madox81/Adema_ATTACK_DS huggingface dataset:
Input: Adversaries may seek information about their already identified targets, or use these datasets to discover opportunities for successful breaches.

Tactics: TA0043
Techniques: T1596, T1596.005
Input: Adversaries may smuggle data and files past content filters by hiding malicious payloads inside of seemingly benign HTML files.

Tactics: TA0005
Techniques: T1027.006, T1027
Input: The SSP configuration is stored in two Registry keys: HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Security Packages and HKLM\SYSTEM\CurrentControlSet\Control\Lsa\OSConfig\Security Packages.

Tactics: TA0003, TA0004, TA0006
Techniques: T1003, T1547.005, T1547, T1003.001
Input: Monitor specifically for events related to snapshots and rollbacks and VM configuration changes, that are occurring outside of normal activity.

Tactics: TA0005
Techniques: T1578, T1578.004
Input: Ensure proper system and access isolation for critical network systems through use of account privilege separation.

Tactics: TA0002, TA0008
Techniques: T1072
Input: Typically, a user engages with a file system through applications that allow them to access files and directories, which are an abstraction from their physical location (ex: disk sector).

Tactics: TA0005
Techniques: T1564, T1564.005
Input: Pay2Key has the ability to gather the hostname of the victim machine.

Tactics: TA0007
Techniques: T1082
Input: Any user or administrator within the organization (or adversary with valid credentials) can create rules to automatically forward all received messages to another recipient, forward emails to different locations based on the sender, and more.

Tactics: TA0009
Techniques: T1114, T1114.003
Input: The FireEye FLARE team released a WMI repository-parsing tool that allows investigators to extract embedded data from the WMI repository and identify WMI persistence.

Tactics: TA0002
Techniques: T1047
Input: Typically, the resources for a link target will be an HTML page that may include some client-side script such as JavaScript to decide what content to serve to the user.

Tactics: TA0042
Techniques: T1608.005, T1608
Input: Carberp has queried the infected system's registry searching for specific registry keys associated with antivirus products.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: While performing the analysis on the delivery documents using the .sct file AppLocker bypass, we noticed the C# payload was functionally similar to the original RogueRobin payload

Tactics: TA0005
Techniques: T1027
Input: Adversaries may use stolen application access tokens to bypass the typical authentication process and access restricted accounts, information, or services on remote systems.

Tactics: TA0005, TA0008
Techniques: T1550.001, T1550
Input: Toolkits like the PowerSploit framework contain PowerUp modules that can be used to explore systems for service file system permissions weaknesses.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.010, T1574
Input: Proton modifies the tty_tickets line in the sudoers file.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: Confucius has used HTTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: On Windows and Linux, these system processes are referred to as services.

Tactics: TA0003, TA0004
Techniques: T1543
Input: Seasalt is capable of installing itself as a service.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about usernames listed in AD.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: Turian has the ability to take screenshots.

Tactics: TA0009
Techniques: T1113
Input: Information stored in a repository may vary based on the specific instance or environment.

Tactics: TA0009
Techniques: T1213
Input: Tonto Team has used tools such as NBTscan to enumerate network shares.

Tactics: TA0007
Techniques: T1135
Input: The login shell then configures the user environment with ~/.zprofile and ~/.zlogin.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: Systemd utilizes configuration files known as service units to control how services boot and under what conditions.

Tactics: TA0003, TA0004
Techniques: T1543.002, T1543
Input: njRAT uses Base64 encoding for C2 traffic.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: NanoCore uses JavaScript files.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Felismus collects the current username and sends it to the C2 server.

Tactics: TA0007
Techniques: T1033
Input: Technique Description   Fan Check The Trojan will perform the following WMI query:   Select * from Win32_Fan   According to MSDN, this query should return a class that provides statistics on the CPU fan

Tactics: TA0002
Techniques: T1047
Input: Transparent Tribe has crafted VBS-based malicious documents.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: CaddyWiper can obtain a list of current processes.

Tactics: TA0007
Techniques: T1057
Input: LoJax is a UEFI BIOS rootkit deployed to persist remote access software on some targeted systems.

