madox81/Adema_ATTACK_DS huggingface dataset:
Input: The Retriever Trojan uses the following namespace: using pcchekapp.grp.ammar.samaneh; Android.The malware begins by creating a web service object and uses the following URL within its configuration: http:// service.chrome-up[.]date:8080 /WebService.asmx It then calls a function called “SetLog2”, which sets variables for the system’s IP address, MAC address and hostname

Tactics: TA0007
Techniques: T1016
Input: Adversaries may gather credentials that can be used during targeting.

Tactics: TA0043
Techniques: T1589, T1589.001
Input: Team member or team identifier Analysis of the OwaAuth web shell revealed a PDB string with the "SyberSpace" username (see Figure 20)

Tactics: TA0003, TA0007
Techniques: T1505.003, T1033, T1505
Input: Prikormka encodes C2 traffic with Base64.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX.

Tactics: TA0005
Techniques: T1218, T1218.001
Input: looks for net and account or domain in close proximity

Tactics: TA0007
Techniques: T1201
Input: COM execution

Tactics: TA0008
Techniques: T1021.003, T1021
Input: Kerberos tickets on macOS are stored in a standard ccache format, similar to Linux.

Tactics: TA0006
Techniques: T1558
Input: Sandworm Team has tricked unwitting recipients into clicking on spearphishing attachments and enabling malicious macros embedded within files.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Ebury has verified C2 domain ownership by decrypting the TXT record using an embedded RSA public key.

Tactics: TA0005
Techniques: T1140
Input: SharpStage has a persistence component to write a scheduled task for the payload.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: When macros are enabled and run, the macro within the Word document searches the sections of the document to get the contents of the header using the following piece of code:       Set rng = ActiveDocument.Sections(intSection).Headers(1).Range     The code above obtains the contents of the header, which the macro will write to a file at C:\programdata\Office365DCOMCheck.ps1

Tactics: TA0002, TA0005, TA0007, TA0011
Techniques: T1140, T1090.003, T1083, T1090, T1204
Input: This may deny access to available backups and recovery options.

Tactics: TA0040
Techniques: T1490
Input: BONDUPDATER is written in PowerShell.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Zebrocy decodes its secondary payload and writes it to the victim’s machine.

Tactics: TA0005
Techniques: T1140
Input: Mimikatz's MISC::AddSid module can appended any SID or user/group account to a user's SID-History.

Tactics: TA0004, TA0005
Techniques: T1134.005, T1134
Input: SILENTTRINITY can scan for open ports on a compromised machine.

Tactics: TA0007
Techniques: T1046
Input: Ensure proper Registry permissions are in place to prevent adversaries from disabling or interfering with security services.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Figure 3 Countries in which OopsIE will run in based on the time zone Notable Differences The OopsIE Trojan delivered in this attack had functional code that was very similar to the OopsIE variant discussed in our previous blog

Tactics: TA0007
Techniques: T1124
Input: Transparent Tribe has used websites with malicious hyperlinks and iframes to infect targeted victims with Crimson, njRAT, and other malicious tools.

Tactics: TA0001
Techniques: T1189
Input: In some cases, cloud accounts may be federated with traditional identity management system, such as Window Active Directory.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078.004, T1078
Input: KONNI can take screenshots of the victim’s machine.

Tactics: TA0009
Techniques: T1113
Input: Wizard Spider has used stolen credentials to copy tools into the %TEMP% directory of domain controllers.

Tactics: TA0008
Techniques: T1570
Input: ThreatNeedle chooses its payload creation path from a randomly selected service name from netsvc.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: This behavior is distinct from Disk Content Wipe and Disk Structure Wipe because individual files are destroyed rather than sections of a storage disk or the disk's logical structure.

Tactics: TA0040
Techniques: T1485
Input: The public keys of each entity are exchanged before encrypted communications begin.

Tactics: TA0010
Techniques: T1048.002, T1048
Input: Magic Hound stole domain credentials from Microsoft Active Directory Domain Controller and leveraged Mimikatz.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: emond

Tactics: TA0003, TA0004
Techniques: T1546, T1546.014
Input: After acquiring credentials from web browsers, adversaries may attempt to recycle the credentials across different systems and/or accounts in order to expand access.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: PowerSploit's Invoke-TokenManipulation Exfiltration module can be used to manipulate tokens.

