madox81/Adema_ATTACK_DS huggingface dataset:
Input: Kimsuky has obtained and used tools such as Nirsoft WebBrowserPassVIew, Mimikatz, and PsExec.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: This value will serve as the program that will be executed when a user logs into the computer.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.014
Input: The tampered function is typically invoked using a Windows message.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.013, T1574
Input: Monitor contextual data about a running process, which may include information such as environment variables, image name, user/owner that may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions.

Tactics: TA0004, TA0005
Techniques: T1548
Input: Rising Sun can detect the username of the infected host.

Tactics: TA0007
Techniques: T1033
Input: EvilGrab has the capability to capture video from a victim machine.

Tactics: TA0009
Techniques: T1125
Input: Compare recent invocations of regsvr32.exe with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Malicious Macro Analysis When the victim opens the ThreeDollars document they are presented with the lure image and prompted to click on the “Enable Content” button

Tactics: TA0002
Techniques: T1204
Input: REvil can force a reboot in safe mode with networking.

Tactics: TA0005
Techniques: T1562.009, T1562
Input: Ajax Security Team has used CWoolger and MPK, custom-developed malware, which recorded all keystrokes on an infected system.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: These vulnerabilities include:CVE-2015-6585: Hangul Word Processor VulnerabilityCVE-2015-8651: Adobe Flash Player 18.0.0.324 and 19.x VulnerabilityCVE-2016-0034: Microsoft Silverlight 5.1.41212.0 VulnerabilityCVE-2016-1019: Adobe Flash Player 21.0.0.197 VulnerabilityCVE-2016-4117: Adobe Flash Player 21.0.0.226 VulnerabilityDHS recommends that organizations upgrade these applications to the latest version and patch level

Tactics: TA0002, TA0004
Techniques: T1203, T1068
Input: Attack chain of Tropic Trooper’s operations Here’s a summary of the attack chain of Tropic Trooper’s recent campaigns:  Execute a command through exploits for CVE-2017-11882 or CVE-2018-0802, security flaws in Microsoft Office’s Equation Editor (EQNEDT32.EXE)

Tactics: TA0002
Techniques: T1203
Input: Proton uses VNC to connect into systems.

Tactics: TA0008
Techniques: T1021.005, T1021
Input: KONNI has encrypted data and files prior to exfiltration.

Tactics: TA0009
Techniques: T1560
Input: SECOND STAGE JAVASCRIPT INTO POWERSHELL: The second stage JavaScript creates a PowerShell file with the same name in the same directory

Tactics: TA0002, TA0003, TA0004
Techniques: T1547.001, T1547, T1059.001, T1059
Input: Adversaries may schedule data exfiltration to be performed only at certain times of day or at certain intervals.

Tactics: TA0010
Techniques: T1029
Input: Fgdump can dump Windows password hashes.

Tactics: TA0006
Techniques: T1003, T1003.002
Input: APT32's backdoor has used LZMA compression and RC4 encryption before exfiltration.

Tactics: TA0009
Techniques: T1560
Input: Cadelspy has the ability to discover information about the compromised host.

Tactics: TA0007
Techniques: T1082
Input: Valak has the ability to modify the Registry key HKCU\Software\ApplicationContainer\Appsw64 to store information regarding the C2 server and downloads.

Tactics: TA0005
Techniques: T1112
Input: APT38 has used DYEPACK to manipulate SWIFT messages en route to a printer.

Tactics: TA0040
Techniques: T1565, T1565.002
Input: Malicious document used by Tropic Trooper PDB Strings as Context Clues The MSI file has two program database (PDB) strings inside: one belonging to the MSI file, and another for the backdoor installer (detected by Trend Micro as TROJ_TCDROP.ZTFB)

Tactics: TA0005
Techniques: T1140
Input: GALLIUM used whoami and query user to obtain information about the victim user.

Tactics: TA0007
Techniques: T1033
Input: APT33 has used malicious e-mail attachments to lure victims into executing malware.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: For each user, this file resides at the same location: ~/.bash_history.

