madox81/Adema_ATTACK_DS huggingface dataset:
Input: We recently mentioned this tool in another report on April 16, as this variant of the BONDUPDATER tool used DNS tunneling to communicate with its C2, specifically using TXT queries to receive information from the C2 server

Tactics: TA0011
Techniques: T1071
Input: BlackEnergy has run a keylogger plug-in on a victim.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Kasidet creates a Registry Run key to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Cyclops Blink has the ability to use the Linux API function utime to change the timestamps of modified firmware update images.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: In addition to this, the malware queries four PasteBin links to extract the C2 addresses from these links:  https://pastebin[.]com/eSsjmhBG https://pastebin[.]com/PSxQd6qw https://pastebin[.]com/CzjM9qwi https://pastebin[.]com/xHDSxxMD  A full list of the extracted strings from the configuration is given in Appendix D – Extracted PlugX Strings

Tactics: TA0001, TA0011
Techniques: T1071, T1566.003, T1566, T1566.002, T1102
Input: HOPLIGHT has the capability to harvest credentials and passwords from the SAM database.

Tactics: TA0006
Techniques: T1003, T1003.002
Input: By adding random or meaningless data to the protocols used for command and control, adversaries can prevent trivial methods for decoding, deciphering, or otherwise analyzing the traffic.

Tactics: TA0011
Techniques: T1001.001, T1001
Input: While supply chain compromise can impact any component of hardware or software, adversaries looking to gain execution have often focused on malicious additions to legitimate software in software distribution or update channels.

Tactics: TA0001
Techniques: T1195
Input: FIN6 has used Pastebin and Google Storage to host content for their operations.

Tactics: TA0011
Techniques: T1102
Input: MarkiRAT can check for running processes on the victim’s machine to look for Kaspersky and Bitdefender antivirus products.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: OilRig has used PowerShell scripts for execution, including use of a macro to run a PowerShell command to decode file contents.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: BlackEnergy has used a plug-in to gather credentials stored in files on the host by various software programs, including The Bat!

Tactics: TA0006
Techniques: T1552.001, T1552
Input: Donut can generate packed code modules.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Direct API access through a token negates the effectiveness of a second authentication factor and may be immune to intuitive countermeasures like changing passwords.

Tactics: TA0005, TA0008
Techniques: T1550.001, T1550
Input: zwShell has used SchTasks for execution.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Zox has the ability to upload files from a targeted system.

Tactics: TA0009
Techniques: T1005
Input: Felismus collects the system information, including hostname and OS version, and sends it to the C2 server.

Tactics: TA0007
Techniques: T1082
Input: cUpdateCheckers.bat is launched and creates a scheduled task for GoogleUpdateschecker.vbs persistence

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053, T1059
Input: DarkWatchman has used an icon mimicking a text file to mask a malicious executable.

Tactics: TA0005
Techniques: T1036
Input: This can be configured through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Increase scheduling priority.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053, T1053.002
Input: Olympic Destroyer will attempt to clear the System and Security event logs using wevtutil.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: SUNBURST created VBScripts that were named after existing services or folders to blend into legitimate activities.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Monitor for modifications of PATH environment variable Registry keys such as HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment\Path.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.007, T1574
Input: Inception has encrypted malware payloads dropped on victim machines with AES and RC4 encryption.

Tactics: TA0005
Techniques: T1027
Input: Sandworm Team has used webshells including P.A.S.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Windows API functions such as GetLocaleInfoW can also be used to determine the locale of the host.

Tactics: TA0007
Techniques: T1614
Input: These rules can be abused to impair/delay detection had the email content been immediately seen by a user or defender.

Tactics: TA0005
Techniques: T1564, T1564.008
Input: GALLIUM used a modified version of NBTscan to identify available NetBIOS name servers over the network as well as ping to identify remote systems.

Tactics: TA0007
Techniques: T1018
Input: By modifying the instructions stored in the system image file, adversaries may either weaken existing defenses or provision new capabilities that the device did not have before.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: APT-C-36 has prompted victims to accept macros in order to execute the subsequent payload.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: TA505 has also run net group /domain.

Tactics: TA0007
Techniques: T1069
Input: Monitor for new, unfamiliar DLL files written to a domain controller and/or local computer.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.002, T1556
Input: XCSSET performs AES-CBC encryption on files under ~/Documents, ~/Downloads, and~/Desktop with a fixed key and renames files to give them a .enc extension.

Tactics: TA0040
Techniques: T1486
Input: APT32 used the ipconfig /all command to gather the IP address from the system.

Tactics: TA0007
Techniques: T1016
Input: Cardinal RAT lures victims into executing malicious macros embedded within Microsoft Excel documents.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Skidmap has installed itself via crontab.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: AppleSeed can take screenshots on a compromised host by calling a series of APIs.

