madox81/Adema_ATTACK_DS huggingface dataset:
Input: Whitefly has used a simple remote shell tool that will call back to the C2 server and wait for commands.

Tactics: TA0002
Techniques: T1059
Input: The encryption key can be found in a file named Policy.vpol, typically located in the same folder as the credentials.

Tactics: TA0006
Techniques: T1555, T1555.004
Input: Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows ( unauthorized, gratuitous, or anomalous traffic patterns attempting to access configuration content)

Tactics: TA0009
Techniques: T1602
Input: Clambling has the ability to bypass UAC using a passuac.dll file.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Smoke Loader searches through Outlook files and directories (, inbox, sent, templates, drafts, archives, ).

Tactics: TA0009
Techniques: T1114, T1114.001
Input: Adversaries may abuse these OS API functions as a means of executing behaviors.

Tactics: TA0002
Techniques: T1106
Input: Sidewinder has used the ActiveXObject utility to create OLE objects to obtain execution through Internet Explorer.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: An adversary may use a cloud service dashboard GUI with stolen credentials to gain useful information from an operational cloud environment, such as specific services, resources, and features.

Tactics: TA0007
Techniques: T1538
Input: Higher level execution mediums, such as those of Command and Scripting Interpreters, may also leverage underlying IPC mechanisms.

Tactics: TA0002
Techniques: T1559
Input: They have also dumped credentials from domain controllers.

Tactics: TA0006
Techniques: T1003, T1003.002, T1003.004, T1003.001
Input: Anti-virus can also automatically quarantine suspicious files.

Tactics: TA0001
Techniques: T1566.003, T1566, T1566.001
Input: SIDs are used by Windows security in both security descriptors and access tokens.

Tactics: TA0004, TA0005
Techniques: T1134.005, T1134
Input: DarkWatchman can query the Registry to determine if it has already been installed on the system.

Tactics: TA0007
Techniques: T1012
Input: Other resources may include images, deployments, pods, nodes, and other information such as the status of a cluster.

Tactics: TA0007
Techniques: T1613
Input: Flagpro has relied on users clicking a malicious attachment delivered through spearphishing.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: BendyBear has used byte randomization to obscure its behavior.

Tactics: TA0011
Techniques: T1001.001, T1001
Input: Wizard Spider has sent phishing emails containing a link to an actor-controlled Google Drive document or other free online file hosting services.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Adversaries may develop exploits that can be used during targeting.

Tactics: TA0042
Techniques: T1587, T1587.004
Input: bcdedit.exe can be used to disable automatic Windows recovery features by modifying boot configuration data - bcdedit.exe /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no

Tactics: TA0040
Techniques: T1490
Input: Monitor for newly constructed  processes and/or command-lines involved in data destruction activity, such as vssadmin, wbadmin, and bcdedit.

Tactics: TA0040
Techniques: T1486
Input: TAINTEDSCRIBE can randomly pick one of five hard-coded IP addresses for C2 communication; if one of the IP fails, it will wait 60 seconds and then try another IP address.

Tactics: TA0011
Techniques: T1008
Input: A gh0st RAT variant has used DLL side-loading.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: A common example is to build rapport with a target via social media, then send content to a personal webmail service that the target uses on their work computer.

Tactics: TA0001
Techniques: T1566.003, T1566
Input: Magic Hound malware is capable of keylogging.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: The first link was labeled as "Comparison of Major Tasks in '16 & '17" and the second link was identified as "Comparison between '16 & '17".Upon opening these links the user was presented with a further decoy Hangul document

Tactics: TA0001
Techniques: T1566, T1566.002
Input: HotCroissant has the ability to determine if the current user is an administrator, Windows product name, processor name, screen resolution, and physical RAM of the infected host.

Tactics: TA0007
Techniques: T1082
Input: Pupy can upload and download to/from a victim machine.

Tactics: TA0011
Techniques: T1105
Input: APT32 malware has injected a Cobalt Strike beacon into Rundll32.exe.

Tactics: TA0004, TA0005
Techniques: T1055
Input: AADInternals can enumerate information about a variety of cloud services, such as Office 365 and Sharepoint instances or OpenID Configurations.

