madox81/Adema_ATTACK_DS huggingface dataset:
Input: [Screenshot 1] Encrypted Login Packet sent by Gh0stRAT infected PC  In addition to a standard malware analysis blog post, I’d also like to take this time to document and describe my methods for analysis, in the hopes that you as a reader will use these techniques in the future

Tactics: TA0009
Techniques: T1113
Input: The payload then calls the VirtualAllocEx API to create a buffer in the newly hollowed process and the WriteProcessMemory API to write the supplied data buffer that contains the code to inject to this newly created buffer

Tactics: TA0002
Techniques: T1106
Input: FIN10 has established persistence by using S4U tasks as well as the Scheduled Task option in PowerShell Empire.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Mosquito runs whoami on the victim’s machine.

Tactics: TA0007
Techniques: T1033
Input: TeamTNT has added RSA keys in authorized_keys.

Tactics: TA0003
Techniques: T1098.004, T1098
Input: The launcher module, obfuscated with the notorious Metasploit’s shikata_ga_nai encoder, is the same for all the droppers

Tactics: TA0005
Techniques: T1027
Input: CORESHELL has established persistence by creating autostart extensibility point (ASEP) Registry entries in the Run key and other Registry keys, as well as by creating shortcuts in the Internet Explorer Quick Start folder.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: down_new has the ability to list the directories on a compromised host.

Tactics: TA0007
Techniques: T1083
Input: InvisiMole gathers the local system time from the victim’s machine.

Tactics: TA0007
Techniques: T1124
Input: Audit images deployed within the environment to ensure they do not contain any malicious components.

Tactics: TA0002
Techniques: T1204.003, T1204
Input: Password policies can be discovered in cloud environments using available APIs such as GetAccountPasswordPolicy in AWS .

Tactics: TA0007
Techniques: T1201
Input: Administrators should log in as a standard user but run their tools with administrator privileges using the built-in access token manipulation command runas.

Tactics: TA0004, TA0005
Techniques: T1134.002, T1134.003, T1134, T1134.001
Input: These accounts may be leveraged during other phases of the adversary lifecycle, such as during Initial Access (ex: Spearphishing via Service).

Tactics: TA0042
Techniques: T1585, T1585.001
Input: Ke3chang has performed  frequent and scheduled data exfiltration from compromised networks.

Tactics: TA0010
Techniques: T1020
Input: The adversary could then restart the device to implement the change immediately or they could wait until the next time the system restarts.

Tactics: TA0005
Techniques: T1601, T1601.002
Input: Kazuar gathers information about opened windows.

Tactics: TA0007
Techniques: T1010
Input: Adversaries may search in different social media sites depending on what information they seek to gather.

Tactics: TA0043
Techniques: T1593, T1593.001
Input: Shamoon decrypts ciphertext using an XOR cipher and a base64-encoded string.

Tactics: TA0005
Techniques: T1140
Input: certutil has been used to decode binaries hidden inside certificate files as Base64 information.

Tactics: TA0005
Techniques: T1140
Input: Ajax Security Team has used Wrapper/Gholee, custom-developed malware, which downloaded additional malware to the infected system.

Tactics: TA0011
Techniques: T1105
Input: Duqu can track key presses with a keylogger module.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: On macOS, launchd processes known as Launch Daemon and Launch Agent are run to finish system initialization and load user specific parameters.

Tactics: TA0003, TA0004
Techniques: T1543
Input: CosmicDuke steals user files from network shared drives with file extensions and keywords that match a predefined list.

Tactics: TA0009
Techniques: T1039
Input: Leviathan has used VBScript.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Monitor for execution of AppleScript through osascript and usage of the NSAppleScript and OSAScript APIs that may be related to other suspicious behavior occurring on the system.

Tactics: TA0002
Techniques: T1059.002, T1059
Input: BRONZE BUTLER downloads encoded payloads and decodes them on the victim.

Tactics: TA0005
Techniques: T1140
Input: APT3 has used PowerShell on victim systems to download and run payloads after exploitation.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Mimikatz’s LSADUMP::DCSync and KERBEROS::PTT modules implement the three steps required to extract the krbtgt account hash and create/use Kerberos tickets.

Tactics: TA0005, TA0008
Techniques: T1550.003, T1550
Input: Monitor for changes made to windows registry key or values for unexpected modifications of the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList key.

