madox81/Adema_ATTACK_DS huggingface dataset:
Input: LookBack can take desktop screenshots.

Tactics: TA0009
Techniques: T1113
Input: Mythic supports HTTP-based C2 profiles.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: The second named scheduled task, loaded as an XML file to falsify task attributes, ran a JavaScript code block that downloaded and launched a secondary backdoor, delivered as a multi-stage PowerShell script

Tactics: TA0002, TA0005
Techniques: T1036, T1059
Input: Monitor newly executed processes that may gain persistence and elevate privileges by executing malicious content triggered by the Event Monitor Daemon (emond).

Tactics: TA0003, TA0004
Techniques: T1546, T1546.014
Input: Monitor executed commands and arguments for actions that aid in sniffing network traffic to capture information about an environment, including authentication material passed over the network

Tactics: TA0006, TA0007
Techniques: T1040
Input: Seasalt uses HTTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Compare the checksum of the operating system file with the checksum of a known good copy from a trusted source.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: CookieMiner can download additional scripts from a web server.

Tactics: TA0011
Techniques: T1105
Input: BRONZE BUTLER has used tools to enumerate software installed on an infected host.

Tactics: TA0007
Techniques: T1518
Input: Magic Hound has attempted to lure victims into opening malicious email attachments.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Though a malicious transport agent may be invoked for all emails passing through the Exchange transport pipeline, the agent can be configured to only carry out specific tasks in response to adversary defined criteria.

Tactics: TA0003
Techniques: T1505.002, T1505
Input: Applications can send messages to the XPC Service daemon, which runs as root, using the low-level XPC Service C API or the high level NSXPCConnection API in order to handle tasks that require elevated privileges (such as network connections).

Tactics: TA0002
Techniques: T1559, T1559.003
Input: SUNBURST strings were compressed and encoded in Base64.

Tactics: TA0005
Techniques: T1027
Input: BlackTech has used right-to-left-override to obfuscate the filenames of malicious e-mail attachments.

Tactics: TA0005
Techniques: T1036, T1036.002
Input: An adversary may gain administrative Azure AD privileges if a SAML token is forged which claims to represent a highly privileged account.

Tactics: TA0006
Techniques: T1606, T1606.002
Input: HyperBro has used HTTPS for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: GALLIUM ensured each payload had a unique hash, including by using different types of packers.

Tactics: TA0005
Techniques: T1027, T1027.005
Input: In some cases a second visit to the website after the initial scan is required before exploit code is delivered.

Tactics: TA0001
Techniques: T1189
Input: The following is a brief list of example information that may hold potential value to an adversary and may also be found on an information repository:

Tactics: TA0009
Techniques: T1213
Input: A user's service tickets or ticket granting ticket (TGT) may be obtained, depending on the level of access.

Tactics: TA0005, TA0008
Techniques: T1550.003, T1550
Input: Cloud service providers may track access key age to help audit and identify keys that may need to be rotated.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078.004, T1078
Input: Adversaries may abuse safe mode to disable endpoint defenses that may not start with a limited boot.

Tactics: TA0005
Techniques: T1562.009, T1562
Input: The final antidebugging technique involves GetTickCount performance counters, which are placed within the main sections of code to detect any delay a debugger adds during runtime

Tactics: TA0005
Techniques: T1140
Input: CallMe uses AES to encrypt C2 traffic.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Kimsuky has compromised legitimate sites and used them to distribute malware.

Tactics: TA0042
Techniques: T1584.001, T1584
Input: Tropic Trooper sent spearphishing emails that contained malicious Microsoft Office and fake installer file attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Monitor for newly constructed network connections that are sent or received by abnormal or untrusted hosts.

Tactics: TA0010
Techniques: T1020.001, T1020
Input: Mustang Panda has also used reg save on the SYSTEM file Registry location to help extract the NTDS.dit file.

Tactics: TA0006
Techniques: T1003.003, T1003
Input: APT41 used legitimate websites for C2 through dead drop resolvers (DDR), including GitHub, Pastebin, and Microsoft TechNet.

