madox81/Adema_ATTACK_DS huggingface dataset:
Input: Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001, T1497.002
Input: TeamTNT has created local privileged users on victim machines.

Tactics: TA0003
Techniques: T1136, T1136.001
Input: Ke3chang has used network scanning and enumeration tools, including Ping.

Tactics: TA0007
Techniques: T1018
Input: capture screenshot

Tactics: TA0009
Techniques: T1113
Input: Monitor executed commands and arguments of .scr files.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.002
Input: Once executed, Vcrodat loads an encrypted payload on to the victim’s computer.

Tactics: TA0005
Techniques: T1027
Input: POWRUNER can use base64 encoded C2 communications.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: SpicyOmelette can identify the system name of a compromised host.

Tactics: TA0007
Techniques: T1082
Input: Admins can add restrictions to applications by setting the setuid and/or setgid bits, use entitlements, or have a __RESTRICT segment in the Mach-O binary.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.006, T1574
Input: Compare recent invocations of msiexec.exe with prior history of known good arguments and executed MSI files.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: Melcoz can monitor content saved to the clipboard.

Tactics: TA0009
Techniques: T1115
Input: application shim

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: WinExec()

Tactics: TA0002
Techniques: T1106
Input: Monitor for new constructed systemd services to repeatedly execute malicious payloads as part of persistence.

Tactics: TA0003, TA0004
Techniques: T1543.002, T1543
Input: Operation Wocao has used the tasklist command to search for one of its backdoors.

Tactics: TA0007
Techniques: T1007
Input: FoggyWeb's loader has used DLL Search Order Hijacking to load malicious code instead of the legitimate version.dll during the Microsoft.IdentityServer.ServiceHost.exe execution process.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: A remote build request may be sent to the Docker API that includes a Dockerfile that pulls a vanilla base image, such as alpine, from a public or local registry and then builds a custom image upon it.

Tactics: TA0005
Techniques: T1612
Input: Threat Group-3390 has lured victims into opening malicious files containing malware.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Adversaries may also stage collected data in various available formats/locations of a system, including local storage databases/repositories or the Windows Registry.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: attrib +h

Tactics: TA0005
Techniques: T1222
Input: This third-party server is commonly termed a reflector.

Tactics: TA0040
Techniques: T1498, T1498.002
Input: ServHelper may attempt to establish persistence via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ run key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Bankshot marks files to be deleted upon the next system reboot and uninstalls and removes itself from the system.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: It hands over the decrypted buffer extracted from the resource section and the path from the original RegAsm executable to the start_protect_hexcode function.Then it starts the process-hollowing shellcode, which is stored in the HEXCODE1 variable

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: The following Registry keys can be used to set startup folder items for persistence:

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: menuPass has used RDP connections to move across the victim network.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: On Windows 8.1 and Windows Server 2012 R2, enable Protected Process Light for LSA.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: infoClient is reponsible for collecting OS info, submitting this info to its C&C servers (the servers are malicious in nature), and receiving additional C&C communication information

Tactics: TA0007
Techniques: T1082
Input: Flagpro has been delivered within ZIP or RAR password-protected archived files.

Tactics: TA0005
Techniques: T1027
Input: The payload then uses the MD5 hash (14331d289e737093994395d3fc412afc) of what appears to be a hardcoded SHA1 hash (B6A75B1EF701710D7AEADE0FE93DE8477F3BD506) as an RC4 key to decrypts the resulting decoded data

Tactics: TA0005
Techniques: T1140
Input: Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture audio.

Tactics: TA0009
Techniques: T1123
Input: Another variation of this technique, dubbed "Squiblytwo", involves using Windows Management Instrumentation to invoke JScript or VBScript within an XSL file.

Tactics: TA0005
Techniques: T1220
Input: BRONZE BUTLER has used net time to check the local time on a target system.

Tactics: TA0007
Techniques: T1124
Input: admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: net localgroup administrator >> %temp%\download

Tactics: TA0007
Techniques: T1069.001, T1069
Input: Chaes has used JavaScript and Node.Js information stealer script that exfiltrates data using the node process.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: TeamTNT has disabled iptables.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: All zero-day exploits known, or suspected, to have been used by this group are for vulnerabilities in Internet Explorer and Flash

Tactics: TA0004
Techniques: T1068
Input: reg query

Tactics: TA0007
Techniques: T1012
Input: FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on removable media and copies them to a staging area.

