madox81/Adema_ATTACK_DS huggingface dataset:
Input: Proc memory injection is commonly performed by overwriting the target processes’ stack using memory mappings provided by the /proc filesystem.

Tactics: TA0004, TA0005
Techniques: T1055.009, T1055
Input: SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information from NTDS.dit.

Tactics: TA0006
Techniques: T1003.003, T1003
Input: PHOREAL is capable of creating reverse shell.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: If the application deployment system can be configured to deploy only signed binaries, then ensure that the trusted signing certificates are not co-located with the application deployment system and are instead located on a system that cannot be accessed remotely or to which remote access is tightly controlled.

Tactics: TA0002, TA0008
Techniques: T1072
Input: In this campaign, we observed threat actors exploiting CVE-2017-0199 and CVE-2017-11882 to distribute malware

Tactics: TA0002
Techniques: T1203
Input: Out1 can parse e-mails on a target machine.

Tactics: TA0009
Techniques: T1114, T1114.001
Input: Tonto Team has used the ShowLocalGroupDetails command to identify administrator, user, and guest accounts on a compromised host.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: This shortcut file points to ‘C:\Windows\system32\rundll32.exe “%APPDATA%\cnagnt.dll”,Sd’    One of the exceptions to the installation routine above is in the event Symantec is detected

Tactics: TA0003, TA0004, TA0005
Techniques: T1547.009, T1218, T1547, T1218.011
Input: Part of APT28's operation involved using CHOPSTICK modules to copy itself to air-gapped machines and using files written to USB sticks to transfer data and command traffic.

Tactics: TA0001, TA0008
Techniques: T1091
Input: Suspicious activity may include personas claiming to work for your organization or recently created/modified accounts making numerous connection requests to accounts affiliated with your organization.Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access (ex: Spearphishing via Service).

Tactics: TA0042
Techniques: T1585, T1585.001
Input: Operation Wocao has used domain credentials, including domain admin, for lateral movement and privilege escalation.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.002
Input: Adversaries may opt to use these encrypted mechanisms that are baked into a protocol.

Tactics: TA0010
Techniques: T1048.002, T1048
Input: Systemd is the default initialization (init) system on many Linux distributions starting with Debian 8, Ubuntu 15.04, CentOS 7, RHEL 7, Fedora 15, and replaces legacy init systems including SysVinit and Upstart while remaining backwards compatible with the aforementioned init systems.

Tactics: TA0003, TA0004
Techniques: T1543.002, T1543
Input: RobbinHood will search for an RSA encryption key and then perform its encryption process on the system files.

Tactics: TA0040
Techniques: T1486
Input: Links to network shares and other internal resources

Tactics: TA0009
Techniques: T1213, T1213.001, T1213.002
Input: If it is successful then it will send out basic host information and await further commands.

Tactics: TA0007
Techniques: T1082
Input: Monitor executed commands and arguments for actions for abnormal usage of utilities and command-line arguments that may be used in support of remote transfer of files

Tactics: TA0008
Techniques: T1570
Input: MarkiRAT can use BITS Utility to connect with the C2 server.

Tactics: TA0003, TA0005
Techniques: T1197
Input: HOPLIGHT can launch cmd.exe to execute commands on the system.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Different colors show the three dropped modules: legit app (blue), launcher (green), and decompressor with the Trojan embedded (red) The initial module drops three files that are typical for Chinese-speaking actors: a legit Symantec pcAnywhere (IntgStat.exe) for DLL side loading, a .dll launcher (pcalocalresloader.dll) and the last-stage decompressor (thumb.db)

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1055, T1574
Input: Such files often pose as email attachments and allow an adversary to gain Initial Access into a user’s system via Spearphishing Attachment then User Execution.

Tactics: TA0005
Techniques: T1036, T1036.007
Input: Adversaries may attempt to get a listing of local system accounts.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: New DLLs written to the System32 directory that do not correlate with known good software or patching may be suspicious.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.010
Input: EvilBunny has used various API calls as part of its checks to see if the malware is running in a sandbox.

