madox81/Adema_ATTACK_DS huggingface dataset:
Input: The group has also used quser.exe to identify existing RDP sessions on a victim.

Tactics: TA0007
Techniques: T1049
Input: Epic has overwritten the function pointer in the extra window memory of Explorer's Shell_TrayWnd in order to execute malicious code in the context of the explorer.exe process.

Tactics: TA0004, TA0005
Techniques: T1055.011, T1055
Input: Micropsia collects the username from the victim’s machine.

Tactics: TA0007
Techniques: T1033
Input: Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.

Tactics: TA0003, TA0004, TA0005
Techniques: T1014, T1574.006, T1574
Input: Monitor for API calls that may execute malicious payloads via loading shared modules.

Tactics: TA0002
Techniques: T1129
Input: Several Microsoft signed binaries that are default on Windows installations can be used to proxy execution of other files or commands.

Tactics: TA0005
Techniques: T1218
Input: XCSSET saves a screen capture of the victim's system with a numbered filename and .jpg extension.

Tactics: TA0009
Techniques: T1113
Input: PoetRAT used Nmap for remote system discovery.

Tactics: TA0007
Techniques: T1018
Input: PUNCHBUGGY can establish using a AppCertDLLs Registry key.

Tactics: TA0003, TA0004
Techniques: T1546.009, T1546
Input: BOOTRASH has used unallocated disk space between partitions for a hidden file system that stores components of the Nemesis bootkit.

Tactics: TA0005
Techniques: T1564, T1564.005
Input: Threat Group-3390 has used DLL side-loading, including by using legitimate Kaspersky antivirus variants in which the DLL acts as a stub loader that loads and executes the shell code.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: The creation and modification of systemd service unit files is generally reserved for administrators such as the Linux root user and other users with superuser privileges.

Tactics: TA0003, TA0004
Techniques: T1543.002, T1543
Input: Adversaries may attempt to hide process command-line arguments by overwriting process memory.

Tactics: TA0005
Techniques: T1564.010, T1564
Input: The HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell subkeys can automatically launch programs.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Ixeshe can collect data from a local system.

Tactics: TA0009
Techniques: T1005
Input: This can be used to prevent exposure of capabilities in environments that are not intended to be compromised or operated within.

Tactics: TA0005
Techniques: T1480, T1480.001
Input: Chaes requires the user to click on the malicious Word document to execute the next part of the attack.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Phishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information.

Tactics: TA0043
Techniques: T1598
Input: Chimera has dumped password hashes for use in pass the hash authentication attacks.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: Adversaries may install a new Launch Agent that executes at login by placing a .plist file into the appropriate folders with the RunAtLoad or KeepAlive keys set to true.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: Monitor for changes to system processes that do not correlate with known software, patch cycles, , including by comparing results against a trusted system baseline.

Tactics: TA0003, TA0004
Techniques: T1543
Input: WastedLocker can perform a UAC bypass if it is not executed with administrator rights or if the infected host runs Windows Vista or later.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: spwebmember is used to enumerate and dump information from Microsoft SharePoint.

Tactics: TA0009
Techniques: T1213, T1213.002
Input: Different methods of blocking may cause different disruptions in reporting.

Tactics: TA0005
Techniques: T1562.006, T1562
Input: Specific checks will vary based on the target and/or adversary, but may involve Native API function calls such as IsDebuggerPresent() and  NtQueryInformationProcess(), or manually checking the BeingDebugged flag of the Process Environment Block (PEB).

Tactics: TA0005, TA0007
Techniques: T1622
Input: APT3 has lured victims into clicking malicious links delivered through spearphishing.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: First, the sample is UPX packed

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Because each OS has a maximum number of concurrent TCP connections that it will allow, this can quickly exhaust the ability of the system to receive new requests for TCP connections, thus preventing access to any TCP service provided by the server.

Tactics: TA0040
Techniques: T1499, T1499.001
Input: Debuggers are typically used by defenders to trace and/or analyze the execution of potential malware payloads.

