madox81/Adema_ATTACK_DS huggingface dataset:
Input: Visitors are asked to download the “University Of Oxford Job Symposium Pre-Register Tool”:  The downloaded file (which is also signed with an AI Squared certificate), is a fake registration tool built by the attackers: OxfordSymposiumRegTool.exe f77ee804de304f7c3ea6b87824684b33 If run by the victim, their computer would get infected, while they are shown this registration process:    Note that after completing the “registration process”, the victim is asked to send the form to an email address in oxford-careers[.]com, which also belongs to the attackers

Tactics: TA0007
Techniques: T1057
Input: CLIs typically contain various permission levels required for different commands.

Tactics: TA0002
Techniques: T1059.008, T1059
Input: OSX_OCEANLOTUS.D scrambles and encrypts data using AES256 before sending it to the C2 server.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: NOKKI is written to %LOCALAPPDATA%\MicroSoft Updatea\svServiceUpdate.exe prior being executed in a new process in an apparent attempt to masquerade as a legitimate folder and file.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Flagpro can communicate with its C2 using HTTP.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Compromised systems outside of the victim environment may be used for these purposes, as well as purchased infrastructure such as cloud-based resources or virtual private servers.

Tactics: TA0011
Techniques: T1090, T1090.002
Input: This technique is abusing normal functionality in macOS and Linux systems, but sudo has the ability to log all input and output based on the LOG_INPUT and LOG_OUTPUT directives in the /etc/sudoers file.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: Leviathan has archived victim's data prior to exfiltration.

Tactics: TA0009
Techniques: T1560
Input: Cobalt Strike can recover hashed passwords.

Tactics: TA0006
Techniques: T1003, T1003.002
Input: Enumerating the SAM database requires SYSTEM level access.

Tactics: TA0006
Techniques: T1003, T1003.002
Input: DGAs can take the form of apparently random or "gibberish" strings (ex: istgmxdejdnxuyla.ru) when they construct domain names by generating each letter.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: Older documents used by Patchwork focused on the CVE-2017-0261 vulnerability, however in late January 2018 when, paradoxically, newer documents abandoned this vulnerability to attack the older CVE-2015-2545 vulnerability

Tactics: TA0002
Techniques: T1203
Input: RTM has distributed its malware via the RIG and SUNDOWN exploit kits, as well as online advertising network Yandex.Direct.

Tactics: TA0001
Techniques: T1189
Input: Dylibs are loaded into an application's address space allowing the malicious dylib to inherit the application's privilege level and resources.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.004, T1574
Input: Since a shortcut's target path likely will not change, modifications to shortcut files that do not correlate with known software changes, patches, removal, , may be suspicious.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Monitor logs for actions that could be taken to gather credentials to container and cloud infrastructure, including the use of discovery API calls by new or unexpected users and APIs that access Docker logs.

Tactics: TA0006
Techniques: T1552, T1552.007
Input: System architecture diagrams

Tactics: TA0009
Techniques: T1213, T1213.001, T1213.002
Input: Some examples of these relationships include IT services contractors, managed security providers, infrastructure contractors ( HVAC, elevators, physical security).

Tactics: TA0001
Techniques: T1199
Input: FIN7 has used port-protocol mismatches on ports such as 53, 80, 443, and 8080 during C2.

Tactics: TA0011
Techniques: T1571
Input: Monitor executed commands and arguments for actions that may target an Exchange server, Office 365, or Google Workspace to collect sensitive information.

Tactics: TA0009
Techniques: T1114, T1114.002
Input: HALFBAKED can execute PowerShell scripts.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: The KRBTGT password hash may be obtained using OS Credential Dumping and privileged access to a domain controller.

Tactics: TA0006
Techniques: T1558, T1558.001
Input: Meteor can use group policy to push a scheduled task from the AD to all network machines.

Tactics: TA0004, TA0005
Techniques: T1484.001, T1484
Input: Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems.

Tactics: TA0003
Techniques: T1505
Input: Monitor for contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions, may use NTFS file attributes to hide their malicious data in order to evade detection.

