or Word document containing macros, pretending to be from the organizer of the event.

Tactics: TA0001
Techniques: T1566.003, T1566
Input: Alternate protocols include FTP, SMTP, HTTP/S, DNS, SMB, or any other network protocol not being used as the main command and control channel.

Tactics: TA0010
Techniques: T1048
Input: Monitor for newly constructed network connections associated with pings/scans that may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.

Tactics: TA0007
Techniques: T1018
Input: Adversaries may use steganography techniques in order to prevent the detection of hidden information.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: Any potential changes cannot take effect until every registered filter acknowledges validation.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.002, T1556
Input: HotCroissant has the ability to stop services on the infected host.

Tactics: TA0040
Techniques: T1489
Input: Monitor for newly constructed logon behavior that may "pass the ticket" using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls.

Tactics: TA0005, TA0008
Techniques: T1550.003, T1550
Input: DDKONG decodes an embedded configuration using XOR.

Tactics: TA0005
Techniques: T1140
Input: gh0st RAT has gathered system architecture, processor, OS configuration, and installed hardware information.

Tactics: TA0007
Techniques: T1082
Input: Monitor executed commands and arguments that may attempt to exfiltrate data over a USB connected physical device.

Tactics: TA0010
Techniques: T1052, T1052.001
Input: Monitor for artifacts of abnormal process execution.

Tactics: TA0005
Techniques: T1620
Input: ShadowPad communicates over HTTP to retrieve a string that is decoded into a C2 server URL.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: HermeticWizard can use cmd.exe for execution on compromised hosts.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: These difficulties can slow down the incident response process and help adversaries hide their tactics, techniques, and procedures (TTPs).

Tactics: TA0005
Techniques: T1480, T1480.001
Input: Meteor can use Wevtutil to remove Security, System and Application Event Viewer logs.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: These variables are often used by developers to debug binaries without needing to recompile, deconflict mapped symbols, and implement custom functions without changing the original library.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.006, T1574
Input: RDAT can deobfuscate the base64-encoded and AES-encrypted files downloaded from the C2 server.

Tactics: TA0005
Techniques: T1140
Input: RTM has relied on users opening malicious email attachments, decompressing the attached archive, and double-clicking the executable within.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: CostaBricks has added the entire unobfuscated code of the legitimate open source application Blink to its code.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: Monitor for contextual data about an account, which may include a username, user ID, environmental data,  that may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls.

Tactics: TA0004, TA0005
Techniques: T1134
Input: Monitor processes for unusual activity (, a process that does not use the network begins to do so, abnormal process call trees).

Tactics: TA0003, TA0004, TA0005
Techniques: T1574
Input: Dtrack’s dropper can list all running processes.

Tactics: TA0007
Techniques: T1057
Input: via <file name="filename.extension" loadFrom="fully-qualified or relative pathname"> in an embedded or external "application manifest". The file name refers to an entry in the IMPORT directory or a forwarded EXPORT.

Tactics: TA0002
Techniques: T1129
Input: By achieving sufficient rights on the device, an adversary can reconfigure the device to allow the traffic they want, allowing them to then further achieve goals such as command and control via Multi-hop Proxy or exfiltration of data via Traffic Duplication.

Tactics: TA0005
Techniques: T1599
Input: SharpStage can execute arbitrary commands with PowerShell.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Ebury has injected its dynamic library into descendent processes of sshd via LD_PRELOAD.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.006, T1574
Input: APT37 uses HTTPS to conceal C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Lazarus Group malware SierraBravo-Two generates an email message via SMTP containing information about newly infected victims.

Tactics: TA0010
Techniques: T1048.003, T1048
Input: Comnie uses the tasklist to view running processes on the victim’s machine.

Tactics: TA0007
Techniques: T1057
Input: msxsl.exe script[.]jpeg script[.]jpeg

Tactics: TA0005
Techniques: T1220
Input: Monitor property changes in Group Policy: Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy\Store passwords using reversible encryption.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.005
Input: Taidoor uses RC4 to encrypt the message body of HTTP content.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: There are two forms of encrypted strings: an RSA256-encrypted string, and custom base64-encoded and RSA256-encrypted string

Tactics: TA0005
Techniques: T1027
Input: Evilnum can collect email credentials from victims.

Tactics: TA0006
Techniques: T1555
Input: QakBot can identify whether it has been run previously on a host by checking for a specified folder.

