madox81/Adema_ATTACK_DS huggingface dataset:
Input: Monitor for newly constructed files from a spearphishing emails with a malicious attachment in an attempt to gain access to victim systems.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Use of Secure Boot may prevent some implementations of modification to code signing policies.

Tactics: TA0005
Techniques: T1553, T1553.006
Input: Chaos conducts brute force attacks against SSH services to gain initial access.

Tactics: TA0006
Techniques: T1110
Input: Correlate activity with related suspicious behavior that may indicate an active intrusion to reduce false positives.

Tactics: TA0006
Techniques: T1552, T1552.002
Input: Skidmap has the ability to check whether the infected system’s OS is Debian or RHEL/CentOS to determine which cryptocurrency miner it should use.

Tactics: TA0007
Techniques: T1082
Input: Derusbi is capable of performing screen captures.

Tactics: TA0009
Techniques: T1113
Input: Stuxnet uses a driver to scan for specific filesystem driver objects.

Tactics: TA0007
Techniques: T1083
Input: The "ZR" variant of BACKSPACE will check to see if known host-based firewalls are installed on the infected systems.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: HAFNIUM has stolen copies of the Active Directory database (NTDS.DIT).

Tactics: TA0006
Techniques: T1003.003, T1003
Input: Several operating system administration utilities exist that can be used to gather this information.

Tactics: TA0007
Techniques: T1016
Input: Filter boundary traffic by blocking source addresses sourcing the attack, blocking ports that are being targeted, or blocking protocols being used for transport.

Tactics: TA0040
Techniques: T1499, T1499.004
Input: Monitor executed commands and arguments that may bypass UAC mechanisms to elevate process privileges on system.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Data is compressed with zlib, and bytes are rotated four times before being XOR'ed with 0x23.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: Kinsing has used SSH for lateral movement.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: ABK has the ability to use HTTP in communications with C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Sykipot uses SSL for encrypting C2 communications.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Magic Hound has conducted watering-hole attacks through media and magazine websites.

Tactics: TA0001
Techniques: T1189
Input: PoshC2 can enumerate local and domain user account information.

Tactics: TA0007
Techniques: T1087.002, T1087, T1087.001
Input: Leviathan has used publicly available tools to dump password hashes, including ProcDump and WCE.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Adversaries may employ a known symmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: njRAT is capable of deleting files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: These samples communicated with the following hosts via FTP for C2 communication:  ftp.byethost7[.]com ftp.byethost10[.]com files.000webhost[.]com  Beginning in June 2018, we observed the OceanSalt malware family being dropped by CARROTBAT

Tactics: TA0011, TA0010
Techniques: T1071, T1048
Input: In this case, the technique could be used for privilege escalation from user to administrator or SYSTEM or from administrator to SYSTEM, depending on the program.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Attor can detect whether it is executed in some virtualized or emulated environment by searching for specific artifacts, such as communication with I/O ports and using VM-specific instructions.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Both are binaries that may be digitally signed by Microsoft.

Tactics: TA0005
Techniques: T1218.009, T1218
Input: Rundll32.exe is commonly associated with executing DLL payloads (ex: rundll32.exe {DLLname, DLLfunction}).

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Silent Librarian has collected e-mail addresses from targeted organizations from open Internet searches.

Tactics: TA0043
Techniques: T1589.002, T1589
Input: AppleSeed can gain system level privilege by passing SeDebugPrivilege to the AdjustTokenPrivilege API.

Tactics: TA0004, TA0005
Techniques: T1134
Input: 64)   u= {B5B70BD7-87FC-499A-B4D1- 98163306F0D8} A GUID   r= 1 Boolean value if the malware is running as injected code   t= 8035187 Number of milliseconds the computer has been running    Table 3

Tactics: TA0004, TA0005
Techniques: T1055
Input: The dir /r command can also be used to display ADSs.

Tactics: TA0005
Techniques: T1564, T1564.004
Input: However, certain shims can be used to Bypass User Account Control (UAC and RedirectEXE), inject DLLs into processes (InjectDLL), disable Data Execution Prevention (DisableNX) and Structure Exception Handling (DisableSEH), and intercept memory addresses (GetProcAddress).