Tactics: TA0005
Techniques: T1564.002, T1564
Input: The cab file was encrypted and decrypted using a simple xor cipher with a rotating 16 byte key: \x36\x11\xdd\x08\xac\x4b\x72\xf8\x51\x04\x68\x2e\x3e\x38\x64\x32

Tactics: TA0005
Techniques: T1027
Input: Libraries specified in environment variables are loaded first, taking precedence over system libraries with the same function name.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.006, T1574
Input: OopsIE checks to see if the system is configured with "Daylight" time and checks for a specific region to be set for the timezone.

Tactics: TA0007
Techniques: T1124
Input: The quarantine flag is an opt-in system and not imposed by macOS.

Tactics: TA0005
Techniques: T1553.001, T1553
Input: Use file scanning to look for known software packers or artifacts of packing techniques.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Monitor for changes made to services for unexpected modifications to names, descriptions, and/or start types

Tactics: TA0005
Techniques: T1036.004, T1036
Input: TURNEDUP is capable of creating a reverse shell.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: FlawedAmmyy enumerates the privilege level of the victim during the initial infection.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: Kobalos can remove all command history on compromised hosts.

Tactics: TA0005
Techniques: T1070, T1070.003
Input: The SSH config file is usually located under /etc/ssh/sshd_config.

Tactics: TA0003
Techniques: T1098.004, T1098
Input: WellMail can decompress scripts received from C2.

Tactics: TA0005
Techniques: T1140
Input: LightNeuron gathers information about network adapters using the Win32 API call GetAdaptersInfo.

Tactics: TA0007
Techniques: T1016
Input: After obtaining the unique ID from the C2 server, the Trojan calls the “SetAbStatById” method to notify the C2 server of its status of “1” to notify the server it had successfully received the filename and file data

Tactics: TA0010
Techniques: T1041
Input: FatDuke has been regularly repacked by its operators to create large binaries and evade detection.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Lucifer can use certutil for propagation on Windows hosts within intranets.

Tactics: TA0008
Techniques: T1570
Input: Initial Compromise For initial compromise, FireEye Intelligence has observed APT39 leverage spear phishing emails with malicious attachments and/or hyperlinks typically resulting in a POWBAT infection

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Chimera has used custom DLLs for continuous retrieval of data from memory.

Tactics: TA0009
Techniques: T1119
Input: Naikon has used the LadonGo scanner to scan target networks.

Tactics: TA0007
Techniques: T1046
Input: Therefore, compromise of the token can grant the adversary access to resources of other sites through a malicious application.

Tactics: TA0005, TA0008
Techniques: T1550.001, T1550
Input: Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes.

Tactics: TA0002, TA0003, TA0004, TA0005
Techniques: T1559, T1137.002, T1137, T1546.006, T1218, T1220, T1574.002, T1218.008, T1106, T1546, T1218.007, T1055.014, T1574.005, T1546.007, T1055, T1574, T1218.010, T1055.001
Input: Rising Sun decrypted itself using a single-byte XOR scheme.

Tactics: TA0005
Techniques: T1140
Input: Shamoon has been seen overwriting features of disk structure such as the MBR.

Tactics: TA0040
Techniques: T1561, T1561.002
Input: MechaFlounder has the ability to send the compromised user's account name and hostname within a URL to C2.

Tactics: TA0010
Techniques: T1041
Input: DarkComet can launch a remote shell to execute commands on the victim’s machine.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: A IP and/or port number calculation can be used to bypass egress filtering on a C2 channel.

Tactics: TA0011
Techniques: T1568, T1568.003
Input: Kimsuky has used a proprietary tool to intercept one time passwords required for two-factor authentication.

Tactics: TA0006
Techniques: T1111
Input: Expand can be used to download or upload a file over a network share.

Tactics: TA0008
Techniques: T1570
Input: Keydnap adds the setuid flag to a binary so it can easily elevate in the future.

Tactics: TA0004, TA0005
Techniques: T1548, T1548.001
Input: Ramsay has masqueraded as a JPG image file.

Tactics: TA0005
Techniques: T1036
Input: APT19 collected system architecture information.

Tactics: TA0007
Techniques: T1082
Input: An adversary may create a snapshot or data backup within a cloud account to evade defenses.

Tactics: TA0005
Techniques: T1578, T1578.001
Input: Donut can generate shellcode outputs that execute via PowerShell.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: CPL files not exporting CPlApplet are not directly executable.