Tactics: TA0011
Techniques: T1102.001, T1102
Input: Babuk can use "WNetOpenEnumW" and "WNetEnumResourceW" to enumerate files in network resources for encryption.

Tactics: TA0007
Techniques: T1049
Input: jRAT can gather victim internal and external IPs.

Tactics: TA0007
Techniques: T1016
Input: WhisperGate can deobfuscate downloaded files stored in reverse byte order and decrypt embedded resources using multiple XOR operations.

Tactics: TA0005
Techniques: T1140
Input: Adversaries can use this mechanism on their own malware to make sure they're able to execute in elevated contexts in the future.

Tactics: TA0004, TA0005
Techniques: T1548, T1548.001
Input: Ebury can automatically exfiltrate gathered SSH credentials.

Tactics: TA0010
Techniques: T1020
Input: Monitor for applications and processes related to remote admin tools.

Tactics: TA0011
Techniques: T1219
Input: APT-C-36 has used port 4050 for C2 communications.

Tactics: TA0011
Techniques: T1571
Input: Micropsia creates a new hidden directory to store all components' outputs in a dedicated sub-folder for each.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: SeaDuke C2 traffic is base64-encoded.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Modification of firewall rules might also consider opening local ports and services for different network profiles such as public and domain.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: A common use of this technique is with Spearphishing Attachment/Malicious File since it can trick both end users and defenders if they are not aware of how their tools display and render the RTLO character.

Tactics: TA0005
Techniques: T1036, T1036.002
Input: five threads are for forwarding collected data to four cloud services (Box, Dropbox, Pcloud and Yandex). When uploading stolen data to a cloud service

Tactics: TA0011
Techniques: T1102
Input: APT41 attempted to remove evidence of some of its activity by deleting Bash histories.

Tactics: TA0005
Techniques: T1070, T1070.003
Input: PoetRAT has used a custom encryption scheme for communication between scripts and pyminifier to obfuscate scripts.

Tactics: TA0005
Techniques: T1027
Input: LazyScripter has used a variety of open-source remote access Trojans for its operations.

Tactics: TA0042
Techniques: T1588, T1588.001
Input: Cobalt Strike has the ability to use an Excel Workbook to execute additional code by enabling Office to trust macros and execute code without user permission.

Tactics: TA0003
Techniques: T1137, T1137.001
Input: Peppy has the ability to execute shell commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: ABK has the ability to use cmd to run a Portable Executable (PE) on the compromised host.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Code executed via ListPlanting may also evade detection from security products since the execution is masked under a legitimate process.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.015
Input: Ramsay can spread itself by infecting other portable executable files on removable drives.

Tactics: TA0001, TA0008
Techniques: T1091
Input: A modification to the compute service infrastructure can include the creation, deletion, or modification of one or more components such as compute instances, virtual machines, and snapshots.

Tactics: TA0005
Techniques: T1578
Input: Train users to be suspicious about certificate errors.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.002
Input: Naikon has disguised malicious programs as Google Chrome, Adobe, and VMware executables.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: GoldenSpy can execute remote commands via the command-line interface.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Monitor newly executed processes of vaultcmd.exe for suspicious activity, such as listing credentials from the Windows Credentials locker (, vaultcmd /listcreds:"Windows Credentials").

Tactics: TA0006
Techniques: T1555, T1555.004
Input: Unknown Logger can obtain information about the victim computer name, physical memory, country, and date.

Tactics: TA0007
Techniques: T1082
Input: Monitor for changes made to windows registry keys and/or values that may use a hidden file system to conceal malicious activity from users and security tools.

Tactics: TA0005
Techniques: T1564, T1564.005
Input: Monitor for an attempt by a user to gain access to a network or computing resource, often by providing credentials that may search compromised systems to find and obtain insecurely stored credentials.

Tactics: TA0006
Techniques: T1552
Input: Several examples of this weakness in existing common installers have been reported to software vendors.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.005, T1574
Input: menuPass has searched compromised systems for folders of interest including those related to HR, audit and expense, and meeting memos.

Tactics: TA0007
Techniques: T1083
Input: By either replacing or adding illegitimate drivers (, Hijack Execution Flow), an adversary can use LSA operations to continuously execute malicious payloads.

