madox81/Adema_ATTACK_DS huggingface dataset:
Input: RDAT can issue SOAP requests to delete already processed C2 emails.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: objectClass=trustedDomain

Tactics: TA0007
Techniques: T1482
Input: SUPERNOVA contained Base64-encoded strings.

Tactics: TA0005
Techniques: T1027
Input: Waterbear can inject decrypted shellcode into the LanmanServer service.

Tactics: TA0004, TA0005
Techniques: T1055
Input: If permissions for this feature are misconfigured – for example, by allowing all users to request a token for a particular account - an adversary may be able to gain initial access to a Cloud Account or escalate their privileges.

Tactics: TA0005, TA0008
Techniques: T1550.001, T1550
Input: 10 Ensuring the files have been downloaded After the malware is downloaded and files verified, the script will check in the C:\Program Files\ directory for the presence Avast antivirus, which happens to be the most common installed AV worldwide

Tactics: TA0007, TA0011
Techniques: T1090.003, T1083, T1105, T1090
Input: C2 traffic from ADVSTORESHELL is encrypted, then encoded with Base64 encoding.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: These dropped files bundle functionality for both 64bit and 32bit Windows systems and are all located within one directory: C:\Documents and Settings\user\Application Data\ATI_Subsystem\ 6761106f816313394a653db5172dc487,amdhcp32.dll,54kb  ← 32bit dll,CompiledOn:2014.07.02 21:13:24 d596827d48a3ff836545b3a999f2c3e3,aticaldd.dll,60kb  ← 64bit dll,CompiledOn:2014.07.02 21:13:26 bc626c8f11ed753f33ad1c0fe848d898,atiumdag.dll,285kb ← 32bit dll, Trojan.Win32.CozyDuke.a, CompiledOn:2014.07.02 21:13:26 4152e79e3dbde55dcf3fc2014700a022,6kb,racss.dat The code copies rundll32.exe from windows\system32 to its newly created %appdata%\ATI_Subsystem subdirectory as “amdocl_as32.exe” alongside the three dll’s listed above

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1218, T1574.002, T1218.011, T1055, T1574
Input: Meteor has been disguised as the Windows Power Efficiency Diagnostics report tool.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Okrum was seen using MimikatzLite to perform credential dumping.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: NavRAT loads malicious shellcode and executes it in memory.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Threat Group-3390 has performed DLL search order hijacking to execute their payload.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Python

Tactics: TA0002
Techniques: T1059
Input: Get-LocAdm

Tactics: TA0007
Techniques: T1069
Input: APT29 modified timestamps of backdoors to match legitimate Windows files.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: LightNeuron is capable of modifying email content, headers, and attachments during transit.

Tactics: TA0040
Techniques: T1565, T1565.002
Input: Ursnif has copied itself to and infected removable drives for propagation.

Tactics: TA0001, TA0008
Techniques: T1091
Input: Reg may be used to find credentials in the Windows Registry.

Tactics: TA0006
Techniques: T1552, T1552.002
Input: PipeMon can collect and send the local IP address, RDP information, and the network adapter physical address as a part of its C2 beacon.

Tactics: TA0007
Techniques: T1016
Input: For example, the EventLog service may be disabled using the following PowerShell line: Stop-Service -Name EventLog.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: A modified .LNK or .SCF file with the icon filename pointing to an external reference such as \[remote address]\pic.png that will force the system to load the resource when the icon is rendered to repeatedly gather credentials.

Tactics: TA0006
Techniques: T1187
Input: DarkWatchman has used the csc.exe tool to compile a C# executable.

Tactics: TA0005
Techniques: T1027.004, T1027
Input: Transport agents will be invoked during a specified stage of email processing and carry out developer defined tasks.

Tactics: TA0003
Techniques: T1505.002, T1505
Input: gh0st RAT uses RC4 and XOR to encrypt C2 traffic.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Tools such as MailSniper can be used to automate searches for specific keywords.

Tactics: TA0009
Techniques: T1114, T1114.002
Input: Lazarus Group malware uses cmd.exe to execute commands on a compromised host.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Go2Assist

Tactics: TA0011
Techniques: T1219
Input: Monitor for newly constructed services/daemons that may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence.

