madox81/Adema_ATTACK_DS huggingface dataset:
Input: Operation Wocao has used Mimikatz's DCSync to dump credentials from the memory of the targeted system.

Tactics: TA0006
Techniques: T1003.006, T1003
Input: Valak can collect sensitive mailing information from Exchange servers, including credentials and the domain certificate of an enterprise.

Tactics: TA0009
Techniques: T1114, T1114.002
Input: Monitor requests of new ticket granting ticket or service tickets to a Domain Controller, such as Windows EID 4769 or 4768, that may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.

Tactics: TA0005, TA0008
Techniques: T1550
Input: The backdoor has the capability to download and upload files, execute shell commands, and update its configuration.

Tactics: TA0011
Techniques: T1105
Input: Sandworm Team added a login to a SQL Server with sp_addlinkedsrvlogin.

Tactics: TA0003
Techniques: T1136
Input: HELLOKITTY can enumerate logical drives on a target system.

Tactics: TA0007
Techniques: T1082
Input: Correlate other security systems with login information (, a user has the KRBTGT account password hash and forges Kerberos ticket-granting tickets).

Tactics: TA0006
Techniques: T1558, T1558.001
Input: ZxShell can kill AV products' processes.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Gorgon Group malware can download a remote access tool, ShiftyBug, and inject into another process.

Tactics: TA0004, TA0005
Techniques: T1055.002, T1055
Input: WhisperGate can delete tools from a compromised host after execution.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: If access to external resources over SMB and WebDAV is necessary, then traffic should be tightly limited with allowlisting.

Tactics: TA0006
Techniques: T1187
Input: To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disk content may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.

Tactics: TA0040
Techniques: T1561.001, T1561
Input: The default Keychain is the Login Keychain, which stores user passwords and information.

Tactics: TA0006
Techniques: T1555.001, T1555
Input: On Linux systems adversaries may launch dialog boxes prompting users for credentials from malicious shell scripts or the command line ( Unix Shell).

Tactics: TA0006, TA0009
Techniques: T1056.002, T1056
Input: Higaisa used a FakeTLS session for C2 communications.

Tactics: TA0011
Techniques: T1001, T1001.003
Input: Chimera has used type \\c$\Users\\Favorites\Links\Bookmarks bar\Imported From IE*citrix* for bookmark discovery.

Tactics: TA0007
Techniques: T1217
Input: PlugX can modify the characteristics of folders to hide them from the compromised user.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Backdoor.Oldrea can enumerate and map ICS-specific systems in victim environments.

Tactics: TA0007
Techniques: T1018
Input: Aria-body has the ability to gather TCP and UDP table status listings.

Tactics: TA0007
Techniques: T1049
Input: A much more advanced and highly obfuscated Javascript script was utilized in White Atlas samples that dropped a Firefox extension backdoor developed by Turla, but again the script was responsible for the simple tasks of writing out the extension.json configuration file for the extension and deleting itself for cleanup purposes

Tactics: TA0002, TA0005
Techniques: T1070, T1027, T1070.004, T1059
Input: Naikon uses commands such as netsh advfirewall firewall to discover local firewall settings.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: TinyTurla has the ability to act as a second-stage dropper used to infect the system with additional malware.

Tactics: TA0011
Techniques: T1105
Input: KONNI has created a shortcut called "Anti virus service.lnk" in an apparent attempt to masquerade as a legitimate file.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: However, if you DO get infected, you’ll want to delete the following registry keys (if they exist): HKLM/System/CurrentControlSet/Services/DirecastX ytasda jrqq HKLM/System/CurrentControlSet/Services/DirectX yta jsdrq HKLM/System/CurrentControlSet/Services/DirectX ytsda jrq Additionally, you’ll want to delete any copies of “svchost.exe” that you find in %Program Files (x86)%/DIFXE/, as these are the dropped copies of the malware

Tactics: TA0005
Techniques: T1070, T1112, T1070.004
Input: SILENTTRINITY's credphisher.py module can prompt a current user for their credentials.

