madox81/Adema_ATTACK_DS huggingface dataset:
Input: The Komplex C2 channel uses an 11-byte XOR algorithm to hide data.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: BRONZE BUTLER has used steganography in multiple operations to conceal malicious payloads.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: PoshC2 contains a module for recursively parsing through files and directories to gather valid credit card numbers.

Tactics: TA0009
Techniques: T1119
Input: For the adversary to poison the ARP cache, their reply must be faster than the one made by the legitimate IP address owner.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.002
Input: Compare recent invocations of InstallUtil.exe with prior history of known good arguments and executed binaries to determine anomalous and potentially adversarial activity

Tactics: TA0005
Techniques: T1218, T1218.004
Input: CrackMapExec can enumerate the domain user accounts on a targeted system.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: In this scenario, adversaries attach a file to the spearphishing email and usually rely upon User Execution to gain execution.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Monitor for changes made to windows registry keys and/or values that may execute their own malicious payloads by hijacking the way operating systems run programs.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574
Input: RDAT has used AES ciphertext to encode C2 communications.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Adversaries can set the DYLD_INSERT_LIBRARIES environment variable to point to malicious libraries containing names of legitimate libraries or functions requested by a victim program.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.006, T1574
Input: We determined this by following the process in which the TwoFace++ loader webshell uses the actor provided password to authenticate and decrypt the embedded webshell:  Append a string to the password that acts as a salt Obtain the SHA1 hash of the resulting string containing the password and salt Base64 encode the SHA1 hash Compare the encoded hash with hardcoded base64 string If the encoded hash matches hardcoded base64 string then the inbound request is authenticated Generates the SHA256 hash of the password string Base64 encodes the SHA256 hash and uses the first 24 characters as a key Uses 24-character key and the 3DES cipher to decrypt the embedded webshell  Now let’s look at how this works with the values in the TwoFace++ loader sample

Tactics: TA0005, TA0008, TA0011
Techniques: T1140, T1132, T1550.002, T1573, T1027, T1550
Input: MarkiRAT can use the GetKeyboardLayout API to check if a compromised host's keyboard is set to Persian.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: Flame can use Windows Authentication Packages for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.002, T1547
Input: Similar to the case of MBR, an adversary who has raw access to the boot drive may overwrite the VBR to divert execution during startup to adversary code.

Tactics: TA0003, TA0005
Techniques: T1542.003, T1542
Input: HermeticWiper has the ability to set the HKLM:\SYSTEM\\CurrentControlSet\\Control\\CrashControl\CrashDumpEnabled Registry key to 0 in order to disable crash dumps.

Tactics: TA0005
Techniques: T1562.006, T1562
Input: Several Microsoft signed scripts that have been downloaded from Microsoft or are default on Windows installations can be used to proxy execution of other files.

Tactics: TA0005
Techniques: T1216
Input: Use process monitoring to monitor the execution and arguments of rundll32.exe.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Cobalt Group has used regsvr32.exe to execute scripts.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: WhisperGate can overwrite sectors of a victim host's hard drive at periodic offsets.

Tactics: TA0040
Techniques: T1561.001, T1561
Input: Figure 2: Zyklon attack flow Infection Techniques CVE-2017-8759 This vulnerability was discovered by FireEye in September 2017, and it is a vulnerability we have observed being exploited in the wild

Tactics: TA0002
Techniques: T1203
Input: Monitor events for changes to account objects and/or permissions on systems and the domain, such as event IDs 4738, 4728 and 4670.

Tactics: TA0003
Techniques: T1098
Input: WannaCry utilizes wmic to delete shadow copies.

Tactics: TA0002
Techniques: T1047
Input: Operation Wocao has used stolen credentials to connect to the victim's network via VPN.

Tactics: TA0001, TA0003
Techniques: T1133
Input: TajMahal has the ability to identify which anti-virus products, firewalls, and anti-spyware products are in use.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: The majority of delivery documents contain a generic lure image requesting the victim enable macros with no additional content, the adversaries seemingly relying solely on lure filenames to entice victims to launch the malicious document

Tactics: TA0002
Techniques: T1204
Input: Adversaries may disable or modify system firewalls in order to bypass controls limiting network usage.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: Newer variants of BACKSPACE will encode C2 communications with a custom system.

Tactics: TA0011
Techniques: T1132, T1132.002
Input: Once adversaries have provisioned compromised infrastructure (ex: a server for use in command and control), internet scans may help proactively discover compromised infrastructure.

Tactics: TA0042
Techniques: T1584
Input: Monitor processes spawned by command line utilities to manipulate keychains directly, such as security, combined with arguments to collect passwords, such as dump-keychain -d.

Tactics: TA0006
Techniques: T1555.001, T1555
Input: Machete has also used some visual obfuscation techniques by naming variables as combinations of letters to hinder analysis.

