madox81/Adema_ATTACK_DS huggingface dataset:
Input: Figure 1 Side-by-side of the lure images within ThreeDollars in the October 2017 and the January 2018 attacks   Superficially, we can immediately see the images are quite similar, but with some glaring differences

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: Xbash can download additional malicious files from its C2 server.

Tactics: TA0011
Techniques: T1105
Input: Also, monitor modifications of files such as renaming programs using Windows system utilities names.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.008, T1574
Input: Fox Kitten has brute forced RDP credentials.

Tactics: TA0006
Techniques: T1110
Input: Kazuar finds a specified directory, lists the files and metadata about those files.

Tactics: TA0007
Techniques: T1083
Input: Information obtained could be used to gain an understanding of common software/applications running on systems within the network.

Tactics: TA0007
Techniques: T1057
Input: The structure of the domain mimics the Mercator Institute for China Studies (MERICS), whose actual domain is merics.org

Tactics: TA0007
Techniques: T1016
Input: Adversaries can create accounts that can be used to build a persona to further operations.

Tactics: TA0042
Techniques: T1585
Input: Ensure proper permissions are set for Registry hives to prevent users from modifying keys related to SIP and trust provider components.

Tactics: TA0005
Techniques: T1553
Input: An adversary may achieve the same goal by modifying or extending features of the kernel.

Tactics: TA0003, TA0004
Techniques: T1547
Input: FIN6 has removed files from victim machines.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Consider enabling Registry Auditing on specific keys to produce an alertable event (Event ID 4657) whenever a value is changed (though this may not trigger when values are created with Reghide or other evasive methods).

Tactics: TA0005
Techniques: T1112
Input: We have covered recent FIN7 activity in previous public blog posts:   FIN7 Spear Phishing Campaign Targets Personnel Involved in SEC Filings  FIN7 Evolution and the Phishing LNK  To SDB, Or Not To SDB: FIN7 Leveraging Shim Databases for Persistence  The FireEye iSIGHT Intelligence MySIGHT Portal contains additional information on our investigations and observations into FIN7 activity

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Bundlore uses the curl -s -L -o command to exfiltrate archived data to a URL.

Tactics: TA0010
Techniques: T1048
Input: Monitor for unexpected and abnormal accesses to network shares.

Tactics: TA0009
Techniques: T1039
Input: PLEAD has the ability to upload and download files to and from an infected host.

Tactics: TA0011
Techniques: T1105
Input: Monitor for newly constructed files in common folders on the computer system.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: Another approach is to use deep learning to classify domains as DGA-generated]

Tactics: TA0011
Techniques: T1568, T1568.002
Input: User Unix Shells execute several configuration scripts at different points throughout the session based on events.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: APT38 has used Task Scheduler to run programs at system startup or on a scheduled basis for persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Hydraq uses svchost.exe to execute a malicious DLL included in a new service group.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).

Tactics: TA0002
Techniques: T1047
Input: The net start command can be used in Net to find information about Windows services.

Tactics: TA0007
Techniques: T1007
Input: Disable Office VBA macros from executing.

Tactics: TA0003
Techniques: T1137, T1137.001
Input: APT39 has used malware disguised as Mozilla Firefox and a tool named mfevtpse.exe to proxy C2 communications, closely mimicking a legitimate McAfee file mfevtps.exe.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Proton removes logs from /var/logs and /Library/logs.

Tactics: TA0005
Techniques: T1070, T1070.002
Input: On Linux and macOS, command history is tracked in a file pointed to by the environment variable HISTFILE.

Tactics: TA0005
Techniques: T1562.003, T1562
Input: SUNBURST remained dormant after initial access for a period of up to two weeks.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Monitor for newly executed processes that execute from removable media after it is mounted or when initiated by a user.

Tactics: TA0001, TA0008
Techniques: T1091
Input: Elise configures itself as a service.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Msxsl.exe takes two main arguments, an XML source file and an XSL stylesheet.

