madox81/Adema_ATTACK_DS huggingface dataset:
Input: FIN7 has developed malware for use in operations, including the creation of infected removable media.

Tactics: TA0042
Techniques: T1587, T1587.001
Input: Native API functions (such as NtCreateProcess) may be directed invoked via system calls / syscalls, but these features are also often exposed to user-mode applications via interfaces and libraries.

Tactics: TA0002
Techniques: T1106
Input: Next, to the beginning of the BASE64 string a random BASE64 string with the length of 5 characters is added

Tactics: TA0005
Techniques: T1027
Input: Winnti for Linux has used a modified copy of the open-source userland rootkit Azazel, named libxselinux.so, to hide the malware's operations and network activity.

Tactics: TA0005
Techniques: T1014
Input: TA505 has used UPX to obscure malicious code.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Adversaries can set environment variables via the command line using the export command, setenv function, or putenv function.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.006, T1574
Input: Its use of a PowerShell payload means that only legitimate system processes are utilized and that the malicious code execution can only be identified through enhanced logging or in memory

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Some SeaDuke samples have a module to use pass the ticket with Kerberos for authentication.

Tactics: TA0005, TA0008
Techniques: T1550.003, T1550
Input: SUNBURST collected all network interface MAC addresses that are up and not loopback devices, as well as IP address, DHCP configuration, and domain information.

Tactics: TA0007
Techniques: T1016
Input: APT28 can exfiltrate data over Google Drive.

Tactics: TA0010
Techniques: T1567
Input: Clambling can enumerate the IP address of a compromised machine.

Tactics: TA0007
Techniques: T1016
Input: PsExec has the ability to remotely create accounts on target systems.

Tactics: TA0003
Techniques: T1136, T1136.002
Input: RTM has initiated connections to external domains using HTTPS.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: The wave against the government entity (June 26) also involved a simple PE file attachment (SHA256: d948d5b3702e140ef5b9247d26797b6dcdfe4fdb6f367bb217bc6b5fc79df520) using the filename tafahom.exe

Tactics: TA0005
Techniques: T1036
Input: In the second method for changing the operating system in memory, the adversary would make use of the boot loader.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: Instead of setting up their own DNS servers, adversaries may compromise third-party DNS servers in support of operations.

Tactics: TA0042
Techniques: T1584.002, T1584
Input: A number of tools can be used to retrieve the SAM file through in-memory techniques:

Tactics: TA0006
Techniques: T1003, T1003.002
Input: APT29 has stolen user's saved passwords from Chrome.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: TrickBot uses HTTPS to communicate with its C2 servers, to get malware updates, modules that perform most of the malware logic and various configuration files.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: XCSSET then downloads a script and Mach-O file into the Xcode project folder.

Tactics: TA0001
Techniques: T1195.001, T1195
Input: SpeakUp uses the whoami command.

Tactics: TA0007
Techniques: T1033
Input: DarkWatchman can store configuration strings, keylogger, and output of components in the Registry.

Tactics: TA0005
Techniques: T1112
Input: NETWIRE can create a scheduled task to establish persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Rocke exploited Apache Struts, Oracle WebLogic (CVE-2017-10271), and Adobe ColdFusion (CVE-2017-3066) vulnerabilities to deliver malware.

Tactics: TA0001
Techniques: T1190
Input: Monitor for unexpected deletion of windows registry keys to hide configuration information, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.

Tactics: TA0005
Techniques: T1112
Input: Adversaries may attempt to hide artifacts associated with their behaviors to evade detection.

Tactics: TA0005
Techniques: T1564
Input: Leviathan has sent spearphishing emails with links, often using a fraudulent lookalike domain and stolen branding.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: GravityRAT uses HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Monitor executed processes and command-line arguments for actions that could be taken to gather local email files.

Tactics: TA0009
Techniques: T1114
Input: It is highly likely the adversary then used spear-phishing attacks containing links to these malicious documents as a delivery mechanism

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Molerats has sent malicious files via email that tricked users into clicking Enable Content to run an embedded macro and to download malicious archives.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Hancitor has the ability to download additional files from C2.

Tactics: TA0011
Techniques: T1105
Input: Okrum's loader can check the amount of physical memory and terminates itself if the host has less than 1.5 Gigabytes of physical memory in total.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Look for command-lines that invoke attempts to access or copy the NTDS.dit.