Tactics: TA0006
Techniques: T1552.003, T1552
Input: AppleSeed can zip and encrypt data collected on a target system.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Drovorub can exfiltrate files over C2 infrastructure.

Tactics: TA0010
Techniques: T1041
Input: For example, at the end of 2016 CTU researchers observed the threat actors using native system functionality to disable logging processes and delete logs within a network

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Whitefly has encrypted the payload used for C2.

Tactics: TA0005
Techniques: T1027
Input: A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

Tactics: TA0005
Techniques: T1564, T1564.009
Input: MuddyWater has used scheduled tasks to establish persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Monitor for contextual data about a firewall and activity around it such as name, policy, or status

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Monitor for events associated with scripting execution, such as process activity, usage of the Windows Script Host (typically cscript.exe or wscript.exe), file activity involving scripts

Tactics: TA0002
Techniques: T1059.007, T1059
Input: APT39 has used a screen capture utility to take screenshots on a compromised host.

Tactics: TA0009
Techniques: T1113
Input: menuPass stages data prior to exfiltration in multi-part archives, often saved in the Recycle Bin.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Agent Tesla has used the Rijndael symmetric encryption algorithm to encrypt strings.

Tactics: TA0005
Techniques: T1027
Input: Do not allow a user to be a local administrator for multiple systems.

Tactics: TA0005, TA0008
Techniques: T1550.003, T1550
Input: Operation Wocao has collected a list of open connections on the infected system using netstat and checks whether it has an internet connection.

Tactics: TA0007
Techniques: T1049
Input: TA551 has used spoofed company emails that were acquired from email clients on previously infected hosts to target other individuals.

Tactics: TA0043
Techniques: T1589.002, T1589
Input: Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.

Tactics: TA0043, TA0001
Techniques: T1598.002, T1566, T1566.002, T1566.001, T1598
Input: HOPLIGHT has used svchost.exe to execute a malicious DLL .

Tactics: TA0002
Techniques: T1569.002, T1569
Input: GravityRAT uses the netstat command to find open ports on the victim’s machine.

Tactics: TA0007
Techniques: T1049
Input: Zebrocy  has used a method similar to RC4 as well as AES for encryption and hexadecimal for encoding data before exfiltration.

Tactics: TA0009
Techniques: T1560
Input: Threat actors can query nameservers for a target organization directly, or search through centralized repositories of logged DNS query responses (known as passive DNS).

Tactics: TA0043
Techniques: T1596, T1596.001
Input: Lokibot has used LoadLibrary(), GetProcAddress() and CreateRemoteThread() API functions to execute its shellcode.

Tactics: TA0002
Techniques: T1106
Input: Enable the Hardened Runtime capability when developing applications.

Tactics: TA0002
Techniques: T1559
Input: Adversaries may install a root certificate on a compromised system to avoid warnings when connecting to adversary controlled web servers.

Tactics: TA0005
Techniques: T1553, T1553.004
Input: Most email clients allow users to create inbox rules for various email functions, including forwarding to a different recipient.

Tactics: TA0009
Techniques: T1114, T1114.003
Input: Third-party entities can include technology companies that specialize in malware development, criminal marketplaces (including Malware-as-a-Service, or MaaS), or from individuals.

Tactics: TA0042
Techniques: T1588, T1588.001
Input: FIN6 has renamed the "psexec" service name to "mstdc" to masquerade as a legitimate Windows service.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: NetBIOS / SMB / Samba (139/TCP & 445/TCP)

Tactics: TA0006
Techniques: T1110.004, T1110, T1110.001, T1110.003
Input: menuPass has leveraged vulnerabilities in Pulse Secure VPNs to hijack sessions.

Tactics: TA0001
Techniques: T1190
Input: APT28 has collected files from various information repositories.

Tactics: TA0009
Techniques: T1213
Input: StreamEx uses rundll32 to call an exported function.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: ListPlanting is a method of executing arbitrary code in the address space of a separate live process.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.015
Input: Eventually it will start new processes with the stored token attached.

