madox81/Adema_ATTACK_DS huggingface dataset:
Input: Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes.

Tactics: TA0006
Techniques: T1555.001, T1555
Input: JPIN can download files and upgrade itself.

Tactics: TA0011
Techniques: T1105
Input: Disable the RDP service if it is unnecessary.

Tactics: TA0008
Techniques: T1563.002, T1021.001, T1021, T1563
Input: HARDRAIN uses cmd.exe to execute netshcommands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Deletes the registry key HKCU\Software\Classes\Applications\rundll32.exe\shell\open Deletes the dropper components from the system

Tactics: TA0005
Techniques: T1070, T1112, T1070.004
Input: An adversary may compress or encrypt data that is collected prior to exfiltration using a custom method.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: One persistence mechanism used by CozyCar is to set itself to be executed at system startup by adding a Registry value under one of the following Registry keys: HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: MarkiRAT can capture screenshots that are initially saved as ‘scr.jpg’.

Tactics: TA0009
Techniques: T1113
Input: ZxShell has a command to clear system event logs.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: The main module of the Trojan can execute the following commands:  CommandDescription 0x1FSet the dwell time value for the standby mode 0x29Activate the controllers 0x2ASet new configuration data and update the list of command and control servers 0x32Set the dwell time value for the active mode 0x33Set up the plug-in 0x33Save the dwell time values into the database 0x34Activate the plug-ins 0x35Add configuration data 0x36Delete the specified configuration data  The Remote Shell Module can execute the following commands:  CommandDescription 0x66Exit 0x65Open a remote Shell 0x68Verify that the Shell in running 0x67Execute a command  The module, which interacts with the file system, can execute the following commands:  cmdDescription 0x65Find the file(s) 0x66Read the file(s) 0x67Save the file 0x68Remove the file(s) 0x69Run the file(s)  A report on the operations’ execution by this module is displayed as the HTML code

Tactics: TA0002, TA0005
Techniques: T1140, T1070, T1070.006, T1059
Input: It contains functionality to acquire information about credentials in many ways, including from DCSync/NetSync.

Tactics: TA0006
Techniques: T1003.006, T1003
Input: As of macOS Sierra, the sudoers file has tty_tickets enabled by default.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: The loader will then inject a DLL backdoor into dllhost.exe

Tactics: TA0004, TA0005
Techniques: T1055
Input: While use of Virtualization/Sandbox Evasion may involve checking for known sandbox values and continuing with execution only if there is no match, the use of environmental keying will involve checking for an expected target-specific value that must match for decryption and subsequent execution to be successful.

Tactics: TA0005
Techniques: T1480, T1480.001
Input: Monitor executed commands and arguments that may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms.

Tactics: TA0005
Techniques: T1562
Input: HOPLIGHT has multiple C2 channels in place in case one fails.

Tactics: TA0011
Techniques: T1008
Input: DRATzarus can use HTTP or HTTPS for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Threat Group-3390 has embedded malicious code into websites to screen a potential victim's IP address and then exploit their browser if they are of interest.

Tactics: TA0042
Techniques: T1608.004, T1608
Input: Silence has used scheduled tasks to stage its operation.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: hcdLoader installs itself as a service for persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: The Windows utility Nltest is known to be used by adversaries to enumerate domain trusts.

Tactics: TA0007
Techniques: T1482
Input: Ryuk can create .dll files that actually contain a Rich Text File format document.

Tactics: TA0005
Techniques: T1036
Input: With a sufficient level of access, the net user /add /domain command can be used to create a domain account.

Tactics: TA0003
Techniques: T1136, T1136.002
Input: PowerShower has the ability to identify the current Windows domain of the infected host.

Tactics: TA0007
Techniques: T1016
Input: Monitor for newly executed processes that may use Valid Accounts to interact with remote systems using Windows Remote Management (WinRM), as well as service processes such as wmiprvse.exe on destination hosts.

