madox81/Adema_ATTACK_DS huggingface dataset:
Input: FIN7 has conducted broad phishing campaigns using malicious links.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Kimsuky has collected Office, PDF, and HWP documents from its victims.

Tactics: TA0009
Techniques: T1005
Input: The original file may be overwritten, or a new file may be written alongside of it and the device reconfigured to boot to the compromised image.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: Orz can execute shell commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: ProLock can use BITS jobs to download its malicious payload.

Tactics: TA0003, TA0005
Techniques: T1197
Input: zwShell has been copied over network shares to move laterally.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: An adversary may rely upon specific actions by a user in order to gain execution.

Tactics: TA0002
Techniques: T1204
Input: Adversaries can use screensaver settings to maintain persistence by setting the screensaver to run malware after a certain timeframe of user inactivity.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.002
Input: Adversaries may gather this information in various ways, such as direct elicitation via Phishing for Information.

Tactics: TA0043
Techniques: T1591.004, T1592, T1591.003, T1589, T1591.002, T1590, T1590.003, T1591, T1592.003, T1591.001
Input: Mustang Panda has stored collected credential files in c:\windows\temp prior to exfiltration.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Denis collects OS information and the computer name from the victim’s machine.

Tactics: TA0007
Techniques: T1082
Input: AppleJeus has decoded files received from a C2.

Tactics: TA0005
Techniques: T1140
Input: Agent Tesla can capture screenshots of the victim’s desktop.

Tactics: TA0009
Techniques: T1113
Input: For example, the Add-MailboxPermission PowerShell cmdlet, available in on-premises Exchange and in the cloud-based service Office 365, adds permissions to a mailbox.

Tactics: TA0003
Techniques: T1098.002, T1098
Input: This means that " ls" will not be saved, but "ls" would be saved by history.

Tactics: TA0005
Techniques: T1562.003, T1562
Input: Silent Librarian has used collected lists of names and e-mail accounts to use in password spraying attacks against private sector targets.

Tactics: TA0006
Techniques: T1110, T1110.003
Input: Ragnar Locker may attempt to connect to removable drives and mapped network drives.

Tactics: TA0007
Techniques: T1120
Input: Information about an organization may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites).

Tactics: TA0043
Techniques: T1591
Input: Socksbot can write and execute PowerShell scripts.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: OSX/Shlayer uses the command appDir="$(dirname $(dirname "$currentDir"))" and $(dirname "$(pwd -P)") to construct installation paths.

Tactics: TA0007
Techniques: T1083
Input: BRONZE UNION appears to use a combination of self-registered IP addresses and commercial VPN services in its command and control (C2) and operational infrastructure

Tactics: TA0011
Techniques: T1102
Input: Adversaries may build a container image directly on a host to bypass defenses that monitor for the retrieval of malicious images from a public registry.

Tactics: TA0005
Techniques: T1612
Input: Although the activity was previously linked by others to the FIN7 threat actor group, our research suggests the activity is in fact espionage related and unlikely to be FIN7 related

Tactics: TA0005
Techniques: T1027
Input: The ETW provided EventHeader ProcessId identifies the actual parent process.

Tactics: TA0004, TA0005
Techniques: T1134.004, T1134
Input: It then sends the following IRC commands: NICK bxphzrjbxp USER bxphzrjbxp bxphzrjbxp bxphzrjbxp bxphzrjbxp To make sure it connected to the correct server, the Trojan checks for the message sent from the IRC server after the bot connects: Welcome to the MpkNet IRC Network The MPK bot does not join a specific IRC channel, instead sending private messages (PRIVMSG) to a user with the nick “mpk”

Tactics: TA0011
Techniques: T1132
Input: When a process is created, defensive tools/sensors that monitor process creations may retrieve the process arguments from the PEB.

Tactics: TA0005
Techniques: T1564.010, T1564
Input: Ruler can be used to enumerate Exchange users and dump the GAL.

