madox81/Adema_ATTACK_DS huggingface dataset:
Input: Determine if certain websites that can be used for spearphishing are necessary for business operations and consider blocking access if activity cannot be monitored well or if it poses a significant risk.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: (On the left is NavRAT, and on the right is the shellcode of ROKRAT):    We performed the same analysis for the shellcode located in the downloaded image file and the shellcode is not exactly the same, but the design is very similar

Tactics: TA0002
Techniques: T1059
Input: The PHP version of the China Chopper Web shell, for example, is the following short payload: <?php @eval($_POST['password']);>Nevertheless, detection mechanisms exist.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: It will then connect to the system with RegConnectRegistryW and modify the Registry to disable UAC remote restrictions by setting SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy to 1.

Tactics: TA0005
Techniques: T1112
Input: QakBot can use a variety of commands, including esentutl.exe to steal sensitive data from Internet Explorer and Microsoft Edge, to acquire information that is subsequently exfiltrated.

Tactics: TA0009
Techniques: T1005
Input: Ryuk can use anti-disassembly and code transformation obfuscation techniques.

Tactics: TA0005
Techniques: T1027
Input: The most interesting part is the decrypted C&C configuration, as can be seen in the image below

Tactics: TA0005
Techniques: T1140
Input: To report an intrusion and request resources for incident response or technical assistance, you are encouraged to contact DHS NCCIC (NCCICCustomerService@hq.dhs.gov or 888-282-0870), the FBI through a local field office, or the FBI’s Cyber Division (CyWatch@fbi.gov or 855-292-3937).Protect Against SQL Injection and Other Attacks on Web ServicesTo protect against code injections and other attacks, system operators should routinely evaluate known and published vulnerabilities, periodically perform software updates and technology refreshes, and audit external-facing systems for known web application vulnerabilities

Tactics: TA0003
Techniques: T1505.003, T1505
Input: In cloud environments, adversaries may create accounts that only have access to specific services, which can reduce the chance of detection.

Tactics: TA0003
Techniques: T1136
Input: PoetRAT has the ability to gather information about the compromised host.

Tactics: TA0007
Techniques: T1082
Input: The malware also contains an embedded .NET wrapper DLL for creating and managing scheduled tasks on Windows systems

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Monitor newly executed processes that may modify XDG autostart entries to execute programs or commands during system boot.

Tactics: TA0003, TA0004
Techniques: T1547.013, T1547
Input: Dtrack’s RAT makes a persistent target file with auto execution on the host start.

Tactics: TA0003, TA0004
Techniques: T1547
Input: Windshift has used malware to identify the computer name of a compromised host.

Tactics: TA0007
Techniques: T1082
Input: Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.014
Input: The Get-MsolRole PowerShell cmdlet can be used to obtain roles and permissions groups for Exchange and Office 365 accounts .

Tactics: TA0007
Techniques: T1069, T1069.003
Input: Applications may send push notifications to verify a login as a form of multi-factor authentication (MFA).

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078.004, T1078, T1078.002
Input: Patchwork has obfuscated a script with Crypto Obfuscator.

Tactics: TA0005
Techniques: T1027
Input: Helminth establishes persistence by creating a shortcut.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Even though some third-party applications define user COM objects, the presence of objects within HKEY_CURRENT_USER\Software\Classes\CLSID\ may be anomalous and should be investigated since user objects will be loaded prior to machine objects in HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID.

Tactics: TA0003, TA0004
Techniques: T1546.015, T1546
Input: Office365DCOMCheck.vbs or SystemDiskClean.vbs) within the %TEMP% folder:       CreateObject("WScript.Shell").Run "" & WScript.Arguments(0) & "", 0, False     The scheduled task will then run every five minutes, which provides persistent execution of the downloader script

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1547.001, T1053, T1547, T1059
Input: DRATzarus can use various API calls to see if it is running in a sandbox.

