madox81/Adema_ATTACK_DS huggingface dataset:
Input: Usually this series of packets consists of attempted connections to a predefined sequence of closed ports ( Port Knocking), but can involve unusual flags, specific strings, or other unique characteristics.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205
Input: Similar to Process Hollowing, proc memory injection may target child processes (such as a backgrounded copy of sleep).

Tactics: TA0004, TA0005
Techniques: T1055.009, T1055
Input: Using rundll32.exe, vice executing directly ( Shared Modules), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Modifications to the code signing policy of a system are likely to be rare.

Tactics: TA0005
Techniques: T1553, T1553.006
Input: SharpStage has the ability to capture the victim's screen.

Tactics: TA0009
Techniques: T1113
Input: Okrum can collect the victim username.

Tactics: TA0007
Techniques: T1033
Input: Monitor for an extracted list of ACLs of available groups and/or their associated settings.

Tactics: TA0007
Techniques: T1069
Input: OilRig has used the Plink utility and other tools to create tunnels to C2 servers.

Tactics: TA0011
Techniques: T1572
Input: Darkhotel has used code-signing certificates on its malware that are either forged due to weak keys or stolen.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: When performing PtH, valid password hashes for the account being used are captured using a Credential Access technique.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: In one example, the Word document contained a button with the label “First click “Enable Content” above the page, then click here to fill out the form”  This string attempts to trick the user into enabling macros to execute the malicious code within the macro

Tactics: TA0002
Techniques: T1204
Input: Dtrack has used a dropper that embeds an encrypted payload as extra data.

Tactics: TA0005
Techniques: T1027
Input: Monitor for execution of JXA through osascript and usage of OSAScript API that may be related to other suspicious behavior occurring on the system.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: For a more exhaustive list of utilities that can be used to execute and create ADSs, see https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f.

Tactics: TA0005
Techniques: T1564, T1564.004
Input: NETWIRE can perform keylogging.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Lateral Movement APT40 uses many methods for lateral movement throughout an environment, including custom scripts, web shells, a variety of tunnelers, as well as Remote Desktop Protocol (RDP)

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Email addresses could also be enumerated via more active means ( Active Scanning), such as probing and analyzing responses from authentication services that may reveal valid usernames in a system.

Tactics: TA0043
Techniques: T1589.002, T1589
Input: A larger than normal volume of emails sent from an account and similar phishing emails sent from real accounts within a network may be a sign that an account was compromised and attempts to leverage access with modified email permissions is occurring.

Tactics: TA0003
Techniques: T1098.002, T1098
Input: This has the advantage of making it much harder for defenders to block, track, or take over the command and control channel, as there potentially could be thousands of domains that malware can check for instructions.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: The spreadsheet also creates a scheduled task named "windows update check" that runs the file C:\Users\<user_name>\.templates\System Manager.exe every minute.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: QuietSieve can identify and search removable drives for specific file name extensions.

Tactics: TA0007
Techniques: T1120
Input: Imminent Monitor has a dynamic debugging feature to set the file attribute to hidden.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Adversaries may obtain and abuse credentials of a cloud account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078.004, T1078
Input: Backdoor.Oldrea injects itself into explorer.exe.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Ensure that user accounts with administrative rights follow best practices, including use of privileged access workstations, Just in Time/Just Enough Administration (JIT/JEA), and strong authentication.

Tactics: TA0006
Techniques: T1606, T1606.002
Input: Netwalker can use Windows API functions to inject the ransomware DLL.

Tactics: TA0002
Techniques: T1106
Input: APT32 modified Windows Services to ensure PowerShell scripts were loaded on the system.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Taking a screenshot is also typically possible through native utilities or API calls, such as CopyFromScreen, xwd, or screencapture.

Tactics: TA0009
Techniques: T1113
Input: Smoke Loader adds a Visual Basic script in the Startup folder to deploy the payload.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Adversaries may create and cultivate accounts with services that can be used during targeting.

Tactics: TA0042
Techniques: T1585
Input: After downloading its main config file, Downdelph downloads multiple payloads from C2 servers.

Tactics: TA0011
Techniques: T1105
Input: Administrators should set up monitoring to trigger automatic alerts when policy criteria are met.

Tactics: TA0006
Techniques: T1528
Input: Azorult can decrypt the payload into memory, create a new suspended process of itself, then inject a decrypted payload to the new process and resume new process execution.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: Frankenstein has enumerated hosts, gathering username, machine name, and administrative permissions information.