Tactics: TA0009
Techniques: T1025
Input: Stage 1 sample file: 3amadi_hamas.zip MD5: e686ffa90b2bfb567547f1c0dad1ae0b Type: Compressed container Child file/lure name: محضر اجتماع العمادي مع هنية رئيس حماس امس الاحد .exe Child file/lure MD5: 92dd0f16e8ae274d83ba1d0d5b2e342  This sample ZIP file, which is similar to many other stage 1 downloaders in this campaign, contains an executable that is a compiled AutoIt script and which embeds some interesting functions (listed in the table below)

Tactics: TA0005, TA0007, TA0009, TA0011
Techniques: T1036, T1090.003, T1083, T1090, T1074
Input: Attor has a file uploader plugin that automatically exfiltrates the collected data and log files to the C2 server.

Tactics: TA0010
Techniques: T1020
Input: Trojan.Karagany can create directories to store plugin output and stage data for exfiltration.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Interestingly, the delivery document borrowed a technique which was publicized in late 2017 as being used by the Sofacy threat actors, embedding the main malicious code in a EXIF metadata property of the document

Tactics: TA0005
Techniques: T1140
Input: The tool runs the following list of WMI queries:  wmic logicaldisk get Caption, Description,VolumeSerialNumber,Size,FreeSpace wmic diskdrive get Model, SerialNumber wmic computersystem get Manufacturer, Model, Name, SystemTypec wmic os get Caption, OSArchitecture, OSLanguage,SystemDrive,MUILanguages wmic process get Caption,ExecutablePath  The URL used to send the system information, running processes and a screenshot to the C2 server is: hxxp://145.249.105[.]165/resource-store/stockroom-center-service/check.php?fm=[serial number] The C# variant of Zebrocy uses an HTTP POST request to the URL above to transmit the gathered data, of which is included within the HTTP POST data that is structured as follows: spp=[system information from WMI queries] &spvg=[screenshot in JPEG format] Conclusion The Sofacy group continues their attacks on organizations across the globe using similar tactics and techniques

Tactics: TA0002, TA0007, TA0010
Techniques: T1041, T1057, T1047
Input: Use verification of distributed binaries through hash checking or other integrity checking mechanisms.

Tactics: TA0001
Techniques: T1195.001, T1195, T1195.002
Input: Monitor for newly constructed pods that may deploy a container into an environment to facilitate execution or evade defenses.

Tactics: TA0002, TA0005
Techniques: T1610
Input: Ke3chang has developed custom malware that allowed them to maintain persistence on victim networks.

Tactics: TA0042
Techniques: T1587, T1587.001
Input: Remcos takes automated screenshots of the infected machine.

Tactics: TA0009
Techniques: T1113
Input: SslMM sends the logged-on username to its hard-coded C2.

Tactics: TA0007
Techniques: T1033
Input: LogMeing

Tactics: TA0011
Techniques: T1219
Input: Invoke-DCOM

Tactics: TA0008
Techniques: T1021.003, T1021
Input: McAfee ATR has now discovered additional implants that are part of an operation to gain persistence for continued data exfiltration and for targeted access

Tactics: TA0011
Techniques: T1132
Input: Rover persists by creating a Registry entry in HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Additionally, a Turla custom executable containing Metasploit shellcode is saved to the Startup folder to gain persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions.

Tactics: TA0004, TA0005
Techniques: T1548
Input: Peirates can deploy a pod that mounts its node’s root file system, then execute a command to create a reverse shell on the node.

Tactics: TA0002, TA0005
Techniques: T1610
Input: The Helminth config file is encrypted with RC4.

Tactics: TA0005
Techniques: T1027
Input: Information about client configurations may include a variety of details and settings, including operating system/version, virtualization, architecture (ex: 32 or 64 bit), language, and/or time zone.

Tactics: TA0043
Techniques: T1592, T1592.004
Input: Depending on the specific method of phishing, the detections can vary.

Tactics: TA0043
Techniques: T1598
Input: The Registry may also be modified through Windows system management tools such as Windows Management Instrumentation and PowerShell, which may require additional logging features to be configured in the operating system to collect necessary information for analysis.

Tactics: TA0005
Techniques: T1112
Input: Command-line invocation of tools capable of adding or modifying services may be unusual, depending on how systems are typically used in a particular environment.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: KONNI can collect the username from the victim’s machine.

Tactics: TA0007
Techniques: T1033
Input: [UUID].plist file to execute payloads when a user logs in.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.007
Input: CostaRicto has used scheduled tasks to download backdoor tools.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: This behavior is the same for logout hooks where a script can be executed upon user logout.

Tactics: TA0003, TA0004
Techniques: T1037.002, T1037
Input: Preemptively search for files containing passwords and take actions to reduce the exposure risk when found.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: The state command sets a global variable containing a series of Boolean values represented as ASCII values ‘0’ or ‘1’ and also adds itself to the configuration file

Tactics: TA0005
Techniques: T1140
Input: PoetRAT has the ability to compress files with zip.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Portions of files can also be encoded to hide the plain-text strings that would otherwise help defenders with discovery.