Tactics: TA0005
Techniques: T1564, T1564.004
Input: To obtain the passwords and hashes stored in memory, processes must open a maps file in the /proc filesystem for the process being analyzed.

Tactics: TA0006, TA0007
Techniques: T1033, T1003
Input: TrickBot can disable Windows Defender.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: QUADAGENT uses VBScripts.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Additionally, joined devices can be viewed via the Azure AD portal.

Tactics: TA0003
Techniques: T1098.005, T1098
Input: APT41 added a registry key in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost to establish persistence for Cobalt Strike.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Egregor has masqueraded the svchost.exe process to exfiltrate data.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Analysis APT34 sent a malicious .rtf file (MD5: a0e6933f4e0497269620f44a083b2ed4) as an attachment in a malicious spear phishing email sent to the victim organization

Tactics: TA0001
Techniques: T1566, T1566.001
Input: PLATINUM has used the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel for command and control.

Tactics: TA0011
Techniques: T1095
Input: Adversaries may target an Exchange server, Office 365, or Google Workspace to collect sensitive information.

Tactics: TA0009
Techniques: T1114, T1114.002
Input: It is different from other forms of spearphishing in that it employs the use of links to download malware contained in email, instead of attaching malicious files to the email itself, to avoid defenses that may inspect email attachments.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: TrailBlazer has the ability to use WMI for persistence.

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: APT37 leverages social networking sites and cloud platforms (AOL, Twitter, Yandex, Mediafire, pCloud, Dropbox, and Box) for C2.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: Consider use of services that may aid in the tracking of capabilities, such as certificates, in use on sites across the Internet.

Tactics: TA0042
Techniques: T1587
Input: Agent.btz obtains the victim username and saves it to a file.

Tactics: TA0007
Techniques: T1033
Input: CHOPSTICK has the capability to capture screenshots.

Tactics: TA0009
Techniques: T1113
Input: These audits should check if new local accounts are created that have not be authorized.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.003
Input: Adversaries may generate these cookies in order to gain access to web resources.

Tactics: TA0006
Techniques: T1606, T1606.001
Input: TajMahal has the ability to index files from drives, user profiles, and removable drives.

Tactics: TA0007
Techniques: T1083
Input: Attor's dispatcher can establish persistence via adding a Registry key with a logon script HKEY_CURRENT_USER\Environment "UserInitMprLogonScript" .

Tactics: TA0003, TA0004
Techniques: T1037.001, T1037
Input: InvisiMole can register a Windows service named CsPower as part of its execution chain, and a Windows service named clr_optimization_v2.0.51527_X86 to achieve persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Specifically, analysts should look for use of the runas command or similar artifacts.

Tactics: TA0004, TA0005
Techniques: T1134.002, T1134.003, T1134
Input: Sandworm Team has used Dropbear SSH with a hardcoded backdoor password to maintain persistence within the target network.

Tactics: TA0001, TA0003
Techniques: T1133
Input: NETWIRE has masqueraded as legitimate software including TeamViewer and macOS Finder.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: StreamEx has the ability to modify the Registry.

Tactics: TA0005
Techniques: T1112
Input: Firmware is software that is loaded and executed from non-volatile memory on hardware devices in order to initialize and manage device functionality.

Tactics: TA0040
Techniques: T1495
Input: These resources can be viewed within web applications such as the Kubernetes dashboard or can be queried via the Docker and Kubernetes APIs.

Tactics: TA0007
Techniques: T1613
Input: WarzoneRAT can use cmd.exe to execute malicious code.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: These sites may also have details highlighting business operations and relationships.

Tactics: TA0043
Techniques: T1594
Input: Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code.

Tactics: TA0005
Techniques: T1218, T1218.001
Input: PowerSploit's Invoke-Kerberoast module can request service tickets and return crackable ticket hashes.

Tactics: TA0006
Techniques: T1558.003, T1558
Input: Magic Hound malware gathers the victim's local IP address, MAC address, and external IP address.

Tactics: TA0007
Techniques: T1016
Input: Depending on how the environment is used, that data alone may not be useful due to benign use during normal operations.

