madox81/Adema_ATTACK_DS huggingface dataset:
Input: Empire can add a SID-History to a user if on a domain controller.

Tactics: TA0004, TA0005
Techniques: T1134.005, T1134
Input: Monitor for newly constructed files for payloads

Tactics: TA0005
Techniques: T1027.004, T1027
Input: IOCs Domain supservermgr[.]com URL hxxp://supservermgr[.]com/sys/upd/pageupd.php Zebrocy d697160aecf152a81a89a6b5a7d9e1b8b5e121724038c676157ac72f20364edc cba5ab65a24be52214736bc1a5bc984953a9c15d0a3826d5b15e94036e5497df 25f0d1cbcc53d8cfd6d848e12895ce376fbbfaf279be591774b28f70852a4fd8 115fd8c619fa173622c7a1e84efdf6fed08a25d3ca3095404dcbd5ac3deb1f03 f27836430742c9e014e1b080d89c47e43db299c2e00d0c0801a2830b41b57bc1 5b5e80f63c04402d0b282e95e32155b2f86cf604a6837853ab467111d4ac15e2 dd7e69e14c88972ac173132b90b3f4bfb2d1faec15cca256a256dd3a12b6e75d Koadic abbad7acd50754f096fdc6551e728aa6054dcf8e55946f90a02b17db552471ca User Agents Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30; .NET CLR 3.0.04506.648; InfoPath.1) Mozilla/5.0 (Windows NT 6.1; WOW64) WinHttp/1.6.3.8 (WinHTTP/5.1) like Gecko Mozilla v5.1 (Windows NT 6.1; rv:6.0.1) Gecko/20100101 Firefox/6.0.1 IPs 185.25.51[.]198 185.25.50[.]93 220.158.216[.]127 92.114.92[.]102 86.106.131[.]177  DDE Docs 85da72c7dbf5da543e10f3f806afd4ebf133f27b6af7859aded2c3a6eced2fd5 8cf3bc2bf36342e844e9c8108393562538a9af2a1011c80bb46416c0572c86ff

Tactics: TA0007
Techniques: T1087
Input: Monitor newly executed processes that may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources.

Tactics: TA0040
Techniques: T1561
Input: A TYPEFRAME variant can force the compromised system to function as a proxy server.

Tactics: TA0011
Techniques: T1090
Input: Monitor for API calls that may acquire credentials from web browsers by reading files specific to the target browser.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: OilRig has used sc query on a victim to gather information about services.

Tactics: TA0007
Techniques: T1007
Input: Data from these solutions can be retrieved directly using the cloud provider's APIs.

Tactics: TA0009
Techniques: T1530
Input: IcedID can use a self signed TLS certificate in connection with the spoofed site and simultaneously maintains a live connection with the legitimate site to display the correct URL and certificates in the browser.

Tactics: TA0009
Techniques: T1185
Input: Adversaries can create social media accounts that can be used to build a persona to further operations.

Tactics: TA0042
Techniques: T1585, T1585.001
Input: Zeus Panda collects the OS version, system architecture, computer name, product ID, install date, and information on the keyboard mapping to determine the language used on the system.

Tactics: TA0007
Techniques: T1082
Input: Monitor for contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, etc that would aid in the manipulation of data to hide activity

Tactics: TA0040
Techniques: T1565.003, T1565
Input: TinyZBot contains keylogger functionality.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Honeybee uses a batch file to load a DLL into the svchost.exe process.

Tactics: TA0004, TA0005
Techniques: T1055
Input: TClient is injected into dllhost.exe Malware Analysis  wab32res.dll (FakeRun loader) loads TClient

Tactics: TA0004, TA0005
Techniques: T1055
Input: CHOPSTICK is capable of performing keylogging.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: IcedID can query LDAP to identify additional users on the network to infect.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: A notable characteristic of CopyKittens is the use of DNS for command and control communication (C&C) and for data exfiltration

Tactics: TA0011
Techniques: T1132
Input: Rancor has used VBS scripts as well as embedded macros for execution.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Monitor executed commands and arguments for binaries that could be involved in data destruction activity, such as SDelete.

Tactics: TA0040
Techniques: T1485
Input: Network devices such as routers and firewalls that connect multiple networks together may implement NAT during the process of passing packets between networks.