Tactics: TA0005
Techniques: T1027
Input: USBStealer mimics a legitimate Russian program called USB Disk Security.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Figure 3 shows this webshell’s code that will run supplied JScript provided in base64 encoded format within the URL within a parameter

Tactics: TA0005
Techniques: T1027
Input: Bazar can identify the username of the infected user.

Tactics: TA0007
Techniques: T1033
Input: Windows API calls

Tactics: TA0002
Techniques: T1106
Input: Dipsind can download remote files.

Tactics: TA0011
Techniques: T1105
Input: Enable firewall rules to block RDP traffic between network security zones within a network.

Tactics: TA0008
Techniques: T1563.002, T1021.001, T1021, T1563
Input: TrickBot can use secondary C2 servers for communication after establishing connectivity and relaying victim information to primary C2 servers.

Tactics: TA0011
Techniques: T1008
Input: APT3 has a tool that can list out currently running processes.

Tactics: TA0007
Techniques: T1057
Input: SNUGRIDE is a backdoor that communicates with its C2 server through HTTP requests

Tactics: TA0011
Techniques: T1071
Input: Hildegard has used masscan to look for kubelets in the internal Kubernetes network.

Tactics: TA0007
Techniques: T1046
Input: APT41 deleted files from the system.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: CreateProcess

Tactics: TA0002
Techniques: T1106
Input: Some Orz versions have an embedded DLL known as MockDll that uses Process Hollowing and regsvr32 to execute another payload.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Donut can patch Antimalware Scan Interface (AMSI), Windows Lockdown Policy (WLDP), as well as exit-related Native API functions to avoid process termination.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Unsandboxed applications with an unspecified LSFileQuarantineEnabled entry will default to not setting the quarantine flag.

Tactics: TA0005
Techniques: T1553.001, T1553
Input: QakBot can execute WMI queries to gather information.

Tactics: TA0002
Techniques: T1047
Input: Webshell to maintain access to victim networks.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Monitor Registry key additions to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\.Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing the Active Setup Registry locations and startup folders.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.014
Input: Javali has used embedded VBScript to download malicious payloads from C2.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: MURKYTOP has the capability to retrieve information about groups.

Tactics: TA0007
Techniques: T1069
Input: The Linux utility, unshadow, can be used to combine the two files in a format suited for password cracking utilities such as John the Ripper: # /usr/bin/unshadow /etc/passwd /etc/shadow > /tmp/crack.password.db

Tactics: TA0006
Techniques: T1003, T1003.008
Input: Daserf can log keystrokes.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Magic Hound has acquired Amazon S3 buckets to use in C2.

Tactics: TA0042
Techniques: T1583.006, T1583
Input: Monitor for newly executed processes that may create or edit shortcuts to run a program during system boot or user login.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Monitor executed commands and arguments for actions that can leverage a computer’s peripheral devices (, microphones and webcams) or applications (, voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.

Tactics: TA0009
Techniques: T1123
Input: WhisperGate can use PowerShell to support multiple actions including execution and defense evasion.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Monitor the addition of the MiniNT registry key in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control, which may disable Event Viewer.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: Conti has decrypted its payload using a hardcoded AES-256 key.

Tactics: TA0005
Techniques: T1140
Input: Cobalt Strike can conduct peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol.

Tactics: TA0011
Techniques: T1071
Input: Adversaries may stage collected data in a central location or directory prior to Exfiltration.

Tactics: TA0009
Techniques: T1074
Input: BackdoorDiplomacy has used an executable to detect removable media, such as USB flash drives.

Tactics: TA0007
Techniques: T1120
Input: While the seller specifies that HawkEye Reborn should only be used on systems with permission, they also explicitly forbid scanning of HawkEye Reborn executables using antivirus software, likely an attempt to minimize the likelihood that anti-malware solutions will detect HawkEye Reborn binaries.Following these changes, the new developer of HawkEye Reborn has continued to make changes and we expect this to continue as long as the developer can monetize their efforts.As with other malware that we wrote about last year, while the developer claims that the software should only be used on systems with permission, or "for educational purposes," malicious attackers have been continuously leveraging it against various targets around the world.Distribution campaignsFor several months during the last half of 2018 and continuing into 2019, Cisco Talos has observed ongoing malicious email campaigns that are being used to distribute versions of the HawkEye Reborn keylogger/stealer

Tactics: TA0007
Techniques: T1518.001, T1518, T1018
Input: This "downloaded" file is actually not dropped onto the system.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Mythic supports DNS-based C2 profiles.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: WarzoneRAT can obtain a list of processes on a compromised host.

Tactics: TA0007
Techniques: T1057
Input: ThiefQuest exfiltrates targeted file extensions in the /Users/ folder to the command and control server via unencrypted HTTP.

Tactics: TA0010
Techniques: T1041
Input: EnvyScout can Base64 encode payloads.