Tactics: TA0008
Techniques: T1021, T1021.006
Input: File monitoring may be used to detect changes to files in the Web directory of a Web server that do not match with updates to the Web server's content and may indicate implantation of a Web shell script.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Fysbis has installed itself as an autostart entry under ~/.config/autostart/dbus-inotifier.desktop to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.013, T1547
Input: Gold Dragon collects endpoint information using the systeminfo command.

Tactics: TA0007
Techniques: T1082
Input: This, however, will not delete/flush the ConsoleHost_history.txt file.

Tactics: TA0005
Techniques: T1070, T1070.003
Input: Anchor has used cmd.exe to run its self deletion routine.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: ROADTools can enumerate Azure AD groups.

Tactics: TA0007
Techniques: T1069, T1069.003
Input: Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate some obfuscation activity at the network level.

Tactics: TA0011
Techniques: T1001.001, T1001, T1001.003, T1001.002
Input: With sufficient permissions, there are a variety of ways to add credentials including the Azure Portal, Azure command line interface, and Azure or Az PowerShell modules.

Tactics: TA0003
Techniques: T1098.001, T1098
Input: Revenge RAT has a plugin for credential harvesting.

Tactics: TA0006
Techniques: T1003
Input: Industroyer’s data wiper component enumerates specific files on all the Windows drives.

Tactics: TA0007
Techniques: T1083
Input: On Linux, adversaries may set LD_PRELOAD to point to malicious libraries that match the name of legitimate libraries which are requested by a victim program, causing the operating system to load the adversary's malicious code upon execution of the victim program.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.006, T1574
Input: SombRAT has the ability to download and execute additional payloads.

Tactics: TA0011
Techniques: T1105
Input: Once adversaries have provisioned a server (ex: for use as a command and control server), internet scans may reveal servers that adversaries have acquired.

Tactics: TA0042
Techniques: T1583.004, T1583
Input: APT41 used a keylogger called GEARSHIFT on a target system.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Monitor for the loading of modules associated with VB languages (ex: vbscript.dll).

Tactics: TA0002
Techniques: T1059.005, T1059
Input: If this object is not found, the macro will exit without downloading additional payloads.

Tactics: TA0005, TA0007
Techniques: T1497
Input: menuPass has used Ntdsutil to dump credentials.

Tactics: TA0006
Techniques: T1003.003, T1003
Input: Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Collection and Exfiltration, based on the information obtained.

Tactics: TA0007
Techniques: T1619, T1580
Input: Typically, a user is notified when someone else is trying to steal their session.

Tactics: TA0008
Techniques: T1563.002, T1563
Input: Seasalt has a command to download additional files.

Tactics: TA0011
Techniques: T1105
Input: OilRig has sent spearphising emails with malicious links to potential victims.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Adversaries may also change the location of the base template to point to their own by hijacking the application's search order,  Word 2016 will first look for Normal.dotm under C:\Program Files (x86)\Microsoft Office\root\Office16\, or by modifying the GlobalDotName registry key.

Tactics: TA0003
Techniques: T1137, T1137.001
Input: Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.

Tactics: TA0009
Techniques: T1560
Input: YAHOYAH checks for the system’s Windows OS version and hostname.

Tactics: TA0007
Techniques: T1082
Input: Turla has abused local accounts that have the same password across the victim’s network.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.003
Input: Destroy Evidence: Securely deleted logs, as well as deployed and executed disk-wiping malware, to cover tracks and disrupt forensic analysis

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Examples for both Word and Excel have been discovered and published.

Tactics: TA0003
Techniques: T1137, T1137.001
Input: Adversaries may use the results and responses from these requests to determine if the system is capable of communicating with their C2 servers before attempting to connect to them.

Tactics: TA0007
Techniques: T1016.001, T1016
Input: BADFLICK has delayed communication to the actor-controlled IP address by 5 minutes.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Versions of OSX/Shlayer pass encrypted and password-protected code to openssl and then write the payload to the /tmp folder.

Tactics: TA0005
Techniques: T1140
Input: down_new has the ability to AES encrypt C2 communications.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: StrongPity has created new services and modified existing services for persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: FakeM contains a keylogger module.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: ROKRAT has the ability to gather a list of files and directories on the infected system.