Tactics: TA0005
Techniques: T1599, T1599.001
Input: ShadowPad has collected the current date and time of the victim system.

Tactics: TA0007
Techniques: T1124
Input: PoetRAT sent username, computer name, and the previously generated UUID in reply to a "who" command from C2.

Tactics: TA0007
Techniques: T1033
Input: Avenger has the ability to identify the host volume ID and the OS architecture on a compromised host.

Tactics: TA0007
Techniques: T1082
Input: An adversary may use cron in Linux or Unix environments to execute programs at system startup or on a scheduled basis for Persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: Threat Group-3390 malware has used HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: CharmPower has the ability to enumerate Uninstall registry values.

Tactics: TA0007
Techniques: T1012
Input: Registry key “Software\Microsoft\Windows\CurrentVersion\Internet Settings\” is queried to gather proxy information with values ProxyEnable, Proxy: (NO), Proxy, ProxyServer

Tactics: TA0007, TA0011
Techniques: T1012, T1090
Input: NETWIRE has used a custom obfuscation algorithm to hide strings including Registry keys, APIs, and DLL names.

Tactics: TA0005
Techniques: T1027
Input: Gorgon Group malware can use PowerShell commands to download and execute a payload and open a decoy document on the victim’s machine.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Adversaries may attempt to find group and permission settings.

Tactics: TA0007
Techniques: T1069
Input: Ke3chang malware RoyalDNS has used DNS for C2.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Injects ma32.dll into “wwahost.exe” or “audacity.exe”

Tactics: TA0004, TA0005
Techniques: T1055
Input: Kazuar also obfuscates the name of created files/folders/mutexes and encrypts debug messages written to log files using the Rijndael cipher.

Tactics: TA0005
Techniques: T1027
Input: Monitor unusual connections or connection attempts to the device that may specifically target TFTP or other file-sharing protocols.

Tactics: TA0003, TA0005
Techniques: T1542.005, T1542
Input: Grandoreiro can identify installed security tools based on window names.

Tactics: TA0007
Techniques: T1010
Input: Process command-line arguments are stored in the process environment block (PEB), a data structure used by Windows to store various information about/used by a process.

Tactics: TA0005
Techniques: T1564.010, T1564
Input: Kimsuky has run reg add ‘HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList’ /v to hide a newly created user.

Tactics: TA0005
Techniques: T1564.002, T1564
Input: For example, AWS provides a DescribeInstances API within the Amazon EC2 API that can return information about one or more instances within an account, the ListBuckets API that returns a list of all buckets owned by the authenticated sender of the request, the HeadBucket API to determine a bucket’s existence along with access permissions of the request sender, or the GetPublicAccessBlock API to retrieve access block configuration for a bucket.

Tactics: TA0007
Techniques: T1580
Input: Although deprecated in favor of Scheduled Task's schtasks in Windows environments, using at requires that the Task Scheduler service be running, and the user to be logged on as a member of the local Administrators group.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: Collect authentication logs and analyze for unusual access patterns, windows of activity, and access outside of normal business hours.

Tactics: TA0001, TA0003
Techniques: T1133
Input: Monitor for unexpected deletion of a cloud storage infrastructure, such as the DeleteDBCluster and DeleteGlobalCluster events in AWS, or a high quantity of data deletion events, such as DeleteBucket.

Tactics: TA0040
Techniques: T1485
Input: Whitefly has used malicious .exe or .dll files disguised as documents or images.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: If running with administrator privileges on a 32-bit host:  Copy the temporary DLL in %TEMP% to %WINDOWS%\LINKINFO.dll   Otherwise:  Copy the temporary DLL in %TEMP% to %APPDATA%\cnagnt.dll Delete the temporary DLL in %TEMP% Write a ‘Conime.lnk’ file in the user’s startup path

Tactics: TA0003, TA0004, TA0005
Techniques: T1070, T1574.001, T1574.002, T1070.004, T1055, T1574
Input: RATANKBA uses netstat -ano to search for specific IP address ranges.

Tactics: TA0007
Techniques: T1049
Input: down_new has the ability to detect anti-virus products and processes on a compromised host.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: This links the previous samples with this unique username

Tactics: TA0007
Techniques: T1033
Input: These devices could include the motherboard, hard drive, or video cards.