Tactics: TA0003, TA0005
Techniques: T1014, T1542.001, T1542
Input: Valak can download additional modules and malware capable of using separate C2 channels.

Tactics: TA0011
Techniques: T1104
Input: Monitor for process activity (such as unexpected processes spawning outside a container and/or on a host) that might indicate an attempt to escape from a privileged container to host.

Tactics: TA0004
Techniques: T1611
Input: LitePower can use various API calls.

Tactics: TA0002
Techniques: T1106
Input: Sharpshooter's first-stage downloader resolved various Windows libraries and APIs, including LoadLibraryA(), GetProcAddress(), and CreateProcessA().

Tactics: TA0002
Techniques: T1106
Input: Chaes has added persistence via the Registry key software\microsoft\windows\currentversion\run\microsoft windows html help.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Blue Mockingbird has used XMRIG to mine cryptocurrency on victim systems.

Tactics: TA0040
Techniques: T1496
Input: NDiskMonitor can download and execute a file from given URL.

Tactics: TA0011
Techniques: T1105
Input: Finally, the payload is triggered by sending the LVM_SORTITEMS message to the SysListView32 child of the process window, with the payload within the newly allocated buffer passed and executed as the ListView_SortItems callback.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.015
Input: UBoatRAT has used HTTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: MuddyWater has used the native Windows cabinet creation tool, makecab.exe, likely to compress stolen data to be uploaded.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Ke3chang performs discovery of permission groups net group /domain.

Tactics: TA0007
Techniques: T1069.002, T1069
Input: SDBbot has the ability to inject a downloaded DLL into a newly created rundll32.exe process.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Empire can perform port scans from an infected host.

Tactics: TA0007
Techniques: T1046
Input: Metamorfo collects a list of installed antivirus software from the victim’s system.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Kasidet has the ability to initiate keylogging and screen captures.

Tactics: TA0009
Techniques: T1113
Input: Patchwork removed certain files and replaced them so they could not be retrieved.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: APT19 used Regsvr32 to bypass application control techniques.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Kimsuky has the ability to enumerate all files and directories on an infected system.

Tactics: TA0007
Techniques: T1083
Input: Revenge RAT uses mshta.exe to run malicious scripts on the system.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: APT32 used NTFS alternate data streams to hide their payloads.

Tactics: TA0005
Techniques: T1564, T1564.004
Input: XCSSET uses the ssh launchdaemon to elevate privileges, bypass system controls, and enable remote access to the victim.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: Kimsuky has used e-mail to send exfiltrated data to C2 servers.

Tactics: TA0011
Techniques: T1071, T1071.003
Input: gpprefdecrypt.py

Tactics: TA0006
Techniques: T1552, T1552.006
Input: Clop has been packed to help avoid detection.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Carbanak malware installs itself as a service to provide persistence and SYSTEM privileges.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Infrastructure as a Service (IaaS) cloud providers such as AWS, GCP, and Azure allow access to instance and virtual machine information via APIs.

Tactics: TA0007
Techniques: T1082
Input: Silent Librarian has also made use of a variety of URL shorteners for these staged websites.

Tactics: TA0042
Techniques: T1608.005, T1608
Input: HISTCONTROL can also be set to ignore duplicate commands by setting it to "ignoredups".

Tactics: TA0005
Techniques: T1562.003, T1562
Input: Fox Kitten has used Scheduled Tasks for persistence and to load and execute a reverse proxy binary.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: POSHSPY leverages two of the tools the group frequently uses: PowerShell and Windows Management Instrumentation (WMI)

Tactics: TA0002
Techniques: T1047
Input: BlackEnergy has gathered information about local network connections using netstat.

Tactics: TA0007
Techniques: T1049
Input: POWRUNER can download or upload files from its C2 server.

Tactics: TA0011
Techniques: T1105
Input: Monitor executed commands and arguments that may stop or disable services on a system to render those services unavailable to legitimate users.

Tactics: TA0040
Techniques: T1489
Input: Ramsay can take screenshots every 30 seconds as well as when an external removable storage device is connected.

