madox81/Adema_ATTACK_DS huggingface dataset:
Input: SharpStage has used a legitimate web service for evading detection.

Tactics: TA0011
Techniques: T1102
Input: APT29 has used compromised service principals to make changes to the Office 365 environment.

Tactics: TA0005, TA0008
Techniques: T1550.001, T1550
Input: Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction.

Tactics: TA0043
Techniques: T1595
Input: H1N1 has functionality to copy itself to network shares.

Tactics: TA0008
Techniques: T1080
Input: Conti can use "Windows Restart Manager" to ensure files are unlocked and open for encryption.

Tactics: TA0040
Techniques: T1486
Input: Volgmer can gather information about TCP connection state.

Tactics: TA0007
Techniques: T1049
Input: Threat actors can use online resources and lookup tools to harvest information from these services.

Tactics: TA0043
Techniques: T1596, T1596.005
Input: In total, 29 unique CARROTBAT samples have been identified to date, containing a total of 12 confirmed unique decoy documents

Tactics: TA0005
Techniques: T1140
Input: It can also run with ShellExecute.

Tactics: TA0002
Techniques: T1106
Input: FIN6 has used kill.bat script to disable security tools.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Monitor for the execution of commands and arguments associated with disabling or modification of security software processes or services such as Set-MpPreference-DisableScriptScanning 1 in Windows,sudo spctl --master-disable in macOS, and setenforce 0 in Linux.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: HighShell v5.0 explorer tab allows actor to navigate the file system The HighShell v7.1 variant from the data dump contains similar functionality to its predecessors and continued the tabular approach but expanded even further by splitting out the main functionality across multiple tabs, specifically “Command”, “Explorer”, “Upload”, “Download”, “Sql Server” and “Change Time”

Tactics: TA0011
Techniques: T1105
Input: Monitor processes and command-line arguments for actions that could be taken to change, conceal, and/or delete information in the Registry.

Tactics: TA0005
Techniques: T1112
Input: ProLock can encrypt files on a compromised host with RC6, and encrypts the key with RSA-1024.

Tactics: TA0040
Techniques: T1486
Input: Ursnif has used strings from legitimate system files and existing folders for its file, folder, and Registry entry names.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: VBScript #1 The dropped script “58d2a83f7778d5.36783181.vbs” acts as a launcher

Tactics: TA0002
Techniques: T1059
Input: Monitor the HKLM\SOFTWARE\Microsoft\Netsh registry key for any new or suspicious entries that do not correlate with known system files or benign software.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.007
Input: ShimRatReporter communicated over HTTP with preconfigured C2 servers.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Threat Group-1314 actors used a victim's endpoint management platform, Altiris, for lateral movement.

Tactics: TA0002, TA0008
Techniques: T1072
Input: Melcoz can use VBS scripts to execute malicious DLLs.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Tonto Team abuses a legitimate and signed Microsoft executable to launch a malicious DLL.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Monitor for newly executed processes associated with DCOM activity, especially those invoked by a user different than the one currently logged on.

Tactics: TA0008
Techniques: T1021.003, T1021
Input: Remexi achieves persistence using Userinit by adding the Registry key HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit.

Tactics: TA0003, TA0004
Techniques: T1547.004, T1547
Input: Felismus has masqueraded as legitimate Adobe Content Management System files.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Sandworm Team has distributed NotPetya by compromising the legitimate Ukrainian accounting software M.E.Doc and replacing a legitimate software update with a malicious one.

Tactics: TA0001
Techniques: T1195, T1195.002
Input: The IP address in the lateral movement techniques was substituted with the local machine IP address to achieve code execution on the system

Tactics: TA0007
Techniques: T1016
Input: Revenge RAT uses cmd.exe to execute commands and run scripts on the victim's machine.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: All at jobs are stored in /var/spool/cron/atjobs/.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: Operation Wocao has accessed and collected credentials from password managers.

Tactics: TA0006
Techniques: T1555.005, T1555
Input: Machete renamed task names to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Python tasks.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: APT32 has added JavaScript to victim websites to download additional frameworks that profile and compromise website visitors.