Tactics: TA0006
Techniques: T1003.003, T1003
Input: It contains functionality to acquire information about credentials in many ways, including from the SAM table.

Tactics: TA0006
Techniques: T1003, T1003.002
Input: Domain trust details, such as whether or not a domain is federated, allow authentication and authorization properties to apply between domains for the purpose of accessing shared resources.

Tactics: TA0004, TA0005
Techniques: T1484, T1484.002
Input: Adversaries attempt to take advantage of a trusted internal account to increase the likelihood of tricking the target into falling for the phish attempt.

Tactics: TA0008
Techniques: T1534
Input: DarkComet adds a Registry value for its installation routine to the Registry Key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System Enable LUA="0" and HKEY_CURRENT_USER\Software\DC3_FEXEC.

Tactics: TA0005
Techniques: T1112
Input: GoldenSpy constantly attempts to download and execute files from the remote C2, including GoldenSpy itself if not found on the system.

Tactics: TA0011
Techniques: T1105
Input: For example, they stated DROPSHOT uses more advanced anti-emulation techniques, utilizes external scripts for self-deletion, and uses memory injection versus external drivers for deployment

Tactics: TA0002
Techniques: T1059
Input: GrimAgent can use a hardcoded server public RSA key to encrypt the first request to C2.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Transparent Tribe has used weaponized documents in e-mail to compromise targeted systems.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Use Trusted Platform Module technology.

Tactics: TA0003, TA0005
Techniques: T1542.001, T1542
Input: EVILNUM can download and upload files to the victim's computer.

Tactics: TA0011
Techniques: T1105
Input: An adversary may guess login credentials without prior knowledge of system or environment passwords during an operation by using a list of common passwords.

Tactics: TA0006
Techniques: T1110, T1110.001
Input: yty has some basic anti-sandbox detection that tries to detect Virtual PC, Sandboxie, and VMware.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: REvil has the ability to identify specific files and directories that are not to be encrypted.

Tactics: TA0007
Techniques: T1083
Input: Xbash can execute malicious JavaScript payloads on the victim’s machine.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: In one instance, the threat actor gained remote access to a high-value system in a compromised network, ran quser.exe to identify existing RDP sessions on the device, immediately ran a command to compile a RAR archive that specified file types the threat actor did not want, and used a password to encrypt the archive:  YYYY-MM-DD hh:mm:ss     quser YYYY-MM-DD hh:mm:ss     C:\windows\temp\svchost.exe a -m5 -v2000m -hp{password} -inul -r "{destination_file.rar}" "{multiple user directories linked to the victim's projects}" -x*.exe -x*.msi -x*.cab -x*.inc -x*.dll -x*.db -x*.mdb -x*.htm -x*.html -x*.css -x*.jar -x*.js -x*.tmp -x*.bak -x*.dat -x*.log -x*.xml -x*.dmp -x*.dbf -x*.avi -x*.mp3 -x*.mp4 -x*.mpg -x*.mpeg -x*.asp -x*.aspx -x*.gif -x*.jpg -x*.mpp -x*.pst  The threat actors typically rename the encrypted RAR archives

Tactics: TA0005
Techniques: T1036
Input: (ex: Windows EID 4625 or 5379)

Tactics: TA0006
Techniques: T1110.004, T1110, T1110.002, T1110.003
Input: APT28 added "junk data" to each encoded string, preventing trivial decoding without knowledge of the junk removal algorithm.

Tactics: TA0011
Techniques: T1001.001, T1001
Input: Most common web applications have standardized and documented cookie values that can be generated using provided tools or interfaces.

Tactics: TA0006
Techniques: T1606, T1606.001
Input: If the executing process is set to run at a specific time or during a certain event (, system bootup) then this technique can also be used for persistence.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.010, T1574.005, T1574
Input: JavaScript (JS) is a platform-independent scripting language (compiled just-in-time at runtime) commonly associated with scripts in webpages, though JS can be executed in runtime environments outside the browser.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Look for command-lines that invoke AuditD or the Security Accounts Manager (SAM).

Tactics: TA0006, TA0007
Techniques: T1033, T1003
Input: Even though Delphi Cannon uses POP3S and SMTPS for its C2 communications like Cannon, it is arguably easier to defend against as it uses an actor owned domain that defenders can easily block and not a legitimate email provider such as Seznam

Tactics: TA0011
Techniques: T1071
Input: Machete captures screenshots.