Tactics: TA0005
Techniques: T1220
Input: Shamoon accesses network share(s), enables share access to the target device, copies an executable payload to the target system, and uses a Scheduled Task/Job to execute the malware.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Aria-body has the ability to decrypt the loader configuration and payload DLL.

Tactics: TA0005
Techniques: T1140
Input: FoggyWeb has been XOR-encoded.

Tactics: TA0005
Techniques: T1027
Input: Adversaries may alter data en route to storage or other systems in order to manipulate external outcomes or hide activity, thus threatening the integrity of the data.

Tactics: TA0040
Techniques: T1565, T1565.002
Input: A FinFisher variant uses a custom packer.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: TRITON was run as trilog.exe, a Py2EXE compiled python script that accepts a single IP address as a flag.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Processes running with root privileges can use this facility to scrape live memory of other running programs.

Tactics: TA0006
Techniques: T1003, T1003.007
Input: Adversaries may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.

Tactics: TA0005, TA0008
Techniques: T1550
Input: Delivery TG-3390 conducts SWCs or sends spearphishing emails with ZIP archive attachments

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Adversaries may also try brute forcing via Password Guessing to obtain the master password of a password manager.

Tactics: TA0006
Techniques: T1555.005, T1555
Input: SpicyOmelette has been distributed via emails containing a malicious link that appears to be a PDF document.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: In cloud environments, adversaries may stage data within a particular instance or virtual machine before exfiltration.

Tactics: TA0009
Techniques: T1074.002, T1074
Input: On Windows 8.1 and Server 2012 R2, enable LSA Protection by setting the Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL to dword:00000001.

Tactics: TA0003, TA0004
Techniques: T1547.008, T1547
Input: Mustang Panda has searched the entire target system for DOC, DOCX, PPT, PPTX, XLS, XLSX, and PDF files.

Tactics: TA0007
Techniques: T1083
Input: Adversaries may abuse Unix shells to execute various commands or payloads.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: Verifies that there is no process with the name “rsyncd” on the active process list (“dbus-inotifier” if the Trojan does not have root privileges)

Tactics: TA0007
Techniques: T1057
Input: For containing the impact of a previously forged SAML token, rotate the token-signing AD FS certificate in rapid succession twice, which will invalidate any tokens generated using the previous certificate.

Tactics: TA0006
Techniques: T1606, T1606.002
Input: Chrommme can enumerate the IP address of a compromised host.

Tactics: TA0007
Techniques: T1016
Input: Examples of built-in Command and Scripting Interpreter functions include del on Windows and rm or unlink on Linux and macOS.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: USBferry can detect the victim's file or folder list.

Tactics: TA0007
Techniques: T1083
Input: Monitor newly executed processes that may search compromised systems to find and obtain insecurely stored credentials.

Tactics: TA0006
Techniques: T1552
Input: Seasalt has a command to perform a process listing.

Tactics: TA0007
Techniques: T1057
Input: The default file types copied would include data copied to the drive by SPACESHIP.

Tactics: TA0009
Techniques: T1025
Input: With SYN floods, excessive amounts of SYN packets are sent, but the 3-way TCP handshake is never completed.

Tactics: TA0040
Techniques: T1499, T1499.001
Input: BabyShark has the ability to decode downloaded files prior to execution.

Tactics: TA0005
Techniques: T1140
Input: Indirect Code Execution Through INF and SCT This scriptlet code execution technique leveraging INF and SCT files was recently discovered and documented in February 2018

Tactics: TA0002, TA0005
Techniques: T1140, T1059
Input: USBferry can execute rundll32.exe in memory to avoid detection.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: For example, an adversary may abuse these mechanisms to modify HTTP responses in order to distribute malicious commands/content to previously comprised hosts.

Tactics: TA0003
Techniques: T1505.004, T1505
Input: Collect events related to Registry key creation for keys that could be used for Office-based persistence.

Tactics: TA0003
Techniques: T1137.002, T1137, T1137.001
Input: Monitor for indications of Pass the Ticket being used to move laterally.