Tactics: TA0007
Techniques: T1083
Input: Spark has used HTTP POST requests to communicate with its C2 server to receive commands.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Components may still be able to be hijacked to suitable functions already present on disk if malicious modifications to Registry keys are not prevented.

Tactics: TA0005
Techniques: T1553
Input: These registrations have a five-minute average lifespan, resulting in a constant shuffle of IP address resolution.

Tactics: TA0011
Techniques: T1568.001, T1568
Input: ZIRCONIUM has used Python-based implants to interact with compromised hosts.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Malware repositories can also be used to identify additional samples associated with the adversary and identify patterns an adversary has used in procuring code signing certificates.Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult.

Tactics: TA0042
Techniques: T1588, T1588.003
Input: Axiom has used watering hole attacks to gain access.

Tactics: TA0001
Techniques: T1189
Input: SILENTTRINITY contains a number of modules that can bypass UAC, including through Window's Device Manager, Manage Optional Features, and an image hijack on the .msc file extension.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Adversaries may also seek and target CDN misconfigurations that leak sensitive information not intended to be hosted and/or do not have the same protection mechanisms (ex: login portals) as the content hosted on the organization’s website.

Tactics: TA0043
Techniques: T1596, T1596.004
Input: Identify and block potentially malicious software executed through search order hijacking by using application control solutions capable of blocking DLLs loaded by legitimate software.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Lazarus Group has used net use to identify and establish a network connection with a remote host.

Tactics: TA0007
Techniques: T1049
Input: Dark Caracal has used macros in Word documents that would download a second stage if executed.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Certificate errors may arise when the application’s certificate does not match the one expected by the host.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.002
Input: Helminth can provide a remote shell.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Empire contains modules for executing commands over SSH as well as in-memory VNC agent injection.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: Certificates can be uploaded to a server, then the server can be configured to use the certificate to enable encrypted communication with it.

Tactics: TA0042
Techniques: T1608.003, T1608
Input: Adversaries may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.012
Input: In the event it does, Reaver will move this file to ‘%TEMP%\~FJIOW.tmp’ and delete this new file

Tactics: TA0005
Techniques: T1070, T1070.004
Input: SodaMaster can enumerate the host name and OS version on a target system.

Tactics: TA0007
Techniques: T1082
Input: ZxShell can query the netsvc group value data located in the svchost group Registry key.

Tactics: TA0007
Techniques: T1012
Input: Inception has obtained and used open-source tools such as LaZagne.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Imminent Monitor has a feature to disable Windows Task Manager.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Monitor for new constructed windows registry keys that may create or modify Windows services to repeatedly execute malicious payloads as part of persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: No pdb/debug strings are present in the code

Tactics: TA0005
Techniques: T1140
Input: Apple also uses a set of keys and algorithms to encrypt the user’s password, but once the master key is found, an adversary need only iterate over the other values to unlock the final password.

Tactics: TA0006
Techniques: T1555.002, T1555
Input: PlugX has a module to download and execute files on the compromised machine.

Tactics: TA0011
Techniques: T1105
Input: ROKRAT can gather the hostname and the OS version to ensure it doesn’t run on a Windows XP or Windows Server 2003 systems.

Tactics: TA0007
Techniques: T1082
Input: FIN4 has captured credentials via fake Outlook Web App (OWA) login pages and has also used a .NET based keylogger.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: GALLIUM created high-privileged domain user accounts to maintain access to victim networks.

Tactics: TA0003
Techniques: T1136, T1136.002
Input: Avenger can identify the domain of the compromised host.

Tactics: TA0007
Techniques: T1016
Input: Dtrack can collect the victim's computer name, hostname and adapter information to create a unique identifier.

Tactics: TA0007
Techniques: T1082
Input: A DoS attack may be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS).

Tactics: TA0040
Techniques: T1499
Input: Adversaries may establish persistence by executing malicious content triggered by user inactivity.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.002
Input: Silence has weaponized CHM files in their phishing campaigns.

Tactics: TA0005
Techniques: T1218, T1218.001
Input: Use auditing tools capable of detecting DLL search order hijacking opportunities on systems within an enterprise and correct them.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: C:\Windows\System32\utilman.exe

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: If scheduled tasks are not used for persistence, then the adversary is likely to remove the task when the action is complete.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053, T1053.002
Input: Nidiran can create a new service named msamger (Microsoft Security Accounts Manager).

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Alternatively, a file or container image name given may be a close approximation to legitimate programs/images or something innocuous.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Adversaries may gather credential material by invoking or forcing a user to automatically provide authentication information through a mechanism in which they can intercept.

