madox81/Adema_ATTACK_DS huggingface dataset:
Input: Monitor for changes made to drive letters or mount points of data storage devices for attempts to read to sensitive locations like the partition boot sector, master boot record, disk partition table, or BIOS parameter block/superblock.

Tactics: TA0040
Techniques: T1561.001, T1561, T1561.002
Input: Monitor for newly executed processes that may execute their own malicious payloads by hijacking the binaries used by services.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.010, T1574
Input: PLEAD has been executed via malicious e-mail attachments.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: 23 Take screenshot, temporarily store it as TPX499.dat, and upload it to the C2

Tactics: TA0009
Techniques: T1113
Input: Responds to the IRC server via PRIVMSG with “Download  Success :FilePath=<path to downloaded file>” or “Download Fail” if unsuccessful

Tactics: TA0011
Techniques: T1105
Input: menuPass has sent malicious Office documents via email as part of spearphishing campaigns as well as executables disguised as documents.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: FatDuke can secure delete its DLL.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: InvisiMole can create hidden system directories.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: GeminiDuke collects information from the victim, including installed drivers, programs previously executed by users, programs and services configured to automatically run at startup, files and folders present in any user's home folder, files and folders present in any user's My Documents, programs installed to the Program Files folder, and recently accessed files, folders, and programs.

Tactics: TA0007
Techniques: T1083
Input: The resulting Interop.SHDocVw .NET assembly is packed with SmartAssembly and further obfuscated using Confuser v1.9.0.0

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Monitor for anomalous access of websites and cloud-based applications by the same user in different locations or by different systems that do not match expected configurations.

Tactics: TA0005, TA0008
Techniques: T1550.004, T1550
Input: Malicious forms will execute when an adversary sends a specifically crafted email to the user.

Tactics: TA0003
Techniques: T1137, T1137.003
Input: APT3 has a tool that can locate credentials in files on the file system such as those from Firefox or Chrome.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: APT38 has used a custom secure delete function to make deleted files unrecoverable.

Tactics: TA0040
Techniques: T1485
Input: Dtrack can save collected data to disk, different file formats, and network shares.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Gold Dragon collects the endpoint victim's username and uses it as a basis for downloading additional components from the C2 server.

Tactics: TA0007
Techniques: T1033
Input: Clambling can register itself as a system service to gain persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: APT41 executed file /bin/pwd in activity exploiting CVE-2019-19781 against Citrix devices.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: Inventory Control Panel items to locate unregistered and potentially malicious files present on systems:* Executable format registered Control Panel items will have a globally unique identifier (GUID) and registration Registry entries in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ControlPanel\NameSpace and HKEY_CLASSES_ROOT\CLSID{GUID}.

Tactics: TA0005
Techniques: T1218, T1218.002
Input: BackdoorDiplomacy has executed DLL search order hijacking.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: For example, adversaries may attempt to brute force access to Valid Accounts within a victim environment leveraging knowledge gathered from other post-compromise behaviors such as OS Credential Dumping, Account Discovery, or Password Policy Discovery.

Tactics: TA0006
Techniques: T1110
Input: This DLL is used to create a scheduled task that points to the QuasarRAT binary, microsoft_network.exe, allowing it to remain persistent after reboot

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Adversaries may also used compressed or archived scripts, such as JavaScript.

Tactics: TA0005
Techniques: T1027
Input: Cobalt Strike can use Python to perform execution.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: The malware accepts up to two arguments at the command line: one to display cleartext credentials for each login session, and a second to display cleartext credentials, NTLM hashes, and malware version for each login session

Tactics: TA0006
Techniques: T1003
Input: Adversaries may leverage cmd to execute various commands and payloads.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Confucius has used a weaponized Microsoft Word document with an embedded RTF exploit.

Tactics: TA0005
Techniques: T1221
Input: A new registry entry is created at HKEY_CURRENT_USERS\Software\Microsoft\Windows\CurrentVersion\Run\Graphics with a value of “C:\ ProgramData \ Initech \Initech.exe” /run.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Adversaries may purchase a subscription to use an existing botnet from a booter/stresser service.

Tactics: TA0042
Techniques: T1583.005, T1583
Input: Doki has downloaded scripts from C2.

Tactics: TA0011
Techniques: T1105
Input: It also collects the system's MAC address with getmac and domain configuration with net config workstation.

Tactics: TA0007
Techniques: T1016
Input: Other checks for debugging artifacts may also seek to enumerate hardware breakpoints, interrupt assembly opcodes, time checks, or measurements if exceptions are raised in the current process (assuming a present debugger would "swallow" or handle the potential error).

Tactics: TA0005, TA0007
Techniques: T1622
Input: Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: WellMess can identify the computer name of a compromised host.