Tactics: TA0006
Techniques: T1558, T1558.001
Input: Windows event logs may also designate activity associated with a shutdown/reboot,  Event ID 1074 and 6006.

Tactics: TA0040
Techniques: T1529
Input: Maze has used several Windows API functions throughout the encryption process including IsDebuggerPresent, TerminateProcess, Process32FirstW, among others.

Tactics: TA0002
Techniques: T1106
Input: Chimera has used PowerShell scripts to execute malicious payloads and the DSInternals PowerShell module to make use of Active Directory features.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.

Tactics: TA0006
Techniques: T1552.001, T1552, T1003, T1003.004, T1555.003, T1555, T1003.005
Input: Empire includes various modules to attempt to bypass UAC for escalation of privileges.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Adversaries disable a network device’s dedicated hardware encryption, which may enable them to leverage weaknesses in software encryption in order to reduce the effort involved in collecting, manipulating, and exfiltrating transmitted data.

Tactics: TA0005
Techniques: T1600, T1600.002
Input: APT32 has cleared select event log entries.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: Dragonfly has collected open source information to identify relationships between organizations for targeting purposes.

Tactics: TA0043
Techniques: T1591.002, T1591
Input: Similarly, adversaries may modify existing services, daemons, or agents to achieve the same effect.

Tactics: TA0003, TA0004
Techniques: T1543
Input: GALLIUM used reg commands to dump specific hives from the Windows Registry, such as the SAM hive, and obtain password hashes.

Tactics: TA0006
Techniques: T1003, T1003.002
Input: Many benign tasks and services exist that have commonly associated names.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Credentials are typically accessible after a user provides a master password that unlocks the database.

Tactics: TA0006
Techniques: T1555.005, T1555
Input: Octopus has compressed data before exfiltrating it using a tool called Abbrevia.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Once enumerated, the target processes’ memory map within /proc/[pid]/maps can be overwritten using dd.

Tactics: TA0004, TA0005
Techniques: T1055.009, T1055
Input: Monitor for unexpected file access on removable media

Tactics: TA0011
Techniques: T1092
Input: Low confidence generally means that the information's credibility and/or plausibility is questionable, or that the information is too fragmented or poorly corroborated to make solid analytic inferences, or that [there are] significant concerns or problems with the sources

Tactics: TA0007
Techniques: T1082
Input: In Kubernetes environments, consider defining a Pod Security Policy that limits container access to host process namespaces, the host network, and the host file system.

Tactics: TA0004
Techniques: T1611
Input: WellMess can send files from the victim machine to C2.

Tactics: TA0009
Techniques: T1005
Input: This targeting of third party organizations to attack further targets is a risky move on the attackers’ part, as it potentially reveals their activity within the compromised third party organizations to the new target (those receiving the malicious documents  Making sense of MuddyWater When we looked at the cluster of activity which consisted of what appeared to be espionage-focused attacks in the Middle East, we were somewhat confused as the previous public reporting had attributed these attacks to FIN7

Tactics: TA0001
Techniques: T1189
Input: Adversaries may modify Mach-O binary headers to load and execute malicious dylibs every time the binary is executed.

Tactics: TA0003, TA0004
Techniques: T1546.006, T1546
Input: Magic Hound has compromised personal email accounts through the use of legitimate credentials and gathered additional victim information.

Tactics: TA0042
Techniques: T1586.002, T1586
Input: Leafminer infected victims using JavaScript code.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Bundlore uses HTTP requests for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Enforce the principle of least-privilege.

Tactics: TA0005, TA0008, TA0009
Techniques: T1213, T1213.003, T1213.002, T1550
Input: SpicyOmelette can download malicious files from threat actor controlled AWS URL's.

