madox81/Adema_ATTACK_DS huggingface dataset:
Input: KGH_SPY can collect drive information from a compromised host.

Tactics: TA0007
Techniques: T1082
Input: BADNEWS monitors USB devices and copies files with certain extensions to a predefined directory.

Tactics: TA0009
Techniques: T1119
Input: DarkWatchman can list signed PnP drivers for smartcard readers.

Tactics: TA0007
Techniques: T1120
Input: On Linux and macOS, at may be invoked by the superuser as well as any users added to the at.allow file.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: A multilayered approach is a must to securing the organization’s perimeter, especially for information security professionals and system/IT administrators

Tactics: TA0007
Techniques: T1082
Input: Darkhotel's selective infector modifies executables stored on removable media as a method of spreading across computers.

Tactics: TA0001, TA0008
Techniques: T1091
Input: KeyBoy has a download and upload functionality.

Tactics: TA0011
Techniques: T1105
Input: LightNeuron is capable of starting a process using CreateProcess.

Tactics: TA0002
Techniques: T1106
Input: Ensure all browsers and plugins kept updated can help prevent the exploit phase of this technique.

Tactics: TA0001
Techniques: T1189
Input: SUNSPOT enumerated the Orion software Visual Studio solution directory path.

Tactics: TA0007
Techniques: T1083
Input: Monitor for newly executed processes for process executable paths that are named for partial directories.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.007, T1574
Input: Adversaries may do this to execute commands as other users or spawn processes with higher privileges.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: SslMM creates a new thread implementing a keylogging facility using Windows Keyboard Accelerators.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: KGH_SPY can harvest data from mail clients.

Tactics: TA0009
Techniques: T1114, T1114.001
Input: Dyre has the ability to directly inject its code into the web browser process.

Tactics: TA0004, TA0005
Techniques: T1055
Input: This functionality has been implemented in the MimiPenguin, an open source tool inspired by Mimikatz.

Tactics: TA0006
Techniques: T1003, T1003.007
Input: Often these third-party applications will have logs of their own that can be collected and correlated with other data from the environment.

Tactics: TA0002, TA0008
Techniques: T1072
Input: Collect process execution information including process IDs (PID) and parent process IDs (PPID) and look for abnormal chains of activity resulting from Office processes.

Tactics: TA0003
Techniques: T1137
Input: Flagpro has been used to execute net view to discover mapped network shares.

Tactics: TA0007
Techniques: T1135
Input: SHOTPUT uses netstat to list TCP connection status.

Tactics: TA0007
Techniques: T1049
Input: UPPERCUT has the capability to obtain the time zone information and current timestamp of the victim’s machine.

Tactics: TA0007
Techniques: T1124
Input: AuditCred can open a reverse shell on the system to execute commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: An adversary may rely upon a user clicking a malicious link in order to gain execution.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Remcos has a command for UAC bypassing.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: CosmicDuke exfiltrates collected files automatically over FTP to remote servers.

Tactics: TA0010
Techniques: T1020
Input: The keylogger will monitor for active application windows and write them to the log in the following format: <span class=’keylog_process’>[Application Name]</span> The keylogger will log a configurable amount of keystrokes (default 50) before sending the log to the C2 server using the following format: <span class=’keylog_user_keys’>[logged keystrokes]</span> The keylogger can handle logging special keys, such as return and the function keys and will report those within the log in the following format; <span class=’keylog_spec_key’>[special character]</span> Infrastructure The XAgentOSX sample we analyzed was configured to use the following IP address and domain names as its C2 servers: 23.227.196[.]215 apple-iclods[.]org apple-checker[.]org apple-uptoday[.]org apple-search[.]info When we analyzed this sample, the domain names that were used as backup C2 locations were not registered; therefore, these domains did not provide any links to additional infrastructure

Tactics: TA0006, TA0009, TA0011
Techniques: T1573, T1056
Input: VERMIN collects data stored in the clipboard.