Tactics: TA0007
Techniques: T1033
Input: The shellcode is not encrypted but is obfuscated

Tactics: TA0005
Techniques: T1027
Input: In cloud-based environments, adversaries may also use cloud APIs, command line interfaces, or extract, transform, and load (ETL) services to automatically collect data.

Tactics: TA0009
Techniques: T1119
Input: The JavaScript is heavily obfuscated. The first variable—a—is an array of obfuscated values

Tactics: TA0005
Techniques: T1027
Input: Network adapter information may also be helpful in detecting the use of virtual instances.

Tactics: TA0005
Techniques: T1564, T1564.006
Input: SombRAT can SSL encrypt C2 traffic.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Shamoon obtains the victim's operating system version and keyboard layout and sends the information to the C2 server.

Tactics: TA0007
Techniques: T1082
Input: For operations incorporating social engineering, the utilization of an online persona may be important.

Tactics: TA0042
Techniques: T1586.001, T1585, T1586
Input: FIN7 has registered look-alike domains for use in phishing campaigns.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: 3PARA RAT will use an 8-byte XOR key derived from the string HYF54&%9&jkMCXuiS if the DES decoding fails

Tactics: TA0011
Techniques: T1573, T1573.001
Input: EVILNUM can obtain the username from the victim's machine.

Tactics: TA0007
Techniques: T1033
Input: RARSTONE uses SSL to encrypt its communication with its C2 server.

Tactics: TA0011
Techniques: T1095
Input: Olympic Destroyer uses Windows Management Instrumentation to enumerate all systems in the network.

Tactics: TA0007
Techniques: T1018
Input: Additionally, a PROPERTY=VALUE pair containing a 56-bit encryption key has been used to decrypt the main payload from the installer packages.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: NETWIRE has the ability to write collected data to a file created in the ./LOGS directory.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: build_downer has the ability to send system volume information to C2.

Tactics: TA0007
Techniques: T1082
Input: This IP is of particular interest as historical domain resolutions of this IP revealed that it had resolved to the domain hotmai1l[.]com in the past as well, which was a domain we had previously identified as having a high likelihood of association with DarkHydrus infrastructure

Tactics: TA0007
Techniques: T1016
Input: SMOKEDHAM can execute Powershell commands sent from its C2 server.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Dragonfly has moved laterally via RDP.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Adversaries may poison Address Resolution Protocol (ARP) caches to position themselves between the communication of two or more networked devices.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.002
Input: Honeybee's service-based DLL implant traverses the FTP server’s directories looking for files with keyword matches for computer names or certain keywords.

Tactics: TA0007
Techniques: T1083
Input: Wizard Spider has lured victims into clicking a malicious link delivered through spearphishing.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: OSX_OCEANLOTUS.D encrypts its strings in RSA256 and encodes them in a custom base64 scheme and XOR.

Tactics: TA0005
Techniques: T1027
Input: For both the receiving of C2 commands and exfiltration, Remexi uses the Microsoft Background Intelligent Transfer Service (BITS) mechanism to communicate with the C2 over HTTP

Tactics: TA0011
Techniques: T1132, T1071
Input: Astaroth uses an external software known as NetPass to recover passwords.

Tactics: TA0006
Techniques: T1552, T1555
Input: Sidewinder has used LNK files to download remote files to the victim's network.

Tactics: TA0011
Techniques: T1105
Input: Maze has attempted to delete the shadow volumes of infected machines, once before and once after the encryption process.

Tactics: TA0040
Techniques: T1490
Input: However, the OwaAuth web shell password contains the victim organization's name

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Dtrack can collect network and active connection information.

Tactics: TA0007
Techniques: T1049
Input: Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.

Tactics: TA0006
Techniques: T1110
Input: Ramsay has been executed through malicious e-mail attachments.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: SLOTHFULMEDIA has hashed a string containing system information prior to exfiltration via POST requests.

Tactics: TA0011
Techniques: T1001
Input: The plist file is installed in the ~/Library/LaunchAgents/ folder and configured with the path to the persistent binary located in the ~/Library/ folder.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary command and control infrastructure and malware can be used to mitigate activity at the network level.

Tactics: TA0010
Techniques: T1030, T1048.002, T1048.003, T1048, T1029
Input: OilRig has encrypted and encoded data in its malware, including by using base64.

Tactics: TA0005
Techniques: T1027
Input: Ramsay can collect data from removable media and stage it for exfiltration.

Tactics: TA0009
Techniques: T1025
Input: StrongPity can exfiltrate collected documents through C2 channels.

Tactics: TA0010
Techniques: T1041
Input: menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.

Tactics: TA0006
Techniques: T1003, T1003.002, T1003.004
Input: GoldMax retrieved a list of the system's network interface after execution.