Tactics: TA0011
Techniques: T1105
Input: A closer examination revealed the obfuscation used by the OilRig group in these QUADAGENT samples were likely the result of using an open-source toolkit called Invoke-Obfuscation

Tactics: TA0005
Techniques: T1027
Input: Remcos searches for Sandboxie and VMware on the system.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Collect and analyze signing certificate metadata and check signature validity on software that executes within the environment

Tactics: TA0003
Techniques: T1554
Input: ThiefQuest uses various API functions such as NSCreateObjectFileImageFromMemory to load and link in-memory payloads.

Tactics: TA0005
Techniques: T1620
Input: Cobalt Group has used the command cmstp.exe /s /ns C:\Users\ADMINI~W\AppData\Local\Temp\XKNqbpzl.txt to bypass AppLocker and launch a malicious script.

Tactics: TA0005
Techniques: T1218, T1218.003
Input: APT28 has saved files with hidden file attributes.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: PipeMon modules are stored on disk with seemingly benign names including use of a file extension associated with a popular word processor.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: ( plaintext credentials in code, published credentials in repositories, or credentials in public cloud storage).

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: SideTwist can collect the username on a targeted system.

Tactics: TA0007
Techniques: T1033
Input: PUNCHBUGGY has used PowerShell to decode base64-encoded assembly.

Tactics: TA0005
Techniques: T1140
Input: Ursnif has used process hollowing to inject into child processes.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: Interactive command shells may be in use, and common functionality within cmd may be used to gather information.

Tactics: TA0009
Techniques: T1025, T1039
Input: Orz has used Technet and Pastebin web pages for command and control.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: Rover searches for files on local drives based on a predefined list of file extensions.

Tactics: TA0009
Techniques: T1005
Input: HAFNIUM has collected e-mail addresses for users they intended to target.

Tactics: TA0043
Techniques: T1589.002, T1589
Input: Duqu is capable of loading executable code via process hollowing.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access (ex: Phishing).

Tactics: TA0042
Techniques: T1586.002, T1585, T1585.002, T1586
Input: Adversaries may search compromised systems to find and obtain insecurely stored credentials.

Tactics: TA0006
Techniques: T1552
Input: IFEOs can also enable an arbitrary monitor program to be launched when a specified program silently exits ( is prematurely terminated by itself or a second, non kernel-mode process).

Tactics: TA0003, TA0004
Techniques: T1546.012, T1546
Input: So this method uses psexec itself to copy the payload over the network, overwrite earlier versions (if found), and run it without waiting for any response. They use batch files that leverage psexec , again, to push PowerShell loader scripts out to machines the network scanner finds on the internal network.

Tactics: TA0002
Techniques: T1059
Input: Adversaries may gather information about the victim's identity that can be used during targeting.

Tactics: TA0043
Techniques: T1589
Input: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

Tactics: TA0007
Techniques: T1083
Input: Adversaries may inject malicious code into processes via the /proc filesystem in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055.009, T1055
Input: (Source: Dell SecureWorks)   The following tools appear to be exclusive to TG-3390:  OwaAuth web shell — A web shell and credential stealer deployed to Microsoft Exchange servers

Tactics: TA0002, TA0003
Techniques: T1505.003, T1505, T1059
Input: Grandoreiro has been spread via malicious links embedded in e-mails.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: It exploits CVE-2017-0199 to download the second stage payload from 193.23.181.151 (Figure 3)

Tactics: TA0011
Techniques: T1105
Input: Monitor for API calls that may employ various means to detect and avoid virtualization and analysis environments.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001, T1497.002
Input: Trickbot uses this encrypted module to scan the network and steal relevant network information.

Tactics: TA0007
Techniques: T1016
Input: Monitor executed commands and arguments for actions that would delete Windows event logs (via PowerShell)

Tactics: TA0005
Techniques: T1070, T1070.001
Input: An example commonly-used sequence is Microsoft's Authorization Code Grant flow.

Tactics: TA0006
Techniques: T1528
Input: FIN8 has used HTTPS for command and control.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: The Windows Control Panel process binary (control.exe) handles execution of Control Panel items, which are utilities that allow users to view and adjust computer settings.