Tactics: TA0003, TA0004
Techniques: T1547.008, T1547
Input: Downloading stylesheets allows for emended JavaScript and VBS to be run from within them, at which point any type of malware could be staged and run quite easily

Tactics: TA0002, TA0003, TA0004
Techniques: T1547.001, T1547, T1059
Input: Monitor for queried domain name system (DNS) registry data that may compromise third-party infrastructure that can be used during targeting.

Tactics: TA0042
Techniques: T1584
Input: If the machine has the value 0x419 (Russian), 0x422 (Ukrainian), or 0x423 (Belarusian), it stops execution.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: Threat Group-3390 has used net use and netstat to conduct internal discovery of systems.

Tactics: TA0007
Techniques: T1049
Input: Mustang Panda has used spearphishing attachments to deliver initial access payloads.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Trojan.Karagany can secure C2 communications with SSL and TLS.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Nidiran can create a new service named msamger (Microsoft Security Accounts Manager), which mimics the legitimate Microsoft database by the same name.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Chrommme can encrypt and store on disk collected data before exfiltration.

Tactics: TA0009
Techniques: T1560
Input: FELIXROOT downloads and uploads files to and from the victim’s machine.

Tactics: TA0011
Techniques: T1105
Input: Dyre has the ability to identify running services on a compromised host.

Tactics: TA0007
Techniques: T1007
Input: CCBkdr was added to a legitimate, signed version 5.33 of the CCleaner software and distributed on CCleaner's distribution site.

Tactics: TA0001
Techniques: T1195, T1195.002
Input: Cuba has a hardcoded list of services and processes to terminate.

Tactics: TA0040
Techniques: T1489
Input: Unpacks the code in memory via process hollowing

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: Audit applications and their permissions to ensure access to data and resources are limited based upon necessity and principle of least privilege.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: RTM has resolved Pony C2 server IP addresses by either converting Bitcoin blockchain transaction data to specific octets, or accessing IP addresses directly within the Namecoin blockchain.

Tactics: TA0011
Techniques: T1568
Input: All subsequent messages are encrypted with AES in CBC mode

Tactics: TA0005, TA0011
Techniques: T1573, T1027
Input: RGDoor encrypts files with XOR before sending them back to the C2 server.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: Enforce authentication and role-based access control on the container API to restrict users to the least privileges required.

Tactics: TA0006
Techniques: T1552, T1552.007
Input: BabyShark has used cmd.exe to execute commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Adversaries may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055.008, T1055
Input: FinFisher uses token manipulation with NtFilterToken as part of UAC bypass.

Tactics: TA0004, TA0005
Techniques: T1134, T1134.001
Input: It may also create the Registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ IMJPMIJ8.1{3 characters of Unique Identifier}.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Felismus can download files from remote servers.

Tactics: TA0011
Techniques: T1105
Input: Adversaries may also target information about victim network-based intrusion detection systems (NIDS) or other appliances related to defensive cybersecurity operations.

Tactics: TA0043
Techniques: T1590, T1590.006
Input: Since these payloads are text-based, it is also very common for adversaries to obfuscate their content as part of Obfuscated Files or Information.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Sykipot may use net start to display running services.

Tactics: TA0007
Techniques: T1007
Input: It communicates encoded system information to a single hard coded command and control (C2) server, using the system’s default User-Agent string

Tactics: TA0007, TA0011
Techniques: T1071, T1082
Input: Monitor newly executed processes that may set files and directories to be hidden to evade detection mechanisms.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: ServHelper uses HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Consider monitoring the size of virtual machines running on the system.

Tactics: TA0005
Techniques: T1564, T1564.006
Input: InvisiMole can inject its backdoor as a portable executable into a target process.

Tactics: TA0004, TA0005
Techniques: T1055.002, T1055
Input: Various COM interfaces are exposed that can be abused to invoke arbitrary execution via a variety of programming languages such as C, C++, Java, and Visual Basic.

Tactics: TA0002
Techniques: T1559, T1559.001
Input: Monitor executed commands and arguments for actions that may gather the system time and/or time zone from a local or remote system.