Tactics: TA0005, TA0007
Techniques: T1622
Input: Gallmaker has used WinZip, likely to archive data prior to exfiltration.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Scripts are likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used.

Tactics: TA0002
Techniques: T1059.006, T1059.002, T1059
Input: Bazar can inject code through calling VirtualAllocExNuma.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Ensure all Launch Agents with the RunAtLoad key set to true are in alignment with policy.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: Proxysvc collects the network adapter information and domain/username information based on current remote sessions.

Tactics: TA0007
Techniques: T1016
Input: WarzoneRAT can use XOR 0x45 to decrypt obfuscated code.

Tactics: TA0005
Techniques: T1140
Input: HermeticWiper can also overwrite symbolic links and big files in My Documents and on the Desktop with random bytes.

Tactics: TA0040
Techniques: T1485
Input: PoisonIvy starts a rootkit from a malicious file dropped to disk.

Tactics: TA0005
Techniques: T1014
Input: One of the documents we examined with the filename Rocket attacks on Israel.docx (SHA256: 34bdb5b364..) contained inconsistent creation and last modified timestamps, with the last modified timestamp occurring before the creation timestamp

Tactics: TA0005
Techniques: T1070, T1070.006
Input: (Source: SecureWorks)  NetWire logs keystrokes and peripheral inputs into encoded files in the C:\Users\<username>   Figure 3

Tactics: TA0006, TA0007, TA0009
Techniques: T1033, T1056
Input: In GCP, gcloud iam service-accounts list and gcloud projects get-iam-policy may be used to obtain a listing of service accounts and users in a project.

Tactics: TA0007
Techniques: T1087, T1087.004
Input: Sliver can encrypt strings at compile time.

Tactics: TA0005
Techniques: T1027
Input: Audit the Remote Desktop Users group membership regularly.

Tactics: TA0008
Techniques: T1563.002, T1021.001, T1021, T1563
Input: Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.

Tactics: TA0001
Techniques: T1195, T1195.002
Input: Fox Kitten has used RDP to log in and move laterally in the target environment.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Operation Wocao has edited variable names within the Impacket suite to avoid automated detection.

Tactics: TA0005
Techniques: T1027, T1027.005
Input: Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547.001, T1547
Input: P.A.S. Webshell has the ability to modify file permissions.

Tactics: TA0005
Techniques: T1222.002, T1222
Input: Windshift has used WMI to collect information about target machines.

Tactics: TA0002
Techniques: T1047
Input: BONDUPDATER uses a DGA to communicate with command and control servers.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: Execution granted through EWM injection may allow access to both the target process's memory and possibly elevated privileges.

Tactics: TA0004, TA0005
Techniques: T1055.011, T1055
Input: AdFind can extract subnet information from Active Directory.

Tactics: TA0007
Techniques: T1016
Input: This may be achieved by running verclsid.exe /S /C {CLSID}, where the file is referenced by a Class ID (CLSID), a unique identification number used to identify COM objects.

Tactics: TA0005
Techniques: T1218, T1218.012
Input: The data dump included the 0000000000.bat file, which when executed on an infected system would run the following commands to gather information to be sent back to the C2 server:  whoami hostname ipconfig /all net user /domain net group /domain net group “domain admins” /domain net group “Exchange Trusted Subsystem” /domain net accounts /domain net user net localgroup administrators netstat -an tasklist systeminfo reg query “HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default” schtasks /query /FO List /TN “GoogleUpdatesTaskMachineUI” /V | findstr /b /n /c:”Repeat: Every:” WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List  This batch script is also interesting as it uses echo commands to include headers before each of the command results

Tactics: TA0007
Techniques: T1087, T1069
Input: KEYMARBLE has the capability to collect the computer name, language settings, the OS version, CPU information, disk devices, and time elapsed since system start.

Tactics: TA0007
Techniques: T1082
Input: These stolen access tokens allow the adversary to perform various actions on behalf of the user via API calls.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Container orchestration jobs run these automated tasks at a specific date and time, similar to cron jobs on a Linux system.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.007, T1053
Input: Some variants encrypt the collected data with AES and encode it with base64 before transmitting it to the C2 server.