Tactics: TA0011
Techniques: T1105
Input: KONNI has registered itself as a service using its export function.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Common symmetric encryption algorithms include AES, DES, 3DES, Blowfish, and RC4.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Octopus has used HTTP GET and POST requests for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Torisma has encoded C2 communications with Base64.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: APT18 establishes persistence via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: 20 New processes The malicious svchost constantly queries ieframe.dll, as well as IWebBrowser2 Interface using CLSID dc30c1661-cdaf-11D0-8A3E-00c04fc9e26e, both key components to interact with Internet Explorer

Tactics: TA0004, TA0005
Techniques: T1055
Input: Protect domain controllers by ensuring proper security configuration for critical servers to limit access by potentially unnecessary protocols and services, such as SMB file sharing.

Tactics: TA0003
Techniques: T1098
Input: By manipulating stored data, adversaries may attempt to affect a business process, organizational understanding, and decision making.

Tactics: TA0040
Techniques: T1565.001, T1565
Input: LazyScripter has used JavaScript in its attacks.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: QuasarRAT has a command to edit the Registry on the victim’s machine.

Tactics: TA0005
Techniques: T1112
Input: Adversaries may use SID-History Injection to escalate privileges and bypass access controls.

Tactics: TA0004, TA0005
Techniques: T1134.005, T1134
Input: ROKRAT can check for debugging tools.

Tactics: TA0005, TA0007
Techniques: T1622
Input: Metamorfo has a command to launch a keylogger and capture keystrokes on the victim’s machine.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Monitor for newly constructed files that may attempt to hide artifacts associated with their behaviors to evade detection.

Tactics: TA0005
Techniques: T1564
Input: menuPass has used a modified version of pentesting script wmiexec.vbs, which logs into a remote machine using WMI.

Tactics: TA0002
Techniques: T1047
Input: On January 1, 2017, we observed this URL responding to the above HTTP request with the following data:powershell.exe -exec bypass -window hidden -noni -nop -encoded JABjAG8AbQBtAGEAbgBkACAAPQAgACcAVwB3AEIATwBBAEcAVQBBAGQAQQBBAHUAQQBGAE0AQQBaAFEAQgB5AEEASABZAEEAYQBRAEIAagBBAEcAVQBBAFUAQQBCAHYAQQBHAGsAQQBiAGcAQgAwAEEARQAwAEEAWQBRAEIAdQBBAEcARQBBAFoAdwBCAGwAQQBIAEkAQQBYAFEAQQA2AEEARABvAEEAVQB3AEIAbABBAEgASQBBAGQAZwBCAGwAQQBIAEkAQQBRAHcAQgBsAEEASABJAEEAZABBAEIAcABBAEcAWQBBAGEAUQBCAGoAQQBHAEUAQQBkAEEAQgBsAEEARgBZAEEAWQBRAEIAcwBBAEcAawBBAFoAQQBCAGgAQQBIAF..snip..As you can see, the C2 server responds with a PowerShell command that will run on the system

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Gold Dragon can download additional components from the C2 server.

Tactics: TA0011
Techniques: T1105
Input: HAWKBALL has leveraged several Windows API calls to create processes, gather disk information, and detect debugger activity.

Tactics: TA0002
Techniques: T1106
Input: Monitor for commands with arguments (such as opening common command-line editors) used to modify plist files, especially commonly abused files such as those in \~/LaunchAgents, \~/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm, and an application's Info.plist.

Tactics: TA0005
Techniques: T1647
Input: BabyShark has used scheduled tasks to maintain persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Consider focusing efforts on detecting other adversary behavior used to acquire credential materials, such as OS Credential Dumping or Kerberoasting.

Tactics: TA0006
Techniques: T1110, T1110.002
Input: Egregor has used the Windows API to make detection more difficult.

Tactics: TA0002
Techniques: T1106
Input: Fox Kitten has used Amazon Web Services to host C2.