Tactics: TA0005
Techniques: T1027
Input: The script self-scheduling, as well as the scheduling of a script that repeatedly attempts to download and execute the Revenge RAT binary, significantly contribute to the persistence of this infection

Tactics: TA0011
Techniques: T1105
Input: 119 readFiles Obtains file information on a file or a folder, and supports a “*” wildcard and recursive file list

Tactics: TA0007
Techniques: T1083
Input: Sidewinder has used PowerShell to drop and execute malware loaders.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: APT29 used the service control manager on a remote system to disable services associated with security monitoring products.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Turla attempted to trick targets into clicking on a link featuring a seemingly legitimate domain from Adobe.com to download their malware and gain initial access.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: EKANS stops processes related to security and management software.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Monitor for newly constructed registry keys or values to aid in persistence and execution.

Tactics: TA0005
Techniques: T1112
Input: FIN4 has used VBA macros to display a dialog box and collect victim credentials.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Enforce proxies and use dedicated servers for services such as DNS and only allow those systems to communicate over respective ports/protocols, instead of all systems within a network.

Tactics: TA0010
Techniques: T1048.002, T1048.003, T1048
Input: Maze has checked the language of the infected system using the "GetUSerDefaultUILanguage" function.

Tactics: TA0007
Techniques: T1082
Input: Adversaries may search within public scan databases for information about victims that can be used during targeting.

Tactics: TA0043
Techniques: T1596, T1596.005
Input: However, the second extension is the true file type that determines how the file is opened and executed.

Tactics: TA0005
Techniques: T1036, T1036.007
Input: Carbanak stores a configuration files in the startup directory to automatically execute commands in order to persist across reboots.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Monitor for unusual processes with internal network connections creating files on-system may be suspicious

Tactics: TA0008
Techniques: T1570
Input: The CALENDAR malware communicates through the use of events in Google Calendar.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: Net Crawler uses PsExec to perform remote service manipulation to execute a copy of itself as part of lateral movement.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Bandook has used malicious VBA code against the target system.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Filter DLLs must be present in Windows installation directory (C:\Windows\System32\ by default) of a domain controller and/or local computer with a corresponding entry in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages.

Tactics: TA0003, TA0005, TA0006, TA0007
Techniques: T1556.002, T1556, T1201
Input: OSX/Shlayer can masquerade as a Flash Player update.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Monitor for changes made to firewall rules for unexpected modifications to allow/block specific network traffic that may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms.

Tactics: TA0005
Techniques: T1562
Input: Servers and cloud-based systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for Resource Hijacking and cryptocurrency mining.

Tactics: TA0040
Techniques: T1496
Input: Bundlore can use AppleScript to inject malicious JavaScript into a browser.

Tactics: TA0002
Techniques: T1059.002, T1059
Input: QUADAGENT uses cmd.exe to execute scripts and commands on the victim’s machine.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Crimson can perform audio surveillance using microphones.

Tactics: TA0009
Techniques: T1123
Input: Chimera has used the get -b  -e  -p command for network scanning as well as a custom Python tool  packed into a Windows executable named Get.exe to scan IP ranges for HTTP.

Tactics: TA0007
Techniques: T1046
Input: Rocke used scripts which detected and uninstalled antivirus software.

Tactics: TA0005, TA0007
Techniques: T1518.001, T1562.001, T1518, T1562
Input: NanHaiShu can change Internet Explorer settings to reduce warnings about malware activity.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: This is performed by checking if the following libraries are loaded on the victim machine.SbieDll.dll (sandboxie library)Dbghelp.dll (Microsoft debugging tools)Api_log.dll (threatAnalyzer / GFI SandBox)Dir_watch.dll (threatAnalyzer / GFI SandBox)We were able to uncover some other techniques used by this variant of ROKRAT to make analysis difficult, Group 123 used an anti-debugging technique related to NOP (No Operation).nop dword ptr [eax+eax+00h] is a 5 byte NOP

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574.002, T1574
Input: RCSession can capture screenshots from a compromised host.

Tactics: TA0009
Techniques: T1113
Input: BLACKCOFFEE has the capability to create a reverse shell.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: FrameworkPOS can identifiy payment card track data on the victim and copy it to a local file in a subdirectory of C:\Windows.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: One of the malware families tied to this group, BADNEWS, continues to be updated both in how it uses dead drop resolvers, as well as how it communicates with a remote C2 server

Tactics: TA0011
Techniques: T1102
Input: APT29 has installed web shells on exploited Microsoft Exchange servers.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: DownPaper searches and reads the value of the Windows Update Registry Run key.

Tactics: TA0007
Techniques: T1012
Input: Login items created using a shared file list are visible in System Preferences, can hide the application when it launches, and are executed through LaunchServices, not launchd, to open applications, documents, or URLs without using Finder.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.015
Input: Shamoon can download an executable to run on the victim.