Tactics: TA0004, TA0005
Techniques: T1134
Input: Non-standard process execution trees may also indicate suspicious or malicious behavior, such as if hh.exe is the parent process for suspicious processes and activity relating to other adversarial techniques.

Tactics: TA0005
Techniques: T1218, T1218.001
Input: A module in Prikormka collects information from the victim about the current user name.

Tactics: TA0007
Techniques: T1033
Input: Mis-Type network traffic can communicate over a raw socket.

Tactics: TA0011
Techniques: T1095
Input: DDE could also be leveraged by an adversary operating on a compromised machine who does not have direct access to a Command and Scripting Interpreter.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: GoldMax will check if it is being run in a virtualized environment by comparing the collected MAC address to c8:27:cc:c2:37:5a.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: RedLeaves has encrypted C2 traffic with RC4, previously using keys of 88888888 and babybear.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Bandook was signed with valid Certum certificates.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: CARROTBAT itself is a dropper that allows an attacker to drop and open an embedded decoy file, followed by the execution of a command that will download and run a payload on the targeted machine

Tactics: TA0011
Techniques: T1105
Input: Monitor internal and websites for unplanned content changes.

Tactics: TA0040
Techniques: T1491.001, T1491
Input: SUNBURST used the WMI query Select * From Win32_SystemDriver to retrieve a driver listing.

Tactics: TA0002
Techniques: T1047
Input: With both an inserted card and access to the smart card password, an adversary can connect to a network resource using the infected system to proxy the authentication with the inserted hardware token.

Tactics: TA0006
Techniques: T1111
Input: A Threat Group-3390 tool can use a public UAC bypass method to elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Periodically baseline cloud block storage volumes to identify malicious modifications or additions.

Tactics: TA0005
Techniques: T1578
Input: FLASHFLOOD also collects information stored in the Windows Address Book.

Tactics: TA0009
Techniques: T1005
Input: Browser bookmarks may also highlight additional targets after an adversary has access to valid credentials, especially Credentials In Files associated with logins cached by a browser.

Tactics: TA0007
Techniques: T1217
Input: The generation of web cookies often requires secret values, such as passwords, Private Keys, or other cryptographic seed values.

Tactics: TA0006
Techniques: T1606, T1606.001
Input: Higaisa has called various native OS APIs.

Tactics: TA0002
Techniques: T1106
Input: The group also side-loads its backdoor by dropping a library and a legitimate, signed executable (AcroTranscoder).

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: The main function of the dropper All strings within the dropper, as well as the backdoor, are encrypted using a hardcoded RSA256 key

Tactics: TA0005
Techniques: T1140, T1027
Input: HyperBro has used a legitimate application to sideload a DLL to decrypt, decompress, and run a payload.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: APT33 has obtained and leveraged publicly-available tools for early intrusion activities.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Goopy has the ability to communicate with its C2 over DNS.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Waterbear can receive and load executables from remote C2 servers.

Tactics: TA0011
Techniques: T1105
Input: The HermeticWiper executable has been signed with a legitimate certificate issued to Hermetica Digital Ltd.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: TeamTNT has established tmate sessions for C2 communications.

Tactics: TA0011
Techniques: T1219
Input: Final1stspy obfuscates strings with base64 encoding.

Tactics: TA0005
Techniques: T1027
Input: JHUHUGIT obtains a build identifier as well as victim hard drive information from Windows registry key HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum.

Tactics: TA0007
Techniques: T1082
Input: Winnti for Linux can encode its configuration file with single-byte XOR encoding.

Tactics: TA0005
Techniques: T1027
Input: 2 Downloads a file to the system

Tactics: TA0011
Techniques: T1105
Input: The shellcode executed by this command is the same as in the delivery documents as well, specifically taken from Metasploit to obtain additional shellcode to execute using an HTTP request to the following URL: http://www7.chrome-up[.]date/0m5EE We are unsure of the shellcode hosted at this URL, as we were unable to coerce the C2 server to provide a payload

Tactics: TA0011
Techniques: T1071
Input: Peirates can gain a reverse shell on a host node by mounting the Kubernetes hostPath.

