madox81/Adema_ATTACK_DS huggingface dataset:
Input: SDBbot has the ability to decrypt and decompress its payload to enable code execution.

Tactics: TA0005
Techniques: T1140
Input: Lucifer has used UPX packed binaries.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: In the case of network designs that require NAT to function, this enables the adversary to overcome inherent routing limitations that would normally prevent them from accessing protected systems behind the border device.

Tactics: TA0005
Techniques: T1599, T1599.001
Input: Sykipot may use net view /domain to display hostnames of available systems on a network.

Tactics: TA0007
Techniques: T1018
Input: Once successfully installed in a system, Trickbot will gather system information such as OS, CPU, and memory information, user accounts, lists of installed programs and services.

Tactics: TA0007
Techniques: T1082
Input: SysUpdate has the ability to set file attributes to hidden.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: TA505 has used VBS for code execution.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Monitor for changes made to pods for unexpected modifications to settings and/or control data that may deploy a container into an environment to facilitate execution or evade defenses.

Tactics: TA0002, TA0005
Techniques: T1610
Input: Carbanak has a command to create a reverse shell.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: ShimRat can be issued a command shell function from the C2.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: DNS information may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases).

Tactics: TA0043
Techniques: T1590.002, T1590
Input: A number of commands are provided to the attackers, including the ability to download and execute additional information, upload documents of interest, and take screenshots of the desktop

Tactics: TA0009, TA0011
Techniques: T1105, T1113
Input: GreyEnergy encrypts communications using RSA-2048.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Property list files use the Label, ProgramArguments , and RunAtLoad keys to identify the Launch Agent's name, executable location, and execution time.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: Operation Wocao has used a custom proxy tool called "Agent" which has support for multiple hops.

Tactics: TA0011
Techniques: T1090
Input: Silence can capture victim screen activity.

Tactics: TA0009
Techniques: T1113
Input: IcedID has used obfuscated VBA string expressions.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Mustang Panda has gathered system information using systeminfo.

Tactics: TA0007
Techniques: T1082
Input: AppleJeus has collected the victim host information after infection.

Tactics: TA0007
Techniques: T1082
Input: Monitor cloud logs for API calls and other potentially unusual activity related to cloud instance enumeration.

Tactics: TA0007
Techniques: T1580
Input: Adversaries may modify pluggable authentication modules (PAM) to access user credentials or enable otherwise unwarranted access to accounts.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.003, T1556
Input: Carbanak has used a VBScript named "ggldr" that uses Google Apps Script, Sheets, and Forms services for C2.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: Cuba has been disguised as legitimate 360 Total Security Antivirus and OpenVPN programs.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Though various tools and services exist to track, query, and monitor domain name registration information, tracking across multiple DNS infrastructures can require multiple tools/services or more advanced analytics.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: Bundlore creates a new key pair with ssh-keygen and drops the newly created user key in authorized_keys to enable remote login.

Tactics: TA0003
Techniques: T1098.004, T1098
Input: XAgent uses HTTP requests to communicate with its C2 servers, which allows the threat actor to interact with the compromised system

Tactics: TA0011
Techniques: T1071
Input: TrickBot has the ability to capture RDP credentials by capturing the CredEnumerateA API

Tactics: TA0006, TA0009
Techniques: T1056.004, T1056
Input: HotCroissant has compressed network communications and encrypted them with a custom stream cipher.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: This is done by limiting the protocol specified in the second parameter to LDAP://, vice the script: moniker which could be used to reference remote code via HTTP(S).

Tactics: TA0005
Techniques: T1216.001, T1216
Input: Keydnap uses HTTPS for command and control.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: However, in this new variant, all the DNS activity is initiated and executed solely from memory – unlike previous attacks which used PowerShell commands

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Adversaries may attempt to establish persistence by inserting commands into scripts automatically executed by shells.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: PUNCHBUGGY can gather system information such as computer names.

Tactics: TA0007
Techniques: T1082
Input: APT32 has set up Facebook pages in tandem with fake websites.

Tactics: TA0042
Techniques: T1585, T1585.001
Input: This variation of the technique is often referred to as a "Squiblydoo" and has been used in campaigns targeting governments.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: The  crontab file contains the schedule of cron entries to be run and the specified times for execution.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: InvisiMole can use a modified base32 encoding to encode data within the subdomain of C2 requests.

Tactics: TA0011
Techniques: T1132, T1132.002
Input: With this information, an adversary may be able to reproduce the encryption key and subsequently decrypt the encrypted password value.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.005
Input: Meteor can use WinAPI to remove a victim machine from an Active Directory domain.

Tactics: TA0002
Techniques: T1106
Input: Adversaries may register for web services that can be used during targeting.

Tactics: TA0042
Techniques: T1583.006, T1583
Input: AADInternals can dump secrets from the Local Security Authority.