Tactics: TA0006
Techniques: T1187
Input: A Lazarus Group malware sample encrypts data using a simple byte based XOR operation prior to exfiltration.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: As seen below, the relational analysis proved to be quite fruitful:  Figure 1 Overview of relationships We rapidly discovered a different set of tools communicating to the exact same C2 servers as those two Word documents, in addition to other tools communicating to other subdomain variations of chrome-up[.]date as seen in the following graphic:  Figure 2 Command and control overlaps From there, we were able to map out a large infrastructure separating out into four categories of tools: downloaders, droppers, loaders, and payloads

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Source code payloads may also be encrypted, encoded, and/or embedded within other files, such as those delivered as a Phishing.

Tactics: TA0005
Techniques: T1027.004, T1027
Input: T9000 can take screenshots of the desktop and target application windows, saving them to user directories as one byte XOR encrypted .dat files.

Tactics: TA0009
Techniques: T1113
Input: StoneDrill can check for antivirus and antimalware programs.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: RemoteUtilities can take screenshots on a compromised host.

Tactics: TA0009
Techniques: T1113
Input: Machete produces file listings in order to search for files to be exfiltrated.

Tactics: TA0007
Techniques: T1083
Input: In some cases, the passing of files embedded using steganography, such as image or document files, can be used for command and control.

Tactics: TA0011
Techniques: T1001, T1001.002
Input: RainyDay can use RC4 to encrypt C2 communications.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: The full contents of the batch script are given in Appendix C – a.bat

Tactics: TA0002
Techniques: T1059
Input: This activity may also be seen shortly after Internal Spearphishing.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Data loss prevention can restrict access to sensitive data and detect sensitive data that is unencrypted.

Tactics: TA0009
Techniques: T1005, T1025
Input: DarkWatchman can load DLLs.

Tactics: TA0002
Techniques: T1129
Input: OilRig has sent spearphising emails with malicious attachments to potential victims using compromised and/or spoofed email accounts.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001, T1497.002
Input: The command az ad user list will list all users within a domain.

Tactics: TA0007
Techniques: T1087, T1087.004
Input: Adversaries may create or edit shortcuts to run a program during system boot or user login.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Xbash can use mshta for executing scripts.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: DropBook can download and execute additional files.

Tactics: TA0011
Techniques: T1105
Input: ROKRAT can encrypt data prior to exfiltration by using an RSA public key.

Tactics: TA0005
Techniques: T1027
Input: SHARPSTATS has the ability to identify the username on the compromised host.

Tactics: TA0007
Techniques: T1033
Input: Monitor for files being accessed that may search local file systems and remote file shares for files containing insecurely stored credentials.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: Monitor the behavior of containers within the environment to detect anomalous behavior or malicious activity after users deploy from malicious images.

Tactics: TA0002
Techniques: T1204.003, T1204
Input: Babuk can enumerate disk volumes, get disk information, and query service status.

Tactics: TA0007
Techniques: T1082
Input: and look for common keylogging API calls.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: With these outputs, FIN6 was able to identify user accounts that could access additional hosts in the domain

Tactics: TA0007
Techniques: T1087
Input: Pysa has used RSA and AES-CBC encryption algorithm to encrypt a list of targeted file extensions.

Tactics: TA0040
Techniques: T1486
Input: via specification of the (fully-qualified or relative) DLL pathname in the IMPORT directory;

Tactics: TA0002
Techniques: T1129
Input: APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Keep security software up-to-date with the latest definitions  Protection Norton Security, Symantec Endpoint Protection, and other Symantec security products protect users against these threats through the following detections: AV  Backdoor.Cadelspy Backdoor.Remexi Backdoor.Remexi.B  IPS  System Infected: Backdoor.Cadelspy Activity 2 System Infected: Backdoor.Remexi Activity  Indicators of compromise We have also compiled an indicators-of-compromise document containing further details which can be used to help identify the threats if they are present in your environment

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Ramsay can scan for removable media which may contain documents for collection.

