madox81/Adema_ATTACK_DS huggingface dataset:
Input: Evilnum has used the malware variant, TerraTV, to load a malicious DLL placed in the TeamViewer directory, instead of the original Windows DLL located in a system folder.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Honeybee uses FTP for command and control.

Tactics: TA0011
Techniques: T1071.002, T1071
Input: Malware used by Group5 is capable of remotely deleting files from victims.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Adversaries may use this functionality as a way to execute arbitrary payloads on a victim system.

Tactics: TA0002
Techniques: T1129
Input: Agent Tesla has the ability to steal credentials from FTP clients and wireless profiles.

Tactics: TA0006
Techniques: T1555
Input: QakBot can measure the download speed on a targeted host.

Tactics: TA0007
Techniques: T1016.001, T1016
Input: Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053
Input: Hildegard has deleted scripts after execution.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: * User accounts start with a RID of 1,000+.

Tactics: TA0006
Techniques: T1003, T1003.002
Input: Metamorfo has displayed fake forms on top of banking sites to intercept credentials from victims.

Tactics: TA0006, TA0009
Techniques: T1056.002, T1056
Input: Nomadic Octopus has used PowerShell for execution.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: FIN8's malicious spearphishing payloads are executed as PowerShell.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: MegaCortex has checked the number of CPUs in the system to avoid being run in a sandbox or emulator.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Analysis of the domains and IP address infrastructure used by APT15 identified a number of similar possible domains, shown at the bottom of the post

Tactics: TA0007
Techniques: T1016
Input: BRONZE BUTLER has used TROJ_GETVERSION to discover system services.

Tactics: TA0007
Techniques: T1007
Input: Lokibot has used VBS scripts and XLS macros for execution.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: UPPERCUT can capture desktop screenshots in the PNG format and send them to the C2 server.

Tactics: TA0009
Techniques: T1113
Input: Cloud firewalls are separate from system firewalls that are described in Disable or Modify System Firewall.

Tactics: TA0005
Techniques: T1562.007, T1562
Input: Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.

Tactics: TA0006
Techniques: T1003.003, T1003
Input: BlackTech has used spearphishing e-mails with malicious password-protected archived files (ZIP or RAR) to deliver malware.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: CosmicDuke exfiltrates collected files over FTP or WebDAV.

Tactics: TA0010
Techniques: T1048.003, T1048
Input: sch.exe

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Leviathan has used WMI for persistence.

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software.

Tactics: TA0006
Techniques: T1003
Input: Adversaries may also combine brute forcing activity with behaviors such as External Remote Services as part of Initial Access.

Tactics: TA0006
Techniques: T1110
Input: Attacks targeting web applications may generate logs in the web server, application server, and/or database server that can be used to identify the type of attack, possibly before the impact is felt.

Tactics: TA0040
Techniques: T1499.002, T1499, T1499.003
Input: Information about an organization may include a variety of details, including the names of divisions/departments, specifics of business operations, as well as the roles and responsibilities of key employees.

Tactics: TA0043
Techniques: T1591
Input: Adversaries can also use NETEAGLE to establish an RDP connection with a controller over TCP/7519.

Tactics: TA0011
Techniques: T1071
Input: The "tDiscoverer" variant of HAMMERTOSS establishes a C2 channel by downloading resources from Web services like Twitter and GitHub.

Tactics: TA0011
Techniques: T1102.003, T1102
Input: Tropic Trooper has been known to side-load DLLs using a valid version of a Windows Address Book and Windows Defender executable with one of their tools.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: On Windows 10, various Attack Surface Reduction (ASR) rules can be enabled to prevent the execution of potentially malicious executable files (such as those that have been downloaded and executed by Office applications/scripting interpreters/email clients or that do not meet specific prevalence, age, or trusted list criteria).