Tactics: TA0009
Techniques: T1113
Input: Monitor for modification of Registry keys and values used by services such as HKLM\SYSTEM\CurrentControlSet\Services that may allow adversaries to launch their own code when a service starts.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.011, T1574
Input: For example, on an Ubuntu system using the GNOME Display Manger (GDM), accounts may be hidden from the greeter using the gsettings command (ex: sudo -u gdm gsettings set org.gnome.login-screen disable-user-list true).

Tactics: TA0005
Techniques: T1564.002, T1564
Input: LoudMiner can automatically launch a Linux virtual machine as a service at startup if the AutoStart option is enabled in the VBoxVmService configuration file.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Linux Rabbit attempts to gain access to the server via SSH.

Tactics: TA0001, TA0003
Techniques: T1133
Input: Monitor for user accounts logged into systems they would not normally access or abnormal access patterns, such as multiple systems over a relatively short period of time.

Tactics: TA0008
Techniques: T1021
Input: Monitor the file system for files that have the setuid or setgid bits set.

Tactics: TA0004, TA0005
Techniques: T1548, T1548.001
Input: Adversaries may add junk data to protocols used for command and control to make detection more difficult.

Tactics: TA0011
Techniques: T1001.001, T1001
Input: OilRig has exfiltrated data over FTP separately from its primary C2 channel over DNS.

Tactics: TA0010
Techniques: T1048.003, T1048
Input: Adversaries may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Daemon (emond).

Tactics: TA0003, TA0004
Techniques: T1546, T1546.014
Input: Empire can use Dropbox and GitHub for C2.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: Mivast creates the following Registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Micromedia.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: The verb get can be used in a myriad of ways to retrieve information for a machine, however in this case os get /format: is being abused to download payloads from non-local resources with .xsl extensions

Tactics: TA0007
Techniques: T1082
Input: Remsec schedules the execution one of its modules by creating a new scheduler task.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053
Input: Waterbear can use thread injection to inject shellcode into the process of security software.

Tactics: TA0004, TA0005
Techniques: T1055.003, T1055
Input: QakBot can Base64 encode system information sent to C2.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Adversaries may reveal credentials of accounts that have disabled Kerberos preauthentication by Password Cracking Kerberos messages.

Tactics: TA0006
Techniques: T1558, T1558.004
Input: WHOIS data is stored by regional Internet registries (RIR) responsible for allocating and assigning Internet resources such as domain names.

Tactics: TA0043
Techniques: T1596.002, T1596
Input: Web browsers commonly save credentials such as website usernames and passwords so that they do not need to be entered manually in the future.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: BISCUIT has a command to collect the processor type, operation system, computer name, uptime, and whether the system is a laptop or PC.

Tactics: TA0007
Techniques: T1082
Input: Adversaries may attempt to get information about running processes on a system.

Tactics: TA0007
Techniques: T1057
Input: Screenshots The data dump includes several screenshots of resources that the leaker alleged was related to the OilRig group

Tactics: TA0009
Techniques: T1113
Input: Volgmer checks the system for certain Registry keys.

Tactics: TA0007
Techniques: T1012
Input: FIN8 has retrieved a list of trusted domains by using Nltest.exe /domain_trusts.

Tactics: TA0007
Techniques: T1482
Input: SynAck checks its directory location in an attempt to avoid launching in a sandbox.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001, T1083
Input: ChChes can encrypt C2 traffic with AES or RC4.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Some lure documents used in these attacks are shown below: Decoy documents used in BlackOasis attacks To summarize, we have seen BlackOasis utilizing at least five zero days since June 2015:  CVE-2015-5119 – June 2015 CVE-2016-0984 – June 2015 CVE-2016-4117 – May 2016 CVE-2017-8759 – Sept 2017 CVE-2017-11292 – Oct 2017  Attacks Leveraging CVE-2017-11292 The attack begins with the delivery of an Office document, presumably in this instance via e-mail.  Embedded within the document is an ActiveX object which contains the Flash exploit

Tactics: TA0002
Techniques: T1203
Input: Dipsind encrypts C2 data with AES256 in ECB mode.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Adversaries may gather credentials via APIs within a containers environment.

Tactics: TA0006
Techniques: T1552, T1552.007
Input: The Visual Basic macro performs the following tasks:  Opens a handle to the malicious document to read the encoded CAB file Decodes the CAB file and writes it to the disk at %temp%\setup.cab   Encoded CAB file in the Word document

Tactics: TA0005
Techniques: T1140
Input: The MBR is the section of disk that is first loaded after completing hardware initialization by the BIOS.