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: BloodHound can use PowerShell to pull Active Directory information from the target environment.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: FlawedAmmyy enumerates the current user during the initial infection.

Tactics: TA0007
Techniques: T1033
Input: Dok installs a root certificate to aid in Adversary-in-the-Middle actions using the command add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /tmp/filename.

Tactics: TA0005
Techniques: T1553, T1553.004
Input: SPACESHIP identifies files with certain extensions and copies them to a directory in the user's profile.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: GrimAgent can sleep for 195 - 205 seconds after payload execution and before deleting its task.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.When it comes to following links, monitor for references to uncategorized or known-bad sites.

Tactics: TA0043
Techniques: T1598
Input: Backdoor.Oldrea collects information about the Internet adapter configuration.

Tactics: TA0007
Techniques: T1016
Input: When flood volumes exceed the capacity of the network connection being targeted, it is typically necessary to intercept the incoming traffic upstream to filter out the attack traffic from the legitimate traffic.

Tactics: TA0040
Techniques: T1498
Input: Adversaries may search CDN data to gather actionable information.

Tactics: TA0043
Techniques: T1596, T1596.004
Input: Sandworm Team has used port 6789 to accept connections on the group's SSH server.

Tactics: TA0011
Techniques: T1571
Input: KOCTOPUS will perform UAC bypass either through fodhelper.exe or eventvwr.exe.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.

Tactics: TA0007
Techniques: T1057
Input: SeaDuke is capable of executing commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: HermeticWizard has used regsvr32.exe /s /i to execute malicious payloads.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Similarly, monitoring command line arguments which suppress notifications may highlight potentially malicious activity ( VBoxManage.exe setextradata global GUI/SuppressMessages "all").

Tactics: TA0005
Techniques: T1564, T1564.006
Input: Command & Control  The malware communicates with the Naver email platform in order to communicate with the operator

Tactics: TA0011
Techniques: T1071
Input: Victims are targeted by watering hole attacks, and emails with links to malicious websites or with malicious attachments

Tactics: TA0001
Techniques: T1189, T1566.003, T1566, T1566.002
Input: The Payloads The delivery documents in this attack campaign loaded remote templates whose macros installed a variety of first-stage payloads

Tactics: TA0002, TA0005
Techniques: T1027, T1059
Input: cmd is used to execute programs and other actions at the command-line interface.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: TajMahal has the ability to determine local time on a compromised host.

Tactics: TA0007
Techniques: T1124
Input: Machete uses FTP for Command & Control.

Tactics: TA0011
Techniques: T1071.002, T1071
Input: Mustang Panda has downloaded additional executables following the initial infection stage.

Tactics: TA0011
Techniques: T1105
Input: In macOS and Linux, the currently logged in user can be identified with w and who.

Tactics: TA0007
Techniques: T1033
Input: The White Company has checked for specific antivirus products on the target’s computer, including Kaspersky, Quick Heal, AVG, BitDefender, Avira, Sophos, Avast!, and ESET.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Current User Hive: reg query HKCU /f password /t REG_SZ /s

Tactics: TA0006
Techniques: T1552, T1552.002
Input: RunningRAT contains code to compress files.

Tactics: TA0009
Techniques: T1560
Input: Victim-owned websites may contain a variety of details, including names of departments/divisions, physical locations, and data about key employees such as names, roles, and contact info (ex: Email Addresses).

Tactics: TA0043
Techniques: T1594
Input: LookBack removes itself after execution and can delete files on the system.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Monitor for modification of accounts in correlation with other suspicious activity.

Tactics: TA0003
Techniques: T1098
Input: There are examples of antivirus software being targeted by persistent threat groups to avoid detection.

Tactics: TA0005
Techniques: T1211
Input: Stealth Falcon malware communicates with its C2 server via HTTPS.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Malware may be placed on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure).

Tactics: TA0042
Techniques: T1608.001, T1608
Input: These applications are often websites, but can include databases (like SQL), standard services (like SMB or SSH), network device administration and management protocols (like SNMP and Smart Install), and any other applications with Internet accessible open sockets, such as web servers and related services.