Tactics: TA0007
Techniques: T1526
Input: APT41 leveraged sticky keys to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: ChChes communicates to its C2 server over HTTP and embeds data within the Cookie HTTP header.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Monitor for changes to Azure Activity Logs for unexpected modifications to Service Principal and Application.

Tactics: TA0003
Techniques: T1098
Input: APT29 has used AdFind to enumerate domain groups.

Tactics: TA0007
Techniques: T1069.002, T1069
Input: RDAT has used HTTP if DNS C2 communications were not functioning.

Tactics: TA0011
Techniques: T1008
Input: NOKKI has downloaded a remote module for execution.

Tactics: TA0011
Techniques: T1105
Input: Maze operators have used VirtualBox and a Windows 7 virtual machine to run the ransomware; the virtual machine's configuration file mapped the shared network drives of the target company, presumably so Maze can encrypt files on the shared drives as well as the local machine.

Tactics: TA0005
Techniques: T1564, T1564.006
Input: Frankenstein has established persistence through a scheduled task using the command:  /Create /F /SC DAILY /ST 09:00 /TN WinUpdate /TR , named "WinUpdate".

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: APT1 listed connected network shares.

Tactics: TA0007
Techniques: T1135
Input: Ngrok has been used by threat actors to configure servers for data exfiltration.

Tactics: TA0010
Techniques: T1567
Input: Pupy has built in commands to identify a host’s IP address and find out other network configuration settings by viewing connected sessions.

Tactics: TA0007
Techniques: T1016
Input: StoneDrill has used several anti-emulation techniques to prevent automated analysis by emulators or sandboxes.

Tactics: TA0005, TA0007
Techniques: T1497
Input: Derusbi also gathers the username of the victim.

Tactics: TA0007
Techniques: T1033
Input: A Helminth VBScript receives a batch script to execute a set of commands in a command prompt.

Tactics: TA0009
Techniques: T1119
Input: USBferry can check for connected USB devices.

Tactics: TA0007
Techniques: T1120
Input: In such cases, the user's web browser is typically targeted for exploitation (often not requiring any extra user interaction once landing on the site), but adversaries may also set up websites for non-exploitation behavior such as Application Access Token.

Tactics: TA0042
Techniques: T1608.004, T1608
Input: CharmPower can download additional modules from actor-controlled Amazon S3 buckets.

Tactics: TA0011
Techniques: T1102
Input: SUNBURST collected a list of service names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.

Tactics: TA0007
Techniques: T1007
Input: Additionally, HISTCONTROL can be configured to ignore commands that start with a space by simply setting it to "ignorespace".

Tactics: TA0005
Techniques: T1562.003, T1562
Input: Use of a contractor may be considered an extension of that adversary's exploit development capabilities, provided the adversary plays a role in shaping requirements and maintains an initial degree of exclusivity to the exploit.

Tactics: TA0042
Techniques: T1587, T1587.004
Input: By patching the operating system, the adversary can change this command to instead display the original, higher revision number that they replaced through the system downgrade.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: Lazarus Group has stopped the MSExchangeIS service to render Exchange contents inaccessible to users.

Tactics: TA0040
Techniques: T1489
Input: SILENTTRINITY can determine if an anti-virus product is installed through the resolution of the service's virtual SID.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Cleaver has been known to dump credentials using Mimikatz and Windows Credential Editor.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: China Chopper's server component can change the timestamp of files.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: InvisiMole can inject its code into a trusted process via the APC queue.

Tactics: TA0004, TA0005
Techniques: T1055.004, T1055
Input: Monitor executed commands and arguments that may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel.

Tactics: TA0010
Techniques: T1048.002, T1048.003, T1048, T1048.001
Input: Adversaries can also use login items to launch executables that can be used to control the victim system remotely or as a means to gain privilege escalation by prompting for user credentials.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.015
Input: OSX/Shlayer can use bash scripts to check the macOS version, download payloads, and extract bytes from files.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: APT28 has used IMAP, POP3, and SMTP for a communication channel in various implants, including using self-registered Google Mail accounts and later compromised email servers of its victims.

