madox81/Adema_ATTACK_DS huggingface dataset:
Input: Adversarial may use these commands to make themselves the owner of files and directories or change the mode if current permissions allow it.

Tactics: TA0005
Techniques: T1222.002, T1222
Input: Encryption can be used to protect transmitted network traffic to maintain its confidentiality (protect against unauthorized disclosure) and integrity (protect against unauthorized changes).

Tactics: TA0005
Techniques: T1600
Input: Clop has used built-in API functions such as WNetOpenEnumW(), WNetEnumResourceW(), WNetCloseEnum(), GetProcAddress(), and VirtualAlloc().

Tactics: TA0002
Techniques: T1106
Input: NETEAGLE allows adversaries to enumerate and modify the infected host's file system.

Tactics: TA0007
Techniques: T1083
Input: Threat actors may passively harvest data from these sites, as well as use information gathered to create fake profiles/groups to elicit victim’s into revealing specific information ( Spearphishing Service).

Tactics: TA0043
Techniques: T1593, T1593.001
Input: Nomadic Octopus has used malicious macros to download additional files to the victim's machine.

Tactics: TA0011
Techniques: T1105
Input: Fox Kitten has exploited known vulnerabilities in remote services including RDP.

Tactics: TA0008
Techniques: T1210
Input: Operation Wocao has injected code into a selected process, which in turn launches a command as a child process of the original.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Kinsing has used crontab to download and run shell scripts every minute to ensure persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: File starts as mico-audio.exe and installs to C:\Users\%USERNAME%\AppData\Roaming\google-chrome\crome.exe

Tactics: TA0007
Techniques: T1033
Input: BRONZE BUTLER has exfiltrated files stolen from local systems.

Tactics: TA0009
Techniques: T1005
Input: Password managers are applications designed to store user credentials, normally in an encrypted database.

Tactics: TA0006
Techniques: T1555.005, T1555
Input: With the Trojan moved its final location, it will then create a scheduled task to run a VBScript to make sure it runs persistently

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Monitor network data for uncommon data flows (, a client sending significantly more data than it receives from a server).

Tactics: TA0011
Techniques: T1105
Input: The BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547.001, T1547
Input: Fox Kitten has used WizTree to obtain network files and directory listings.

Tactics: TA0007
Techniques: T1083
Input: Lazarus Group has exploited Adobe Flash vulnerability CVE-2018-4878 for execution.

Tactics: TA0002
Techniques: T1203
Input: Monitor executed commands and arguments that may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable..

Tactics: TA0006
Techniques: T1003, T1003.005
Input: Stealth Falcon malware gathers system information via WMI, including the system directory, build number, serial number, version, manufacturer, model, and total physical memory.

Tactics: TA0007
Techniques: T1082
Input: Monitor for direct access read/write attempts using the \\.\ notation.

Tactics: TA0040
Techniques: T1561
Input: PROMETHIUM has signed code with self-signed certificates.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Clop can search for processes with antivirus and antimalware product names.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Wingbird checks for the presence of Bitdefender security software.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Crutch can persist via DLL search order hijacking on Google Chrome, Mozilla Firefox, or Microsoft OneDrive.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Consider disabling Windows administrative shares.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: OceanSalt can encode data with a NOT operation before sending the data to the control server.

Tactics: TA0011
Techniques: T1132, T1132.002
Input: The URIs used in the HTTP requests are randomly generated

Tactics: TA0011
Techniques: T1071
Input: Monitor newly executed processes that may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

Tactics: TA0003, TA0004
Techniques: T1546.015, T1546
Input: It is installed as an ISAPI filter on Exchange servers and shares characteristics with the China Chopper Web shell.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Periodically baseline snapshots to identify malicious modifications or additions.

Tactics: TA0005, TA0010
Techniques: T1578, T1578.001, T1537
Input: If it is necessary that software must store credentials in the Registry, then ensure the associated accounts have limited permissions so they cannot be abused if obtained by an adversary.

Tactics: TA0006
Techniques: T1552, T1552.002
Input: InvisiMole can collect jpeg files from connected MTP devices.