Tactics: TA0007
Techniques: T1082
Input: Ramsay has used base64 to encode its C2 traffic.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Ramsay has base64-encoded its portable executable and hidden itself under a JPG header.

Tactics: TA0005
Techniques: T1027
Input: Neoichor can gather the IP address from an infected host.

Tactics: TA0007
Techniques: T1016
Input: JScript is interpreted via the Windows Script engine and thus integrated with many components of Windows such as the Component Object Model and Internet Explorer HTML Application (HTA) pages.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: It can be used to execute files as a different user, move, and delete files locally, schedule remote AT jobs, perform host discovery on connected networks, scan for open ports on hosts in a connected network, and retrieve information about the OS, users, groups, and shares on remote hosts

Tactics: TA0007
Techniques: T1087, T1046
Input: Socks5 Proxy Zyklon features the ability to establish a reverse Socks5 proxy server on infected host machines

Tactics: TA0007, TA0011
Techniques: T1090, T1016
Input: The Regsvr32.exe binary may also be signed by Microsoft.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: An adversary may enumerate resources using a compromised user's access keys to determine which are available to that user.

Tactics: TA0007
Techniques: T1580
Input: njRAT has added persistence via the Registry key HKCU\Software\Microsoft\CurrentVersion\Run\ and dropped a shortcut in %STARTUP%.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: VB execution is likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: This callback function will call a function named pressedKeyWithKeyCode, which is responsible for logging the keystrokes

Tactics: TA0006, TA0009
Techniques: T1056
Input: Further,  adversaries may leverage Data from Configuration Repository in order to obtain hashed credentials for network devices.

Tactics: TA0006
Techniques: T1110, T1110.002
Input: Information about network topologies may also be exposed to adversaries via online or other accessible data sets (ex: Search Victim-Owned Websites).

Tactics: TA0043
Techniques: T1590, T1590.004
Input: For example, Microsoft’s Office Open XML (OOXML) specification defines an XML-based format for Office documents (.docx, xlsx, .pptx) to replace older binary formats (.doc, .xls, .ppt).

Tactics: TA0005
Techniques: T1221
Input: Siloscape searches for the kubectl binary.

Tactics: TA0007
Techniques: T1518
Input: Monitor for the anomalous creation of scheduled jobs in container orchestration environments.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.007, T1053
Input: Compromised infrastructure can help adversary operations blend in with traffic that is seen as normal, such as contact with high reputation or trusted sites.

Tactics: TA0042
Techniques: T1584
Input: APT32 has used COM scriptlets to download Cobalt Strike beacons.

Tactics: TA0002
Techniques: T1059
Input: Consider modifying host firewall rules to prevent egress traffic from verclsid.exe.

Tactics: TA0005
Techniques: T1218, T1218.012
Input: FruitFly executes and stores obfuscated Perl scripts.

Tactics: TA0005
Techniques: T1027
Input: When installers create subdirectories and files they often do not set appropriate permissions to restrict write access, which allows for execution of untrusted code placed in the subdirectories or overwriting of binaries used in the installation process.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.005, T1574
Input: PlugX has been disguised as legitimate Adobe and PotPlayer files.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: GoldenSpy has included a program "ExeProtector", which monitors for the existence of GoldenSpy on the infected system and redownloads if necessary.

Tactics: TA0007
Techniques: T1083
Input: MuddyWater has used malware that can capture screenshots of the victim’s machine.

Tactics: TA0009
Techniques: T1113
Input: Monitor file read events of web browser files that contain credentials, especially when the reading process is unrelated to the subject web browser.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: OopsIE concatenates then decompresses multiple resources to load an embedded .Net Framework assembly.

Tactics: TA0005
Techniques: T1140
Input: Linfo creates a backdoor through which remote attackers can retrieve a list of running processes.

Tactics: TA0007
Techniques: T1057
Input: Melcoz can monitor the victim's browser for online banking sessions and display an overlay window to manipulate the session in the background.

Tactics: TA0009
Techniques: T1185
Input: Limit the permissions for accounts that are at higher risk of compromise; for example, configure SSH so users can only run specific programs.

Tactics: TA0008
Techniques: T1021
Input: Vulnerability scans typically harvest running software and version numbers via server banners, listening ports, or other network artifacts.

Tactics: TA0043
Techniques: T1595, T1595.002
Input: OSX_OCEANLOTUS.D collects processor information, memory information, computer name, hardware UUID, serial number, and operating system version.

Tactics: TA0007
Techniques: T1082
Input: Chaes has used VBscript to execute malicious code.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Adversaries can setup a position similar to AiTM to prevent traffic from flowing to the appropriate destination, potentially to Impair Defenses and/or in support of a Network Denial of Service.

