madox81/Adema_ATTACK_DS huggingface dataset:
Input: OwaAuth has been loaded onto Exchange servers and disguised as an ISAPI filter (owaauth.dll).

Tactics: TA0003
Techniques: T1505.004, T1505
Input: ShimRatReporter gathered the operating system name and specific Windows version of an infected machine.

Tactics: TA0007
Techniques: T1082
Input: build_downer has the ability to add itself to the Registry Run key for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Next, the buffer is encrypted using the RC4 algorithm with the 50-byte key (also stored in the backdoor’s body)

Tactics: TA0005
Techniques: T1027
Input: CHOPSTICK encrypts C2 communications with RC4.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Services or processes may not allow for modification of their data stores while running.

Tactics: TA0040
Techniques: T1489
Input: TYPEFRAME has used a malicious Word document for delivery with VBA macros for execution.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Scan file objects reported during the PsSetCreateProcessNotifyRoutine,  which triggers a callback whenever a process is created or deleted, specifically looking for file objects with enabled write access.

Tactics: TA0004, TA0005
Techniques: T1055.013, T1055
Input: SysUpdate can use packed binaries.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Monitor executed commands and arguments that may abuse Microsoft Office templates to obtain persistence on a compromised system.

Tactics: TA0003
Techniques: T1137, T1137.001
Input: Remsec can perform DLL injection.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Limit domain admin account permissions to domain controllers and limited servers.

Tactics: TA0005, TA0006, TA0008
Techniques: T1550.003, T1558, T1558.001, T1550
Input: Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.

Tactics: TA0011
Techniques: T1573
Input: The overwritten instruction (displayed in Figure 1) is used to call the “WinExec” function from kernel32.dll, as depicted in the instruction at 00430c12, which calls the “WinExec” function

Tactics: TA0002
Techniques: T1106
Input: Fysbis has used the command ls /etc | egrep -e"fedora*|debian*|gentoo*|mandriva*|mandrake*|meego*|redhat*|lsb-*|sun-*|SUSE*|release" to determine which Linux OS version is running.

Tactics: TA0007
Techniques: T1082
Input: Mis-Type first attempts to use a Base64-encoded network protocol over a raw TCP socket for C2, and if that method fails, falls back to a secondary HTTP-based protocol to communicate to an alternate C2 server.

Tactics: TA0011
Techniques: T1008
Input: Monitor for changed made to .manifest/.local redirection files, or file systems for moving, renaming, replacing, or modifying DLLs.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: ROKRAT can use  SetWindowsHookEx and GetKeyNameText to capture keystrokes.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Bazar can collect the time on the compromised host.

Tactics: TA0007
Techniques: T1124
Input: PROMETHIUM has created new services and modified existing services for persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Astaroth uses WMIC to execute payloads.

Tactics: TA0002
Techniques: T1047
Input: Identify and block potentially malicious software executed through accessibility features functionality by using application control  tools, like Windows Defender Application Control, AppLocker,   or Software Restriction Policies  where appropriate.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: Agent Tesla can steal data from the victim’s clipboard.

Tactics: TA0009
Techniques: T1115
Input: TajMahal has the ability to identify the Internet Explorer (IE) version on an infected host.

Tactics: TA0007
Techniques: T1518
Input: Monitor processes and command-line arguments for actions that could be taken to modify the code signing policy of a system, such as bcdedit.exe -set TESTSIGNING ON.

Tactics: TA0005
Techniques: T1553, T1553.006
Input: BUGJUICE is a backdoor that is executed by launching a benign file and then hijacking the search order to load a malicious dll into it

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: SMOKEDHAM has been delivered via malicious links in phishing emails.

Tactics: TA0043
Techniques: T1598, T1598.003
Input: HTML5 also introduced a download attribute that may be used to initiate file downloads.

Tactics: TA0005
Techniques: T1027.006, T1027
Input: Egregor has disabled Windows Defender to evade protections.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: After copying itself to a DLL file, a variant of Elise calls the DLL file using rundll32.exe.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: The knowledge of local system permission groups can help adversaries determine which groups exist and which users belong to a particular group.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: Adversaries may abuse container files such as compressed/archive (.arj, .gzip) and/or disk image (.iso, .vhd) file formats to deliver malicious payloads that may not be tagged with MOTW.

Tactics: TA0005
Techniques: T1553, T1553.005
Input: The FIVEHANDS payload is encrypted with AES-128.

Tactics: TA0005
Techniques: T1027
Input: Mustang Panda has delivered web bugs and malicious links to their intended targets.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: The Proc filesystem on Linux contains a great deal of information regarding the state of the running operating system.

Tactics: TA0006
Techniques: T1003, T1003.007
Input: Adversaries may match or approximate the name or location of legitimate files or resources when naming/placing them.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: RogueRobin gathers BIOS versions and manufacturers, the number of CPU cores, the total physical memory, and the computer name.

