madox81/Adema_ATTACK_DS huggingface dataset:
Input: A patch management process should be implemented to check unused applications, unmaintained and/or previously vulnerable software, unnecessary features, components, files, and documentation.

Tactics: TA0001
Techniques: T1195, T1195.002
Input: A QuasarRAT .dll file is digitally signed by a certificate from AirVPN.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Adversaries may target these repositories in order to collect large quantities of sensitive system administration data.

Tactics: TA0009
Techniques: T1602
Input: OSX/Shlayer can base64-decode and AES-decrypt downloaded payloads.

Tactics: TA0005
Techniques: T1140
Input: Audit domain and local accounts as well as their permission levels routinely to look for situations that could allow an adversary to gain wide access by obtaining credentials of a privileged account.

Tactics: TA0001, TA0003, TA0004, TA0005, TA0006
Techniques: T1078, T1556, T1556.001
Input: yty uses a keylogger plugin to gather keystrokes.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Adversaries may install an older version of the operating system of a network device to weaken security.

Tactics: TA0005
Techniques: T1601, T1601.002
Input: Neoichor can use HTTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Log attempts to read/write to BIOS and compare against known patching behavior.Likewise, EFI modules can be collected and compared against a known-clean list of EFI executable binaries to detect potentially malicious modules.

Tactics: TA0003, TA0005
Techniques: T1542.001, T1542
Input: Additionally, xcopy on Windows can copy files and directories with a variety of options.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Clop can use msiexec.exe to disable security tools on the system.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: CARROTBALL has been executed through users being lured into opening malicious e-mail attachments.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: If the permissions on the file system directory containing a target binary, or permissions on the binary itself, are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.005, T1574
Input: Monitor for unexpected deletion of a system log file, typically stored in /var/logs or /Library/Logs.

Tactics: TA0005
Techniques: T1070, T1070.002
Input: Pisloader uses DNS as its C2 protocol.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: LiteDuke can enumerate the account name on a targeted system.

Tactics: TA0007
Techniques: T1033
Input: Analyzing web metadata may also reveal artifacts that can be attributed to potentially malicious activity, such as referer or user-agent string HTTP/S fields.

Tactics: TA0043
Techniques: T1589.002, T1589, T1594
Input: Ensure proper Registry permissions are in place to prevent adversaries from disabling or interfering with security/logging services.

Tactics: TA0005
Techniques: T1562
Input: Examples of events that may be subscribed to are the wall clock time, user loging, or the computer's uptime.

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: Monitor for changes made to the /Library/Preferences/com.apple.loginwindow plist file for unexpected modifications to the  Hide500Users key value on macOS.

Tactics: TA0005
Techniques: T1564.002, T1564
Input: Adversaries have been observed conducting DoS attacks for political purposes and to support other malicious activities, including distraction, hacktivism, and extortion.

Tactics: TA0040
Techniques: T1499
Input: MacSpy captures keystrokes.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Bisonal has added the exfiltrated data to the URL over the C2 channel.

Tactics: TA0010
Techniques: T1041
Input: FatDuke has the ability to execute PowerShell scripts.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Adversaries may also steal code signing materials directly from a compromised third-party.

Tactics: TA0042
Techniques: T1588, T1588.003
Input: Adversaries may install a new service or modify an existing service to execute at startup in order to persist on a system.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: The Trojan then gets the hexadecimal values of the compressed data and will replace the following hexadecimal values on each line with ASCII characters to further compressed the data:   String of hexadecimal values Character replacement 000000 z 00000 x 0000 y 000 g 00 w 01 t   The Trojan then writes 1500 bytes of the hexadecimal formatted data, one per line to a temporary file in the SpecialFolder.CommonApplicationData folder named as:<day><hour><second><millisecond>.tmp The Trojan will then read each line from this temporary file and send them to the C2 server by issuing requests to a URL structured as follows:http://<c2 domain>/resp?<hex(Environment.UserName/Environment.MachineName)>ABZ<hex(1500 characters of hexadecimal formatted file contents)> Once all of the lines of hexadecimal formatted data in the temporary file are sent to the C2 server, the Trojan will send a request to the C2 server to notify the data has been successfully transmitted via a URL structured as follows:http://<c2 domain>/resp?<hex(Environment.UserName/Environment.MachineName)>ABZFinish  Overlaps with Previous OilRig Group Attacks Since May 2016, we have continued to monitor and uncover various attacks and tools associated with the OilRig group

