madox81/Adema_ATTACK_DS huggingface dataset:
Input: BADCALL collects the network adapter information.

Tactics: TA0007
Techniques: T1016
Input: RGDoor uploads and downloads files to and from the victim’s machine.

Tactics: TA0011
Techniques: T1105
Input: PLATINUM has used keyloggers that are also capable of dumping credentials.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Olympic Destroyer utilizes PsExec to help propagate itself across a network.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: APT41 performed password brute-force attacks on the local admin account.

Tactics: TA0006
Techniques: T1110, T1110.002
Input: Timezone Check The Trojan check to see if the system is configured (“DaylightName”) with one of the following time zones:   Arabic Daylight Time (UTC+3) Arab Daylight Time (UTC+3) Arabian Daylight Time (UTC+4) Middle East Daylight Time (UTC+2) Iran Daylight Time (UTC+3.5)   Human Interaction Check Before executing its functional code, the Trojan presents a dialog box with the following line of code:   Interaction.MsgBox(encodedStringClass.return_user32_bogus_errorcode_(3), MsgBoxStyle.Critical, null);   This dialog box displays  An error occurred while processing user32.dll!, which the user must click the ok button for the Trojan to run its functional code

Tactics: TA0007
Techniques: T1124
Input: APT29 renamed software and DLL's with legitimate names to appear benign.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: TEMP.Veles has obtained and used tools such as Mimikatz and PsExec.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: APT38 used a backdoor, NESTEGG, that has the capability to download and upload files to and from a victim’s machine.

Tactics: TA0011
Techniques: T1105
Input: Bundlore has leveraged /bin/sh and /bin/bash to execute commands on the victim machine.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: HTTPBrowser deletes its original installer file once installation is complete.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Process monitoring may be used to detect servers components that perform suspicious actions such as running cmd.exe or accessing files.

Tactics: TA0003
Techniques: T1505
Input: Darkhotel has used first-stage payloads that download additional malware from C2 servers.

Tactics: TA0011
Techniques: T1105
Input: TrickBot collects the users of the system.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: The executable version of Helminth has a module to log keystrokes.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Examples may include appending/prepending data with junk characters or writing junk characters between significant characters.

Tactics: TA0011
Techniques: T1001.001, T1001
Input: HyperBro has the ability to run an application (CreateProcessW) or script/file (ShellExecuteW) via API.

Tactics: TA0002
Techniques: T1106
Input: APT41 has obtained and used tools such as Mimikatz, pwdump, PowerSploit, and Windows Credential Editor.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Elderwood has delivered zero-day exploits and malware to victims by injecting malicious code into specific public Web pages visited by targets within a particular sector.

Tactics: TA0001
Techniques: T1189
Input: Microsoft's Enhanced Mitigation Experience Toolkit (EMET) Attack Surface Reduction (ASR) feature can be used to block methods of using using trusted binaries to bypass application control.

Tactics: TA0005
Techniques: T1218
Input: HTTPBrowser is capable of spawning a reverse shell on a victim.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Chaes has used HTTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Modules can be pushed to and executed by Duqu that copy data to a staging area, compress it, and XOR encrypt it.

Tactics: TA0009
Techniques: T1560.003, T1560, T1074.001, T1074
Input: Magic Hound has downloaded additional code and files from servers onto victims.

Tactics: TA0011
Techniques: T1105
Input: Commands such as net user /domain and net group /domain of the Net utility, dscacheutil -q groupon macOS, and ldapsearch on Linux can list domain users and groups.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: Limit which user accounts are allowed to login via SSH.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: Ensure that endpoint defenses run in safe mode.

Tactics: TA0005
Techniques: T1562.009, T1562
Input: This most likely means there is some type of DLL hijacking going on by distributing a legitimate McAfee binary with MirageFox to load up the DLL properly into a legitimate looking process

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Adversaries may conduct File and Directory Permissions Modification or Modify Registry in support of subverting these controls.