Tactics: TA0006
Techniques: T1003, T1003.004
Input: Adversaries may bypass UAC mechanisms to elevate process privileges on system.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Mustang Panda have acquired C2 domains prior to operations.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: Neither this new domain nor the IP it resolves to have been observed in the past, indicating that the sample in Table 3 may be associated with a newer campaign

Tactics: TA0007
Techniques: T1016
Input: Administrators can block end-user consent to OAuth applications, disabling users from authorizing third-party apps through OAuth 2.0 and forcing administrative consent for all requests.

Tactics: TA0006
Techniques: T1528
Input: In addition to downloading free malware, software, and exploits from the internet, adversaries may purchase these capabilities from third-party entities.

Tactics: TA0042
Techniques: T1588
Input: TA505 has used malware to gather credentials from Internet Explorer.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Siloscape itself is obfuscated and uses obfuscated API calls.

Tactics: TA0005
Techniques: T1027
Input: When an entry with a known good path and binary is replaced or changed to an unusual value to point to an unknown binary in a new location, then it may indicate suspicious behavior and should be investigated.

Tactics: TA0003, TA0004
Techniques: T1546.015, T1546
Input: QakBot can use advanced web injects to steal web banking credentials.

Tactics: TA0009
Techniques: T1185
Input: Figure 13: Zyklon issuing “settings” command and subsequent server response    Figure 14: Zyklon issuing “sign” command and subsequent server response    Figure 15: Zyklon issuing “ddos” command and subsequent server response Plugin Manager Zyklon downloads number of plugins from its C2 server

Tactics: TA0007, TA0011
Techniques: T1105, T1016
Input: Monitor for suspicious use of gpresult.

Tactics: TA0007
Techniques: T1615
Input: Ramsay has used HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Xbash has destroyed Linux-based databases as part of its ransomware capabilities.

Tactics: TA0040
Techniques: T1485
Input: PowerShower has used a PowerShell document stealer module to pack and exfiltrate .txt, .pdf, .xls or .doc files smaller than 5MB that were modified during the past two days.

Tactics: TA0010
Techniques: T1041
Input: Chimera has used WMIC to execute remote commands.

Tactics: TA0002
Techniques: T1047
Input: Further collaboration between FireEye as a Service (FaaS), Mandiant and FireEye iSIGHT intelligence uncovered additional victims worldwide, a new suite of tools and novel techniques

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Monitor for the creation of and/or changes to login hook files (/Library/Preferences/com.apple.loginwindow.plist), especially by unusual accounts outside of normal administration duties.

Tactics: TA0003, TA0004
Techniques: T1037.002, T1037
Input: Malware repositories can also be used to identify additional samples associated with the adversary and identify patterns an adversary has used in crafting self-signed code signing certificates.Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult.

Tactics: TA0042
Techniques: T1587.002, T1587
Input: Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS and the default service account in Kubernetes.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.001
Input: Encrypted backdoor configuration    Description Decryption Strings   Check code MDDEFGEGETGIZ   Addr1: tel.qpoe[.]com   Addr2: elderscrolls.wikaba[.]com   Addr3: tel.qpoe[.]com   Port1: 443   Port2: 443   Port3: 53   LoginPasswd: someone   HostMark: mark   Proxy: 0    Figure 12

Tactics: TA0005, TA0011
Techniques: T1140, T1027, T1571
Input: Melcoz has been packed with VMProtect and Themida.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

Tactics: TA0008
Techniques: T1210
Input: ShimRat can sleep when instructed to do so by the C2.

Tactics: TA0010
Techniques: T1029
Input: RTM can obtain the computer name, OS version, and default language identifier.

Tactics: TA0007
Techniques: T1082
Input: MuddyWater uses various techniques to bypass UAC.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Trojan.Karagany can capture keystrokes on a compromised host.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Adversaries may abuse rundll32.exe to proxy execution of malicious code.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: T9000 encrypts collected data using a single byte XOR key.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: nbtstat can be used to discover current NetBIOS sessions.

Tactics: TA0007
Techniques: T1049
Input: The Clambling executable has been obfuscated when dropped on a compromised host.

Tactics: TA0005
Techniques: T1027
Input: Empire uses a command-line interface to interact with systems.

Tactics: TA0002
Techniques: T1059
Input: Dragonfly has used spearphishing with PDF attachments containing malicious links that redirected to credential harvesting websites.

Tactics: TA0043
Techniques: T1598, T1598.003
Input: Once activated, this variant of the KillDisk component looks for and terminates two non-standard processes with the following names:  komut.exe sec_service.exe  We didn’t manage to find any information regarding the name of the first process (komut.exe)

Tactics: TA0005
Techniques: T1036, T1562.001, T1562
Input: Agent.btz saves system information into an XML file that is then XOR-encoded.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: Look for DLLs that are not recognized or not normally loaded into a process.