Tactics: TA0005
Techniques: T1218, T1218.002
Input: Bonadan can download an additional module which has a cryptocurrency mining extension.

Tactics: TA0040
Techniques: T1496
Input: Embedded Trojan This Trojan loaded by the first payload contains several embedded executables that it uses to ultimately download and execute a secondary payload, as well as downloading and opening a decoy document

Tactics: TA0005
Techniques: T1027
Input: Adversaries can use this to register code to be executed when the shell encounters specific interrupts as a persistence mechanism.

Tactics: TA0003, TA0004
Techniques: T1546.005, T1546
Input: Monitor for newly constructed WMI Objects that may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events.

Tactics: TA0003, TA0004
Techniques: T1546
Input: Revenge RAT uses the Forfiles utility to execute commands on the system.

Tactics: TA0005
Techniques: T1202
Input: Nebulae can enumerate processes on a target system.

Tactics: TA0007
Techniques: T1057
Input: This Registry key is not created by default during an Office installation.

Tactics: TA0003
Techniques: T1137.002, T1137
Input: One version of Helminth uses batch scripting.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Inception has incorporated at least five different cloud service providers into their C2 infrastructure including CloudMe.

Tactics: TA0011
Techniques: T1102
Input: Fox Kitten has named the task for a reverse proxy lpupdate to appear legitimate.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Azorult can check for installed software on the system under the Registry key Software\Microsoft\Windows\CurrentVersion\Uninstall.

Tactics: TA0007
Techniques: T1012
Input: Carberp has collected the operating system version from the infected system.

Tactics: TA0007
Techniques: T1082
Input: QakBot can identify the user name on a compromised system.

Tactics: TA0007
Techniques: T1033
Input: HyperStack can use Windows API's ConnectNamedPipe and WNetAddConnection2 to detect incoming connections and connect to remote shares.

Tactics: TA0002
Techniques: T1106
Input: H1N1 kills and disables services for Windows Firewall.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: netsh can be used to discover system firewall settings.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Commonly targeted services include the following:

Tactics: TA0006
Techniques: T1110.004, T1110, T1110.001, T1110.003
Input: Smoke Loader recursively searches through directories for files.

Tactics: TA0007
Techniques: T1083
Input: Adversaries may abuse task scheduling functionality provided by container orchestration tools such as Kubernetes to schedule deployment of containers configured to execute malicious code.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.007, T1053
Input: Fox Kitten has used Angry IP Scanner to detect remote systems.

Tactics: TA0007
Techniques: T1018
Input: Protocols such as SMTP/S, POP3/S, and IMAP that carry electronic mail may be very common in environments.

Tactics: TA0011
Techniques: T1071, T1071.003
Input: Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.

Tactics: TA0003
Techniques: T1136, T1136.002, T1098.002, T1098
Input: APT41 used a malware variant called WIDETONE to conduct port scans on specified subnets.

Tactics: TA0007
Techniques: T1046
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may abuse Microsoft Outlook rules to obtain persistence on a compromised system.

Tactics: TA0003
Techniques: T1137, T1137.005
Input: RainyDay can create and register a service for execution.

Tactics: TA0007
Techniques: T1007
Input: Carbon uses the net view command.

Tactics: TA0007
Techniques: T1018
Input: Olympic Destroyer contains a module that tries to obtain stored credentials from web browsers.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Transparent Tribe has compromised domains for use in targeted malicious campaigns.

Tactics: TA0042
Techniques: T1584.001, T1584
Input: Monitor for newly executed processes that may abuse AppleScript for execution.

Tactics: TA0002
Techniques: T1059.002, T1059
Input: Adversaries may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Password guessing may or may not take into account the target's policies on password complexity or use policies that may lock accounts out after a number of failed attempts.

Tactics: TA0006
Techniques: T1110, T1110.001
Input: Molerats has used forged Microsoft code-signing certificates on malware.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Chimera has used net user for account discovery.

Tactics: TA0007
Techniques: T1087, T1087.001