madox81/Adema_ATTACK_DS huggingface dataset:
Input: Fox Kitten has created a local user account with administrator privileges.

Tactics: TA0003
Techniques: T1136, T1136.001
Input: Honeybee drops files with base64-encoded data.

Tactics: TA0005
Techniques: T1027
Input: The Winnti for Windows HTTP/S C2 mode can make use of an external proxy.

Tactics: TA0011
Techniques: T1090, T1090.002
Input: SUNBURST added junk bytes to its C2 over HTTP.

Tactics: TA0011
Techniques: T1001.001, T1001
Input: An adversary may attempt to modify a cloud account's compute service infrastructure to evade defenses.

Tactics: TA0005
Techniques: T1578
Input: PowerShower has the ability to identify the current user on the infected host.

Tactics: TA0007
Techniques: T1033
Input: On execution, the tool injects itself into lsass.exe and is triggered with the argument “dig”

Tactics: TA0004, TA0005
Techniques: T1055
Input: Indrik Spider has used PowerShell Empire for execution of malware.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: CharmPower can remove persistence-related artifacts from the Registry.

Tactics: TA0005
Techniques: T1112
Input: PipeMon has used call to LoadLibrary to load its installer.

Tactics: TA0002
Techniques: T1129
Input: Koadic can use WMI to execute commands.

Tactics: TA0002
Techniques: T1047
Input: BackdoorDiplomacy has exploited CVE-2020-5902, an F5 BIP-IP vulnerability, to drop a Linux backdoor.

Tactics: TA0001
Techniques: T1190
Input: REvil has been executed via malicious MS Word e-mail attachments.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: If one is identified, it will encrypt the files on the attached device.

Tactics: TA0007
Techniques: T1120
Input: Empire can send data gathered from a target through the command and control channel.

Tactics: TA0010
Techniques: T1041
Input: httpclient opens cmd.exe on the victim.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: SILENTTRINITY has the ability to leverage API including GetProcAddress and LoadLibrary.

Tactics: TA0002
Techniques: T1106
Input: APT39 leveraged spearphishing emails with malicious attachments to initially compromise victims.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Ensure that root accounts have complex, unique passwords across all systems on the network.

Tactics: TA0006
Techniques: T1003, T1003.007, T1003.008
Input: HTTPBrowser abuses the Windows DLL load order by using a legitimate Symantec anti-virus binary, VPDN_LU.exe, to load a malicious DLL that mimics a legitimate Symantec DLL, navlu.dll.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Incidents have been observed where adversaries have created backups of cloud instances and transferred them to separate accounts.

Tactics: TA0010
Techniques: T1537
Input: LaZagne can perform credential dumping from memory to obtain account and password information.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: By default this property is disabled (instead storing user credentials as the output of one-way hashing functions) and should not be enabled unless legacy or other software require it.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.005
Input: The group then was able to authenticate to the intended victim's OWA (Outlook Web Access) portal and read hundreds of email communications for information on Middle East organizations.

Tactics: TA0003
Techniques: T1098.002, T1098
Input: Use application control configured to block execution of wmic.exe if it is not required for a given system or network to prevent potential misuse by adversaries.

Tactics: TA0002
Techniques: T1047
Input: GOLD SOUTHFIELD has staged and executed PowerShell scripts on compromised hosts.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Attachment types have included .rtf, .doc, .xls, archives containing LNK files, and password protected archives containing .exe and .scr executables.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Monitor for the unexpected deletion or absence of cloud block storage volumes .

Tactics: TA0005
Techniques: T1578
Input: It handles XML formatted project files that define requirements for loading and building various platforms and configurations.

Tactics: TA0005
Techniques: T1127.001, T1127
Input: FoggyWeb's loader can check for the FoggyWeb backdoor .pri file on a compromised AD FS server.

Tactics: TA0007
Techniques: T1083
Input: FIN8 has used emails with malicious links to lure victims into installing malware.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Leviathan has compromised social media accounts to conduct social engineering attacks.

Tactics: TA0042
Techniques: T1586.001, T1586
Input: Deep Panda has used -w hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: WellMess has the ability to use DNS tunneling for C2 communications.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: APT32 has hosted malicious payloads in Dropbox, Amazon S3, and Google Drive for use during targeting.

Tactics: TA0042
Techniques: T1608.001, T1608
Input: Suspicious activity may include personas claiming to work for your organization or recently modified accounts making numerous connection requests to accounts affiliated with your organization.Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult.

Tactics: TA0042
Techniques: T1586
Input: Pupy can compress data with Zip before sending it over C2.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: SLOTHFULMEDIA has named a service it establishes on victim machines as "TaskFrame" to hide its malicious purpose.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Monitor for user accounts logged into systems associated with RDP (ex: Windows EID 4624 Logon Type 10).