Tactics: TA0040
Techniques: T1495
Input: Wizard Spider has used cmd.exe to execute commands on a victim's machine.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Commercial and open source products can be leveraged with capabilities such as passive network tapping, network traffic modification ( Adversary-in-the-Middle), keystroke injection, kernel memory reading via DMA, addition of new wireless access to an existing network, and others.

Tactics: TA0001
Techniques: T1200
Input: APT1 has created email accounts for later use in social engineering, phishing, and when registering domains.

Tactics: TA0042
Techniques: T1585, T1585.002
Input: APT19 downloaded and launched code within a SCT file.

Tactics: TA0002
Techniques: T1059
Input: Exfiltration Over Alternative Protocol can be done using various common operating system utilities such as Net/SMB or FTP.

Tactics: TA0010
Techniques: T1048
Input: Taidoor has downloaded additional files onto a compromised host.

Tactics: TA0011
Techniques: T1105
Input: Volgmer uses a simple XOR cipher to encrypt traffic and files.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Adversaries may create, acquire, or steal code signing materials to sign their malware or tools.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: HOPLIGHT has injected into running processes.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Operation Wocao has deleted logs and executable files used during an intrusion.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: CrossRAT creates a Launch Agent on macOS.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: JPIN can enumerate drives and their types.

Tactics: TA0007
Techniques: T1083
Input: Objective-See's Dylib Hijacking Scanner can be used to identify applications vulnerable to dylib hijacking

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.004, T1574
Input: Aquatic Panda has attempted to discover third party endpoint detection and response (EDR) tools on compromised systems.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Malicious files will be transmitted directly as attachments or through links to download them.

Tactics: TA0002
Techniques: T1203
Input: Prevent users from installing their own launch agents or launch daemons.

Tactics: TA0002
Techniques: T1569.001, T1569
Input: The communication and exfiltration of data was detected in a real-world scenario using the Cybereason platform

Tactics: TA0011
Techniques: T1132
Input: Aria-body has used ZIP to compress data gathered on a compromised host.

Tactics: TA0009
Techniques: T1560
Input: More generally, adversaries can conduct non-targeted phishing, such as in mass credential harvesting campaigns.

Tactics: TA0043
Techniques: T1598
Input: These redirects were implemented by adding two malicious scripts obfuscated by a tool similar to the Dean Edwards packer

Tactics: TA0005
Techniques: T1027
Input: Remexi uses AutoIt and VBS scripts throughout its execution process.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Pay2Key can encrypt data on victim's machines using RSA and AES algorithms in order to extort a ransom payment for decryption.

Tactics: TA0040
Techniques: T1486
Input: The values of the keys listed are commands that are executed when the handler opens the file extension.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.001
Input: BackConfig has the ability to use scheduled tasks to repeatedly execute malicious payloads on a compromised host.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: There is no documented method for defenders to directly identify behaviors that reduce encryption key space.

Tactics: TA0005
Techniques: T1600.001, T1600, T1600.002
Input: Stuxnet encodes the payload of system information sent to the command and control servers using a one byte 0xFF XOR key.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Mitigation Security and system/IT administrators must practice due diligence in protecting their websites and web-based applications from threats that can undermine their security, and hijack them to do the bad guys’ bidding—delivering malware to their victims

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Darkhotel has used malware that repeatedly checks the mouse cursor position to determine if a real user is on the system.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.002
Input: Monitor network traffic for WMI connections; the use of WMI in environments that do not typically use WMI may be suspect.

Tactics: TA0002
Techniques: T1047
Input: MoonWind can obtain the victim hostname, Windows version, RAM amount, number of drives, and screen resolution.

Tactics: TA0007
Techniques: T1082
Input: BlackEnergy injects its DLL component into svchost.exe.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: adbupd can use a WMI script to achieve persistence.

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: TAINTEDSCRIBE uses a Linear Feedback Shift Register (LFSR) algorithm for network encryption.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.