Tactics: TA0009
Techniques: T1560
Input: For each account found without preauthentication, an adversary may send an AS-REQ message without the encrypted timestamp and receive an AS-REP message with TGT data which may be encrypted with an insecure algorithm such as RC4.

Tactics: TA0006
Techniques: T1558, T1558.004
Input: Creddump7 can then be used to process the SAM database locally to retrieve hashes.

Tactics: TA0006
Techniques: T1003, T1003.002
Input: MarkiRAT can capture clipboard content.

Tactics: TA0009
Techniques: T1115
Input: 1/12/14 3/5/14 127.0.0.1 N/A   3/5/14 3/31/14 103.24.0.142 Hong Kong   3/31/14 10/27/14 103.24.1.54 Hong Kong   10/27/14 11/9/14 127.0.0.1 N/A   11/9/14 5/25/15 127.0.0.3 N/A   5/25/15 Current as of this publication 127.0.0.1 N/A    Table 5

Tactics: TA0011
Techniques: T1571
Input: In some cases politically oriented image files have been used to overwrite data.

Tactics: TA0040
Techniques: T1485
Input: To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Adversaries may also analyze data from local host files (ex: C:\Windows\System32\Drivers\etc\hosts or /etc/hosts) or other passive means (such as local Arp cache entries) in order to discover the presence of remote systems in an environment.

Tactics: TA0007
Techniques: T1018
Input: Sykipot may gather a list of running processes by running tasklist /v.

Tactics: TA0007
Techniques: T1057
Input: MuddyWater has used malware that can execute PowerShell scripts via DDE.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: Zeus Panda can perform keylogging on the victim’s machine by hooking the functions TranslateMessage and WM_KEYDOWN.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Develop a robust cyber threat intelligence capability to determine what types and levels of threat may use software exploits and 0-days against a particular organization.

Tactics: TA0004, TA0005, TA0008
Techniques: T1210, T1211, T1068
Input: APT29 has used steganography to hide C2 communications in images.

Tactics: TA0011
Techniques: T1001, T1001.002
Input: Chimera has harvested data from remote mailboxes including through execution of \\c$\Users\\AppData\Local\Microsoft\Outlook*.ost.

Tactics: TA0009
Techniques: T1114, T1114.002
Input: Adversaries may deploy containers based on retrieved or built malicious images or from benign images that download and execute malicious payloads at runtime.

Tactics: TA0002, TA0005
Techniques: T1610
Input: Use process monitoring to monitor the execution and command line parameters of binaries involved in inhibiting system recovery, such as vssadmin, wbadmin, and bcdedit.

Tactics: TA0040
Techniques: T1490
Input: A version of PlugX loads as shellcode within a .NET Framework project using msbuild.exe, presumably to bypass application control techniques.

Tactics: TA0005
Techniques: T1127.001, T1127
Input: Empire can enumerate Security Support Providers (SSPs) as well as utilize PowerSploit's Install-SSP and Invoke-Mimikatz to install malicious SSPs and log authentication events.

Tactics: TA0003, TA0004
Techniques: T1547.005, T1547
Input: Depending on the flaw being exploited this may include Exploitation for Defense Evasion.

Tactics: TA0001
Techniques: T1190
Input: Imminent Monitor has a dynamic debugging feature to check whether it is located in the %TEMP% directory, otherwise it copies itself there.

Tactics: TA0007
Techniques: T1083
Input: FIN7 has used SSH to move laterally through victim environments.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: APT28 has also used a machine to relay and obscure communications between CHOPSTICK and their server.