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Finally, Reaver.v2 will execute the ‘~Update.lnk’ file in a new process, thus loading the recently dropped malicious CPL file

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: FIN7 has used Kerberoasting for credential access and to enable lateral movement.

Tactics: TA0006
Techniques: T1558.003, T1558
Input: Turian can retrieve the internal IP address of a compromised host.

Tactics: TA0007
Techniques: T1016
Input: Also monitor user SSH-agent socket files being used by different users.

Tactics: TA0008
Techniques: T1563, T1563.001
Input: Aquatic Panda has acquired and used njRAT in its operations.

Tactics: TA0042
Techniques: T1588, T1588.001
Input: SodaMaster has the ability to query the Registry to detect a key specific to VMware.

Tactics: TA0007
Techniques: T1012
Input: Micropsia creates a command-line shell using cmd.exe.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: PolyglotDuke can write encrypted JSON configuration files to the Registry.

Tactics: TA0005
Techniques: T1112
Input: Use application control to mitigate installation and use of unapproved software that can be used for remote access.

Tactics: TA0011
Techniques: T1219
Input: Psylo has a command to conduct timestomping by setting a specified file’s timestamps to match those of a system file in the System32 directory.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: CopyKittens has used Metasploit and Empire for post-exploitation activities.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: FIN8 has used RAR to compress collected data before exfiltration.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Cobalt Group has used Remote Desktop Protocol to conduct lateral movement.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: It does so using either the HTTPS/HTTP or DNS channels, depending on which method is successful

Tactics: TA0011
Techniques: T1071
Input: Depending on the implementation, successful modification of a signing policy may require reboot of the compromised system.

Tactics: TA0005
Techniques: T1553, T1553.006
Input: Metamorfo includes payloads written in JavaScript.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: On network devices, adversaries may use crafted packets to enable Network Device Authentication for standard services offered by the device such as telnet.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205
Input: Leafminer has used Process Doppelgänging to evade security software while deploying tools on compromised systems.

Tactics: TA0004, TA0005
Techniques: T1055.013, T1055
Input: Spearphishing with a link is a specific variant of spearphishing.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: POWERSTATS can retrieve screenshots from compromised hosts.

Tactics: TA0009
Techniques: T1113
Input: Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.

Tactics: TA0007
Techniques: T1010
Input: MiniDuke can can use a named pipe to forward communications from one compromised machine with internet access to other compromised machines.

Tactics: TA0011
Techniques: T1090.001, T1090
Input: HermeticWizard can copy files to other machines on a compromised network.

Tactics: TA0008
Techniques: T1570
Input: These frameworks are used collaboratively to verify the user and determine what actions the user is allowed to perform.

Tactics: TA0005, TA0008
Techniques: T1550.001, T1550
Input: Additionally, it is possible to avoid setting this flag using Drive-by Compromise, which may bypass Gatekeeper.

Tactics: TA0005
Techniques: T1553.001, T1553
Input: Proxysvc performs data exfiltration over the control server channel using a custom protocol.

Tactics: TA0010
Techniques: T1041
Input: PowerShell may also be used to download and run executables from the Internet, which can be executed from disk or in memory without touching disk.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: BLUELIGHT has captured a screenshot of the display every 30 seconds for the first 5 minutes after initiating a C2 loop, and then once every five minutes thereafter.

Tactics: TA0009
Techniques: T1113
Input: Attor has a plugin that enumerates files with specific extensions on all hard disk drives and stores file information in encrypted log files.

Tactics: TA0007
Techniques: T1083
Input: njRAT can also detect any removable drives connected to the system.

Tactics: TA0007
Techniques: T1120
Input: Lazarus Group has used a scheduled task named SRCheck to mask the execution of a malicious .dll.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Get2 has the ability to run executables with command-line arguments.

Tactics: TA0002
Techniques: T1059
Input: OSX/Shlayer can download payloads, and extract bytes from files.

Tactics: TA0011
Techniques: T1105
Input: OopsIE uses the Confuser protector to obfuscate an embedded .Net Framework assembly used for C2.

Tactics: TA0005
Techniques: T1027
Input: ShadowPad has used UDP for C2 communications.

Tactics: TA0011
Techniques: T1095
Input: Netwalker can delete the infected system's Shadow Volumes to prevent recovery.

Tactics: TA0040
Techniques: T1490
Input: APT39 has maintained persistence using the startup folder.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Clambling can create and start services on a compromised host.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: The IIS w3wp.exe process then loads the malicious DLL.

Tactics: TA0003
Techniques: T1505.004, T1505
Input: Authentication processes generally require a valid identity (, username) along with one or more authentication factors (, password, pin, physical smart card, token generator, ).

Tactics: TA0005, TA0008
Techniques: T1550
Input: DRATzarus has been named Flash.exe, and its dropper has been named IExplorer.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry.