Tactics: TA0007
Techniques: T1124
Input: Ajax Security Team has used various social media channels to spearphish victims.

Tactics: TA0001
Techniques: T1566.003, T1566
Input: Clambling has gained execution through luring victims into opening malicious files.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Turla RPC backdoors can be used to transfer files to/from victim machines on the local network.

Tactics: TA0008
Techniques: T1570
Input: Bandook can collect local files from the system .

Tactics: TA0009
Techniques: T1005
Input: Debuggers can also be evaded by detaching the process or flooding debug logs with meaningless data via messages produced by looping Native API function calls such as OutputDebugStringW().

Tactics: TA0005, TA0007
Techniques: T1622
Input: Prevent adversary access to privileged accounts or access necessary to perform this technique.

Tactics: TA0003, TA0005
Techniques: T1542.001, T1542
Input: Torisma can use GetlogicalDrives to get a bitmask of all drives available on a compromised system.

Tactics: TA0007
Techniques: T1082
Input: RemoteUtilities can upload and download files to and from a target machine.

Tactics: TA0011
Techniques: T1105
Input: Transparent Tribe has crafted malicious files to exploit CVE-2012-0158 and CVE-2010-3333 for execution.

Tactics: TA0002
Techniques: T1203
Input: In green, functions from Keychaindump C&C communication Keydnap is using the onion.to Tor2Web proxy over HTTPS to report back to its C&C server

Tactics: TA0011
Techniques: T1090
Input: Neoichor can use the Internet Explorer (IE) COM interface to connect and receive commands from C2.

Tactics: TA0002
Techniques: T1559, T1559.001
Input: Modifying the Dll and FuncName Registry values in HKLM\SOFTWARE[WOW6432Node]Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData{SIP_GUID} that point to the DLL providing a SIP’s CryptSIPDllVerifyIndirectData function, which validates a file’s computed hash against the signed hash value. By pointing to a maliciously-crafted DLL with an exported function that always returns TRUE (indicating that the validation was successful), an adversary can successfully validate any file (with a legitimate signature) using that SIP  (with or without hijacking the previously mentioned CryptSIPDllGetSignedDataMsg function). This Registry value could also be redirected to a suitable exported function from an already present DLL, avoiding the requirement to drop and execute a new file on disk.

Tactics: TA0005
Techniques: T1553, T1553.003
Input: A USB data collecting tool that checks for a connected USB drive and steals certain file types, encrypting them into a RAR file.

Tactics: TA0009
Techniques: T1025
Input: The analysis of the tools and techniques used in the Astaroth campaign show how truly effective LOLbins are at evading antivirus products

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Technical Databases or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services).

Tactics: TA0043
Techniques: T1590, T1590.004
Input: A JPIN variant downloads the backdoor payload via the BITS service.

Tactics: TA0003, TA0005
Techniques: T1197
Input: TrickBot has used macros in Excel documents to download and deploy the malware on the user’s machine.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Additionally, some of this early activity shares a similarity with current FIN7 operations – the use of Power Admin PAExec for lateral movement

Tactics: TA0008
Techniques: T1021, T1021.002
Input: For instance, here are the resulting decrypted strings from each of the case statements (dd7e69e1…): Case – String decrypted 1 – 185.25.50[.]93 2 – POST http://185.25.50[.]93/syshelp/kd8812u/protocol.php HTTP/1.1\r\nHost: 185.25.50[.]93\r\nContent-Type: application/x-www-form-urlencoded\r\nContent-Length: 3 – porg= 4 – Content-Length: The Trojan uses raw sockets to communicate with its C2 server and uses the decrypted string above to create HTTP requests

Tactics: TA0005, TA0011
Techniques: T1140, T1071, T1008
Input: While detecting adversaries accessing credentials may be difficult without knowing they exist in the environment, it may be possible to detect adversary use of credentials they have obtained.

Tactics: TA0006
Techniques: T1552
Input: Cobalt Group has obtained and used a variety of tools including Mimikatz, PsExec, Cobalt Strike, and SDelete.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Remove smart cards when not in use.