Tactics: TA0002
Techniques: T1106
Input: Monitor for changes made to user accounts for unexpected modification of properties, such as passwords or status (enabled/disabled).

Tactics: TA0040
Techniques: T1531
Input: Sidewinder has used HTTP in C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Malicious Outlook rules can be created that can trigger code execution when an adversary sends a specifically crafted email to that user.

Tactics: TA0003
Techniques: T1137, T1137.005
Input: Some variants of FakeM use SSL to communicate with C2 servers.

Tactics: TA0011
Techniques: T1095
Input: Adversaries may abuse various implementations of JavaScript for execution.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Javali can download payloads from remote C2 servers.

Tactics: TA0011
Techniques: T1105
Input: The following functions are called when the application attempts to initialize the menu:ETransaksi.Speed(); // Legitimate class, but method is the first  wrapped function that leads to malicious code ProjectData.EndApp(); // Closes the application before rest of  legitimate Sales System Application functions are calledThe “Speed” method in the legitimate ETransaksi class contains legitimate code from the Sales System Application; however, the author of this tool includes this code in an if/else construct that bypasses these instructions by setting a false flag to skip the legitimate code and execute the next step to the malicious code

Tactics: TA0001, TA0005
Techniques: T1189, T1140, T1036, T1027, T1027.001
Input: Ptrace system call injection is a method of executing arbitrary code in the address space of a separate live process.

Tactics: TA0004, TA0005
Techniques: T1055.008, T1055
Input: InvisiMole can function as a proxy to create a server that relays communication between the client and C&C server, or between two clients.

Tactics: TA0011
Techniques: T1090.001, T1090
Input: Meteor can use PowerShell commands to disable the network adapters on a victim machines.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Cannon can download a payload for execution.

Tactics: TA0011
Techniques: T1105
Input: Additionally, administrators can leverage audit tools to monitor actions that can be conducted as a result of OAuth 2.0 access.

Tactics: TA0005, TA0008
Techniques: T1550.001, T1550
Input: Certain methods of executing a program (namely using cmd.exe or the command-line) rely solely on the PATH environment variable to determine the locations that are searched for a program when the path for the program is not given.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.007, T1574
Input: Turian has the ability to use HTTP for its C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: One variant of BlackEnergy locates existing driver services that have been disabled and drops its driver component into one of those service's paths, replacing the legitimate executable.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.010, T1574
Input: The script writes files to the path % appdata %\Roaming\Microsoft\Templates\, then creates two task entries triggered to run daily.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Mandiant initially identified an early variant of the POSHSPY backdoor deployed as PowerShell scripts during an incident response engagement in 2015

Tactics: TA0002
Techniques: T1059.001, T1059
Input: APT3 has been known to stage files for exfiltration in a single location.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Audit local accounts permission levels routinely to look for situations that could allow an adversary to gain wide access by obtaining credentials of a privileged account.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.003
Input: Monitor for newly executed processes for unusual activity (, a process that does not use the network begins to do so).

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.006, T1574
Input: Monitor Launch Agent creation through additional plist files and utilities such as Objective-See’s KnockKnock application.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: Monitor for files (such as /etc/hosts) being accessed that may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system

Tactics: TA0007
Techniques: T1018
Input: APT18 actors used the native at Windows task scheduler tool to use scheduled tasks for execution on a victim network.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: Turla has modified variables in kernel memory to turn off Driver Signature Enforcement after exploiting vulnerabilities that obtained kernel mode privileges.

Tactics: TA0005
Techniques: T1553, T1553.006
Input: RainyDay can use a file exfiltration tool to collect recently changed files on a compromised host.

Tactics: TA0009
Techniques: T1005
Input: Pupy has a built-in module for port scanning.

Tactics: TA0007
Techniques: T1046
Input: Tropic Trooper has started a web service in the target host and wait for the adversary to connect, acting as a web shell.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to display network connections: netstat -ano >> %temp%\download

Tactics: TA0007
Techniques: T1049
Input: Binaries signed with trusted digital certificates can typically execute on Windows systems protected by digital signature validation.

