madox81/Adema_ATTACK_DS huggingface dataset:
Input: PowerShell

Tactics: TA0002
Techniques: T1059
Input: JSS Loader has been delivered by phishing emails containing malicious Microsoft Excel attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: It is unknown what these domains may have been used for but based on the similarity of domain spoofing and sharing an IP, they are likely part of the adversary infrastructure

Tactics: TA0007
Techniques: T1016
Input: Chaes has been delivered by sending victims a phishing email containing a malicious .docx file.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Win32 API

Tactics: TA0002
Techniques: T1106
Input: UserInitMprLogonScript

Tactics: TA0003, TA0004
Techniques: T1037
Input: netstat

Tactics: TA0007
Techniques: T1049
Input: Metamorfo has used HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: /sbin/emond

Tactics: TA0003, TA0004
Techniques: T1546, T1546.014
Input: Zebrocy searches for files that are 60mb and less and contain the following extensions: .doc, .docx, .xls, .xlsx, .ppt, .pptx, .exe, .zip, and .rar.

Tactics: TA0007
Techniques: T1083
Input: Kasidet has the ability to download and execute additional files.

Tactics: TA0011
Techniques: T1105
Input: MoonWind installs itself as a new service with automatic startup to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: C:\Windows\System32\sethc.exe

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: In Office 365 environments, adversaries may assign the Default or Anonymous user permissions or roles to the Top of Information Store (root), Inbox, or other mailbox folders.

Tactics: TA0003
Techniques: T1098.002, T1098
Input: OnionDuke has the capability to use a Denial of Service module.

Tactics: TA0040
Techniques: T1499
Input: VPN and to persist in same sentence

Tactics: TA0001, TA0003
Techniques: T1133
Input: pbpaste

Tactics: TA0009
Techniques: T1115
Input: dir c:\

Tactics: TA0007
Techniques: T1083
Input: Flagpro can check whether the target system is using Japanese, Taiwanese, or English through detection of specific Windows Security and Internet Explorer dialog.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: Manipulating TLS callbacks may be performed by allocating and writing to specific offsets within a process’ memory space using other Process Injection techniques such as Process Hollowing.

Tactics: TA0004, TA0005
Techniques: T1055.005, T1055
Input: AuditCred encrypts the configuration.

Tactics: TA0005
Techniques: T1027
Input: Token theft can also occur through social engineering, in which case user action may be required to grant access.

Tactics: TA0006
Techniques: T1528
Input: Inveigh

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: Pass-The-Hash Toolkit can perform pass the hash.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: tasklist

Tactics: TA0007
Techniques: T1057
Input: Okrum can establish persistence by creating a .lnk shortcut to itself in the Startup folder.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Astaroth can create a new process in a suspended state from a targeted legitimate process in order to unmap its memory and replace it with malicious code.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: There are also other mechanisms, such as Active Directory fields, that can be used to modify access tokens.

Tactics: TA0004, TA0005
Techniques: T1134
Input: Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media.

Tactics: TA0042
Techniques: T1587, T1587.001
Input: LazyScripter has used rundll32.exe to execute Koadic stagers.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Monitor processes for suspicious or malicious use of MMC.

Tactics: TA0005
Techniques: T1218, T1218.014
Input: QakBot can make small changes to itself in order to change its checksum and hash value.

Tactics: TA0005
Techniques: T1027, T1027.005
Input: Remsec also disguised malicious modules using similar filenames as custom network encryption software on victims.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: PowerStallion modifies the MAC times of its local log files to match that of the victim's desktop.ini file.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: When generating the URL for the HTTP requests issued to the C2 server, the Trojan chooses a random folder from the following to include within the URL path: watch/? search/? find/? results/? open/? search/? close/? XAgent also will choose several parameters names from the following list when finishing the construction of the C2 URL: itwm= text= from=

Tactics: TA0007, TA0011
Techniques: T1071, T1090.003, T1083, T1090
Input: Monitor newly executed processes that may take control of preexisting sessions with remote services to move laterally in an environment.

Tactics: TA0008
Techniques: T1563
Input: MobileOrder has a command to download a file from the C2 server to the victim mobile device's SD card.

