madox81/Adema_ATTACK_DS huggingface dataset:
Input: Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.

Tactics: TA0003, TA0005
Techniques: T1542.003, T1542
Input: After collecting documents from removable media, Prikormka compresses the collected files, and encrypts it with Blowfish.

Tactics: TA0009
Techniques: T1560
Input: CrackMapExec can collect DNS information from the targeted system.

Tactics: TA0007
Techniques: T1016
Input: GoldMax has decoded and decrypted the configuration file when executed.

Tactics: TA0005
Techniques: T1140
Input: AADInternals can enumerate Azure AD users.

Tactics: TA0007
Techniques: T1087, T1087.004
Input: Sandworm Team checks for connectivity to other resources in the network.

Tactics: TA0007
Techniques: T1016
Input: A similar process is then used to wipe content in logical drives and, finally, attempt to wipe every byte of every sector on every drive.

Tactics: TA0040
Techniques: T1561.001, T1561
Input: Drovorub has used a kernel module rootkit to hide processes, files, executables, and network artifacts from user space view.

Tactics: TA0005
Techniques: T1014
Input: This feature allows for an internal or external URL to be loaded and presented whenever a folder is opened.

Tactics: TA0003
Techniques: T1137, T1137.004
Input: Removal of these indicators may interfere with event collection, reporting, or other processes used to detect intrusion activity.

Tactics: TA0005
Techniques: T1070
Input: Exploits  CVE-2017-0143, SMB exploit CVE-2017-0146, SMB exploit  These 2 exploits are EternalBlue/Doublepulsar and are used to drop the Stage1 Dropper onto a system.  Installation The Gh0stRAT dropper arrives on a PC through the use of EternalBlue/DoublePulsar.  Once on a victim’s PC, the dropper executable is launched and it decrypts and loads the Gh0stRAT DLL into memory.  It then passes the config buffer to the extracted DLL and calls the exported function (Shellex)  [Screenshot 2] The mainthread of the code.  Note the call at the bottom that calls Shellex Gh0stRAT dll functionality An important note:  In its base state, this sample is damaged, therefore it will not install its services properly.  However, as the service information is included, I will list it anyways.  Additionally, samples downloaded from its distribution server DO install correctly,  and are downloaded during the base dll’s runtime

Tactics: TA0002, TA0003, TA0004, TA0005
Techniques: T1574.001, T1203, T1574.002, T1574
Input: Bisonal has used the MPRESS packer and similar tools for obfuscation.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: TAINTEDSCRIBE can copy itself into the current user’s Startup folder as "Narrator.exe" for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Ryuk is a ransomware that uses a combination of public and symmetric-key cryptography to encrypt files on the host computer.

Tactics: TA0009, TA0040
Techniques: T1560, T1486
Input: Authenticated access may enable unfettered access to hosts and/or resources within single-factor authentication environments.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.001
Input: Additionally, If adversaries launch their malicious services using svchost.exe, the service’s file may be identified using HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\servicename\Parameters\ServiceDll.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.011, T1574
Input: LazyScripter has established GitHub accounts to host its toolsets.

Tactics: TA0042
Techniques: T1583.006, T1583
Input: Tools that scan for malicious VBA source code may be bypassed as the unwanted code is hidden in the compiled p-code.

Tactics: TA0005
Techniques: T1564, T1564.007
Input: Pupy can use Lazagne for harvesting credentials.

Tactics: TA0006
Techniques: T1552.001, T1552, T1003, T1003.004, T1555.003, T1555, T1003.005
Input: Monitor for unexpected processes interacting with the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.001
Input: Bankshot gathers domain and account names/information through process monitoring.

Tactics: TA0007
Techniques: T1087.002, T1087, T1087.001
Input: Carbanak has obtained and used open-source tools such as PsExec and Mimikatz.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Various Windows utilities may be used to execute commands, possibly without invoking cmd.