Tactics: TA0009
Techniques: T1113
Input: The config file provides download instructions for the loader

Tactics: TA0011
Techniques: T1105
Input: SUNBURST used VBScripts to initiate the execution of payloads.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: For example, find / -perm +4000 2>/dev/null can be used to find files with setuid set and find / -perm +2000 2>/dev/null may be used for setgid.

Tactics: TA0004, TA0005
Techniques: T1548, T1548.001
Input: Responses from the Pisloader C2 server are base32-encoded.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: njRAT gathers information about opened windows during the initial infection.

Tactics: TA0007
Techniques: T1010
Input: In many cases, additional stealers, RATs, and other malware were observed being hosted on the same web servers.Analysis of HawkEye Reborn The campaign starts with sending the aforementioned Excel sheets that exploit the well-known CVE-2017-11882 vulnerability, an arbitrary code execution bug in Microsoft Office

Tactics: TA0002
Techniques: T1203
Input: Instead of compromising a third-party Server or renting a Virtual Private Server, adversaries may opt to configure and run their own servers in support of operations.

Tactics: TA0042
Techniques: T1583.004, T1583
Input: BadPatch has a keylogging capability.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: In infrastructure-as-a-service (IaaS) environments, after gaining access through Cloud Accounts, adversaries may generate or import their own SSH keys using either the CreateKeyPair or ImportKeyPair API in AWS or the gcloud compute os-login ssh-keys add command in GCP.

Tactics: TA0003
Techniques: T1098.001, T1098
Input: Okrum's backdoor deletes files after they have been successfully uploaded to C2 servers.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Drovorub can download files to a compromised host.

Tactics: TA0011
Techniques: T1105
Input: Caterpillar WebShell can gather the IP address from the victim's machine using the IP config command.

Tactics: TA0007
Techniques: T1016
Input: Follow best practices in restricting access to privileged accounts to avoid hostile programs from accessing such sensitive information.

Tactics: TA0006
Techniques: T1003, T1003.008
Input: Adversaries may also directly start services through Service Execution.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Mustang Panda has delivered initial payloads hidden using archives and encoding measures.

Tactics: TA0005
Techniques: T1027
Input: FELIXROOT uses WMI to query the Windows Registry.

Tactics: TA0002
Techniques: T1047
Input: Bazar can create a scheduled task for persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: SodaMaster can check for the presence of the Registry key HKEY_CLASSES_ROOT\Applications\VMwareHostOpen.exe before proceeding to its main functionality.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Third-party entities can include technology companies that specialize in malware and exploits, criminal marketplaces, or from individuals.

Tactics: TA0042
Techniques: T1588
Input: File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations.

Tactics: TA0003, TA0005
Techniques: T1197
Input: After data is collected by Stealth Falcon malware, it is exfiltrated over the existing C2 channel.

Tactics: TA0010
Techniques: T1041
Input: Part of APT28's operation involved using CHOPSTICK modules to copy itself to air-gapped machines, using files written to USB sticks to transfer data and command traffic.

Tactics: TA0011
Techniques: T1092
Input: Cache.dll code flow overview RC4 decrypt hardcoded c2 and urls resolve hidden function calls collect identifying victim system data encrypt collected data send stolen data to c2 and retrieve commands Cache.dll code details Structurally, “Cache.dll” is a fairly large backdoor at 425KB

Tactics: TA0005, TA0009, TA0010
Techniques: T1140, T1041, T1005
Input: AppleScripts can also be executed as plain text shell scripts by adding #!/usr/bin/osascript to the start of the script file.

Tactics: TA0002
Techniques: T1059.002, T1059
Input: SILENTTRINITY has the ability to set its window state to hidden.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: PoetRAT used file system monitoring to track modification and enable automatic exfiltration.

Tactics: TA0009
Techniques: T1119
Input: QUADAGENT gathers the victim username.

Tactics: TA0007
Techniques: T1033
Input: Monitor for changes made to the Office Test Registry key.

Tactics: TA0003
Techniques: T1137.002, T1137
Input: OceanSalt can extract drive information from the endpoint and search files on the system.

