madox81/Adema_ATTACK_DS huggingface dataset:
Input: Cobalt Strike can use WinRM to execute a payload on a remote host.

Tactics: TA0008
Techniques: T1021, T1021.006
Input: HermeticWizard has the ability to encrypt PE files with a reverse XOR loop.

Tactics: TA0005
Techniques: T1027
Input: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.

Tactics: TA0002
Techniques: T1106
Input: With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).

Tactics: TA0003
Techniques: T1098, T1098.003
Input: Meteor can hide its console window upon execution to decrease its visibility to a victim.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Minimize available services to only those that are necessary.

Tactics: TA0008
Techniques: T1210
Input: YAHOYAH uses HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: 11 AV detection If there is no Avast install present, the script proceeds to the final .dll execution using regsvr32 and quits

Tactics: TA0005
Techniques: T1218, T1218.010
Input: File encryption should be enforced across email communications containing sensitive information that may be obtained through access to email services.

Tactics: TA0005, TA0008
Techniques: T1550.001, T1550
Input: Peirates can dump the contents of AWS S3 buckets.

Tactics: TA0009
Techniques: T1530
Input: Input capture mechanisms may be transparent to the user ( Credential API Hooking) or rely on deceiving the user into providing input into what they believe to be a genuine service ( Web Portal Capture).

Tactics: TA0006, TA0009
Techniques: T1056
Input: Example of decoded keylogger output

Tactics: TA0006, TA0009
Techniques: T1056
Input: Pillowmint has used shellcode which reads code stored in the registry keys \REGISTRY\SOFTWARE\Microsoft\DRM using the native Windows API as well as read HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters\Interfaces as part of its C2.

Tactics: TA0007
Techniques: T1012
Input: Ursnif has used tmp files to stage gathered information.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: ThiefQuest creates a hidden file, copies the original target executable to the file, then executes the new hidden file to maintain the appearance of normal behavior.

Tactics: TA0003
Techniques: T1554
Input: Adversaries may also leverage a Network Device CLI on network devices to gather detailed system information.

Tactics: TA0007
Techniques: T1082
Input: A Patchwork payload uses process hollowing to hide the UAC bypass vulnerability exploitation inside svchost.exe.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: IPC mechanisms may differ depending on OS, but typically exists in a form accessible through programming languages/libraries or native interfaces such as Windows Dynamic Data Exchange or Component Object Model.

Tactics: TA0002
Techniques: T1559
Input: PowerShower has the ability to remove all files created during the dropper process.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Also ensure that the EventLog service and its threads are properly running.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: Domain registration information is, by design, captured in public registration logs.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: PLATINUM has renamed rar.exe to avoid detection.

Tactics: TA0005
Techniques: T1036
Input: Command Description   search Searches for corresponding files   search&upload Encrypts and adds the corresponding files to the upload directory with the provided name   uploadfile Encrypts and adds the specified file to the upload directory with the provided name   uploadfolder Encrypts and adds the mentioned directory to the upload directory with the provided name   shellexecute Silently executes received command with cmd.exe   wmic Silently executes received command with wmic.exe (for WMI commands)   sendIEPass Encrypts and adds all gathered browser data into files for upload to C2   uninstall Removes files, directory and BITS tasks    Cryptography To decrypt the configuration data, the malware uses XOR with 25-character keys such as “waEHleblxiQjoxFJQaIMLdHKz” that are different for every sample

Tactics: TA0002, TA0005, TA0007, TA0009, TA0011
Techniques: T1070, T1070.006, T1047, T1036, T1090.003, T1083, T1560, T1090, T1074
Input: These may also highlight DHCP issues such as when IP allocations are low or have run out.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.003
Input: Penquin can remove strings from binaries.

Tactics: TA0005
Techniques: T1027, T1027.005
Input: SILENTTRINITY can use System.DirectoryServices namespace to retrieve domain group information.

Tactics: TA0007
Techniques: T1069.002, T1069
Input: Windigo has also used multiple reverse proxy chains as part of their C2 infrastructure.