Tactics: TA0002
Techniques: T1204.002, T1204
Input: The information contained in this data dump include:  Stolen credentials Potential systems to login to using stolen credentials Deployed webshell URLs Backdoor tools Command and control server component of backdoor tools Scripts to perform DNS hijacking Documents identifying specific individual operators Screenshots of OilRig operational systems  The Leak In mid-March 2019, an unknown entity appeared on several hacking forums and Twitter with the user handle @Mr_L4nnist3r claiming they had access to data dumps involving internal tools and data used by the OilRig group

Tactics: TA0006
Techniques: T1003
Input: Protocols such as ICMP may be used as a transport.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: Command ID 17 indexes to a function that collects the system information and sends it to the C2 server.

Tactics: TA0007
Techniques: T1033
Input: LazyScripter has used VBScript to execute malicious code.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Chimera has used credential stuffing against victim's remote services to obtain valid accounts.

Tactics: TA0006
Techniques: T1110.004, T1110
Input: Monitor for accounts assigned to admin roles that go over a certain threshold of known admins.

Tactics: TA0003
Techniques: T1136, T1136.003, T1098, T1098.003
Input: DEATHRANSOM can download files to a compromised host.

Tactics: TA0011
Techniques: T1105
Input: Determine if certain social media sites, personal webmail services, or other service that can be used for spearphishing is necessary for business operations and consider blocking access if activity cannot be monitored well or if it poses a significant risk.

Tactics: TA0001
Techniques: T1566.003, T1566
Input: QakBot can use net localgroup to enable discovery of local groups.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: Monitoring when the user's .bash_history is read can help alert to suspicious activity.

Tactics: TA0006
Techniques: T1552.003, T1552
Input: Outlook rules allow a user to define automated behavior to manage email messages.

Tactics: TA0003
Techniques: T1137, T1137.005
Input: Captured hashes are used with PtH to authenticate as that user.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: esentutl can be used to read and write alternate data streams.

Tactics: TA0005
Techniques: T1564, T1564.004
Input: Carberp's bootkit can inject a malicious DLL into the address space of running processes.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Lazarus Group has used DOCX files to retrieve a malicious document template/DOTM file.

Tactics: TA0005
Techniques: T1221
Input: Monitor for newly executed processes, such as Windows Management Instrumentation and PowerShell , with arguments that can be used to enumerate email addresses and accounts.

Tactics: TA0007
Techniques: T1087.003, T1087
Input: Configuration repositories are used by management systems in order to configure, manage, and control data on remote systems.

Tactics: TA0009
Techniques: T1602
Input: Monitor executed commands and arguments that may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes.

Tactics: TA0003, TA0004
Techniques: T1546.009, T1546
Input: Ensure proper Registry permissions are in place to prevent adversaries from disabling or modifying firewall settings.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: When a user attempts to browse a website that presents a certificate that is not trusted an error message will be displayed to warn the user of the security risk.

Tactics: TA0005
Techniques: T1553, T1553.004
Input: LightNeuron collects Exchange emails matching rules specified in its configuration.

Tactics: TA0009
Techniques: T1114, T1114.002
Input: PowerSploit reflectively loads a Windows PE file into a process.

Tactics: TA0005
Techniques: T1620
Input: Cobalt Strike uses a command-line interface to interact with systems.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: NETWIRE can capture the victim's screen.

Tactics: TA0009
Techniques: T1113
Input: Dridex can use multiple layers of proxy servers to hide terminal nodes in its infrastructure.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: Disturbing or offensive images may be used as a part of Defacement in order to cause user discomfort, or to pressure compliance with accompanying messages.

Tactics: TA0040
Techniques: T1491
Input: Turla surveys a system upon check-in to discover the system time by using the net time command.

Tactics: TA0007
Techniques: T1124
Input: Magnifier: C:\Windows\System32\Magnify.exe

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: To move laterally on a victim network, FIN6 has used credentials stolen from various systems on which it gathered usernames and password hashes.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: PowerDuke has a command to list the victim's processes.