Tactics: TA0007
Techniques: T1082
Input: Monitor for processes being viewed that may inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055.003, T1055
Input: Axiom has used digital certificates to deliver malware.

Tactics: TA0005
Techniques: T1553
Input: Fox Kitten has searched local system resources to access sensitive documents.

Tactics: TA0009
Techniques: T1005
Input: Stuxnet decrypts resources that are loaded into memory and executed.

Tactics: TA0005
Techniques: T1140
Input: Higaisa discovered system proxy settings and used them if available.

Tactics: TA0011
Techniques: T1090.001, T1090
Input: PowerSploit contains a collection of Exfiltration modules that can harvest credentials from Windows vault credential objects.

Tactics: TA0006
Techniques: T1555, T1555.004
Input: Additionally, depending on the virtual networking implementation (ex: bridged adapter), network traffic generated by the virtual instance can be difficult to trace back to the compromised host as the IP address and hostname might not match known values.

Tactics: TA0005
Techniques: T1564, T1564.006
Input: The shareDll32 module then enumerates and identifies systems connected on the same domain using WNetEnumResource and GetComputerNameW

Tactics: TA0007
Techniques: T1087
Input: TrickBot has attempted to get users to launch malicious documents to deliver its payload.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Use read-only containers, read-only file systems, and minimal images when possible to prevent the execution of commands.

Tactics: TA0002
Techniques: T1609
Input: On macOS this behavior is conceptually the same as on Linux, differing only in how the macOS dynamic libraries (dyld) is implemented at a lower level.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.006, T1574
Input: Code for new functionality can be included in these messages.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205
Input: An adversary could use VNC to remotely control and monitor a system to collect data and information to pivot to other systems within the network.

Tactics: TA0008
Techniques: T1021.005, T1021
Input: Monitor for newly constructed files that may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence.

Tactics: TA0003, TA0004
Techniques: T1543
Input: Packets produced from these protocols may have many fields and headers in which data can be concealed.

Tactics: TA0011
Techniques: T1071.002, T1071, T1071.003
Input: Silence has used RDP for lateral movement.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Proxysvc gathers product names from the Registry key: HKLM\Software\Microsoft\Windows NT\CurrentVersion ProductName and the processor description from the Registry key HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessorNameString.

Tactics: TA0007
Techniques: T1012
Input: Gold Dragon encrypts data using Base64 before being sent to the command and control server.

Tactics: TA0009
Techniques: T1560
Input: Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems.

Tactics: TA0011
Techniques: T1132
Input: Gorgon Group malware can use cmd.exe to download and execute payloads and to execute commands on the system.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Mimikatz The threat actors also uploaded tools to scan for and exploit potential vulnerabilities in the network, such as the well-known SMB vulnerability patched in commonly exploited by EternalBlue to move laterally to other systems on the network.

Tactics: TA0007
Techniques: T1046
Input: Bazar can decrypt downloaded payloads.

Tactics: TA0005
Techniques: T1140
Input: PolyglotDuke can use Twitter, Reddit, Imgur and other websites to get a C2 URL.

Tactics: TA0011
Techniques: T1102.001, T1102
Input: Empire can acquire local and domain user account information.

Tactics: TA0007
Techniques: T1087.002, T1087, T1087.001
Input: Execution Guardrails likely should not be mitigated with preventative controls because it may protect unintended targets from being compromised.

Tactics: TA0005
Techniques: T1480
Input: Users may be subjected to social engineering to get them to execute malicious code by, for example, opening a malicious document file or link.

Tactics: TA0002
Techniques: T1204
Input: Cannon can obtain victim drive information as well as a list of folders in C:\Program Files.

Tactics: TA0007
Techniques: T1083
Input: Carbanak enables concurrent Remote Desktop Protocol (RDP) sessions.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Chimera has copied tools between compromised hosts using SMB.

Tactics: TA0008
Techniques: T1570
Input: Pasam creates a backdoor through which remote attackers can delete files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Bisonal has the capability to download files to execute on the victim’s machine.