Tactics: TA0009
Techniques: T1115
Input: Monitor executed commands and arguments for commands that can be used to disable logging.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: NETWIRE can copy itself to and launch itself from hidden folders.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Adversaries may use several methods to accomplish Virtualization/Sandbox Evasion such as checking for security monitoring tools (, Sysinternals, Wireshark, ) or other system artifacts associated with analysis or virtualization.

Tactics: TA0005, TA0007
Techniques: T1497
Input: Egregor can collect any files found in the enumerated drivers before sending it to its C2 channel.

Tactics: TA0009
Techniques: T1039
Input: REvil can enumerate active services.

Tactics: TA0007
Techniques: T1007
Input: TeamTNT has also used a custom user agent HTTP header in shell scripts.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Configuration management databases (CMDB) and other asset management systems may help with the detection of computer systems or network devices that should not exist on a network.

Tactics: TA0001, TA0002, TA0005
Techniques: T1200, T1199, T1610
Input: The storage location for these ccache entries is influenced by the /etc/krb5.conf configuration file and the KRB5CCNAME environment variable which can specify to save them to disk or keep them protected via the KCM daemon.

Tactics: TA0006
Techniques: T1558
Input: A Silver Ticket can be obtained for services that use Kerberos as an authentication mechanism and are used to generate tickets to access that particular resource and the system that hosts the resource (, SharePoint).

Tactics: TA0005, TA0008
Techniques: T1550.003, T1550
Input: Monitor executed commands and arguments that may forge credential materials that can be used to gain access to web applications or Internet services.

Tactics: TA0005
Techniques: T1218
Input: Turian can establish persistence by adding Registry Run keys.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: GALLIUM used a modified version of Mimikatz along with a PowerShell-based Mimikatz to dump credentials on the victim machines.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Kazuar can also act as a webserver and listen for inbound HTTP requests through an exposed API.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: XCSSET builds a malicious application bundle to resemble Safari through using the Safari icon and Info.plist.

Tactics: TA0005
Techniques: T1036
Input: Chimera has used a valid account to maintain persistence via scheduled task.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: Limit privileges of user accounts so only authorized privileged users can create and modify XDG autostart entries.

Tactics: TA0003, TA0004
Techniques: T1547.013, T1547
Input: Lazarus Group has used a VBA Macro to set its file attributes to System and Hidden and has named files with a dot prefix to hide them from the Finder application.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: A noteworthy addition to the Poseidon toolkit is the IGT supertool (Information Gathering toolkit), a bulking 15 megabyte executable that orchestrates a series of different information collections steps, exfiltration, and the cleanup of components

Tactics: TA0007
Techniques: T1082
Input: During the macOS initialization startup, the launchd process loads the parameters for launch-on-demand system-level daemons from plist files found in /System/Library/LaunchDaemons/ and /Library/LaunchDaemons/.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: RawDisk was used in Shamoon to write to protected system locations such as the MBR and disk partitions in an effort to destroy data.

Tactics: TA0040
Techniques: T1485
Input: Perform physical inspection of hardware to look for potential tampering.

Tactics: TA0001
Techniques: T1195, T1195.003
Input: The KilaAlfa keylogger also reports the title of the window in the foreground.

Tactics: TA0007
Techniques: T1010
Input: LazyScripter has used PowerShell scripts to execute malicious code.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Cobalt Strike can use spoof arguments in spawned processes that execute beacon commands.

Tactics: TA0005
Techniques: T1564.010, T1564
Input: Figure 7: Property list file in LaunchAgents directory To camouflage the location of the malicious file, Keydnap replaces argv[0] with /usr/libexec/icloudsyncd –launchd netlogon.bundle

Tactics: TA0007
Techniques: T1083
Input: Silence has used ProxyBot, which allows the attacker to redirect traffic from the current node to the backconnect server via Sock4\Socks5.

Tactics: TA0011
Techniques: T1090, T1090.002
Input: The generation of web credentials often requires secret values, such as passwords, Private Keys, or other cryptographic seed values.