Tactics: TA0003, TA0005
Techniques: T1542.003, T1542
Input: Adversaries may employ various user activity checks to detect and avoid virtualization and analysis environments.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.002
Input: The user may be required to assist in this process by enabling scripting or active website components and ignoring warning dialog boxes.

Tactics: TA0001
Techniques: T1189
Input: Also look for any process API calls for behavior that may be indicative of Process Injection.

Tactics: TA0004, TA0005
Techniques: T1548
Input: Caterpillar WebShell can obtain a list of local groups of users from a system.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: Monitor for newly constructed files that may abuse Microsoft Office templates to obtain persistence on a compromised system.

Tactics: TA0003
Techniques: T1137, T1137.001
Input: Adversaries may use their own abstracted file system, separate from the standard file system present on the infected system.

Tactics: TA0005
Techniques: T1564, T1564.005
Input: Zeus Panda checks to see if anti-virus, anti-spyware, or firewall products are installed in the victim’s environment.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Public IP addresses may be allocated to organizations by block, or a range of sequential addresses.

Tactics: TA0043
Techniques: T1595.001, T1590, T1590.005, T1595
Input: When authentication is not required to access an exposed remote service, monitor for follow-on activities such as anomalous external use of the exposed API or application.

Tactics: TA0001, TA0003
Techniques: T1133
Input: There is a myriad of approaches for detecting a pseudo-randomly generated domain name, including using frequency analysis, Markov chains, entropy, proportion of dictionary words, ratio of vowels to other characters, and more.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: LightNeuron contains a function to encrypt and store emails that it collects.

Tactics: TA0009
Techniques: T1560
Input: APT38 has conducted watering holes schemes to gain initial access to victims.

Tactics: TA0001
Techniques: T1189
Input: These snap-ins may be used to manage Windows systems locally or remotely.

Tactics: TA0005
Techniques: T1218, T1218.014
Input: Common uses include cmd to execute a single command, or abusing cmd interactively with input and output forwarded over a command and control channel.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Gelsemium can use dynamic DNS domain names in C2.

Tactics: TA0011
Techniques: T1568
Input: IronNetInjector can identify processes via C# methods such as GetProcessesByName and running Tasklist with the Python os.popen function.

Tactics: TA0007
Techniques: T1057
Input: TG-3390 has used additional web shells containing similarly formatted passwords

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Socksbot can start SOCKS proxy threads.

Tactics: TA0011
Techniques: T1090
Input: QakBot can maintain persistence by creating an auto-run Registry key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: APT39 has used Mimikatz, Windows Credential Editor and ProcDump to dump credentials.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: For example, HTTPS over port 8088 or port 587 as opposed to the traditional port 443.

Tactics: TA0011
Techniques: T1571
Input: Monitor executed commands and arguments that may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

Tactics: TA0005
Techniques: T1036
Input: Silence has used RAdmin, a remote software tool used to remotely control workstations and ATMs.

Tactics: TA0002, TA0008
Techniques: T1072
Input: Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect.

Tactics: TA0011
Techniques: T1132, T1132.002
Input: ShimRat can list directories.

Tactics: TA0007
Techniques: T1083
Input: Helminth samples have been signed with legitimate, compromised code signing certificates owned by software company AI Squared.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Anchor has used HTTP and HTTPS in C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: TEMP.Veles has used Virtual Private Server (VPS) infrastructure.

Tactics: TA0042
Techniques: T1583.003, T1583
Input: Green Lambert can delete the original executable after initial installation in addition to unused functions.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Sharpshooter has sent malicious DOC and PDF files to targets so that they can be opened by a user.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Ramsay has PE data embedded within JPEG files contained within Word documents.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: Credentials targeted by PinchDuke include ones associated with many sources such as The Bat!, Yahoo!, Mail.ru, Passport.Net, Google Talk, and Microsoft Outlook.

Tactics: TA0006
Techniques: T1555
Input: NanHaiShu modifies the %regrun% Registry to point itself to an autostart mechanism.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: This RAT communicates with 5.189.145.248, a command and control (C2) IP address that this group has used previously with other malware, including DarkComet and NJRAT

Tactics: TA0011
Techniques: T1102
Input: OceanSalt has been delivered via spearphishing emails with Microsoft Office attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Skeleton Key is used to patch an enterprise domain controller authentication process with a backdoor password.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.001
Input: LookBack can shutdown and reboot the victim machine.

Tactics: TA0040
Techniques: T1529
Input: Patchwork has used spearphishing with an attachment to deliver files with exploits to initial victims.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may leverage Confluence repositories to mine valuable information.

Tactics: TA0009
Techniques: T1213, T1213.001
Input: Pisloader uses cmd.exe to set the Registry Run key value.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Mustang Panda will delete their tools and files, and kill processes after their objectives are reached.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Monitor for newly constructed visual content for internal or external enterprise networks.

