madox81/Adema_ATTACK_DS huggingface dataset:
Input: Rollback – Undo changes to original executable, effectively removing malicious code from the file system.

Tactics: TA0004, TA0005
Techniques: T1055.013, T1055
Input: GPP are tools that allow administrators to create domain policies with embedded credentials.

Tactics: TA0006
Techniques: T1552, T1552.006
Input: On Windows 10 and 11, enable Microsoft Vulnerable Driver Blocklist to assist in hardening against third party-developed drivers.

Tactics: TA0003, TA0004
Techniques: T1543
Input: OSInfo queries the registry to look for information about Terminal Services.

Tactics: TA0007
Techniques: T1012
Input: For example, an adversary may use a script or utility that creates new ingress rules in existing security groups to allow any TCP/IP connectivity.

Tactics: TA0005
Techniques: T1562.007, T1562
Input: Molerats has created scheduled tasks to persistently run VBScripts.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Silence has used Nmap to scan the corporate network, build a network topology, and identify vulnerable hosts.

Tactics: TA0007
Techniques: T1018
Input: Monitor for hash dumpers opening the Security Accounts Manager (SAM) on the local file system (%SystemRoot%/system32/config/SAM).

Tactics: TA0006, TA0007
Techniques: T1033, T1003, T1003.002
Input: Torisma can use WTSEnumerateSessionsW to monitor remote desktop connections.

Tactics: TA0007
Techniques: T1049
Input: BendyBear has used a custom RC4 and XOR encrypted protocol over port 443 for C2.

Tactics: TA0011
Techniques: T1571
Input: Aquatic Panda has acquired and used Cobalt Strike in its operations.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: If an executable is written, renamed, and/or moved to match an existing service executable, it could be detected and correlated with other suspicious behavior.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574
Input: Babuk has the ability to enumerate network shares.

Tactics: TA0007
Techniques: T1135
Input: APT29 named tasks \Microsoft\Windows\SoftwareProtectionPlatform\EventCacheManager in order to appear legitimate.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Adversaries may leverage Microsoft Office-based applications for persistence between startups.

Tactics: TA0003
Techniques: T1137
Input: By disabling Windows event logging, adversaries can operate while leaving less evidence of a compromise behind.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: Astaroth encodes data using Base64 before sending it to the C2 server.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Janicab captured screenshots and sent them out to a C2 server.

Tactics: TA0009
Techniques: T1113
Input: Adversaries may abuse authentication packages to execute DLLs when the system boots.

Tactics: TA0003, TA0004
Techniques: T1547.002, T1547
Input: An APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.

Tactics: TA0005
Techniques: T1140
Input: Similarly, website defacement may also be used as setup, or a precursor, for future attacks such as Drive-by Compromise.

Tactics: TA0040
Techniques: T1491.002, T1491
Input: These persistence mechanisms can work within Outlook or be used through Office 365.

Tactics: TA0003
Techniques: T1137
Input: Lazarus Group malware attempts to connect to Windows shares for lateral movement by using a generated list of usernames, which center around permutations of the username Administrator, and weak passwords.

Tactics: TA0006
Techniques: T1110, T1110.003
Input: Windows system WMI data is stored in the WMI common information model (CIM) repository, which consists of several files in the System32\wbem\Repository directory

Tactics: TA0002
Techniques: T1047
Input: Monitor domain controller logs for replication requests and other unscheduled activity possibly associated with DCSync.

Tactics: TA0006, TA0007
Techniques: T1003.006, T1033, T1003
Input: TAINTEDSCRIBE can use DirectoryList to enumerate files in a specified directory.

Tactics: TA0007
Techniques: T1083
Input: DarkVishnya performed port scanning to obtain the list of active services.

Tactics: TA0007
Techniques: T1046
Input: Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times or outside of business hours.

Tactics: TA0001, TA0003, TA0004, TA0005, TA0008
Techniques: T1078, T1078.003, T1078.002, T1550
Input: BLUELIGHT can collect the username on a compromised host.