Tactics: TA0006
Techniques: T1606
Input: Anchor can install itself as a cron job.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: Daserf uses encrypted Windows APIs and also encrypts data using the alternative base64+RC4 or the Caesar cipher.

Tactics: TA0005
Techniques: T1027
Input: Naid creates a new service to establish.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: When communicating with its C2 server, the downloaders use multiple protocols, specifically HTTPS, HTTP or DNS, each of which provide a fallback channel in that order

Tactics: TA0011
Techniques: T1071, T1008
Input: Doing so allows a plausible reason for asking about services, policies, and software that's running in an environment.

Tactics: TA0001
Techniques: T1566.003, T1566
Input: InvisiMole can upload files to the victim's machine for operations.

Tactics: TA0011
Techniques: T1105
Input: Filename SHA256 Description   7za.exe dd6d7af00ef4ca89a319a230cdd094275c3a1d365807fe5b34133324bdaa0229 7-Zip 17.01 beta    nbt.exe c9d5dc956841e000bfd8762e2f0b48b66c79b79500e894b4efa7fb9ba17e4e9e nbtscan 1.0.35    rx.exe a6a0fbfee08367046d3d26fb4b4cf7779f7fb6eaf7e60e1d9b6bf31c5be5b63e IntelliAdmin Remote Execute v1.0    Table 5

Tactics: TA0005
Techniques: T1036
Input: PowerDuke achieves persistence by using various Registry Run keys.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Monitor for newly executed processes conducting malicious activity

Tactics: TA0006, TA0009
Techniques: T1056
Input: Adversaries may compromise numerous third-party systems to form a botnet that can be used during targeting.

Tactics: TA0042
Techniques: T1584, T1584.005
Input: ExecStart, ExecStartPre, and ExecStartPost directives cover execution of commands when a services is started manually by 'systemctl' or on system start if the service is set to automatically start.

Tactics: TA0003, TA0004
Techniques: T1543.002, T1543
Input: APT29 has also used SDelete to remove artifacts from victims.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: PROMETHIUM has attempted to get users to execute compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: APT29 then created a WMI event subscription in order to execute the backdoor

Tactics: TA0002
Techniques: T1047
Input: SoreFang can use HTTP in C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Skidmap has the ability to set SELinux to permissive mode.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Threat actors may seek information/indicators gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns.

Tactics: TA0043
Techniques: T1597, T1597.001
Input: BloodHound has the ability to map domain trusts and identify misconfigurations for potential abuse.

Tactics: TA0007
Techniques: T1482
Input: Malware repositories can also be used to identify additional samples associated with the developers and the adversary utilizing their services.

Tactics: TA0042
Techniques: T1588, T1588.001
Input: The rule files are in the plist format and define the name, event type, and action to take.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.014
Input: DNS packets contain many fields and headers in which data can be concealed.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: gh0st RAT has decrypted and loaded the gh0st RAT DLL into memory, once the initial dropper executable is launched.

Tactics: TA0005
Techniques: T1140
Input: TrickBot creates a scheduled task on the system that provides persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: MURKYTOP has the capability to delete local files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Gelsemium can retrieve data from specific Windows directories, as well as open random files as part of Virtualization/Sandbox Evasion.

Tactics: TA0007
Techniques: T1083
Input: Mustang Panda has executed PowerShell scripts via WMI.

Tactics: TA0002
Techniques: T1047
Input: ThreatNeedle can collect system profile information from a compromised host.

Tactics: TA0007
Techniques: T1082
Input: The main similarities include the use of a scheduled task to persistently execute on the system, as well as the same general process to communicate with its C2 server

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Restrict permissions and access to the AD FS server to only originate from privileged access workstations.

Tactics: TA0006
Techniques: T1606, T1606.002
Input: Preauthentication offers protection against offline Password Cracking.

Tactics: TA0006
Techniques: T1558, T1558.004
Input: Adversaries may gather information about the victim's networks that can be used during targeting.