Tactics: TA0003, TA0004
Techniques: T1543
Input: Machete has relied on users opening malicious attachments delivered through spearphishing to execute malware.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Actions may be related to network and system information Discovery, Collection, or other scriptable post-compromise behaviors and could be used as indicators of detection leading back to the source script.

Tactics: TA0002
Techniques: T1059.002, T1059
Input: Hancitor has also delivered compressed payloads in ZIP files to victims.

Tactics: TA0005
Techniques: T1027
Input: Get-MicrophoneAudio

Tactics: TA0009
Techniques: T1123
Input: Network intrusion prevention systems and systems designed to scan and remove malicious email attachments can be used to block activity.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Limit user accounts that can load or unload device drivers by disabling SeLoadDriverPrivilege.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.012
Input: Meteor has the ability to change the password of local users on compromised hosts and can log off users.

Tactics: TA0040
Techniques: T1531
Input: Access to cloud accounts can also be abused to gain Initial Access to a network by abusing a Trusted Relationship.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078.004, T1078
Input: Dok gives all users execute permissions for the application using the command chmot +x /Users/Shared/AppStore.app.

Tactics: TA0005
Techniques: T1222.002, T1222
Input: ShellExecute

Tactics: TA0002
Techniques: T1106
Input: SUNBURST also removed the firewall rules it created during execution.

Tactics: TA0005
Techniques: T1070
Input: SysUpdate has the ability to download files to a compromised host.

Tactics: TA0011
Techniques: T1105
Input: Get-NetDomainTrust

Tactics: TA0007
Techniques: T1482
Input: Kinsing has communicated with C2 over HTTP.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Efforts should likely be placed on mitigation and collecting enough information on process launches and actions that could be performed before and after a UAC bypass is performed.

Tactics: TA0004, TA0005
Techniques: T1548
Input: Wingbird deletes its payload along with the payload's parent process after it finishes copying files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: LoadModule()

Tactics: TA0002
Techniques: T1106
Input: MS##-###

Tactics: TA0008
Techniques: T1210
Input: P.A.S. Webshell can upload and download files to and from compromised hosts.

Tactics: TA0011
Techniques: T1105
Input: Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: whoami

Tactics: TA0007
Techniques: T1033
Input: Kessel can exfiltrate credentials and other information via HTTP POST request, TCP, and DNS.

Tactics: TA0010
Techniques: T1048.003, T1048
Input: The PowerShell script executes a compressed first stage PowerShell child process, which then performs a second stage PowerShell process

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Monitor and analyze network flows associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, or gratuitous or anomalous traffic patterns).

Tactics: TA0003, TA0005, TA0011, TA0010
Techniques: T1020.001, T1205, T1020, T1205.001
Input: Malware associated with this technique have also used SendNotifyMessage  to trigger the associated window procedure and eventual malicious injection.

Tactics: TA0004, TA0005
Techniques: T1055.011, T1055
Input: !ProcessList List running processes, including their PID, parent PID, executable name and priority   !SendFileToServer Uploads a specified file to the C2 server   !CaptureScreen Takes a screenshot that it saves to a file and uploads to the C2 server

Tactics: TA0007, TA0011
Techniques: T1057, T1105
Input: Orz can gather victim drive information.

Tactics: TA0007
Techniques: T1083
Input: Comnie appends a total of 64MB of garbage data to a file to deter any security products in place that may be scanning files on disk.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: Machete searches the File system for files of interest.

Tactics: TA0009
Techniques: T1005
Input: jRAT can serve as a SOCKS proxy server.

Tactics: TA0011
Techniques: T1090
Input: WindTail has the ability to enumerate the users home directory and the path to its own application bundle.

Tactics: TA0007
Techniques: T1083
Input: net user

Tactics: TA0007
Techniques: T1087
Input: Emotet leverages the Admin$ share for lateral movement once the local admin password has been brute forced.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: GravityRAT has a feature to list the available services on the system.