Tactics: TA0007
Techniques: T1033
Input: TeamTNT uses a payload that removes itself after running.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Monitor executed commands and arguments that may modify XDG autostart entries to execute programs or commands during system boot.

Tactics: TA0003, TA0004
Techniques: T1547.013, T1547
Input: CosmicDuke attempts to exploit privilege escalation vulnerabilities CVE-2010-0232 or CVE-2010-4398.

Tactics: TA0004
Techniques: T1068
Input: Kimsuky has collected valid email addresses that were subsequently used in spearphishing campaigns.

Tactics: TA0043
Techniques: T1589.002, T1589
Input: BackConfig can download and run batch files to execute commands on a compromised host.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Adversaries may choose to use custom archival methods, such as encryption with XOR or stream ciphers implemented with no external library or utility references.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: APT16 has compromised otherwise legitimate sites as staging servers for second-stage payloads.

Tactics: TA0042
Techniques: T1584.004, T1584
Input: Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application.

Tactics: TA0003
Techniques: T1505
Input: Monitor calls to the ZwSetEaFile and ZwQueryEaFile Windows API functions as well as binaries used to interact with EA,   and consider regularly scanning for the presence of modified information.

Tactics: TA0005
Techniques: T1564, T1564.004
Input: Victim system reconnaissance The code then tries to obtain the victim’s public IP via “https://api.ipify.org/”

Tactics: TA0007
Techniques: T1016
Input: If the C2 server is not active at this time, the download will fail and the victim will not receive a prompt to Enable Content as no macro is downloaded

Tactics: TA0011
Techniques: T1105
Input: Mosquito's installer searches the Registry and system to see if specific antivirus tools are installed on the system.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Ryuk has called GetLogicalDrives to emumerate all mounted drives, and GetDriveTypeW to determine the drive type.

Tactics: TA0007
Techniques: T1082
Input: FALLCHILL can modify file or directory timestamps.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: If a change to a service-related entry occurs, then it will likely be followed by a local or remote service start or restart to execute the file.

Tactics: TA0005
Techniques: T1112
Input: Linfo creates a backdoor through which remote attackers can delete files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: InvisiMole can enumerate windows and child windows on a compromised host.

Tactics: TA0007
Techniques: T1010
Input: Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.

Tactics: TA0003
Techniques: T1136, T1136.001, T1136.002
Input: Grandoreiro can delete .LNK files created in the Startup folder.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Suspicious entries can also be identified by comparing entries to a trusted system baseline.

Tactics: TA0003, TA0004
Techniques: T1547.013, T1547
Input: If the victim is using PowerShell 3.0 or later, POWERSOURCE writes its decoded payload to an alternate data stream (ADS) named kernel32.dll that is saved in %PROGRAMDATA%\Windows\.

Tactics: TA0005
Techniques: T1564, T1564.004
Input: PolyglotDuke can use LoadLibraryW and CreateProcess to load and execute code.

Tactics: TA0002
Techniques: T1106
Input: FELIXROOT queries the Registry for specific keys for potential privilege escalation and proxy information.

Tactics: TA0007
Techniques: T1012
Input: Data may also be stored in Data URLs, which enable embedding media type or MIME files inline of HTML documents.

Tactics: TA0005
Techniques: T1027.006, T1027
Input: Agent Tesla can add itself to the Registry as a startup program to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: The macro then extracts the CAB file into %systemroo%\system32, using either wusa.exe or expand.exe (depending on the OS) to again bypass UAC prompts Once the files have been extracted, the Visual Basic macro deletes the CAB file and runs the malicious NTWDBLIB.dll via cliconfg.exe (to gain privileges and bypass UAC protections) Command lines used by the Visual Basic macro:  cmd /c wusa %TEMP%\setup.cab /quiet /extract:%SystemRoot%\System32 && del /f /q %TEMP%\setup.cab && cliconfg.exe cmd /c expand %TEMP%\setup.cab -F:* %SystemRoot%\System32 && del /f /q %TEMP%\setup.cab && cliconfg.exe A combination of NTWDBLIB.dll and cliconfg.exe are used to bypass UAC protections; this is a familiar attack on Windows

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: China Chopper's client component is packed with UPX.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Both executable and CPL formats are compliant Portable Executable (PE) images and can be examined using traditional tools and methods, pending anti-reverse-engineering techniques.