Tactics: TA0006, TA0009
Techniques: T1056.002, T1056
Input: Monitor for newly constructed files that may use scripts automatically executed at boot or logon initialization to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1037
Input: SILENTTRINITY can enumerate processes, including properties to determine if they have the Common Language Runtime (CLR) loaded.

Tactics: TA0007
Techniques: T1057
Input: Information about physical locations of a target organization may include a variety of details, including where key resources and infrastructure are housed.

Tactics: TA0043
Techniques: T1591, T1591.001
Input: PowerDuke has a command to get text of the current foreground window.

Tactics: TA0007
Techniques: T1010
Input: This may mitigate, or at least alleviate, the scope of AiTM activity.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: RogueRobin uses WMI to check BIOS version for VBOX, bochs, qemu, virtualbox, and vm to check for evidence that the script might be executing within an analysis environment.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Forged SAML tokens enable adversaries to authenticate across services that use SAML 2.0 as an SSO (single sign-on) mechanism.

Tactics: TA0006
Techniques: T1606, T1606.002
Input: BADFLICK has download files from its C2 server.

Tactics: TA0011
Techniques: T1105
Input: Sandworm Team has used Base64 encoding within malware variants.

Tactics: TA0005
Techniques: T1027
Input: Frankenstein has deobfuscated base64-encoded commands following the execution of a malicious script, which revealed a small script designed to obtain an additional payload.

Tactics: TA0005
Techniques: T1140
Input: Confucius has created scheduled tasks to maintain persistence on a compromised host.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: If installing itself as a service fails, Elise instead writes itself as a file named svchost.exe saved in %APPDATA%\Microsoft\Network.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: The text of the spearphishing email usually tries to give a plausible reason why the file should be filled-in, such as a request for information from a business associate.

Tactics: TA0043
Techniques: T1598.002, T1598
Input: Ensure Domain Controller backups are properly secured.

Tactics: TA0006
Techniques: T1003.003, T1003
Input: TA505 has used HTTP to communicate with C2 nodes.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Too strict a policy may create a denial of service condition and render environments un-usable, with all accounts used in the brute force being locked-out.

Tactics: TA0006
Techniques: T1110.004, T1110, T1110.001, T1110.003
Input: Other Control Panel items will have registration entries in the CPLs and Extended Properties Registry keys of HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Control Panel.

Tactics: TA0005
Techniques: T1218, T1218.002
Input: The servers use a different static key to encrypt replies to the implant.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: The initial DNS query sent by the payload to obtain the system specific identifier uses the following structure, which includes the current process identifier (PID) as the subdomain of the C2 domain: <current process id>.<c2 domain> The C2 server will provide the system specific identifier within the answer portion of the DNS response

Tactics: TA0011
Techniques: T1071
Input: Encrypt all important data flows to reduce the impact of tailored modifications on data in transit.

Tactics: TA0040
Techniques: T1565, T1565.002
Input: This functionality resides in NTDLL.dll and is part of the Windows Native API which is called from functions like CreateProcess, LoadLibrary,  of the Win32 API.

Tactics: TA0002
Techniques: T1129
Input: Kimsuky has used an instrumentor script to gather the names of all services running on a victim's system.

Tactics: TA0007
Techniques: T1007
Input: AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

Tactics: TA0002
Techniques: T1059.002, T1059
Input: FoggyWeb has used a dynamic XOR key and custom XOR methodology for C2 communications.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Umbreon provides additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205
Input: Monitor executed commands with arguments to install or modify login hooks.

Tactics: TA0003, TA0004
Techniques: T1037.002, T1037
Input: Monitor for the usage of unexpected or unusual cookies to access resources and services.

Tactics: TA0006
Techniques: T1606, T1606.001
Input: Use multi-factor authentication for user and privileged accounts.