Tactics: TA0007
Techniques: T1007
Input: TA459 has targeted victims using spearphishing emails with malicious Microsoft Word attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: The .zip archive attached to the email contains a Windows shortcut (.lnk) file with the Microsoft Internet Explorer logo

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Darkhotel has dropped an mspaint.lnk shortcut to disk which launches a shell script that downloads and executes a file.

Tactics: TA0002, TA0003, TA0004
Techniques: T1547.009, T1059.003, T1547, T1059
Input: Note: aswrundll.exe is very similar to Microsoft’s own rundll32.exe - it allows you to execute DLLs by calling their exported functions

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Disk Structure Wipe may be performed in isolation, or along with Disk Content Wipe if all sectors of a disk are wiped.

Tactics: TA0040
Techniques: T1561, T1561.002
Input: In Kubernetes environments, the admission controller can be used to validate images after a container deployment request is authenticated but before the container is deployed.

Tactics: TA0002, TA0005
Techniques: T1610
Input: There are several known examples of this occurring.

Tactics: TA0001
Techniques: T1189
Input: net share

Tactics: TA0007
Techniques: T1135
Input: capture keystrokes

Tactics: TA0006, TA0009
Techniques: T1056
Input: Run the Autoruns utility, which checks for this Registry key as a persistence mechanism

Tactics: TA0003, TA0004
Techniques: T1547, T1547.010
Input: VBA macros obtained from the Internet, based on the file's Mark of the Web (MOTW) attribute, may be blocked from executing in Office applications (ex: Access, Excel, PowerPoint, Visio, and Word) by default starting in Windows Version 2203.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Binaries used in this technique are often Microsoft-signed files, indicating that they have been either downloaded from Microsoft or are already native in the operating system.

Tactics: TA0005
Techniques: T1218
Input: Mach-O binaries have a series of headers that are used to perform certain operations when a binary is loaded.

Tactics: TA0003, TA0004
Techniques: T1546.006, T1546
Input: Decrypted Config: C&C IP: 192.168.0.107 Port: 80 Sleep Timer: 30000 Campaign Identifier: Mirage If you look at it the decrypted configuration, you may notice that the IP being used for the C&C is an internal IP address

Tactics: TA0005, TA0007
Techniques: T1140, T1016
Input: Kazuar obtains a list of running processes through WMI querying.

Tactics: TA0002
Techniques: T1047
Input: TA551 has used a DGA to generate URLs from executed macros.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: Aria-body has used an encrypted configuration file for its loader.

Tactics: TA0005
Techniques: T1027
Input: Exaramel for Linux has a hardcoded location that it uses to achieve persistence if the startup system is Upstart or System V and it is running as root.

Tactics: TA0003, TA0004
Techniques: T1543
Input: MESSAGETAP checks two files, keyword_parm.txt and parm.txt, for instructions on how to target and save data parsed and extracted from SMS message data from the network traffic.

Tactics: TA0009
Techniques: T1119
Input: Micropsia searches for anti-virus software and firewall products installed on the victim’s machine using WMI.

Tactics: TA0002, TA0007
Techniques: T1518.001, T1047, T1518
Input: GeminiDuke collects information on local user accounts from the victim.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: A rogue DC must authenticate as a service using these two SPNs for the replication process to successfully complete.

Tactics: TA0005
Techniques: T1207
Input: Analyze the contents of corresponding .service files present on the file system and ensure that they refer to legitimate, expected executables.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.006, T1053
Input: Chimera has used time /t and net time \ip/hostname for system time discovery.

Tactics: TA0007
Techniques: T1124
Input: ComRAT samples have been seen which hijack COM objects for persistence by replacing the path to shell32.dll in registry location HKCU\Software\Classes\CLSID{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32.

Tactics: TA0003, TA0004
Techniques: T1546.015, T1546
Input: KGH_SPY can perform keylogging by polling the GetAsyncKeyState() function.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Like other Execution Guardrails, environmental keying can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within.

Tactics: TA0005
Techniques: T1480, T1480.001
Input: spwebmember

Tactics: TA0009
Techniques: T1213
Input: Built-in Windows tools such as comsvcs.dll can also be used:

Tactics: TA0006
Techniques: T1003, T1003.001
Input: OpenClipboard()

Tactics: TA0009
Techniques: T1115
Input: These entries may contain information about the Control Panel item such as its display name, path to the local file, and the command executed when opened in the Control Panel.