Tactics: TA0005
Techniques: T1218, T1218.002
Input: Flagpro has been used to execute netstat -ano on a compromised host.

Tactics: TA0007
Techniques: T1049
Input: In the case of network infrastructure, particularly routers, it is possible for an adversary to leverage multiple compromised devices to create a multi-hop proxy chain within the Wide-Area Network (WAN) of the enterprise.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: Lazarus Group has also used various, often lesser known, functions to perform various types of Discovery and Process Injection.

Tactics: TA0002
Techniques: T1106
Input: Perhaps they plan to pair this stealer with another dropper that maintains the WMI anti-AV functionality

Tactics: TA0002
Techniques: T1047
Input: Silence has used Windows command-line to run commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Lazarus Group malware SierraAlfa sends data to one of the hard-coded C2 servers chosen at random, and if the transmission fails, chooses a new C2 server to attempt the transmission again.

Tactics: TA0011
Techniques: T1008
Input: Lazarus Group has used tools to detect sandbox or VMware services through identifying the presence of a debugger or related services.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Pony has delayed execution using a built-in function to avoid detection and analysis.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Therefore, NTLM LogonType 3 authentications that are not associated to a domain login and are not anonymous logins are suspicious.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: APT29 used account credentials they obtained to attempt access to Group Managed Service Account (gMSA) passwords.

Tactics: TA0006
Techniques: T1555
Input: Large botnets can generate a significant amount of traffic from systems spread across the global internet.

Tactics: TA0040
Techniques: T1499
Input: Conficker terminates various services related to system security and Windows.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Seth-Locker has the ability to download and execute files on a compromised host.

Tactics: TA0011
Techniques: T1105
Input: Avenger has the ability to browse files in directories such as Program Files and the Desktop.

Tactics: TA0007
Techniques: T1083
Input: Examine data in user’s SID-History attributes

Tactics: TA0004, TA0005
Techniques: T1134.005, T1134
Input: Monitor for newly constructed scheduled jobs.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002, T1053.003
Input: They have also exploited CVE-2020-0688 against the Microsoft Exchange Control Panel to regain access to a network.

Tactics: TA0001
Techniques: T1190
Input: Security monitoring and control mechanisms may be in place for system utilities adversaries are capable of abusing.

Tactics: TA0005
Techniques: T1036.003, T1036
Input: Data SPACESHIP copies to the staging area is compressed with zlib.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: Once the .msc file is saved, adversaries may invoke the malicious CLSID payload with the following command: mmc.exe -Embedding C:\path\to\test.msc.

Tactics: TA0005
Techniques: T1218, T1218.014
Input: The presence of msxsl.exe or other utilities that enable proxy execution that are typically used for development, debugging, and reverse engineering on a system that is not used for these purposes may be suspicious.

Tactics: TA0005
Techniques: T1220
Input: Leverage AD directory synchronization (DirSync) to monitor changes to directory state using AD replication cookies.

Tactics: TA0005
Techniques: T1207
Input: ROKRAT has used legitimate social networking sites and cloud platforms (including but not limited to Twitter, Yandex, Dropbox, and Mediafire) for C2 communications.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: Adversaries may leverage the COR_PROFILER environment variable to hijack the execution flow of programs that load the .NET CLR.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.012, T1574
Input: KillDisk loads and executes functions from a DLL.

Tactics: TA0002
Techniques: T1129
Input: Lokibot's second stage DLL has set a timer using "timeSetEvent" to schedule its next execution.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053
Input: APT41 used  svchost.exe and Net to execute a system service installed to launch a Cobalt Strike BEACON loader.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Lurid performs XOR encryption.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: The attacker leveraged multiple exploits, targeting both CVE-2014-6332 and CVE-2014-4113

Tactics: TA0004
Techniques: T1068
Input: Valak can execute JavaScript containing configuration data for establishing persistence.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Lokibot has modified the Registry as part of its UAC bypass process.