Tactics: TA0011
Techniques: T1071, T1071.003
Input: Carbanak has a command to delete files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: APT39 has used tools with the ability to search for files on a compromised host.

Tactics: TA0007
Techniques: T1083
Input: Since the XSL file is valid XML, the adversary may call the same XSL file twice.

Tactics: TA0005
Techniques: T1220
Input: Expand can be used to decompress a local or remote CAB file into an executable.

Tactics: TA0005
Techniques: T1140
Input: Adversaries may use Patch System Image to hard code a password in the operating system, thus bypassing of native authentication mechanisms for local accounts on network devices.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.004
Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Trusted Relationship).

Tactics: TA0043
Techniques: T1590, T1590.003
Input: This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: Vault was implemented in Windows 7, it contains any sensitive data (like the credentials) of Internet Explorer

Tactics: TA0006
Techniques: T1003
Input: After checking for the existence of two files, keyword_parm.txt and parm.txt, MESSAGETAP XOR decodes and read the contents of the files.

Tactics: TA0005
Techniques: T1140
Input: APT1 has registered hundreds of domains for use in operations.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: Monitor executed commands and arguments that may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system.

Tactics: TA0003
Techniques: T1137.002, T1137
Input: Kinsing has used Unix shell scripts to execute commands in the victim environment.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: Kessel has trojanized the ssh_login and user-auth_pubkey functions to steal plaintext credentials.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556
Input: Monitor for unusual Exchange and Office 365 email account permissions changes that may indicate excessively broad permissions (including memberships in privileged groups) being granted to compromised accounts.

Tactics: TA0003
Techniques: T1098.002, T1098
Input: Similar to DLL Search Order Hijacking, side-loading involves hijacking which DLL a program loads.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: Correlate other security systems with login information (, a user has an active login session but has not entered the building or does not have VPN access).

Tactics: TA0001, TA0003, TA0004, TA0005, TA0006
Techniques: T1556.003, T1078, T1556, T1078.003, T1199, T1078.002, T1556.001
Input: FIN6 has used PowerShell to gain access to merchant's networks, and a Metasploit PowerShell module to download and execute shellcode and to set up a local listener.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: HAFNIUM has used 7-Zip and WinRAR to compress stolen files for exfiltration.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: GeminiDuke collects information on programs and services on the victim that are configured to automatically run at startup.

Tactics: TA0007
Techniques: T1007
Input: Zebrocy enumerates information about connected storage devices.

Tactics: TA0007
Techniques: T1120
Input: Zeroaccess is a kernel-mode rootkit.

Tactics: TA0005
Techniques: T1014
Input: APT28 has staged archives of collected data on a target's Outlook Web Access (OWA) server.

Tactics: TA0009
Techniques: T1074.002, T1074
Input: APT32 has used mshta.exe for code execution.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: Operation Wocao has queried the registry to detect recent PuTTY sessions.

Tactics: TA0007
Techniques: T1012
Input: Rocke conducted scanning for exposed TCP port 7001 as well as SSH and Redis servers.

Tactics: TA0007
Techniques: T1046
Input: Flagpro has dropped an executable file to the startup directory.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: The current version, HawkEye Reborn v9 has been modified from earlier versions and heavily obfuscated to make analysis more difficult.The email campaigns that have been observed feature characteristics that are consistent with what is commonly seen with malspam campaigns, with the emails purporting to be associated with various documents such as invoices, bills of materials, order confirmations, and other corporate functions

Tactics: TA0005
Techniques: T1027
Input: Valak can gather information regarding the user.

Tactics: TA0007
Techniques: T1033
Input: Information may also be acquired through system management tools such as Windows Management Instrumentation and PowerShell.

Tactics: TA0007
Techniques: T1217
Input: Micropsia gathers the hostname and OS version from the victim’s machine.

Tactics: TA0007
Techniques: T1082
Input: Crutch has automatically exfiltrated stolen files to Dropbox.

Tactics: TA0010
Techniques: T1020
Input: Caching alternate authentication material allows the system to verify an identity has successfully authenticated without asking the user to reenter authentication factor(s).

