madox81/Adema_ATTACK_DS huggingface dataset:
Input: The data may also be sent to an alternate network location from the main command and control server.

Tactics: TA0010
Techniques: T1048.002, T1048.003, T1048, T1048.001
Input: APT32 has used PowerShell-based tools, PowerShell one-liners, and shellcode loaders for execution.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Adversaries may also use services to install and execute malicious drivers.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Ke3chang has obtained and used tools such as Mimikatz.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: This can be used to limit the number of egress points, or provide access to a host without direct internet access.

Tactics: TA0011
Techniques: T1090.001, T1090
Input: Ebury has encrypted C2 traffic using the client IP address, then encoded it as a hexadecimal string.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: EvilGrab adds a Registry Run key for ctfmon.exe to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: AADInternals can gather information about a tenant’s domains using public Microsoft APIs.

Tactics: TA0043
Techniques: T1590, T1590.001
Input: ComRAT has used cmd.exe to execute commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Shamoon copies an executable payload to the target system by using SMB/Windows Admin Shares and then scheduling an unnamed task to execute the malware.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: You can see that in addition to the code, the author copy-pasted English typos such as "IE Registery":PDB PathsWe can clearly identify a pattern in the PDB naming convention of all the binaries mentioned in this article.ROKRAT:e:\Happy\Work\Source\version 12\T+M\Result\DocPrint.pdb (from the "Evil New Year" campaign)d:\HighSchool\version 13\2ndBD\T+M\T+M\Result\DocPrint.pdb (from the "North Korean Human Rights" campaignD:\HighSchool\version 13\First-Dragon(VS2015)\Sample\Release\DogCall.pdb (ROKRAT Sample from an unidentified campaign from June)Wiper:D:\HighSchool\version 13\VC2008(Version15)\T+M\T+M\TMProject\Release\ErasePartition.pdb (From the "Are You Happy?" campaign)Summary GraphHere is a graph to visualize the similarities and differences between each campaign mentioned in this article:ConclusionSouth Korea is becoming an important target for malicious actors and the techniques used are becoming specific to the region (for example: use of native language to try and ensure the targets feel that the information, document or email being sent to them has added legitimacy)

Tactics: TA0007
Techniques: T1082
Input: Remsec has a plugin to detect active drivers of some security products.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: SideTwist can encrypt C2 communications with a randomly generated key.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Fox Kitten has obtained files from the victim's cloud storage instances.

Tactics: TA0009
Techniques: T1530
Input: During privilege escalation, freely available tools such as Mimikatz and Ncrack have been observed, in addition to legitimate tools such as Windows Credential Editor and ProcDump

Tactics: TA0006
Techniques: T1003
Input: NBTscan can dump and print whole packet content.

Tactics: TA0006, TA0007
Techniques: T1040
Input: down_new has the ability to identify the system volume information of a compromised host.

Tactics: TA0007
Techniques: T1082
Input: To wipe disk content, adversaries may acquire direct access to the hard drive in order to overwrite arbitrarily sized portions of disk with random data.

Tactics: TA0040
Techniques: T1561.001, T1561
Input: There is no restriction on the number of custom time providers registrations, though each may require a DLL payload written to disk.

Tactics: TA0003, TA0004
Techniques: T1547.003, T1547
Input: HyperStack can connect to the IPC$ share on remote machines.

Tactics: TA0002
Techniques: T1559
Input: Common uses include hosting malicious scripts on websites as part of a Drive-by Compromise or downloading and executing these script files as secondary payloads.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Some variants of Cherry Picker use AppInit_DLLs to achieve persistence by creating the following Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows "AppInit_DLLs"="pserver32.dll"

Tactics: TA0003, TA0004
Techniques: T1546, T1546.010
Input: Clambling can inject into the svchost.exe process for execution.

Tactics: TA0004, TA0005
Techniques: T1055
Input: APT28 has used a Powershell cmdlet to grant the ApplicationImpersonation role to a compromised account.

Tactics: TA0003
Techniques: T1098.002, T1098
Input: LockerGoga has been observed shutting down infected systems.

