madox81/Adema_ATTACK_DS huggingface dataset:
Input: Alternatively, adversaries may choose to find and target vulnerable binaries with the setuid or setgid bits already enabled ( File and Directory Discovery).

Tactics: TA0004, TA0005
Techniques: T1548, T1548.001
Input: EvilBunny has exploited CVE-2011-4369, a vulnerability in the PRC component in Adobe Reader.

Tactics: TA0002
Techniques: T1203
Input: Pasam creates a backdoor through which remote attackers can retrieve files.

Tactics: TA0009
Techniques: T1005
Input: Do not allow administrator accounts that have permissions to add IIS components to be used for day-to-day operations that may expose these permissions to potential adversaries and/or other unprivileged systems.

Tactics: TA0003
Techniques: T1505.004, T1505
Input: Bandook has modules that are capable of capturing audio.

Tactics: TA0009
Techniques: T1123
Input: An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.

Tactics: TA0006, TA0007
Techniques: T1040
Input: LockerGoga installation has been immediately preceded by a "task kill" command in order to disable anti-virus.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Adversaries may abuse the print spooler service by adding print processors that load malicious DLLs at startup.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.012
Input: KOCTOPUS has added and deleted keys from the Registry.

Tactics: TA0005
Techniques: T1112
Input: This function is able to obfuscate code so that every iteration of the code is presented differently

Tactics: TA0005
Techniques: T1140
Input: Tools such as PsExec and sc.exe can accept remote servers as arguments and may be used to conduct remote execution.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Disable Bluetooth in local computer security settings or by group policy if it is not needed within an environment.

Tactics: TA0010
Techniques: T1011.001, T1011
Input: Use of the non-public PowerShell backdoor previously described by Morphisec and MalwareBytes (which we refer to as POWERSTATS)

Tactics: TA0002
Techniques: T1059.001, T1059
Input: POWRUNER will send the captured screenshot image file to the C2 server if the “fileupload” command is issued

Tactics: TA0009
Techniques: T1113
Input: Frankenstein has uploaded and downloaded files to utilize additional plugins.

Tactics: TA0011
Techniques: T1105
Input: Kerberos authentication can be used as the first step to lateral movement to a remote system.

Tactics: TA0005, TA0008
Techniques: T1550.003, T1550
Input: HALFBAKED can obtain information about the OS, processor, and BIOS.

Tactics: TA0007
Techniques: T1082
Input: Denylist Python where not required.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Green Lambert can use DNS for C2 communications.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Monitor for networks that solicits and obtains the configuration information of the queried device

Tactics: TA0001
Techniques: T1189
Input: Specific checks will vary based on the target and/or adversary, but may involve behaviors such as Windows Management Instrumentation, PowerShell, System Information Discovery, and Query Registry to obtain system information and search for VME artifacts.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Wingbird uses services.exe to register a new autostart service named "Audit Service" using a copy of the local lsass.exe file.

Tactics: TA0002, TA0003, TA0004
Techniques: T1569.002, T1543.003, T1543, T1569
Input: Grant access to application deployment systems only to a limited number of authorized administrators.

Tactics: TA0002, TA0008
Techniques: T1072
Input: Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: FIN5 scripts save memory dump data into a specific directory on hosts in the victim environment.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: ZeroT gathers the victim's computer name, Windows version, and system language, and then sends it to its C2 server.

Tactics: TA0007
Techniques: T1082
Input: The real file extension may be hidden by the operating system in the file browser (ex: explorer.exe), as well as in any software configured using or similar to the system’s policies.

Tactics: TA0005
Techniques: T1036, T1036.007
Input: KOCTOPUS can use the LoadResource and CreateProcessW APIs for execution.

Tactics: TA0002
Techniques: T1106
Input: APT1 has collected files from a local victim.

Tactics: TA0009
Techniques: T1005
Input: Analysis should attempt to relate shortcut file change events to other potentially suspicious events based on known adversary behavior such as process launches of unknown executables that make network connections.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel.

Tactics: TA0010
Techniques: T1048, T1048.001
Input: The alerting system should be thoroughly investigated beyond that initial alert for activity that was not detected.

Tactics: TA0005
Techniques: T1027, T1027.005
Input: Gamaredon Group has used VNC tools, including UltraVNC, to remotely interact with compromised hosts.

Tactics: TA0008
Techniques: T1021.005, T1021
Input: BLINDINGCAN has downloaded files to a victim machine.

Tactics: TA0011
Techniques: T1105
Input: The group has also used torrent file-sharing sites to more indiscriminately disseminate malware to victims.

Tactics: TA0001
Techniques: T1189
Input: RedLeaves is capable of downloading a file from a specified URL.

Tactics: TA0011
Techniques: T1105
Input: Backdoor.Oldrea writes collected data to a temporary file in an encrypted form before exfiltration to a C2 server.