Tactics: TA0007
Techniques: T1087.003, T1087
Input: The shellcode performs a system survey to collect the victim's computer name and username and then appends those values to a URL string using libjs.inquirerjs[.]com.

Tactics: TA0007
Techniques: T1033
Input: Ensure least privilege principles are applied to important information resources to reduce exposure to data manipulation risk.

Tactics: TA0040
Techniques: T1565.001, T1565
Input: Tropic Trooper has encrypted configuration files.

Tactics: TA0005
Techniques: T1027
Input: OSinfo: OSInfo is a general purpose, system information gathering tool

Tactics: TA0007
Techniques: T1082
Input: Pteranodon can use mshta.exe to execute an HTA file hosted on a remote server.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: H1N1 uses a custom packing algorithm.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Chaes changed the template target of the settings.xml file embedded in the Word document and populated that field with the downloaded URL of the next payload.

Tactics: TA0005
Techniques: T1221
Input: This technique can be used for persistence if executables are called on a regular basis, as well as privilege escalation if intercepted executables are started by a higher privileged process.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.009, T1574
Input: Digital certificates include information about the key, information about its owner's identity, and the digital signature of an entity that has verified the certificate's contents are correct.

Tactics: TA0042
Techniques: T1608.003, T1608
Input: Siloscape also writes both an archive of Tor and the unzip binary to disk from data embedded within the payload using Visual Studio’s Resource Manager.

Tactics: TA0005
Techniques: T1140
Input: RobbinHood stops 181 Windows services on the system before beginning the encryption process.

Tactics: TA0040
Techniques: T1489
Input: Magic Hound malware has obtained the victim username and sent it to the C2 server.

Tactics: TA0007
Techniques: T1033
Input: Proton prompts users for their credentials.

Tactics: TA0006, TA0009
Techniques: T1056.002, T1056
Input: APT28 has used compromised email accounts to send credential phishing emails.

Tactics: TA0042
Techniques: T1586.002, T1586
Input: The device typically stores an in-memory copy of the configuration while operating, and a separate configuration on non-volatile storage to load after device reset.

Tactics: TA0009
Techniques: T1602, T1602.002
Input: LookBack has a C2 proxy tool that masquerades as GUP.exe, which is software used by Notepad++.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Imminent Monitor has a CommandPromptPacket and ScriptPacket module(s) for creating a remote shell and executing scripts.

Tactics: TA0002
Techniques: T1059
Input: Gamaredon Group has injected malicious macros into all Word and Excel documents on mapped network drives.

Tactics: TA0008
Techniques: T1080
Input: BADFLICK has uploaded files from victims' machines.

Tactics: TA0009
Techniques: T1005
Input: BlackTech has used DLL side loading by giving DLLs hardcoded names and placing them in searched directories.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: Bonadan can download additional modules from the C2 server.

Tactics: TA0011
Techniques: T1105
Input: If targeted, efforts should be focused on preventing adversary tools from running earlier in the chain of activity and on identifying subsequent malicious behavior if compromised.

Tactics: TA0005
Techniques: T1480, T1480.001
Input: Utilizing an existing persona may engender a level of trust in a potential victim if they have a relationship, or knowledge of, the compromised persona.

Tactics: TA0042
Techniques: T1586.001, T1586
Input: SEASHARPEE can download remote files onto victims.

Tactics: TA0011
Techniques: T1105
Input: Monitor for newly constructed processes and/or command-lines that execute logon scripts

Tactics: TA0003, TA0004
Techniques: T1037.001, T1037.003, T1037
Input: XTunnel has been used to execute remote commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Conti can enumerate routine network connections from a compromised host.

Tactics: TA0007
Techniques: T1049
Input: Cardinal RAT can execute commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: RobbinHood disconnects all network shares from the computer with the command net use * /DELETE /Y.