Tactics: TA0001, TA0002, TA0003, TA0004, TA0005, TA0008
Techniques: T1053.005, T1053, T1021, T1021.002, T1078
Input: APT38 has used rundll32.exe to execute binaries, scripts, and Control Panel Item files and to execute code via proxy to avoid triggering security tools.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Zox has used the .PNG file format for C2 communications.

Tactics: TA0011
Techniques: T1001, T1001.002
Input: Hijacking DLL loads may be for the purpose of establishing persistence as well as elevating privileges and/or evading restrictions on file execution.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: ShimRat has installed shim databases in the AppPatch folder.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: SDBbot has the ability to use image file execution options for persistence if it detects it is running with admin privileges on a Windows version newer than Windows 7.

Tactics: TA0003, TA0004
Techniques: T1546.012, T1546
Input: After Comnie has been copied to the %TEMP% directory, it will look for the presence of the ‘DQuit.tmp’ file in this path

Tactics: TA0009
Techniques: T1074
Input: Adversaries may compromise email accounts that can be used during targeting.

Tactics: TA0042
Techniques: T1586.002, T1586
Input: Metamorfo has used native WINAPI calls.

Tactics: TA0002
Techniques: T1106
Input: PowerShell command Description   ‘gwmi -query “select * from win32_BIOS where SMBIOSBIOSVERSION LIKE ‘%VBOX%'” Query attempts to detect VirtualBox environment from the win32_BIOS WMI class   gwmi -query “select * from win32_BIOS where SMBIOSBIOSVERSION LIKE ‘%bochs%'” Query attempts to detect Bochs environment from the win32_BIOS WMI class   gwmi -query “select * from win32_BIOS where SMBIOSBIOSVERSION LIKE ‘%qemu%'” Query attempts to detect QEMU environment from the win32_BIOS WMI class   gwmi -query “select * from win32_BIOS where SMBIOSBIOSVERSION LIKE ‘%VirtualBox%'” Query attempts to detect VirtualBox environment from the win32_BIOS WMI class   gwmi -query “select * from win32_BIOS where SMBIOSBIOSVERSION LIKE ‘%VM%'” Query attempts to detect VMWare environment from the win32_BIOS WMI class   gwmi -query “Select * from win32_BIOS where Manufacturer LIKE ‘%XEN%'” Query attempts to detect Xen environment from the win32_BIOS WMI class   gwmi win32_computersystem Uses this query to check the system information for the string “VMware”

Tactics: TA0002, TA0005, TA0007
Techniques: T1497, T1007, T1070, T1047, T1012, T1135, T1069, T1070.004, T1018
Input: Chimera has used net localgroup administrators to identify  accounts with local administrative rights.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: Outlook stores data locally in offline data files with an extension of .ost.

Tactics: TA0009
Techniques: T1114, T1114.001
Input: Renaming abusable system utilities to evade security monitoring is also a form of Masquerading.

Tactics: TA0005
Techniques: T1036
Input: Monitor cloud service usage for anomalous behavior that may indicate adversarial presence within the environment.

Tactics: TA0007
Techniques: T1046, T1526
Input: Monitor newly executed processes associated with account creation, such as net.exe

Tactics: TA0003
Techniques: T1136, T1136.001, T1136.002
Input: The contents within the releasenotes.txt file (SHA256: bf925f340920111b385078f3785f486fff1096fd0847b993892ff1ee3580fa9d)  contains the following formula that Excel will save to the “A0” cell in the worksheet:  The formula uses a command prompt to run a PowerShell script that attempts to download and execute a second PowerShell script hosted at the URL hxxp://micrrosoft[.]net/winupdate.ps1

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Chimera has collected data of interest from network shares.

Tactics: TA0009
Techniques: T1039
Input: Analyze new Control Panel items as well as those present on disk for malicious content.

Tactics: TA0005
Techniques: T1218, T1218.002
Input: Adversaries may develop malware and malware components that can be used during targeting.

Tactics: TA0042
Techniques: T1587, T1587.001
Input: It can also change file permissions using cacls.exe.

Tactics: TA0007
Techniques: T1083
Input: Parameter   Description    ‘u=’  This parameter contains target machine information in the following format: <Computer Name>, <User Name>, <Windows Versions>, <Processor Architecture>, <1.3>, < KdfrJKN >, <Volume Serial Number>    ‘&h=’  This parameter includes the information about the command executed and its results

Tactics: TA0007
Techniques: T1082
Input: Ensure only valid password filters are registered.