Tactics: TA0043, TA0001
Techniques: T1598.001, T1598.002, T1566.003, T1566, T1566.002, T1566.001, T1598, T1598.003
Input: Kimsuky has staged collected data files under C:\Program Files\Common Files\System\Ole DB\.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: For example, on Linux systems SSH logon activity can be found in the logs located in /var/log/auth.log or /var/log/secure depending on the distro you are using.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: Use auditing tools capable of detecting hijacking opportunities on systems within an enterprise and correct them.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574
Input: Monitor for contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions that may attempt to hide artifacts associated with their behaviors to evade detection.

Tactics: TA0005
Techniques: T1564
Input: DarkWatchman has been delivered via spearphishing emails that contain a malicious zip file.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: GoldMax has written AES-encrypted and Base64-encoded configuration files to disk.

Tactics: TA0005
Techniques: T1027
Input: Adversaries may search WHOIS data to gather actionable information.

Tactics: TA0043
Techniques: T1596.002, T1596
Input: Monitor executed commands and arguments that may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053
Input: PLEAD samples were found to be highly obfuscated with junk code.

Tactics: TA0011
Techniques: T1001.001, T1001
Input: Higher privileges are often necessary to perform additional actions such as some methods of OS Credential Dumping.

Tactics: TA0004
Techniques: T1068
Input: Monitor newly constructed processes for unusual activity (, a process that does not use the network begins to do so) as well as the introduction of new files/programs.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: Frankenstein has enumerated hosts via Empire, gathering the username, domain name, machine name, and other system information.

Tactics: TA0009
Techniques: T1119
Input: Another Lazarus Group malware sample checks for the presence of the following Registry key:HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt.

Tactics: TA0007
Techniques: T1012
Input: SpyNote RAT is capable of performing a variety of alarming functions that includes:   Activating the device’s microphone and listening to live conversations  Executing commands on the device  Copying files from the device to a Command & Control (C&C) center  Recording screen captures  Viewing contacts  Reading SMS messages  The screenshot below shows part of the sandbox’s report on the SpyNote RAT’s signature and detected functions:          Figure 1 : Zscaler Cloud Sandbox Detection     The fake Netflix app we are analyzing in this blog appears to be built using an updated version of SpyNote RAT builder, which was leaked last year

Tactics: TA0007, TA0009, TA0011
Techniques: T1090.003, T1083, T1571, T1113, T1090
Input: BoomBox can execute an LDAP query to discover e-mail accounts for domain users.

Tactics: TA0007
Techniques: T1087.003, T1087
Input: The Registry key contains entries for the following:

Tactics: TA0003, TA0004
Techniques: T1547, T1547.010
Input: Monitor for creation of files (especially DLLs on webservers) that could be abused as malicious ISAPI extensions/filters or IIS modules.

Tactics: TA0003
Techniques: T1505.004, T1505
Input: However, there are instances where programs need to be executed in an elevated context to function properly, but the user running them may not have the specific required privileges.

Tactics: TA0004, TA0005
Techniques: T1548, T1548.001
Input: This information can help adversaries determine which local accounts exist on a system to aid in follow-on behavior.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Activity originating from unexpected sources may indicate improper permissions are set that is allowing access to data.

Tactics: TA0007
Techniques: T1619
Input: Lizar can decrypt its configuration data.

Tactics: TA0005
Techniques: T1140
Input: Adversaries may send spearphishing messages via third-party services to elicit sensitive information that can be used during targeting.

Tactics: TA0043
Techniques: T1598.001, T1598
Input: EKANS can determine the domain of a compromised host.

Tactics: TA0007
Techniques: T1016
Input: 22 Keylogging and exfiltrating data The exfiltrated data is base64 that decodes into more custom encoded strings that appear to be “/” delimited

Tactics: TA0005, TA0009
Techniques: T1140, T1560
Input: Monitor newly executed processes that may achieve persistence by adding a Registry key to the Active Setup of the local machine.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.014
Input: For more information related to HIDDEN COBRA activity, go to https://www.us-cert.gov/hiddencobra.If users or administrators detect the custom tools indicative of HIDDEN COBRA, these tools should be immediately flagged, reported to the DHS National Cybersecurity Communications and Integration Center (NCCIC) or the FBI Cyber Watch (CyWatch), and given highest priority for enhanced mitigation

Tactics: TA0005, TA0007, TA0011
Techniques: T1518.001, T1090.003, T1518, T1564, T1090, T1564.001
Input: Adversaries may also use Automated Collection on the local system.

Tactics: TA0009
Techniques: T1005
Input: LazyScripter has leveraged the BatchEncryption tool to perform advanced batch obfuscation and encoding techniques.