Tactics: TA0007
Techniques: T1083
Input: The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain.

Tactics: TA0003, TA0004
Techniques: T1547.008, T1547
Input: Cobalt Strike can modify Registry values within HKEY_CURRENT_USER\Software\Microsoft\Office\\Excel\Security\AccessVBOM\ to enable the execution of additional code.

Tactics: TA0005
Techniques: T1112
Input: Windshift has used icons mimicking MS Office files to mask malicious executables.

Tactics: TA0005
Techniques: T1036
Input: In addition to these tools, we believe OilRig attackers obtained credentials through, bruteforcing, SQL injections, and using traditional credential harvesting toolkits as we discussed in the Striking Oil blog published in September 2017

Tactics: TA0006
Techniques: T1003
Input: It is also possible to detect the usage of the GCP API with the sourceSnapshot parameter pointed to global/snapshots/[BOOT_SNAPSHOT_NAME].

Tactics: TA0005
Techniques: T1578, T1578.001
Input: There is usually a delay between when an exploit is discovered and when it is made public.

Tactics: TA0042
Techniques: T1588, T1588.005
Input: XCSSET exfiltrates data stolen from a system over its C2 channel.

Tactics: TA0010
Techniques: T1041
Input: Modifying the Dll and FuncName Registry values in HKLM\SOFTWARE[\WOW6432Node]Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg{SIP_GUID} that point to the dynamic link library (DLL) providing a SIP’s CryptSIPDllGetSignedDataMsg function, which retrieves an encoded digital certificate from a signed file. By pointing to a maliciously-crafted DLL with an exported function that always returns a known good signature value (ex: a Microsoft signature for Portable Executables) rather than the file’s real signature, an adversary can apply an acceptable signature value to all files using that SIP  (although a hash mismatch will likely occur, invalidating the signature, since the hash returned by the function will not match the value computed from the file).

Tactics: TA0005
Techniques: T1553, T1553.003
Input: FIN5 has used legitimate VPN, Citrix, or VNC credentials to maintain access to a victim environment.

Tactics: TA0001, TA0003
Techniques: T1133
Input: Cyber analysts are encouraged to review the information provided in this alert to detect signs of malicious network activity.Tools and capabilities used by HIDDEN COBRA actors include DDoS botnets, keyloggers, remote access tools (RATs), and wiper malware

Tactics: TA0007
Techniques: T1518.001, T1518, T1018
Input: TG-3390 attempts to reenter the environment by identifying accounts that do not require two-factor authentication for remote access solutions, and then brute forcing usernames and passwords

Tactics: TA0006
Techniques: T1110
Input: Consider disabling WDigest authentication.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Chrommme can exfiltrate collected data via C2.

Tactics: TA0010
Techniques: T1041
Input: Aside from the command line, scripts can be executed in numerous ways including Mail rules, Calendar.app alarms, and Automator workflows.

Tactics: TA0002
Techniques: T1059.002, T1059
Input: Volatile Cedar has targeted publicly facing web servers, with both automatic and manual vulnerability discovery.

Tactics: TA0001
Techniques: T1190
Input: Web proxies can be used to enforce external network communication policy that prevents use of unauthorized external services.

Tactics: TA0011
Techniques: T1102.001, T1102.002, T1102.003, T1102
Input: APT29 created tokens using compromised SAML signing certificates.

Tactics: TA0006
Techniques: T1606, T1606.002
Input: In double flux cases, nothing is static.

Tactics: TA0011
Techniques: T1568.001, T1568
Input: Changes could also include new services and modification of existing binary paths to point to malicious files.

Tactics: TA0005
Techniques: T1112
Input: Adversaries may manipulate accounts to maintain access to victim systems.

Tactics: TA0003
Techniques: T1098
Input: An adversary may do this when they have a specific, existing process they want to assign the new token to.

Tactics: TA0004, TA0005
Techniques: T1134, T1134.001
Input: Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism.

Tactics: TA0006
Techniques: T1110
Input: Adversaries may buy, steal, or download malware that can be used during targeting.