Tactics: TA0005
Techniques: T1202
Input: For example, Wevtutil, auditpol, sc stop EventLog, and offensive tooling (such as Mimikatz and Invoke-Phant0m) may be used to clear logs.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: Sibot can decrypt data received from a C2 and save to a file.

Tactics: TA0005
Techniques: T1140
Input: There are also cross-platform interpreters such as Python, as well as those commonly associated with client applications such as JavaScript and Visual Basic.

Tactics: TA0002
Techniques: T1059
Input: Melcoz has gained execution through victims opening malicious links.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: menuPass has encrypted files and information before exfiltration.

Tactics: TA0009
Techniques: T1560
Input: In other cases, threat actors placed web shells on externally accessible servers, sometimes behind a reverse proxy, to execute commands on the compromised system

Tactics: TA0002, TA0003, TA0011
Techniques: T1505.003, T1505, T1090, T1059
Input: Use application control configured to block execution of msbuild.exe if it is not required for a given system or network to prevent potential misuse by adversaries.

Tactics: TA0005
Techniques: T1127.001, T1127
Input: PowerShower has the ability to encode C2 communications with base64 encoding.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Blue Mockingbird has used wmic.exe to set environment variables.

Tactics: TA0002
Techniques: T1047
Input: The interactive shell uses the ~/.zshrc to configure the user environment.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: The screenshot in Figure 8 of the inf method within a Cannon sample (SHA256: 4405cfbf28…) shows the information gathered that is exfiltrated to the C2 via email, specifically with RunningPlace and LogicalDrives header strings:  Figure 8 inf method used by Cannon When comparing the two Cannon variants, we found a method within a Delphi Cannon sample (SHA256: 5a02d4e5f6…) showing the use of Running place and Logical_Drivers as header strings to the system information it is collecting and sending to the C2 via email

Tactics: TA0011
Techniques: T1071
Input: XAgentOSX contains the takeScreenShot (along with startTakeScreenShot and stopTakeScreenShot) functions to take screenshots using the CGGetActiveDisplayList, CGDisplayCreateImage, and NSImage:initWithCGImage methods.

Tactics: TA0009
Techniques: T1113
Input: Adversaries can target various layers of the application stack that is hosted on the system used to provide the service.

Tactics: TA0040
Techniques: T1499
Input: TRITON attempts to write a dummy program into memory if it fails to reset the Triconex controller.

Tactics: TA0005
Techniques: T1036
Input: SILENTTRINITY can search for modifiable services that could be used for privilege escalation.

Tactics: TA0007
Techniques: T1007
Input: Continuous monitoring of vulnerability sources and the use of automatic and manual code review tools should also be implemented as well.

Tactics: TA0001
Techniques: T1195.001, T1195, T1195.002
Input: After running the malware, the batch script goes on to cleans up all signs of its existence on the system, this includes:  Deletion of all initial files created during installation, as well as all associated files required on disk during initial execution

Tactics: TA0005
Techniques: T1070, T1070.004
Input: KillDisk deletes system files to make the OS unbootable.

Tactics: TA0040
Techniques: T1485
Input: Astaroth can abuse alternate data streams (ADS) to store content for malicious payloads.

Tactics: TA0005
Techniques: T1564, T1564.004
Input: BRONZE BUTLER has compressed data into password-protected RAR archives prior to exfiltration.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Sakula uses DLL side-loading, typically using a digitally signed sample of Kaspersky Anti-Virus (AV) 6.0 for Windows Workstations or McAfee's Outlook Scan About Box to load malicious DLL files.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: After the cookie is obtained through Steal Web Session Cookie or Web Cookies, the adversary may then import the cookie into a browser they control and is then able to use the site or application as the user for as long as the session cookie is active.

Tactics: TA0005, TA0008
Techniques: T1550.004, T1550
Input: Adversaries may establish persistence through executing malicious commands triggered by a user’s shell.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: Dragonfly has used PowerShell scripts for execution.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Silence has downloaded additional modules and malware to victim’s machines.

Tactics: TA0011
Techniques: T1105
Input: Operation Wocao has used Mimikatz to dump certificates and private keys from the Windows certificate store.