Tactics: TA0009
Techniques: T1025
Input: PoetRAT has the ability to take screen captures.

Tactics: TA0009
Techniques: T1113
Input: njRAT has used the ShellExecute() function within a script.

Tactics: TA0002
Techniques: T1106
Input: Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket.

Tactics: TA0006
Techniques: T1558
Input: WindTail can be delivered as a compressed, encrypted, and encoded payload.

Tactics: TA0005
Techniques: T1027
Input: When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger (, C:\dbg\ntsd.exe -g  notepad.exe).

Tactics: TA0003, TA0004
Techniques: T1546.012, T1546
Input: InvisiMole can register itself for execution and persistence via the Control Panel.

Tactics: TA0005
Techniques: T1218, T1218.002
Input: StreamEx has the ability to scan for security tools such as firewalls and antivirus tools.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Monitor for unexpected windows registry key being accessed that may search the Registry on compromised systems for insecurely stored credentials.

Tactics: TA0006
Techniques: T1552, T1552.002
Input: InvisiMole has undergone regular technical improvements in an attempt to evade detection.

Tactics: TA0005
Techniques: T1027, T1027.005
Input: This has led it to do more, such as:  Communication with more C&C servers – up to 16 P2P communication between infected nodes MAC address check - PlugX runs if the MAC address of an infected host coincides with configuration information in itself (If not specified in the configuration, PlugX runs on any host)

Tactics: TA0007
Techniques: T1082, T1016
Input: When the Launch Daemon is executed, the program inherits administrative permissions.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: Office365DCOMCheck.ps1 and SystemDiskClean.ps1):       wscript.exe "Office365DCOMCheck.vbs" \"PowerShell.exe  -ExecutionPolicy bypass -WindowStyle hidden -NoProfile '<current PowerShell script>'  \"     After setting up persistent access, the payload checks to see if a value exists within a registry key in the HKCU hive whose name is the same as the scheduled task (ex

Tactics: TA0005, TA0007
Techniques: T1036, T1012
Input: Monitor for the use of PowerShell functions such as Get-DomainGPO and Get-DomainGPOLocalGroup and processes spawning with command-line arguments containing GPOLocalGroup.

Tactics: TA0007
Techniques: T1615
Input: Winnti for Windows can determine if the OS on a compromised host is newer than Windows XP.

Tactics: TA0007
Techniques: T1082
Input: TDTESS has a command to download and execute an additional file.

Tactics: TA0011
Techniques: T1105
Input: Prior to compromising accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation.

Tactics: TA0042
Techniques: T1586
Input: More_eggs has used HTTP GET requests to check internet connectivity.

Tactics: TA0007
Techniques: T1016.001, T1016
Input: Documents with the Flash exploit managed to evade static defenses and remain undetected as an exploit on VirusTotal

Tactics: TA0004
Techniques: T1068
Input: Threat Group-3390 has moved staged encrypted archives to Internet-facing servers that had previously been compromised with China Chopper prior to exfiltration.

Tactics: TA0009
Techniques: T1074.002, T1074
Input: Remote COM execution is facilitated by Remote Services such as  Distributed Component Object Model (DCOM).

Tactics: TA0002
Techniques: T1559, T1559.001
Input: In cloud-based systems, native logging can be used to identify access to certain APIs and dashboards that may contain system information.

Tactics: TA0007
Techniques: T1082
Input: While nuances of each platform’s permissions implementation may vary, most of the platforms provide two primary commands used to manipulate file and directory ACLs: chown (short for change owner), and chmod (short for change mode).

Tactics: TA0005
Techniques: T1222.002, T1222
Input: Javali has been delivered via malicious links embedded in e-mails.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: POWERSTATS can sleep for a given number of seconds.

Tactics: TA0010
Techniques: T1029
Input: It is not used on Linux due to the decentralized nature of the platform.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: NavRAT uses systeminfo on a victim’s machine.