Tactics: TA0011
Techniques: T1102
Input: Several Lazarus Group malware families collect information on the type and version of the victim OS, as well as the victim computer name and CPU information.

Tactics: TA0007
Techniques: T1082
Input: VERMIN saves each collected file with the automatically generated format {0:dd-MM-yyyy}.txt .

Tactics: TA0009
Techniques: T1119
Input: APT40 leverages exploits in their phishing operations, often weaponizing vulnerabilities within days of their disclosure

Tactics: TA0004
Techniques: T1068
Input: Programs with direct access may read and write files directly from the drive by analyzing file system data structures.

Tactics: TA0005
Techniques: T1006
Input: Variations of this method such as reflective DLL injection (writing a self-mapping DLL into a process) and memory module (map DLL when writing into process) overcome the address relocation issue as well as the additional APIs to invoke execution (since these methods load and execute the files in memory by manually preforming the function of LoadLibrary).

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Rocke has compiled malware, delivered to victims as .c files, with the GNU Compiler Collection (GCC).

Tactics: TA0005
Techniques: T1027.004, T1027
Input: Monitor for changes made to firmware for unexpected modifications to settings and/or data that may be used by rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.

Tactics: TA0005
Techniques: T1014
Input: MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Valak can communicate over multiple C2 hosts.

Tactics: TA0011
Techniques: T1008
Input: Tropic Trooper used netview to scan target systems for shared resources.

Tactics: TA0007
Techniques: T1135
Input: Monitor for changes made to files that may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055
Input: This may also include identifying and abusing improper XPC client validation and/or poor sanitization of input parameters to conduct Exploitation for Privilege Escalation.

Tactics: TA0002
Techniques: T1559, T1559.003
Input: APT37 has signed its malware with an invalid digital certificates listed as "Tencent Technology (Shenzhen) Company Limited."

Tactics: TA0005
Techniques: T1036, T1036.001
Input: After the elapsed time, XCSSET executes additional modules.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Botnets have been used in some of the most high-profile DDoS flooding attacks, such as the 2012 series of incidents that targeted major US banks.

Tactics: TA0040
Techniques: T1498, T1498.001
Input: A module in Prikormka collects information from the victim about installed anti-virus software.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Most cloud providers provide various types of storage including persistent, local, and/or ephemeral, with the ephemeral types often reset upon stop/restart of the VM.

Tactics: TA0005
Techniques: T1578, T1578.004
Input: Gelsemium has the ability to perform timestomping of files on targeted systems.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: QUADAGENT uses DNS for C2 communications.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Monitor for newly constructed processes indicative of modifying account settings, such as those that modify authorized_keys or /etc/ssh/sshd_config files.

Tactics: TA0003
Techniques: T1098
Input: They apparently create a Domain Admin account  named SQLSVC and give it the password Br4pbr4p (which also happens to be the password salt preconfigured in the dirtycow exploit script) and then leverage that account to perform a series of commands.

Tactics: TA0003
Techniques: T1136
Input: SHARPSTATS has the ability to upload and download files.

Tactics: TA0011
Techniques: T1105
Input: Get2 has the ability to inject DLLs into processes.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Adversaries may compromise third-party servers that can be used during targeting.

Tactics: TA0042
Techniques: T1584.004, T1584
Input: Specific COM objects also exist to directly perform functions beyond code execution, such as creating a Scheduled Task/Job, fileless download/execution, and other adversary behaviors related to privilege escalation and persistence.

Tactics: TA0002
Techniques: T1559, T1559.001
Input: Event ID 5861 is logged on Windows 10 systems when new EventFilterToConsumerBinding events are created.

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: SeaDuke is capable of uploading and downloading files.

Tactics: TA0011
Techniques: T1105
Input: Axiom has compressed and encrypted data prior to exfiltration.

Tactics: TA0009
Techniques: T1560
Input: Use of multiple stages may obfuscate the command and control channel to make detection more difficult.

Tactics: TA0011
Techniques: T1104
Input: Zebrocy performs persistence with a logon script via adding to the Registry key HKCU\Environment\UserInitMprLogonScript.