Tactics: TA0002, TA0003, TA0004, TA0005
Techniques: T1559, T1137.002, T1137, T1546.006, T1218, T1220, T1574.002, T1218.008, T1546, T1218.007, T1055.014, T1574.005, T1546.007, T1055, T1574, T1218.010, T1055.001
Input: Koadic can scan for open TCP ports on the target network.

Tactics: TA0007
Techniques: T1046
Input: Chaos provides a reverse shell connection on 8338/TCP, encrypted via AES.

Tactics: TA0002, TA0011
Techniques: T1573, T1059.004, T1573.001, T1059
Input: Turla has used net user /domain to enumerate domain accounts.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: Monitor for abnormal DLLs that are loaded by spoolsv.exe.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.012
Input: FoggyWeb can invoke the Common.Compress method to compress data with the C# GZipStream compression class.

Tactics: TA0009
Techniques: T1560.002, T1560
Input: Lateral Movement, Maintain Presence, and Complete Mission APT39 facilitates lateral movement through myriad tools such as Remote Desktop Protocol (RDP), Secure Shell (SSH), PsExec, RemCom, and xCmdSvc

Tactics: TA0008
Techniques: T1021.001, T1021
Input: The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals.

Tactics: TA0003, TA0004
Techniques: T1546.005, T1546
Input: HTTP Public Key Pinning (HPKP) is one method to mitigate potential Adversary-in-the-Middle situations where and adversary uses a mis-issued or fraudulent certificate to intercept encrypted communications by enforcing use of an expected certificate.

Tactics: TA0005
Techniques: T1553, T1553.004
Input: Equation has been observed utilizing environmental keying in payload delivery.

Tactics: TA0005
Techniques: T1480, T1480.001
Input: Filter or block WebDAV protocol traffic from exiting the network.

Tactics: TA0006
Techniques: T1187
Input: Compare recent invocations of those binaries with prior history of known good arguments and executed binaries to determine anomalous and potentially adversarial activity.

Tactics: TA0005
Techniques: T1127.001, T1127
Input: (Source: Dell SecureWorks) Over a few days' span, the threat actors install remote access tools on additional systems based upon the results of the network reconnaissance

Tactics: TA0007
Techniques: T1018
Input: Consider analyzing packet contents to detect application layer protocols, leveraging SSL/TLS inspection for encrypted traffic, that do not follow the expected protocol standards and traffic flows( snmp traffic originating from unauthorized or untrusted hosts, signature detection for strings mapped to device configuration(s), and anomolies in snmp request(s))

Tactics: TA0009
Techniques: T1602.001, T1602
Input: Dragonfly has sent emails with malicious attachments to gain initial access.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: PoetRAT has added a registry key in the  hive for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: An increasingly popular tactic by threat actors is to use legitimate hosting services like Google Cloud or CloudFlare for their payload and C2  infrastructure, making it much more difficult to safely block IPs

Tactics: TA0011
Techniques: T1102
Input: The loader’s main goal was to run a PowerShell command to execute shellcode

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Adversaries may leverage Confluence repositories to mine valuable information.

Tactics: TA0009
Techniques: T1213, T1213.001
Input: Proxysvc registers itself as a service on the victim’s machine to run as a standalone process.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: BRONZE BUTLER downloader code has included "0" characters at the end of the file to inflate the file size in a likely attempt to evade anti-virus detection.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: In order to meet the phishing emails’ infrastructure requirements, disposable domains and emails were used as the delivery medium

Tactics: TA0001
Techniques: T1566, T1566.001
Input: When possible, minimize time delay on event reporting to avoid prolonged storage on the local system.

Tactics: TA0005
Techniques: T1070, T1070.002, T1070.001
Input: After the .NET PE file has been run, we observed the same behavior as the above QUADAGENT sample of dropping a PowerShell script with the filename SystemDiskClean.ps1 alongside a VBScript file with the same name

Tactics: TA0005
Techniques: T1036
Input: Note: Domain controllers may not log replication requests originating from the default domain controller account.

Tactics: TA0006, TA0007
Techniques: T1003.006, T1033, T1003
Input: Ragnar Locker has used cmd.exe and batch scripts to execute commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: ZIRCONIUM has spoofed legitimate applications in phishing lures and changed file extensions to conceal  installation of malware.

Tactics: TA0005
Techniques: T1036
Input: Identify and block potentially malicious software executed that may be executed through this technique by using application control  tools, like Windows Defender Application Control, AppLocker,   or Software Restriction Policies  where appropriate.

Tactics: TA0002
Techniques: T1106
Input: PipeMon can decrypt password-protected executables.

Tactics: TA0005
Techniques: T1140
Input: With these permissions, an adversary could potentially browse to any resource on an intranet, such as Sharepoint or webmail, that is accessible through the browser and which the browser has sufficient permissions.