Tactics: TA0005
Techniques: T1027
Input: In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion.

Tactics: TA0005
Techniques: T1070, T1070.003
Input: Credentials targeted by PinchDuke include ones associated many sources such as WinInet Credential Cache, and Lightweight Directory Access Protocol (LDAP).

Tactics: TA0006
Techniques: T1003
Input: Any information gathered from the endpoint is first stored in the following file, encrypted, and sent to the control server:  C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\1.hwp  The following information is gathered from the endpoint, stored in the file 1.hwp, and sent to the control server:  Directory listing of the user’s Desktop folder using command:  cmd.exe /c dir C:\DOCUME~1\<username>\Desktop\ >> C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\1.hwp  Directory listing of the user’s recently accessed files using command:  cmd.exe /c dir C:\DOCUME~1\<username>\Recent >> C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\1.hwp  Directory listing of the system’s %programfiles% folder using command:  cmd.exe /c dir C:\PROGRA~1\ >> C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\1.hwp  Systeminfo of the endpoint using command:  cmd.exe /c systeminfo >> C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\1.hwp  Copies the file ixe000.bin from:  C:\Documents and Settings\<username>\Application Data\Microsoft\Windows\UserProfiles\ixe000.bin To: C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\1.hwp  Registry key and value information for the current user’s Run key (with information collected):  HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Number of subkeys (<KeyIndex>) <KeyName> Number of Values under each key including the parent Run key (<ValueIndex>) <Value_Name> <Value_Content>  Registry Run key enumeration by Gold Dragon

Tactics: TA0003, TA0004, TA0007, TA0009
Techniques: T1033, T1547.001, T1547, T1560
Input: An adversary may disable cloud logging capabilities and integrations to limit what data is collected on their activities and avoid detection.

Tactics: TA0005
Techniques: T1562.008, T1562
Input: Ixeshe enumerates the IP address, network proxy settings, and domain name from a victim's system.

Tactics: TA0007
Techniques: T1016
Input: KOCTOPUS has been distributed via spearphishing emails with malicious attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services.

Tactics: TA0043, TA0001
Techniques: T1598.001, T1566.003, T1566, T1598
Input: APT38 has used a custom MBR wiper named BOOTWRECK, which will initiate a system reboot after wiping the victim's MBR.

Tactics: TA0040
Techniques: T1529
Input: BONDUPDATER can read batch commands in a file sent from its C2 server and execute them with cmd.exe.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Pteranodon exfiltrates screenshot files to its C2 server.

Tactics: TA0010
Techniques: T1041
Input: Hancitor has been delivered via phishing emails which contained malicious links.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: ipconfig

Tactics: TA0007
Techniques: T1016
Input: Detection of process argument spoofing may be difficult as adversaries may momentarily modify stored arguments used for malicious execution.

Tactics: TA0005
Techniques: T1564.010, T1564
Input: Cyber threat groups’ access to the media organization’s networks could potentially provide the government advance warning on upcoming protests, information on pro-democracy group leaders, and insights needed to disrupt activity on the Internet, such as what occurred in mid-2014 when several websites were brought down in denial of service attacks.[8] Threat Actors Use Spear Phishing Written in Traditional Chinese Script in Attempted Intrusions In August 2015, the threat actors sent spear phishing emails to a number of Hong Kong-based media organizations, including newspapers, radio, and television

Tactics: TA0001
Techniques: T1566, T1566.002
Input: MuddyWater has added Registry Run key KCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemTextEncoding to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: BackdoorDiplomacy has used NetCat and PortQry  to enumerate network connections and display the status of related TCP and UDP ports.

Tactics: TA0007
Techniques: T1049
Input: Adversaries may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system.

Tactics: TA0003, TA0005
Techniques: T1542
Input: Adversaries may execute malicious payloads via loading shared modules.

Tactics: TA0002
Techniques: T1129
Input: CPL files

Tactics: TA0005
Techniques: T1218, T1218.002
Input: There have also been similar examples of extensions being used for command & control.

Tactics: TA0003
Techniques: T1176
Input: Audit domain account permission levels routinely to look for situations that could allow an adversary to gain wide access by obtaining credentials of a privileged account.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.002
Input: AppleSeed has used UPX packers for its payload DLL.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Sliver can enumerate files on a target system.

Tactics: TA0007
Techniques: T1083
Input: Stuxnet can propagate via peer-to-peer communication and updates using RPC.

Tactics: TA0008
Techniques: T1021
Input: Monitor for changes made in the Active Directory that may use scripts automatically executed at boot or logon initialization to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1037
Input: Enterprise email solutions may have monitoring mechanisms that may include the ability to audit inbox rules on a regular basis.

Tactics: TA0005
Techniques: T1564, T1564.008
Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).

Tactics: TA0043
Techniques: T1596