Tactics: TA0009
Techniques: T1113
Input: Fysbis can use Base64 to encode its C2 traffic.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Figure 9: Command logs after execution Network Communications FELIXROOT communicates with its C2 via HTTP and HTTPS POST protocols

Tactics: TA0011
Techniques: T1071
Input: ZIRCONIUM has purchased domains for use in targeted campaigns.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: Traffic to known anonymity networks and C2 infrastructure can be blocked through the use of network allow and block lists.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: Monitor for newly constructed network device configuration and system image against a known-good version to discover unauthorized changes to system boot, startup configuration, or the running OS.

Tactics: TA0003, TA0005
Techniques: T1542.005, T1542
Input: Imminent Monitor has a keylogging module.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: ZeroT can download additional payloads onto the victim.

Tactics: TA0011
Techniques: T1105
Input: MoonWind communicates over ports 80, 443, 53, and 8080 via raw sockets instead of the protocols usually associated with the ports.

Tactics: TA0011
Techniques: T1571
Input: REvil can identify the domain membership of a compromised host.

Tactics: TA0007
Techniques: T1069.002, T1069
Input: Operation Wocao has executed PowerShell commands which were encoded or compressed using Base64, zlib, and XOR.

Tactics: TA0005
Techniques: T1027
Input: TA505 has signed payloads with code signing certificates from Thawte and Sectigo.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Dragonfly has used SMB for C2.

Tactics: TA0011
Techniques: T1071
Input: Ensure proper user permissions are in place to prevent adversaries from disabling or interfering with security/logging services.

Tactics: TA0005
Techniques: T1562
Input: Socksbot can take screenshots.

Tactics: TA0009
Techniques: T1113
Input: Comnie, first named by Sophos seemingly after the Windows LNK file name it created, is a custom malware family that is used in targeted attacks, and has been observed in the wild since at least April 2013

Tactics: TA0003, TA0004, TA0005
Techniques: T1547.009, T1036, T1547
Input: Adversaries may also check for legitimate user activity to help determine if it is in an analysis environment.

Tactics: TA0005, TA0007
Techniques: T1497
Input: Explosive has a function to download a file to the infected system.

Tactics: TA0011
Techniques: T1105
Input: KGH_SPY has the ability to set a Registry key to run a cmd.exe command.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: SDBbot has the ability to XOR the strings for its installer component with a hardcoded 128 byte key.

Tactics: TA0005
Techniques: T1027
Input: ZeroT can add a new service to ensure PlugX persists on the system when delivered as another payload onto the system.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: The file name AcroRD32.exe, a legitimate process name for Adobe's Acrobat Reader, was used by APT1 as a name for malware.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Persistence is maintained through a Run registry key

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Agent Tesla has the ability to decrypt strings encrypted with the Rijndael symmetric encryption algorithm.

Tactics: TA0005
Techniques: T1140
Input: In some Linux systems, this is set by default to "ignoreboth" which covers both of the previous examples.

Tactics: TA0005
Techniques: T1562.003, T1562
Input: An example of a domain structure and malware delivery contents is shown in the following table:      SHA-256 Infrastructure URL   4e4967e3d39256049bc1054b966e5c609245fd3b2a934fda5cd1885526d8221e stemtopx[.]com/work/1.doc   d2f58b08f8abfe5055f3c1f0b8d991dfe1deb62807a5336b134ce2fb36d87284 stemtopx[.]com/work/3.exe   db4d8d931f1b979cf32d311f9b03e851d3283b4f7e86252730247da25cf9f093 stemtopx[.]com/work/2.exe   4c6e3d8fdb2394edffe4a5bc45a238749e929301efa8bcfa3a247b1ab68eac54 stemtopx[.]com/work/1.exe   81de431987304676134138705fc1c21188ad7f27edf6b77a6551aa693194485e stemtopx[.]com/work/new/20.exe   26151f1e24bc97532e49013fbe04919de1f51e346dba1f10ce2e389160f2fb9d stemtopx[.]com/work/new/3.exe   a100ce0a67c5890bcc38d2b6e30f9164dfe266126ec40a2fd7eb8e941dc7d025 stemtopx[.]com/work/new/2.exe   806098afc2148dabb838b24c4dfaa148269ac3ddf769aee54e75d46bfef0c506 stemtopx[.]com/work/doc/20.doc   bf37d6cb393b440f790ad2b333624fde079e10bfaeb44d65188e3ccc551c982f stemtopx[.]com/work/k/1.docx   81de431987304676134138705fc1c21188ad7f27edf6b77a6551aa693194485e stemtopx[.]com/work/k/1s.exe     Table 1

Tactics: TA0001, TA0004, TA0005, TA0011
Techniques: T1566.003, T1566, T1566.002, T1055.012, T1008, T1055
Input: FELIXROOT collects a list of running processes.