Tactics: TA0007
Techniques: T1120
Input: In December 2018, a thread on HackForums described a change in the ownership and ongoing development of the HawkEye keylogger.Shortly following this exchange, new posts began to appear that were attempting to market and sell new versions of HawkEye (HawkEye Reborn v9), with these new posts also referencing the change in ownership of the project moving forward.HawkEye Reborn v9 is currently marketed as an "Advance Monitoring Solution." It is currently being sold using a licensing model, with purchasers gaining access to the software and updates for different periods based on a tiered pricing model.HawkEye Reborn v9 also features a Terms of Service agreement that provides some additional insight

Tactics: TA0003, TA0004, TA0011
Techniques: T1543.003, T1008, T1543
Input: Traps 4.0 can be configured to protect the processes that are cited as being abused in this blog from loading malicious code

Tactics: TA0004, TA0005
Techniques: T1055
Input: RARSTONE obtains installer properties from Uninstall Registry Key entries to obtain information about installed applications and how to uninstall certain applications.

Tactics: TA0007
Techniques: T1083
Input: MESSAGETAP checks for the existence of two configuration files (keyword_parm.txt and parm.txt) and attempts to read the files every 30 seconds.

Tactics: TA0007
Techniques: T1083
Input: The infection could continue to spread via the newly infected file when it is executed by a remote system.

Tactics: TA0008
Techniques: T1080
Input: Ursnif droppers have also been delivered as password-protected zip files that execute base64 encoded PowerShell commands.

Tactics: TA0005
Techniques: T1027
Input: For example, JavaScript Blobs can be abused to dynamically generate malicious files in the victim machine and may be dropped to disk by abusing JavaScript functions such as msSaveBlob.

Tactics: TA0005
Techniques: T1027.006, T1027
Input: Mavinject.exe is the Microsoft Application Virtualization Injector, a Windows utility that can inject code into external processes as part of Microsoft Application Virtualization (App-V).

Tactics: TA0005
Techniques: T1218, T1218.013
Input: Gallmaker used PowerShell to download additional payloads and for execution.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: More_eggs has the capability to gather the OS version and computer name.

Tactics: TA0007
Techniques: T1082
Input: If the payload doesn't work as expected, the adversary can continue normal communications and troubleshoot with the target on how to get it working.

Tactics: TA0001
Techniques: T1566.003, T1566
Input: Adversaries may register a rogue Domain Controller to enable manipulation of Active Directory data.

Tactics: TA0005
Techniques: T1207
Input: mericcs.org 221.121.138.141 Domain used for spear phish sender e-mail address and to host malicious documents

Tactics: TA0007
Techniques: T1016
Input: Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Sliver can inject code into local and remote processes.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Janicab captured audio and sent it out to a C2 server.

Tactics: TA0009
Techniques: T1123
Input: APT29 has conducted brute force password spray attacks.

Tactics: TA0006
Techniques: T1110, T1110.003
Input: Monitor for anomalous authentication activity, such as logons or other user session activity associated with unknown accounts.

Tactics: TA0006
Techniques: T1606, T1606.001
Input: Some network designs require NAT for the packets to cross the border device.

Tactics: TA0005
Techniques: T1599, T1599.001
Input: Zeus Panda searches for specific directories on the victim’s machine.

Tactics: TA0007
Techniques: T1083
Input: PlugX has a module to create, delete, or modify Registry keys.

Tactics: TA0005
Techniques: T1112
Input: APT33 has used FTP to exfiltrate files (separately from the C2 channel).

Tactics: TA0010
Techniques: T1048.003, T1048
Input: Dacls has had its payload named with a dot prefix to make it hidden from view in the Finder application.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: VBA code can be extracted from p-code before execution with tools such as the pcodedmp disassembler.

Tactics: TA0005
Techniques: T1564, T1564.007
Input: Monitor newly constructed files that may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053
Input: Nltest may be used to enumerate remote domain controllers using options such as /dclist and /dsgetdc.

Tactics: TA0007
Techniques: T1018
Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or Exploit Public-Facing Application).

Tactics: TA0043
Techniques: T1592, T1592.003
Input: Monitor for newly constructed containers

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.007, T1053
Input: Astaroth loads its module with the XSL script parameter vShow set to zero, which opens the application with a hidden window.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: In 2016, APT28 conducted a distributed denial of service (DDoS) attack against the World Anti-Doping Agency.

Tactics: TA0040
Techniques: T1498
Input: Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

Tactics: TA0005
Techniques: T1027
Input: Dyre has the ability to achieve persistence by adding a new task in the task scheduler to run every minute.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Sibot has used a legitimate compromised website to download DLLs to the victim's machine.

Tactics: TA0011
Techniques: T1102
Input: Chaes has used .MSI files as an initial way to start the infection chain.

Tactics: TA0005
Techniques: T1218, T1218.007