Tactics: TA0005, TA0008
Techniques: T1550
Input: Modifying or disabling a system firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: Servers are likely a high value target for lateral movement exploitation, but endpoint systems may also be at risk if they provide an advantage or access to additional resources.

Tactics: TA0008
Techniques: T1210
Input: Metamorfo has used MSI files to download additional files to execute.

Tactics: TA0011
Techniques: T1105
Input: The print spooler service runs under SYSTEM level permissions, therefore print processors installed by an adversary may run under elevated privileges.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.012
Input: These processes may show up as outlier processes that have not been seen before when compared against historical data.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.011, T1574
Input: Adversaries may abuse these templates to initially conceal malicious code to be executed via user documents.

Tactics: TA0005
Techniques: T1221
Input: IOC’s and YARA rules     Sample   MD5   Size   IP   IOC     TdxWCfg.exe   474b3cd073b0a40d656b1a2f5bb673cf   708KB   http://mdzz2019.noip.cn:19931   HKLM/System/CurrentControlSet/Services/DirecastX ytasda jrqq   %Program Files (x86)%/DIFXE/svchost.exe     Tdx_Dropped   9bce099b5b01c305a5d98f1fd262bce1   143.05KB   http://mdzz2019.noip.cn:19931   HKLM/System/CurrentControlSet/Services/DirecastX ytasda jrqq       dwm.exe   00aaf0ddcc8d9b197c148e44d9e72d8d   384KB   http://mdzz2019.noip.cn:19931   HKLM/System/CurrentControlSet/Services/DirectX yta jsdrq %Program Files (x86)%/DIFXE/svchost.exe     dwm_dropped   a548c18aa678626dab9b60628712cc18   84KB   http://mdzz2019.noip.cn:19931   HKLM/System/CurrentControlSet/Services/DirectX yta jsdrq         Yara Rules:     rule gh0strat_variant_dropper             {                meta:                    author = "James Quinn, @lazyactivist192"                    desc = "Identifies a Gh0stRAT dropper"                           strings:                    $s1 = "+gPp6bGvrqa9/fz2770A/amupqawrp8="                    $s2 = "Shellex"                    $s3 = "SUSRAIZCqllahrCohrlojSarZSalpecasZ"                    $s4 = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"                               $s6 = "SYST%-\\#urrENt#ONtrOLSEt\\SErvICEs\\"                               condition:                    2 of ($s1, $s2, $s4) and 1 of ($s3, $s6)         }         rule gh0strat_variant         {                meta:                    author = "James Quinn, @lazyactivist192"                    desc = "Identifies a Gh0stRAT variant"                               strings:                    $s1 = "\\\\.\\agmkis2"                    $s2 = "Shellex"                              $s3 = "Gh0st Update"                    $s4 = "PluginMe"                               condition:                    all of them         }     Appendix  Socket script Version 1: https://github.com/Jquinn147/Analysis-Automation/blob/master/Python/Gh0stRAT_Variant_Socket.py Socket Script V2(Command Script): https://github.com/Jquinn147/Analysis-Automation/blob/master/Python/Gh0stRatSocket.py Citations: Martin, D

Tactics: TA0002, TA0007, TA0011
Techniques: T1007, T1569.002, T1071, T1569
Input: TrickBot has been known to reach a command and control server via one of nine proxy IP addresses.

Tactics: TA0011
Techniques: T1090, T1090.002
Input: There was a slight deviation in the November grouping, where the three samples we collected still used the Joohn author name for the last modified field but reverted to a default USER/user author name for the creator field

Tactics: TA0007
Techniques: T1033
Input: The majority of native system logging is stored under the /var/log/ directory.

Tactics: TA0005
Techniques: T1070, T1070.002
Input: Drovorub can delete specific files from a compromised host.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: TrickBot uses non-descriptive names to hide functionality and uses an AES CBC (256 bits) encryption algorithm for its loader and configuration files.

Tactics: TA0005
Techniques: T1027
Input: Peppy can identify specific files for exfiltration.

Tactics: TA0007
Techniques: T1083
Input: Adversaries may also check the network adapters addresses, CPU core count, and available memory/drive size.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Unlike a previously reported variant, this version of BADNEWS no longer looks at USB drives for interesting files

Tactics: TA0007
Techniques: T1083
Input: Mustang Panda has installed TeamViewer on targeted systems.