Tactics: TA0007
Techniques: T1057
Input: Monitor network data for uncommon data flows that may be related to abuse of /techniques/T1078 to log into a service specifically designed to accept remote connections, such as RDP, telnet, SSH, and VNC.

Tactics: TA0008
Techniques: T1021
Input: Octopus can download additional files and tools onto the victim’s machine.

Tactics: TA0011
Techniques: T1105
Input: APT38 uses a tool called CLEANTOAD that has the capability to modify Registry keys.

Tactics: TA0005
Techniques: T1112
Input: After finding the process id, the shellcode uses standard functions to allocate and write memory within Explorer and then uses low-level API RtlCreateUserThread for thread injection.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Empire can use GitHub for data exfiltration.

Tactics: TA0010
Techniques: T1567.001, T1567
Input: Okrum's installer can attempt to achieve persistence by creating a scheduled task.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Torisma can send victim data to an actor-controlled C2 server.

Tactics: TA0010
Techniques: T1041
Input: Empire can perform pass the hash attacks.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: SNUGRIDE encrypts C2 traffic using AES with a static key.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Sandworm Team has used the Telegram Bot API from Telegram Messenger to send and receive commands to its Python backdoor.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: Adversaries may abuse various utilities to compress or encrypt data before exfiltration.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Adversaries may manipulate the configuration on the network device specifying use of a malicious TFTP server, which may be used in conjunction with Modify System Image to load a modified image on device startup or reset.

Tactics: TA0003, TA0005
Techniques: T1542.005, T1542
Input: Similarly, GCP's Cloud SDK CLI provides the gcloud compute instances list command to list all Google Compute Engine instances in a project , and Azure's CLI command az vm list lists details of virtual machines.

Tactics: TA0007
Techniques: T1580
Input: Monitor for processes and/or command-lines to install or modify login hooks, as well as processes spawned at user login by these hooks.

Tactics: TA0003, TA0004
Techniques: T1037.002, T1037
Input: Cobalt Strike can use sudo to run a command.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: (stored in Windows Registry keys) An adversary can place an executable in a higher level directory of the path, and Windows will resolve that executable instead of the intended executable.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.009, T1574
Input: ShimRat's loader has been packed with the compressed ShimRat core DLL and the legitimate DLL for it to hijack.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: USBStealer exfiltrates collected files via removable media from air-gapped victims.

Tactics: TA0010
Techniques: T1052, T1052.001
Input: 4H RAT has the capability to obtain a listing of running processes (including loaded modules).

Tactics: TA0007
Techniques: T1057
Input: An Endpoint DoS denies the availability of a service without saturating the network used to provide access to the service.

Tactics: TA0040
Techniques: T1499
Input: Ramsay can collect Microsoft Word documents from the target's file system, as well as .txt, .doc, and .xls files from the Internet Explorer cache.

Tactics: TA0009
Techniques: T1005
Input: Some APT40 malware tools can evade typical network detectiona by leveraging legitimate websites, such as GitHub, Google, and Pastebin for initial C2 communications

Tactics: TA0011
Techniques: T1102
Input: Epic uses the tasklist /v command to obtain a list of processes.

Tactics: TA0007
Techniques: T1057
Input: TrickBot uses a custom crypter leveraging Microsoft’s CryptoAPI to encrypt C2 traffic.Newer versions of TrickBot have been known to use bcrypt to encrypt and digitally sign responses to their C2 server.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: The Windows service control manager (services.exe) is an interface to manage and manipulate services.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: NETWIRE can discover processes on compromised hosts.

Tactics: TA0007
Techniques: T1057
Input: Lazarus Group has used multiple proxies to obfuscate network traffic from victims.

Tactics: TA0011
Techniques: T1090, T1090.002
Input: Turla has used Metasploit to perform reflective DLL injection in order to escalate privileges.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Matryoshka uses rundll32.exe in a Registry Run key value for execution as part of its persistence mechanism.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: CharmPower can use wmic to gather information from a system.