Tactics: TA0040
Techniques: T1529
Input: Frankenstein has used trojanized documents that retrieve remote templates from an adversary-controlled website.

Tactics: TA0005
Techniques: T1221
Input: Monitor for contextual data about an account that may attempt to access detailed information about the password policy used within an enterprise network or cloud environment.

Tactics: TA0007
Techniques: T1201
Input: Group Policy allows for centralized management of user and computer settings in Active Directory (AD).

Tactics: TA0007
Techniques: T1615
Input: Agent Tesla has the ability to extract credentials from configuration or support files.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: APT32 also encrypts the library used for network exfiltration with AES-256 in CBC mode in their macOS backdoor.

Tactics: TA0005
Techniques: T1027
Input: ObliqueRAT can discover pluggable/removable drives to extract files from.

Tactics: TA0007
Techniques: T1120
Input: One way of explicitly assigning the PPID of a new process is via the CreateProcess API call, which supports a parameter that defines the PPID to use.

Tactics: TA0004, TA0005
Techniques: T1134.004, T1134
Input: In the event this is successful, the malware will use the following path to store any dropped files:  %COMMONPROGRAMFILES%\services\  In the event it is not successful, this alternative path will be used instead:  %APPDATA%\microsoft\mmc\  Reaver.v2 proceeds to decrypt an embedded file using a simple XOR obfuscation routine

Tactics: TA0005
Techniques: T1140
Input: Locations where profile.ps1 can be stored should be monitored for new profiles.

Tactics: TA0003, TA0004
Techniques: T1546.013, T1546
Input: Monitor for unexpected windows registry key being accessed that may search compromised systems to find and obtain insecurely stored credentials.

Tactics: TA0006
Techniques: T1552
Input: Green Lambert can use Keychain Services API functions to find and collect passwords, such as SecKeychainFindInternetPassword and SecKeychainItemCopyAttributesAndData.

Tactics: TA0006
Techniques: T1555.001, T1555
Input: Use network appliances and host-based security software to block network traffic that is not necessary within the environment, such as legacy protocols that may be leveraged for AiTM conditions.

Tactics: TA0006, TA0009
Techniques: T1557
Input: Executable-Signing Certificates Samples are usually signed with a fake certificate – we’ve seen two instances, one AMD and one Intel:  Configuration files: Some of the malware uses an encrypted configuration file which is stored on disk as “racss.dat”

Tactics: TA0005
Techniques: T1553, T1553.002, T1027
Input: Plist files are structured metadata in key-value pairs formatted in XML based on Apple's Core Foundation DTD.

Tactics: TA0005
Techniques: T1647
Input: Similar to File and Directory Discovery on a local host, after identifying available storage services ( Cloud Infrastructure Discovery) adversaries may access the contents/objects stored in cloud infrastructure.

Tactics: TA0007
Techniques: T1619
Input: Kimsuky has decoded malicious VBScripts using Base64.

Tactics: TA0005
Techniques: T1140
Input: There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain.

Tactics: TA0006
Techniques: T1555.001, T1555
Input: Proton kills security tools like Wireshark that are running.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Monitor for abnormal presence of these or other utilities that enable proxy execution that are typically used for development, debugging, and reverse engineering on a system that is not used for these purposes may be suspicious.

Tactics: TA0005
Techniques: T1127
Input: The Windows module loader can be instructed to load DLLs from arbitrary local paths and arbitrary Universal Naming Convention (UNC) network paths.

Tactics: TA0002
Techniques: T1129
Input: menuPass has used tools to exploit the ZeroLogon vulnerability (CVE-2020-1472).

Tactics: TA0008
Techniques: T1210
Input: Kimsuky has downloaded additional malware with scheduled tasks.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Popular open source projects that are used as dependencies in many applications may be targeted as a means to add malicious code to users of the dependency.

Tactics: TA0001
Techniques: T1195.001, T1195
Input: Bankshot recursively generates a list of files within a directory and sends them back to the control server.