Tactics: TA0005
Techniques: T1070, T1070.005
Input: The information this malware collected included the following:The computer nameThe usernameThe execution path of the sampleThe BIOS modelA randomly-generated ID to uniquely identify the systemGroup123 utilized this method to ensure their victim was (a) someone they wanted to target further and (b) someone they could infect further based on the information obtained from the reconnaissance phase

Tactics: TA0007
Techniques: T1082
Input: Attor's dispatcher can execute additional plugins by loading the respective DLLs.

Tactics: TA0002
Techniques: T1129
Input: DarkComet has a keylogging capability.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Invoke-NinjaCopy

Tactics: TA0006
Techniques: T1003.003, T1003
Input: In environments with high-maturity, it may be possible to leverage User-Behavioral Analytics (UBA) platforms to detect and alert on user based anomalies.

Tactics: TA0009
Techniques: T1213, T1213.001, T1213.002
Input: BITSAdmin can be used to create BITS Jobs to launch a malicious process.

Tactics: TA0003, TA0005
Techniques: T1197
Input: Monitor for newly executed processes that may stop or disable services on a system to render those services unavailable to legitimate users.

Tactics: TA0040
Techniques: T1489
Input: SYSCON has the ability to use Systeminfo to identify system information.

Tactics: TA0007
Techniques: T1082
Input: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.010
Input: Magic Hound has sent malicious URL links through email to victims.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: SUNBURST had commands to enumerate files and directories.

Tactics: TA0007
Techniques: T1083
Input: The C2 server can also send a PowerShell command to capture and store a screenshot of a victim’s system

Tactics: TA0009
Techniques: T1113
Input: Initialization scripts can be used to perform administrative functions, which may often execute other programs or send information to an internal logging server.

Tactics: TA0003, TA0004
Techniques: T1037
Input: In PowerShell, an adversary may make associated changes to user settings using commands similar to Set-ADUser -AllowReversiblePasswordEncryption $true.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.005
Input: Code comparison between the default batch script issued by Poison Frog’s C2 and a batch script received by the Helminth Trojan Webshells The data dump included several different webshells apparently used by OilRig to interact with compromised servers

Tactics: TA0002
Techniques: T1059
Input: Plist files can be saved in text or binary format.

Tactics: TA0005
Techniques: T1647
Input: If a link is being visited by a user, network intrusion prevention systems and systems designed to scan and remove malicious downloads can be used to block activity.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: The email address is associated with the Lebanese domain of a major global financial institution

Tactics: TA0007
Techniques: T1016
Input: ZeroT has retrieved stage 2 payloads as Bitmap images that use Least Significant Bit (LSB) steganography.

Tactics: TA0011
Techniques: T1001, T1001.002
Input: Monitor network traffic for uncommon data flows that may use /techniques/T1078 to log into a computer using the Remote Desktop Protocol (RDP).

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Adversaries may also compromise sites then include malicious content designed to collect website authentication cookies from visitors.

Tactics: TA0043
Techniques: T1589, T1589.001
Input: ADVSTORESHELL is capable of starting a process using CreateProcess.

Tactics: TA0002
Techniques: T1106
Input: Update software regularly to include patches that fix DLL side-loading vulnerabilities.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547.001, T1547
Input: OilRig has used automated collection.

Tactics: TA0009
Techniques: T1119
Input: By default SSSD maintains a copy of the ticket database that can be found in /var/lib/sss/secrets/secrets.ldb as well as the corresponding key located in /var/lib/sss/secrets/.secrets.mkey.

Tactics: TA0006
Techniques: T1558
Input: SilverTerrier uses HTTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: This behavior is typical in enterprise environments so that users do not need to enter credentials to access network resources.

Tactics: TA0006
Techniques: T1187
Input: WellMess can decode and decrypt data received from C2.

Tactics: TA0005
Techniques: T1140
Input: In cloud and/or containerized environments, authenticated user and service account credentials are often stored in local configuration and credential files.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: Brave Prince lists the running processes.

Tactics: TA0007
Techniques: T1057
Input: Lazarus Group has hosted malicious downloads on Github and Dropbox.