Tactics: TA0011
Techniques: T1105
Input: SUNBURST attempted to disable software security services following checks against a FNV-1a + XOR hashed hardcoded blocklist.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Monitor and analyze application programming interface (API) calls that are indicative of Registry edits such as RegCreateKeyEx and RegSetValueEx.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.010
Input: Turian can retrieve usernames.

Tactics: TA0007
Techniques: T1033
Input: Peirates can use kubectl or the Kubernetes API to run commands.

Tactics: TA0002
Techniques: T1609
Input: remote template

Tactics: TA0005
Techniques: T1221
Input: Machete saves the window names.

Tactics: TA0007
Techniques: T1010
Input: Identify and block potentially malicious software executed through this technique by using application control tools capable of preventing unknown DLLs from being loaded.

Tactics: TA0002
Techniques: T1129
Input: GALLIUM has used PsExec to move laterally between hosts in the target network.

Tactics: TA0008
Techniques: T1570
Input: COM and execution in same sentence

Tactics: TA0008
Techniques: T1021.003, T1021
Input: LC_LOAD_DYLIB

Tactics: TA0003, TA0004
Techniques: T1546.006, T1546
Input: Previous to macOS 11, adversaries could silently install browser extensions via the command line using the profiles tool to install malicious .mobileconfig files.

Tactics: TA0003
Techniques: T1176
Input: This is a guest post by independent security researcher James Quinn. This will be Part 1 of a series titled Reversing Gh0stRAT Variants.  As 2018 drew to a close and 2019 took over, I began to see a different behavior from SMB malware authors.  Instead of massive, multi-staged cryptocurrency miners, I began to see more small, covert RATs serving as partial stage1’s.  Of these samples, there was one specific sample that stood out to me.  A Gh0stRAT variant, this sample not only changed the Gh0stRAT header from “Gh0st” to “nbLGX”, it also hid its traffic with an encryption algorithm over the entire TCP segment, in addition to the standard Zlib compression on the Gh0stRAT data.  Some key functionality is below:   Can download more malware   Offline Keylogger   Cleans Event logs

Tactics: TA0005
Techniques: T1070
Input: sudo

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: mshta.exe

Tactics: TA0005
Techniques: T1218.005, T1218
Input: Monitor executed commands and arguments for logon scripts

Tactics: TA0003, TA0004
Techniques: T1037.001, T1037.003, T1037, T1037.005
Input: Remote desktop is a common feature in operating systems.

Tactics: TA0008
Techniques: T1563.002, T1021.001, T1021, T1563
Input: (Source: SecureWorks)  The “Windows Folder.exe” executable spawns and injects code into the legitimate notepad.exe Windows process (see Figure 2)

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: BADFLICK has captured victim computer name, memory space, and CPU details.

Tactics: TA0007
Techniques: T1082
Input: In highly virtualized environments, such as cloud-based infrastructure, this may be accomplished by restoring virtual machine (VM) or data storage snapshots through the cloud management dashboard or cloud APIs.

Tactics: TA0005
Techniques: T1578, T1578.004
Input: Ensure that high permission level service binaries cannot be replaced or modified by users with a lower permission level.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: searches for files

Tactics: TA0007
Techniques: T1083
Input: Encoding the encryption key  In order for the C&C server to decrypt the encrypted data, the randomly generated AES256 key must be included in the packet along with the encrypted data

Tactics: TA0009, TA0011
Techniques: T1573, T1560
Input: The Regin malware platform uses Extended Attributes to store encrypted executables.

Tactics: TA0005
Techniques: T1564, T1564.004
Input: BONDUPDATER uses -windowstyle hidden to conceal a PowerShell window that downloads a payload.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Monitor for newly executed processes that may attempt to gather information about the system language of a victim in order to infer the geographical location of that host.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: Get-NetForestTrust

Tactics: TA0007
Techniques: T1482
Input: This allows the adversary to use the proxy credentials for subsequent requests if they enable outbound HTTP access.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: NativeZone can display an RTF document to the user  to enable execution of  Cobalt Strike stage shellcode.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: EvilGrab has the capability to capture screenshots.

Tactics: TA0009
Techniques: T1113
Input: Melcoz has been distributed through an AutoIt loader script.