Tactics: TA0007
Techniques: T1083
Input: boom! Deletes GID.bin, ShwDoc.VBS and ShwDoc.srv files, as well as the scheduled task whose name a GUID stored in the GID.bin file

Tactics: TA0005
Techniques: T1070, T1070.004
Input: QuietSieve can collect files from a compromised host.

Tactics: TA0009
Techniques: T1005
Input: The System Keychain stores items accessed by the operating system, such as items shared among users on a host.

Tactics: TA0006
Techniques: T1555.001, T1555
Input: APT32 has used the WindowStyle parameter to conceal PowerShell windows.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Monitor for any influxes or abnormal increases in DCOM related Distributed Computing Environment/Remote Procedure Call (DCE/RPC) traffic (typically over port 135).

Tactics: TA0008
Techniques: T1021.003, T1021
Input: The third-party provider's access may be intended to be limited to the infrastructure being maintained, but may exist on the same network as the rest of the enterprise.

Tactics: TA0001
Techniques: T1199
Input: APT28 has performed large-scale scans in an attempt to find vulnerable servers.

Tactics: TA0043
Techniques: T1595, T1595.002
Input: Message 2:    Headers Received: by mailcenter.support   Sender Council on Foreign Relations <webprint@fprii.net>   Subject The Four Traps China May Fall Into   Body Content and images included within the e-mail body were a direct copy of the following CFR article: https://www.cfr.org/blog/four-traps-china-may-fall   Notes Multiple hyperlinks within the e-mail body lead to a malicious RTF document located at the URL  hxxp://fprii.net/The_Four_Traps_for_China.doc

Tactics: TA0007
Techniques: T1087
Input: The network configuration is a file containing parameters that determine the operation of the device.

Tactics: TA0009
Techniques: T1602, T1602.002
Input: Adversaries may establish persistence and elevate privileges by executing malicious content triggered by a Windows Management Instrumentation (WMI) event subscription.

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: InvisiMole can use a .lnk shortcut for the Control Panel to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: menuPass uses scripts to enumerate IP ranges on the victim network.

Tactics: TA0007
Techniques: T1018
Input: Monitor for API calls associated with detecting token manipulation only through careful analysis of user activity, examination of running processes, and correlation with other endpoint and network behavior.

Tactics: TA0004, TA0005
Techniques: T1134.002, T1134
Input: Suspicious program execution as startup programs may show up as outlier processes that have not been seen before when compared against historical data.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.014
Input: In addition, web traffic between a service provider’s customer and a service provider is likely to be viewed as benign by network defenders at the customer, allowing the attacker to exfiltrate data stealthily

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: VNC (5900/TCP)

Tactics: TA0006
Techniques: T1110.004, T1110, T1110.001, T1110.003
Input: NETWIRE can use Native API including CreateProcess GetProcessById, and WriteProcessMemory.

Tactics: TA0002
Techniques: T1106
Input: Inspect and cleanup malicious hidden Registry entries using Native Windows API calls and/or tools such as Autoruns  and RegDelNull .

Tactics: TA0005
Techniques: T1112
Input: An adversary may set this property at various scopes through Local Group Policy Editor, user properties, Fine-Grained Password Policy (FGPP), or via the ActiveDirectory PowerShell module.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.005
Input: menuPass has compressed files before exfiltration using TAR and RAR.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: It’s also used to inject code into its target processes using the technique.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Maze has forged POST strings with a random choice from a list of possibilities including "forum", "php", "view",  while making connection with the C2, hindering detection efforts.

Tactics: TA0011
Techniques: T1568
Input: KONNI has used FTP to exfiltrate reconnaissance data out.

Tactics: TA0010
Techniques: T1048.003, T1048
Input: Inception has enumerated installed software on compromised systems.

Tactics: TA0007
Techniques: T1518
Input: Doki has used the dogechain.info API to generate a C2 address.