Tactics: TA0005
Techniques: T1218, T1218.002
Input: APT40 leverages custom credential theft utilities such as HOMEFRY, a password dumper/cracker used alongside the AIRBREAK and BADFLICK backdoors

Tactics: TA0006
Techniques: T1003
Input: APT3 has been known to side load DLLs with a valid version of Chrome with one of their tools.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: Adversaries may also add the Parameters key, which stores driver-specific data, or other custom subkeys for their malicious services to establish persistence or enable other malicious activities.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.011, T1574
Input: An adversary that compromises a user’s credentials may enroll a new device in order to bypass initial MFA requirements and gain persistent access to a network.

Tactics: TA0003
Techniques: T1098.005, T1098
Input: Monitor newly executed processes that may hijack a legitimate user's SSH session to move laterally within an environment.

Tactics: TA0008
Techniques: T1563, T1563.001
Input: Use of the KernelCallbackTable to hijack execution flow may evade detection from security products since the execution can be masked under a legitimate process.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.013, T1574
Input: While all payloads can be dynamically updated, at the time of delivery, this task launched a COM scriptlet (“.sct” file extension) that downloaded and executed Meterpreter hosted on images.chinabytes[.]info

Tactics: TA0002
Techniques: T1059
Input: Suspicious activity may include personas claiming to work for your organization or recently created/modified accounts making numerous connection requests to accounts affiliated with your organization.Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult.

Tactics: TA0042
Techniques: T1585
Input: H1N1 contains a command to download and execute a file from a remotely hosted URL using WinINet HTTP requests.

Tactics: TA0011
Techniques: T1105
Input: The malware queries the value for the flag BeingDebugged from PEB to check whether the process is being debugged.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Adversaries may register or hijack domains that they will later purchase an SSL/TLS certificate for.

Tactics: TA0042
Techniques: T1588.004, T1588
Input: Epic gathers information on local group names.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: MSBuild will compile and execute the inline task.

Tactics: TA0005
Techniques: T1127.001, T1127
Input: Chimera has registered alternate phone numbers for compromised users to intercept 2FA codes sent via SMS.

Tactics: TA0006
Techniques: T1111
Input: SHUTTERSPEED can download and execute an arbitary executable.

Tactics: TA0011
Techniques: T1105
Input: Industroyer’s main backdoor connected to a remote C2 server using HTTPS.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Regularly scan externally facing systems for vulnerabilities and establish procedures to rapidly patch systems when critical vulnerabilities are discovered through scanning and through public disclosure.

Tactics: TA0001
Techniques: T1190
Input: Adversaries may insert, delete, or manipulate data at rest in order to influence external outcomes or hide activity, thus threatening the integrity of the data.

Tactics: TA0040
Techniques: T1565.001, T1565
Input: Collect events related to Registry key creation and modification for keys that could be used for Office-based persistence.

Tactics: TA0003
Techniques: T1137
Input: SslMM has a hard-coded primary and backup C2 string.

Tactics: TA0011
Techniques: T1008
Input: Melcoz can use DLL hijacking to bypass security controls.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: HOPLIGHT has used WMI to recompile the Managed Object Format (MOF) files in the WMI repository.

Tactics: TA0002
Techniques: T1047
Input: SoreFang can gain access by exploiting a Sangfor SSL VPN vulnerability that allows for the placement and delivery of malicious update binaries.

Tactics: TA0001
Techniques: T1190
Input: Delays may also be based on waiting for specific victim conditions to be met (ex: system time, events, ) or employ scheduled Multi-Stage Channels to avoid analysis and scrutiny.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Adversaries may purchase technical information about victims that can be used during targeting.

Tactics: TA0043
Techniques: T1597.002, T1597
Input: Examples of such abuse include modifying GPOs to push a malicious Scheduled Task to computers throughout the domain environment or modifying domain trusts to include an adversary controlled domain where they can control access tokens that will subsequently be accepted by victim domain resources.

Tactics: TA0004, TA0005
Techniques: T1484
Input: KillDisk has a ransomware component that encrypts files with an AES key that is also RSA-1028 encrypted.

Tactics: TA0040
Techniques: T1486
Input: Ixeshe collects the username from the victim’s machine.

Tactics: TA0007
Techniques: T1033
Input: Use of compromised infrastructure allows an adversary to stage, launch, and execute an operation.

Tactics: TA0042
Techniques: T1584
Input: These credentials may include those needed for Docker API authentication or secrets from Kubernetes cluster components.

Tactics: TA0006
Techniques: T1552, T1552.007
Input: EnvyScout can determine whether the ISO payload was received by a Windows or iOS device.

Tactics: TA0007
Techniques: T1082
Input: Power Loader overwrites Explorer’s Shell_TrayWnd extra window memory to redirect execution to a NTDLL function that is abused to assemble and execute a return-oriented programming (ROP) chain and create a malicious thread within Explorer.exe.