Tactics: TA0007
Techniques: T1057
Input: If a smart card is used for multi-factor authentication, then a keylogger will need to be used to obtain the password associated with a smart card during normal use.

Tactics: TA0006
Techniques: T1111
Input: Monitor for changes made to files for unexpected modifications to unusual accounts outside of normal administration duties

Tactics: TA0003, TA0004
Techniques: T1037.003, T1037
Input: GrimAgent can collect data and files from a compromised host.

Tactics: TA0009
Techniques: T1005
Input: FIN6 used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.

Tactics: TA0007
Techniques: T1046, T1018
Input: Each running process has its own directory, which includes memory mappings.

Tactics: TA0004, TA0005
Techniques: T1055.009, T1055
Input: GRIFFON has used a reconnaissance module that can be used to retrieve the date and time of the system.

Tactics: TA0007
Techniques: T1124
Input: Clambling can discover the hostname, computer name, and Windows version of a targeted machine.

Tactics: TA0007
Techniques: T1082
Input: Environmental Keying likely should not be mitigated with preventative controls because it may protect unintended targets from being compromised.

Tactics: TA0005
Techniques: T1480, T1480.001
Input: More_eggs has used a signed binary shellcode loader and a signed Dynamic Link Library (DLL) to create a reverse shell.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Hydraq creates a backdoor through which remote attackers can load and call DLL functions.

Tactics: TA0002
Techniques: T1129
Input: FELIXROOT has also used WMI to query the Windows Registry.

Tactics: TA0007
Techniques: T1012
Input: The CozyCar dropper copies the system file rundll32.exe to the install location for the malware, then uses the copy of rundll32.exe to load and execute the main CozyCar component.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Stuxnet uses an RPC server that contains a file dropping routine and support for payload version updates for P2P communications within a victim network.

Tactics: TA0008
Techniques: T1570
Input: Commercial software may be obtained through purchase, stealing licenses (or licensed copies of the software), or cracking trial versions.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: MobileOrder has a command to upload to its C2 server victim mobile device information, including IMEI, IMSI, SIM card serial number, phone number, Android version, and other information.

Tactics: TA0007
Techniques: T1082
Input: We have gathered three samples of the default loader associated with this group and extracted the following configurations:    SHA256 of Sample Configuration   82779504d3fa0ffc8506ab69de9cb4d8f6415adbb11a9b8312828c539cf10190 LAUNCHER_ARGS=[‘–host’, ‘www1.chrome-up[.]date:4443’, ‘-t’, ‘obfs3’]   db453b8de1a01a3e4d963847c0a0a45fb7e1a9b9e6d291c8883c74019f2fc91f LAUNCHER_ARGS=[‘–host’, ‘www1.chrome-up[.]date:4443’, ‘-t’, ‘obfs3’]   7e57e35f8fce0efc3b944a7545736fa419e9888514fcd9e098c883b8d85e7e73 LAUNCHER_ARGS=[‘–host’, ‘139.59.46[.]154:3543’, ‘-t’, ‘obfs3’]      These configurations show that this group uses both fully-qualified domain names and IP addresses to host their Pupy C2 servers

Tactics: TA0007, TA0011
Techniques: T1008, T1016, T1102
Input: Gelsemium has named malicious binaries serv.exe, winprint.dll, and chrome_elf.dll and has set its persistence in the Registry with the key value Chrome Update to appear legitimate.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Command-line invocation of tools capable of modifying services may be unusual, depending on how systems are typically used in a particular environment.

Tactics: TA0003, TA0004
Techniques: T1543
Input: BADCALL collects the computer name and host name on the compromised system.

Tactics: TA0007
Techniques: T1082
Input: Process doppelgänging's use of TxF also avoids the use of highly-monitored API functions such as NtUnmapViewOfSection, VirtualProtectEx, and SetThreadContext.