Tactics: TA0003, TA0005, TA0006
Techniques: T1601, T1136, T1136.001, T1136.003, T1556, T1136.002, T1556.004, T1601.001, T1098.002, T1098.001, T1098, T1098.003
Input: Like past attacks, the initial infection vector is a malicious Word document attached to a phishing email that is well-tailored to the targeted business and its day-to-day operations

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Monitor for API calls that may employ various time-based methods to detect and avoid virtualization and analysis environments.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Turla has used malware obtained after compromising other threat actors, such as OilRig.

Tactics: TA0042
Techniques: T1588, T1588.001
Input: Cobalt Strike can hash functions to obfuscate calls to the Windows API and use a public/private key pair to encrypt Beacon session metadata.

Tactics: TA0005
Techniques: T1027
Input: Impacket modules like GetUserSPNs can be used to get Service Principal Names (SPNs) for user accounts.

Tactics: TA0006
Techniques: T1558.003, T1558
Input: Magic Hound malware has used VBS scripts for execution.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: This execution may also bypass AppLocker and other application control defenses since CMSTP.exe is a legitimate binary that may be signed by Microsoft.

Tactics: TA0005
Techniques: T1218, T1218.003
Input: RobbinHood will search for Windows services that are associated with antivirus software on the system and kill the process.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Empire has modules for enumerating domain trusts.

Tactics: TA0007
Techniques: T1482
Input: MechaFlounder has the ability to use HTTP in communication with C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: CrackMapExec can create a registry key using wdigest.

Tactics: TA0005
Techniques: T1112
Input: Revenge RAT is a simple and freely available Remote Access Trojan that automatically gathers system information before allowing threat actors to remotely access system components such as webcams, microphones, and various other utilities

Tactics: TA0007
Techniques: T1082
Input: Prevent users from changing the HISTCONTROL, HISTFILE, and HISTFILESIZE environment variables.

Tactics: TA0005
Techniques: T1562.003, T1562
Input: FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.

Tactics: TA0011
Techniques: T1572, T1573, T1573.002
Input: Adversaries may create self-signed SSL/TLS certificates that can be used during targeting.

Tactics: TA0042
Techniques: T1587, T1587.003
Input: Kobalos's authentication and key exchange is performed using RSA-512.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: SynAck lists all the keyboard layouts installed on the victim’s system using GetKeyboardLayoutList API and checks against a hardcoded language code list.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: Winnti for Windows sets its DLL file as a new service in the Registry to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: APT29 registered devices in order to enable mailbox syncing via the Set-CASMailbox command.

Tactics: TA0003
Techniques: T1098.005, T1098
Input: Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries.

Tactics: TA0003, TA0004
Techniques: T1546
Input: PowerShower has the ability to save and execute VBScript.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Sandworm Team has created VBScripts to run an SSH server.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Other factors, such as access patterns and activity that occurs after a remote login, may indicate suspicious or malicious behavior with SSH.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: OLDBAIT can use HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Proxysvc lists processes running on the system.

Tactics: TA0007
Techniques: T1057
Input: Leviathan has obfuscated code using base64 and gzip compression.

Tactics: TA0005
Techniques: T1027
Input: Turla has created web accounts including Dropbox and GitHub for C2 and document exfiltration.

Tactics: TA0042
Techniques: T1583.006, T1583
Input: Other types of virtualization and application microsegmentation may also mitigate the impact of some types of exploitation.

Tactics: TA0004, TA0005, TA0008
Techniques: T1210, T1211, T1068
Input: The Windows event logs,  Event ID 524 indicating a system catalog was deleted, may contain entries associated with suspicious activity.

Tactics: TA0040
Techniques: T1490
Input: SideTwist can use GetUserNameW, GetComputerNameW, and GetComputerNameExW to gather information.

Tactics: TA0002
Techniques: T1106
Input: Periodically baseline cloud storage infrastructure to identify malicious modifications or additions.