Tactics: TA0040
Techniques: T1491
Input: Leafminer used several tools for retrieving login and password information, including LaZagne and Mimikatz.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: KONNI has relied on a victim to enable malicious macros within an attachment delivered via email.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Sakula contains UAC bypass code for both 32- and 64-bit systems.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: For the Office Test method, create the Registry key used to execute it and set the permissions to "Read Control" to prevent easy access to the key without administrator permissions or requiring Privilege Escalation.

Tactics: TA0003
Techniques: T1137
Input: Malicious obfuscated VBA code is executed when the macro is first enabled

Tactics: TA0005
Techniques: T1027
Input: MAGIC HOUND TOOLSET The Magic Hound attacks did not rely on exploit code to compromise targeted systems, instead relying on executables and Microsoft Office documents, specifically Excel and Word documents containing malicious macros

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Messages can be forwarded to internal or external recipients, and there are no restrictions limiting the extent of this rule.

Tactics: TA0009
Techniques: T1114, T1114.003
Input: TURNEDUP is capable of taking screenshots.

Tactics: TA0009
Techniques: T1113
Input: Meteor can check if a specific process is running, such as Kaspersky's avp.exe.

Tactics: TA0007
Techniques: T1057
Input: There have been examples of malware targeting session cookies to bypass multi-factor authentication systems.

Tactics: TA0005, TA0008
Techniques: T1550.004, T1550
Input: If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001, T1497.002
Input: Taidoor has used HTTP GET and POST requests for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: ELMER is capable of performing process listings.

Tactics: TA0007
Techniques: T1057
Input: ZeroT has used HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Patchwork used JavaScript code and .SCT files on victim machines.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: This technique bypasses Windows file access controls as well as file system monitoring tools.

Tactics: TA0005
Techniques: T1006
Input: Adversaries have used systemd functionality to establish persistent access to victim systems by creating and/or modifying service unit files that cause systemd to execute malicious commands at system boot.

Tactics: TA0003, TA0004
Techniques: T1543.002, T1543
Input: Magic Hound has obtained and used open-source penetration testing tools like Havij, sqlmap, Metasploit, and Mimikatz.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: The malware also uses return-oriented programming (ROP) technique and single-byte XOR to obfuscate data.

Tactics: TA0005
Techniques: T1027
Input: RTLO can be used in the Windows Registry as well, where regedit.exe displays the reversed characters but the command line tool reg.exe does not by default.

Tactics: TA0005
Techniques: T1036, T1036.002
Input: Hildegard has searched for private keys in .ssh.

Tactics: TA0006
Techniques: T1552.004, T1552
Input: Cadelle and Chafer are most active during the day time within Iran’s time zone and primarily operate during Iran’s business week (Saturday through Thursday)

Tactics: TA0007
Techniques: T1124
Input: Various implementations of CHOPSTICK communicate with C2 over SMTP and POP3.

Tactics: TA0011
Techniques: T1071, T1071.003
Input: Monitor executed commands and arguments that may abuse the Windows service control manager to execute malicious commands or payloads.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: CSPY Downloader has the ability to self delete.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Examples of such features would include a program being allowed to run because it is signed by a valid code signing certificate, a program prompting the user with a warning because it has an attribute set from being downloaded from the Internet, or getting an indication that you are about to connect to an untrusted site.

Tactics: TA0005
Techniques: T1553
Input: GoldMax has used scheduled tasks to maintain persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: QakBot can send stolen information to C2 nodes including passwords, accounts, and emails.

Tactics: TA0010
Techniques: T1041
Input: Cloud environments allow for collection and analysis of audit and application logs that provide insight into what activities a user does within the environment.

Tactics: TA0005
Techniques: T1562.008, T1562
Input: jRAT uses WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.

Tactics: TA0002
Techniques: T1047
Input: Adversaries can establish Persistence by adding a malicious application path to the com.apple.loginwindow.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.007
Input: Sandworm Team has used stolen credentials to access administrative accounts within the domain.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.002
Input: SombRAT can encrypt strings with XOR-based routines and use a custom AES storage format for plugins, configuration, C2 domains, and harvested data.

Tactics: TA0005
Techniques: T1027
Input: FELIXROOT adds a shortcut file to the startup folder for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Penquin has encrypted strings in the binary for obfuscation.

Tactics: TA0005
Techniques: T1027
Input: NETWIRE creates a Registry start-up entry to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Umbreon hides from defenders by hooking libc function calls, hiding artifacts that would reveal its presence, such as the user account it creates to provide access and undermining strace, a tool often used to identify malware.

Tactics: TA0005
Techniques: T1014
Input: On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Office VBA macros from calling Win32 APIs.

Tactics: TA0002
Techniques: T1106