Tactics: TA0006
Techniques: T1552.004, T1552
Input: monitor service creation that uses cmd.exe /k or cmd.exe /c in its arguments to detect RDP session hijacking.

Tactics: TA0008
Techniques: T1563.002, T1563
Input: Metamorfo can collect screenshots of the victim’s machine.

Tactics: TA0009
Techniques: T1113
Input: Regin leveraged several compromised universities as proxies to obscure its origin.

Tactics: TA0011
Techniques: T1090, T1090.002
Input: If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate with its owner.

Tactics: TA0042
Techniques: T1588.004, T1588, T1587, T1587.003
Input: WhisperGate can overwrite the Master Book Record (MBR) on victim systems with a malicious 16-bit bootloader.

Tactics: TA0040
Techniques: T1561, T1561.002
Input: A file name may include a secondary file type extension that may cause only the first extension to be displayed (ex: File.txt.exe may render in some views as just File.txt).

Tactics: TA0005
Techniques: T1036, T1036.007
Input: Kobalos is triggered by an incoming TCP connection to a legitimate service from a specific source port.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205
Input: Cobalt Strike has the ability to accept a value for HTTP Host Header to enable domain fronting.

Tactics: TA0011
Techniques: T1090.004, T1090
Input: Digital certificates are issued by a certificate authority (CA) in order to cryptographically verify the origin of signed content.

Tactics: TA0043
Techniques: T1596, T1596.003
Input: Upon exiting, /etc/zlogout and ~/.zlogout are executed.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: Adversaries may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources.

Tactics: TA0040
Techniques: T1561
Input: ComRAT can check the default browser by querying HKCR\http\shell\open\command.

Tactics: TA0007
Techniques: T1012
Input: Monitor for common cryptomining files on local systems that may indicate compromise and resource usage

Tactics: TA0040
Techniques: T1496
Input: Empire can leverage WMI debugging to remotely replace binaries like sethc.exe, Utilman.exe, and Magnify.exe with cmd.exe.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: APT41 has executed file /bin/pwd on exploited victims, perhaps to return architecture related information.

Tactics: TA0007
Techniques: T1083
Input: Malware used by Ke3chang can run commands on the command-line interface.

Tactics: TA0002
Techniques: T1059
Input: Zeus Panda can launch an interface where it can execute several commands on the victim’s PC.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Monitor authentication logs for system and application login failures of Valid Accounts.

Tactics: TA0006
Techniques: T1110.004, T1110, T1110.002, T1110.001, T1110.003
Input: Cadelspy has the ability to identify open windows on the compromised host.

Tactics: TA0007
Techniques: T1010
Input: 3PARA RAT has a command to set certain attributes such as creation/modification timestamps on files.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: If a login hook already exists, adversaries can add additional commands to an existing login hook.

Tactics: TA0003, TA0004
Techniques: T1037.002, T1037
Input: It also deletes Windows Event Logs : Application, Security, Setup, System

Tactics: TA0005
Techniques: T1070
Input: CosmicDuke contains a custom version of the RC4 algorithm that includes a programming error.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Sandworm Team's VBS backdoor can decode Base64-encoded data and save it to the %TEMP% folder.

Tactics: TA0005
Techniques: T1140
Input: A Patchwork payload was packed with UPX.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Once the extension is installed, it can browse to websites in the background, steal all information that a user enters into a browser (including credentials), and be used as an installer for a RAT for persistence.

Tactics: TA0003
Techniques: T1176
Input: ShimRat has used Windows API functions to install the service and shim.

Tactics: TA0002
Techniques: T1106
Input: Zebrocy obtains additional code to execute on the victim's machine, including the downloading of a secondary payload.

Tactics: TA0011
Techniques: T1105
Input: Monitor for newly constructed files that may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications.

Tactics: TA0005
Techniques: T1564, T1564.009
Input: Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure.

Tactics: TA0011
Techniques: T1090
Input: It also gathers registered mail, browser, and instant messaging clients from the Registry.