Tactics: TA0004
Techniques: T1611
Input: Emotet has been observed leveraging a module that retrieves passwords stored on a system for the current logged-on user.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: Dragonfly has obtained and used tools such as Mimikatz, CrackMapExec, and PsExec.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may leverage information repositories to mine valuable information.

Tactics: TA0009
Techniques: T1213
Input: This can allow an adversary access to other containerized resources from the host level or to the host itself.

Tactics: TA0004
Techniques: T1611
Input: Hildegard has used an IRC channel for C2 communications.

Tactics: TA0011
Techniques: T1071
Input: Links may also lead users to download files that require execution via Malicious File.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.

Tactics: TA0005
Techniques: T1014
Input: Ebury has used a DGA to generate a domain name for C2.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: KARAE can use public cloud-based storage providers for command and control.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: China Chopper's server component is a Web Shell payload.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: LoudMiner used SCP to update the miner from the C2.

Tactics: TA0011
Techniques: T1105
Input: Information about an organization’s business relationships may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, ) that have connected (and potentially elevated) network access.

Tactics: TA0043
Techniques: T1591.002, T1591
Input: Avenger can extract backdoor malware from downloaded images.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: Monitor newly executed processes that may attempt to find cloud groups and permission settings.

Tactics: TA0007
Techniques: T1069, T1069.003
Input: Revenge RAT has the ability to access the webcam.

Tactics: TA0009
Techniques: T1125
Input: All hooks require administrator permissions to modify or create hooks.

Tactics: TA0003, TA0004
Techniques: T1037.002, T1037
Input: DarkVishnya used ports 5190 and 7900 for shellcode listeners, and 4444, 4445, 31337 for shellcode C2.

Tactics: TA0011
Techniques: T1571
Input: Wizard Spider has accessed victim networks by using stolen credentials to access the corporate VPN infrastructure.

Tactics: TA0001, TA0003
Techniques: T1133
Input: APT41 has also environmentally keyed second stage malware with an RC5 key derived in part from the infected system's volume serial number.

Tactics: TA0005
Techniques: T1480, T1480.001
Input: The program calling the API may also load world writable files which can be modified to perform malicious behavior with elevated privileges.

Tactics: TA0004, TA0005
Techniques: T1548.004, T1548
Input: GoldMax can exfiltrate files over the existing C2 channel.

Tactics: TA0010
Techniques: T1041
Input: When the technique is performed on the running operating system in memory and not on the stored copy, this technique will not survive across reboots.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: FIN10 has established persistence by using the Registry option in PowerShell Empire to add a Run key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: DarkWatchman can track key presses with a keylogger module.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: KONNI can steal profiles (containing credential information) from Firefox, Chrome, and Opera.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: KillDisk uses VMProtect to make reverse engineering the malware more difficult.

Tactics: TA0005
Techniques: T1027
Input: Gelsemium can decompress and decrypt DLLs and shellcode.

Tactics: TA0005
Techniques: T1140
Input: Tropic Trooper has used scripts to collect the host's network topology.

Tactics: TA0007
Techniques: T1016
Input: APT38 has used the Windows API to execute code within a victim's system.

Tactics: TA0002
Techniques: T1106
Input: Adversaries may search network shares on computers they have compromised to find files of interest.

Tactics: TA0009
Techniques: T1039
Input: Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes, that may use Valid Accounts to log into a service specifically designed to accept remote connections, such as telnet, SSH, and VNC.

Tactics: TA0008
Techniques: T1021
Input: Monitor executed commands and arguments that may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.

Tactics: TA0006
Techniques: T1110
Input: The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at HKLM\SOFTWARE\Microsoft\Netsh.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.007
Input: SUNSPOT monitored running processes for instances of MsBuild.exe by hashing the name of each running process and comparing it to the corresponding value 0x53D525.

Tactics: TA0007
Techniques: T1057
Input: Threat Group-3390 has extensively used strategic web compromises to target victims.