Tactics: TA0005
Techniques: T1112
Input: Examples include X-MS-Exchange-Organization-AutoForwarded set to true, X-MailFwdBy and X-Forwarded-To.

Tactics: TA0009
Techniques: T1114, T1114.003
Input: Lizar can download additional plugins, files, and tools.

Tactics: TA0011
Techniques: T1105
Input: TeamTNT has used masscan to search for open Docker API ports.

Tactics: TA0007
Techniques: T1046
Input: Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM).

Tactics: TA0003, TA0005
Techniques: T1197
Input: down_new has the ability to identify the MAC address of a compromised host.

Tactics: TA0007
Techniques: T1016
Input: Agent Tesla has created hidden folders.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Once patched, an adversary can use the injected password to successfully authenticate as any domain user account (until the the skeleton key is erased from memory by a reboot of the domain controller).

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.001
Input: Cobalt Strike can explore files on a compromised system.

Tactics: TA0007
Techniques: T1083
Input: Adversaries may also use information from previous reconnaissance efforts (ex: Search Open Websites/Domains or Search Victim-Owned Websites) to craft persuasive and believable lures.

Tactics: TA0043
Techniques: T1598.002, T1598, T1598.003
Input: MarkiRAT can download additional files and tools from its C2 server, including through the use of BITSAdmin.

Tactics: TA0011
Techniques: T1105
Input: Frequently check permissions on cloud storage to ensure proper permissions are set to deny open or unprivileged access to resources.

Tactics: TA0009
Techniques: T1530
Input: Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including the startup folders.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Python can be executed interactively from the command-line (via the python.exe interpreter) or via scripts (.py) that can be written and distributed to different systems.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: The purchase of digital certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity.

Tactics: TA0042
Techniques: T1588.004, T1588
Input: DustySky can detect connected USB devices.

Tactics: TA0007
Techniques: T1120
Input: Machete logs keystrokes from the victim’s machine.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Windows systems use a common method to look for required DLLs to load into a program.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Many network devices such as routers, switches, and firewalls, perform encryption on network traffic to secure transmission across networks.

Tactics: TA0005
Techniques: T1600, T1600.002
Input: HotCroissant has the ability to retrieve a list of services on the infected host.

Tactics: TA0007
Techniques: T1007
Input: Adversaries may gather user credentials from Keychain storage/memory.

Tactics: TA0006
Techniques: T1555.001, T1555
Input: Bonadan can XOR-encrypt C2 communications.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Backdoor.Oldrea can download additional modules from C2.

Tactics: TA0011
Techniques: T1105
Input: Launch Agent or Launch Daemon with executable paths pointing to /tmp and /Shared folders locations are potentially suspicious.

Tactics: TA0002
Techniques: T1569.001, T1569
Input: The MirageFox binaries export a function called dll_wWinMain, the name of an export in vsodscpl.dll, a module by McAfee that is loaded by a few of their executables that import and call this function

Tactics: TA0005
Techniques: T1140
Input: Tropic Trooper has used multiple Windows APIs including HttpInitialize, HttpCreateHttpHandle, and HttpAddUrl.

Tactics: TA0002
Techniques: T1106
Input: HALFBAKED can obtain screenshots from the victim.

Tactics: TA0009
Techniques: T1113
Input: BBSRAT can list running processes.

Tactics: TA0007
Techniques: T1057
Input: RTM can obtain the victim time zone.

Tactics: TA0007
Techniques: T1124
Input: Also, FoggyWeb's loader can mimic a genuine dll file that carries out the same import functions as the legitimate Windows version.dll file.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: A module in Prikormka gathers logins and passwords stored in applications on the victims, including Google Chrome, Mozilla Firefox, and several other browsers.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Ke3chang performs operating system information discovery using systeminfo and has used implants to identify the system language and computer name.