Tactics: TA0004, TA0005
Techniques: T1134
Input: keylog

Tactics: TA0006, TA0009
Techniques: T1056
Input: DarkHydrus leveraged PowerShell to download and execute additional scripts for execution.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Adversaries may collect data stored in the clipboard from users copying information within or between applications.

Tactics: TA0009
Techniques: T1115
Input: Figure 4 x_mode command and new line delimited settings As seen in Figure 4, the settings are stored in variables seen in Table 6, which are used to authenticate to the actor-controlled Google account before uploading and downloading files from Google Drive

Tactics: TA0011
Techniques: T1102
Input: The termsrv.dll file, typically stored in %SystemRoot%\System32\, is the default ServiceDll value for Terminal Services in HKLM\System\CurrentControlSet\services\TermService\Parameters\.

Tactics: TA0003
Techniques: T1505.005, T1505
Input: The sample, in the form of an RTF document, exploited CVE-2016-4117 to download and install a program from a remote C&C server

Tactics: TA0011
Techniques: T1105
Input: Monitor for newly constructed files that may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system.

Tactics: TA0003
Techniques: T1137.002, T1137
Input: Figure 2: De-obfuscated code scheduling the second task to run a script embedded in a blog page The last section of script embedded in 29[.]html then downloads Revenge RAT and injects the binary into the memory of a running process, as seen in Figure 3

Tactics: TA0004, TA0005
Techniques: T1055
Input: ZxShell can check the services on the system.

Tactics: TA0007
Techniques: T1007
Input: HyperStack can add the name of its communication pipe to HKLM\SYSTEM\CurrentControlSet\Services\lanmanserver\parameters\NullSessionPipes.

Tactics: TA0005
Techniques: T1112
Input: IcedID has embedded binaries within RC4 encrypted .png files.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: Analysts should monitor Registry settings for unauthorized changes.

Tactics: TA0004, TA0005
Techniques: T1548
Input: Lizar can retrieve browser history and database files.

Tactics: TA0007
Techniques: T1217
Input: The token can then be used with ImpersonateLoggedOnUser to allow the calling thread to impersonate a logged on user's security context, or with SetThreadToken to assign the impersonated token to a thread.

Tactics: TA0004, TA0005
Techniques: T1134, T1134.001
Input: rc.local

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: HermeticWizard can connect to remote shares using WNetAddConnection2W.

Tactics: TA0002
Techniques: T1106
Input: Crimson contains a command to collect information about anti-virus software on the victim.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Palo Alto Networks customers are already be protected via:  All samples in this report have a malicious verdict in WildFire Domains have been classified as malicious AutoFocus tags are available for additional context: DarkHydrus and RogueRobin  Indicators of Compromise Delivery Document SHA256 513813af1590bc9edeb91845b454d42bbce6a5e2d43a9b0afa7692e4e500b4c8 e068c6536bf353abe249ad0464c58fb85d7de25223442dd220d64116dbf1e022 4e40f80114e5bd44a762f6066a3e56ccdc0d01ab2a18397ea12e0bc5508215b8 RogueRobin SHA256 eb33a96726a34dd60b053d3d1048137dffb1bba68a1ad6f56d33f5d6efb12b97 f1b2bc0831445903c0d51b390b1987597009cc0fade009e07d792e8d455f6db0 5cc62ad6baf572dbae925f701526310778f032bb4a54b205bada78b1eb8c479c RogueRobin C2s akdns[.]live akamaiedge[.]live edgekey[.]live akamaized[.]live 0ffice365[.]agency 0nedrive[.]agency corewindows[.]agency microsoftonline[.]agency onedrive[.]agency sharepoint[.]agency skydrive[.]agency 0ffice365[.]life 0ffice365[.]services skydrive[.]services skydrive[.]agency Nameservers tvs1.trafficmanager[.]live tvs2.trafficmanager[.]live tbs1.microsoftonline[.]services tbs2.microsoftonline[.]services brit.ns.cloudfronts[.]services dns.cloudfronts[.]services ns2.akadns[.]services britns.akadns[.]services britns.akadns[.]live ns2.akadns[.]live Related Domains iecvlist-microsoft[.]live data-microsoft[.]services asimov-win-microsoft[.]services onecs-live[.]services akamaiedge[.]services phicdn[.]world azureedge[.]today nsatc[.]agency Akamai[.]agency t-msedge[.]world

Tactics: TA0002, TA0003, TA0004, TA0007, TA0011
Techniques: T1007, T1569.002, T1543.003, T1203, T1046, T1543, T1569, T1102
Input: BOOSTWRITE has encoded its payloads using a ChaCha stream cipher with a 256-bit key and 64-bit Initialization vector (IV) to evade detection.