Tactics: TA0007
Techniques: T1083
Input: JHUHUGIT tests if it can reach its C2 server by first attempting a direct connection, and if it fails, obtaining proxy settings and sending the connection through a proxy, and finally injecting code into a running browser if the proxy method fails.

Tactics: TA0011
Techniques: T1008
Input: Bonadan has discovered the OS version, CPU model, and RAM size of the system it has been installed on.

Tactics: TA0007
Techniques: T1082
Input: There are many options for the attachment such as Microsoft Office documents, executables, PDFs, or archived files.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Changes may occur at unusual times or from unusual systems.

Tactics: TA0003
Techniques: T1098
Input: Consider using application control configured to block execution of CMSTP.exe if it is not required for a given system or network to prevent potential misuse by adversaries.

Tactics: TA0005
Techniques: T1218, T1218.003
Input: Monitor for newly executed processes that may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.

Tactics: TA0005
Techniques: T1222.002, T1222
Input: ISMInjector creates scheduled tasks to establish persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: A OilRig macro has run a PowerShell command to decode file contents.

Tactics: TA0005
Techniques: T1140
Input: Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means).

Tactics: TA0001, TA0002, TA0003, TA0004, TA0005, TA0008
Techniques: T1053.005, T1053, T1021, T1021.002, T1078
Input: Gamaredon Group has also used malware to scan for removable drives.

Tactics: TA0007
Techniques: T1120
Input: Cuba can enumerate processes running on a victim's machine.

Tactics: TA0007
Techniques: T1057
Input: Torisma has been Base64 encoded and AES encrypted.

Tactics: TA0005
Techniques: T1027
Input: Consider rotating the KRBTGT account password every 180 days.

Tactics: TA0005, TA0006, TA0008
Techniques: T1550.003, T1558, T1558.001, T1550
Input: Buckeye has been known to exploit zero-day vulnerabilities in the past, such as CVE-2010-3962 in an campaign in 2010 and CVE-2014-1776 in 2014

Tactics: TA0002, TA0004
Techniques: T1203, T1068
Input: The command az ad user get-member-groups will list groups associated to a user account for Azure while the API endpoint GET https://cloudidentity.googleapis.com/v1/groups lists group resources available to a user for Google.

Tactics: TA0007
Techniques: T1069, T1069.003
Input: Adversaries may abuse Active Setup by creating a key under  HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\ and setting a malicious value for StubPath.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.014
Input: Invoke-Obfuscation calls the variable obfuscation technique used by the actors to obfuscate this script Random Case + {} + Ticks, which changes all variables in the script to have randomly cased characters, to be surrounded in curly braces and to include the tick (`) character, which is ignored in by PowerShell

Tactics: TA0005
Techniques: T1027
Input: BackConfig can download and execute additional payloads on a compromised host.

Tactics: TA0011
Techniques: T1105
Input: POWRUNER may query the Registry by running reg query on a victim.

Tactics: TA0007
Techniques: T1012
Input: Dragonfly has queried the Registry to identify victim information.

Tactics: TA0007
Techniques: T1012
Input: XCSSET has used a zero-day exploit in the ssh launchdaemon to elevate privileges and bypass SIP.

Tactics: TA0004
Techniques: T1068
Input: Modifications may include changing specific access rights, which may require taking ownership of a file or directory and/or elevated permissions depending on the file or directory’s existing permissions.

Tactics: TA0005
Techniques: T1222
Input: Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be implanted or backdoored.

Tactics: TA0003
Techniques: T1525
Input: Monitor for newly executed processes of binaries that could be involved in data destruction activity, such as SDelete.

Tactics: TA0040
Techniques: T1485
Input: Adversaries can abuse MSBuild to proxy execution of malicious code.

Tactics: TA0005
Techniques: T1127.001, T1127
Input: APC injection is a method of executing arbitrary code in the address space of a separate live process.