Tactics: TA0007
Techniques: T1082
Input: Sidewinder has sent e-mails with malicious attachments often crafted for specific targets.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Monitor newly executed processes that may disable Windows event logging to limit data that can be leveraged for detections and audits.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: Avaddon looks for and attempts to stop database processes.

Tactics: TA0040
Techniques: T1489
Input: WMI Namespaces    Win32_OperatingSystem    Win32_ComputerSystem    AntiSpywareProduct    AntiVirusProduct    FirewallProduct    Win32_UserAccount    Win32_NetworkAdapter    Win32_Process    Table 1: Referred classes WMI Queries and Registry Keys Used  SELECT Caption FROM Win32_TimeZone SELECT CSNAME, Caption, CSDVersion, Locale, RegisteredUser FROM Win32_OperatingSystem SELECT Manufacturer, Model, SystemType, DomainRole, Domain, UserName FROM Win32_ComputerSystem  Registry entries are read for potential administration escalation and proxy information

Tactics: TA0002, TA0005, TA0007
Techniques: T1047, T1112, T1012
Input: Adversaries may execute their own malicious payloads by hijacking the search order used to load DLLs.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Adversaries can use these libraries to download and execute commands or other scripts as well as perform various malicious behaviors.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: SDBbot has the ability to clean up and remove data structures from a compromised host.

Tactics: TA0005
Techniques: T1070
Input: In addition to downloading free exploits from the internet, adversaries may purchase exploits from third-party entities.

Tactics: TA0042
Techniques: T1588, T1588.005
Input: Kasidet can execute commands using cmd.exe.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Bankshot uses the command-line interface to execute arbitrary commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Machete uses the netsh wlan show networks mode=bssid and netsh wlan show interfaces commands to list all nearby WiFi networks and connected interfaces.

Tactics: TA0007
Techniques: T1049
Input: SILENTTRINITY has a keylogging capability.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Bad Rabbit spread through watering holes on popular sites by injecting JavaScript into the HTML body or a .js file.

Tactics: TA0001
Techniques: T1189
Input: The group has also globally opened port 3389.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: Monitor for unexpected and abnormal accesses to network shares, especially those also associated with file activity.

Tactics: TA0008
Techniques: T1080
Input: LOWBALL abuses the Dropbox cloud storage service for command and control (CnC)

Tactics: TA0011
Techniques: T1102
Input: JPIN can obtain the permissions of the victim user.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: Adversaries in possession credentials to Valid Accounts may be unable to complete the login process if they lack access to the 2FA or MFA mechanisms required as an additional credential and security control.

Tactics: TA0006
Techniques: T1621
Input: Mustang Panda used custom batch scripts to collect files automatically from a targeted system.

Tactics: TA0009
Techniques: T1119
Input: Hydraq creates a backdoor through which remote attackers can adjust token privileges.

Tactics: TA0004, TA0005
Techniques: T1134
Input: Microsoft provides a list of trustworthy root certificates online and through authroot.stl.

Tactics: TA0005
Techniques: T1553, T1553.004
Input: FIN10 has used Meterpreter to enumerate users on remote systems.

Tactics: TA0007
Techniques: T1033
Input: EVILNUM has used the Windows Management Instrumentation (WMI) tool to enumerate infected machines.

Tactics: TA0002
Techniques: T1047
Input: Adversaries may attempt to enumerate software for a variety of reasons, such as figuring out what security measures are present or if the compromised system has a version of software that is vulnerable to Exploitation for Privilege Escalation.

Tactics: TA0007
Techniques: T1518
Input: All messages for the mailbox are forwarded to the specified SMTP address.

Tactics: TA0009
Techniques: T1114, T1114.003
Input: Adversaries may acquire credentials from Keychain.

Tactics: TA0006
Techniques: T1555.001, T1555
Input: Monitor for API calls associated with concealing Registry keys, such as Reghide.

Tactics: TA0005
Techniques: T1112
Input: Adversaries may utilize native support for virtualization (ex: Hyper-V) or drop the necessary files to run a virtual instance (ex: VirtualBox binaries).