Tactics: TA0002
Techniques: T1059
Input: The BRONZE BUTLER uploader or malware the uploader uses command to delete the RAR archives after they have been exfiltrated.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: InstallUtil.exe

Tactics: TA0005
Techniques: T1218, T1218.004
Input: Query systems for process and thread token information and look for inconsistencies such as user owns processes impersonating the local SYSTEM account.

Tactics: TA0004, TA0005
Techniques: T1134
Input: reg query HKCU /f password /t REG_SZ /s

Tactics: TA0006
Techniques: T1552, T1552.002
Input: tasklist /svc

Tactics: TA0007
Techniques: T1007
Input: WastedLocker can delete shadow volumes.

Tactics: TA0040
Techniques: T1490
Input: smb and exploit in same sentence

Tactics: TA0008
Techniques: T1210
Input: SQL Stored Procedures are code that can be saved and reused so that database users do not waste time rewriting frequently used SQL queries.

Tactics: TA0003
Techniques: T1505.001, T1505
Input: APT38  has attempted to lure victims into enabling malicious macros within email attachments.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Silent Librarian has collected lists of names for individuals from targeted organizations.

Tactics: TA0043
Techniques: T1589.003, T1589
Input: Command_Keylog_offline:  Load into memory a dll that contains the function “PluginMe”.  After researching and analyzing additional Gh0stRAT samples while trying to figure out what dll contains “PluginMe”, I found a DLL for keylogging (called Keylog.dll) in a Gh0stRAT 2.0 sample that exported “PluginMe”.  Using that and a cross-comparison of another Gh0stRAT sample that I’ve previously analyzed, I was able to determine that “PluginMe” is a offline keyboard manager

Tactics: TA0003, TA0004, TA0005, TA0006, TA0009
Techniques: T1574.001, T1218, T1574.002, T1218.011, T1055, T1574, T1056
Input: An adversary may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users.

Tactics: TA0040
Techniques: T1491.002, T1491
Input: LoadLibrary

Tactics: TA0002
Techniques: T1106
Input: TeamTNT has uploaded backdoored Docker images to Docker Hub.

Tactics: TA0042
Techniques: T1608.001, T1608
Input: ~/.bashrc

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: VNC

Tactics: TA0011
Techniques: T1219
Input: RainyDay has the ability to uninstall itself by deleting its service and files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Doki has communicated with C2 over HTTPS.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: SILENTTRINITY can use the GetRegValue function to check Registry keys within HKCU\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated and HKLM\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated.

Tactics: TA0007
Techniques: T1012
Input: BOOSTWRITE has been signed by a valid CA.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Block unknown or unused attachments by default that should not be transmitted over email as a best practice to prevent some vectors, such as .scr, .exe, .pif, .cpl,  Some email scanning devices can open and analyze compressed and encrypted formats, such as zip and rar that may be used to conceal malicious attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Cobalt Strike can deliver additional payloads to victim machines.

Tactics: TA0011
Techniques: T1105
Input: An adversary may monitor exploit provider forums to understand the state of existing, as well as newly discovered, exploits.

Tactics: TA0042
Techniques: T1588, T1588.005
Input: .sdb

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: net group

Tactics: TA0007
Techniques: T1087, T1069
Input: Search SYSVOL for any existing GGPs that may contain credentials and remove them.

Tactics: TA0006
Techniques: T1552, T1552.006
Input: MISC::AddSid

Tactics: TA0004, TA0005
Techniques: T1134.005, T1134
Input: environmental keying

Tactics: TA0005
Techniques: T1480
Input: template injeciton

Tactics: TA0005
Techniques: T1221
Input: EnvyScout can use hidden directories and files to hide malicious executables.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Clambling can wait 30 minutes before initiating contact with C2.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: RCSession has the ability to capture keystrokes on a compromised host.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Do not allow domain administrator or root accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.