Tactics: TA0005
Techniques: T1218, T1218.002
Input: Sykipot is known to contain functionality that enables targeting of smart card technologies to proxy authentication for connections to restricted network resources using detected hardware tokens.

Tactics: TA0006
Techniques: T1111
Input: Transparent Tribe has set up websites with malicious hyperlinks and iframes to infect targeted victims with Crimson, njRAT, and other malicious tools.

Tactics: TA0042
Techniques: T1608.004, T1608
Input: Side-loading takes advantage of the DLL search order used by the loader by positioning both the victim application and malicious payload(s) alongside each other.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: APT38 has used VBScript to execute commands and other operational tasks.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: REvil can exfiltrate host and malware information to C2 servers.

Tactics: TA0010
Techniques: T1041
Input: BloodHound can compress data collected by its SharpHound ingestor into a ZIP file to be written to disk.

Tactics: TA0009
Techniques: T1560
Input: HISTCONTROL

Tactics: TA0005
Techniques: T1562.003, T1562
Input: Monitor for changes to windows registry keys and/or values that may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: If the Trojan does not have root privileges to enable its automatic launch, it creates the “~/.config/autostart/dbus-inotifier.desktop” file with the following contents: [Desktop Entry] Type=Application Exec=/home/user/.config/dbus-notifier/dbus-inotifier Name[en_EN]=system service d-bus notifier Name=system service d-bus notifier Comment[en_EN]= Comment= “/home/user/” stands here for the environment variable HOME

Tactics: TA0007
Techniques: T1033
Input: Monitor for changes made to /proc files that may inject malicious code into processes via the /proc filesystem in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055.009, T1055
Input: fprii.net 185.130.212.254 Domain used for spear phish sender e-mail address and to host malicious documents

Tactics: TA0007
Techniques: T1016
Input: RATANKBA uses HTTP/HTTPS for command and control communication.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Monitor executed commands and arguments that may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

Tactics: TA0003, TA0004
Techniques: T1546.015, T1546
Input: Adversaries can abuse applications such as ARD to gain remote code execution and perform lateral movement.

Tactics: TA0008
Techniques: T1021
Input: WannaCry scans its local network segment for remote systems to try to exploit and copy itself to.

Tactics: TA0007
Techniques: T1018
Input: TSCookie has the ability to decrypt, load, and execute a DLL and its resources.

Tactics: TA0005
Techniques: T1140
Input: net config

Tactics: TA0007
Techniques: T1016
Input: APT37 has used malware that will issue the command shutdown /r /t 1 to reboot a system after wiping its MBR.

Tactics: TA0040
Techniques: T1529
Input: net session

Tactics: TA0007
Techniques: T1049
Input: A version of KONNI drops a Windows shortcut on the victim’s machine to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Compare recent invocations of odbcconf.exe with prior history of known good arguments and loaded DLLs to determine anomalous and potentially adversarial activity.

Tactics: TA0005
Techniques: T1218, T1218.008
Input: TeamTNT has obtained domains to host their payloads.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: scheduled task

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Ensure Launch Agent's  ProgramArguments  key pointing to executables located in the /tmp or /shared folders are in alignment with enterprise policy.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: Clipboard stealer

Tactics: TA0009
Techniques: T1115
Input: Afterwards, the persistence file will be created in /Library/LaunchDaemons/ or ~/Library/LaunchAgents/  folder

Tactics: TA0003, TA0004, TA0005, TA0011
Techniques: T1090.003, T1543.001, T1564, T1543, T1090, T1564.001
Input: MuddyWater has used C2 infrastructure to receive exfiltrated data.

Tactics: TA0010
Techniques: T1041
Input: Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to Log4j (CVE-2021-44228).