Tactics: TA0009
Techniques: T1185
Input: Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: ECCENTRICBANDWAGON has encrypted strings with RC4.

Tactics: TA0005
Techniques: T1027
Input: A value of "0" indicates LLMNR is disabled.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Compromise Hardware Supply Chain or Hardware Additions).

Tactics: TA0043
Techniques: T1592, T1592.001
Input: Lizar can take JPEG screenshots of an infected system.

Tactics: TA0009
Techniques: T1113
Input: DarkWatchman can identity the OS locale of a compromised host.

Tactics: TA0007
Techniques: T1614
Input: BRONZE BUTLER has used Right-to-Left Override to deceive victims into executing several strains of malware.

Tactics: TA0005
Techniques: T1036, T1036.002
Input: APT3 has also interacted with compromised systems to browse and copy files through RDP sessions.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Honeybee used batch scripting.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: RATANKBA runs the whoami and query user commands.

Tactics: TA0007
Techniques: T1033
Input: HiddenWasp uses a rootkit to hook and implement functions on the system.

Tactics: TA0005
Techniques: T1014
Input: TG-3390 actors keep track of and leverage existing ASPXTool web shells in their operations, preferring to issue commands via an internally accessible web shell rather than HttpBrowser or PlugX

Tactics: TA0002, TA0003
Techniques: T1505.003, T1505, T1059
Input: An example of 1.hwp with registry and system information:  Gold Dragon executes these steps executed in the exfiltration process:  Once the malware has gathered the required data from the endpoint, it encrypts the data file 1.hwp using the password “www[dot]GoldDragon[dot]com” The encrypted content is written to the data file 1.hwp

Tactics: TA0009
Techniques: T1560, T1074
Input: Catchamas steals data stored in the clipboard.

Tactics: TA0009
Techniques: T1115
Input: Ke3chang has dumped credentials, including by using gsecdump.

Tactics: TA0006
Techniques: T1003, T1003.002, T1003.004
Input: MiniDuke can enumerate local drives.

Tactics: TA0007
Techniques: T1083
Input: Log attempts to read/write to BIOS and compare against known patching behavior.

Tactics: TA0040
Techniques: T1495
Input: This includes, but is not limited to, the following:  AES encryption of network communication File management Functionality to download, upload, and execute files Keylogging Remote desktop access Remote webcam viewing Reverse proxy Browser and FTP client password recovery  The images below are what a target user opening a malicious RTF document would see from within Microsoft Word

Tactics: TA0011
Techniques: T1105
Input: Variants of Emissary have added Run Registry keys to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547.001, T1547
Input: The "SCOUT" variant of NETEAGLE achieves persistence by adding itself to the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: CHOPSTICK used a proxy server between victims and the C2 server.

Tactics: TA0011
Techniques: T1090.001, T1090
Input: QakBot has the ability to create scheduled tasks for persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Monitor for newly constructed /etc/rc.local file

Tactics: TA0003, TA0004
Techniques: T1037.004, T1037
Input: After decoding out the blob, analysts found a PowerShell script.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: OopsIE creates a scheduled task to run itself every three minutes.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Adversaries may temporarily modify domain policy, carry out a malicious action(s), and then revert the change to remove suspicious indicators.

Tactics: TA0004, TA0005
Techniques: T1484
Input: FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on the local system and removable media.

Tactics: TA0007
Techniques: T1083
Input: This could lead to privilege escalation, particularly if the roles added allow for lateral movement to additional accounts.

Tactics: TA0003
Techniques: T1098, T1098.003
Input: Adversaries will likely need to deploy and/or install these remote tools to compromised systems.

Tactics: TA0011
Techniques: T1219
Input: Machete captures audio from the computer’s microphone.

Tactics: TA0009
Techniques: T1123
Input: This will cause ConsoleHost_history.txt to stop receiving logs.

Tactics: TA0005
Techniques: T1562.003, T1562
Input: Ixeshe uses HTTP for command and control.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: CoinTicker creates user launch agents named .espl.plist and com.apple.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: A Linux version of Derusbi checks if the victim user ID is anything other than zero (normally used for root), and the malware will not execute if it does not have root privileges.

Tactics: TA0007
Techniques: T1033
Input: AppleJeus has deleted the MSI file after installation.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: BadPatch uses SMTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.003
Input: Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.

Tactics: TA0006
Techniques: T1003, T1003.002
Input: LitePower can use HTTP and HTTPS for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Cobalt Group has sent malicious Word OLE compound documents to victims.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: NotPetya determines if specific antivirus programs are running on an infected host machine.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: QakBot has the ability to capture web session cookies.

Tactics: TA0006
Techniques: T1539
Input: Turian can use WinRAR to create a password-protected archive for files of interest.

Tactics: TA0009
Techniques: T1560.001, T1560