Tactics: TA0007
Techniques: T1082
Input: Consider applying SID Filtering to interforest trusts, such as forest trusts and external trusts, to exclude SID-History from requests to access domain resources.

Tactics: TA0004, TA0005
Techniques: T1134.005, T1134
Input: APT39 has used malware to decrypt encrypted CAB files.

Tactics: TA0005
Techniques: T1140
Input: Doki has used the DynDNS service and a DGA based on the Dogecoin blockchain to generate C2 domains.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: Adversaries may establish persistence by executing malicious content triggered by a file type association.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.001
Input: Examining the use of the unique user agents’ strings over time shows that while previously only the Mozilla/5.0 user agent was in use, since mid 2017 all three user agent strings have been used by the Zebrocy tool for its C2 communications

Tactics: TA0003, TA0004, TA0007
Techniques: T1033, T1543.001, T1543
Input: Use auditing tools capable of detecting folder permissions abuse opportunities on systems, especially reviewing changes made to folders by third-party software.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: SUNBURST used DNS for C2 traffic designed to mimic normal SolarWinds API communications.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Suspicious applications should be investigated and removed.

Tactics: TA0006
Techniques: T1528
Input: Adversaries may also send a gratuitous ARP reply that maliciously announces the ownership of a particular IP address to all the devices in the local network segment.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.002
Input: The group also uses a tool to execute commands on remote computers.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Instead of buying, leasing, or renting infrastructure an adversary may compromise infrastructure and use it during other phases of the adversary lifecycle.

Tactics: TA0042
Techniques: T1584
Input: Bundlore can persist via a LaunchDaemon.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: APT32 executed shellcode to collect the username on the victim's machine.

Tactics: TA0007
Techniques: T1033
Input: Look for abnormal process behavior that may be due to a process loading a malicious DLL.

Tactics: TA0003, TA0004
Techniques: T1547.004, T1547, T1546
Input: jRAT has command line access.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Linux Rabbit opens a socket on port 22 and if it receives a response it attempts to obtain the machine's hostname and Top-Level Domain.

Tactics: TA0007
Techniques: T1033
Input: APT32 have replaced Microsoft Outlook's VbaProject.OTM file to install a backdoor macro for persistence.

Tactics: TA0003
Techniques: T1137
Input: APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium, to pack their implants.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: APT41 deployed Master Boot Record bootkits on Windows systems to hide their malware and maintain persistence on victim systems.

Tactics: TA0003, TA0005
Techniques: T1542.003, T1542
Input: SombRAT can execute getinfo  to identify the username on a compromised host.

Tactics: TA0007
Techniques: T1033
Input: Compromised email accounts can also be used in the acquisition of infrastructure (ex: Domains).

Tactics: TA0042
Techniques: T1586.002, T1586
Input: One way to do this is by creating a sacrificial logon session with dummy credentials (LogonType 9) and then inject the hash into that session which triggers the Kerberos authentication process.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: A service ticket allows for access to a particular resource, whereas a TGT can be used to request service tickets from the Ticket Granting Service (TGS) to access any resource the user has privileges to access.

Tactics: TA0005, TA0008
Techniques: T1550.003, T1550
Input: Spearphishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages.

Tactics: TA0043
Techniques: T1598.001, T1598.002, T1598, T1598.003
Input: Malicious usage of Regsvr32.exe may avoid triggering security tools that may not monitor execution of, and modules loaded by, the regsvr32.exe process because of allowlists or false positives from Windows using regsvr32.exe for normal operations.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Business and government personnel who are traveling, especially in a foreign country, often rely on systems to conduct business other than those at their home office, and may be unfamiliar with threats posed while abroad

Tactics: TA0007
Techniques: T1083
Input: Patchwork has added the path of its second-stage malware to the startup folder to achieve persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: In Google Workspace, delegation can be enabled via the Google Admin console and users can delegate accounts via their Gmail settings.

Tactics: TA0003
Techniques: T1098.002, T1098
Input: QuasarRAT has a module for performing remote desktop access.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: HermeticWizard has the ability to create a new process using rundll32.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: ComRAT has injected its orchestrator DLL into explorer.exe.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Adversaries can also insert key-value pairs to insert environment variables, such as LSEnvironment, to enable persistence via Dynamic Linker Hijacking.

Tactics: TA0005
Techniques: T1647
Input: This can include stealing software licenses, malware, SSL/TLS and code-signing certificates, or raiding closed databases of vulnerabilities or exploits.

Tactics: TA0042
Techniques: T1588
Input: KGH_SPY can save collected system information to a file named "info" before exfiltration.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Dyre has the ability to create files in a TEMP folder to act as a database to store information.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: External Remote Services or Valid Accounts).