Tactics: TA0043
Techniques: T1595, T1595.002
Input: All login items created via shared file lists are viewable by using the System Preferences GUI or in the ~/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm file.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.015
Input: Cobalt Strike can use RSA asymmetric encryption with PKCS1 padding to encrypt data sent to the C2 server.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: These audits should also include checks on any appliances and applications for default credentials or SSH keys, and if any are discovered, they should be updated immediately.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.001
Input: Rocke has used SSH private keys on the infected machine to spread its coinminer throughout a network.

Tactics: TA0006
Techniques: T1552.004, T1552
Input: BACKSPACE is capable of deleting Registry keys, sub-keys, and values on a victim system.

Tactics: TA0005
Techniques: T1112
Input: appinit_dll

Tactics: TA0003, TA0004
Techniques: T1546, T1546.010
Input: Email attacks often use “click-worthy” or interesting topics to convince users to click links or open attachments that could lead to various threats

Tactics: TA0002
Techniques: T1204
Input: Information about networks may include a variety of details, including administrative data (ex: IP ranges, domain names, ) as well as specifics regarding its topology and operations.

Tactics: TA0043
Techniques: T1590
Input: ROADTools can enumerate Azure AD applications and service principals.

Tactics: TA0007
Techniques: T1526
Input: OnionDuke uses HTTP and HTTPS for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: APT39 has packed tools with UPX, and has repacked a modified version of Mimikatz to thwart anti-virus detection.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Tomiris has connected to a signalization server that provides a URL and port, and then Tomiris sends a GET request to that URL to establish C2.

Tactics: TA0011
Techniques: T1568
Input: Some Bisonal samples encrypt C2 communications with RC4.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Downdelph bypasses UAC to escalate privileges by using a custom "RedirectEXE" shim database.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Linux and macOS implementations of SMB typically use Samba.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: A JPIN uses a encrypted and compressed payload that is disguised as a bitmap within the resource section of the installer.

Tactics: TA0005
Techniques: T1027
Input: The authorized_keys file in SSH specifies the SSH keys that can be used for logging into the user account for which the file is configured.

Tactics: TA0003
Techniques: T1098.004, T1098
Input: Segment externally facing servers and services from the rest of the network with a DMZ or on separate hosting infrastructure.

Tactics: TA0001
Techniques: T1190
Input: OSX_OCEANLOTUS.D uses a shell script as the main executable inside an app bundle and drops an embedded base64-encoded payload to the /tmp folder.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: NBNS Spoofing

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: APT39 used custom tools to create SOCK5 and custom protocol proxies between infected hosts.

Tactics: TA0011
Techniques: T1090.001, T1090
Input: LoadPackagedLibrary()

Tactics: TA0002
Techniques: T1106
Input: Monitor file systems for changes to application binaries and invalid checksums/signatures.

Tactics: TA0003, TA0004
Techniques: T1546.006, T1546
Input: Windows API calls such as CreateRemoteThread, SuspendThread/SetThreadContext/ResumeThread, and those that can be used to modify memory within another process, such as VirtualAllocEx/WriteProcessMemory, may be used for this technique.

Tactics: TA0004, TA0005
Techniques: T1055.003, T1055.012, T1055.005, T1055
Input: Adversaries can weaken the encryption software on a compromised network device by reducing the key size used by the software to convert plaintext to ciphertext (, from hundreds or thousands of bytes to just a couple of bytes).

Tactics: TA0005
Techniques: T1600.001, T1600
Input: Data that is sent is compressed and then base64-encoded before being included in the requests

Tactics: TA0011
Techniques: T1132
Input: capture webcam data

Tactics: TA0009
Techniques: T1125
Input: Proxysvc automatically collects data about the victim and sends it to the control server.

Tactics: TA0009
Techniques: T1119
Input: The following code example shows the false flag being set (5 > 115) and the ETransaksi.diomadnfagaghagh method being called:  int num = 5; int num2 = 155; bool flag = num > num2; if (flag) {     <legitimate Sales System Application code>     }            else {     NewLateBinding.LateCall(ETransaksi.diomadnfagaghagh(), null, "Invoke", new object[]     {         null,         new object[0]     }, null, null, null, true);The payload uses this technique to run a chain of methods that eventually carry out its malicious task

Tactics: TA0005
Techniques: T1140