madox81/Adema_ATTACK_DS huggingface dataset:
Input: Shamoon has used HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Applications are responsible for providing the protocol definition which serves as a blueprint of the XPC services.

Tactics: TA0002
Techniques: T1559, T1559.003
Input: Night Dragon has copied files to company web servers and subsequently downloaded them.

Tactics: TA0009
Techniques: T1074.002, T1074
Input: Firewalls and proxies can inspect URLs for potentially known-bad domains or parameters.

Tactics: TA0001
Techniques: T1189
Input: GALLIUM used dumped hashes to authenticate to other machines via pass the hash.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: InvisiMole can replace legitimate software or documents in the compromised network with their trojanized versions, in an attempt to propagate itself within the network.

Tactics: TA0008
Techniques: T1080
Input: Imminent Monitor has uploaded a file containing debugger logs, network information and system information to the C2.

Tactics: TA0010
Techniques: T1041
Input: One variant of CloudDuke uses HTTP and HTTPS for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Leviathan has obtained valid accounts to gain initial access.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: BACKSPACE is capable of enumerating and making modifications to an infected system's Registry.

Tactics: TA0007
Techniques: T1012
Input: NanoCore can access the victim's webcam and capture data.

Tactics: TA0009
Techniques: T1125
Input: QakBot can identify the system time on a targeted host.

Tactics: TA0007
Techniques: T1124
Input: FIN8 has injected malicious code into a new svchost.exe process.

Tactics: TA0004, TA0005
Techniques: T1055.004, T1055
Input: Information about network trusts may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases).

Tactics: TA0043
Techniques: T1590, T1590.003
Input: PipeMon can send time zone information from a compromised host to C2.

Tactics: TA0007
Techniques: T1124
Input: Limit the ability for user accounts to create additional accounts.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078.004, T1078
Input: Ursnif has used hooked APIs to take screenshots.

Tactics: TA0009
Techniques: T1113
Input: UPPERCUT has used HTTP for C2, including sending error codes in Cookie headers.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Octopus has stored collected information in the Application Data directory on a compromised host.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Monitor for abnormal LDAP queries with filters for groupPolicyContainer and high volumes of LDAP traffic to domain controllers.

Tactics: TA0007
Techniques: T1615
Input: Adversaries may gather information about the victim's network security appliances that can be used during targeting.

Tactics: TA0043
Techniques: T1590, T1590.006
Input: Green Lambert can obtain proxy information from a victim's machine using system environment variables.

Tactics: TA0007
Techniques: T1016
Input: Encryption ciphers are used to convert a plaintext message to ciphertext and can be computationally intensive to decipher without the associated decryption key.

Tactics: TA0005
Techniques: T1600
Input: Monitor for processes being viewed that may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055
Input: ZIRCONIUM has created a Registry Run key named Dropbox Update Setup to establish persistence for a malicious Python binary.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: APT41 used compiled HTML (.chm) files for targeting.

Tactics: TA0005
Techniques: T1218, T1218.001
Input: Adversaries may also access externally facing Exchange services, Office 365, or Google Workspace to access email using credentials or access tokens.

Tactics: TA0009
Techniques: T1114, T1114.002
Input: The actor has the following demonstrated capabilities:To include exploits (for Hangul and Microsoft Office) in its workflows.To modify its campaigns by splitting the payload in to multiple stages To use compromised web servers or legitimate cloud based platforms

Tactics: TA0011
Techniques: T1102
Input: CrackMapExec can dump usernames and hashed passwords from the SAM.

Tactics: TA0006
Techniques: T1003, T1003.002
Input: Malware may also use IFEO to Impair Defenses by registering invalid debuggers that redirect and effectively disable various system and security applications.

Tactics: TA0003, TA0004
Techniques: T1546.012, T1546
Input: Monitor script processes, such as `cscript that may be used to proxy execution of malicious files.

Tactics: TA0005
Techniques: T1216.001, T1216
Input: The BITS mechanism has existed since Windows XP up to the current Windows 10 versions and was developed to create download/upload jobs, mostly to update the OS itself

Tactics: TA0011
Techniques: T1105
Input: Machete's Machete MSI installer has masqueraded as a legitimate Adobe Acrobat Reader installer.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: These logins may occur on any on-premises resources as well as from any cloud environment that trusts the credentials.