Tactics: TA0011
Techniques: T1090
Input: NETWIRE can downloaded payloads from C2 to the compromised host.

Tactics: TA0011
Techniques: T1105
Input: Monitor for API calls that may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware.

Tactics: TA0005
Techniques: T1070
Input: Use network intrusion detection/prevention systems to detect and prevent remote service scans.

Tactics: TA0007
Techniques: T1046
Input: SeaDuke can securely delete files, including deleting itself from the victim.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: YAHOYAH checks for antimalware solution processes on the system.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Regin has used a hidden file system to store some of its components.

Tactics: TA0005
Techniques: T1564, T1564.005
Input: SLOTHFULMEDIA has been created with a hidden attribute to insure it's not visible to the victim.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: TrailBlazer has used HTTP requests for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Unknown Logger is capable of downloading remote files.

Tactics: TA0011
Techniques: T1105
Input: ChChes collects its process identifier (PID) on the victim.

Tactics: TA0007
Techniques: T1057
Input: Monitor for newly constructed files that are added to absolute paths of shared libraries such as LD_PRELOAD on Linux and DYLD_INSERT_LIBRARIES on macOS.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.006, T1574
Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Email Accounts), and/or initial access (ex: Phishing or Brute Force via External Remote Services).

Tactics: TA0043
Techniques: T1589.002, T1589
Input: Microsoft Office contains templates that are part of common Office applications and are used to customize styles.

Tactics: TA0003
Techniques: T1137, T1137.001
Input: Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.

Tactics: TA0007
Techniques: T1046
Input: To maximize impact on the target organization, malware designed for encrypting data may have worm-like features to propagate across a network by leveraging other attack techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.

Tactics: TA0040
Techniques: T1486
Input: WarzoneRAT can use sdclt.exe to bypass UAC in Windows 10 to escalate privileges; for older Windows versions WarzoneRAT can use the IFileOperation exploit to bypass the UAC module.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Adversaries may modify authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556
Input: Monitor executed commands and arguments that could be taken to copy files from the logical drive and evade common file system protections.

Tactics: TA0005
Techniques: T1006
Input: Application isolation will limit what other processes and system features the exploited target can access.

Tactics: TA0001
Techniques: T1190
Input: (For more on steganography, see the McAfee Labs Threats Report, June 2017, page 33.) The implants covered in this research establish a permanent presence on the victim’s system once the PowerShell implant is executed

Tactics: TA0002
Techniques: T1059.001, T1059
Input: SMOKEDHAM has used net.exe user and net.exe users to enumerate local accounts on a compromised host.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Denis will decrypt important strings used for C&C communication.

Tactics: TA0005
Techniques: T1140
Input: WindTail has the ability to receive and execute a self-delete command.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Monitor for newly constructed BITS tasks to enumerate using the BITSAdmin tool (bitsadmin /list /allusers /verbose).

Tactics: TA0003, TA0005
Techniques: T1197
Input: Monitor for API calls that may forge web cookies that can be used to gain access to web applications or Internet services.

Tactics: TA0005
Techniques: T1218, T1218.002
Input: Briba downloads files onto infected hosts.

Tactics: TA0011
Techniques: T1105
Input: Trojan.Karagany can upload, download, and execute files on the victim.

Tactics: TA0011
Techniques: T1105
Input: Adversaries may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment.

Tactics: TA0007
Techniques: T1518
Input: PowerSploit's Get-ProcessTokenGroup Privesc-PowerUp module can enumerate all SIDs associated with its current token.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Stuxnet attempts to impersonate an anonymous token to enumerate bindings in the service control manager.

Tactics: TA0004, TA0005
Techniques: T1134, T1134.001
Input: Molerats decompresses ZIP files once on the victim machine.

Tactics: TA0005
Techniques: T1140
Input: Adversaries may scan victims for vulnerabilities that can be used during targeting.