Tactics: TA0005, TA0009, TA0011, TA0010
Techniques: T1041, T1070, T1573, T1048, T1560, T1070.004, T1074
Input: Honeybee uses a batch file that modifies Registry keys to launch a DLL into the svchost.exe process.

Tactics: TA0005
Techniques: T1112
Input: It contains functionality to acquire information about credentials in many ways, including from the LSA.

Tactics: TA0006
Techniques: T1003, T1003.004
Input: Chaes can download additional files onto an infected machine.

Tactics: TA0011
Techniques: T1105
Input: ]com/malicious.sct")"  This behavior has been seen used by malware such as Poweliks.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: A Destover-like variant used by Lazarus Group also collects disk space information and sends it to its C2 server.

Tactics: TA0007
Techniques: T1082
Input: GreyEnergy is packed for obfuscation.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Mimikatz's CRYPTO::Extract module can extract keys by interacting with Windows cryptographic application programming interface (API) functions.

Tactics: TA0006
Techniques: T1552.004, T1552
Input: Mis-Type saves itself as a file named msdtc.exe, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Such defenses can be provided by the hosting Internet Service Provider (ISP) or by a 3rd party such as a Content Delivery Network (CDN) or providers specializing in DoS mitigations.

Tactics: TA0040
Techniques: T1498
Input: Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device.

Tactics: TA0040
Techniques: T1529
Input: Hancitor has deleted files using the VBA kill function.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Adversaries may use tainted shared content to move laterally.

Tactics: TA0008
Techniques: T1080
Input: In some cases, adversaries may stop or disable many or all services to render systems unusable.

Tactics: TA0040
Techniques: T1489
Input: External Defacement may be used as a catalyst to trigger events, or as a response to actions taken by an organization or government.

Tactics: TA0040
Techniques: T1491.002, T1491
Input: PUNCHBUGGY can download additional files and payloads to compromised hosts.

Tactics: TA0011
Techniques: T1105
Input: Similar to Regsvr32 / "Squiblydoo", CMSTP.exe may be abused to load and execute DLLs   and/or COM scriptlets (SCT) from remote servers.

Tactics: TA0005
Techniques: T1218, T1218.003
Input: So, it is possible for poor configurations to allow an adversary to modify executables referenced by current Launch Daemon's plist files.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: TA505 has leveraged malicious Word documents that abused DDE.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: Egregor can inject its payload into iexplore.exe process.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Comnie uses HTTP for C2 communication.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Monitor for changes made to processes that may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055.008, T1055
Input: Update password managers regularly by employing patch management for internal enterprise endpoints and servers.

Tactics: TA0006
Techniques: T1555.005, T1555
Input: ZxShell can launch port scans.

Tactics: TA0007
Techniques: T1046
Input: Pysa has used PsExec to copy and execute the ransomware.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Anchor has obfuscated code with stack strings and string encryption.

Tactics: TA0005
Techniques: T1027
Input: Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may be vulnerable to Brute Force.

Tactics: TA0006
Techniques: T1558.003, T1558
Input: Clambling can store a file named mpsvc.dll, which opens a malicious mpsvc.mui file, in the same folder as the legitimate Microsoft executable MsMpEng.exe to gain execution.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: FatDuke can use base64 encoding, string stacking, and opaque predicates for obfuscation.