Tactics: TA0011
Techniques: T1090, T1090.002
Input: In some cases, malware repositories can also be used to identify features of tool use associated with an adversary, such as watermarks in Cobalt Strike payloads.Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Specifically, we discovered code in the PowerShell script that was a match for code in Magic Unicorn containing the comment “one line shellcode injection with native x86 shellcode”

Tactics: TA0002
Techniques: T1059
Input: All of the backdoors identified - excluding RoyalDNS - required APT15 to create batch scripts in order to install its persistence mechanism

Tactics: TA0002, TA0003, TA0004
Techniques: T1547.001, T1547, T1059
Input: TURNEDUP is capable of writing to a Registry Run key to establish.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Gold Dragon uses cmd.exe to execute commands for discovery.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Cobalt Strike's Beacon payload is capable of running shell commands without cmd.exe and PowerShell commands without powershell.exe

Tactics: TA0002
Techniques: T1106
Input: Industroyer attempts to perform an HTTP CONNECT via an internal proxy to establish a tunnel.

Tactics: TA0011
Techniques: T1572
Input: CosmicDuke collects user credentials, including passwords, for various programs including Web browsers.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.

Tactics: TA0001, TA0003, TA0004, TA0005, TA0007
Techniques: T1078.004, T1087, T1087.004, T1078
Input: Rifdoor has been executed from malicious Excel or Word documents containing macros.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Bisonal can retrieve a file listing from the system.

Tactics: TA0007
Techniques: T1083
Input: Establish centralized logging for the activity of cloud compute infrastructure components.

Tactics: TA0005
Techniques: T1578
Input: This syntax (ex: file.ext:ads[.ext]) is commonly associated with ADSs.

Tactics: TA0005
Techniques: T1564, T1564.004
Input: PoshC2 contains modules that allow for use of proxies in command and control.

Tactics: TA0011
Techniques: T1090
Input: Suspicious systemd timers can also be identified by comparing results against a trusted system baseline.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.006, T1053
Input: ShadowPad has encrypted a virtual file system and various files.

Tactics: TA0005
Techniques: T1027
Input: Regsvr32.exe can also be used to specifically bypass application control using functionality to load COM scriptlets to execute DLLs under user permissions.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: The first 11 bytes of the received buffer are encrypted with the XOR algorithm

Tactics: TA0005
Techniques: T1027
Input: MoleNet can perform WMI commands on the system.

Tactics: TA0002
Techniques: T1047
Input: PlugX has a module for enumerating TCP and UDP network connections and associated processes using the netstat command.

Tactics: TA0007
Techniques: T1049
Input: Exploitation for credential access may also result in Privilege Escalation depending on the process targeted or credentials obtained.

Tactics: TA0006
Techniques: T1212
Input: Portions of these tickets may be encrypted with the RC4 algorithm, meaning the Kerberos 5 TGS-REP etype 23 hash of the service account associated with the SPN is used as the private key and is thus vulnerable to offline Brute Force attacks that may expose plaintext credentials.

Tactics: TA0006
Techniques: T1558.003, T1558
Input: FrameworkPOS can enumerate and exclude selected processes on a compromised host to speed execution of memory scraping.

Tactics: TA0007
Techniques: T1057
Input: Indrik Spider has encrypted domain-controlled systems using BitPaymer.

Tactics: TA0040
Techniques: T1486
Input: Adversaries may also leverage a Network Device CLI on network devices to gather file and directory information.

Tactics: TA0007
Techniques: T1083
Input: In this particular case in 2013, the config file included an unknown plugin set, aside from the usual ‘ddos’ plugin listing

Tactics: TA0007
Techniques: T1083
Input: Mimikatz performs credential dumping to obtain account and password information useful in gaining access to additional systems and enterprise network resources.

Tactics: TA0006
Techniques: T1003.006, T1003, T1003.002, T1003.004, T1555.003, T1555, T1003.001
Input: Because of the varying executable file types and corresponding signature formats, Microsoft created software components called Subject Interface Packages (SIPs)  to provide a layer of abstraction between API functions and files.

Tactics: TA0005
Techniques: T1553, T1553.003
Input: Limit privileges of user accounts and groups so that only authorized administrators can interact with system-level process changes and service configurations.

Tactics: TA0003, TA0004
Techniques: T1543
Input: MoleNet can collect information about the about the system.

Tactics: TA0007
Techniques: T1082
Input: HISTCONTROL does not exist by default on macOS, but can be set by the user and will be respected.