Tactics: TA0005
Techniques: T1027
Input: Doki has disguised a file as a Linux kernel module.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: To enable authentication, Kerberos requires that SPNs be associated with at least one service logon account (an account specifically tasked with running a service).

Tactics: TA0006
Techniques: T1558.003, T1558
Input: While invoking API functions, adversaries may also attempt to bypass defensive tools (ex: unhooking monitored functions via Disable or Modify Tools).

Tactics: TA0002
Techniques: T1106
Input: Clambling can set and delete Registry keys.

Tactics: TA0005
Techniques: T1112
Input: It is common for one-time codes to be sent via out-of-band communications (email, SMS).

Tactics: TA0006
Techniques: T1111
Input: Cannon can gather the username from the system.

Tactics: TA0007
Techniques: T1033
Input: NETWIRE can automatically archive collected data.

Tactics: TA0009
Techniques: T1119
Input: AADInternals can gather unsecured credentials for Azure AD services, such as Azure AD Connect, from a local machine.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: FIN8 has deleted tmp and prefetch files during post compromise cleanup activities.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Sidewinder has used tools to obtain the current system time.

Tactics: TA0007
Techniques: T1124
Input: Tropic Trooper is capable of enumerating the running processes on the system using pslist.

Tactics: TA0007
Techniques: T1057
Input: The database is located in the “/usr/lib/cva-ssys/My_BD” folder (“~/.local/cva-ssys/My_BD”—if the Trojan does not have root privileges)

Tactics: TA0004
Techniques: T1068
Input: Monitor newly executed processes that may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system.

Tactics: TA0003
Techniques: T1137.002, T1137
Input: The MSIL file contains the packed core payload in its .Net resource section

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Industroyer uses a custom DoS tool that leverages CVE-2015-5374 and targets hardcoded IP addresses of Siemens SIPROTEC devices.

Tactics: TA0040
Techniques: T1499, T1499.004
Input: Ke3chang transferred compressed and encrypted RAR files containing exfiltration through the established backdoor command and control channel during operations.

Tactics: TA0010
Techniques: T1041
Input: FIN7 has consistently utilized legally purchased code signing certificates to sign their CARBANAK payloads

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Adversaries may leverage code repositories to collect valuable information.

Tactics: TA0009
Techniques: T1213, T1213.003
Input: A good example of this is when malware is detected with a file signature and quarantined by anti-virus software.

Tactics: TA0005
Techniques: T1027, T1027.005
Input: KOMPROGO is capable of creating a reverse shell.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Kasidet has the ability to obtain a victim's system name and operating system version.

Tactics: TA0007
Techniques: T1082
Input: Adversaries may use the information from System Owner/User Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Tactics: TA0007
Techniques: T1033
Input: S-Type may save itself as a file named msdtc.exe, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Empire contains modules that can discover and exploit various DLL hijacking opportunities.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Diavol can enumerate victims' local and external IPs when registering with C2.

Tactics: TA0007
Techniques: T1016
Input: By using this method, it will copy itself into a running Internet Explorer process in order to avoid detection by running as an independent process

Tactics: TA0004, TA0005, TA0007
Techniques: T1057, T1055
Input: A gh0st RAT variant has used rundll32 for execution.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: For example, the following is a list of example information that may hold potential value to an adversary and may also be found on SharePoint:

Tactics: TA0009
Techniques: T1213, T1213.002
Input: NETWIRE can encrypt C2 communications.

Tactics: TA0011
Techniques: T1573
Input: Turla has used PowerShell to execute commands/scripts, in some cases via a custom executable or code from Empire's PSInject.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: APT29 was able to get SUNBURST signed by SolarWinds code signing certificates by injecting the malware into the SolarWinds Orion software lifecycle.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Transparent Tribe has directed users to open URLs hosting malicious content.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: POSHSPY uses PowerShell to execute various commands, one to execute its payload.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Conficker has used a DGA that seeds with the current UTC victim system date to generate domains.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: P.A.S. Webshell can delete scripts from a subdirectory of /tmp after they are run.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Gamaredon Group has used DOCX files to download malicious DOT document templates and has used RTF template injection to download malicious payloads.

Tactics: TA0005
Techniques: T1221
Input: Azorult can encrypt C2 traffic using XOR.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Ursnif has collected files from victim machines, including certificates and cookies.

Tactics: TA0009
Techniques: T1005
Input: cmd can be used to copy files to/from a remotely connected external system.

Tactics: TA0011
Techniques: T1105
Input: Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine.

Tactics: TA0004, TA0005
Techniques: T1548
Input: Lokibot has used process hollowing to inject itself into legitimate Windows process.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: Taidoor can use a stream cipher to decrypt stings used by the malware.

Tactics: TA0005
Techniques: T1140
Input: menuPass has used valid accounts including shared between Managed Service Providers and clients to move between the two environments.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078