Tactics: TA0042
Techniques: T1588, T1588.001
Input: In some cases it may be possible to pivot on known pieces of domain registration information to uncover other infrastructure purchased by the adversary.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: RunningRAT kills antimalware running process.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Melcoz has been spread through malicious links embedded in e-mails.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Prikormka uses rundll32.exe to load its DLL.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: On Windows 10, enable Attack Surface Reduction (ASR) rules to block processes created by PsExec from running.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Monitor for changes made to ACLs and file/directory ownership.

Tactics: TA0005
Techniques: T1222
Input: false under LSFileQuarantineEnabled indicates that an application does not use the quarantine flag.

Tactics: TA0005
Techniques: T1553.001, T1553
Input: Volgmer queries the system to identify existing services.

Tactics: TA0007
Techniques: T1007
Input: In addition, multiple APT40 command and control (C2) domains were initially registered by China based domain resellers and had Whois records with Chinese location information, suggesting a China based infrastructure procurement process

Tactics: TA0011
Techniques: T1102
Input: Registry entries for existing COM objects may change infrequently.

Tactics: TA0003, TA0004
Techniques: T1546.015, T1546
Input: Since the binary may be signed and/or native on Windows systems, proxying execution via verclsid.exe may bypass application control solutions that do not account for its potential abuse.

Tactics: TA0005
Techniques: T1218, T1218.012
Input: USBS Deletes the file created by the USB command to reverse the effect

Tactics: TA0005
Techniques: T1070, T1070.004
Input: TA551 has used regsvr32.exe to load malicious DLLs.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Conti can retrieve the ARP cache from the local system by using the GetIpNetTable() API call and check to ensure IP addresses it connects to are for local, non-Internet, systems.

Tactics: TA0007
Techniques: T1016
Input: FIN10 has used batch scripts and scheduled tasks to delete critical system files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: For example, security products may load their own modules and/or modify those loaded by processes to facilitate data collection.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Monitor the Registry for changes to the LSA Registry keys.

Tactics: TA0003, TA0004
Techniques: T1547.002, T1547
Input: Monitor file creation for files named after partial directories and in locations that may be searched for common processes through the environment variable, or otherwise should not be user writable.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.008, T1574.009, T1574
Input: QakBot can check the compromised host for the presence of multiple executables associated with analysis tools and halt execution if any are found.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Hikit is a Rootkit that has been used by Axiom.

Tactics: TA0005
Techniques: T1014
Input: APT32 uses the Invoke-Obfuscation framework to obfuscate their PowerShell and also performs other code obfuscation.

Tactics: TA0005
Techniques: T1027
Input: KOCTOPUS has used -WindowsStyle Hidden to hide the command window.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: TA505 has used a wide variety of ransomware, such as Locky, Jaff, Bart, Philadelphia, and GlobeImposter, to encrypt victim files and demand a ransom payment.

Tactics: TA0040
Techniques: T1486
Input: WINDSHIELD can gather the victim user name.

Tactics: TA0007
Techniques: T1033
Input: ThiefQuest invokes time call to check the system's time, executes a sleep command, invokes a second time call, and then compares the time difference between the two time calls and the amount of time the system slept to identify the sandbox.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: The document brought Talos a new gift - a new version of ROKRAT

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: RogueRobin decodes an embedded executable using base64 and decompresses it.

Tactics: TA0005
Techniques: T1140
Input: Gold Dragon establishes persistence in the Startup folder.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Monitor newly constructed files that may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events.

Tactics: TA0003, TA0004
Techniques: T1546
Input: RGDoor uses HTTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: KGH_SPY has the ability to steal data from the Chrome, Edge, Firefox, Thunderbird, and Opera browsers.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Network logon scripts can be assigned using Active Directory or Group Policy Objects.

Tactics: TA0003, TA0004
Techniques: T1037.003, T1037
Input: Olympic Destroyer uses API calls to enumerate the infected system's ARP table.

Tactics: TA0007
Techniques: T1016
Input: The tactic also serves to mask malicious C2 and exfiltration traffic and make it appear innocuous

Tactics: TA0011
Techniques: T1132