Tactics: TA0005
Techniques: T1218
Input: Monitor for newly created windows registry keys that may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Pony has been delivered via spearphishing attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: RemoteCMD copies a file over to the remote system before execution.

Tactics: TA0011
Techniques: T1105
Input: Derusbi has used unencrypted HTTP on port 443 for C2.

Tactics: TA0011
Techniques: T1571
Input: Managed Defense reached out to the impacted customer’s security team, who confirmed the file was received via a LinkedIn message.

Tactics: TA0001
Techniques: T1566.003, T1566
Input: The malware uses obfuscation in order to hide strings such as URL or User-Agent, the algorithm is based on bitwise (SUB 0x0F XOR 0x21), here is the decoded data:hxxp://old[.]jrchina[.]com/btob_asiana/udel_confirm.phpMozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; Tablet PC 2.0; .NET4.0E; InfoPath.3)The downloaded third payload is obfuscated using the same technique

Tactics: TA0005, TA0007
Techniques: T1087, T1027
Input: Neoichor can collect the user name from a victim's machine.

Tactics: TA0007
Techniques: T1033
Input: Various Lazarus Group malware enumerates logged-on users.

Tactics: TA0007
Techniques: T1033
Input: Forward logging of historical data to remote data store and centralized logging solution to preserve historical command line log data.

Tactics: TA0005
Techniques: T1070, T1070.003
Input: CrackMapExec can execute remote commands using Windows Management Instrumentation.

Tactics: TA0002
Techniques: T1047
Input: Compare recent invocations of verclsid.exe with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity.

Tactics: TA0005
Techniques: T1218, T1218.012
Input: Limit the privileges of user accounts so that only authorized administrators can edit system environment variables.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.012, T1574
Input: Inception used a file hunting plugin to collect .txt, .pdf, .xls or .doc files from the infected host.

Tactics: TA0009
Techniques: T1005
Input: Sandworm Team has used the BlackEnergy KillDisk component to corrupt the infected system's master boot record.

Tactics: TA0040
Techniques: T1561, T1561.002
Input: RogueRobin uses various WMI queries to check if the sample is running in a sandbox.

Tactics: TA0002
Techniques: T1047
Input: To ensure its victim will use IE, it will terminate any process in-focus that is Chrome or Firefox, in hopes the victim will believe the browsers are “malfunctioning.” Whenever a victim uses IE and browses to specific Brazilian banks or businesses, the malware will only then begin to log keystrokes

Tactics: TA0006
Techniques: T1552.001, T1552
Input: These layers include the Operating Systems (OS), server applications such as web servers, DNS servers, databases, and the (typically web-based) applications that sit on top of them.

Tactics: TA0040
Techniques: T1499
Input: Drive-by content can be staged on adversary controlled infrastructure that has been acquired (Acquire Infrastructure) or previously compromised (Compromise Infrastructure).

Tactics: TA0042
Techniques: T1608.004, T1608
Input: POWRUNER may collect network configuration data by running ipconfig /all on a victim.

Tactics: TA0007
Techniques: T1016
Input: SUNBURST source code used generic variable names and pre-obfuscated strings, and was likely sanitized of developer comments before being added to SUNSPOT.

Tactics: TA0005
Techniques: T1027, T1027.005
Input: By manipulating transmitted data, adversaries may attempt to affect a business process, organizational understanding, and decision making.

Tactics: TA0040
Techniques: T1565, T1565.002
Input: In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library to create a scheduled task.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Adversaries can also leverage Dynamic Linker Hijacking to export variables in a shell or set variables programmatically using higher level syntax such Python’s os.environ.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.006, T1574
Input: Bandook has modules that are capable of capturing video from a victim's webcam.