Tactics: TA0006, TA0009
Techniques: T1557
Input: Through the malicious network configurations, an adversary may achieve the AiTM position, route client traffic through adversary-controlled systems, and collect information from the client network.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.003
Input: Tweets by second account @dookhtegan1 providing a Telegram channel with the leaked files Data Dump Contents The contents of the data dump includes various types of datasets that appear to be results from reconnaissance activity, initial compromises, and tools the OilRig operators use against target organizations

Tactics: TA0006, TA0007, TA0010
Techniques: T1041, T1003, T1018
Input: Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.

Tactics: TA0011
Techniques: T1219
Input: APT30 has relied on users to execute malicious file attachments delivered via spearphishing emails.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Adversaries may undermine security controls that will either warn users of untrusted activity or prevent execution of untrusted programs.

Tactics: TA0005
Techniques: T1553
Input: Adversaries may search public digital certificate data for information about victims that can be used during targeting.

Tactics: TA0043
Techniques: T1596, T1596.003
Input: Monitor for suspicious additions to the /Library/Security/SecurityAgentPlugins directory.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556
Input: Compare recent invocations of Regsvcs.exe and Regasm.exe with prior history of known good arguments and executed binaries to determine anomalous and potentially adversarial activity.

Tactics: TA0005
Techniques: T1218.009, T1218
Input: Adversaries have executed similar procedures for common web browsers such as FireFox, Safari, Edge,  Windows stores Internet Explorer and Microsoft Edge credentials in Credential Lockers managed by the Windows Credential Manager.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system.

Tactics: TA0011
Techniques: T1102
Input: Where possible, only permit execution of signed scripts.

Tactics: TA0002
Techniques: T1059
Input: End users can benefit from security solutions such as Trend Micro Home Security for Mac, which provides comprehensive security and multi-device protection against cyberthreats

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Backdoor.Oldrea can use rundll32 for execution on compromised hosts.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: This kind of targeted campaign is referred to a strategic web compromise or watering hole attack.

Tactics: TA0042
Techniques: T1608.004, T1608
Input: JPIN can obtain the victim user name.

Tactics: TA0007
Techniques: T1033
Input: zwShell has deleted itself after creating a service as well as deleted a temporary file when the system reboots.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Adversaries may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection.

Tactics: TA0010
Techniques: T1020
Input: When selected, all applications currently open are added to a property list file named com.apple.loginwindow.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.007
Input: Monitor executed commands and arguments of executing processes for suspicious words or regular expressions that may indicate searching for a password (for example: password, pwd, login, secure, or credentials).

Tactics: TA0006
Techniques: T1552.001, T1552
Input: Monitor execution and command-line arguments of AppCmd.exe, which may be abused to install malicious IIS modules.

Tactics: TA0003
Techniques: T1505.004, T1505
Input: RogueRobin uses regsvr32.exe to run a .sct file for execution.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: HTTPBrowser is capable of listing files, folders, and drives on a victim.

Tactics: TA0007
Techniques: T1083
Input: The webshell will save the archives locally to the server in the C:\Users\Public\Libraries\Recorded\Files folder, each with a filename with the following structure: [IP address]_c$_Users_[username]__[Desktop-Documents-Downloads]_[year]-[month]-[day]-[hours]-[minutes]-[seconds].7z It is likely that the threat actors use this functionality to rapidly check for new files created by users on the network

Tactics: TA0007
Techniques: T1033
Input: Adversaries may buy and/or steal code signing certificates that can be used during targeting.

Tactics: TA0042
Techniques: T1588, T1588.003
Input: Operating systems may have mechanisms for automatically running a program on system boot or account logon.

Tactics: TA0003, TA0004
Techniques: T1547
Input: Monitor the Registry for changes to the SSP Registry keys.

Tactics: TA0003, TA0004
Techniques: T1547.005, T1547
Input: Dok exfiltrates logs of its execution stored in the /tmp folder over FTP using the curl command.

Tactics: TA0010
Techniques: T1048.003, T1048
Input: Remcos can add itself to the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: SILENTTRINITY can remove files from the compromised host.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: TURNEDUP is capable of downloading additional files.

Tactics: TA0011
Techniques: T1105
Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: External Remote Services or Phishing).

Tactics: TA0043
Techniques: T1593
Input: FrameworkPOS can use DNS tunneling for exfiltration of credit card data.

Tactics: TA0010
Techniques: T1048
Input: Monitor Registry keys within HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: Monitor for API calls (such as IsDebuggerPresent()) that may employ various means to detect and avoid debugged environments.