Tactics: TA0011
Techniques: T1102
Input: In the wild, malware has disabled tty_tickets to potentially make scripting easier by issuing echo \'Defaults !tty_tickets\' >> /etc/sudoers.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: Mitigation As this sample installs itself through the use of EternalBlue, the targeted protocol is SMB.  Because of this, in order to best mitigate and avoid possible installations, you need your system updated to the latest security patches.  Specifically, you’d want to make sure that you have MS17-010 installed, as this is the security patch that patches the EternalBlue vulnerability

Tactics: TA0007
Techniques: T1518.001, T1518
Input: via EXPORT forwarded to another DLL, specified with (fully-qualified or relative) pathname (but without extension);

Tactics: TA0002
Techniques: T1129
Input: APT29 has used valid accounts, including administrator accounts, to help facilitate lateral movement on compromised networks.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.002
Input: These malicious applications have been delivered through popups on legitimate websites.

Tactics: TA0001
Techniques: T1189
Input: A handle to an existing victim process is first created with native Windows API calls such as OpenThread.

Tactics: TA0004, TA0005
Techniques: T1055.003, T1055.004, T1055
Input: DustySky has used both HTTP and HTTPS for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Adversaries may abuse launchctl to execute commands or programs.

Tactics: TA0002
Techniques: T1569.001, T1569
Input: A JHUHUGIT variant takes screenshots by simulating the user pressing the "Take Screenshot" key (VK_SCREENSHOT), accessing the screenshot saved in the clipboard, and converting it to a JPG image.

Tactics: TA0009
Techniques: T1113
Input: H1N1 kills and disables services for Windows Security Center, and Windows Defender.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: PLEAD has the ability to steal saved passwords from Microsoft Outlook.

Tactics: TA0006
Techniques: T1555
Input: Consider implementing access control mechanisms that include both authentication and authorization.

Tactics: TA0009
Techniques: T1213, T1213.002
Input: Since Operation Clandestine Fox, we have observed this actor execute multiple attacks that did not rely on zero-day exploits. The combination of this sustained operational tempo and lack of zero-day exploits may indicate that this group has changed strategy and has decided to attack more frequently and does not have steady access to zero-day exploit code. No matter the strategy, this actor has shown an ability to operate successfully

Tactics: TA0002, TA0004
Techniques: T1203, T1068
Input: HKEY_CLASSES_ROOT\txtfile\shell\print\command

Tactics: TA0003, TA0004
Techniques: T1546, T1546.001
Input: Limit user access to system utilities such as 'systemctl' to only users who have a legitimate need.

Tactics: TA0003, TA0004
Techniques: T1543.002, T1543
Input: Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems.

Tactics: TA0040
Techniques: T1529
Input: This may prevent potential elevation of privileges through exploitation during the process of UAC detecting the installer, but will allow the installation process to continue without being logged.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.010, T1574
Input: Industroyer can use supplied user credentials to execute processes and stop services.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: Chaes has used encryption for its C2 channel.

Tactics: TA0011
Techniques: T1573
Input: Koadic can open an interactive command-shell to perform command line functions on victim machines.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Monitor cluster-level (Kubernetes) data and events associated with changing containers' volume configurations.

Tactics: TA0004
Techniques: T1611
Input: MegaCortex can parse the available drives and directories to determine which files to encrypt.

Tactics: TA0007
Techniques: T1083
Input: Lazarus Group lnk files used for persistence have abused the Windows Update Client (wuauclt.exe) to execute a malicious DLL.

Tactics: TA0005
Techniques: T1218
Input: Empire can timestomp any files or payloads placed on a target machine to help them blend in.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: To get a job from the Google Drive account, the Trojan starts by creating a string that has the following structure with each element within the subdomain subjected to the number to character substitution from Table 4: c<unique identifier><job identifier padded with ‘0’ to make three digits><sequence number>c.<C2 domain> The Trojan will then obtain an OAUTH access token to the Google Drive in the same manner as before when obtaining the unique identifier

Tactics: TA0011
Techniques: T1102
Input: SoreFang has the ability to list directories.