Tactics: TA0005
Techniques: T1564, T1564.006
Input: PoetRAT has used HTTP and HTTPs for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Typically these should only be used in specific and limited cases, like for software development.

Tactics: TA0005
Techniques: T1027.004, T1027
Input: Adversaries may leverage information repositories to mine valuable information.

Tactics: TA0009
Techniques: T1213
Input: Clambling has the ability to communicate over HTTP.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: APT32 collected the victim's username and executed the whoami command on the victim's machine.

Tactics: TA0007
Techniques: T1033
Input: Mustang Panda has searched the victim system for the InstallUtil.exe program and its version.

Tactics: TA0007
Techniques: T1518
Input: APT41 used the net share command as part of network reconnaissance.

Tactics: TA0007
Techniques: T1135
Input: Grandoreiro can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.

Tactics: TA0009
Techniques: T1185
Input: Some Lazarus Group malware uses a list of ordered port numbers to choose a port for C2 traffic, creating port-protocol mismatches.

Tactics: TA0011
Techniques: T1571
Input: BBSRAT has been loaded through DLL side-loading of a legitimate Citrix executable that is set to persist through the Registry Run key location HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ssonsvr.exe.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: APT29 staged data and files in password-protected archives on a victim's OWA server.

Tactics: TA0009
Techniques: T1074.002, T1074
Input: Denis also encodes its payload in Base64.

Tactics: TA0005
Techniques: T1027
Input: XCSSET attempts to discover accounts from various locations such as a user's Evernote, AppleID, Telegram, Skype, and WeChat data.

Tactics: TA0007
Techniques: T1087
Input: Upgrade to Windows 8 or later and enable secure boot.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.010
Input: Malicious GPO modifications can be used to implement many other malicious behaviors such as Scheduled Task/Job, Disable or Modify Tools, Ingress Tool Transfer, Create Account, Service Execution,  and more.

Tactics: TA0004, TA0005
Techniques: T1484.001, T1484
Input: WIRTE has obtained and used Empire for post-exploitation activities.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: WellMess has used Base64 encoding to uniquely identify communication to and from the C2.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: MuddyWater has used a custom tool for creating reverse shells.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: APT33 has used password spraying to gain access to target systems.

Tactics: TA0006
Techniques: T1110, T1110.003
Input: Derusbi binds to a raw socket on a random source port between 31800 and 31900 for C2.

Tactics: TA0011
Techniques: T1095
Input: Adversaries may gain execution by inserting malicious dylibs with the name of the missing dylib in the identified path.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.004, T1574
Input: DarkWatchman has created a scheduled task for persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Group123 Links?  As we explore the Korean malware landscape, we always have burning questions relating to any possible links with Group123

Tactics: TA0001
Techniques: T1566, T1566.002
Input: SLOTHFULMEDIA has uploaded files and information from victim machines.

Tactics: TA0009
Techniques: T1005
Input: InvisiMole can capture keystrokes on a compromised host.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: EWM injection is a method of executing arbitrary code in the address space of a separate live process.

Tactics: TA0004, TA0005
Techniques: T1055.011, T1055
Input: Print processors that do not correlate with known good software or patching may be suspicious.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.012
Input: Depending on the permissions level of the vulnerable remote service an adversary may achieve Exploitation for Privilege Escalation as a result of lateral movement exploitation as well.

Tactics: TA0008
Techniques: T1210
Input: GreyEnergy has a module to harvest pressed keystrokes.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: An APT19 HTTP malware variant establishes persistence by setting the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run\Windows Debug Tools-%LOCALAPPDATA%\.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: APT19 launched an HTTP malware variant and a Port 22 malware variant using a legitimate executable that loaded the malicious DLL.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: hxxp://www.sanjosemaristas[.]com/app/index.php?{A01BA0AD-9BB3-4F38-B76B-A00AD11CBAAA}, providing the current network adapter’s service name GUID

Tactics: TA0007
Techniques: T1016
Input: Cuba can check if Russian language is installed on the infected machine by using the function GetKeyboardLayoutList.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: BLINDINGCAN has used AES and XOR to decrypt its DLLs.