Tactics: TA0043
Techniques: T1595, T1595.002
Input: Adversaries may downgrade and use less-secure versions of various features of a system, such as Command and Scripting Interpreters or even network protocols that can be abused to enable Adversary-in-the-Middle.

Tactics: TA0005
Techniques: T1562.010, T1562
Input: SysUpdate can deobfuscate packed binaries in memory.

Tactics: TA0005
Techniques: T1140
Input: Honeybee uses a combination of NTWDBLIB.dll and cliconfg.exe to bypass UAC protections using DLL hijacking.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: CSPY Downloader can write to the Registry under the %windir% variable to execute tasks.

Tactics: TA0005
Techniques: T1112
Input: DarkComet can disable Security Center functions like the Windows Firewall.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: RegDuke can store its encryption key in the Registry.

Tactics: TA0005
Techniques: T1112
Input: For example, if multiple IP addresses map to a single MAC address, this could be an indicator that the ARP cache has been poisoned.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.002
Input: This technique may be similar to System Firmware but conducted upon other system components/devices that may not have the same capability or level of integrity checking.

Tactics: TA0003, TA0005
Techniques: T1542.002, T1542
Input: When operating systems boot up, they can start processes that perform background system functions.

Tactics: TA0003, TA0004
Techniques: T1543
Input: Adversaries may also include links that are intended to interact directly with an email reader, including embedded images intended to exploit the end system directly or verify the receipt of an email ( web bugs/web beacons).

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Adversaries may leverage the resources of co-opted systems in order to solve resource intensive problems, which may impact system and/or hosted service availability.

Tactics: TA0040
Techniques: T1496
Input: Figure 6 Relational diagram of artifacts  We created a timeline of the activity based off the data we collected, and found that the attack dates were tightly clustered into two waves in mid- to late-October and in mid-November as we see in Figure 7 using the timestamps from Table 3

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Cleaver has created fake LinkedIn profiles that included profile photos, details, and connections.

Tactics: TA0042
Techniques: T1585, T1585.001
Input: AtomBombing  is another variation that utilizes APCs to invoke malicious code previously written to the global atom table.

Tactics: TA0004, TA0005
Techniques: T1055.004, T1055
Input: Gamaredon Group has removed security settings for VBA macro execution by changing registry values HKCU\Software\Microsoft\Office\<version>\<product>\Security\VBAWarnings and HKCU\Software\Microsoft\Office\<version>\<product>\Security\AccessVBOM.

Tactics: TA0005
Techniques: T1112
Input: EvilGrab has the capability to capture audio from a victim machine.

Tactics: TA0009
Techniques: T1123
Input: The first email displays the following decoy document to the infected user and download the following payload:hxxp://discgolfglow[.]com:/wp-content/plugins/maintenance/images/worker.jpgThe second email displays the following decoy document to the infected user and downloads the following payload:hxxp://acddesigns[.]com[.]au/clients/ACPRCM/kingstone.jpgIn both cases, the downloaded payload is the ROKRAT malware.The first tasks of this variant of ROKRAT is to check the operating system version

Tactics: TA0005, TA0007, TA0011
Techniques: T1497, T1105
Input: Adversaries may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system.

Tactics: TA0003
Techniques: T1137.002, T1137
Input: yty communicates to the C2 server by retrieving a Google Doc.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: A Gamaredon Group file stealer can transfer collected files to a hardcoded C2 server.

Tactics: TA0010
Techniques: T1041
Input: MobileOrder exfiltrates data to its C2 server over the same protocol as C2 communications.

Tactics: TA0010
Techniques: T1041
Input: Monitor for the unexpected creation of new resources within your cluster in Kubernetes, especially those created by atypical users.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Chaes stored its instructions in a config file in the Registry.

Tactics: TA0005
Techniques: T1112
Input: Command arguments used before and after the mshta.exe invocation may also be useful in determining the origin and purpose of the .hta file being executed.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: Activities may include the acquisition of malware, software (including licenses), exploits, certificates, and information relating to vulnerabilities.