Tactics: TA0002
Techniques: T1106
Input: Pupy can list local and remote shared drives and folders over SMB.

Tactics: TA0007
Techniques: T1135
Input: PolyglotDuke can retrieve payloads from the C2 server.

Tactics: TA0011
Techniques: T1105
Input: Seeing this string anywhere in a packet's payload may be indicative of a Wake-on-LAN attempt.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205
Input: Adversaries may also create or steal code signing certificates to acquire trust on target systems.

Tactics: TA0005
Techniques: T1553
Input: Libraries specified by LD_PRELOAD are loaded and mapped into memory by dlopen() and mmap() respectively.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.006, T1574
Input: Adversaries may purchase domains that can be used during targeting.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a USB device introduced by a user.

Tactics: TA0010
Techniques: T1052, T1052.001
Input: Chimera has used fsutil fsinfo drives, systeminfo, and vssadmin list shadows for system information including shadow volumes and drive information.

Tactics: TA0007
Techniques: T1082
Input: ServHelper has created a new user and added it to the "Remote Desktop Users" and "Administrators" groups.

Tactics: TA0003
Techniques: T1136, T1136.001
Input: Adversaries may communicate using a protocol and port paring that are typically not associated.

Tactics: TA0011
Techniques: T1571
Input: SLOTHFULMEDIA has mimicked the names of known executables, such as mediaplayer.exe.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: WIRTE has downloaded PowerShell code from the C2 server to be executed.

Tactics: TA0011
Techniques: T1105
Input: Adversaries may employ various time-based methods to detect and avoid virtualization and analysis environments.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Adversaries may install new services, daemons, or agents that can be configured to execute at startup or a repeatable interval in order to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1543
Input: Monitor for API calls that may create or modify Windows services (ex: CreateServiceW()) to repeatedly execute malicious payloads as part of persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Rising Sun can clear process memory by overwriting it with junk bytes.

Tactics: TA0005
Techniques: T1070
Input: Monitor executed commands and arguments that may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

Tactics: TA0007
Techniques: T1082
Input: Cloud service discovery techniques will likely occur throughout an operation where an adversary is targeting cloud-based systems and services.

Tactics: TA0007
Techniques: T1046, T1526
Input: SCREEN Takes a PNG screenshot of the main screen and names the file with timestamps, then uploads it to the C2 server using POST at the path “/FeedBack.php”

Tactics: TA0009
Techniques: T1113
Input: SILENTTRINITY can take a screenshot of the current desktop.

Tactics: TA0009
Techniques: T1113
Input: QuietSieve has taken screenshots every five minutes and saved them to the user's local Application Data folder under Temp\SymbolSourceSymbols\icons or Temp\ModeAuto\icons.

Tactics: TA0009
Techniques: T1113
Input: menuPass has used a script (atexec.py) to execute a command on a target machine via Task Scheduler.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Melcoz can monitor the clipboard for cryptocurrency addresses and change the intended address to one controlled by the adversary.

Tactics: TA0040
Techniques: T1565, T1565.002
Input: Default accounts are not limited to client machines, rather also include accounts that are preset for equipment such as network devices and computer applications whether they are internal, open source, or commercial.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.001
Input: Adversaries may register a device to an adversary-controlled account.

Tactics: TA0003
Techniques: T1098.005, T1098
Input: Nomadic Octopus executed PowerShell in a hidden window.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Often, much of this traffic will be in cleartext due to the use of TLS termination at the load balancer level to reduce the strain of encrypting and decrypting traffic.

Tactics: TA0006, TA0007
Techniques: T1040
Input: Adversaries may also perform DLL preloading, also called binary planting attacks,  by placing a malicious DLL with the same name as an ambiguously specified DLL in a location that Windows searches before the legitimate DLL.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: SslMM identifies and kills anti-malware processes.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: SYNful Knock is malware that is inserted into a network device by patching the operating system image.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: Monitor for changes made to Windows services to repeatedly execute malicious payloads as part of persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Avaddon modifies several registry keys for persistence and UAC bypass.