Tactics: TA0011
Techniques: T1105
Input: POWERSTATS has encrypted C2 traffic with RSA.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: SombRAT has the ability to run cancel or closeanddeletestorage to remove all files from storage and delete the storage temp file on a compromised host.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: The case we found arrived through a targeted email that contained a document file (in docx format).

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Azorult can call WTSQueryUserToken and CreateProcessAsUser to start a new process with local system privileges.

Tactics: TA0004, TA0005
Techniques: T1134.002, T1134
Input: TA551 has used mshta.exe to execute malicious payloads.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: APT28 has used spearphishing to compromise credentials.

Tactics: TA0043
Techniques: T1598
Input: Lazarus Group has developed custom malware for use in their operations.

Tactics: TA0042
Techniques: T1587, T1587.001
Input: The keylogger then records keystrokes in encrypted files, for example: thumbcache_96.dbx

Tactics: TA0006, TA0009
Techniques: T1056
Input: Monitor for suspicious sequences of events, such as the deletion of multiple snapshots within a short period of time.

Tactics: TA0005
Techniques: T1578
Input: Kobalos encrypts all strings using RC4 and bundles all functionality into a single function call.

Tactics: TA0005
Techniques: T1027
Input: PoshC2 contains an implementation of PsExec for remote execution.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: FIN8 has used Registry keys to detect and avoid executing in potential sandboxes.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Monitor for unusual processes accessing local email files that may target user email on local systems to collect sensitive information.

Tactics: TA0009
Techniques: T1114, T1114.001
Input: For example, malware can act as a DHCP server and provide adversary-owned DNS servers to the victimized computers.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.003
Input: ThiefQuest uses a function named is_debugging to perform anti-debugging logic.

Tactics: TA0005, TA0007
Techniques: T1622
Input: Reg can be used to extract from the Registry.

Tactics: TA0006
Techniques: T1003, T1003.004
Input: Aquatic Panda has used DLL search-order hijacking to load exe, dll, and dat files into memory.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: The DustySky dropper uses a function to obfuscate the name of functions and other parts of the malware.

Tactics: TA0005
Techniques: T1027
Input: BoomBox has used HTTP POST requests for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Hildegard has used xmrig to mine cryptocurrency.

Tactics: TA0040
Techniques: T1496
Input: APT39 has used Ncrack to reveal credentials.

Tactics: TA0006
Techniques: T1110
Input: Wizard Spider has used administrative accounts, including Domain Admin, to move laterally within a victim network.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.002
Input: AADInternals can also modify DesktopSSO information.

Tactics: TA0004, TA0005
Techniques: T1484
Input: For internal traffic, monitor the workstation-to-workstation unusual (vs. baseline) SMB traffic.

Tactics: TA0006
Techniques: T1187
Input: Astaroth executes embedded JScript or VBScript in an XSL stylesheet located on a remote domain.

Tactics: TA0005
Techniques: T1220
Input: JSS Loader can download and execute JavaScript files.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: This method may also evade detection from security products since the execution is masked under a legitimate process.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.004, T1574.006, T1574
Input: Consider disabling functions from web technologies such as PHP’s eval() that may be abused for web shells.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Subscriptions consist of three core WMI classes: a Filter, a Consumer, and a FilterToConsumerBinding

Tactics: TA0002
Techniques: T1047
Input: The PowerShell implant used in the Olympics campaign was a stager based on the PowerShell Empire framework that created an encrypted channel to the attacker’s server

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Monitor executed commands and arguments for actions that could be taken to create/modify tasks.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: Rather than just connecting and distributing payloads via removable storage ( Replication Through Removable Media), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused.

Tactics: TA0001
Techniques: T1200
Input: Before being appended to image files, HAMMERTOSS commands are encrypted with a key composed of both a hard-coded value and a string contained on that day's tweet.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: BACKSPACE uses HTTP as a transport to communicate with its command server.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Carbanak has copied legitimate service names to use for malicious services.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Caterpillar WebShell can obtain a list of user accounts from a victim's machine.

Tactics: TA0007
Techniques: T1033
Input: Monitor for newly executed processes that may gather the system time and/or time zone from a local or remote system.

Tactics: TA0007
Techniques: T1124
Input: The v.vbs script drops four components (hUpdateCheckers.base, dUpdateCheckers.base, cUpdateCheckers.bat, and GoogleUpdateschecker.vbs) to the directory: C:\ProgramData\Windows\Microsoft\java\ v.vbs uses CertUtil.exe, a legitimate Microsoft command-line program installed as part of Certificate Services, to decode the base64-encoded files hUpdateCheckers.base and dUpdateCheckers.base, and drop hUpdateCheckers.ps1 and dUpdateCheckers.ps1 to the staging directory

Tactics: TA0002, TA0005, TA0009
Techniques: T1036, T1059, T1074
Input: NavRAT writes multiple outputs to a TMP file using the >> method.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: APT28 exploited a Windows SMB Remote Code Execution Vulnerability to conduct lateral movement.