Tactics: TA0005
Techniques: T1027
Input: Once authenticated, PtH may be used to perform actions on local or remote systems.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: GALLIUM used WinRAR to compress and encrypt stolen data prior to exfiltration.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Empire has a module for creating a new domain user if permissions allow.

Tactics: TA0003
Techniques: T1136, T1136.002
Input: Kobalos can modify timestamps of replaced files, such as ssh with the added credential stealer or sshd used to deploy Kobalos.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: If a remote access tool is used in this manner to move laterally, then additional actions are likely to occur after execution, such as opening network connections for Command and Control and system and network information Discovery.

Tactics: TA0001, TA0008
Techniques: T1091
Input: Kimsuky has used a file injector DLL to spawn a benign process on the victim's system and inject the malicious payload into it via process hollowing.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: PowerStallion uses Microsoft OneDrive as a C2 server via a network drive mapped with net use.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: The SecurityAssist task is responsible for running the following command line command that uses the Certutil application to decode the base64 encoded data in Base.txt and saves the decoded data to the file %PROGRAMDATA%\IntelSecurityAssistManager.exe:cmd.exe /c Certutil -decode %appdata%\Base.txt %programdata%\IntelSecurityAssistManager.exe & SchTasks /Delete /F /TN SecurityAssist The macro also creates a second scheduled task named Conhost that waits two minutes and runs a VBScript %APPDATA%\chkSrv.vbs

Tactics: TA0005
Techniques: T1140, T1036
Input: IronNetInjector has used a task XML file named mssch.xml to run an IronPython script when a user logs in or when specific system events are created.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: ACK floods leverage the stateful nature of the TCP protocol.

Tactics: TA0040
Techniques: T1499, T1499.001
Input: collect usernames

Tactics: TA0007
Techniques: T1033
Input: wevtutil cl application

Tactics: TA0005
Techniques: T1070, T1070.001
Input: RDAT can upload a file via HTTP POST response to the C2 split into 102,400-byte portions.

Tactics: TA0010
Techniques: T1030
Input: PowerShower is a backdoor written in PowerShell.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Turla has used net group "Domain Admins" /domain to identify domain administrators.

Tactics: TA0007
Techniques: T1069.002, T1069
Input: Adversaries may commandeer these sessions to carry out actions on remote systems.

Tactics: TA0008
Techniques: T1563
Input: ShimRat has hijacked the cryptbase.dll within migwiz.exe to escalate privileges.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Lokibot has used HTTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Patch the BIOS and EFI as necessary.

Tactics: TA0003, TA0005
Techniques: T1542.001, T1542
Input: IronNetInjector has been disguised as a legitimate service using the name PythonUpdateSrvc.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Adversaries may create and cultivate social media accounts that can be used during targeting.

Tactics: TA0042
Techniques: T1585, T1585.001
Input: Rising Sun can detect network adapter and IP address information.

Tactics: TA0007
Techniques: T1016
Input: The certificates used during an operation may be created, acquired, or stolen by the adversary.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: KONNI can gather the OS version, architecture information, connected drives, hostname, RAM size, and disk space information from the victim’s machine and has used cmd /c systeminfo command to get a snapshot of the current system state of the target machine.

Tactics: TA0007
Techniques: T1082
Input: Cobalt Strike can set its Beacon payload to reach out to the C2 server on an arbitrary and random interval.

Tactics: TA0010
Techniques: T1029
Input: Sliver can collect network connection information.

Tactics: TA0007
Techniques: T1049
Input: Fysbis has established persistence using a systemd service.

Tactics: TA0003, TA0004
Techniques: T1543.002, T1543
Input: net localgroup

Tactics: TA0007
Techniques: T1087, T1069
Input: PoshC2 contains modules, such as Get-ComputerInfo, for enumerating common system information.

Tactics: TA0007
Techniques: T1082
Input: Ensure KB3191938 which blocks Outlook Visual Basic and displays a malicious code warning, KB4011091 which disables custom forms by default, and KB4011162 which removes the legacy Home Page feature, are applied to systems.