Tactics: TA0001
Techniques: T1189
Input: Empire can use TLS to encrypt its C2 channel.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: HotCroissant has the ability to upload a file from the command and control (C2) server to the victim machine.

Tactics: TA0011
Techniques: T1105
Input: Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053
Input: GrimAgent has the ability to download and execute additional payloads.

Tactics: TA0011
Techniques: T1105
Input: DarkWatchman has used a DGA to generate a domain name for C2.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: Code repositories are often accessible via an API (ex: https://api.github.com).

Tactics: TA0010
Techniques: T1567.001, T1567
Input: The “Excel” command receives another stage of the PowerShell code, saves it in “c:\programdata\a.ps1” and then asks Excel to execute this PowerShell script via DDE

Tactics: TA0002
Techniques: T1059.001, T1059
Input: AppleJeus has placed a plist file within the LaunchDaemons folder and launched it manually.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: ABK can extract a malicious Portable Executable (PE) from a photo.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: By utilizing a web service, adversaries can make it difficult to physically tie back operations to them.

Tactics: TA0042
Techniques: T1583.006, T1583
Input: Chrommme can use Windows API including WinExec for execution.

Tactics: TA0002
Techniques: T1106
Input: Bisonal has deleted Registry keys to clean up its prior activity.

Tactics: TA0005
Techniques: T1112
Input: APT1 used the net use command to get a listing on network connections.

Tactics: TA0007
Techniques: T1049
Input: Emotet has been observed creating new services to maintain persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: CaddyWiper can also halt execution if the compromised host is identified as a domain controller.

Tactics: TA0007
Techniques: T1082
Input: IronNetInjector can use an IronPython scripts to load a .NET injector to inject a payload into its own or a remote process.

Tactics: TA0004, TA0005
Techniques: T1055
Input: MegaCortex has deleted volume shadow copies using vssadmin.exe.

Tactics: TA0040
Techniques: T1490
Input: Vulnerabilities may exist in defensive security software that can be used to disable or circumvent them.

Tactics: TA0005
Techniques: T1211
Input: Monitor for contextual data about an account, which may include a username, user ID, environmental data that may mask the presence of user accounts they create or modify.

Tactics: TA0005
Techniques: T1564.002, T1564
Input: APT-C-36 has used a macro function to set scheduled tasks, disguised as those used by Google.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms.

Tactics: TA0002
Techniques: T1059
Input: ZIRCONIUM has used a tool to enumerate proxy settings in the target environment.

Tactics: TA0007
Techniques: T1016
Input: DarkComet can disable Security Center functions like anti-virus.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Gorgon Group malware can deactivate security mechanisms in Microsoft Office by editing several keys and values under HKCU\Software\Microsoft\Office\.

Tactics: TA0005
Techniques: T1112
Input: FIN7 used JavaScript scripts to help perform tasks on the victim's machine.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: This file is usually found in the user's home directory under <user-home>/.ssh/authorized_keys.

Tactics: TA0003
Techniques: T1098.004, T1098
Input: Spark has checked the results of the GetKeyboardLayoutList and the language name returned by GetLocaleInfoA to make sure they contain the word "Arabic" before executing.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: Cobalt Strike can install a new service.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: For example, after dropping a driver file (ex: .sys) to disk, the payload can be loaded and registered via Native API functions such as CreateServiceW() (or manually via functions such as ZwLoadDriver() and ZwSetValueKey()), by creating the required service Registry values ( Modify Registry), or by using command-line utilities such as PnPUtil.exe.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Uroburos uses a custom packer.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Bisonal can check to determine if the compromised system is running on VMware.

Tactics: TA0005, TA0007
Techniques: T1497
Input: APT39 used Remexi to collect usernames from the system.

Tactics: TA0007
Techniques: T1033
Input: ShadowPad has collected the domain name of the victim system.

Tactics: TA0007
Techniques: T1016
Input: GRIFFON has used a reconnaissance module that can be used to retrieve Windows domain membership information.

Tactics: TA0007
Techniques: T1069.002, T1069