Tactics: TA0004, TA0005
Techniques: T1055.011, T1055
Input: LoudMiner used the ps command to monitor the running processes on the system.

Tactics: TA0007
Techniques: T1057
Input: Disable unnecessary metadata services and restrict or disable insecure versions of metadata services that are in use to prevent adversary access.

Tactics: TA0006
Techniques: T1552, T1552.005
Input: All strings below are encrypted via AES256 and base64 encoding

Tactics: TA0005
Techniques: T1027
Input: SideTwist has used HTTP GET and POST requests over port 443 for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: TSCookie has the ability to inject code into the svchost.exe, iexplorer.exe, explorer.exe, and default browser processes.

Tactics: TA0004, TA0005
Techniques: T1055
Input: PLEAD has the ability to list drives and files on the compromised host.

Tactics: TA0007
Techniques: T1083
Input: SpicyOmelette can identify the IP of a compromised system.

Tactics: TA0007
Techniques: T1016
Input: The started command will send the following information to the C&C:  device_model: the model identifier (e.g.: MacBookPro9,2) bot_version: version of Keydnap build_name: the “build name” that was given by downloader os_version: OS X or macOS kernel version ip_address: external IP address as reported by ipify.org has_root: 1 if executed as root, 0 otherwise  Backdoor commands The response to get_task contains an integer to identify the type of command and optional arguments

Tactics: TA0007
Techniques: T1082, T1016
Input: Monitor for the unexpected creation or presence of cloud block storage volumes .

Tactics: TA0005
Techniques: T1578
Input: UBoatRAT can list running processes on the system.

Tactics: TA0007
Techniques: T1057
Input: If a matching entry is found, access to the object is granted.

Tactics: TA0005
Techniques: T1222, T1222.001
Input: XCSSET uses AppleScript to check the host's language and location with the command user locale of (get system info).

Tactics: TA0007
Techniques: T1614, T1614.001
Input: Monitor command-line execution of the launchctl command immediately followed by abnormal network connections.

Tactics: TA0002
Techniques: T1569.001, T1569
Input: NETEAGLE will attempt to detect if the infected host is configured to a proxy.

Tactics: TA0011
Techniques: T1071, T1008, T1071.001
Input: Sandworm Team's plainpwd tool is a modified version of Mimikatz and dumps Windows credentials from system memory.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.

Tactics: TA0006
Techniques: T1110
Input: The adversary can then use this token to request data or perform actions the original account could not.

Tactics: TA0005, TA0008
Techniques: T1550.001, T1550
Input: Monitor debugger logs for signs of abnormal and potentially malicious activity.

Tactics: TA0005, TA0007
Techniques: T1622
Input: Mustang Panda has exploited CVE-2017-0199 in Microsoft Word to execute code.

Tactics: TA0002
Techniques: T1203
Input: BackdoorDiplomacy has dropped implants in folders named for legitimate software.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Monitor DLL files that are associated with COR_PROFILER environment variables.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.012, T1574
Input: Information about victims may be available in various online sites, such as social media, new sites, or those hosting information about business operations such as hiring or requested/rewarded contracts.

Tactics: TA0043
Techniques: T1593
Input: Aquatic Panda has downloaded additional malware onto compromised hosts.

Tactics: TA0011
Techniques: T1105
Input: Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.

Tactics: TA0002
Techniques: T1047
Input: Remove users from the local administrator group on systems.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs.

Tactics: TA0007
Techniques: T1033
Input: Gazer can establish persistence through the system screensaver by configuring it to execute the malware.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.002
Input: It downloads the file to the infected machine from the input URL using BITSAdmin, and is called every time the script attempts to download a file

Tactics: TA0011
Techniques: T1105
Input: The initial infection vector of this campaign is a Microsoft Office Excel Worksheet with an Office macro that uses the mshta.exe Windows executable to run scripts, which are embedded in the HTML of a specially-crafted blogspot.com page

Tactics: TA0001
Techniques: T1566, T1566.001
Input: SideTwist can collect the computer name of a targeted system.

Tactics: TA0007
Techniques: T1082
Input: Darkhotel has collected the IP address and network adapter information from the victim’s machine.

Tactics: TA0007
Techniques: T1016
Input: Monitor for newly executed processes that may interact with the Windows Registry to gather information about the system, configuration, and installed software.

Tactics: TA0007
Techniques: T1012
Input: One of its file stealers has also persisted by adding a Registry Run key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547