Tactics: TA0005
Techniques: T1553
Input: MySQL (3306/TCP)

Tactics: TA0006
Techniques: T1110.004, T1110, T1110.001, T1110.003
Input: BBSRAT can query service configuration information.

Tactics: TA0007
Techniques: T1007
Input: yty gathers information on victim’s drives and has a plugin for document listing.

Tactics: TA0007
Techniques: T1083
Input: For example, by using the Google Cloud CLI’s "add-metadata" command an adversary may add SSH keys to a user account.

Tactics: TA0003
Techniques: T1098.004, T1098
Input: SamSam uses custom batch scripts to execute some of its components.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: CosmicDuke collects LSA secrets.

Tactics: TA0006
Techniques: T1003, T1003.004
Input: ZxShell can launch a reverse command shell.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Monitor for creation of binaries and service executables that do not occur during a regular software update or an update scheduled by the organization.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.010, T1574
Input: AppleSeed can enumerate the current process on a compromised host.

Tactics: TA0007
Techniques: T1057
Input: Windows logging is able to collect success/failure for accounts that may be used to move laterally and can be collected using tools such as Windows Event Forwarding.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Office applications from creating child processes and from writing potentially malicious executable content to disk.

Tactics: TA0003
Techniques: T1137.002, T1137, T1137.001, T1137.004, T1137.006, T1137.003, T1137.005
Input: This excellent whitepaper by William Ballenthin, Matt Graeber and Claudiu Teodorescu contains additional information on WMI offense, defense and forensics

Tactics: TA0002
Techniques: T1047
Input: Adversaries may create an account to maintain access to victim systems.

Tactics: TA0003
Techniques: T1136
Input: Ensure all COM alerts and Protected View are enabled.

Tactics: TA0002, TA0008
Techniques: T1559, T1021.003, T1559.001, T1021
Input: Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations.

Tactics: TA0009
Techniques: T1113
Input: Adversaries may compromise accounts with services that can be used during targeting.

Tactics: TA0042
Techniques: T1586
Input: Waterbear can query the Registry key "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSDTC\MTxOCI" to see if the value OracleOcilib exists.

Tactics: TA0007
Techniques: T1012
Input: Information about hosts may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites).

Tactics: TA0043
Techniques: T1592
Input: Location, format, and type of artifact (such as command or login history) are often specific to each platform.

Tactics: TA0005
Techniques: T1070
Input: It also allows macro code to access internal VBA objects for stealthier macro code execution in future attacks

Tactics: TA0005
Techniques: T1140
Input: These credentials are used with PsExec and Windows Management Instrumentation to help the malware propagate itself across a network.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: HotCroissant has used the open source UPX executable packer.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: DRATzarus can use IsDebuggerPresent to detect whether a debugger is present on a victim.

Tactics: TA0005, TA0007
Techniques: T1622
Input: Implementing LAPS may help prevent reuse of local administrator credentials across a domain.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.003
Input: ThiefQuest installs a launch item using an embedded encrypted launch agent property list template.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: File is dropped to C:\Users\%USERNAME%\AppData\Roaming\Microsoft Network\microsoft_network\1.0.0.0\microsoft_network.exe

Tactics: TA0007
Techniques: T1033
Input: SharpStage has the ability to create persistence for the malware using the Registry autorun key and startup folder.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Adversaries may do this to hide security alerts, C2 communication, or responses to Internal Spearphishing emails sent from the compromised account.

Tactics: TA0005
Techniques: T1564, T1564.008
Input: WinRM is the name of both a Windows service and a protocol that allows a user to interact with a remote system (, run an executable, modify the Registry, modify services).

Tactics: TA0008
Techniques: T1021, T1021.006
Input: build_downer can extract malware from a downloaded JPEG.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: Metamorfo has performed process name checks and has monitored applications.

Tactics: TA0007
Techniques: T1057
Input: Monitor for logged network traffic in response to a scan showing both protocol header and body values that may buy and/or steal capabilities that can be used during targeting.