Tactics: TA0010
Techniques: T1537
Input: The executable obtains an embedded PowerShell script, decrypts it using RC4, then decompresses it using ZLIB, and saves the cleartext to C:\Users\<username>\AppData\Roaming\Out.jpg

Tactics: TA0007
Techniques: T1033
Input: SoreFang can enumerate processes on a victim machine through use of Tasklist.

Tactics: TA0007
Techniques: T1057
Input: Service paths  and shortcut paths may also be vulnerable to path interception if the path has one or more spaces and is not surrounded by quotation marks (, C:\unsafe path with space\program.exe vs. "C:\safe path with space\program.exe").

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.009, T1574
Input: MiniDuke uses Google Search to identify C2 servers if its primary C2 method via Twitter is not working.

Tactics: TA0011
Techniques: T1008
Input: Monitor for new files added to the /Library/LaunchDaemons/ folder.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: Utilizing an existing persona with a compromised email account may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona.

Tactics: TA0042
Techniques: T1586.002, T1586
Input: DarkWatchman can retrieve browser history.

Tactics: TA0007
Techniques: T1217
Input: RGDoor executes the whoami on the victim’s machine.

Tactics: TA0007
Techniques: T1033
Input: Monitor executed commands and arguments for actions that could be taken to collect files from a system's connected removable media.

Tactics: TA0009
Techniques: T1025
Input: Cyclops Blink can modify the Linux iptables firewall to enable C2 communication via a stored list of port numbers.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: The LNK file is moved to the startup directory

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Sibot can download and execute a payload onto a compromised system.

Tactics: TA0011
Techniques: T1105
Input: Protocols such as FTP, FTPS, and TFTP that transfer files may be very common in environments.

Tactics: TA0011
Techniques: T1071.002, T1071
Input: It also can delete temporary files and itself after the initial script executes.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Kimsuky has also used an instrumentor script to terminate browser processes running on an infected system and then delete the cookie files on disk.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: OSX_OCEANLOTUS.D can use the touch -t command to change timestamps.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: Baseline and periodically analyze the Configuration partition of the AD schema and alert on creation of nTDSDSA objects.

Tactics: TA0005
Techniques: T1207
Input: Evilnum has sent spearphishing emails designed to trick the recipient into opening malicious shortcut links which downloads a .LNK file.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Use application control configured to block execution of verclsid.exe if it is not required for a given system or network to prevent potential misuse by adversaries.

Tactics: TA0005
Techniques: T1218, T1218.012
Input: Monitor external websites for unplanned content changes.

Tactics: TA0040
Techniques: T1491.002, T1491
Input: Agent.btz attempts to download an encrypted binary from a specified domain.

Tactics: TA0011
Techniques: T1105
Input: For example, with a cloud-based email service once an OAuth access token is granted to a malicious application, it can potentially gain long-term access to features of the user account if a "refresh" token enabling background access is awarded.

Tactics: TA0005, TA0008
Techniques: T1550.001, T1550
Input: RedLeaves attempts to add a shortcut file in the Startup folder to achieve persistence.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547.001, T1547
Input: Cryptoistic can scan a directory to identify files for deletion.

Tactics: TA0007
Techniques: T1083
Input: Gelsemium can download additional plug-ins to a compromised host.

Tactics: TA0011
Techniques: T1105
Input: What does the Poseidon Group do? What happens after a target machine is infected? Once the target’s machine is compromised, the attacker first enumerates all processes running in the system and all services

Tactics: TA0007
Techniques: T1057
Input: Koadic can use mshta to serve additional payloads and to help schedule tasks for persistence.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: Stuxnet uses an RPC server that contains a routine for file deletion and also removes itself from the system through a DLL export by deleting specific files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: KONNI has used HTTP POST for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: It maintains both code and data in the raw, encrypted blobs of data to be decrypted and used at runtime, and hidden functionality that isn’t exposed until runtime

Tactics: TA0005
Techniques: T1140
Input: ZIRCONIUM has exfiltrated stolen data to Dropbox.

Tactics: TA0010
Techniques: T1567.002, T1567
Input: Service principal names (SPNs) are used to uniquely identify each instance of a Windows service.