Tactics: TA0009
Techniques: T1560
Input: These platforms may not be well maintained and may break intermittently

Tactics: TA0007
Techniques: T1083
Input: Monitor for an extracted list of available groups and/or their associated setting

Tactics: TA0007
Techniques: T1069, T1069.003
Input: To enable the setgit bit, chmod 2775 and chmod g+s can be used.

Tactics: TA0004, TA0005
Techniques: T1548, T1548.001
Input: Monitor for process being viewed that may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: They can modify the tool by removing the indicator and using the updated version that is no longer detected by the target's defensive systems or subsequent targets that may use similar systems.

Tactics: TA0005
Techniques: T1027, T1027.005
Input: Daserf uses HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: For example, "example.exe" runs "cmd.exe" with the command-line argument net user.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.008, T1574
Input: PHOREAL is capable of manipulating the Registry.

Tactics: TA0005
Techniques: T1112
Input: Kessel's configuration is hardcoded and RC4 encrypted within the binary.

Tactics: TA0005
Techniques: T1027
Input: Chaes has used search order hijacking to load a malicious DLL.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Ke3chang has used a tool known as RemoteExec (similar to PsExec) to remotely execute batch scripts and binaries.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Inception has used VBScript to execute malicious commands and payloads.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Emotet has been observed to hook network APIs to monitor network traffic.

Tactics: TA0006, TA0007
Techniques: T1040
Input: The adversary may then perform actions as the logged-on user.

Tactics: TA0008
Techniques: T1021.003, T1021.001, T1021, T1021.002, T1021.004, T1021.006
Input: On Windows 10, enable Attack Surface Reduction (ASR) rules to secure LSASS and prevent credential stealing.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Lazarus Group has used rundll32 to execute malicious payloads on a compromised host.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Ferocious can delete files from a compromised host.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: The threat actor’s main objective for using this RAT (known as Razy/NeD worm/Wonder Botnet) was obvious from the victim data that was collected – it was to search for specific file extensions such as PDF, DOC, DOCX, XLS, and XLSX, where they are compressed in RAR files per category, stored in temp directories within a folder named by victim ID (bot ID – long MD5 string), encrypted and uploaded to the C2

Tactics: TA0007, TA0009, TA0011
Techniques: T1005, T1090.003, T1083, T1090, T1074
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may rely upon specific actions by a user in order to gain execution.

Tactics: TA0002
Techniques: T1204
Input: As part of the anti-debugging or anti-monitoring techniques, ShellTea iterates over all the running processes, applies CRC32 on each process name (after converting the string to capital letters), and then compares the value against a predefined set of CRCs.

Tactics: TA0007
Techniques: T1057
Input: PoetRAT has executed a Lua script through a Lua interpreter for Windows.

Tactics: TA0002
Techniques: T1059
Input: Sandworm Team has registered domain names and created URLs that are often designed to mimic or spoof legitimate websites, such as email login pages, online file sharing and storage websites, and password reset pages.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: REvil has used obfuscated VBA macros for execution.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Adversaries may also directly modify the search order via DLL redirection, which after being enabled (in the Registry and creation of a redirection file) may cause a program to load a different DLL.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Sys10 collects the account name of the logged-in user and sends it to the C2.

Tactics: TA0007
Techniques: T1033
Input: Forensic techniques exist to identify information stored in NTFS EA.

Tactics: TA0005
Techniques: T1564, T1564.004
Input: Torisma can collect the local MAC address using GetAdaptersInfo as well as the system's IP address.

Tactics: TA0007
Techniques: T1016
Input: Furthermore, EID 400 may indicate the start time and EID 403 indicates the end time of a PowerShell session.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Also look for abnormal process call trees for execution of other commands that could relate to Discovery actions or other techniques.

Tactics: TA0003, TA0004
Techniques: T1546
Input: NBT-NS identifies systems on a local network by their NetBIOS name.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: Command and Control Infrastructure: Compromised servers, messaging platforms, and cloud service providers to avoid detection

Tactics: TA0011
Techniques: T1102
Input: Some Brave Prince variants have used South  Korea's Daum email service to exfiltrate information, and later variants have posted the data to a web server via an HTTP post command.

Tactics: TA0010
Techniques: T1048.003, T1048
Input: Remove unnecessary accounts and groups from Remote Desktop Users groups.

Tactics: TA0008
Techniques: T1563.002, T1021.001, T1021, T1563
Input: Agent Tesla can collect the timestamp from the victim’s machine.

Tactics: TA0007
Techniques: T1124
Input: POSHSPY uses a DGA to derive command and control URLs from a word list.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: Sandworm Team has used remote administration tools or remote industrial control system client software to maliciously release electricity breakers.