Tactics: TA0002
Techniques: T1047
Input: If possible, use a Remote Desktop Gateway to manage connections and security configuration of RDP within a network.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: This command is particularly interesting as it enables an alternative command and control channel that uses the Google Drive API

Tactics: TA0011
Techniques: T1102
Input: Cobalt Strike can also use PowerSploit and other scripting frameworks to perform execution.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Monitor newly executed processes that may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes.

Tactics: TA0003, TA0004
Techniques: T1546.009, T1546
Input: The group has also used a tool that acts as a proxy to allow C2 even if the victim is behind a router.

Tactics: TA0011
Techniques: T1090, T1090.002
Input: Magic Hound malware can use a SOAP Web service to communicate with its C2 server.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: P8RAT has the ability to "sleep" for a specified time to evade detection.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Wizard Spider has used Digicert code-signing certificates for some of its malware.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Ramsay has been delivered using OLE objects in malicious documents.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: CARROTBAT has the ability to download and execute a remote file via certutil.

Tactics: TA0011
Techniques: T1105
Input: Kimsuky has executed a variety of PowerShell scripts.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: MFA can also be used to restrict access to cloud resources and APIs.

Tactics: TA0001, TA0003, TA0004, TA0005, TA0006
Techniques: T1078, T1556, T1078.002, T1556.001
Input: Figure 3: Screen capture of the downloader executed on OS X El Capitan

Tactics: TA0009
Techniques: T1113
Input: Shamoon contains base64-encoded strings.

Tactics: TA0005
Techniques: T1027
Input: PlugX uses Pastebin to store C2 addresses.

Tactics: TA0011
Techniques: T1102.001, T1102
Input: admin@338 actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe

Tactics: TA0005
Techniques: T1036.005, T1036
Input: The following graph view from IDA shows these steps.These execution steps allow the launch of the new ROKRAT variant by decoding the PE binary and injecting into the cmd.exe process

Tactics: TA0002, TA0004, TA0005
Techniques: T1055, T1059
Input: Require secure port access to communicate with the APIs over TLS by disabling unauthenticated access to the Docker API and Kubernetes API Server.

Tactics: TA0002, TA0006, TA0007
Techniques: T1552, T1609, T1552.007, T1613
Input: Similarly, on Linux systems adversaries may abuse trusted binaries such as split to proxy execution of malicious commands.

Tactics: TA0005
Techniques: T1218
Input: WIRTE has used HTTP for network communication.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: In some of the worst cases for DDoS, so many systems are used to generate requests that each one only needs to send out a small amount of traffic to produce enough volume to exhaust the target's resources.

Tactics: TA0040
Techniques: T1499
Input: Valak has the ability save and execute files as alternate data streams (ADS).

Tactics: TA0005
Techniques: T1564, T1564.004
Input: Misdat network traffic communicates over a raw socket.

Tactics: TA0011
Techniques: T1095
Input: Calisto uses launchctl to enable screen sharing on the victim’s machine.

Tactics: TA0002
Techniques: T1569.001, T1569
Input: Monitor for changes made to a file may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware.

Tactics: TA0005
Techniques: T1070
Input: Fox Kitten has used valid accounts to access SMB shares.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Okrum mimics HTTP protocol for C2 communication, while hiding the actual messages in the Cookie and Set-Cookie headers of the HTTP requests.

Tactics: TA0011
Techniques: T1001, T1001.003
Input: DarkVishnya has obtained and used tools such as Impacket, Winexe, and PsExec.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Monitoring the specific plist files associated with reopening applications can indicate when an application has registered itself to be reopened.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.007
Input: Bankshot creates processes using the Windows API calls: CreateProcessA() and CreateProcessAsUserA().