Tactics: TA0042
Techniques: T1588
Input: FinFisher probes the system to check for antimalware processes.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Machete has delivered spearphishing emails that contain a zipped file with malicious contents.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Lazarus Group has used multiple types of encryption and encoding for their payloads, including AES, Caracachs, RC4, XOR, Base64, and other tricks such as creating aliases in code for Native API function names.

Tactics: TA0005
Techniques: T1027
Input: Taidoor can query the Registry on compromised hosts using RegQueryValueExA.

Tactics: TA0007
Techniques: T1012
Input: The GuLoader executable has been retrieved via embedded macros in malicious Word documents.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: If it detects that it is, it will exit.

Tactics: TA0005, TA0007
Techniques: T1497
Input: This could include suspicious files written to disk, evidence of Process Injection for attempts to hide execution or evidence of Discovery.

Tactics: TA0004
Techniques: T1068
Input: Following the compromise of this system, analysts identified FIN6 leveraged stolen credentials to move laterally within the environment using the Windows’ Remote Desktop Protocol (RDP).

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Metamorfo has searched the compromised system for banking applications.

Tactics: TA0007
Techniques: T1518
Input: Use application control configured to block execution of InstallUtil.exe if it is not required for a given system or network to prevent potential misuse by adversaries.

Tactics: TA0005
Techniques: T1218, T1218.004
Input: Several of the tools mentioned in associated sub-techniques may be used by both adversaries and professional security testers.

Tactics: TA0006
Techniques: T1003
Input: SHOTPUT has a command to obtain a process listing.

Tactics: TA0007
Techniques: T1057
Input: APT29 has created self-signed digital certificates to enable mutual TLS authentication for malware.

Tactics: TA0042
Techniques: T1587, T1587.003
Input: Aquatic Panda has attempted to discover services for third party EDR products.

Tactics: TA0007
Techniques: T1007
Input: Suckfly the victim's internal network for hosts with ports 8080, 5900, and 40 open.

Tactics: TA0007
Techniques: T1046
Input: SombRAT can execute getinfo to enumerate the computer name and OS version of a compromised system.

Tactics: TA0007
Techniques: T1082
Input: Lokibot has used PowerShell commands embedded inside batch scripts.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Chimera has used compromised domain accounts to gain access to the target environment.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.002
Input: Carberp has maintained persistence by placing itself inside the current user's startup folder.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges.

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: Dtrack can add a service called WBService to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Bankshot deletes all artifacts associated with the malware from the infected machine.

Tactics: TA0005
Techniques: T1070
Input: Such control can allow for redirection of an organization's traffic, facilitating Collection and Credential Access efforts for the adversary.

Tactics: TA0042
Techniques: T1584.002, T1584
Input: Egregor can perform a  long sleep (greater than or equal to 3 minutes) to evade detection.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Prior to Code Signing, adversaries may develop self-signed code signing certificates for use in operations.

Tactics: TA0042
Techniques: T1587.002, T1587
Input: Green Lambert can add a plist file in the Library/LaunchDaemons to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: DCShadow is a method of manipulating Active Directory (AD) data, including objects and schemas, by registering (or reusing an inactive registration) and simulating the behavior of a DC.

Tactics: TA0005
Techniques: T1207
Input: Adversaries will likely need to learn about an environment and the relationships between systems through Discovery techniques prior to attempting Lateral Movement.

Tactics: TA0008
Techniques: T1021
Input: QakBot can use cmd.exe to launch itself and to execute multiple C2 commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Adversaries may exploit software vulnerabilities in client applications to execute code.

Tactics: TA0002
Techniques: T1203
Input: Hijacking SIP or trust provider components can also enable persistent code execution, since these malicious components may be invoked by any application that performs code signing or signature validation.

Tactics: TA0005
Techniques: T1553, T1553.003
Input: APT29 has gained access through compromised accounts at cloud solution partners, and used compromised certificates issued by Mimecast to authenticate to Mimecast customer systems.