Tactics: TA0005
Techniques: T1140
Input: Clambling can send files from a victim's machine to Dropbox.

Tactics: TA0010
Techniques: T1567.002, T1567
Input: OopsIE checks for information on the CPU fan, temperature, mouse, hard disk, and motherboard as part of its anti-VM checks.

Tactics: TA0007
Techniques: T1082
Input: Ensure proper process and file permissions are in place to prevent adversaries from disabling or modifying firewall settings.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: BLUELIGHT can uninstall itself.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Bisonal has used rundll32.exe to execute as part of the Registry Run key it adds: HKEY_CURRENT_USER \Software\Microsoft\Windows\CurrentVersion\Run\"vert" = "rundll32.exe c:\windows\temp\pvcu.dll , Qszdez".

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Empire can upload and download to and from a victim machine.

Tactics: TA0011
Techniques: T1105
Input: PowerShower has the ability to deploy a reconnaissance module to retrieve a list of the active processes.

Tactics: TA0007
Techniques: T1057
Input: Sandworm Team has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Socksbot can list all running processes.

Tactics: TA0007
Techniques: T1057
Input: APT28 has conducted credential phishing campaigns with embedded links to attacker-controlled domains.

Tactics: TA0043
Techniques: T1598, T1598.003
Input: Most embedded network devices provide a command to print the version of the currently running operating system.

Tactics: TA0005
Techniques: T1601
Input: SUNBURST communicated via HTTP GET or HTTP POST requests to third party servers for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: VERMIN can perform audio capture.

Tactics: TA0009
Techniques: T1123
Input: Sakula uses HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Chimera has used RDP to access targeted systems.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Pupy can communicate over HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Successful execution of the macro within the malicious document results in the installation of APT28’s signature GAMEFISH malware

Tactics: TA0002
Techniques: T1204
Input: This may result in multiple layers of encryption (in protocols that are natively encrypted such as HTTPS) or encryption in protocols that not typically encrypted (such as HTTP or FTP).

Tactics: TA0010
Techniques: T1048, T1048.001
Input: Sharpshooter has sent malicious Word OLE documents to victims.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: The attackers used spear phishing emails combined with malicious HWP documents created using Hancom Hangul Office Suite

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Pasam establishes by infecting the Security Accounts Manager (SAM) DLL to load a malicious DLL dropped to disk.

Tactics: TA0003, TA0004
Techniques: T1547.008, T1547
Input: Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols.

Tactics: TA0042
Techniques: T1588, T1588.001
Input: It can be disabled through GPO: Computer Configuration > [Policies] > Administrative Templates > Windows Components > Credential User Interface: E numerate administrator accounts on elevation.

Tactics: TA0007
Techniques: T1087
Input: Attor's dispatcher can establish persistence by registering a new service.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: APT37 has used the command-line interface.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: PipeMon has used a call to LoadLibrary to load its installer.

Tactics: TA0002
Techniques: T1106
Input: Figure 5 Remote template document requesting the user to click “Enable Content” to run macro Clustering The delivery documents used in the October and November waves shared a large number of similarities, as seen in Table 1, which allowed us to cluster the activity together

Tactics: TA0002
Techniques: T1204
Input: Catchamas collects keystrokes from the victim’s machine.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: POORAIM can perform screen capturing.

Tactics: TA0009
Techniques: T1113
Input: Figure 6: Difference between a stock UPX packed file and the modified one A patch for UPX is available on ESET’s malware-research Github repository that allows unpacking Keydnap’s backdoor with the usual upx -d

Tactics: TA0005
Techniques: T1027.002, T1027
Input: TeamTNT has deployed XMRig Docker images to mine cryptocurrency.

Tactics: TA0040
Techniques: T1496
Input: Gather the process time for all processes  Getting time information for all processes running on the system

Tactics: TA0004, TA0005, TA0007
Techniques: T1057, T1124, T1055
Input: ASPXSpy is a Web shell.

Tactics: TA0003
Techniques: T1505.003, T1505