Tactics: TA0011
Techniques: T1219
Input: HOPLIGHT has modified the firewall using netsh.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: Installing IFEO mechanisms may also provide Persistence via continuous triggered invocation.

Tactics: TA0003, TA0004
Techniques: T1546.012, T1546
Input: Enable Audit Kerberos Service Ticket Operations to log Kerberos TGS service ticket requests.

Tactics: TA0006
Techniques: T1558
Input: Lazarus Group has used multi-stage malware components that inject later stages into separate processes.

Tactics: TA0011
Techniques: T1104
Input: Anchor can support windows execution via SMB shares.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Dridex has used POST requests and HTTPS for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: PoshC2 has a number of modules that leverage pass the hash for lateral movement.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: GuLoader has been spread in phishing campaigns using malicious web links.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Indicators of compromise MITRE ATT&CK techniques  Modify existing service Code signing File deletion Deobfuscate/decode files or information System information discovery Process discovery Service execution RunDLL32 Scripting Command-line Interface Data from local system Automated exfiltration Data encrypted Commonly used port Bypass user account control  Hashes  fe32d29fa16b1b71cd27b23a78ee9f6b7791bff3 f684e15dd2e84bac49ea9b89f9b2646dc32a2477 1d280a77595a2d2bbd36b9b5d958f99be20f8e06 19d9573f0b2c2100accd562cc82d57adb12a57ec f90a2155ac492c3c2d5e1d83e384e1a734e59cc0 9b832dda912cce6b23da8abf3881fcf4d2b7ce09 f3b62fea38cb44e15984d941445d24e6b309bc7b 66d2cea01b46c3353f4339a986a97b24ed89ee18 7113aaab61cacb6086c5531a453adf82ca7e7d03 d41daba0ebfa55d0c769ccfc03dbf6a5221e006a 25f4819e7948086d46df8de2eeeaa2b9ec6eca8c 35ab747c15c20da29a14e8b46c07c0448cef4999 e87de3747d7c12c1eea9e73d3c2fb085b5ae8b42 0e4a7c0242b98723dc2b8cce1fbf1a43dd025cf0 bca861a46d60831a3101c50f80a6d626fa99bf16 01530adb3f947fabebae5d9c04fb69f9000c3cef 4229896d61a5ad57ed5c247228606ce62c7032d0 4c7e975f95ebc47423923b855a7530af52977f57 5a6ad7a1c566204a92dd269312d1156d51e61dc4 1dc50bfcab2bc80587ac900c03e23afcbe243f64 003e21b02be3248ff72cc2bfcd05bb161b6a2356 9b7c3c48bcef6330e3086de592b3223eb198744a 85e2453b37602429596c9681a8c58a5c6faf8d0c  Domains  ftp.byethost31.com ftp.byethost11.com 1113427185.ifastnet.org navermail.byethost3.com nihon.byethost3.com

Tactics: TA0010
Techniques: T1048
Input: Fox Kitten has used 7-Zip to archive data.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: ProLock can remove files containing its payload after they are executed.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Clambling can record screen content in AVI format.

Tactics: TA0009
Techniques: T1125
Input: Chimera has used Cobalt Strike to encapsulate C2 in DNS traffic.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: OopsIE uses the SmartAssembly obfuscator to pack an embedded .Net Framework assembly used for C2.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: OopsIE Trojan Analysis The OopsIE Trojan delivered in these attacks is packed with SmartAssembly and further obfuscated with ConfuserEx v1.0.0

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Sandworm Team's BCS-server tool uses base64 encoding and HTML tags for the communication traffic between the C2 server.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: PLEAD has the ability to delete files on the compromised host.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: This functionality is used by Windows features such as User Account Control (UAC) to correctly set the PPID after a requested elevated process is spawned by SYSTEM (typically via svchost.exe or consent.exe) rather than the current user context.

Tactics: TA0004, TA0005
Techniques: T1134.004, T1134
Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Exploit Public-Facing Application).

Tactics: TA0043
Techniques: T1596, T1596.005