Tactics: TA0042
Techniques: T1583.006, T1583
Input: The LSADUMP::ChangeNTLM and LSADUMP::SetNTLM modules can also manipulate the password hash of an account without knowing the clear text value.

Tactics: TA0003
Techniques: T1098
Input: IcedID has packed and encrypted its loader module.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: An adversary may rely upon a user opening a malicious file in order to gain execution.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: BITS tasks are self-contained in the BITS job database, without new files or registry modifications, and often permitted by host firewalls.

Tactics: TA0003, TA0005
Techniques: T1197
Input: Gamaredon Group has also delivered Microsoft Outlook VBA projects with embedded macros.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Crashed or restarted applications or systems may also have other effects such as Data Destruction, Firmware Corruption, Service Stop  which may further cause a DoS condition and deny availability to critical information, applications and/or systems.

Tactics: TA0040
Techniques: T1499, T1499.004
Input: Verify that account credentials that may be used to access deployment systems are unique and not used throughout the enterprise network.

Tactics: TA0002, TA0008
Techniques: T1072
Input: SharpStage  has been used to target Arabic-speaking users and used code that checks if the compromised machine has the Arabic language installed.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: A victim process can be created with native Windows API calls such as CreateProcess, which includes a flag to suspend the processes primary thread.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: SpicyOmelette has been signed with valid digital certificates.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: ComRAT has used a portable FAT16 partition image placed in %TEMP% as a hidden file system.

Tactics: TA0005
Techniques: T1564, T1564.005
Input: Monitor for changes made to files for unexpected modifications to internal and external websites for unplanned content changes.

Tactics: TA0040
Techniques: T1491
Input: In the case of Astaroth trojan, the .lnk file contains an argument into WMIC.exe to run in non-interactive mode, which forgoes opening a window that the victim could notice, to download the hardcoded url in the .lnk

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: PowerShower sets up persistence with a Registry run key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Dyre injects into other processes to load modules.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Service providers have significant access to customer networks, enabling an attacker who had compromised a service provider to move laterally into the network of the service provider’s customer

Tactics: TA0003, TA0004, TA0008
Techniques: T1543.003, T1021, T1543
Input: Misdat is capable of deleting the backdoor file.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Paths to dylibs may be prefixed with @rpath, which allows developers to use relative paths to specify an array of search paths used at runtime based on the location of the executable.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.004, T1574
Input: Backdoor.Pirpi also collects information about the target’s local network, including the domain controller and workstations

Tactics: TA0007
Techniques: T1016
Input: ZLib creates Registry keys to allow itself to run as various services.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: POWERSTATS has the ability to identify the username on the compromised host.

Tactics: TA0007
Techniques: T1033
Input: Pillowmint can uninstall the malicious service from an infected machine.

Tactics: TA0005
Techniques: T1070
Input: Gamaredon Group tools have registered Run keys in the registry to give malicious VBS files persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: During the T9000 installation process, it drops a copy of the legitimate Microsoft binary igfxtray.exe.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: PowerPunch can download payloads from adversary infrastructure.

Tactics: TA0011
Techniques: T1105
Input: APT32's macOS backdoor changes the permission of the file it wants to execute to 755.

Tactics: TA0005
Techniques: T1222.002, T1222
Input: Operating system's name (i.e., the name of the machine) Operating system's OS architecture Operating system's caption Computer system's domain Computer system's username Computer's public IP address

Tactics: TA0007
Techniques: T1082
Input: It has also disabled Windows Defender's Real-Time Monitoring feature and attempted to disable endpoint protection services.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: ThreatNeedle has been distributed via a malicious Word document within a spearphishing email.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Additionally, other applications on the targets machine might store sensitive authentication cookies in memory ( apps which authenticate to cloud services).

Tactics: TA0006
Techniques: T1539
Input: SYSCON has the ability to use FTP in C2 communications.