Tactics: TA0001
Techniques: T1199
Input: APT28 close-access teams have used Wi-Fi pineapples to intercept Wi-Fi signals and user credentials.

Tactics: TA0006, TA0007
Techniques: T1040
Input: SDBbot has the ability to use port forwarding to establish a proxy between a target host and C2.

Tactics: TA0011
Techniques: T1090
Input: PowerDuke has a command to write random data across a file and delete it.

Tactics: TA0005, TA0040
Techniques: T1070, T1485, T1070.004
Input: OilRig has used brute force techniques to obtain credentials.

Tactics: TA0006
Techniques: T1110
Input: If this file exists, the content is read in order to obtain a path to find a second file with the LNK (link) extension

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: BRONZE BUTLER typically use ping and Net to enumerate systems.

Tactics: TA0007
Techniques: T1018
Input: Until the write handle transaction is terminated, all other handles are isolated from the writer and may only read the committed version of the file that existed at the time the handle was opened.

Tactics: TA0004, TA0005
Techniques: T1055.013, T1055
Input: Windigo has distributed Windows malware via drive-by downloads.

Tactics: TA0001
Techniques: T1189
Input: Operation Wocao has enabled Wdigest by changing the registry value from 0 to 1.

Tactics: TA0005
Techniques: T1112
Input: NDiskMonitor can obtain a list of all files and directories as well as logical drives.

Tactics: TA0007
Techniques: T1083
Input: Nebulae can download files from C2.

Tactics: TA0011
Techniques: T1105
Input: This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.

Tactics: TA0005
Techniques: T1036
Input: The Winnti for Windows installer loads a DLL using rundll32.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Lucifer can collect the computer name, system architecture, default language, and processor frequency of a compromised host.

Tactics: TA0007
Techniques: T1082
Input: Application access tokens are used to make authorized API requests on behalf of a user or service and are commonly used as a way to access resources in cloud and container-based applications and software-as-a-service (SaaS).

Tactics: TA0005, TA0006, TA0008
Techniques: T1550.001, T1528, T1550
Input: Adversaries may attempt to get a listing of cloud accounts.

Tactics: TA0007
Techniques: T1087, T1087.004
Input: BlackMould has the ability to find files on the targeted system.

Tactics: TA0007
Techniques: T1083
Input: Carbon establishes persistence by creating a service and naming it based off the operating system version running on the current machine.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection.

Tactics: TA0005
Techniques: T1564, T1564.004
Input: Cobalt Strike can use a number of known techniques to bypass Windows UAC.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Limiting DLL module loads to %SystemRoot% and %ProgramFiles% directories will protect against module loads from unsafe paths.

Tactics: TA0002
Techniques: T1129
Input: Agent Tesla can list the current running processes on the system.

Tactics: TA0007
Techniques: T1057
Input: Derusbi is capable of enumerating Registry keys and values.

Tactics: TA0007
Techniques: T1012
Input: WindTail has been incompletely signed with revoked certificates.

Tactics: TA0005
Techniques: T1036, T1036.001
Input: All the strings and settings were encrypted and obfuscated

Tactics: TA0005
Techniques: T1027
Input: Neoichor can clear the browser history on a compromised host by changing the ClearBrowsingHistoryOnExit value to 1 in the HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Privacy Registry key.

Tactics: TA0005
Techniques: T1070
Input: Trojan.Karagany can create a link to itself in the Startup folder to automatically start itself upon system restart.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: GravityRAT steals files based on an extension list if a USB drive is connected to the system.

Tactics: TA0009
Techniques: T1025
Input: Devices such as routers and firewalls can be used to create boundaries between trusted and untrusted networks.