Tactics: TA0002
Techniques: T1106
Input: ps

Tactics: TA0007
Techniques: T1057
Input: Carbanak logs key strokes for configured processes and sends them back to the C2 server.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Lucifer can scan for open ports including TCP ports 135 and 1433.

Tactics: TA0007
Techniques: T1046
Input: Commands such as net group /domain of the Net utility,  dscacheutil -q group on macOS, and ldapsearch on Linux can list domain-level groups.

Tactics: TA0007
Techniques: T1069.002, T1069
Input: If the VBA source code is removed, some tools might even think that there are no macros present.

Tactics: TA0005
Techniques: T1564, T1564.007
Input: Operation Wocao has used the Xserver backdoor to exfiltrate data.

Tactics: TA0010
Techniques: T1041
Input: An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant.

Tactics: TA0003
Techniques: T1098, T1098.003
Input: In order to decode this data, Comnie first decodes it using base64 with the following non-standard alphabet (note that it is simply the original alphabet in reverse): /+9876543210zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA   The resulting data is then parsed and decrypted using RC4

Tactics: TA0005
Techniques: T1140
Input: Siloscape uses Tor to communicate with C2.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: Sandworm Team has conducted research against potential victim websites as part of its operational planning.

Tactics: TA0043
Techniques: T1594
Input: Execution via ptrace system call injection may also evade detection from security products since the execution is masked under a legitimate process.

Tactics: TA0004, TA0005
Techniques: T1055.008, T1055
Input: This is included by default in Windows Server 2012+ and is available by patch for XP+ and Server 2003+.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: By default, only administrators are allowed to connect remotely using WMI.

Tactics: TA0002
Techniques: T1047
Input: However, we were able determine a unique, hard-coded user agent used for the C2 communications: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; InfoPath.1) Using AutoFocus, we pivoted from the user agent string to expand our data set to three additional Zebrocy samples using the exact same user agent

Tactics: TA0003, TA0004, TA0007
Techniques: T1087, T1543.001, T1543
Input: Lucifer can persist by setting Registry key values HKLM\Software\Microsoft\Windows\CurrentVersion\Run\QQMusic and HKCU\Software\Microsoft\Windows\CurrentVersion\Run\QQMusic.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: FIN6 has sent stolen payment card data to remote servers via HTTP POSTs.

Tactics: TA0010
Techniques: T1048.003, T1048
Input: APT39 has used a command line utility and a network scanner written in python.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: These credentials include both x509 keys and passwords.

Tactics: TA0003
Techniques: T1098.001, T1098
Input: * CPL format registered Control Panel items stored in the System32 directory are automatically shown in the Control Panel.

Tactics: TA0005
Techniques: T1218, T1218.002
Input: Dok installs two LaunchAgents to redirect all network traffic with a randomly generated name for each plist file maintaining the format com.random.name.plist.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: SpicyOmelette has collected data and other information from a compromised host.

Tactics: TA0009
Techniques: T1005
Input: ComRAT can load a PE file from memory or the file system and execute it with CreateProcessW.

Tactics: TA0002
Techniques: T1106
Input: Lazarus Group has used the Windows API ObtainUserAgentString to obtain the User-Agent from a compromised host to connect to a C2 server.

Tactics: TA0002
Techniques: T1106
Input: Methods for performing this technique could include use of a Command and Scripting Interpreter to search for and copy information fitting set criteria such as file type, location, or name at specific time intervals.

Tactics: TA0009
Techniques: T1119
Input: NOKKI can gather information on drives and the operating system on the victim’s machine.

Tactics: TA0007
Techniques: T1082
Input: WarzoneRAT has the capability to grab passwords from numerous web browsers as well as from Outlook and Thunderbird email clients.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Valak has been delivered via spearphishing e-mails with password protected ZIP files.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: UPPERCUT has the capability to collect the current logged on user’s username from a machine.

Tactics: TA0007
Techniques: T1033