Tactics: TA0003
Techniques: T1137, T1137.004, T1137.003, T1137.005
Input: !Hello The Trojan introduces itself by sending the current username, if its an admin account or not, the computer name, the system UUID and the OS version

Tactics: TA0007
Techniques: T1033, T1082
Input: Melcoz can use MSI files with embedded VBScript for execution.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: Exfiltration to these cloud storage services can provide a significant amount of cover to the adversary if hosts within the network are already communicating with the service.

Tactics: TA0010
Techniques: T1567.002, T1567
Input: Mustang Panda has used mshta.exe to launch collection scripts.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: The Trojan checks the modified time of the file by creating an HTTP request to a URL structured as follows: <Google Drive URL in ‘gdu’> + <file identifier> + “?supportTeamDrives=true&fields=modifiedTime” The Trojan then uses the following regular expression to obtain the modified time of the file from the HTTP response, which is saved to the variable named modification_time: \”modifiedTime\”:(.*) The Trojan then uploads a second file to the Google Drive, the purpose of which is to allow the Trojan to continually write to this file as it waits for the actor to modify the first file uploaded

Tactics: TA0003, TA0004, TA0005, TA0009, TA0011
Techniques: T1547.009, T1070, T1070.006, T1547, T1105, T1074
Input: Domain names are the human readable names used to represent one or more IP addresses.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: Pupy can list the running processes and get the process ID and parent process’s ID.

Tactics: TA0007
Techniques: T1057
Input: build_downer has added itself to the Registry Run key as "NVIDIA" to appear legitimate.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Bazar can perform a check to ensure that the operating system's keyboard and language settings are not set to Russian.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: Adversaries may use a hidden file system to conceal malicious activity from users and security tools.

Tactics: TA0005
Techniques: T1564, T1564.005
Input: IndigoZebra created Dropbox accounts for their operations.

Tactics: TA0042
Techniques: T1583.006, T1583
Input: Adversaries may reduce the level of effort required to decrypt data transmitted over the network by reducing the cipher strength of encrypted communications.

Tactics: TA0005
Techniques: T1600.001, T1600
Input: Zeus Panda can take screenshots of the victim’s machine.

Tactics: TA0009
Techniques: T1113
Input: Mis-Type may create a file containing the results of the command cmd.exe /c net user {Username}.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: DarkWatchman has used Base64 to encode PowerShell commands.

Tactics: TA0005
Techniques: T1027
Input: GuLoader has the ability to perform anti-VM and anti-sandbox checks using string hashing, the API call EnumWindows, and checking for Qemu guest agent.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: OAuth is one commonly implemented framework that issues tokens to users for access to systems.

Tactics: TA0005, TA0006, TA0008
Techniques: T1550.001, T1528, T1550
Input: GRIFFON has used a persistence module that stores the implant inside the Registry, which executes at logon.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Threat Group-3390 has obtained and used tools such as Impacket, pwdump, Mimikatz, gsecdump, NBTscan, and Windows Credential Editor.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Our analysis of the backdoors used in the September 2018 attacks show that AuditCred.dll/ROptimizer.dll was similarly used:      FileTokenBroker.dll  (2017 attack) AuditCred.dll/Roptimizer.dll  (2018 attack)   Launch Method Service Service   Function Loader Component Loader Component   Working directory %Windows%\System32 %Windows%\System32   Loaded Component Path %Windows%\System32\en-US %Program Files%\Common Files\System\ado   Loaded Component Blending Blends with .mui files Blend with ActiveX data Object dll files    Table1: Similarities of the Loader components in both incidents Analysis of backdoors used in 2018 The Lazarus group used a series of backdoors in their 2018 attacks, employing a complicated technique that involves three major components:  AuditCred.dll/ROptimizer.dll (detected by Trend Micro as BKDR_BINLODR.ZNFJ-A) – loader DLL that is launched as a service Msadoz<n>.dll (detected by Trend Micro as BKDR64_BINLODR.ZNFJ-A) – encrypted backdoor n = number of characters in the loader dll’s filename Auditcred.dll.mui/rOptimizer.dll.mui (detected by Trend Micro as TROJ_BINLODRCONF.ZNFJ-A) – encrypted configuration file   Figure 1: Loading sequence of the modularized backdoor The loader DLL is installed as a service and uses different names (AuditCred and ROptimizer) on different machines

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1218, T1574.002, T1218.011, T1055, T1574
Input: Windows API calls such as SuspendThread/SetThreadContext/ResumeThread, QueueUserAPC/NtQueueApcThread, and those that can be used to modify memory within another process, such as VirtualAllocEx/WriteProcessMemory, may be used for this technique.