Tactics: TA0005
Techniques: T1112
Input: RDFSNIFFER hooks several Win32 API functions to hijack elements of the remote system management user-interface.

Tactics: TA0006, TA0009
Techniques: T1056.004, T1056
Input: Phishing for information is different from Phishing in that the objective is gathering data from the victim rather than executing malicious code.

Tactics: TA0043
Techniques: T1598
Input: NotPetya creates a task to reboot the system one hour after infection.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: "Are you Happy?" campaign."FreeMilk" campaign."North Korean Human Rights" campaign."Evil New Year 2018" campaign.On January 2nd of 2018, the "Evil New Year 2018" was started

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: The credential harvesting attacks used spear-phishing emails that contained malicious Microsoft Office documents that leveraged the “attachedTemplate” technique to load a template from a remote server

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Monitor executed commands and arguments that may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems.

Tactics: TA0003, TA0004
Techniques: T1547
Input: However, live memory modification of the operating system can be combined with ROMMONkit to achieve persistence.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: The file uses a character insertion obfuscation technique, making it appear to contain Chinese characters.

Tactics: TA0005
Techniques: T1027
Input: Valak can download a module to search for and build a report of harvested credential data.

Tactics: TA0009
Techniques: T1119
Input: NETWIRE has been spread via e-mail campaigns utilizing malicious links.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Elise performs timestomping of a CAB file it creates.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: If the at.allow file does not exist, the at.deny file is checked.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: This can be done through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Create symbolic links.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Compromised accounts may require additional development, this could include filling out or modifying profile information, further developing social networks, or incorporating photos.

Tactics: TA0042
Techniques: T1586
Input: Carberp's passw.plug plugin can gather account information from multiple instant messaging, email, and social media services, as well as FTP, VNC, and VPN clients.

Tactics: TA0006
Techniques: T1555
Input: Adversaries can use these configuration locations to execute malware, such as remote access tools, to maintain persistence through system reboots.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Although deprecated, the TxF application programming interface (API) is still enabled as of Windows 10.

Tactics: TA0004, TA0005
Techniques: T1055.013, T1055
Input: Ensure critical system files as well as those known to be abused by adversaries have restrictive permissions and are owned by an appropriately privileged account, especially if access is not required by users nor will inhibit system functionality.

Tactics: TA0005
Techniques: T1222.002, T1222, T1222.001
Input: Briba installs a service pointing to a malicious DLL dropped to disk.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: menuPass has encoded strings in its malware with base64 as well as with a simple, single-byte XOR obfuscation using key 0x40.

Tactics: TA0005
Techniques: T1027
Input: FIN8 has exploited the CVE-2016-0167 local vulnerability.

Tactics: TA0004
Techniques: T1068
Input: TLS callback injection is a method of executing arbitrary code in the address space of a separate live process.

Tactics: TA0004, TA0005
Techniques: T1055.005, T1055
Input: In cloud environments, adversaries may be able to modify the SSH authorized_keys file of a particular virtual machine via the command line interface or rest API.

Tactics: TA0003
Techniques: T1098.004, T1098
Input: If unable to contact the C2 server initially, the shellcode is configured to reattempt communication with the C2 server address in the following pattern:  [a-z][a-z][a-z].stage.14919005.www1.proslr3[.]com VBScript #2 “mshta.exe” further executes the second VBScript “58d2a83f777908.23270411.vbs”, which creates a folder by GUID name inside “Intel” and drops the VBScript payloads and configuration files: \Intel\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\58d2a83f777638.60220156.ini \Intel\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\58d2a83f777688.78384945.ps1 \Intel\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\58d2a83f7776b5.64953395.txt \Intel\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\58d2a83f7776e0.72726761.vbs \Intel\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\58d2a83f777716.48248237.vbs \Intel\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\58d2a83f777788.86541308.vbs \Intel\{BFF4219E-C7D1-2880-AE58-9C9CD9701C90}\Foxconn.lnk This script then executes “58d2a83f777716.48248237.vbs”, which is a variant of FIN7’s HALFBAKED backdoor

Tactics: TA0002, TA0005
Techniques: T1036, T1059
Input: Monitor for newly constructed files that may leverage Microsoft Office-based applications for persistence between startups.