Tactics: TA0009
Techniques: T1125
Input: For example, an adversary can use the PostMessage and/or SendMessage API functions to send LVM_SETITEMPOSITION and LVM_GETITEMPOSITION messages, effectively copying a payload 2 bytes at a time to the allocated memory.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.015
Input: HAMMERTOSS is controlled via commands that are appended to image files.

Tactics: TA0011
Techniques: T1001, T1001.002
Input: DownPaper collects the victim username and sends it to the C2 server.

Tactics: TA0007
Techniques: T1033
Input: certutil can be used to install browser root certificates as a precursor to performing Adversary-in-the-Middle between connections to banking websites.

Tactics: TA0005
Techniques: T1553, T1553.004
Input: Sometimes these credentials are used for automatic logons.

Tactics: TA0006
Techniques: T1552, T1552.002
Input: This file controls what mode SELinux is in.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: This traffic can be generated by a single system or multiple systems spread across the internet, which is commonly referred to as a distributed DoS (DDoS).

Tactics: TA0040
Techniques: T1498
Input: Adversaries may use Fast Flux DNS to hide a command and control channel behind an array of rapidly changing IP addresses linked to a single domain resolution.

Tactics: TA0011
Techniques: T1568.001, T1568
Input: The Bazar loader has named malicious shortcuts "adobe" and mimicked communications software.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: BADNEWS creates a scheduled task to establish by executing a malicious payload every subsequent minute.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Monitor for newly constructed files that may deface systems external to an organization in an attempt to deliver messaging, intimidate, or otherwise mislead an organization or users.

Tactics: TA0040
Techniques: T1491.002, T1491
Input: gh0st RAT is able to open a remote shell to execute commands.

Tactics: TA0002
Techniques: T1059
Input: Ajax Security Team has lured victims into executing malicious files.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: This technique may also enable Forced Authentication by injecting a SMB/HTTPS (or other credential prompting) URL and triggering an authentication attempt.

Tactics: TA0005
Techniques: T1221
Input: A wide variety of virtualization technologies exist that allow for the emulation of a computer or computing environment.

Tactics: TA0005
Techniques: T1564, T1564.006
Input: SpicyOmelette has the ability to execute arbitrary JavaScript code on a compromised host.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: OopsIE exfiltrates command output and collected files to its C2 server in 1500-byte blocks.

Tactics: TA0010
Techniques: T1030
Input: The PowerShell script collects all possible information on the user and the network, including snapshots, computer and user names, emails from registry, tasks in task scheduler, system information, AVs registered in the system, privileges, domain and workgroup information

Tactics: TA0007
Techniques: T1087
Input: A second remote access tool (RAT) could be uploaded at that point to redirect the host to the second-stage command and control server.

Tactics: TA0011
Techniques: T1104
Input: SLOTHFULMEDIA has the capability to stop processes and services.

Tactics: TA0040
Techniques: T1489
Input: استطلاع.docx https://0utl00k[.]net/docs    Table 1 Additional DarkHydrus Word documents used to steal credentials Both of these related documents use the attachedTemplate technique to steal credentials by sending them to a URL https://0utl00k[.]net/docs

Tactics: TA0006, TA0007
Techniques: T1552.001, T1552, T1003, T1018
Input: RATANKBA looking for specific IP ranges Our analysis of samples of the hack tool (HKTL_NBTSCAN.GA and HKTL_NBTSCAN.GB) indicate it as a command-line program that scans IP networks for NetBIOS information such as IP address, NetBIOS computer name, logged-in username, and MAC address—with some of the information coming from the initial RATAKNBA installation

Tactics: TA0007
Techniques: T1016
Input: %WINDIR%\AppPatch\custom & %WINDIR%\AppPatch\AppPatch64\Custom and

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: Skidmap is a kernel-mode rootkit used for cryptocurrency mining.

Tactics: TA0040
Techniques: T1496
Input: Maze has gathered all of the running system processes.