Tactics: TA0004, TA0005
Techniques: T1055.004, T1055
Input: Linux Rabbit maintains persistence on an infected machine through rc.local and .bashrc files.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: Wizard Spider has used Rubeus, MimiKatz Kerberos module, and the Invoke-Kerberoast cmdlet to steal AES hashes.

Tactics: TA0006
Techniques: T1558.003, T1558
Input: The following tools and techniques can be used to enumerate the NTDS file and the contents of the entire Active Directory hashes.

Tactics: TA0006
Techniques: T1003.003, T1003
Input: TSCookie has the ability to identify the IP of the infected host.

Tactics: TA0007
Techniques: T1016
Input: KeyBoy uses PowerShell commands to download and execute payloads.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: When it is necessary to do this for a large flood of packets, the computational requirements can cause the server to become sluggish and/or unresponsive, due to the work it must do to eliminate the rogue ACK packets.

Tactics: TA0040
Techniques: T1499, T1499.001
Input: RTM can obtain a list of smart card readers attached to the victim.

Tactics: TA0007
Techniques: T1120
Input: Transparent Tribe has dropped encoded executables on compromised hosts.

Tactics: TA0005
Techniques: T1027
Input: Denis obfuscates its code and encrypts the API names.

Tactics: TA0005
Techniques: T1027
Input: Turla RPC backdoors have used cmd.exe to execute commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Use this command to query the operating system for its version number and compare it to what is expected for the device in question.

Tactics: TA0005
Techniques: T1601
Input: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Firewall rules may also already exist to permit traffic to these services.

Tactics: TA0010
Techniques: T1567
Input: Monitor executed commands and arguments that may hijack a legitimate user's SSH session to move laterally within an environment.

Tactics: TA0008
Techniques: T1563, T1563.001
Input: BoxCaon can execute arbitrary commands and utilize the "ComSpec" environment variable.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Lazarus Group has hosted custom and open-source tools on compromised as well as Lazarus Group-controlled servers.

Tactics: TA0042
Techniques: T1608, T1608.002
Input: Downgrading of a system image can be done on its own, or it can be used in conjunction with Patch System Image.

Tactics: TA0005
Techniques: T1601, T1601.002
Input: ThiefQuest searches through the /Users/ folder looking for executable files.

Tactics: TA0003
Techniques: T1554
Input: Comnie executes the netstat -ano command.

Tactics: TA0007
Techniques: T1049
Input: A Patchwork .dll that contains BADNEWS is loaded and executed using DLL side-loading.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: Grandoreiro can steal the victim's cookies to use for duplicating the active session from another device.

Tactics: TA0006
Techniques: T1539
Input: In some cases, the seed that a particular sample uses can be extracted from DNS traffic.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: PUNCHBUGGY has been observed using a Registry Run key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Pandora can communicate over HTTP.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: To disguise the source of malicious traffic, adversaries may chain together multiple proxies.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: APT29 used sticky-keys to obtain unauthenticated, privileged console access.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: FlawedGrace encrypts its C2 configuration files with AES in CBC mode.

Tactics: TA0005
Techniques: T1027
Input: Do not create service accounts with administrative privileges.

Tactics: TA0004, TA0005
Techniques: T1484
Input: Volgmer deobfuscates its strings and APIs once its executed.

Tactics: TA0005
Techniques: T1140
Input: Smoke Loader uses a simple one-byte XOR method to obfuscate values in the malware.

Tactics: TA0005
Techniques: T1027
Input: Adversaries may abuse these mechanisms as a means of maintaining persistent access to a victim via repeatedly executing malicious code.

Tactics: TA0003, TA0004
Techniques: T1546
Input: HKCU\Software\Microsoft\Office test\Special\Perf

Tactics: TA0003
Techniques: T1137
Input: PoisonIvy creates run key Registry entries pointing to a malicious executable dropped to disk.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Cyclops Blink can use a custom binary scheme to encode messages with specific commands and parameters to be executed.

Tactics: TA0011
Techniques: T1132, T1132.002