Tactics: TA0006
Techniques: T1558.003, T1558
Input: njRAT can identify remote hosts on connected networks.

Tactics: TA0007
Techniques: T1018
Input: If the original process and thread are running under a higher permissions level, then the replaced binary will also execute under higher-level permissions, which could include SYSTEM.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.010, T1574.005, T1574
Input: Turla RPC backdoors can impersonate or steal process tokens before executing commands.

Tactics: TA0004, TA0005
Techniques: T1134.002, T1134
Input: It allows adversaries to bypass the standard authentication system to use a defined password for all accounts authenticating to that domain controller.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.001
Input: DRATzarus can enumerate and examine running processes to determine if a debugger is present.

Tactics: TA0007
Techniques: T1057
Input: Catchamas obtains application windows titles and then determines which windows to perform Screen Capture on.

Tactics: TA0007
Techniques: T1010
Input: Adversaries may gather information in an attempt to calculate the geographical location of a victim host.

Tactics: TA0007
Techniques: T1614
Input: Prior to targeting, adversaries may compromise the infrastructure of other adversaries.

Tactics: TA0042
Techniques: T1584
Input: WarzoneRAT has been distributed as a malicious attachment within an email.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: This effectively routes SOGU malware traffic through the victim’s service provider, which likely indicates a foothold on the service provider’s network

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Machete’s collected files are exfiltrated automatically to remote servers.

Tactics: TA0010
Techniques: T1020
Input: DCSync functionality has been included in the "lsadump" module in Mimikatz.

Tactics: TA0006
Techniques: T1003.006, T1003
Input: Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users.

Tactics: TA0005
Techniques: T1564.002, T1564
Input: FIN6 has encoded data gathered from the victim with a simple substitution cipher and single-byte XOR using the 0xAA key, and Base64 with character permutation.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: Encryption using public key cryptography requires the adversary to obtain the private certificate along with an encryption key to decrypt messages.

Tactics: TA0009
Techniques: T1114, T1114.002, T1114.001, T1114.003
Input: CARROTBAT has the ability to delete downloaded files from a compromised host.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges.

Tactics: TA0004, TA0005
Techniques: T1055.009, T1055.008, T1055.003, T1055.004, T1055.011, T1055.002, T1055.014, T1055.005, T1055, T1055.001
Input: Gamaredon Group has used modules that automatically upload gathered documents to the C2 server.

Tactics: TA0010
Techniques: T1020
Input: Kessel can use a proxy during exfiltration if set in the configuration.

Tactics: TA0011
Techniques: T1090
Input: APT41 has encrypted payloads using the Data Protection API (DPAPI), which relies on keys tied to specific user accounts on specific machines.

Tactics: TA0005
Techniques: T1480, T1480.001
Input: EKANS stops database, data backup solution, antivirus, and ICS-related processes.

Tactics: TA0040
Techniques: T1489
Input: Darkhotel has also stolen certificates and signed backdoors and downloaders with them.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Adversaries may create email accounts that can be used during targeting.

Tactics: TA0042
Techniques: T1585, T1585.002
Input: Monitor for changes made to files that may attempt to hide artifacts associated with their behaviors to evade detection.

Tactics: TA0005
Techniques: T1564
Input: The ARP protocol is used to resolve IPv4 addresses to link layer addresses, such as a media access control (MAC) address.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.002
Input: CARROTBALL has the ability to use FTP in C2 communications.

Tactics: TA0011
Techniques: T1071.002, T1071
Input: Adversaries can replace accessibility features binaries with alternate binaries to execute this technique.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: ChChes establishes persistence by adding a Registry Run key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: BlackEnergy has used Systeminfo to gather the OS version, as well as information on the system configuration, BIOS, the motherboard, and the processor.

Tactics: TA0007
Techniques: T1082
Input: Rocke has used Python-based malware to install and spread their coinminer.

Tactics: TA0002
Techniques: T1059.006, T1059