Tactics: TA0006
Techniques: T1111
Input: The files we recovered indicate they do it by executing a script file, which uses the Sysinternals  psexec tool to move laterally by trying to copy it to every machine they can reach:

Tactics: TA0002
Techniques: T1569.002, T1569
Input: When an attempt is made to access a securable object, the system checks the access control entries in the DACL in order.

Tactics: TA0005
Techniques: T1222, T1222.001
Input: Monitor executed commands and arguments that may establish persistence through executing malicious commands triggered by a user’s shell.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: The Trojan will then use the following regular expression to check the HTTP response to the content upload request for the file identifier value: \”id\”:(.*) The Trojan will use this file identifier value to monitor for changes made to the file by the actor by checking for changes to the modification time of the <process ID of Trojan>.txt file

Tactics: TA0005
Techniques: T1070, T1070.006
Input: OilRig has used credential dumping tool named VALUEVAULT to steal credentials from the Windows Credential Manager.

Tactics: TA0006
Techniques: T1555, T1555.004
Input: Monitor newly executed processes that may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system.

Tactics: TA0003
Techniques: T1137, T1137.004
Input: Bankshot collects files from the local system.

Tactics: TA0009
Techniques: T1005
Input: VaporRage has the ability to check for the presence of a specific DLL and terminate if it is not found.

Tactics: TA0005
Techniques: T1480
Input: Adversaries can also change configuration settings within the AD environment to implement a Rogue Domain Controller.

Tactics: TA0004, TA0005
Techniques: T1484
Input: Comnie uses RC4 and Base64 to obfuscate strings.

Tactics: TA0005
Techniques: T1027
Input: RTM has used search order hijacking to force TeamViewer to load a malicious DLL.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Group policy allows for centralized management of user and computer settings in Active Directory (AD).

Tactics: TA0004, TA0005
Techniques: T1484.001, T1484
Input: This behavior will likely not result in elevated privileges since the injected process was spawned from (and thus inherits the security context) of the injecting process.

Tactics: TA0004, TA0005
Techniques: T1055.013, T1055.012, T1055
Input: Ensure that all wired and/or wireless traffic is encrypted appropriately.

Tactics: TA0006, TA0007, TA0009
Techniques: T1557, T1040, T1557.002
Input: Koadic can run a command on another machine using PsExec.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: APT32 regularly used stealthy techniques to blend in with legitimate user activity:  During one investigation, APT32 was observed using a privilege escalation exploit (CVE-2016-7255) masquerading as a Windows hotfix

Tactics: TA0004
Techniques: T1068
Input: Chrommme can set itself to sleep before requesting a new command from C2.

Tactics: TA0010
Techniques: T1029
Input: 33 Download specified file to %TEMP%\up and execute it in a new process      During C2 communications, BADNEWS will communicate to the C2 previously identified via HTTP

Tactics: TA0011
Techniques: T1071
Input: We found a mechanism for decrypting, executing, and downloading an additional payload from the C&C server.

Tactics: TA0011
Techniques: T1105
Input: The diagram in Figure 1 shows the samples, domains, IP addresses and e-mail addresses that we identified during our investigation (See Appendix B for more detail on these.) There is a clear split between Cluster A and Cluster B, with no infrastructure overlap between the two

Tactics: TA0007
Techniques: T1016
Input: Peirates can query the Kubernetes API for secrets.

Tactics: TA0006
Techniques: T1552, T1552.007
Input: This can be complemented by restricting direct internet access to the company’s internal networks while using proxies to access external resources

Tactics: TA0011
Techniques: T1090
Input: Rocke has spread its coinminer via SSH.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: FIN8 harvests credentials using Invoke-Mimikatz or Windows Credentials Editor (WCE).

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Specifies the screen coordinates to take   -zip Name of password (from configuration data) protected zip archive   -clipboard Screenshot file name where a bitmap from the clipboard is saved in Cache005 subdirectory, zipped with password from configuration    Data exfiltration Exfiltration is done through the bitsadmin.exe utility

Tactics: TA0009, TA0011
Techniques: T1115, T1132, T1560, T1113
Input: Threat Group-3390 has packed malware and tools.

Tactics: TA0005
Techniques: T1027.002, T1027