Tactics: TA0005, TA0007
Techniques: T1622
Input: This execution would take place anytime netsh.exe is executed, which could happen automatically, with another persistence technique, or if other software (ex: VPN) is present on the system that executes netsh.exe as part of its normal functionality.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.007
Input: Meteor can run set.bat, update.bat, cache.bat, bcd.bat, msrun.bat, and similar scripts.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Figure 1: Configuration file that adds new C2 server and forces the data-stealing backdoor to use it   Figure 2: Configuration file that adds TCP tunnels and records desktop video Command and Control CARBANAK communicates to its C2 servers via pseudo-HTTP or a custom binary protocol

Tactics: TA0011
Techniques: T1071
Input: Octopus can collect information on the Windows directory and searches for compressed RAR files on the host.

Tactics: TA0007
Techniques: T1083
Input: For example, an adversary may copy source code for the client software, add a backdoor, compile for the target, and replace the legitimate application binary (or support files) with the backdoored one.

Tactics: TA0003
Techniques: T1554
Input: A variety of features have been discovered in Outlook that can be abused to obtain persistence, such as Outlook rules, forms, and Home Page.

Tactics: TA0003
Techniques: T1137
Input: If msxsl.exe is unnecessary, then block its execution to prevent abuse by adversaries.

Tactics: TA0005
Techniques: T1220
Input: Deny execution from user directories such as file download directories and temp directories where able.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.010, T1574
Input: They may do this, for example, by retrieving account usernames or by using OS Credential Dumping.

Tactics: TA0007
Techniques: T1033
Input: This hidden information can be used for command and control of compromised systems.

Tactics: TA0011
Techniques: T1001, T1001.002
Input: Empire has a dylib hijacker module that generates a malicious dylib given the path to a legitimate dylib of a vulnerable application.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.004, T1574
Input: Carbanak performs desktop video recording and captures screenshots of the desktop and sends it to the C2 server.

Tactics: TA0009
Techniques: T1113
Input: While logged in, this command history is tracked in a file pointed to by the environment variable HISTFILE.

Tactics: TA0005
Techniques: T1070, T1070.003
Input: Information about host firmware may only be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices).

Tactics: TA0043
Techniques: T1592, T1592.003
Input: Batch files (ex: .bat or .cmd) also provide the shell with a list of sequential commands to run, as well as normal scripting operations such as conditionals and loops.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Fox Kitten has base64 encoded scripts and payloads to avoid detection.

Tactics: TA0005
Techniques: T1027
Input: Figure 4: APT32 ActiveMime Lures Create Two Named Scheduled Tasks In this example, a scheduled task named “Windows Scheduled Maintenance” was created to run Casey Smith’s “Squiblydoo” App Whitelisting bypass every 30 minutes

Tactics: TA0002, TA0003, TA0004, TA0005
Techniques: T1053.005, T1053, T1036
Input: SodaMaster can use RC4 to encrypt C2 communications.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: WSD Port

Tactics: TA0003, TA0004
Techniques: T1547, T1547.010
Input: QuasarRAT can obtain passwords from FTP clients.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: Ensure that proper permissions and directory access control are set to deny users the ability to write files to the top-level directory C: and system directories, such as C:\Windows\, to reduce places where malicious files could be placed for execution.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.007, T1574.008, T1574.009, T1574
Input: Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: APT29 leveraged privileged accounts to replicate directory service data with domain controllers.

Tactics: TA0006
Techniques: T1003.006, T1003
Input: Monitor executed commands and arguments to collect data stored in the clipboard from users copying information within or between applications.

Tactics: TA0009
Techniques: T1115
Input: Goopy has the ability to  enumerate the infected system's user name via GetUserNameW.

Tactics: TA0002
Techniques: T1106
Input: Note: The above hijacks are also possible without modifying the Registry via DLL Search Order Hijacking.

Tactics: TA0005
Techniques: T1553, T1553.003
Input: GLOOXMAIL communicates to servers operated by Google using the Jabber/XMPP protocol.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: The modification includes a specific password which is implanted in the operating system image via the patch.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.004
Input: To change the operating system, the adversary typically only needs to affect this one file, replacing or modifying it.

Tactics: TA0005
Techniques: T1601
Input: Kessel can create a reverse shell between the infected host and a specified system.

Tactics: TA0002
Techniques: T1059
Input: Rifdoor has been distributed in e-mails with malicious Excel or Word documents.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Many of the commands used to modify ACLs and file/directory ownership are built-in system utilities and may generate a high false positive alert rate, so compare against baseline knowledge for how systems are typically used and correlate modification events with other indications of malicious activity where possible.

Tactics: TA0005
Techniques: T1222.002, T1222
Input: jRAT collects information about the OS (version, build type, install date) as well as system up-time upon receiving a connection from a backdoor.

Tactics: TA0007
Techniques: T1082
Input: Sandworm Team has used a script to attempt RPC authentication against a number of hosts.

Tactics: TA0006
Techniques: T1110, T1110.003