madox81/Adema_ATTACK_DS huggingface dataset:
Input: Traffic signaling involves the use of a magic value or sequence that must be sent to a system to trigger a special response, such as opening a closed port or executing a malicious task.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205
Input: NDiskMonitor obtains the victim computer name and encrypts the information to send over its C2 channel.

Tactics: TA0007
Techniques: T1082
Input: Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment.

Tactics: TA0011
Techniques: T1090.001, T1090
Input: Leviathan has exfiltrated data over its C2 channel.

Tactics: TA0010
Techniques: T1041
Input: gh0st RAT has used an encrypted protocol within TCP segments to communicate with the C2.

Tactics: TA0011
Techniques: T1095
Input: Two of them are MacOS X User-Agents and the third is a hashed string:  Mozilla/5.0 (iPad; U; CPU OS 3_2_1 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Mobile/BADDAD Mozilla/5.0 (iPad; U; CPU OS 3_2_1 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) Mobile/7B405   E9BC3BD76216AFA560BFB5ACAF5731A3   Figure 5: SpeakUp `s requests are encrypted with the salted base64 and include the unique User-Agent At the moment SpeakUp serves XMRig miners to its listening infected servers

Tactics: TA0007
Techniques: T1082
Input: To clear the audit policy, adversaries may run the following lines: auditpol /clear /y or auditpol /remove /allusers.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: Generally, the links will be accompanied by social engineering text and require the user to actively click or copy and paste a URL into a browser, leveraging User Execution.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Adversaries may create multiple stages for command and control that are employed under different conditions or for certain functions.

Tactics: TA0011
Techniques: T1104
Input: Monitor newly executed processes that may erase the contents of storage devices on specific systems or in large numbers in a network to interrupt availability to system and network resources.

Tactics: TA0040
Techniques: T1561.001, T1561
Input: Mouse Pointer Check The Trojan will perform the following WMI query:   Select * from Win32_PointingDevice   The Trojan will check the Caption, Description, HardwareType, InfSection, Manufacturer and Name fields in the results for the string VMware, Virtual, VBox, VM or Oracle

Tactics: TA0005, TA0007
Techniques: T1497
Input: Kimsuky has exfiltrated data over its C2 channel.

Tactics: TA0010
Techniques: T1041
Input: Audit the Registry entries relevant for enabling add-ins.

Tactics: TA0003
Techniques: T1137, T1137.006
Input: DCOM

Tactics: TA0008
Techniques: T1021.003, T1021
Input: Adversaries may use traffic duplication in conjunction with Network Sniffing, Input Capture, or Adversary-in-the-Middle depending on the goals and objectives of the adversary.

Tactics: TA0010
Techniques: T1020.001, T1020
Input: ThiefQuest obtains a list of running processes using the function kill_unwanted.

Tactics: TA0007
Techniques: T1057
Input: Following successful infiltration, the malware persists through registry: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run The command line execution leads to PowerShell code executed from a different registry value .

Tactics: TA0002
Techniques: T1059.001, T1059
Input: InvisiMole can collect information about installed software used by specific users, software executed on user login, and software executed by each system.

Tactics: TA0007
Techniques: T1518
Input: Leviathan has sent spearphishing attachments attempting to get a user to click.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Environmental keying is an implementation of Execution Guardrails that utilizes cryptographic techniques for deriving encryption/decryption keys from specific types of values in a given computing environment.

Tactics: TA0005
Techniques: T1480, T1480.001
Input: OilRig has deleted files associated with their payload after execution.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: BBK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Zebrocy has the capability to upload dumper tools that extract credentials from web browsers and store them in database files.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: CookieMiner can steal Google Chrome and Apple Safari browser cookies from the victim’s machine.

Tactics: TA0006
Techniques: T1539
Input: Using the information collected by CloudTrail, you can determine the request that was made, the IP address from which the request was made, which user made the request, when it was made, and additional details.In Azure, the creation of a snapshot may be captured in Azure activity logs.