Tactics: TA0001
Techniques: T1190
Input: Consider automatically relaunching forwarding mechanisms at recurring intervals (ex: temporal, on-logon, ) as well as applying appropriate change management to firewall rules and other related system configurations.

Tactics: TA0005
Techniques: T1562.006, T1562
Input: Information about installed software may include a variety of details such as types and versions on specific hosts, as well as the presence of additional components that might be indicative of added defensive protections (ex: antivirus, SIEMs, ).

Tactics: TA0043
Techniques: T1592, T1592.002
Input: As of OSX 10.10, OSA only supports two languages, JXA and AppleScript.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: RATANKBA uses tasklist /svc to display running tasks.

Tactics: TA0007
Techniques: T1007
Input: Containers can be deployed by various means, such as via Docker's create and start APIs or via a web application such as the Kubernetes dashboard or Kubeflow.

Tactics: TA0002, TA0005
Techniques: T1610
Input: Monitor for newly constructed containers that may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053
Input: Arp can be used to display ARP configuration information on the host.

Tactics: TA0007
Techniques: T1016
Input: Comnie encrypts command and control communications with RC4.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: FALLCHILL encrypts C2 data with RC4 encryption.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: While use of Virtualization/Sandbox Evasion may involve checking for known sandbox values and continuing with execution only if there is no match, the use of guardrails will involve checking for an expected target-specific value and only continuing with execution if there is such a match.

Tactics: TA0005
Techniques: T1480
Input: CostaBricks has been used to load SombRAT onto a compromised host.

Tactics: TA0011
Techniques: T1105
Input: KOMPROGO is capable of running WMI queries.

Tactics: TA0002
Techniques: T1047
Input: Monitor for changes to environment variables and files associated with loading shared libraries such as LD_PRELOAD on Linux and DYLD_INSERT_LIBRARIES on macOS.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.006, T1574
Input: In addition to staging content to exploit a user's web browser, adversaries may also stage scripting content to profile the user's browser (as in Gather Victim Host Information) to ensure it is vulnerable prior to attempting exploitation.

Tactics: TA0042
Techniques: T1608.004, T1608
Input: For example, on macOS systems log show --predicate 'process = "screensharingd" and eventMessage contains "Authentication:"' can be used to review incoming VNC connection attempts for suspicious activity.

Tactics: TA0008
Techniques: T1021.005, T1021
Input: Melcoz has the ability to download additional files to a compromised host.

Tactics: TA0011
Techniques: T1105
Input: TajMahal has the ability to capture keystrokes on an infected host.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: NavRAT uses the email platform, Naver, for C2 communications, leveraging SMTP.

Tactics: TA0011
Techniques: T1071, T1071.003
Input: Monitor for changes made to files that may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems.

Tactics: TA0003, TA0004
Techniques: T1547
Input: This information could be useful for performing other techniques, such as executing a file with a Scheduled Task/Job , or to discover locality information based on time zone to assist in victim targeting ( System Location Discovery).

Tactics: TA0007
Techniques: T1124
Input: Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.

Tactics: TA0043, TA0001, TA0003, TA0005, TA0006, TA0007, TA0008, TA0011, TA0010, TA0040
Techniques: T1599, T1505.003, T1499.002, T1219, T1599.001, T1041, T1499, T1003.006, T1572, T1598.001, T1595.001, T1132.001, T1498, T1033, T1003, T1563.002, T1568, T1132, T1499.003, T1102.001, T1102.002, T1598.002, T1104, T1048.002, T1048.003, T1021, T1011.001, T1498.002, T1563, T1021.002, T1046, T1090.001, T1090.003, T1566.003, T1048, T1566, T1566.002, T1595, T1102.003, T1499.001, T1566.001, T1567.001, T1563.001, T1505, T1105, T1598, T1534, T1567.002, T1090, T1090.002, T1567, T1011, T1095, T1598.003, T1132.002, T1102, T1498.001, T1048.001, T1496, T1499.004, T1595.002
Input: It has historically leveraged legitimate third-party websites to host the malware’s command and control (C2) information, acting as “dead drops”

Tactics: TA0011
Techniques: T1102
Input: VNC defaults to TCP ports 5900 for the server, 5800 for browser access, and 5500 for a viewer in listening mode.