Tactics: TA0042
Techniques: T1588
Input: Adversaries may have prior knowledge through reconnaissance that security software exists within an environment or they may perform checks during or shortly after the system is compromised for Security Software Discovery.

Tactics: TA0005
Techniques: T1211
Input: Monitor for API calls that may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Pteranodon can decrypt encrypted data strings prior to using them.

Tactics: TA0005
Techniques: T1140
Input: They can be used as an alternative to Cron in Linux environments.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.006, T1053
Input: APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Endpoint systems may be compromised through normal web browsing or from certain users being targeted by links in spearphishing emails to adversary controlled sites used to exploit the web browser.

Tactics: TA0002
Techniques: T1203
Input: SYSCON has the ability to use Tasklist to list running processes.

Tactics: TA0007
Techniques: T1057
Input: For example, AWS Traffic Mirroring, GCP Packet Mirroring, and Azure vTap allow users to define specified instances to collect traffic from and specified targets to send collected traffic to.

Tactics: TA0006, TA0007
Techniques: T1040
Input: Following these checks, it drops several more malware files signed with the pasted AMD digital signature to a directory it creates

Tactics: TA0005, TA0007, TA0011
Techniques: T1090.003, T1553, T1553.002, T1083, T1090
Input: SpicyOmelette can check for the presence of 29 different antivirus tools.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Monitor newly executed processes that may abuse Microsoft Office templates to obtain persistence on a compromised system.

Tactics: TA0003
Techniques: T1137, T1137.001
Input: Penquin can add the executable flag to a downloaded file.

Tactics: TA0005
Techniques: T1222.002, T1222
Input: Adversaries may transfer tools or other files from an external system into a compromised environment.

Tactics: TA0011
Techniques: T1105
Input: Rundll32.exe can also be used to execute Control Panel Item files (.cpl) through the undocumented shell32.dll functions Control_RunDLL and Control_RunDLLAsUser.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Custom drivers.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: KEYMARBLE has a command to create Registry entries for storing data under HKEY_CURRENT_USER\SOFTWARE\Microsoft\WABE\DataPath.

Tactics: TA0005
Techniques: T1112
Input: The MPK Trojan also monitors specifically for windows that are likely to contain login forms for popular web-based email clients, such as titles that contain: “Gmail -” “Yahoo – login” “Sign In -” “Outlook.com -“ MPK will attempt to parse these window titles to identify the associated email address and record these to the log file using the following format: ///////////// Mail Find <email address> /////////// If the Trojan does not find the window titles associated with Gmail, Yahoo or Outlook, it saves the title to the “Save.tmp” file in the following format: +++++++++++++ Window= <window title> +++++++++++++ The major difference between the IRC variant and non-IRC variant of MPK is the C2 protocol used

Tactics: TA0007
Techniques: T1010
Input: APT19 sent spearphishing emails with malicious attachments in RTF and XLSM formats to deliver initial exploits.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Frankenstein has obtained and used Empire to deploy agents.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Also look for other behavior on the endpoint system that might indicate successful compromise, such as abnormal behavior of browser or Office processes.

Tactics: TA0002
Techniques: T1203
Input: Another implementation could be for an adversary to drop their own portable partition image as a file on top of the standard file system.

Tactics: TA0005
Techniques: T1564, T1564.005
Input: Silence has leveraged the Windows API, including using CreateProcess() or ShellExecute(), to perform a variety of tasks.

Tactics: TA0002
Techniques: T1106
Input: Similarly, adversaries who gain access to network devices may also perform similar discovery activities to gather information about connected systems and services.

Tactics: TA0007
Techniques: T1049
Input: Babuk has the ability to unpack itself into memory using XOR.

Tactics: TA0005
Techniques: T1140
Input: Advanced endpoint threat detection (AETD) can help detect activity associated with web shells and lateral movement, and network technologies that use sandboxing techniques to detonate binaries in network traffic can prevent malicious traffic from reaching internal systems

Tactics: TA0003, TA0008
Techniques: T1505.003, T1021, T1021.002, T1505
Input: APT1 has used RAR to compress files before moving them outside of the victim network.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Siloscape can send kubectl commands to victim clusters through an IRC channel and can run kubectl locally to spread once within a victim cluster.