Tactics: TA0005
Techniques: T1027
Input: Zeus Panda can download additional malware plug-in modules and execute them on the victim’s machine.

Tactics: TA0011
Techniques: T1105
Input: DarkWatchman can search for anti-virus products on the system.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Golden tickets require adversaries to interact with the Key Distribution Center (KDC) in order to obtain TGS.

Tactics: TA0006
Techniques: T1558, T1558.001
Input: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.

Tactics: TA0040
Techniques: T1491.001, T1491
Input: Monitor executed commands and arguments that may invoke a WinRM script to correlate it with other related events.

Tactics: TA0008
Techniques: T1021, T1021.006
Input: Monitor executed commands and arguments of binaries involved in shutting down or rebooting systems.

Tactics: TA0040
Techniques: T1529
Input: This may be done to evade some defenses, such as static indicator scanning tools and anti-virus.

Tactics: TA0005
Techniques: T1564, T1564.004
Input: Metamorfo has written process names to the Registry, disabled IE browser features, deleted Registry keys, and changed the ExtendedUIHoverTime key.

Tactics: TA0005
Techniques: T1112
Input: APT28 has used tools to perform keylogging.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: A custom XOR cipher or RC4 is used for decryption.

Tactics: TA0005
Techniques: T1140
Input: APT32 has used RTF document that includes an exploit to execute malicious code. (CVE-2017-11882)

Tactics: TA0002
Techniques: T1203
Input: Users can interact with ticket storage using kinit, klist, ktutil, and kcc built-in binaries or via Apple's native Kerberos framework.

Tactics: TA0006
Techniques: T1558
Input: Adversaries may also target internal devices responsible for network segmentation and abuse these in conjunction with Internal Proxy to achieve the same goals.

Tactics: TA0005
Techniques: T1599
Input: Emotet has relied upon users clicking on a malicious link delivered through spearphishing.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: TINYTYPHON installs itself under Registry Run key to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: An audit policy, maintained by the Local Security Policy (secpol.msc), defines which system events the EventLog service logs.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: CookieMiner has looked for files in the user's home directory with "wallet" in their name using find.

Tactics: TA0007
Techniques: T1083
Input: The event logs can be cleared with the following utility commands:

Tactics: TA0005
Techniques: T1070, T1070.001
Input: Custom tools may also be used to gather file and directory information and interact with the Native API.

Tactics: TA0007
Techniques: T1083
Input: Attached to this email was a malicious Microsoft Word document (MD5: f6fafb7c30b1114befc93f39d0698560) that exploited CVE-2012-0158

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Kimsuky has used Win7Elevate to inject malicious code into explorer.exe.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Mosquito leverages the CreateProcess() and LoadLibrary() calls to execute files with the .dll and .exe extensions.

Tactics: TA0002
Techniques: T1106
Input: Monitor executed commands and arguments that may acquire credentials from web browsers by reading files specific to the target browser.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Some private keys require a password or passphrase for operation, so an adversary may also use Input Capture for keylogging or attempt to Brute Force the passphrase off-line.

Tactics: TA0006
Techniques: T1552.004, T1552
Input: Aria-body has the ability to identify the location, public IP address, and domain name on a compromised host.

Tactics: TA0007
Techniques: T1016
Input: Configure the Increase Scheduling Priority option to only allow the Administrators group the rights to schedule a priority process.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053, T1053.002
Input: The PowerShell script is responsible for downloading the final payload from C2 server to execute it

Tactics: TA0002
Techniques: T1059.001, T1059
Input: RunningRAT captures keystrokes and sends them back to the C2 server.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Monitor for newly constructed user accounts through account audits to detect suspicious accounts that may have been created by an adversary.

Tactics: TA0003
Techniques: T1136, T1136.001, T1136.002
Input: Denis exploits a security vulnerability to load a fake DLL and execute its code.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: Monitor for changes made to Windows Registry keys and/or values that may forge credential materials that can be used to gain access to web applications or Internet services.