Tactics: TA0011
Techniques: T1105
Input: Proxysvc uses HTTP over SSL to communicate commands with the control server.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: BlackEnergy 2 contains a "Destroy" plug-in that destroys data stored on victim hard drives by overwriting file contents.

Tactics: TA0040
Techniques: T1485
Input: PlugX adds Run key entries in the Registry to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: These files typically require root permissions to modify and are executed each time any shell on a system launches.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: Elderwood has encrypted documents and malicious executables.

Tactics: TA0005
Techniques: T1027
Input: A possible explanation for this is that the document was copied to another system with an incorrectly set system time, then saved with the incorrect time

Tactics: TA0007
Techniques: T1124
Input: Ursnif has used Reg to query the Registry for installed programs.

Tactics: TA0007
Techniques: T1012
Input: Agent Tesla has dropped RegAsm.exe onto systems for performing malicious activity.

Tactics: TA0005
Techniques: T1218.009, T1218
Input: Another variation, known as a SSL renegotiation attack, takes advantage of a protocol feature in SSL/TLS.

Tactics: TA0040
Techniques: T1499.002, T1499
Input: TeamTNT has used an IRC bot for C2 communications.

Tactics: TA0011
Techniques: T1071
Input: ROKRAT can check for VMware-related files and DLLs related to sandboxes.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Metamorfo has communicated with hosts over raw TCP on port 9999.

Tactics: TA0011
Techniques: T1571
Input: PoshC2 has the ability to persist on a system using WMI events.

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: BloodHound has the ability to collect local admin information via GPO.

Tactics: TA0007
Techniques: T1615
Input: The 2.0 versions require a dropper to decipher and launch the AES encrypted QUASARRAT payload

Tactics: TA0005
Techniques: T1027
Input: Valak has the ability to identify the domain and the MAC and IP addresses of an infected machine.

Tactics: TA0007
Techniques: T1016
Input: Msv: Interactive logons, batch logons, and service logons are done through the MSV authentication package.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Container files downloaded from the Internet will be marked with MOTW but the files within may not inherit the MOTW after the container files are extracted and/or mounted.

Tactics: TA0005
Techniques: T1553, T1553.005
Input: Features  TCP network stream (IPv4 & IPv6 support) Fast network serialization (Protocol Buffers) Compressed (QuickLZ) & Encrypted (TLS) communication Multi-Threaded UPnP Support No-Ip.com Support Visit Website (hidden & visible) Show Messagebox Task Manager File Manager Startup Manager Remote Desktop Remote Shell Download & Execute Upload & Execute System Information Computer Commands (Restart, Shutdown, Standby) Keylogger (Unicode Support) Reverse Proxy (SOCKS5) Password Recovery (Common Browsers and FTP Clients) Registry Editor  Supported runtimes and operating systems  .NET Framework 4.0 Client Profile or higher (Download) Supported operating systems (32- and 64-bit)  Windows XP SP3 Windows Server 2003 Windows Vista Windows Server 2008 Windows 7 Windows Server 2012 Windows 8/8.1 Windows 10    Compiling Open the project in Visual Studio 2017+ and restore the NuGET packages

Tactics: TA0002, TA0007, TA0008, TA0011
Techniques: T1021, T1021.002, T1106, T1105, T1010
Input: Execution via VDSO hijacking may also evade detection from security products since the execution is masked under a legitimate process.

Tactics: TA0004, TA0005
Techniques: T1055.014, T1055
Input: Patchwork collected the victim username and whether it was running as admin, then sent the information to its C2 server.

Tactics: TA0007
Techniques: T1033
Input: OilRig has abused the Outlook Home Page feature for persistence.

Tactics: TA0003
Techniques: T1137, T1137.004
Input: Grandoreiro can utilize web services including Google sites to send and receive C2 data.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: For example, a Windows screensaver executable named March 25 \u202Excod.scr will display as March 25 rcs.docx.

Tactics: TA0005
Techniques: T1036, T1036.002
Input: Carberp has queued an APC routine to explorer.exe by calling ZwQueueApcThread.