Tactics: TA0004, TA0005
Techniques: T1055.004, T1055
Input: Crimson contains a module to steal credentials from Web browsers on the victim machine.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: PUNCHBUGGY can delete files written to disk.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: This command history is not available to other sessions and is deleted when the session ends.

Tactics: TA0005
Techniques: T1070, T1070.003
Input: PowerSploit contains a collection of Privesc-PowerUp modules that can discover and replace/modify service binaries, paths, and configs.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: WarzoneRAT can download and execute additional files.

Tactics: TA0011
Techniques: T1105
Input: Monitor cloud logs for API calls and other potentially unusual activity related to snapshot enumeration.

Tactics: TA0007
Techniques: T1580
Input: They may be executed from within mach-O binaries by using the macOS Native APIs NSAppleScript or OSAScript, both of which execute code independent of the /usr/bin/osascript command line utility.

Tactics: TA0002
Techniques: T1059.002, T1059
Input: The EventLog service maintains event logs from various system components and applications.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: Figure 7: The same de-obfuscated code as Figure 2 The only other script content of the blog-page[.]html is an empty script section

Tactics: TA0005
Techniques: T1027
Input: CostaBricks can implement a custom-built virtual machine mechanism to obfuscate its code.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: TajMahal has the ability to inject the LoadLibrary call template DLL into running processes.

Tactics: TA0002
Techniques: T1129
Input: AppleJeus's spearphishing links required user interaction to navigate to the malicious website.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: On-Screen Keyboard: C:\Windows\System32\osk.exe

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: Olympic Destroyer contains a module that tries to obtain credentials from LSASS, similar to Mimikatz.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: The payload will construct a message that has the following structure that it will then send to the C2:   bye<char uuid[35]>d   The message above is sent via a simple HTTPS/HTTP POST request to the C2 server

Tactics: TA0011
Techniques: T1071
Input: Dyre has the ability to identify the users on a compromised host.

Tactics: TA0007
Techniques: T1033
Input: POWRUNER can use DNS for C2 communications.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Breaching these devices may enable an adversary to bypass restrictions on traffic routing that otherwise separate trusted and untrusted networks.

Tactics: TA0005
Techniques: T1599
Input: Figure 2: Sofacy Fysbis capability related leakage through strings Figure 2 shows interactive status / feedback strings that can give a defender an initial profile of capabilities

Tactics: TA0005
Techniques: T1027
Input: The sudo command "allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands as root or another user while providing an audit trail of the commands and their arguments."

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: Lazarus Group also uses secure file deletion to delete files from the victim.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Ixeshe has a command to delete a file from the machine.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: This allows the shell to upload and download files, execute applications with web server account permissions, list directory contents, access Active Directory, access databases, and any other action allowed by the .NET runtime

Tactics: TA0007
Techniques: T1083
Input: Mshta.exe can be used to bypass application control solutions that do not account for its potential use.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: Adversaries may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to system and network resources.

Tactics: TA0040
Techniques: T1561, T1561.002
Input: The AutoIT script is offering a lot of other functions which are not used in this campaign, like anti-virtual machine detection, USB drive infection and others.The final payload — which we found in the AutoIT PE file resource section and was started by the process-hollowing shellcode — is a .NET PE file that's obfuscated with ConfuserEx

Tactics: TA0005
Techniques: T1027
Input: For example, when a user opens a command-line interface or remotely logs in (such as via SSH) a login shell is initiated.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: Using this information an adversary can target accounts with permissions to a given object or leverage accounts they have already compromised to access the object.

Tactics: TA0007
Techniques: T1069, T1069.003
Input: Users can be trained to identify social engineering techniques and phishing emails.

Tactics: TA0001
Techniques: T1566
Input: Molerats used PowerShell implants on target machines.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Wizard Spider has used WMI and LDAP queries for network discovery and to move laterally.

Tactics: TA0002
Techniques: T1047
Input: diantz may also be used to download and compress files from remote locations ( Remote Data Staging).

Tactics: TA0009
Techniques: T1560.001, T1560