Tactics: TA0006
Techniques: T1606
Input: APT32 has set up and operated websites to gather information and deliver malware.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: Dragonfly has compromised legitimate websites to host C2 and malware modules.

Tactics: TA0042
Techniques: T1584.004, T1584
Input: Monitor for processes being accessed that may obtain root access (allowing them to read securityd’s memory), then they can scan through memory to find the correct sequence of keys in relatively few tries to decrypt the user’s logon keychain.

Tactics: TA0006
Techniques: T1555.002, T1555
Input: The Registry key is located HKLM\ SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators.

Tactics: TA0007
Techniques: T1087
Input: Consider reducing the default BITS job lifetime in Group Policy or by editing the JobInactivityTimeout and MaxDownloadTime Registry values in  HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\BITS.

Tactics: TA0003, TA0005
Techniques: T1197
Input: ADVSTORESHELL can list running processes.

Tactics: TA0007
Techniques: T1057
Input: InvisiMole has installed legitimate but vulnerable Total Video Player software and wdigest.dll library drivers on compromised hosts to exploit stack overflow and input validation vulnerabilities for code execution.

Tactics: TA0002
Techniques: T1203
Input: FinFisher contains junk code in its functions in an effort to confuse disassembly programs.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: Adversaries can use a command such as tell application "System Events" to make login item at end with properties /path/to/executable.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.015
Input: Domain registrars each maintain a publicly viewable database that displays contact information for every registered domain.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: Crutch can automatically monitor removable drives in a loop and copy interesting files.

Tactics: TA0009
Techniques: T1119
Input: Information about assigned IP addresses may include a variety of details, such as which IP addresses are in use.

Tactics: TA0043
Techniques: T1590, T1590.005
Input: Integrating multi-factor authentication (MFA) as part of organizational policy can greatly reduce the risk of an adversary gaining control of valid credentials that may be used for additional tactics such as initial access, lateral movement, and collecting information.

Tactics: TA0001, TA0003, TA0004, TA0005, TA0006
Techniques: T1556.003, T1078, T1556, T1078.002, T1556.001
Input: Adversaries may gather employee names that can be used during targeting.

Tactics: TA0043
Techniques: T1589.003, T1589
Input: (Source: Dell SecureWorks) Passwords, like "admin-na-google123!@#" shown in Figure 4, are required to interact with the web shell

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Adversaries may use this information during automated discovery to shape follow-on behaviors, including requesting all or specific objects from cloud storage.

Tactics: TA0007
Techniques: T1619
Input: SILENTTRINITY can add a CLSID key for payload execution through Registry.CurrentUser.CreateSubKey("Software\\Classes\\CLSID\\{" + clsid + "}\\InProcServer32").

Tactics: TA0003, TA0004
Techniques: T1546.015, T1546
Input: Attackers can therefore give a malicious DLL the same name as a legitimate DLL but place it ahead of the legitimate version in the search order so that it will be loaded when Windows searches for it.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Detection efforts may be focused on post-compromise phases of the adversary lifecycle, such as User Execution or Ingress Tool Transfer .

Tactics: TA0042
Techniques: T1608.001, T1608
Input: Kasidet has the ability to search for a given filename on a victim.

Tactics: TA0007
Techniques: T1083
Input: PUNCHBUGGY can load a DLL using Rundll32.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Hi-Zor encrypts C2 traffic with a double XOR using two distinct single-byte keys.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Wizard Spider has lured victims to execute malware with spearphishing attachments containing macros to download either Emotet, Bokbot, TrickBot, or Bazar.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Kimsuky has used Twitter to monitor potential victims and to prepare targeted phishing e-mails.