Tactics: TA0005
Techniques: T1218
Input: TinyTurla contacts its C2 based on a scheduled timing set in its configuration.

Tactics: TA0010
Techniques: T1029
Input: Hydraq uses basic obfuscation in the form of spaghetti code.

Tactics: TA0005
Techniques: T1027
Input: Axiom has used previously compromised administrative accounts to escalate privileges.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: For example, adversaries may use web content discovery tools such as Dirb, DirBuster, and GoBuster and generic or custom wordlists to enumerate a website’s pages and directories.

Tactics: TA0043
Techniques: T1595.003, T1595
Input: AppleSeed can delete files from a compromised host after they are exfiltrated.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: GALLIUM used Web shells and HTRAN for C2 and to exfiltrate data.

Tactics: TA0010
Techniques: T1041
Input: An adversary may abuse Active Directory authentication encryption properties to gain access to credentials on Windows systems.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.005
Input: RogueRobin establishes persistence by creating a shortcut (.LNK file) in the Windows startup folder to run a script each time the user logs in.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: BRONZE BUTLER has used at to register a scheduled task to execute malware during lateral movement.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: The Windows Task Scheduler can also be abused to conduct remote Execution as part of Lateral Movement and/or to run a process under the context of a specified account (such as SYSTEM).

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Bisonal has been loaded through a .wll extension added to the %APPDATA%\microsoft\word\startup\ repository.

Tactics: TA0003
Techniques: T1137, T1137.006
Input: For complex systems, an adversary would likely need special expertise and possibly access to specialized software related to the system that would typically be gained through a prolonged information gathering campaign in order to have the desired impact.

Tactics: TA0040
Techniques: T1565.001, T1565.003, T1565, T1565.002
Input: InvisiMole can mimic HTTP protocol with custom HTTP "verbs" HIDE, ZVVP, and NOP.

Tactics: TA0011
Techniques: T1001, T1001.003
Input: Dyre has the ability to identify installed programs on a compromised host.

Tactics: TA0007
Techniques: T1518
Input: The group has also used the ping command.

Tactics: TA0007
Techniques: T1018
Input: DownPaper collects the victim host name and serial number, and then sends the information to the C2 server.

Tactics: TA0007
Techniques: T1082
Input: Timers installed using privileged paths may be used to maintain root level persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.006, T1053
Input: KEYMARBLE can obtain a list of running processes on the system.

Tactics: TA0007
Techniques: T1057
Input: For example, detecting a sequence of events such as the creation of an instance, mounting of a snapshot to that instance, and deletion of that instance by a new user account may indicate suspicious activity.

Tactics: TA0005
Techniques: T1578.003, T1578
Input: Adversaries may leverage a user's credentials and interact directly with the Exchange server to acquire information from within a network.

Tactics: TA0009
Techniques: T1114, T1114.002
Input: Monitor for unexpected network share access, such as files transferred between shares within a network using protocols such as SMB.

Tactics: TA0008
Techniques: T1570
Input: /var/log/cron.log: Crond logs

Tactics: TA0005
Techniques: T1070, T1070.002
Input: In Docker, the daemon log provides insight into events at the daemon and container service level.

Tactics: TA0002
Techniques: T1609
Input: Equation has used tools with the functionality to search for specific information about the attached hard drive that could be used to identify and overwrite the firmware.

Tactics: TA0007
Techniques: T1120
Input: Bankshot generates a false TLS handshake using a public certificate to disguise C2 network communications.

Tactics: TA0011
Techniques: T1001, T1001.003
Input: Once credentials are obtained, they can be used to perform lateral movement and access restricted information.

Tactics: TA0006
Techniques: T1555
Input: Adversaries may also create custom, target-specific wordlists using data gathered from other Reconnaissance techniques (ex: Gather Victim Org Information, or Search Victim-Owned Websites).