Tactics: TA0004, TA0005
Techniques: T1055.013, T1055
Input: The backdoor's infrequent beaconing, traffic obfuscation, extensive encryption and use of geographically local, legitimate websites for command and control (C2) make identification of its network traffic difficult

Tactics: TA0011
Techniques: T1573
Input: Azorult can steal credentials in files belonging to common software such as Skype, Telegram, and Steam.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: In addition to obfuscation techniques, it also has the ability to detect security tools on the analysis machine, and can also shut down the system if it detects the presence of such tools

Tactics: TA0007
Techniques: T1518.001, T1518
Input: APT37 has used Ruby scripts to execute payloads.

Tactics: TA0002
Techniques: T1059
Input: One sample in particular, cba5ab65a… used yet another unique user agent string in combination with the previous user agent for its C2: Mozilla v5.1 (Windows NT 6.1; rv:6.0.1) Gecko/20100101 Firefox/6.0.1 A malware sample using two separate unique user agent strings is uncommon

Tactics: TA0003, TA0004, TA0007
Techniques: T1033, T1543.001, T1543
Input: An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party libraries.

Tactics: TA0009
Techniques: T1560.002, T1560
Input: Netwalker has been written in PowerShell and executed directly in memory, avoiding detection.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive.

Tactics: TA0040
Techniques: T1496
Input: APT37 identifies the victim username.

Tactics: TA0007
Techniques: T1033
Input: Microsoft Exchange transport agents can operate on email messages passing through the transport pipeline to perform various tasks such as filtering spam, filtering malicious attachments, journaling, or adding a corporate signature to the end of all outgoing emails.

Tactics: TA0003
Techniques: T1505.002, T1505
Input: When contact is lost with the primary command and control server malware may employ a DGA as a means to reestablishing command and control.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: Some of the information may help adversaries to further their operation within a network.

Tactics: TA0007
Techniques: T1012
Input: When a file is opened, the default program used to open the file (also called the file association or handler) is checked.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.001
Input: ObliqueRAT can capture a screenshot of the current screen.

Tactics: TA0009
Techniques: T1113
Input: However, in order to kick off the execution of the malware the attacker uses a batch script which executes the malware, but the batch script does more than simply initiate execution of the malware

Tactics: TA0002
Techniques: T1059
Input: Avenger has the ability to use Tasklist to identify running processes.

Tactics: TA0007
Techniques: T1057
Input: Ebury can intercept private keys using a trojanized ssh-add function.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556
Input: The majority of documents used the name “gerry knight” for the author field in the document metadata, and the embedded macros largely used direct IP connections to command and control (C2) servers rather than using domain names

Tactics: TA0011
Techniques: T1102
Input: Monitor for additions of mechanisms that could be used to trigger autostart execution, such as relevant additions to the Registry.

Tactics: TA0003, TA0004
Techniques: T1547
Input: Once a cloud account is compromised, an adversary may perform Account Manipulation - for example, by adding Additional Cloud Roles - to maintain persistence and potentially escalate their privileges.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078.004, T1078
Input: APT29 has downloaded source code from code repositories.

Tactics: TA0009
Techniques: T1213, T1213.003
Input: Adversaries may abuse Internet browser extensions to establish persistent access to victim systems.

Tactics: TA0003
Techniques: T1176
Input: ZxShell has remote desktop functionality.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Misdat is capable of downloading files from the C2.

Tactics: TA0011
Techniques: T1105
Input: Elise enumerates processes via the tasklist command.

Tactics: TA0007
Techniques: T1057
Input: ftp may be abused by adversaries to transfer tools or files between systems within a compromised environment.

Tactics: TA0008
Techniques: T1570
Input: UPPERCUT has the capability to gather the victim's current directory.

Tactics: TA0007
Techniques: T1083
Input: Azure offers a couple of enterprise policy settings in the Azure Management Portal that may help:

Tactics: TA0006
Techniques: T1528
Input: Use process monitoring to monitor the execution and arguments of regsvr32.exe.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Sowbug extracted Word documents from a file server on a victim network.

Tactics: TA0009
Techniques: T1039
Input: The InstallUtil binary may also be digitally signed by Microsoft and located in the .NET directories on a Windows system: C:\Windows\Microsoft.NET\Framework\v\InstallUtil.exe and C:\Windows\Microsoft.NET\Framework64\v\InstallUtil.exe.

Tactics: TA0005
Techniques: T1218, T1218.004