Tactics: TA0003, TA0004
Techniques: T1037.001, T1037
Input: Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).

Tactics: TA0011
Techniques: T1095
Input: Mosquito can launch PowerShell Scripts.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Monitor for unusual kernel driver installation activity may erase the contents of storage devices on specific systems or in large numbers in a network to interrupt availability to system and network resources.

Tactics: TA0040
Techniques: T1561.001, T1561
Input: The key can be hardcoded or negotiated with the C2 server in the registration phase.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Diavol has used HTTP GET and POST requests for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Search engine services typical crawl online sites to index context and may provide users with specialized syntax to search for specific keywords or specific types of content ( filetypes).

Tactics: TA0043
Techniques: T1593, T1593.002
Input: Adversaries may use flaws in the permissions of Windows services to replace the binary that is executed upon service start.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.010, T1574
Input: APT28 deployed the open source tool Responder to conduct NetBIOS Name Service poisoning, which captured usernames and hashed passwords that allowed access to legitimate credentials.

Tactics: TA0006, TA0007
Techniques: T1040
Input: FatDuke can be controlled via a custom C2 protocol over HTTP.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Sidewinder has sent e-mails with malicious attachments that lead victims to credential harvesting websites.

Tactics: TA0043
Techniques: T1598.002, T1598
Input: Hildegard has modified /etc/ld.so.preload to intercept shared library import functions.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.006, T1574
Input: Astaroth collects the timestamp from the infected machine.

Tactics: TA0007
Techniques: T1124
Input: Adversaries may modify the configuration settings of a domain to evade defenses and/or escalate privileges in domain environments.

Tactics: TA0004, TA0005
Techniques: T1484
Input: Wizard Spider has acquired credentials from the SAM/SECURITY registry hives.

Tactics: TA0006
Techniques: T1003, T1003.002
Input: If the user clicks on the link, he will be prompted to download a RAR file that contains the stage 1 malware/lure, which he will execute afterwards

Tactics: TA0011
Techniques: T1105
Input: SYSCON has the ability to execute commands through cmd on a compromised host.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Monitor contextual data about a running process, which may include information such as environment variables, image name, user/owner that may perform sudo caching and/or use the suoders file to elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: SUNBURST was digitally signed by SolarWinds from March - May 2020.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: BRONZE BUTLER has collected a list of files from the victim and uploaded it to its C2 server, and then created a new list of specific files to steal.

Tactics: TA0007
Techniques: T1083
Input: Transparent Tribe can hide legitimate directories and replace them with malicious copies of the same name.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: EKANS can use Windows Mangement Instrumentation (WMI) calls to execute operations.

Tactics: TA0002
Techniques: T1047
Input: Dacls can download its payload from a C2 server.

Tactics: TA0011
Techniques: T1105
Input: KeyBoy can determine the public or WAN IP address for the system.

Tactics: TA0007
Techniques: T1016
Input: Grandoreiro can write or modify browser shortcuts to enable launching of malicious browser extensions.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Empire can use Invoke-RunAs to make tokens.

Tactics: TA0004, TA0005
Techniques: T1134.002, T1134
Input: Adversaries can register malicious password filters to harvest credentials from local computers and/or entire domains.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.002, T1556
Input: Application and network credentials are stored in the Windows Credentials locker.

Tactics: TA0006
Techniques: T1555, T1555.004
Input: BoxCaon used the "StackStrings" obfuscation technique to hide malicious functionalities.

Tactics: TA0005
Techniques: T1027
Input: secretsdump.py

Tactics: TA0006
Techniques: T1003.003, T1003, T1003.002
Input: DarkComet can steal data from the clipboard.

Tactics: TA0009
Techniques: T1115
Input: Adversaries may abuse inter-process communication (IPC) mechanisms for local code or command execution.

Tactics: TA0002
Techniques: T1559
Input: Remexi uses BITSAdmin to communicate with the C2 server over HTTP.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: iKitten will look for the current IP address.