Tactics: TA0009
Techniques: T1119
Input: In Kubernetes, a CronJob may be used to schedule a Job that runs one or more containers to perform specific tasks.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.007, T1053
Input: APT19 also used an HTTP malware variant to communicate over HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Capturing token input (including a user's personal identification code) may provide temporary access ( replay the one-time passcode until the next value rollover) as well as possibly enabling adversaries to reliably predict future authentication values (given access to both the algorithm and any seed values used to generate appended temporary codes).

Tactics: TA0006
Techniques: T1111
Input: Fox Kitten has used the Softerra LDAP browser to browse documentation on service accounts.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: Silence has used Winexe to install a service on the remote system.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Carbanak downloads an executable and injects it directly into a new process.

Tactics: TA0004, TA0005
Techniques: T1055.002, T1055
Input: Techniques for name service resolution poisoning, such as LLMNR/NBT-NS Poisoning and SMB Relay, can also be used to capture credentials to websites, proxies, and internal systems by redirecting traffic to an adversary.

Tactics: TA0006, TA0007
Techniques: T1040
Input: Pupy can communicate using multiple transports, migrate into processes using reflective injection, and load remote python code, python packages and python C-extensions from memory

Tactics: TA0004, TA0005
Techniques: T1055
Input: RunningRAT adds itself to the Registry key Software\Microsoft\Windows\CurrentVersion\Run to establish persistence upon reboot.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Hydraq creates a backdoor through which remote attackers can retrieve system information, such as CPU speed, from Registry keys.

Tactics: TA0007
Techniques: T1012
Input: GreyEnergy encrypts communications using AES256.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Pysa has used brute force attempts against a central management console, as well as some Active Directory accounts.

Tactics: TA0006
Techniques: T1110
Input: Disable the default to "hide file extensions for known file types" in Windows OS.

Tactics: TA0005
Techniques: T1036, T1036.007
Input: FIN6 has used a script to iterate through a list of compromised PoS systems, copy and remove data to a log file, and to bind to events from the submit payment button.

Tactics: TA0009
Techniques: T1119
Input: The group has also used tunneling tools to tunnel RDP into the environment.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Monitor for suspicious descendant process spawning from Microsoft Office and other productivity software.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Restrict execution of particularly vulnerable binaries to privileged accounts or groups that need to use it to lessen the opportunities for malicious usage.

Tactics: TA0005
Techniques: T1218
Input: XAgentOSX contains keylogging functionality that will monitor for active application windows and write them to the log, it can handle special characters, and it will buffer by default 50 characters before sending them out over the C2 infrastructure.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services.

Tactics: TA0006
Techniques: T1552, T1552.002
Input: GALLIUM established persistence for PoisonIvy by created a scheduled task.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Screenshot provided in leak showing administrative panel for hosting provider Berbid Server The screenshot showed the administrative panel for a VPS account on DeltaHost with four different virtual servers, as seen in Figure 20

Tactics: TA0009
Techniques: T1113
Input: APT28 uses a tool to infect connected USB devices and transmit itself to air-gapped computers when the infected USB device is inserted.

Tactics: TA0001, TA0008
Techniques: T1091
Input: Lazarus Group has also used shellcode within macros to decrypt and manually map DLLs into memory at runtime.

Tactics: TA0005
Techniques: T1620
Input: Threat Group-3390 has used a variety of Web shells.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Ixeshe can download and execute additional files.

Tactics: TA0011
Techniques: T1105
Input: Microsoft Office documents can be poisoned with DDE commands, directly or through embedded files, and used to deliver execution via Phishing campaigns or hosted Web content, avoiding the use of Visual Basic for Applications (VBA) macros.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: EvilBunny has been observed querying installed antivirus software.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Raindrop used steganography to locate the start of its encoded payload within legitimate 7-Zip code.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: MegaCortex can enable SeDebugPrivilege and adjust token privileges.

Tactics: TA0004, TA0005
Techniques: T1134
Input: Daserf uses file and folder names related to legitimate programs in order to blend in, such as HP, Intel, Adobe, and perflogs.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Monitor for API calls to the SetWindowsHookEx and SetWinEventHook functions, which install a hook procedure.