Tactics: TA0007
Techniques: T1057
Input: GreyEnergy can securely delete a file by hooking into the DeleteFileA and DeleteFileW functions in the Windows API.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: This group was observed using tactics such as registering typosquatting domains for security or technology vendors, abusing open-source penetration testing tools, and leveraging novel file types as anti-analysis techniques

Tactics: TA0007
Techniques: T1518.001, T1518
Input: RCSession can bypass UAC to escalate privileges.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Ursnif has injected code into target processes via thread local storage callbacks.

Tactics: TA0004, TA0005
Techniques: T1055.005, T1055
Input: APT28 uses a tool that captures information from air-gapped computers via an infected USB and transfers it to network-connected computer when the USB is inserted.

Tactics: TA0011
Techniques: T1092
Input: GuLoader has previously used RegAsm as a donor process.

Tactics: TA0004, TA0005
Techniques: T1055
Input: APT32's backdoor possesses the capability to list files and directories on a machine.

Tactics: TA0007
Techniques: T1083
Input: Adversaries may only need a lightweight setup if most of their activities will take place using online infrastructure.

Tactics: TA0042
Techniques: T1583.004, T1583
Input: To use this technique remotely, an adversary must use it in conjunction with RDP.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: FELIXROOT executes batch scripts on the victim’s machine, and can launch a reverse shell for command execution.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Monitor for Keychain Services API calls, specifically legacy extensions such as SecKeychainFindInternetPassword, that may collect Keychain data from a system to acquire credentials.

Tactics: TA0006
Techniques: T1555.001, T1555
Input: GOLD SOUTHFIELD has used the cloud-based remote management and monitoring tool "ConnectWise Control" to deploy REvil.

Tactics: TA0011
Techniques: T1219
Input: Mosquito uses a custom encryption algorithm, which consists of XOR and a stream that is similar to the Blum Blum Shub algorithm.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: APT33 has created a scheduled task to execute a .vbe file multiple times a day.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Carbon decrypts task and configuration files for execution.

Tactics: TA0005
Techniques: T1140
Input: APT39 has used SQL injection for initial compromise.

Tactics: TA0001
Techniques: T1190
Input: DDKONG lists files on the victim’s machine.

Tactics: TA0007
Techniques: T1083
Input: GoldMax has used HTTPS and HTTP GET requests with custom HTTP cookies for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: The group has also used certutil -decode to decode files on the victim’s machine when dropping UPPERCUT.

Tactics: TA0005
Techniques: T1140
Input: Hydraq C2 traffic is encrypted using bitwise NOT and XOR operations.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Shamoon can impersonate tokens using LogonUser, ImpersonateLoggedOnUser, and ImpersonateNamedPipeClient.

Tactics: TA0004, TA0005
Techniques: T1134, T1134.001
Input: Monitor and analyze activity related to items associated with CPL files, such as the control.exe.

Tactics: TA0005
Techniques: T1218, T1218.002
Input: NETWIRE has been executed through luring victims into opening malicious documents.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: TrickBot utilizes EternalBlue and EternalRomance exploits for lateral movement in the modules wormwinDll, wormDll, mwormDll, nwormDll, tabDll.

Tactics: TA0008
Techniques: T1210
Input: Dridex has encrypted traffic with RSA.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: To enable this traffic signaling on embedded devices, adversaries must first achieve and leverage Patch System Image due to the monolithic nature of the architecture.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205
Input: One of the tags in these files can be apple.awt.UIElement, which allows for Java applications to prevent the application's icon from appearing in the Dock.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: menuPass has resized and added data to the certificate table to enable the signing of modified files with legitimate signatures.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: TrickBot used COM to setup scheduled task for persistence.

Tactics: TA0002
Techniques: T1559, T1559.001
Input: Depending on the device, this attack may also result in Data Destruction.

Tactics: TA0040
Techniques: T1495
Input: Adversaries may stage collected data in a central location or directory on the local system prior to Exfiltration.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: The Carbanak malware communicates to its command server using HTTP with an encrypted payload.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: AutoIt backdoor has sent a C2 response that was base64-encoded.

Tactics: TA0011
Techniques: T1132.001, T1132