Tactics: TA0043
Techniques: T1595.003, T1595
Input: Okrum can impersonate a logged-on user's security context using a call to the ImpersonateLoggedOnUser API.

Tactics: TA0004, TA0005
Techniques: T1134, T1134.001
Input: Ecipekac can use XOR, AES, and DES to encrypt loader shellcode.

Tactics: TA0005
Techniques: T1027
Input: Remexi performs exfiltration over BITSAdmin, which is also used for the C2 channel.

Tactics: TA0010
Techniques: T1041
Input: A Threat Group-3390 tool can encrypt payloads using XOR.

Tactics: TA0005
Techniques: T1027
Input: Magic Hound malware has used Registry Run keys to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Carbanak has a plugin for VNC and Ammyy Admin Tool.

Tactics: TA0011
Techniques: T1219
Input: Tropic Trooper has installed a service pointing to a malicious DLL dropped to disk.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: The OwaAuth web shell is likely created with a builder, given that the PE compile time of the binary does not change between instances and the configuration fields are padded to a specific size

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Initial triage begins with connecting to Windows Management Instrumentation (WMI) via the “ROOT\CIMV2” namespace

Tactics: TA0002
Techniques: T1047
Input: Mis-Type may create a temporary user on the system named "Lost_{Unique Identifier}."

Tactics: TA0003
Techniques: T1136, T1136.001
Input: GALLIUM has used Taiwan-based servers that appear to be exclusive to GALLIUM.

Tactics: TA0042
Techniques: T1583.004, T1583
Input: Egregor can perform a language check of the infected system and can query the CPU information (cupid).

Tactics: TA0007
Techniques: T1082
Input: Toolkits like the PowerSploit framework contain PowerUp modules that can be used to explore systems for permission weaknesses in scheduled tasks that could be used to escalate privileges.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053, T1053.002
Input: Although UAC bypass techniques exist, it is still prudent to use the highest enforcement level for UAC when possible and mitigate bypass opportunities that exist with techniques such as DLL Search Order Hijacking.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Pysa has used Powershell scripts to deploy its ransomware.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Zebrocy is delivered primarily via phishing attacks that contain malicious Microsoft Office documents with macros as well as simple executable file attachments

Tactics: TA0001
Techniques: T1566, T1566.001
Input: The LSA includes multiple dynamic link libraries (DLLs) associated with various other security functions, all of which run in the context of the LSA Subsystem Service (LSASS) lsass.exe process.

Tactics: TA0003, TA0004
Techniques: T1547.008, T1547
Input: These files are downloaded to a directory (C:\Users\Public\Libraries\tempsys) on the infected machine by Bxaki() and xparis()

Tactics: TA0007
Techniques: T1083
Input: Silent Librarian has cloned victim organization login pages and staged them for later use in credential harvesting campaigns.

Tactics: TA0042
Techniques: T1608.005, T1608
Input: Derusbi gathers the name of the local host, version of GNU Compiler Collection (GCC), and the system information about the CPU, machine, and operating system.

Tactics: TA0007
Techniques: T1082
Input: TA551 has sent spearphishing attachments with password protected ZIP files.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: The Trojan accesses two resources, named Sch and VBS that contains obfuscated strings that contain the command to create the scheduled task and the VBScript to run

Tactics: TA0005
Techniques: T1027
Input: KOCTOPUS will attempt to delete or disable all Registry keys and scheduled tasks related to Microsoft Security Defender and Security Essentials.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Adversaries may search for VME artifacts in memory, processes, file system, hardware, and/or the Registry.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: The threat actor can now combine the information and brute force their way throughout the network (through NetBIOS) using a list of usernames and passwords as well as a range of IP addresses

Tactics: TA0006, TA0007
Techniques: T1110, T1016
Input: Prior to Code Signing, adversaries may purchase or steal code signing certificates for use in operations.

Tactics: TA0042
Techniques: T1588, T1588.003