Tactics: TA0003
Techniques: T1098.001, T1098
Input: Dragonfly has used scheduled tasks to automatically log out of created accounts every 8 hours as well as to execute malicious files.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: QuasarRAT can obtain passwords from common web browsers.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: FELIXROOT deletes the .LNK file from the startup directory as well as the dropper components.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: cron.deny is used to explicitly disallow users from using cron.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: CCBkdr can use a DGA for Fallback Channels if communications with the primary command and control server are lost.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: DWriteCreateFactory()

Tactics: TA0002
Techniques: T1129
Input: Adversaries may target multi-factor authentication (MFA) mechanisms, (I.e., smart cards, token generators, ) to gain access to credentials that can be used to access systems, services, and network resources.

Tactics: TA0006
Techniques: T1111
Input: After the Registry is modified, pressing the appropriate key combination at the login screen while at the keyboard or when connected with Remote Desktop Protocol will cause the "debugger" program to be executed with SYSTEM privileges.

Tactics: TA0003, TA0004
Techniques: T1546.012, T1546
Input: FruitFly persists via a Launch Agent.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: lsass.exe

Tactics: TA0003, TA0004
Techniques: T1547.008, T1547
Input: Leafminer has obtained and used tools such as LaZagne, Mimikatz, PsExec, and MailSniper.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Indrik Spider has used malicious JavaScript files for several components of their attack.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: DropBook can execute arbitrary shell commands on the victims' machines.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: PE injection is a method of executing arbitrary code in the address space of a separate live process.

Tactics: TA0004, TA0005
Techniques: T1055.002, T1055
Input: Agent Tesla has the ability to use form-grabbing to extract data from web data forms.

Tactics: TA0009
Techniques: T1185
Input: StrongPity can identify if ESET or BitDefender antivirus are installed before dropping its payload.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: WMI Filters define conditions that will trigger a Consumer, including system startup, the execution of a program, the passing of a specified time and many others

Tactics: TA0002
Techniques: T1047
Input: AADInternals can be used to forge Kerberos tickets using the password hash of the AZUREADSSOACC account.

Tactics: TA0006
Techniques: T1558.002, T1558
Input: chmod

Tactics: TA0005
Techniques: T1222
Input: sc query

Tactics: TA0007
Techniques: T1007
Input: OSInfo enumerates the current network connections similar to  net use .

Tactics: TA0007
Techniques: T1049
Input: FIN8 has also used PowerShell for lateral movement and credential access.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Maze has delivered components for its ransomware attacks using MSI files, some of which have been executed from the command-line using msiexec.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: The use of a shared folder specified in the configuration enables Ragnar Locker to encrypt files on the host operating system, including files on any mapped drives.

Tactics: TA0005
Techniques: T1564, T1564.006
Input: InvisiMole can gather network share information.

Tactics: TA0007
Techniques: T1135
Input: Starloader decrypts and executes shellcode from a file called Stars.jps.

Tactics: TA0005
Techniques: T1140
Input: Get-MsolRoleMember

Tactics: TA0007
Techniques: T1087
Input: Windshift has created LNK files in the Startup folder to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: ROKRAT can use HTTP and HTTPS for command and control communication.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: The image and table below illustrate TClient’s encrypted configuration that we decrypted (via Python code):  Figure 10

Tactics: TA0005
Techniques: T1140
Input: OilRig has used batch scripts.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Botnets are commonly used to conduct network flooding attacks against networks and services.

Tactics: TA0040
Techniques: T1498, T1498.001
Input: Monitor newly executed processes that may use hidden windows to conceal malicious activity from the plain sight of users.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Avaddon deletes backups and shadow copies using native system tools.

Tactics: TA0040
Techniques: T1490
Input: Adversaries may attempt to abuse Kerberos by stealing tickets or forging tickets to enable unauthorized access.

Tactics: TA0006
Techniques: T1558
Input: Monitor for the LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets being accessed

Tactics: TA0006
Techniques: T1003, T1003.004
Input: Disturbing or offensive images may be used as a part of Internal Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages.

Tactics: TA0040
Techniques: T1491.001, T1491
Input: Nomadic Octopus attempted to make Octopus appear as a  Telegram Messenger with a Russian interface.