Tactics: TA0043
Techniques: T1593, T1593.001
Input: TSCookie can multiple protocols including HTTP and HTTPS in communication with command and control (C2) servers.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Monitor for logging, messaging that may disable Windows event logging to limit data that can be leveraged for detections and audits.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: APT33 has deployed a tool known as DarkComet to the Startup folder of a victim, and used Registry run keys to gain persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: HAYMAKER is a backdoor that can download and execute additional payloads in the form of modules

Tactics: TA0011
Techniques: T1105
Input: TA505 has used JavaScript for code execution.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Derusbi uses a backup communication method with an HTTP beacon.

Tactics: TA0011
Techniques: T1008
Input: Monitor for the SAM registry key dump being created to access stored account password hashes.

Tactics: TA0006
Techniques: T1003, T1003.002
Input: Monitor logs for actions that could be taken to gather information about pods, including the use of discovery API calls by new or unexpected users.

Tactics: TA0007
Techniques: T1613
Input: Zebrocy uses SMTP and POP3 for C2.

Tactics: TA0011
Techniques: T1071, T1071.003
Input: Monitor cloud logs for API calls used for file or object enumeration for unusual activity.

Tactics: TA0007
Techniques: T1619
Input: This directory will also contain the process id of the running malware in process.id and a “build name” (as it is called by the author) in build.id

Tactics: TA0007
Techniques: T1057
Input: Using a golden ticket, adversaries are then able to request ticket granting service (TGS) tickets, which enable access to specific resources.

Tactics: TA0006
Techniques: T1558, T1558.001
Input: TeamTNT has searched for unsecured AWS credentials and Docker API credentials.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: On Windows, there are a variety of features in scripting languages in Windows, such as PowerShell, Jscript, and Visual Basic to make windows hidden.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Monitor newly constructed files to/from a lateral tool transfer

Tactics: TA0008
Techniques: T1570
Input: APT29 has acquired C2 domains, sometimes through resellers.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: Monitor for newly constructed logon behavior across Atlassian's Confluence which can be configured to report access to certain pages and documents through AccessLogFilter.

Tactics: TA0009
Techniques: T1213, T1213.001
Input: These documents contained malicious OLE objects used to drop binaries.This time, however, they contained malicious OLE (Object Link Embedded) objects.Initial analysis confirmed two similarly sized OLE object files within this document which appeared to be the same from an execution point of view.The two dropped binaries were stored and executed in this location during our analysis:C:\Users\ADMINI~1\AppData\Local\Temp\Hwp (2).exeC:\Users\ADMINI~1\AppData\Local\Temp\Hwp (3).exeInitial analysis showed some sloppy cleaning up from Group123, which we used later to determine that separate campaigns were the work of this same actor, as compilation artifacts remained within the binaries:e:\Happy\Work\Source\version 12\T+M\Result\DocPrint.pdbThe second stage of the dropped binaries was used to execute wscript.exe while injecting shellcode into this process

Tactics: TA0002
Techniques: T1204
Input: FinFisher performs UAC bypass.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Some InnaputRAT variants establish persistence by modifying the Registry key HKU\\Software\Microsoft\Windows\CurrentVersion\Run:%appdata%\NeutralApp\NeutralApp.exe.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: The associated Windows Registry key for this is located at HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\SafeDLLSearchMode

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: APT29 has used AdFind to enumerate remote systems.

Tactics: TA0007
Techniques: T1018
Input: Ursnif has used CreateProcessW to create child processes.

Tactics: TA0002
Techniques: T1106
Input: NOKKI has established persistence by writing the payload to the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Denis has a command to delete files from the victim’s machine.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: In addition to using RDP for lateral movement, APT39 has used this protocol to maintain persistence in a victim environment

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Windows SSP DLLs are loaded into the Local Security Authority (LSA) process at system start.

Tactics: TA0003, TA0004
Techniques: T1547.005, T1547
Input: Adversaries can avoid the need to upload a tool by having compromised victim machines download the tool directly from a third-party hosting location (ex: a non-adversary controlled GitHub repo), including the original hosting site of the tool.