Tactics: TA0043
Techniques: T1590
Input: BRONZE BUTLER has incorporated code into several tools that attempts to terminate anti-virus processes.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Adversaries may mimic this functionality to prompt users for credentials with a seemingly legitimate prompt for a number of reasons that mimic normal usage, such as a fake installer requiring additional access or a fake malware removal suite.

Tactics: TA0006, TA0009
Techniques: T1056.002, T1056
Input: This may be a difficult technique to detect because adversary traffic may be masked by normal user traffic.

Tactics: TA0009
Techniques: T1185
Input: Monitor for files written to disk that contain two file extensions, particularly when the second is an executable.

Tactics: TA0005
Techniques: T1036, T1036.007
Input: hklm\software\microsoft\windows nt\currentversion\appcompatflags\custom

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: Adversaries may also compromise existing commands in the operating system to produce false output to mislead defenders.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: APT1 has used various open-source tools for privilege escalation purposes.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: This development could be applied to social media, website, or other publicly available information that could be referenced and scrutinized for legitimacy over the course of an operation using that persona or identity.

Tactics: TA0042
Techniques: T1585
Input: CharmPower can delete created files from a compromised system.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Enable Windows firewall, which prevents DCOM instantiation by default.

Tactics: TA0008
Techniques: T1021.003, T1021
Input: There have been notable incidents where internal spearphishing has been used.

Tactics: TA0008
Techniques: T1534
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may rely on a user running a malicious image to facilitate execution.

Tactics: TA0002
Techniques: T1204.003, T1204
Input: PipeMon can switch to an alternate C2 domain when a particular date has been reached.

Tactics: TA0011
Techniques: T1008
Input: APT29 used AUDITPOL to prevent the collection of audit logs.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: These user actions will typically be observed as follow-on behavior from forms of Phishing.

Tactics: TA0002
Techniques: T1204
Input: The at utility exists as an executable within Windows, Linux, and macOS for scheduling tasks at a specified time and date.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: Values an adversary can provide about a target system or environment to use as guardrails may include specific network share names, attached physical devices, files, joined Active Directory (AD) domains, and local/external IP addresses.

Tactics: TA0005
Techniques: T1480
Input: CookieMiner has installed multiple new Launch Agents in order to maintain persistence for cryptocurrency mining software.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: Tools such as Sysinternals Autoruns can be used to detect changes to the screensaver binary path in the Registry.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.002
Input: The risks of additional exploits and weaknesses in implementation may still exist for these types of systems.

Tactics: TA0001
Techniques: T1189
Input: TrickBot injects into the svchost.exe process.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: Since MMC is a signed Windows binary, verify use of MMC is legitimate and not malicious.

Tactics: TA0005
Techniques: T1218, T1218.014
Input: These capabilities may be staged on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure).

Tactics: TA0042
Techniques: T1608
Input: Apple’s OSA provides scripting capabilities to control applications, interface with the operating system, and bridge access into the rest of Apple’s internal APIs.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Periodic low resolution screenshots

Tactics: TA0009
Techniques: T1113
Input: Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.

Tactics: TA0011
Techniques: T1090
Input: Gazer uses custom encryption for C2 that uses RSA.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Adversaries may upload backdoored files, such as application binaries, virtual machine images, or container images, to third-party software stores or repositories (ex: GitHub, CNET, AWS Community AMIs, Docker Hub).

Tactics: TA0042
Techniques: T1608.001, T1608
Input: Included in the directories were a combination of files leveraged in targeted attacks mentioned above against nation states

Tactics: TA0007
Techniques: T1083
Input: Adversaries may clear the history environment variable (unset HISTFILE) or set the command history size to zero (export HISTFILESIZE=0) to prevent logging of commands.

Tactics: TA0005
Techniques: T1562.003, T1562
Input: Rather than creating and cultivating social media profiles ( Social Media Accounts), adversaries may compromise existing social media accounts.

Tactics: TA0042
Techniques: T1586.001, T1586
Input: Follow Office macro security best practices suitable for your environment.