Tactics: TA0005
Techniques: T1036
Input: C2 Infrastructure  103.53.197.202  104.237.218.70  104.237.218.72  185.157.79.3  193.169.245.78  193.169.245.137  23.227.196.210  24.datatimes.org  80.255.3.87  blog.docksugs.org  blog.panggin.org  contay.deaftone.com  check.paidprefund.org  datatimes.org  docksugs.org  economy.bloghop.org  emp.gapte.name  facebook-cdn.net  gap-facebook.com  gl-appspot.org  help.checkonl.org  high.expbas.net  high.vphelp.net  icon.torrentart.com  images.chinabytes.info  imaps.qki6.com  img.fanspeed.net  job.supperpow.com  lighpress.info  menmin.strezf.com  mobile.pagmobiles.info  news.lighpress.info  notificeva.com  nsquery.net  pagmobiles.info  paidprefund.org  push.relasign.org  relasign.org  share.codehao.net  seri.volveri.net  ssl.zin0.com  static.jg7.org  syn.timeizu.net  teriava.com  timeizu.net  tonholding.com  tulationeva.com  untitled.po9z.com  update-flashs.com  vieweva.com  volveri.net  vphelp.net  yii.yiihao126.net  zone.apize.net   Table 4: Sampling of APT32 C2 Infrastructure

Tactics: TA0001, TA0007, TA0008, TA0011
Techniques: T1007, T1087, T1021, T1021.002, T1566.003, T1566, T1566.002, T1008, T1018
Input: Restrict granting of permissions related to listing objects in cloud storage to necessary accounts.

Tactics: TA0007
Techniques: T1619
Input: Consider periodic review of accounts and privileges for critical and sensitive repositories.

Tactics: TA0009
Techniques: T1213
Input: GetClipboardData()

Tactics: TA0009
Techniques: T1115
Input: query user

Tactics: TA0007
Techniques: T1033
Input: SQL inject

Tactics: TA0001
Techniques: T1190
Input: LoadLibraryExW()

Tactics: TA0002
Techniques: T1129
Input: Use tools that restrict program execution via application control by attributes other than file name for common operating system utilities that are needed.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: BISCUIT can capture keystrokes.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: cmstp.exe

Tactics: TA0005
Techniques: T1218, T1218.003
Input: mshta

Tactics: TA0005
Techniques: T1218.005, T1218
Input: Calisto has the capability to add its own account to the victim's machine.

Tactics: TA0003
Techniques: T1136, T1136.001
Input: Both utilities may be used to bypass application control through use of attributes within the binary to specify code that should be run before registration or unregistration: [ComRegisterFunction] or [ComUnregisterFunction] respectively.

Tactics: TA0005
Techniques: T1218.009, T1218
Input: APT28 has used Google Drive for C2.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: When running with root privileges after a Launch Agent is installed, ThiefQuest installs a plist file to the /Library/LaunchDaemons/ folder with the RunAtLoad key set to true establishing persistence as a Launch Daemon.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: OLE

Tactics: TA0002
Techniques: T1559, T1559.002
Input: Adversaries use launchctl to execute commands and programs as Launch Agents or Launch Daemons.

Tactics: TA0002
Techniques: T1569.001, T1569
Input: Monitor for contextual file data that may show signs of deletion or alter generated artifacts on a host system, including logs or captured files such as quarantined malware.

Tactics: TA0005
Techniques: T1070
Input: Sibot has used WMI to discover network connections and configurations.

Tactics: TA0002
Techniques: T1047
Input: Time providers are implemented as dynamic-link libraries (DLLs) that are registered in the subkeys of  HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\W32Time\TimeProviders\.

Tactics: TA0003, TA0004
Techniques: T1547.003, T1547
Input: Unix shell usage may be common on administrator, developer, or power user systems, depending on job function.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: Backdoor.Oldrea collects information about available drives, default browser, desktop file list, My Documents, Internet history, program files, and root of available drives.

Tactics: TA0007
Techniques: T1083
Input: TeamTNT has established persistence through the creation of a cryptocurrency mining system service.

Tactics: TA0003, TA0004
Techniques: T1543.002, T1543
Input: poison name services

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: These personas may be fictitious or impersonate real people.

Tactics: TA0042
Techniques: T1585, T1585.001
Input: Lazarus Group has used shellcode within macros to decrypt and manually map DLLs and shellcode into memory at runtime.

Tactics: TA0005
Techniques: T1140