Tactics: TA0042
Techniques: T1608, T1608.002
Input: Identify and block potentially malicious software executed path interception by using application control tools, like Windows Defender Application Control, AppLocker, or Software Restriction Policies where appropriate.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.007, T1574.008, T1574.009, T1574
Input: Flash object in the .docx file, stored in uncompressed format The Flash object contains an ActionScript which is responsible for extracting the exploit using a custom packer seen in other FinSpy exploits

Tactics: TA0005
Techniques: T1027.002, T1027
Input: MMC may legitimately be used to call Microsoft-created .msc files, such as services.msc or eventvwr.msc.

Tactics: TA0005
Techniques: T1218, T1218.014
Input: RawPOS encodes credit card data it collected from the victim with XOR.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: Monitor for newly constructed files via JavaScript, developing rules for the different variants, with a combination of different encoding and/or encryption schemes, may be very challenging.

Tactics: TA0005
Techniques: T1027.006, T1027
Input: Mosquito establishes persistence under the Registry key HKCU\Software\Run auto_update.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: PinchDuke searches for files created within a certain timeframe and whose file extension matches a predefined list.

Tactics: TA0007
Techniques: T1083
Input: Programs that fall victim to path hijacking may appear to behave normally because malicious DLLs may be configured to also load the legitimate DLLs they were meant to replace.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Darkhotel has sent spearphishing emails in an attempt to lure users into clicking on a malicious attachments.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: IcedID has used WMI to execute binaries.

Tactics: TA0002
Techniques: T1047
Input: If a victim meets certain criteria, T9000 uses the AppInit_DLL functionality to achieve persistence by ensuring that every user mode process that is spawned will load its malicious DLL, ResN32.dll.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.010
Input: Monitor for changes made to DACLs and file/directory ownership.

Tactics: TA0005
Techniques: T1222, T1222.001
Input: Ensure proper system isolation for critical network systems through use of firewalls.

Tactics: TA0002, TA0008
Techniques: T1072
Input: APT38 installed a port monitoring tool, MAPMAKER, to print the active TCP connections on the local system.

Tactics: TA0007
Techniques: T1049
Input: SombRAT has the ability to respawn itself using ShellExecuteW and CreateProcessW.

Tactics: TA0002
Techniques: T1106
Input: Empire can leverage its implementation of Mimikatz to obtain and use golden tickets.

Tactics: TA0006
Techniques: T1558, T1558.001
Input: The Trojan will respond to the C2 with “PRIVMSG <username> : <message> [<specified path>]”

Tactics: TA0007
Techniques: T1033
Input: While sending to the C2 server, the data is formatted as follows: @{SYSINFO  = $get.ToString(); ACTION = "REGISTER";}  Ability to take screenshots

Tactics: TA0009
Techniques: T1113
Input: Monitor newly executed processes that may abuse Microsoft Outlook rules to obtain persistence on a compromised system.

Tactics: TA0003
Techniques: T1137, T1137.005
Input: Adversaries may abuse odbcconf.exe to proxy execution of malicious payloads.

Tactics: TA0005
Techniques: T1218, T1218.008
Input: Require that all AppleScript be signed by a trusted developer ID before being executed - this will prevent random AppleScript code from executing.

Tactics: TA0002
Techniques: T1059.002, T1059
Input: These tools may be used to query specific data from a configuration repository or configure the device to export the configuration for later analysis.

Tactics: TA0009
Techniques: T1602, T1602.002
Input: XAgentOSX contains the getInstalledAPP function to run ls -la /Applications to gather what applications are installed.

Tactics: TA0007
Techniques: T1082
Input: The binary will then be executed by the system when the authentication packages are loaded.

Tactics: TA0003, TA0004
Techniques: T1547.002, T1547
Input: Scripting execution is likely to perform actions with various effects on a system that may generate events, depending on the types of monitoring used.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: The attackers gain an initial foothold on targeted machines via phishing emails containing malicious attachments.

Tactics: TA0001
Techniques: T1566.003, T1566
Input: TEARDROP created and read from a file with a fake JPG header, and its payload was encrypted with a simple rotating XOR cipher.

Tactics: TA0005
Techniques: T1027
Input: APT33 has used AES for encryption of command and control traffic.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: BISCUIT has a command to download a file from the C2 server.