Tactics: TA0005
Techniques: T1562.003, T1562
Input: WhisperGate overwrites the MBR with a bootloader component that performs destructive wiping operations on hard drives and displays a fake ransom note when the host boots.

Tactics: TA0003, TA0005
Techniques: T1542.003, T1542
Input: Adversaries may use these scripts to maintain persistence on a single system.

Tactics: TA0003, TA0004
Techniques: T1037.001, T1037
Input: gh0st RAT can inject malicious code into process created by the "Command_Create&Inject" function.

Tactics: TA0004, TA0005
Techniques: T1055
Input: HALFBAKED can delete a specified file.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: A string with the 5-character length and encoded with BASE64 is added to the beginning of the buffer encoded using the BASE64 algorithm

Tactics: TA0005, TA0011
Techniques: T1132, T1027
Input: Further, PowerShell provides cmdlets that can be used to retrieve or modify file and directory DACLs.

Tactics: TA0005
Techniques: T1222, T1222.001
Input: MarkiRAT can capture all keystrokes on a compromised host.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Kwampirs collects a list of files and directories in C:\ with the command dir /s /a c:\ >> "C:\windows\TEMP[RANDOM].tmp".

Tactics: TA0007
Techniques: T1083
Input: When we analyzed the email headers, we determined that the email was sent from an SMTP server using an IP associated with the Yonsei University network

Tactics: TA0007
Techniques: T1016
Input: Information about hardware infrastructure may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: card/biometric readers, dedicated encryption hardware, ).

Tactics: TA0043
Techniques: T1592, T1592.001
Input: Adversaries may acquire credentials from web browsers by reading files specific to the target browser.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Sidewinder has used tools to automatically collect system and network configuration information.

Tactics: TA0009
Techniques: T1119
Input: VERMIN encrypts the collected files using 3-DES.

Tactics: TA0009
Techniques: T1560
Input: Command arguments used before and after the invocation of msiexec.exe may also be useful in determining the origin and purpose of the MSI files or DLLs being executed.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: Information about processes can also be extracted from the output of Native API calls such as CreateToolhelp32Snapshot.

Tactics: TA0007
Techniques: T1057
Input: Smoke Loader spawns a new copy of c:\windows\syswow64\explorer.exe and then replaces the executable code in memory with malware.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: NOKKI can collect the username from the victim’s machine.

Tactics: TA0007
Techniques: T1033
Input: KONNI has used AES to encrypt C2 traffic.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Wingbird drops a malicious file (sspisrv.dll) alongside a copy of lsass.exe, which is used to register a service that loads sspisrv.dll as a driver.

Tactics: TA0003, TA0004
Techniques: T1547.008, T1547
Input: Msiexec.exe execution may also be elevated to SYSTEM privileges if the AlwaysInstallElevated policy is enabled.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: Chimera has used net share and net view to identify network shares of interest.

Tactics: TA0007
Techniques: T1135
Input: Strong passwords should be used on certain encrypted documents that use them to prevent offline cracking through Brute Force techniques.

Tactics: TA0009
Techniques: T1119
Input: Service binary paths may even be changed to execute commands or scripts.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: MCMD has the ability to upload files from an infected device.

Tactics: TA0009
Techniques: T1005
Input: Monitor executed commands and arguments that may modify plist files to automatically run an application when a user logs in.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.007
Input: Vasport copies itself to disk and creates an associated run key Registry entry to establish.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: If that HTTPS request is not successful, the downloader will issue an HTTP request

Tactics: TA0011
Techniques: T1071
Input: Toolkits like the PowerSploit framework contain PowerUp modules that can be used to explore systems for hijacking weaknesses.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574
Input: Ngrok can provide DGA for C2 servers through the use of random URL strings that change every 12 hours.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: (Source: SecureWorks) In multiple instances, CTU researchers observed artifacts from unsuccessful attempts to create a web shell on web-accessible JBOSS-based service desk software, followed by use of a functional shell to gain access to the environment

Tactics: TA0003
Techniques: T1505.003, T1505