Tactics: TA0043
Techniques: T1589, T1589.001
Input: HotCroissant has attempted to install a scheduled task named "Java Maintenance64" on startup to establish persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Consider periodic reviews of accounts and privileges for critical and sensitive code repositories.

Tactics: TA0009
Techniques: T1213, T1213.003
Input: Monitor for logging, messaging, and other artifacts provided by cloud services.

Tactics: TA0007
Techniques: T1069
Input: This process is sometimes referred to as Bring Your Own Vulnerable Driver (BYOVD).

Tactics: TA0004
Techniques: T1068
Input: !ExeCuteFile Executes a specified file using ShellExecuteA   !DeleteFileFolder Deletes a file or a folder   !SendkeyLogToServer Uploads the %TEMP%\Save.tmp file to the C2 server   !DeleteKeyloggerLog Deletes the %TEMP%\Save.tmp file on the system    Table 2 Commands available within MPK IRC Bot   The post Magic Hound Campaign Attacks Saudi Targets appeared first on Palo Alto Networks Blog

Tactics: TA0005, TA0009
Techniques: T1070, T1070.004, T1074
Input: Green Lambert can use uname to identify the operating system name, version, and processor type.

Tactics: TA0007
Techniques: T1082
Input: InvisiMole can disconnect previously connected remote drives.

Tactics: TA0005
Techniques: T1070, T1070.005
Input: Many command shell utilities can be used to obtain this information.

Tactics: TA0007
Techniques: T1083
Input: APT39 has used malware to set LoadAppInit_DLLs in the Registry key SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows in order to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.010
Input: Deep Panda uses the Microsoft Tasklist utility to list processes running on systems.

Tactics: TA0007
Techniques: T1057
Input: Subsequently, pressing the appropriate key combination at the login screen while sitting at the keyboard or when connected over Remote Desktop Protocol will cause the replaced file to be executed with SYSTEM privileges.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: Dark Caracal has used UPX to pack Bandook.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: VaporRage can deobfuscate XOR-encoded shellcode prior to execution.

Tactics: TA0005
Techniques: T1140
Input: Wizard Spider has used valid credentials for privileged accounts with the goal of accessing domain controllers.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: BACKSPACE attempts to avoid detection by checking a first stage command and control server to determine if it should connect to the second stage server, which performs "louder" interactions with the malware.

Tactics: TA0011
Techniques: T1104
Input: The Deep Panda group is known to utilize WMI for lateral movement.

Tactics: TA0002
Techniques: T1047
Input: Azorult can collect the time zone information from the system.

Tactics: TA0007
Techniques: T1124
Input: Monitor for API calls that may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

Tactics: TA0007
Techniques: T1049
Input: New, benign services may be created during installation of new software.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: APT29 used dynamic DNS resolution to construct and resolve to randomly-generated subdomains for C2.

Tactics: TA0011
Techniques: T1568
Input: FLIPSIDE uses RDP to tunnel traffic from a victim environment.

Tactics: TA0011
Techniques: T1572
Input: ( reg.exe, regedit.exe)

Tactics: TA0005
Techniques: T1112
Input: Public file scanning services, such as VirusTotal, limits the maximum size of an uploaded file to be analyzed.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: Otherwise, this technique may be difficult to detect since malicious activity is taking place on system components possibly outside the purview of OS security and integrity mechanisms.

Tactics: TA0003, TA0005
Techniques: T1542.002, T1542
Input: A cloud metadata API has been used in at least one high profile compromise.

Tactics: TA0006
Techniques: T1552, T1552.005
Input: For example, a service can be forced to start on safe mode boot by adding a * in front of the "Startup" value name: HKLM\Software\Microsoft\Windows\CurrentVersion\Run["*Startup"="{Path}"] or by adding a key to HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal.

Tactics: TA0005
Techniques: T1562.009, T1562
Input: PLEAD has used RC4 encryption to download modules.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: SMOKEDHAM has communicated with its C2 servers via HTTPS and HTTP POST requests.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: TrickBot leverages a custom packer to obfuscate its functionality.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Diavol has used several API calls like GetLogicalDriveStrings, SleepEx, SystemParametersInfoAPI, CryptEncrypt, and others to execute parts of its attack.

Tactics: TA0002
Techniques: T1106
Input: GreyEnergy has a module for Mimikatz to collect Windows credentials from the victim’s machine.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Launch Agents also require files on disk for persistence which can also be monitored via other file monitoring applications.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: The file collection tool used by RainyDay can utilize native API including ReadDirectoryChangeW for folder monitoring.

Tactics: TA0002
Techniques: T1106
Input: Metamorfo uses JavaScript to get the system time.

Tactics: TA0007
Techniques: T1124
Input: APT38 clears Window Event logs and Sysmon logs from the system.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: Attor has automatically collected data about the compromised system.