Tactics: TA0011
Techniques: T1219
Input: BRONZE BUTLER malware has used HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Andariel has used the netstat -naop tcp command to display TCP connections on a victim's machine.

Tactics: TA0007
Techniques: T1049
Input: Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts.

Tactics: TA0040
Techniques: T1531
Input: FIN6 has used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.

Tactics: TA0002
Techniques: T1059
Input: Zebrocy has used URL/Percent Encoding on data exfiltrated via HTTP POST requests.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: APT41 created and modified startup files for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Finally the script deletes the shadow copies, in a preparation for the ransomware operations.

Tactics: TA0040
Techniques: T1490
Input: WINERACK can enumerate processes.

Tactics: TA0007
Techniques: T1057
Input: Lokibot has the ability to discover the computer name and Windows product name/version.

Tactics: TA0007
Techniques: T1082
Input: Lazarus Group has deployed malware designed not to run on computers set to Korean, Japanese, or Chinese in Windows language preferences.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: A complete wipe of all disk sectors may be attempted.

Tactics: TA0040
Techniques: T1561
Input: PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit path interception opportunities in the PATH environment variable.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.007, T1574
Input: WhisperGate can use a Visual Basic script to exclude the C:\ drive from Windows Defender.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Monitor executed commands and arguments that may attempt to exfiltrate data over a different network medium than the command and control channel

Tactics: TA0010
Techniques: T1011
Input: Other methods may rely on specific user interaction with the system before the malicious code is activated, such as waiting for a document to close before activating a macro  or waiting for a user to double click on an embedded image to activate.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.002
Input: Kazuar can also be configured to inject and execute within specific processes.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: ObliqueRAT can hide its payload in BMP images hosted on compromised websites.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: powershell.exe -w 1 -exec Bypass -nologo -noprofile -c iex([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String((get-content C:\ProgramData\ZIPSDK\ProjectConfManagerNT.ini))));  PowerShell one-liner Encoded text file Execution flow:  The PowerShell code When PowerShell is invoked whether via WMI, wscript.exe, or mshta.exe, it executes a one-liner PowerShell code (as outlined above) that reads the encoded text file dropped in ProgramData and then decodes it

Tactics: TA0002, TA0005
Techniques: T1036, T1059.001, T1059
Input: GRIFFON has used a reconnaissance module that can be used to retrieve information about a victim's computer, including the resolution of the workstation .

Tactics: TA0007
Techniques: T1082
Input: AppleJeus has exfiltrated collected host information to a C2 server.

Tactics: TA0010
Techniques: T1041
Input: The associated Registry key is located at HKLM\SYSTEM\CurrentControlSet\Control\Lsa\SubmitControl.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053, T1053.002
Input: BADNEWS copies files with certain extensions from USB devices toa predefined directory.

Tactics: TA0009
Techniques: T1025
Input: SDBbot has the ability to get directory listings or drive information on a compromised host.

Tactics: TA0007
Techniques: T1083
Input: This information may be used to shape follow-on behaviors, including whether the adversary infects the target and/or attempts specific actions.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: MirageFox is likely loaded via DLL hijacking into a legitimate McAfee binary.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: jRAT can capture microphone recordings.

Tactics: TA0009
Techniques: T1123
Input: Adversaries can hide a program's true filetype by changing the extension of a file.

Tactics: TA0005
Techniques: T1036.006, T1036
Input: Here is the registry creation:The registry location where persistence is achieved is: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update

Tactics: TA0003, TA0004, TA0005, TA0007
Techniques: T1547.001, T1547, T1112, T1012
Input: The two variants of MPK share the same registry key that the Trojan uses to automatically run each time the system starts, specifically: [HKLM and HKCU]\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\explorer Both MPK variants include key loggers that are extremely similar in functionality in addition to having the same strings used for headers within the key log file

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: This allows the adversary to gain information without making any API requests.

Tactics: TA0007
Techniques: T1538
Input: Adversaries may abuse Visual Basic (VB) for execution.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Andariel has used a variety of publicly-available remote access Trojans (RATs) for its operations.

Tactics: TA0042
Techniques: T1588, T1588.001
Input: SUNBURST delivered different payloads, including TEARDROP in at least one instance.

Tactics: TA0011
Techniques: T1105
Input: FIN7 has used TightVNC to control compromised hosts.

Tactics: TA0008
Techniques: T1021.005, T1021
Input: NotPetya can use wmic to help propagate itself across a network.

Tactics: TA0002
Techniques: T1047
Input: This is a classic RAT that can download, upload, execute commands on the victim host and, finally, perform keylogging

Tactics: TA0006, TA0009, TA0011
Techniques: T1105, T1056
Input: EnvyScout can deobfuscate and write malicious ISO files to disk.

Tactics: TA0005
Techniques: T1140
Input: Adversaries may modify code signing policies to enable execution of unsigned or self-signed code.