Tactics: TA0003
Techniques: T1137, T1137.001
Input: PipeMon can use parent PID spoofing to elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1134.004, T1134
Input: Sakula has the capability to download files.

Tactics: TA0011
Techniques: T1105
Input: NanoCore can modify the victim's anti-virus.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: AppleSeed has divided files if the size is 0x1000000 bytes or more.

Tactics: TA0010
Techniques: T1030
Input: 11/1/18 sahro.bella7 trala.cosh2 Bishtr.cam47 Lobrek.chizh Cervot.woprov    Table 5 Gathered C# Cannon samples As mentioned in our initial blog, the actor controlled email address acting as the C2 was sahro.bella7[at]post.cz, but all previous samples of Cannon used sym777.g[at]post.cz

Tactics: TA0011
Techniques: T1071
Input: Microsoft has released patches to try to address each issue.

Tactics: TA0003
Techniques: T1137, T1137.004, T1137.003, T1137.005
Input: HAMMERTOSS is known to use PowerShell.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Higaisa exfiltrated data over its C2 channel.

Tactics: TA0010
Techniques: T1041
Input: When a Windows system attempts to connect to an SMB resource it will automatically attempt to authenticate and send credential information for the current user to the remote system.

Tactics: TA0006
Techniques: T1187
Input: Stuxnet sends compromised victim information via HTTP.

Tactics: TA0010
Techniques: T1041
Input: Adversaries may also use information from previous reconnaissance efforts (ex: Social Media or Search Victim-Owned Websites) to craft persuasive and believable lures.

Tactics: TA0043
Techniques: T1598.001, T1598
Input: Create the Registry key used to execute it and set the permissions to "Read Control" to prevent easy access to the key without administrator permissions or requiring Privilege Escalation.

Tactics: TA0003
Techniques: T1137.002, T1137
Input: Set a browser extension allow or deny list as appropriate for your security policy.

Tactics: TA0003
Techniques: T1176
Input: Chimera has utilized multiple commands to identify data of interest in file and directory listings.

Tactics: TA0007
Techniques: T1083
Input: Additionally, some cryptocurrency mining malware identify then kill off processes for competing malware to ensure it’s not competing for resources.

Tactics: TA0040
Techniques: T1496
Input: Ryuk has injected itself into remote processes to encrypt files using a combination of VirtualAlloc, WriteProcessMemory, and CreateRemoteThread.

Tactics: TA0004, TA0005
Techniques: T1055
Input: SID Filtering of external trusts is automatically enabled on all created external trusts using Server 2003 or later domain controllers.

Tactics: TA0004, TA0005
Techniques: T1134.005, T1134
Input: Bankshot uploads files and secondary payloads to the victim's machine.

Tactics: TA0011
Techniques: T1105
Input: NanHaiShu executes additional Jscript code on the victim's machine.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: IcedID has used HTTPS in communications with C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Dragonfly has commonly created Web shells on victims' publicly accessible email and web servers, which they used to maintain access to a victim network and download additional malicious files.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Extra scrutiny should be placed on suspicious modification of Registry keys such as COR_ENABLE_PROFILING, COR_PROFILER, and COR_PROFILER_PATH by command line tools like wmic.exe, setx.exe, and Reg.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.012, T1574
Input: Tasklist can be used to discover services running on a system.

Tactics: TA0007
Techniques: T1007
Input: The portion of the Web shell that is on the server may be small and innocuous looking.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Monitor for changes to account management events on Domain Controllers for successful and failed changes to SID-History.

Tactics: TA0004, TA0005
Techniques: T1134.005, T1134
Input: In some cases, adversaries may continuously repeat login attempts in order to bombard users with MFA push notifications, SMS messages, and phone calls, potentially resulting in the user finally accepting the authentication request in response to "MFA fatigue."

Tactics: TA0006
Techniques: T1621
Input: WellMail can archive files on the compromised host.

Tactics: TA0009
Techniques: T1560