Tactics: TA0005
Techniques: T1578, T1578.001
Input: When calling this API, the user will be prompted to enter their credentials but no checks on the origin or integrity of the program are made.

Tactics: TA0004, TA0005
Techniques: T1548.004, T1548
Input: load additional modules

Tactics: TA0002
Techniques: T1129
Input: ADVSTORESHELL stores output from command execution in a .dat file in the %TEMP% directory.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: TrickBot can send information about the compromised host and upload data to a hardcoded C2 server.

Tactics: TA0010
Techniques: T1041
Input: Threat Group-3390 has used PowerShell for execution.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: .cpl

Tactics: TA0005
Techniques: T1218, T1218.002
Input: RogueRobin gathers the IP address and domain from the victim’s machine.

Tactics: TA0007
Techniques: T1016
Input: SpeakUp uses Perl scripts.

Tactics: TA0002
Techniques: T1059
Input: EvilBunny has downloaded additional Lua scripts from the C2.

Tactics: TA0011
Techniques: T1105
Input: xCaon has checked for the existence of Kaspersky antivirus software on the system.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Those infected systems can then send the output from those commands back over that Web service channel.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: StrongPity can download files to specified targets.

Tactics: TA0011
Techniques: T1105
Input: RTM encrypts C2 traffic with a custom RC4 variant.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Clambling can establish persistence by adding a Registry run key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Adversaries may also leverage a Network Device CLI on network devices to clear command history data.

Tactics: TA0005
Techniques: T1070, T1070.003
Input: APT28 has used the WindowStyle parameter to conceal PowerShell windows.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Winnti for Linux has used a passive listener, capable of identifying a specific magic value before executing tasking, as a secondary command and control (C2) mechanism.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205
Input: Higaisa used JavaScript to execute additional files.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Sandworm Team also used legitimate M.E.Doc software update check requests for sending and receiving commands and hosted malicious payloads on putdrive.com.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: Adversaries may deploy a container into an environment to facilitate execution or evade defenses.

Tactics: TA0002, TA0005
Techniques: T1610
Input: Analyze the process execution trees, historical activities from the third-party application (such as what types of files are usually pushed), and the resulting activities or events from the file/binary/script pushed to systems.

Tactics: TA0002, TA0008
Techniques: T1072
Input: Empire has the ability to gather browser data such as bookmarks and visited sites.

Tactics: TA0007
Techniques: T1217
Input: Changes to binaries that do not line up with application updates or patches are also extremely suspicious.

Tactics: TA0003, TA0004
Techniques: T1546.006, T1546
Input: Other such controls may be disabled by default but are configurable through application controls, such as only allowing signed Dynamic-Link Libraries (DLLs) to execute on a system.

Tactics: TA0005
Techniques: T1553, T1553.006
Input: BBSRAT has been seen persisting via COM hijacking through replacement of the COM object for MruPidlList {42aedc87-2188-41fd-b9a3-0c966feabec1} or Microsoft WBEM New Event Subsystem {F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1} depending on the system's CPU architecture.

Tactics: TA0003, TA0004
Techniques: T1546.015, T1546
Input: OwaAuth has a command to list its directory and logical drives.

Tactics: TA0007
Techniques: T1083
Input: Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open links.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: APT29 used 7-Zip to compress stolen emails into password-protected archives prior to exfiltration.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Machete has a component to check for running processes to look for web browsers.

Tactics: TA0007
Techniques: T1057
Input: SysUpdate can delete its configuration file from the targeted system.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Adversaries may abuse various implementations of JavaScript to execute various behaviors.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Gamaredon Group has collected files from infected systems and uploaded them to a C2 server.

Tactics: TA0009
Techniques: T1005
Input: Consider comparing a copy of the network device configuration against a known-good version to discover unauthorized changes to the command interpreter.