Tactics: TA0008
Techniques: T1021.005, T1021
Input: Monitor for newly constructed processes and/or command-lines that executed through scheduled tasks may show up as outlier processes that have not been seen before when compared against historical data.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: AppleSeed can pull a timestamp from the victim's machine.

Tactics: TA0007
Techniques: T1124
Input: Olympic Destroyer will attempt to enumerate mapped network shares to later attempt to wipe all files on those shares.

Tactics: TA0007
Techniques: T1135
Input: Pupy can walk through directories and recursively search for strings in files.

Tactics: TA0007
Techniques: T1083
Input: An account registered to a domain, with or without special privileges, can be abused to list all domain accounts that have preauthentication disabled by utilizing Windows tools like PowerShell with an LDAP filter.

Tactics: TA0006
Techniques: T1558, T1558.004
Input: AppleJeus has loaded a plist file using the launchctl command.

Tactics: TA0002
Techniques: T1569.001, T1569
Input: This malicious code in the bootloader provides the capability of direct memory manipulation to the adversary, allowing them to patch the live operating system during runtime.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: Confucius has dropped malicious files into the startup folder %AppData%\Microsoft\Windows\Start Menu\Programs\Startup on a compromised host in order to maintain persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Ramsay has included embedded Visual Basic scripts in malicious documents.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Data exfiltration is done by Okrum using the already opened channel with the C2 server.

Tactics: TA0010
Techniques: T1041
Input: APT-C-36 has downloaded binary data from a specified domain after the malicious document is opened.

Tactics: TA0011
Techniques: T1105
Input: LoudMiner used a script to gather the IP address of the infected machine before sending to the C2.

Tactics: TA0007
Techniques: T1016
Input: Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

Tactics: TA0043
Techniques: T1596.002, T1591.004, T1589.003, T1592, T1591.003, T1590.002, T1589, T1592.002, T1593, T1591.002, T1589.001, T1597.002, T1592.004, T1590, T1596, T1590.004, T1596.005, T1590.006, T1590.005, T1590.003, T1591, T1592.003, T1597, T1593.001, T1596.004, T1591.001, T1592.001, T1593.002, T1596.003, T1597.001, T1590.001, T1596.001
Input: Fox Kitten has used Volume Shadow Copy to access credential information from NTDS.

Tactics: TA0006
Techniques: T1003.003, T1003
Input: BabyShark has executed the reg query command for HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default.

Tactics: TA0007
Techniques: T1012
Input: Threat Group-3390 has staged tools, including gsecdump and WCE, on previously compromised websites.

Tactics: TA0042
Techniques: T1608, T1608.002
Input: Changes to accessibility utility binaries or binary paths that do not correlate with known software, patch cycles, , are suspicious.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: The dropper will delete itself at the end of the process

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Bundlore has used the ps command to list processes.

Tactics: TA0007
Techniques: T1057
Input: Monitor processes and command-line arguments for execution and subsequent behavior.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: This information can then be transmitted to the attacker using protocols such as FTP, HTTP, and SMTP

Tactics: TA0011
Techniques: T1071
Input: APT29 added their own devices as allowed IDs for active sync using Set-CASMailbox, allowing it to obtain copies of victim mailboxes.

Tactics: TA0003
Techniques: T1098.002, T1098
Input: APT33 has used a variety of publicly available tools like LaZagne, Mimikatz, and ProcDump to dump credentials.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: A shortcut file is generated in the following path:  %TEMP%\~Update.lnk  This ‘~Update.lnk’ file is then copied to a filename of ‘Windows help.lnk’, which is placed in the startup path previously identified

Tactics: TA0003, TA0004, TA0005
Techniques: T1547.009, T1036, T1547
Input: Staging web resources for a link target to be used with spearphishing.

Tactics: TA0042
Techniques: T1608
Input: Agent Tesla can download additional files for execution on the victim’s machine.

Tactics: TA0011
Techniques: T1105
Input: SMOKEDHAM can capture screenshots of the victim’s desktop.