Tactics: TA0002
Techniques: T1609
Input: Identify and correct GPO permissions abuse opportunities (ex: GPO modification privileges) using auditing tools such as BloodHound (version 1.5.1 and later).

Tactics: TA0004, TA0005
Techniques: T1484.001, T1484
Input: Carbanak encrypts strings to make analysis more difficult.

Tactics: TA0005
Techniques: T1027
Input: Security tools may make dynamic changes to system components in order to maintain visibility into specific events.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: APT29 has conducted enumeration of Azure AD accounts.

Tactics: TA0007
Techniques: T1087, T1087.004
Input: Dynamic-link libraries (DLLs) that are specified in the AppInit_DLLs value in the Registry keys HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Windows or HKEY_LOCAL_MACHINE\Software\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Windows are loaded by user32.dll into every process that loads user32.dll.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.010
Input: Figures 8 and 9: LiteHTTP screenshots taken from the user`s profile in which the acronym “Knock” appears Conclusion SpeakUp`s obfuscated payloads and propagation technique is beyond any doubt the work of a bigger threat in the making

Tactics: TA0005, TA0009
Techniques: T1027, T1113
Input: Agent Tesla can access the victim’s webcam and record video.

Tactics: TA0009
Techniques: T1125
Input: It then downloads and decrypts a PNG file

Tactics: TA0005
Techniques: T1140
Input: Tonto Team has used a first stage web shell after compromising a vulnerable Exchange server.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: EKANS uses encoded strings in its process kill list.

Tactics: TA0005
Techniques: T1027
Input: The victim will then see a prompt to Enable Content as with any malicious macro document as seen in Figure 5

Tactics: TA0002
Techniques: T1204
Input: Torisma can use HTTP and HTTPS for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Cobalt Group has used exploits to increase their levels of rights and privileges.

Tactics: TA0004
Techniques: T1068
Input: Lucifer has established persistence by creating the following scheduled task schtasks /create /sc minute /mo 1 /tn QQMusic ^ /tr C:Users\%USERPROFILE%\Downloads\spread.exe /F.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Its purpose is to load Msadoz<n>.dll in order to decrypt and execute it in memory

Tactics: TA0005
Techniques: T1140
Input: Note: Login hooks were deprecated in 10.11 version of macOS in favor of Launch Daemon and Launch Agent

Tactics: TA0003, TA0004
Techniques: T1037.002, T1037
Input: Volatile Cedar has performed vulnerability scans of the target server.

Tactics: TA0043
Techniques: T1595, T1595.002
Input: MuddyWater has exploited the Office vulnerability CVE-2017-0199 for execution.

Tactics: TA0002
Techniques: T1203
Input: APT32's backdoor has modified the Windows Registry to store the backdoor's configuration.

Tactics: TA0005
Techniques: T1112
Input: Once forged, adversaries may use these web cookies to access resources (Web Session Cookie), which may bypass multi-factor and other authentication protection mechanisms.

Tactics: TA0006
Techniques: T1606, T1606.001
Input: Require signed binaries and images.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: PoshC2 can enumerate service and service permission information.

Tactics: TA0007
Techniques: T1007
Input: Zeus Panda also encrypts all configuration and settings in AES and RC4.

Tactics: TA0005
Techniques: T1027
Input: CORESHELL C2 messages are encrypted with custom stream ciphers using six-byte or eight-byte keys.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Mapping of TG-3390's interactions with web shells during an intrusion responded to by CTU researchers

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Monitor for changes to binaries and service executables that may normally occur during software updates.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.005, T1574
Input: Adversaries may use SMB to interact with file shares, allowing them to move laterally throughout a network.

Tactics: TA0008
Techniques: T1021, T1021.002