Tactics: TA0007
Techniques: T1016
Input: Figure 11: PowerShell script is XOR encoded using a single byte key After deobfuscating the contents of the PowerShell Script, we can divide it into three sections

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Xbash can collect IP addresses and local intranet information from a victim’s machine.

Tactics: TA0007
Techniques: T1016
Input: Suspicious processes or scripts spawned in this manner will have a parent process of ‘systemd’, a parent process ID of 1, and will usually execute as the ‘root’ user.

Tactics: TA0003, TA0004
Techniques: T1543.002, T1543
Input: (Source: SecureWorks)  China Chopper web shell — This web-based executable script communicates with a full-featured user interface to allow threat actors to transfer and create files, open a command terminal, and interact with database servers

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Legitimate software will likely only need to load routine, bundled DLL modules or Windows system DLLs such that deviation from known module loads may be suspicious.

Tactics: TA0002
Techniques: T1129
Input: BRONZE BUTLER's MSGET downloader uses a dead drop resolver to access malicious payloads.

Tactics: TA0011
Techniques: T1102.001, T1102
Input: Remexi includes different modules that it deploys in its working directory, including configuration decryption and parsing, launching victim activity logging in a separate module, and seven threads for various espionage and auxiliary functions

Tactics: TA0005, TA0007, TA0011
Techniques: T1090.003, T1083, T1562.001, T1090, T1562
Input: Make use of this feature where possible in order to prevent and/or detect attempts by adversaries to compromise the system image.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: LightNeuron can be configured to automatically exfiltrate files under a specified directory.

Tactics: TA0010
Techniques: T1020
Input: Adversaries can also use NTLM hashes to access administrator shares on systems with Pass the Hash and certain configuration and patch levels.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Carbon uses the netstat -r and netstat -an commands.

Tactics: TA0007
Techniques: T1049
Input: FIN6 also moved laterally to servers in the environment using RDP and configured them as malware “distribution” servers.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: When a root certificate is installed, the system or application will trust certificates in the root's chain of trust that have been signed by the root certificate.

Tactics: TA0005
Techniques: T1553, T1553.004
Input: This should be done extensively on all resources in order to establish a baseline, followed up on with periodic audits of new or updated resources.

Tactics: TA0006
Techniques: T1606, T1606.001
Input: CSPY Downloader can search loaded modules, PEB structure, file paths, Registry keys, and memory to determine if it is being debugged or running in a virtual environment.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: WastedLocker has a command to take ownership of a file and reset the ACL permissions using the takeown.exe /F filepath command.

Tactics: TA0005
Techniques: T1222, T1222.001
Input: Smoke Loader searches for credentials stored from web browsers.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Much like the original payload, this tool uses if/else statements to skip the legitimate code in the Saransh Email System source to run the malicious functions, which have the same method names as the original tool and follow the same call sequence:  Form1.Speed Form1.diomadnfagaghagh Form1.fjcsERIfjfiojsGHIsdifjksi Form1.gsgjIDJIGJIGJIGJIFDOSpl Form1.FJaioefgkaoeK  This chain of functions eventually loads a resource named ‘GSrdofjksrgj’, which the tool decrypts using the same algorithm and key as in the initial payload:byte[] array4 = new byte[] {     19,     129,     43,     37,     56,     65,     255,     75,     111,     19,     211,     120,     0,     49,     126,     248 };The decrypted payload has a SHA256 hash of 5e805a88294f6d25d55103d19d13e798e01ad70e6b89e9c58db5d468cc63b3d5, which is a variant of the NanoCore remote administration tool

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Monitor for queried domain name system (DNS) registry data that may hijack domains and/or subdomains that can be used during targeting.

Tactics: TA0042
Techniques: T1584.001, T1584
Input: Adversaries may change this file in storage, to be loaded in a future boot, or in memory during runtime.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: Monitor for changes made to detect changes to files in the Web directory for organization login pages that do not match with authorized updates to the Web server's content.

Tactics: TA0006, TA0009
Techniques: T1056.003, T1056
Input: BitPaymer can use net view to discover remote systems.

Tactics: TA0007
Techniques: T1018