Tactics: TA0003, TA0005, TA0006, TA0007
Techniques: T1556.002, T1556, T1201
Input: The group has also sent spearphishing emails that contained malicious Microsoft Office documents that use the "attachedTemplate" technique to load a template from a remote server.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Identify and block potentially malicious software executed through AppCertDLLs functionality by using application control  tools, like Windows Defender Application Control, AppLocker,   or Software Restriction Policies  where appropriate.

Tactics: TA0003, TA0004
Techniques: T1546.009, T1546
Input: Because some programs do not call other programs using the full path, adversaries may place their own file in the directory where the calling program is located, causing the operating system to launch their malicious software at the request of the calling program.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.008, T1574
Input: Available Commands The XAgent C2 server will provide commands for the Trojan to run on the compromised system within its response to inbound HTTP request

Tactics: TA0002, TA0011
Techniques: T1071, T1059
Input: Hancitor has used malicious Microsoft Word documents, sent via email, which prompted the victim to enable macros.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Packing is not a definitive indicator of malicious activity, because legitimate software may use packing techniques to reduce binary size or to protect proprietary code.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: POWRUNER persists through a scheduled task that executes it every minute.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: The Ritsol backdoor trojan used by Elderwood can download files onto a compromised host from a remote location.

Tactics: TA0011
Techniques: T1105
Input: ZLib has the ability to enumerate system information.

Tactics: TA0007
Techniques: T1082
Input: The document also contained a lure image, similar to ones commonly found in malicious macro documents which ask the user to click on “Enable Content” as seen in Figure 2

Tactics: TA0002
Techniques: T1204
Input: The QakBot web inject module can inject Java Script into web banking pages visited by the victim.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Monitor for changes made to windows registry keys and/or values modifying W32Time information in the Registry.

Tactics: TA0003, TA0004
Techniques: T1547.003, T1547
Input: Emissary uses HTTP or HTTPS for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Monitor for API calls related to enumerating and manipulating EWM such as GetWindowLong  and SetWindowLong .

Tactics: TA0004, TA0005
Techniques: T1055.011, T1055
Input: Turla surveys a system upon check-in to discover running services and associated processes using the tasklist /svc command.

Tactics: TA0007
Techniques: T1007
Input: HermeticWiper can decompress and copy driver files using LZCopy.

Tactics: TA0005
Techniques: T1140
Input: Dridex has collected the computer name and OS architecture information from the system.

Tactics: TA0007
Techniques: T1082
Input: Bazar can use HTTP and HTTPS over ports 80 and 443 in C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: build_downer has the ability to detect if the infected host is running an anti-virus process.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Consider updating Windows to the latest version and patch level to utilize the latest protective measures against UAC bypass.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: These processes may automatically execute specific binaries as part of their functionality or to perform other actions.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.005, T1574
Input: Custom implementations of well-known compression algorithms have also been used.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: This is the first time that Bankshot has been tied directly to financial-related hacking and the first time it has been used since November 2017

Tactics: TA0007
Techniques: T1124
Input: FYAnti can download additional payloads to a compromised host.

Tactics: TA0011
Techniques: T1105
Input: Cobalt Strike can steal access tokens from exiting processes.

Tactics: TA0004, TA0005
Techniques: T1134, T1134.001
Input: Unlike Code Signing, this activity will not result in a valid signature.

Tactics: TA0005
Techniques: T1036, T1036.001
Input: Derusbi is capable of deleting files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Malware researchers can reverse engineer malware variants that use dynamic resolution and determine future C2 infrastructure that the malware will attempt to contact, but this is a time and resource intensive effort.

Tactics: TA0011
Techniques: T1568
Input: If infrastructure or patterns in malware, tooling, certificates, or malicious web content have been previously identified, internet scanning may uncover when an adversary has staged their capabilities.Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult.

Tactics: TA0042
Techniques: T1608
Input: Adversaries may buy, steal, or download exploits that can be used during targeting.

Tactics: TA0042
Techniques: T1588, T1588.005
Input: Leviathan has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors.

Tactics: TA0005
Techniques: T1140