Tactics: TA0009
Techniques: T1113
Input: HDoor kills anti-virus found on the victim.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Cardinal RAT encodes many of its artifacts and is encrypted (AES-128) when downloaded.

Tactics: TA0005
Techniques: T1027
Input: This may also span both native defenses as well as supplemental capabilities installed by users and administrators.

Tactics: TA0005
Techniques: T1562
Input: WEBC2 can download and execute a file.

Tactics: TA0011
Techniques: T1105
Input: The extent of this increase will depending upon many variables, such as the protocol in question, the technique used, and the amplifying servers that actually produce the amplification in attack volume.

Tactics: TA0040
Techniques: T1498, T1498.002
Input: StrongPity can parse the hard drive on a compromised host to identify specific file extensions.

Tactics: TA0007
Techniques: T1083
Input: Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network.

Tactics: TA0009
Techniques: T1560
Input: The Data field is encrypted using a custom stream cipher.

Tactics: TA0009
Techniques: T1560
Input: Pysa has extracted credentials from the password database before encrypting the files.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: If the OwaAuth web shell is ineffective because the victim uses two-factor authentication for webmail, the adversaries identify other externally accessible servers and deploy ChinaChopper web shells

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Malicious processes are marked red (click image to enlarge):  The following malicious files are dropped and run:  C:\ProgramData\{2ED05C38-D464-4188-BC7F-F6915DE8D764}\OFFLINE\9A189DFE\C7B7C186\main.vbs dcac79d7dc4365c6d742a49244e81fd0 C:\Users\Public\Libraries\RecordedTV\DnE.ps1 7fe0cb5edc11861bc4313a6b04aeedb2 C:\Users\Public\Libraries\RecordedTV\DnS.ps1 3920c11797ed7d489ca2a40201c66dd4 “C:\Windows\System32\schtasks.exe” /create /F /sc minute /mo 3 /tn “GoogleUpdateTasksMachineUI” /tr C:\Users\Public\Libraries\RecordedTV\backup.vbs 7528c387f853d96420cf7e20f2ad1d32  Command and control server is located in the following domain: tecsupport[.]in A detailed analysis of the malware is provided in two posts by Palo Alto networks and in a post by FireEye, which wrote about previous campaigns by this threat agent

Tactics: TA0002
Techniques: T1204
Input: Depending on the software and nature of the vulnerability, some may be exploited in the browser or require the user to open a file.

Tactics: TA0002
Techniques: T1203
Input: Having access to software's source code may allow adversaries to develop Exploits, while credentials may provide access to additional resources using Valid Accounts.

Tactics: TA0009
Techniques: T1213, T1213.003
Input: Monitor executed commands and arguments that may consist of logon scripts for unusual access by abnormal users or at abnormal times.

Tactics: TA0003, TA0004
Techniques: T1037
Input: Magic Hound has used PowerShell for execution and privilege escalation.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Once APT28 gained access to the DCCC network, the group then proceeded to use that access to compromise the DNC network.

Tactics: TA0001
Techniques: T1199
Input: HOPLIGHT has been observed loading several APIs associated with Pass the Hash.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: In the order to run the SSH server, the attackers created a VBS file with the following content: Set WshShell = CreateObject(“WScript.Shell”) WshShell.CurrentDirectory = “C:\WINDOWS\TEMP\Dropbear\” WshShell.Run “dropbear.exe -r rsa -d dss -a -p 6789”, 0, false As is evident here, the SSH server will accept connections on port number 6789

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: A JHUHUGIT variant encodes C2 POST data base64.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Command Hash   Command Name   Description    0x0AA37987  loadconfig  Runs each command specified in the configuration file (see the Configuration section)

Tactics: TA0005, TA0007
Techniques: T1070, T1070.006, T1016
Input: APT32 has also encoded payloads using Base64 and a framework called "Dont-Kill-My-Cat (DKMC).

Tactics: TA0005
Techniques: T1027
Input: Monitor for newly constructed scheduled jobs by enabling the "Microsoft-Windows-TaskScheduler/Operational" setting within the event logging service.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053