Tactics: TA0003
Techniques: T1137
Input: Rancor has used cmd.exe to execute commmands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: ShimRatReporter used several Windows API functions to gather information from the infected system.

Tactics: TA0002
Techniques: T1106
Input: WannaCry attempts to kill processes associated with Exchange, Microsoft SQL Server, and MySQL to make it possible to encrypt their data stores.

Tactics: TA0040
Techniques: T1489
Input: Molerats saved malicious files within the AppData and Startup folders to maintain persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Monitor for contextual data about an Internet-facing resource gathered from a scan, such as running services or ports that may buy, lease, or rent infrastructure that can be used during targeting.

Tactics: TA0042
Techniques: T1583
Input: HKEY_CLASSES_ROOT\txtfile\shell\open\command

Tactics: TA0003, TA0004
Techniques: T1546, T1546.001
Input: APT39 has used HTTP in communications with C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Bandook can support commands to execute Java-based payloads.

Tactics: TA0002
Techniques: T1059
Input: Remexi decrypts the configuration data using XOR with 25-character keys.

Tactics: TA0005
Techniques: T1140
Input: Furthermore, change default configurations and implement limits upon the maximum number of 2FA/MFA request prompts that can be sent to users in period of time.

Tactics: TA0006
Techniques: T1621
Input: GoldFinder logged and stored information related to the route or hops a packet took from a compromised machine to a hardcoded C2 server, including the target C2 URL, HTTP response/status code, HTTP response headers and values, and data received from the C2 node.

Tactics: TA0009
Techniques: T1119
Input: Astaroth has used a DGA in C2 communications.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: Malicious files or data can be obfuscated and hidden inside of HTML files through Data URLs and/or JavaScript Blobs and can be deobfuscated when they reach the victim ( Deobfuscate/Decode Files or Information), potentially bypassing content filters.

Tactics: TA0005
Techniques: T1027.006, T1027
Input: Unusual remote logins that correlate with other suspicious activity (such as writing and executing binaries) may indicate malicious activity.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: NETWIRE can use TCP in C2 communications.

Tactics: TA0011
Techniques: T1095
Input: Penquin can report the IP of the compromised host to attacker controlled infrastructure.

Tactics: TA0007
Techniques: T1016
Input: The dropped executable (MD5: 78734CD268E5C9AB4184E1BBE21A6EB9) contains the compressed FELIXROOT dropper component in the Portable Executable (PE) binary overlay section

Tactics: TA0005
Techniques: T1070, T1070.004
Input: WINDSHIELD can gather the victim computer name.

Tactics: TA0007
Techniques: T1082
Input: The shellcode retrieves an additional payload by connecting to the following C2 server using DNS: aaa.stage.14919005.www1.proslr3[.]com Once a successful reply is received from the command and control (C2) server, the PowerShell script executes the embedded Cobalt Strike shellcode

Tactics: TA0011
Techniques: T1071
Input: Adversaries may attempt to get a listing of email addresses and accounts.

Tactics: TA0007
Techniques: T1087.003, T1087
Input: Tropic Trooper has deleted dropper files on an infected system using command scripts.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Linfo creates a backdoor through which remote attackers can obtain data from local systems.

Tactics: TA0009
Techniques: T1005
Input: Cuba has used multiple layers of obfuscation to avoid analysis, including its Base64 encoded payload.