Tactics: TA0008
Techniques: T1210
Input: Operation Wocao can download additional files to the infected system.

Tactics: TA0011
Techniques: T1105
Input: Interactive command shells may be used, and common functionality within cmd and bash may be used to copy data into a staging location.

Tactics: TA0009
Techniques: T1074.002, T1074.001, T1074
Input: A variety of methods exist for compromising email accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, or by brute forcing credentials (ex: password reuse from breach credential dumps).

Tactics: TA0042
Techniques: T1586.002, T1586
Input: FIN7 used images embedded into document lures that only activate the payload when a user double clicks to avoid sandboxes.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.002
Input: TeamTNT has cleared command history with history -c.

Tactics: TA0005
Techniques: T1070, T1070.003
Input: Briba uses rundll32 within Registry Run Keys / Startup Folder entries to execute malicious DLLs.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Review false values under the LSFileQuarantineEnabled entry in an application's Info.plist file (required by every application).

Tactics: TA0005
Techniques: T1553.001, T1553
Input: Its main functions are:  Brute-force using a pre-defined list of usernames and passwords in an attempt to login to Admin panels

Tactics: TA0006
Techniques: T1110
Input: The macro saves the chkSrv.vbs script to the system, which is responsible for running the IntelSecurityAssistManager.exe payload (OopsIE Trojan) and cleaning up the installation by deleting the two scheduled tasks, the Base.txt file, the ThreeDollars document, and the chkSrv.vbs script

Tactics: TA0002, TA0003, TA0004, TA0005
Techniques: T1053.005, T1070, T1053, T1070.004
Input: Ensure that cloud accounts, particularly privileged accounts, have complex, unique passwords across all systems on the network.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078.004, T1078
Input: Crimson contains commands to list files and directories, as well as search for files matching certain extensions from a defined list.

Tactics: TA0007
Techniques: T1083
Input: VBShower has the ability to download VBS files to the target computer.

Tactics: TA0011
Techniques: T1105
Input: LitePower can create a scheduled task to enable persistence mechanisms.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Kazuar encodes communications to the C2 server in Base64.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: TeamTNT has used SSH to connect back to victim machines.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices.

Tactics: TA0007
Techniques: T1120
Input: Monitor for changes to Azure Activity Logs for Service Principal and Application modifications.

Tactics: TA0003
Techniques: T1098.001, T1098
Input: Alternatively, a print processor can be registered to the print spooler service by adding the HKLM\SYSTEM\[CurrentControlSet or ControlSet001]\Control\Print\Environments\[Windows architecture: , Windows x64]\Print Processors\[user defined]\Driver Registry key that points to the DLL.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.012
Input: LaZagne can obtain credential information from /etc/shadow using the shadow.py module.

Tactics: TA0006
Techniques: T1003, T1003.008
Input: For example, auditpol /set /category:"Account Logon" /success:disable /failure:disable turns off auditing for the Account Logon category.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: Cloud service providers support IP-based restrictions when accessing cloud resources.

Tactics: TA0009
Techniques: T1530
Input: On macOS 10.10 Yosemite and higher, AppleScript has the ability to execute Native APIs, which otherwise would require compilation and execution in a mach-O binary file format.

Tactics: TA0002
Techniques: T1059.002, T1059
Input: Rover automatically searches for files on local drives based on a predefined list of file extensions.

Tactics: TA0007
Techniques: T1083
Input: They can also do reputation-based analytics on websites and their requested resources such as how old a domain is, who it's registered to, if it's on a known bad list, or how many other users have connected to it before.

Tactics: TA0001
Techniques: T1189
Input: Web shells can be difficult to detect.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: ZLib mimics the resource version information of legitimate Realtek Semiconductor, Nvidia, or Synaptics modules.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: This can be done remotely or locally and with active or disconnected sessions.

Tactics: TA0008
Techniques: T1563.002, T1563
Input: HELLOKITTY can use an embedded RSA-2048 public key to encrypt victim data for ransom.

Tactics: TA0040
Techniques: T1486
Input: Periodically baseline virtual machine images to identify malicious modifications or additions.

Tactics: TA0003
Techniques: T1525
Input: Monitor newly executed processes that may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications.

Tactics: TA0005
Techniques: T1564, T1564.009
Input: Dragonfly has accessed email accounts using Outlook Web Access.

Tactics: TA0009
Techniques: T1114, T1114.002
Input: jRAT has been distributed as HTA files with VBScript.

Tactics: TA0002
Techniques: T1059.005, T1059