Tactics: TA0002
Techniques: T1059.008, T1059
Input: Adversaries can inspect the configuration files to reveal information about the target network and its layout, the network device and its software, or identifying legitimate accounts and credentials for later use.

Tactics: TA0009
Techniques: T1602, T1602.002
Input: Attor has staged collected data in a central upload directory prior to exfiltration.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: In some cases the URLs were shortened or linked to Word documents with malicious macros that executed PowerShells scripts to download Pupy.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: BRONZE BUTLER has used various tools (such as Mimikatz and WCE) to perform credential dumping.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: OLE object

Tactics: TA0002
Techniques: T1559, T1559.002
Input: It will run the newly downloaded PowerShell script by running the following command via cmd /c:       wscript.exe "Office365DCOMCheck.vbs" "PowerShell.exe-ExecutionPolicy bypass -WindowStyle hidden -NoProfile <path to Office365DCOMCheck.ps1 script>"     The payload will then notify the C2 it has successfully downloaded and executed the secondary PowerShell payload

Tactics: TA0002
Techniques: T1059.001, T1059
Input: ShimRat can enumerate connected drives for infected host machines.

Tactics: TA0007
Techniques: T1135
Input: Ragnar Locker has used regsvr32.exe to execute components of VirtualBox.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: TrickBot has come with a signed downloader component.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Monitor for unexpected deletion of files from the system

Tactics: TA0005
Techniques: T1070, T1070.004
Input: FatDuke can collect the user name, Windows version, computer name, and available space on discs from a compromised host.

Tactics: TA0007
Techniques: T1082
Input: 25 26 ix32.dll ix64.dll LoadLibrary call template dll is used by Reinstaller/Injector plugin (rsXX.dll) for injecting LoadLibrary call into running processes

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1055, T1574
Input: RATANKBA uploads and downloads information.

Tactics: TA0011
Techniques: T1105
Input: Ensure proper user permissions are in place to prevent adversaries from disabling or interfering with security services.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: CrackMapExec can brute force passwords for a specified user on a single target system or across an entire network.

Tactics: TA0006
Techniques: T1110, T1110.001
Input: Hancitor has used verclsid.exe to download and execute a malicious script.

Tactics: TA0005
Techniques: T1218, T1218.012
Input: USBferry can use net user to gather information about local accounts.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Tropic Trooper has created the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell and sets the value to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.004, T1547
Input: APT29 has used WMI event subscriptions for persistence.

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: Hikit performs XOR encryption.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Utilizing these shims may allow an adversary to perform several malicious acts such as elevate privileges, install backdoors, disable defenses like Windows Defender,   Shims can also be abused to establish persistence by continuously being invoked by affected programs.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: Some cloud providers, such as AWS, provide distinct log events for login attempts to the management console.

Tactics: TA0006
Techniques: T1539
Input: Several commands are supported by the Honeybee's implant via the command-line interface and there’s also a utility to execute any custom command on an infected endpoint.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Peirates gathers Kubernetes service account tokens using a variety of techniques.

Tactics: TA0006
Techniques: T1528
Input: Avaddon has searched for specific files prior to encryption.

Tactics: TA0007
Techniques: T1083
Input: Javascript

Tactics: TA0002
Techniques: T1059
Input: FatDuke can execute via rundll32.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Asymmetric cryptography, also known as public key cryptography, uses a keypair per party: one public that can be freely distributed, and one private.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Epic collects the user name from the victim’s machine.

Tactics: TA0007
Techniques: T1033
Input: MURKYTOP has the capability to scan for open ports on hosts in a connected network.

Tactics: TA0007
Techniques: T1046
Input: FALLCHILL can delete malware and associated artifacts from the victim.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: These files are stored within an 217kb encrypted cab file in the dropper’s resources under the name “A”

Tactics: TA0005
Techniques: T1027
Input: To decrypt the commands, an investigator would need access to the intended malware sample, the day's tweet, and the image file containing the command.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Uninstall any VNC server software where not required.