Tactics: TA0006, TA0009
Techniques: T1056.004, T1056
Input: RunningRAT contains code to clear event logs.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: Monitor module loads by the Terminal Services process (ex: svchost.exe -k termsvcs) for unexpected DLLs (the default is %SystemRoot%\System32\termsrv.dll, though an adversary could also use Match Legitimate Name or Location to potentially conceal a malicious payload).

Tactics: TA0003
Techniques: T1505.005, T1505
Input: Hikit uses certmgr.exe -add GlobalSign.cer -c -s -r localMachine Root and certmgr.exe -add GlobalSign.cer -c -s -r localMachineTrustedPublisher to install a self-generated certificate to the local trust store as a root CA and Trusted Publisher.

Tactics: TA0005
Techniques: T1553, T1553.004
Input: Attor can obtain application window titles and then determines which windows to perform Screen Capture on.

Tactics: TA0007
Techniques: T1010
Input: APT29 has embedded ISO images and VHDX files in HTML to evade Mark-of-the-Web.

Tactics: TA0005
Techniques: T1553, T1553.005
Input: Ferocious Kitten has acquired domains imitating legitimate sites.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: URL inspection within email (including expanding shortened links) can help detect links leading to known malicious sites.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: DownPaper uses the command line.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Hi-Zor executes using regsvr32.exe called from the Registry Run Keys / Startup Folder persistence mechanism.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: S-Type runs the command net user on a victim.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Monitor for use of proxied smart card connections by an adversary may be difficult because it requires the token to be inserted into a system; thus it is more likely to be in use by a legitimate user and blend in with other network behavior.

Tactics: TA0006
Techniques: T1111
Input: APT39 has used CrackMapExec and a custom port scanner known as BLUETORCH for network scanning.

Tactics: TA0007
Techniques: T1046
Input: BitPaymer has copied itself to the :bin alternate data stream of a newly created file.

Tactics: TA0005
Techniques: T1564, T1564.004
Input: Adversaries may inject malicious code into processes via thread local storage (TLS) callbacks in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055.005, T1055
Input: APT3 has a tool that creates a new service for persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: SSH Hijacking differs from use of SSH because it hijacks an existing SSH session rather than creating a new session using Valid Accounts.

Tactics: TA0008
Techniques: T1563, T1563.001
Input: Adversaries may attempt to discover containers and other resources that are available within a containers environment.

Tactics: TA0007
Techniques: T1613
Input: Remove or disable access to any systems, resources, and infrastructure that are not explicitly required to be available externally.

Tactics: TA0043
Techniques: T1595.003, T1595
Input: Metamorfo can send the data it collects to the C2 server.

Tactics: TA0010
Techniques: T1041
Input: ZxShell can capture screenshots.

Tactics: TA0009
Techniques: T1113
Input: The function then uses the built-in Shell function to run the following command, which effectively executes the .sct file stored in 12-B-366.txt:       regsvr32.exe /s /n /u /i:%TEMP%\12-B-366.txt scrobj.dll     The use of the legitimate regsvr32.exe application to run a .sct file is an AppLocker bypass technique originally discovered by Casey Smith (@subtee), which eventually resulted in a Metasploit module

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Astaroth can store C2 information on cloud hosting services such as AWS and CloudFlare and websites like YouTube and Facebook.

Tactics: TA0011
Techniques: T1102.001, T1102
Input: Several of the tools are freely-available Windows utilities, such as Amplia Security’s Windows Credential Editor. We also found a nearly complete set of the Microsoft SysInternals  PsTools package, a copy of NLBrute (which attempts to brute-force passwords), installers for the commercial TeamViewer and AnyDesk remote support tools, and a number of utilities created by endpoint security vendors that are designed to remove their (and other companies’) endpoint security and antivirus tools from a computer.

Tactics: TA0006
Techniques: T1110
Input: BLINDINGCAN has collected the victim machine's local IP address information and MAC address.