Tactics: TA0009
Techniques: T1119
Input: A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google,  Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations.

Tactics: TA0042
Techniques: T1584, T1584.006
Input: Analysts can also monitor for use of Windows APIs such as CreateProcessWithTokenW and correlate activity with other suspicious behavior to reduce false positives that may be due to normal benign use by users and administrators.

Tactics: TA0004, TA0005
Techniques: T1134.002, T1134
Input: EvilBunny has an integrated scripting engine to download and execute Lua scripts.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: APT3 has used tools to dump passwords from browsers.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Avenger has the ability to inject shellcode into svchost.exe.

Tactics: TA0004, TA0005
Techniques: T1055
Input: RainyDay can use HTTP in C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: A custom CHM file containing embedded payloads could be delivered to a victim then triggered by User Execution.

Tactics: TA0005
Techniques: T1218, T1218.001
Input: Equation has used an encrypted virtual file system stored in the Windows Registry.

Tactics: TA0005
Techniques: T1564, T1564.005
Input: ZxShell has a command to open a file manager and explorer on the system.

Tactics: TA0007
Techniques: T1083
Input: Turian has the ability to use a XOR decryption key to extract C2 server domains and IP addresses.

Tactics: TA0005
Techniques: T1140
Input: Enable the Registry Global Object Access Auditing  setting in the Advanced Security Audit policy to apply a global system access control list (SACL) and event auditing on modifications to Registry values (sub)keys related to SIPs and trust providers:* HKLM\SOFTWARE\Microsoft\Cryptography\OID* HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID* HKLM\SOFTWARE\Microsoft\Cryptography\Providers\Trust* HKLM\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust

Tactics: TA0005
Techniques: T1553, T1553.003
Input: Flagpro can collect data from a compromised host, including Windows authentication information.

Tactics: TA0009
Techniques: T1005
Input: Turla has frequently used compromised WordPress sites for C2 infrastructure.

Tactics: TA0042
Techniques: T1584, T1584.006
Input: Kinsing has used chmod to modify permissions on key files for use.

Tactics: TA0005
Techniques: T1222.002, T1222
Input: Mustang Panda has used names like adobeupdate.dat and PotPlayerDB.dat to disguise PlugX, and a file named OneDrive.exe to load a Cobalt Strike payload.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: DustySky can delete files it creates from the infected system.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: On the next step this file is executed by rundll32.exe via the KlpSvc export

Tactics: TA0005
Techniques: T1218, T1218.011
Input: FoggyWeb can retrieve token signing certificates and token decryption certificates from a compromised AD FS server.

Tactics: TA0006
Techniques: T1552.004, T1552
Input: Reflectively loaded payloads may be compiled binaries, anonymous files (only present in RAM), or just snubs of fileless executable code (ex: position-independent shellcode).

Tactics: TA0005
Techniques: T1620
Input: InvisiMole can record sound using input audio devices.

Tactics: TA0009
Techniques: T1123
Input: POWERSTATS can use Mshta.exe to execute additional payloads on compromised hosts.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: FIN6 has used fake job advertisements sent via LinkedIn to spearphish targets.

Tactics: TA0001
Techniques: T1566.003, T1566
Input: For macOS, the sharing -l command lists all shared points used for smb services.

Tactics: TA0007
Techniques: T1135
Input: NOKKI has used HTTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Mustang Panda has used vssadmin to create a volume shadow copy and retrieve the NTDS.dit file.

Tactics: TA0006
Techniques: T1003.003, T1003
Input: SILENTTRINITY can enumerate and collect the properties of domain computers.

Tactics: TA0007
Techniques: T1018
Input: Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system.

Tactics: TA0002
Techniques: T1203
Input: WINERACK can gather information about the host.

Tactics: TA0007
Techniques: T1082
Input: Filters are implemented as DLLs containing a method to validate potential passwords against password policies.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.002, T1556
Input: menuPass has used Putty Secure Copy Client (PSCP) to transfer data.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: Stuxnet extracts and writes driver files that match the times of other legitimate files.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: Elise executes net user after initial communication is made to the remote server.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: App Switcher: C:\Windows\System32\AtBroker.exe

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: In addition to freely downloading or purchasing software, adversaries may steal software and/or software licenses from third-party entities (including other adversaries).

Tactics: TA0042
Techniques: T1588, T1588.002
Input: For example, adversaries can add a malicious application path to the ~/Library/Preferences/com.apple.dock.plist file, which controls apps that appear in the Dock.

Tactics: TA0005
Techniques: T1647
Input: Monitor executed commands and arguments that may indicate common cryptomining functionality

Tactics: TA0040
Techniques: T1496
Input: Javali can capture login credentials from open browsers including Firefox, Chrome, Internet Explorer, and Edge.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Use multi-factor authentication for cloud accounts, especially privileged accounts.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078.004, T1078