Tactics: TA0008
Techniques: T1021.005, T1021
Input: This technique can be used on Mac OS X Panther v10.3 and earlier versions which still execute the RC scripts.

Tactics: TA0003, TA0004
Techniques: T1037.004, T1037
Input: Service configurations can be set or modified using system utilities (such as sc.exe), by directly modifying the Registry, or by interacting directly with the Windows API.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Lazarus Group has sent spearphishing emails in an attempt to lure users to click on a malicious link.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: This may be done in a number of ways, including inserting malicious script into web pages or other user controllable web content such as forum posts.

Tactics: TA0042
Techniques: T1608.004, T1608
Input: Drovorub has used XOR encrypted payloads in WebSocket client to server messages.

Tactics: TA0005
Techniques: T1027
Input: The username appears to be attacker specified and has occurred in 2017 Bankshot samples

Tactics: TA0007
Techniques: T1033
Input: Octopus has been delivered via spearsphishing emails.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: KONNI has used a custom base64 key to encode stolen data before exfiltration.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: However, adversaries may alter the bytes of an existing .rtf file to insert a template control word field to include a URL resource of a malicious payload.

Tactics: TA0005
Techniques: T1221
Input: Deleting an instance or virtual machine can remove valuable forensic artifacts and other evidence of suspicious behavior if the instance is not recoverable.

Tactics: TA0005
Techniques: T1578.003, T1578
Input: SHARPSTATS has the ability to identify the IP address, machine name, and OS of the compromised host.

Tactics: TA0007
Techniques: T1082
Input: Analyze process behavior to determine if a process is performing unusual actions, such as opening network connections, reading files, or other suspicious actions that could relate to post-compromise behavior.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.015
Input: Registry keys specific to Microsoft Office feature control security can be set to disable automatic DDE/OLE execution.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: Gamaredon Group has used WMI to execute scripts used for discovery.

Tactics: TA0002
Techniques: T1047
Input: SideTwist has the ability to download additional files.

Tactics: TA0011
Techniques: T1105
Input: Information about host firmware may include a variety of details such as type and versions on specific hosts, which may be used to infer more information about hosts in the environment (ex: configuration, purpose, age/patch level, ).

Tactics: TA0043
Techniques: T1592, T1592.003
Input: Some Felismus samples use a custom encryption method for C2 traffic that utilizes AES and multiple keys.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Consider analyzing packet contents to detect application layer protocols, leveraging SSL/TLS inspection for encrypted traffic, that do not follow the expected protocol standards and traffic flows ( unauthorized, gratuitous, or anomalous traffic patterns attempting to access configuration content)

Tactics: TA0009
Techniques: T1602
Input: Astaroth collects the external IP address from the system.

Tactics: TA0007
Techniques: T1016
Input: collect + keychain in same sentence

Tactics: TA0006
Techniques: T1555.001, T1555
Input: Compromised/infected system images (multiple cases of removable media infected at the factory)

Tactics: TA0001
Techniques: T1195
Input: Remexi has a command to capture active windows on the machine and retrieve window titles.

Tactics: TA0007
Techniques: T1010
Input: After creating a digital certificate, an adversary may then install that certificate (see Install Digital Certificate) on infrastructure under their control.

Tactics: TA0042
Techniques: T1587, T1587.003
Input: Bisonal has decoded strings in the malware using XOR and RC4.

Tactics: TA0005
Techniques: T1140
Input: NinjaCopy

Tactics: TA0005
Techniques: T1006
Input: AADInternals is written and executed via PowerShell.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Caterpillar WebShell has a module to use a port scanner on a system.

Tactics: TA0007
Techniques: T1046
Input: APT32's backdoor can query the Windows Registry to gather system information.

Tactics: TA0007
Techniques: T1012
Input: Dragonfly has modified the Registry to perform multiple techniques through the use of Reg.

Tactics: TA0005
Techniques: T1112
Input: SUNBURST also obfuscated collected system information using a FNV-1a + XOR algorithm.