Tactics: TA0007
Techniques: T1016
Input: The relay step can happen in conjunction with poisoning but may also be independent of it.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: At this point the process can be suspended then written to, realigned to the injected code, and resumed via SuspendThread , VirtualAllocEx, WriteProcessMemory, SetThreadContext, then ResumeThread respectively.

Tactics: TA0004, TA0005
Techniques: T1055.003, T1055
Input: LiteDuke can enumerate the CPUID and BIOS version on a compromised system.

Tactics: TA0007
Techniques: T1082
Input: GrimAgent has used Accept-Language to identify hosts in the United Kingdom, United States, France, and Spain.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: Get2 has the ability to use HTTP to send information collected from an infected host to C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Monitor for changes made to files for unexpected modifications to /Library/StartupItem folder

Tactics: TA0003, TA0004
Techniques: T1037, T1037.005
Input: JHUHUGIT variants have communicated with C2 servers over HTTP and HTTPS.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Remsec can add or remove applications or ports on the Windows firewall or disable it entirely.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: Remexi utilizes Run Registry keys in the HKLM hive as a persistence mechanism.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Malware can also be staged on web services, such as GitHub or Pastebin.

Tactics: TA0042
Techniques: T1608.001, T1608
Input: SodaMaster can search a list of running processes.

Tactics: TA0007
Techniques: T1057
Input: Emotet has been observed adding the downloaded payload to the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key to maintain persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Epic uses the net use, net session, and netstat commands to gather information on network connections.

Tactics: TA0007
Techniques: T1049
Input: Adversaries who have the KRBTGT account password hash may forge Kerberos ticket-granting tickets (TGT), also known as a golden ticket.

Tactics: TA0006
Techniques: T1558, T1558.001
Input: They may also search for debugger artifacts before dropping secondary or additional payloads.

Tactics: TA0005, TA0007
Techniques: T1622
Input: OilRig has delivered malicious links to achieve execution on the target system.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Adversaries may attempt to access the Cloud Instance Metadata API to collect credentials and other sensitive data.

Tactics: TA0006
Techniques: T1552, T1552.005
Input: Access to a third-party network-wide or enterprise-wide software system may enable an adversary to have remote code execution on all systems that are connected to such a system.

Tactics: TA0002, TA0008
Techniques: T1072
Input: Defenders such as domain registrars and service providers are likely in the best position for detection.

Tactics: TA0011
Techniques: T1568.001, T1568
Input: Kessel can split the data to be exilftrated into chunks that will fit in subdomains of DNS queries.

Tactics: TA0010
Techniques: T1030
Input: Bazar can send C2 communications with XOR encryption.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: TinyTurla has used WinHTTP, CreateProcess, and other APIs for C2 communications and other functions.

Tactics: TA0002
Techniques: T1106
Input: Rifdoor has the ability to identify the username on the compromised host.

Tactics: TA0007
Techniques: T1033
Input: Monitor for changes made to firmware for unexpected modifications to settings and/or data that may use a hidden file system to conceal malicious activity from users and security tools.

Tactics: TA0005
Techniques: T1564, T1564.005
Input: If NETEAGLE does not detect a proxy configured on the infected machine, it will send beacons via UDP/6000.

Tactics: TA0011
Techniques: T1095
Input: Zox can download files to a compromised machine.

Tactics: TA0011
Techniques: T1105
Input: Ptrace system call injection is commonly performed by writing arbitrary code into a running process (ex: malloc) then invoking that memory with PTRACE_SETREGS to set the register containing the next instruction to execute.

Tactics: TA0004, TA0005
Techniques: T1055.008, T1055
Input: njRAT has modified the Windows firewall to allow itself to communicate through the firewall.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: HOPLIGHT has been observed enumerating system drives and partitions.

Tactics: TA0007
Techniques: T1083
Input: Adversaries may redirect network traffic to adversary-owned systems by spoofing Dynamic Host Configuration Protocol (DHCP) traffic and acting as a malicious DHCP server on the victim network.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.003
Input: Direct Network Floods are when one or more systems are used to send a high-volume of network packets towards the targeted service's network.

Tactics: TA0040
Techniques: T1498, T1498.001