Tactics: TA0005
Techniques: T1553, T1553.006
Input: Hydraq creates a backdoor through which remote attackers can read data from files.

Tactics: TA0009
Techniques: T1005
Input: Use of the RTLO character has been seen in many targeted intrusion attempts and criminal activity.

Tactics: TA0005
Techniques: T1036, T1036.002
Input: This is most likely meant to be a mechanism to update the compromised host with a new version of the LOWBALL malware.

Tactics: TA0011
Techniques: T1105
Input: BendyBear can query the host's Registry key at HKEY_CURRENT_USER\Console\QuickEdit to retrieve data.

Tactics: TA0007
Techniques: T1012
Input: Monitor network connections involving common remote management protocols, such as ports tcp:3283 and tcp:5900, as well as ports tcp: 3389 and tcp:22 for remote login.

Tactics: TA0008
Techniques: T1021
Input: Wizard Spider has used WMI to identify anti-virus products installed on a victim's machine.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Calisto has the capability to use rm -rf to remove folders and files from the victim's machine.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: MuddyWater has performed credential dumping with LaZagne.

Tactics: TA0006
Techniques: T1003, T1003.004, T1003.005
Input: Koadic can use Regsvr32 to execute additional payloads.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: The SHAPESHIFT malware is capable of wiping disks, erasing volumes and deleting files, depending on its configuration

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Finally, the malware executes the extracted install.bat script before deleting the original files and exiting

Tactics: TA0002, TA0005
Techniques: T1070, T1070.004, T1059
Input: APT33 has sent spearphishing e-mails with archive attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: A snapshot is a point-in-time copy of an existing cloud compute component such as a virtual machine (VM), virtual hard drive, or volume.

Tactics: TA0005
Techniques: T1578, T1578.001
Input: Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt.

Tactics: TA0006, TA0009
Techniques: T1056.002, T1056
Input: Bad Rabbit’s infpub.dat file uses NTLM login credentials to brute force Windows machines.

Tactics: TA0006
Techniques: T1110, T1110.003
Input: APT3 will identify Microsoft Office documents on the victim's computer.

Tactics: TA0009
Techniques: T1005
Input: Some vendors of embedded network devices provide cryptographic signing to ensure the integrity of operating system images at boot time.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: Goopy has used a polymorphic decryptor to decrypt itself at runtime.

Tactics: TA0005
Techniques: T1140
Input: They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it.

Tactics: TA0005
Techniques: T1140
Input: Cobalt Strike can use a custom command and control protocol that can be encapsulated in HTTP or HTTPS.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Monitor executed commands with arguments that may be used to collect Keychain data from a system to acquire credentials.

Tactics: TA0006
Techniques: T1555.001, T1555
Input: Machete collects stored credentials from several web browsers.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: SharpStage can execute arbitrary commands with the command line.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: .service files are Systemd Service unit files that are managed by the systemd system and service manager.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.006, T1053
Input: The malware performs the following activities:  Builds imports by dynamically loading APIs Decrypts strings needed for control server communications Performs control server communications Handles commands issued by the control server Uninstalls self from the system  The malicious thread dynamically loads the APIs it needs at the beginning of its execution using LoadLibrary() and GetProcAddress()

Tactics: TA0010
Techniques: T1041
Input: Monitor for newly executed processes that may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.

Tactics: TA0005
Techniques: T1027
Input: Lokibot has demonstrated the ability to steal credentials from multiple applications and data sources including Safari and the Chromium and Mozilla Firefox-based web browsers.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Detection efforts may be focused on related follow-on behavior, such as Code Signing or Install Root Certificate.

Tactics: TA0042
Techniques: T1587.002, T1588, T1587, T1588.003
Input: Kivars has the ability to conceal its activity through hiding active windows.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Anti-virus can potentially detect malicious documents and files that are downloaded and executed on the user's computer.

Tactics: TA0002
Techniques: T1204
Input: SDBbot has the ability to download a DLL from C2 to a compromised host.

Tactics: TA0011
Techniques: T1105
Input: Outlook forms are used as templates for presentation and functionality in Outlook messages.

Tactics: TA0003
Techniques: T1137, T1137.003
Input: Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

Tactics: TA0040
Techniques: T1499, T1499.004
Input: Update corporate policies to restrict what types of third-party applications may be added to any online service or tool that is linked to the company's information, accounts or network (, Google, Microsoft, Dropbox, Basecamp, GitHub).

Tactics: TA0005, TA0008
Techniques: T1550.001, T1550
Input: GRIFFON is written in and executed as JavaScript.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: TA505 has used the tool EmailStealer to steal and send lists of e-mail addresses to a remote server.

Tactics: TA0007
Techniques: T1087.003, T1087
Input: XTunnel is capable of probing the network for open ports.

Tactics: TA0007
Techniques: T1046