Tactics: TA0005
Techniques: T1027
Input: POST /api/osx/started HTTP/1.1Host: r2elajikcosf7zee.onion.toAccept: */*Content-Length: 233Content-Type: application/x-www-form-urlencodedbot_id=9a8965ba04e72909f36c8d16aa801794c6d905d045c2b704e8f0a9bbb97d3eb8&amp;data=psX0DKYB0u...5TximyY%2BQY%3D     Figure 10: Malware sending initial information       &gt; rc4decrypt(base64decode("psX0DKYB0u...5TximyY+QY="), "u2RLhh+!LGd9p8!ZtuKcN")device_model=MacBookPro9,2bot_version=1.3.5build_name=elitef*ckos_version=15.5.0ip_address=4.5.6.7has_root=0     Figure 11: Decoded data sent to C&C The bot_id is constructed by hashing the following values with SHA-256:  The hardware UUID (IOPlatformUUID) The system serial number (IOPlatformSerialNumber) The model identifier of the Mac (e.g.: MacBookPro9,2)  Most actions are self-explanatory

Tactics: TA0007
Techniques: T1082
Input: Chimera has staged stolen data on designated servers in the target environment.

Tactics: TA0009
Techniques: T1074.002, T1074
Input: Metamorfo has used VMProtect to pack and protect files.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel.

Tactics: TA0010
Techniques: T1011.001, T1011
Input: Similar to PtH, this involves using a password hash to authenticate as a user but also uses the password hash to create a valid Kerberos ticket.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: Monitor newly executed processes that may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: RCSession has the ability to drop additional files to an infected machine.

Tactics: TA0011
Techniques: T1105
Input: Signatures are often for unique indicators within protocols and may be based on the specific protocol used by a particular adversary or tool, and will likely be different across various malware families and versions.

Tactics: TA0011
Techniques: T1008
Input: TeamTNT has the curl command to send credentials over HTTP and download new software.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: They could subsequently lock others out of the file.

Tactics: TA0005
Techniques: T1222.002, T1222
Input: APT32 has used JavaScript for drive-by downloads and C2 communications.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Calisto's installation file is an unsigned DMG image under the guise of Intego’s security solution for mac.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Attor's has a plugin that is capable of recording audio using available input sound devices.

Tactics: TA0009
Techniques: T1123
Input: Axiom has used spear phishing to initially compromise victims.

Tactics: TA0001
Techniques: T1566
Input: Monitor for an attempt by a user that may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: Patchwork has used spearphishing with links to try to get users to click, download and open malicious files.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: HAFNIUM has downloaded malware and tools--including Nishang and PowerCat--onto a compromised host.

Tactics: TA0011
Techniques: T1105
Input: ObliqueRAT can halt execution if it identifies processes belonging to virtual machine software or analysis tools.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: sekurlsa::logonPasswords

Tactics: TA0006
Techniques: T1003, T1003.001
Input: SSL/TLS inspection can be used to see the contents of encrypted sessions to look for network-based indicators of malware communication protocols.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: A JavaScript file named photo_high_re\u202Egnp.js will be displayed as photo_high_resj.png.

Tactics: TA0005
Techniques: T1036, T1036.002
Input: /var/log/secure or /var/log/auth.log: Authentication logs

Tactics: TA0005
Techniques: T1070, T1070.002
Input: LitePower can query the Registry for keys added to execute COM hijacking.

Tactics: TA0007
Techniques: T1012
Input: System owners are also advised to run the YARA tool on any system they suspect to have been targeted by HIDDEN COBRA actors

Tactics: TA0007
Techniques: T1082
Input: BackdoorDiplomacy has also exploited mis-configured Plesk servers.

Tactics: TA0001
Techniques: T1190
Input: SodaMaster has the ability to download additional payloads from C2 to the targeted system.

Tactics: TA0011
Techniques: T1105
Input: RainyDay can use services to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543