Tactics: TA0004, TA0005
Techniques: T1055.004, T1055
Input: In most lures, one scheduled task persisted an APT32-specific backdoor and the other scheduled task initialized a commercially-available backdoor as backup

Tactics: TA0002, TA0003, TA0004, TA0005
Techniques: T1053.005, T1053, T1036
Input: These locations should be monitored and audited.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.015
Input: Adversaries may abuse Microsoft Office add-ins to obtain persistence on a compromised system.

Tactics: TA0003
Techniques: T1137, T1137.006
Input: njRAT has a module for performing remote desktop access.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Zox can enumerate attached drives.

Tactics: TA0007
Techniques: T1082
Input: ShimRat has the capability to upload collected files to a C2.

Tactics: TA0009
Techniques: T1005
Input: SideTwist has primarily used port 443 for C2 but can use port 80 as a fallback.

Tactics: TA0011
Techniques: T1008
Input: FatDuke can copy files and directories from a compromised host.

Tactics: TA0009
Techniques: T1005
Input: Configure robust, consistent account activity audit policies across the enterprise and with externally accessible services.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.001
Input: Tor encapsulates traffic in multiple layers of encryption, using TLS by default.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: BADNEWS typically loads its DLL file into a legitimate signed Java or VMware executable.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: This may occur through compromising the SSH agent itself or by having access to the agent's socket.

Tactics: TA0008
Techniques: T1563, T1563.001
Input: APT29 also created a scheduled task to maintain SUNSPOT persistence when the host booted during the 2020 SolarWinds intrusion.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Monitor account activity for attempts to share data, snapshots, or backups with untrusted or unusual accounts on the same cloud service provider.

Tactics: TA0010
Techniques: T1537
Input: Bundlore has the ability to enumerate what browser is being used as well as version information for Safari.

Tactics: TA0007
Techniques: T1518
Input: Ursnif droppers have used COM objects to execute the malware's full executable payload.

Tactics: TA0002
Techniques: T1559, T1559.001
Input: In spearphishing, a specific individual, company, or industry will be targeted by the adversary.

Tactics: TA0043, TA0001
Techniques: T1566, T1598
Input: Dump and inspect BIOS images on vulnerable systems and compare against known good images.

Tactics: TA0003, TA0005
Techniques: T1542.001, T1542
Input: SpeakUp uses Python scripts.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Conti can enumerate remote open SMB network shares using NetShareEnum().

Tactics: TA0007
Techniques: T1135
Input: For early Gazer versions, the compilation timestamp was faked.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: Sidewinder has used the Windows service winmgmts:\.\root\SecurityCenter2 to check installed antivirus products.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Regin appears to have functionality to sniff for credentials passed over HTTP, SMTP, and SMB.

Tactics: TA0006, TA0007
Techniques: T1040
Input: QUADAGENT uses PowerShell scripts for execution.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: When the service starts or is restarted, then the adversary-controlled program will execute, allowing the adversary to establish persistence and/or privilege escalation to the account context the service is set to execute under (local/domain account, SYSTEM, LocalService, or NetworkService).

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.011, T1574
Input: Traps blocks all of the files currently associated with Gorgon Group    Appendix   Analysis of a targeted attack “1971 Liberation War Freedom Fighters in Pakistan ArmyCustody Database98” The delivery documents used in the targeted attacks are Microsoft Office documents that contain a macro that attempts to compromise the system

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Common public key encryption algorithms include RSA and ElGamal.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Impacket contains various modules emulating other service execution tools such as PsExec.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: PUNCHBUGGY enables remote interaction and can obtain additional code over HTTPS GET and POST requests.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Monitor for executed processes (such as ipconfig/ifconfig and arp) with arguments that may look for details about the network configuration and settings, such as IP and/or MAC addresses.

Tactics: TA0007
Techniques: T1016
Input: This is a likely indicator that a binary was renamed after it was compiled.

Tactics: TA0005
Techniques: T1036.003, T1036
Input: In this ongoing campaign, FIN7 is targeting organizations with spear phishing emails containing either a malicious DOCX or RTF file – two versions of the same LNK file and VBScript technique

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547