Tactics: TA0007
Techniques: T1082
Input: TajMahal has the ability to steal web session cookies from Internet Explorer, Netscape Navigator, FireFox and RealNetworks applications.

Tactics: TA0006
Techniques: T1539
Input: Lucifer can use the Stratum protocol on port 10001 for communication between the cryptojacking bot and the mining server.

Tactics: TA0011
Techniques: T1071
Input: Threat actors can use online resources and lookup tools to harvest information about content servers within a CDN.

Tactics: TA0043
Techniques: T1596, T1596.004
Input: Emotet has been observed enumerating local processes.

Tactics: TA0007
Techniques: T1057
Input: Since mavinject.exe may be digitally signed by Microsoft, proxying execution via this method may evade detection by security products because the execution is masked under a legitimate process.

Tactics: TA0005
Techniques: T1218, T1218.013
Input: Derusbi is capable of creating a remote Bash shell and executing commands.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: Adversaries may craft malicious stored procedures that can provide a persistence mechanism in SQL database servers.

Tactics: TA0003
Techniques: T1505.001, T1505
Input: BLINDINGCAN has lured victims into executing malicious macros embedded within Microsoft Office documents.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Monitor for anomalous file transfer activity between accounts and to untrusted VPCs.

Tactics: TA0010
Techniques: T1537
Input: Adversaries may hijack SIP and trust provider components to mislead operating system and application control tools to classify malicious (or any) code as signed by:

Tactics: TA0005
Techniques: T1553, T1553.003
Input: DarkVishnya used PowerShell to create shellcode loaders.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

Tactics: TA0011
Techniques: T1071.002, T1071.004, T1071, T1071.003, T1071.001
Input: Pillowmint has stored its malicious payload in the registry key HKLM\SOFTWARE\Microsoft\DRM.

Tactics: TA0005
Techniques: T1112
Input: Remexi obfuscates its configuration data with XOR.

Tactics: TA0005
Techniques: T1027
Input: AppleJeus has waited a specified time before downloading a second stage payload.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: TEMP.Veles has created staging folders in directories that were infrequently used by legitimate users or processes.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Following exploitation with LOWBALL malware, admin@338 actors created a file containing a list of commands to be executed on the compromised computer.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: QakBot can use process hollowing to execute its main payload.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: An example of this is use of Rundll32 to load a specifically crafted DLL which loads an auto-elevated Component Object Model object and performs a file operation in a protected directory which would typically require elevated access.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: APT28 has split archived exfiltration files into chunks smaller than 1MB.

Tactics: TA0010
Techniques: T1030
Input: Especially flag events where the subject and target accounts differ or that include additional flags such as changing a password without knowledge of the old password.

Tactics: TA0003
Techniques: T1098
Input: Kimsuky  has used HTTP GET and POST requests for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Chimera specifically has used the NtdsAudit tool to dump the password hashes of domain users via cmsadcs.exe "NTDS.dit" -s "SYSTEM" -p RecordedTV_pdmp.txt --users-csv RecordedTV_users.csv and used ntdsutil to copy the Active Directory database.

Tactics: TA0006
Techniques: T1003.003, T1003
Input: Doki has searched for the current process’s PID.

Tactics: TA0007
Techniques: T1057
Input: TAINTEDSCRIBE has used FileReadZipSend to compress a file and send to C2.

Tactics: TA0009
Techniques: T1560
Input: Backdoor.Oldrea contains a cleanup module that removes traces of itself from the victim.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Linux Rabbit acquires valid SSH accounts through brute force.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: LazyScripter has achieved persistence via writing a PowerShell script to the autorun registry key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Agent Tesla has the capability to kill any running analysis processes and AV software.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: QakBot has spread through emails with malicious links.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: BLINDINGCAN has sent user and system information to a C2 server via HTTP POST requests.

Tactics: TA0010
Techniques: T1041
Input: Higaisa’s shellcode attempted to find the process ID of the current process.

Tactics: TA0007
Techniques: T1057