Tactics: TA0007
Techniques: T1083
Input: The built-in Windows utility rundll32.exe is then used to load this DLL by the original .lnk file

Tactics: TA0003, TA0004, TA0005
Techniques: T1547.009, T1218, T1547, T1218.011
Input: Cobalt Strike can use VBA to perform execution.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Windows 8.1, Windows Server 2012 R2, and later versions may make LSA run as a Protected Process Light (PPL) by setting the Registry key HKLM\SYSTEM\CurrentControlSet\Control\Lsa\RunAsPPL, which requires all SSP DLLs to be signed by Microsoft.

Tactics: TA0003, TA0004
Techniques: T1547.005, T1547
Input: Sidewinder has added paths to executables in the Registry to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Like other objects in AD, GPOs have access controls associated with them.

Tactics: TA0004, TA0005
Techniques: T1484.001, T1484
Input: A Threat Group-3390 tool can use WMI to execute a binary.

Tactics: TA0002
Techniques: T1047
Input: FIN7 has used WMI to install malware on targeted systems.

Tactics: TA0002
Techniques: T1047
Input: Monitor Registry edits for modifications to services and startup programs that correspond to security tools.

Tactics: TA0005
Techniques: T1562
Input: Misdat is capable of providing shell functionality to the attacker to execute commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: build_downer has the ability to download files from C2 to the infected host.

Tactics: TA0011
Techniques: T1105
Input: Cyclops Blink can use the Linux API statvfs to enumerate the current working directory.

Tactics: TA0007
Techniques: T1083
Input: XAgentOSX contains the execFile function to execute a specified file on the system using the NSTask:launch method.

Tactics: TA0002
Techniques: T1106
Input: It can be disabled through GPO: Computer Configuration > [Policies] > Administrative Templates > Windows Components > Credential User Interface: Enumerate administrator accounts on elevation.

Tactics: TA0007
Techniques: T1087.002, T1087, T1087.001
Input: Diavol can delete shadow copies using the IVssBackupComponents COM object to call the DeleteSnapshots method.

Tactics: TA0040
Techniques: T1490
Input: Indrik Spider has used the win32_service WMI class to retrieve a list of services from the system.

Tactics: TA0007
Techniques: T1007
Input: BadPatch uses HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Hikit has the ability to download files to a compromised host.

Tactics: TA0011
Techniques: T1105
Input: APT40 used MURKYSHELL at a compromised victim organization to port scan IP addresses and conduct network enumeration

Tactics: TA0007
Techniques: T1016
Input: FIN6 has used has used Metasploit’s named-pipe impersonation technique to escalate privileges.

Tactics: TA0004, TA0005
Techniques: T1134
Input: Kwampirs downloads additional files that are base64-encoded and encrypted with another cipher.

Tactics: TA0005
Techniques: T1027
Input: CrossRAT uses run keys for persistence on Windows

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Elise is capable of launching a remote shell on the host to delete itself.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: BLUELIGHT can use HTTP/S for C2 using the Microsoft Graph API.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Monitor for API calls may attempt to get information about running processes on a system.

Tactics: TA0007
Techniques: T1057
Input: Consider encrypting important information to reduce an adversary’s ability to perform tailored data modifications.

Tactics: TA0040
Techniques: T1565.001, T1565
Input: Dragonfly has compromised targets via strategic web compromise (SWC) utilizing a custom exploit kit.

Tactics: TA0001
Techniques: T1189
Input: In Kubernetes environments, processes running inside a container communicate with the Kubernetes API server using service account tokens.

Tactics: TA0006
Techniques: T1528
Input: WarzoneRAT can disarm Windows Defender during the UAC process to evade detection.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Inception has used HTTP, HTTPS, and WebDav in network communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: The discovery modules used with Duqu can collect information on open windows.

Tactics: TA0007
Techniques: T1010
Input: RGDoor uses cmd.exe to execute commands on the victim’s machine.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: It is prepended to the encrypted and encoded message

Tactics: TA0005
Techniques: T1027