Tactics: TA0005
Techniques: T1599
Input: On the SYSVOL share, adversaries may use the following command to enumerate potential GPP XML files: dir /s * .xml

Tactics: TA0006
Techniques: T1552, T1552.006
Input: GALLIUM has used a variety of widely-available tools, which in some cases they modified to add functionality and/or subvert antimalware solutions.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: CORESHELL contains unused machine instructions in a likely attempt to hinder analysis.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: Monitor and investigate attempts to modify ACLs and file/directory ownership.

Tactics: TA0005
Techniques: T1222.002, T1222
Input: Cyclops Blink can use DNS over HTTPS (DoH) to resolve C2 nodes.

Tactics: TA0011
Techniques: T1572
Input: Winnti for Windows can check if the explorer.exe process is responsible for calling its install function.

Tactics: TA0007
Techniques: T1057
Input: ECCENTRICBANDWAGON has stored keystrokes and screenshots within the %temp%\GoogleChrome, %temp%\Downloads, and %temp%\TrendMicroUpdate directories.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: FatDuke can decrypt AES encrypted C2 communications.

Tactics: TA0005
Techniques: T1140
Input: InvisiMole has disguised its droppers as legitimate software or documents, matching their original names and locations, and saved its files as mpr.dll in the Windows folder.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: This method makes no changes to the Registry as the COM object is not actually registered, only executed.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Monitor the AppCertDLLs Registry value for modifications that do not correlate with known software, patch cycles,

Tactics: TA0003, TA0004
Techniques: T1546.009, T1546
Input: Flagpro has been used to execute the ipconfig /all command on a victim system.

Tactics: TA0007
Techniques: T1016
Input: Additional Reading This PowerShell logging blog post contains more information on improving PowerShell visibility in your environment

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Both methods require a password, where the default password for the Login Keychain is the current user’s password to login to the macOS host.

Tactics: TA0006
Techniques: T1555.001, T1555
Input: When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.

Tactics: TA0011
Techniques: T1568
Input: EvilBunny has used the API calls NtQuerySystemTime, GetSystemTimeAsFileTime, and GetTickCount to gather time metrics as part of its checks to see if the malware is running in a sandbox.

Tactics: TA0007
Techniques: T1124
Input: The string “fjzmpcjvqp” is unique and not something likely to be present if the code was not generated with the same public POC exploit code

Tactics: TA0005
Techniques: T1140, T1027, T1027.001
Input: These are typically obtained through the operating systems package manager and installed like a normal package.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: This tactic uses public web services to host content that contains encoded commands that are decoded by the malware

Tactics: TA0011
Techniques: T1102
Input: OilRig has used net localgroup administrators to find local administrators on compromised systems.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: Ramsay can use Windows API functions such as WriteFile, CloseHandle, and GetCurrentHwProfile during its collection and file storage operations.

Tactics: TA0002
Techniques: T1106
Input: Adversaries may execute their own malicious payloads by hijacking environment variables used to load libraries.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.007, T1574
Input: APT28 has used several malicious applications to steal user OAuth access tokens including applications masquerading as "Google Defender" "Google Email Protection," and "Google Scanner" for Gmail users.

Tactics: TA0006
Techniques: T1528
Input: ServHelper will attempt to enumerate Windows version and system architecture.

Tactics: TA0007
Techniques: T1082
Input: Gelsemium can enumerate running processes.

Tactics: TA0007
Techniques: T1057
Input: TAINTEDSCRIBE can delete files from a compromised host.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: XCSSET loads a system level launchdaemon using the launchctl load -w command from /System/Librarby/LaunchDaemons/ssh.plist.

Tactics: TA0002
Techniques: T1569.001, T1569
Input: Operate intrusion detection, analysis, and response systems on a separate network from the production environment to lessen the chances that an adversary can see and interfere with critical response functions.

Tactics: TA0040
Techniques: T1489
Input: ComRAT can check the victim's default browser to determine which process to inject its communications module into.

Tactics: TA0007
Techniques: T1518
Input: Agent Tesla can collect the system's computer name and also has the capability to collect information on the processor, memory, OS, and video card from the system.

Tactics: TA0007
Techniques: T1082