Tactics: TA0011
Techniques: T1071.002, T1071
Input: Several Lazarus Group malware families use timestomping, including modifying the last write timestamp of a specified Registry key to a random date, as well as copying the timestamp for legitimate .exe files (such as calc.exe or mspaint.exe) to its dropped files.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: Pteranodon schedules tasks to invoke its components in order to establish persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Sibot has been executed via MSHTA application.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: Industroyer’s data wiper module clears registry keys and overwrites both ICS configuration and Windows files.

Tactics: TA0040
Techniques: T1485
Input: Notes: * RID 500 account is the local, built-in administrator.

Tactics: TA0006
Techniques: T1003, T1003.002
Input: This same behavior could be executed using service tickets captured from network traffic.

Tactics: TA0006
Techniques: T1558.003, T1558
Input: Threat Group-3390 malware is also obfuscated using Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.

Tactics: TA0005
Techniques: T1027
Input: Block .scr files from being executed from non-standard locations.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.002
Input: If neither files exist, then only the super user is allowed to run cron.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: Targeting may be specific to a desired victim set or malicious software may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.

Tactics: TA0001
Techniques: T1195
Input: List-view controls are user interface windows used to display collections of items.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.015
Input: Monitor for processes being viewed that may inject malicious code into suspended and hollowed processes in order to evade process-based defenses.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: Protect domain controllers by ensuring proper security configuration for critical servers.

Tactics: TA0003
Techniques: T1136, T1136.002
Input: Pteranodon can use HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: TeamTNT searches for rival malware and removes them if found.

Tactics: TA0007
Techniques: T1057
Input: Data may be kept in separate files or combined into one file through techniques such as Archive Collected Data.

Tactics: TA0009
Techniques: T1074.002, T1074.001, T1074
Input: IcedCoffee is a fairly basic backdoor which uses WMI to collect a variety of system and user information from the system, which is then encoded with base64, encrypted with RC4 and submitted via HTTP POST to the C2 server

Tactics: TA0011
Techniques: T1071
Input: menuPass has used Wevtutil to remove PowerShell execution logs.

Tactics: TA0005
Techniques: T1070, T1070.003
Input: Imminent Monitor has the capability to run a cryptocurrency miner on the victim machine.

Tactics: TA0040
Techniques: T1496
Input: It uses the legitimate Naver email platform in order to communicate with the attackers via email

Tactics: TA0011
Techniques: T1071
Input: RTM has also hidden Pony C2 server IP addresses within transactions on the Bitcoin and Namecoin blockchain.

Tactics: TA0011
Techniques: T1102.001, T1102
Input: FIN8 has used WMI event subscriptions for persistence.

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: HAWKBALL can collect the OS version, architecture information, and computer name.

Tactics: TA0007
Techniques: T1082
Input: Internal web servers are often not configured with the same security controls as public-facing counterparts, making them more vulnerable to exploitation by APT40 and similarly sophisticated groups

Tactics: TA0003
Techniques: T1505.003, T1505
Input: QakBot can capture keystrokes on a compromised host.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: APT32 malware has used rundll32.exe to execute an initial infection process.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: The magic value 0xFEEDFACF that belongs to Mach-O Executable (64 bit) Methods GET_LAUNCHNAME and GET_LABELNAME will return the hardcoded name of the property list “.plist” for the root user (com.apple.screen.assistantd.plist) and for the regular user (com.apple.spell.agent.plist)

Tactics: TA0007
Techniques: T1033
Input: TEMP.Veles has renamed files to look like legitimate files, such as Windows update files or Schneider Electric application files.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Hildegard has established tmate sessions for C2 communications.

Tactics: TA0011
Techniques: T1219
Input: WhisperGate has used InstallUtil.exe as part of its process to disable Windows Defender.

Tactics: TA0005
Techniques: T1218, T1218.004
Input: Symmetric encryption algorithms use the same key for plaintext encryption and ciphertext decryption.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Monitor for Windows API calls that may clear Windows Event Logs to hide the activity of an intrusion.

Tactics: TA0005
Techniques: T1070, T1070.001