Tactics: TA0005
Techniques: T1027
Input: Turla surveys a system upon check-in to discover network configuration details using the arp -a, nbtstat -n, net config, ipconfig /all, and route commands, as well as NBTscan.

Tactics: TA0007
Techniques: T1016
Input: PROMETHIUM has named services to appear legitimate.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Cardinal RAT can act as a reverse proxy.

Tactics: TA0011
Techniques: T1090
Input: ROKRAT has used Visual Basic for execution.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: In the event of sandbox detection, it would delete itself by overwriting the malware scripts with the contents of "License.txt" and exiting.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: OopsIE encodes data in hexadecimal format over the C2 channel.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Process doppelgänging is a method of executing arbitrary code in the address space of a separate live process.

Tactics: TA0004, TA0005
Techniques: T1055.013, T1055
Input: SNMP can give administrators great insight in their systems, such as, system information, description of hardware, physical location, and software packages.

Tactics: TA0009
Techniques: T1602.001, T1602
Input: Pisloader establishes persistence via a Registry Run key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Egregor has been decrypted before execution.

Tactics: TA0005
Techniques: T1140
Input: Kimsuky has used rundll32.exe to execute malicious scripts and malware on a victim's network.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Malicious Control Panel items can be delivered via Phishing campaigns or executed as part of multi-stage malware.

Tactics: TA0005
Techniques: T1218, T1218.002
Input: If this activity occurs outside of known administration activity, upgrades, installations, or patches, then it may be suspicious.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.007, T1574.008, T1574.009, T1574
Input: NETWIRE has the ability to steal credentials from web browsers including Internet Explorer, Opera, Yandex, and Chrome.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: PROMETHIUM has used a script that configures the knockd service and firewall to only accept C2 connections from systems that use a specified sequence of knock ports.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205, T1205.001
Input: JPIN can inject content into lsass.exe to load a module.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Domain fronting involves using different domain names in the SNI field of the TLS header and the Host field of the HTTP header.

Tactics: TA0011
Techniques: T1090.004, T1090
Input: Find and eliminate path interception weaknesses in program configuration files, scripts, the PATH environment variable, services, and in shortcuts by surrounding PATH variables with quotation marks when functions allow for them.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.007, T1574.008, T1574.009, T1574
Input: From an infrastructure point of view there is no overlap between the two sets of activity, the only overlap is the use of the unique tool “DNSMessenger”  When these points are considered together in conjunction with the significant difference in targeting they make a strong case for classifying this activity as distinct from FIN7 activity

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Some of these security controls may be enabled by default, such as Driver Signature Enforcement (DSE) on Windows or System Integrity Protection (SIP) on macOS.

Tactics: TA0005
Techniques: T1553, T1553.006
Input: Taidoor can upload data and files from a victim's machine.

Tactics: TA0009
Techniques: T1005
Input: ThreatNeedle can be loaded into the Startup folder (%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\OneDrives.lnk) as a Shortcut file for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: JPIN can list running services.

Tactics: TA0007
Techniques: T1007
Input: Sowbug identified and extracted all Word documents on a server by using a command containing * .doc and *.docx.

Tactics: TA0007
Techniques: T1083
Input: (Source: Dell SecureWorks) Table 4 lists the OwaAuth web shell commands available to the adversary

Tactics: TA0002, TA0003
Techniques: T1505.003, T1505, T1059
Input: For containing the impact of a previously generated golden ticket, reset the built-in KRBTGT account password twice, which will invalidate any existing golden tickets that have been created with the KRBTGT hash and other Kerberos tickets derived from it.

Tactics: TA0006
Techniques: T1558, T1558.001
Input: Ensure .evtx files, which are located at C:\Windows\system32\Winevt\Logs, have the proper file permissions for limited, legitimate access and audit policies for detection.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: Grandoreiro can steal cookie data and credentials from Google Chrome.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: An older variant of PLAINTEE performs UAC bypass.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548