Tactics: TA0011
Techniques: T1105
Input: Sandworm Team temporarily disrupted service to Georgian government, non-government, and private sector websites after compromising a Georgian web hosting provider in 2019.

Tactics: TA0040
Techniques: T1499
Input: The HandlePP::getClientID method uses the following environment variables:   Figure 11. Serial number   Figure 12. Hardware UUID   Figure 13. MAC address   Figure 14. Randomly generated UUID For the initial information packet, the backdoor also collects the following:   Figure 15. OS version Running getpwuid ->pw_name , scutil – -get ComputerName, and uname –m will provide the following returns respectively:  Mac OSX 10.12

Tactics: TA0007
Techniques: T1082
Input: Crimson can identify the geographical location of a victim host.

Tactics: TA0007
Techniques: T1614
Input: esentutl can be used to collect data from local file systems.

Tactics: TA0009
Techniques: T1005
Input: Cobian RAT has a feature to perform keylogging on the victim’s machine.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: APT28 has used COM hijacking for persistence by replacing the legitimate MMDeviceEnumerator object with a payload.

Tactics: TA0003, TA0004
Techniques: T1546.015, T1546
Input: Adversaries may purchase or steal SSL/TLS certificates to further their operations, such as encrypting C2 traffic (ex: Asymmetric Cryptography with Web Protocols) or even enabling Adversary-in-the-Middle if the certificate is trusted or otherwise added to the root of trust ( Install Root Certificate).

Tactics: TA0042
Techniques: T1588.004, T1588
Input: APT1 used the ipconfig /all command to gather network configuration information.

Tactics: TA0007
Techniques: T1016
Input: Consider analyzing malware for features that may be associated with the adversary and/or their developers, such as compiler used, debugging artifacts, or code similarities.

Tactics: TA0042
Techniques: T1587, T1587.001
Input: The most common authentication module is pam_unix.so, which retrieves, sets, and verifies account authentication information in /etc/passwd and /etc/shadow.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.003, T1556
Input: Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools.

Tactics: TA0011
Techniques: T1132.001, T1132, T1090.001, T1008, T1105, T1090, T1090.002, T1132.002
Input: Examples include Arp, ipconfig/ifconfig, nbtstat, and route.

Tactics: TA0007
Techniques: T1016
Input: Different protocol channels could also include Web services such as cloud storage.

Tactics: TA0010
Techniques: T1048
Input: BITS jobs use HTTP(S) and SMB for remote connections and are tethered to the creating user and will only function when that user is logged on (this rule applies even if a user attaches the job to a service account).

Tactics: TA0003, TA0005
Techniques: T1197
Input: schtasks is used to schedule tasks on a Windows system to run at a specific date and time.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Monitor for unusual login activity from unknown or abnormal locations, especially for privileged accounts (ex: Exchange administrator account).

Tactics: TA0009
Techniques: T1114, T1114.002
Input: KeyBoy has a command to perform screen grabbing.

Tactics: TA0009
Techniques: T1113
Input: OLDBAIT installs itself in %ALLUSERPROFILE%\Application Data\Microsoft\MediaPlayer\updatewindws.exe; the directory name is missing a space and the file name is missing the letter "o."

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Monitor logs for actions that could be taken to gather information about container infrastructure, including the use of discovery API calls by new or unexpected users.

Tactics: TA0007
Techniques: T1613
Input: SID Filtering of forest trusts is enabled by default, but may have been disabled in some cases to allow a child domain to transitively access forest trusts.

Tactics: TA0004, TA0005
Techniques: T1134.005, T1134
Input: CharmPower has the ability to capture screenshots.

Tactics: TA0009
Techniques: T1113
Input: KGH_SPY has the ability to download and execute code from remote servers.

Tactics: TA0011
Techniques: T1105
Input: Adversaries may carry out malicious operations using a virtual instance to avoid detection.

Tactics: TA0005
Techniques: T1564, T1564.006
Input: VERMIN gathers the username from the victim’s machine.

Tactics: TA0007
Techniques: T1033
Input: HARDRAIN uses FakeTLS to communicate with its C2 server.

Tactics: TA0011
Techniques: T1001, T1001.003