Tactics: TA0007
Techniques: T1016
Input: Cobalt Group has injected code into trusted processes.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Emotet has been observed dropping browser password grabber modules.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Note: DLL side loading is a prevalent persistence technique that is used to launch a multitude of backdoors

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: For each executable, ThiefQuest prepends a copy of itself to the beginning of the file.

Tactics: TA0003
Techniques: T1554
Input: PoetRAT was executed with a Python script and worked in conjunction with additional Python-based post-exploitation tools.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Rocke has changed the time stamp of certain files.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: Also collect service utility execution and service binary path arguments used for analysis.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: An executable dropped onto victims by Putter Panda aims to inject the specified DLL into a process that would normally be accessing the network, including Outlook Express (msinm.exe), Outlook (outlook.exe), Internet Explorer (iexplore.exe), and Firefox (firefox.exe).

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: It can also retrieve service account tokens from kOps buckets in Google Cloud Storage or S3.

Tactics: TA0009
Techniques: T1530
Input: DarkVishnya used DameWare Mini Remote Control for lateral movement.

Tactics: TA0011
Techniques: T1219
Input: njRAT can collect data from a local system.

Tactics: TA0009
Techniques: T1005
Input: Similar to System Binary Proxy Execution, adversaries have also abused the Windows Task Scheduler to potentially mask one-time execution under signed/trusted system processes.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Prevent administrator accounts from being enumerated when an application is elevating through UAC since it can lead to the disclosure of account names.

Tactics: TA0007
Techniques: T1087.002, T1087, T1087.001
Input: The malware then appends a script extension (php, bml, or cgi) with a random number of random parameters or a file extension from the following list with no parameters: gif, jpg, png, htm, html, php

Tactics: TA0007
Techniques: T1083
Input: Aria-body has used HTTP in C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: A PowerShell profile  (profile.ps1) is a script that runs when PowerShell starts and can be used as a logon script to customize user environments.

Tactics: TA0003, TA0004
Techniques: T1546.013, T1546
Input: Crimson can use a module to perform keylogging on compromised hosts.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Devices registered in Azure AD may be able to conduct Internal Spearphishing campaigns via intra-organizational emails, which are less likely to be treated as suspicious by the email client.

Tactics: TA0003
Techniques: T1098.005, T1098
Input: Ensure that any accounts used by third-party providers to access these systems are traceable to the third-party and are not used throughout the network or used by other third-party providers in the same environment.

Tactics: TA0002, TA0008
Techniques: T1072
Input: WarzoneRAT has the ability to inject malicious DLLs into a specific process for privilege escalation.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Monitor for anomalous activity, such as enabling Audit Kerberos Service Ticket Operations to log Kerberos TGS service ticket requests.

Tactics: TA0006
Techniques: T1558, T1558.004
Input: FIN7 used a PowerShell script to launch shellcode that retrieved an additional payload.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Stuxnet propagates to available network shares.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Cobalt Strike can deobfuscate shellcode using a rolling XOR and decrypt metadata from Beacon sessions.

Tactics: TA0005
Techniques: T1140
Input: Zebrocy has exfiltrated data to the designated C2 server using HTTP POST requests.

Tactics: TA0010
Techniques: T1041
Input: For instance, the downloader will first attempt to communicate with its C2 server using an HTTPS request

Tactics: TA0011
Techniques: T1071
Input: HermeticWizard can execute files on remote machines using DCOM.

Tactics: TA0002
Techniques: T1559, T1559.001
Input: APT41 used RDP for lateral movement.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Derusbi is capable of obtaining directory, file, and drive listings.

Tactics: TA0007
Techniques: T1083
Input: APT29 has used large file sizes to avoid detection.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: However, the sudoers file can also specify when to not prompt users for passwords with a line like user1 ALL=(ALL) NOPASSWD: ALL.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: Tonto Team has exploited CVE-2019-0803 and MS16-032 to escalate privileges.

Tactics: TA0004
Techniques: T1068
Input: KONNI had a feature to steal data from the clipboard.

Tactics: TA0009
Techniques: T1115
Input: Grandoreiro can use MSI files to execute DLLs.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: Similar to Trusted Developer Utilities Proxy Execution, the Microsoft common line transformation utility binary (msxsl.exe)  can be installed and used to execute malicious JavaScript embedded within local or remote (URL referenced) XSL files.

Tactics: TA0005
Techniques: T1220
Input: pwdumpx.exe

Tactics: TA0006
Techniques: T1003, T1003.002
Input: By modifying an authentication process, an adversary may be able to authenticate to a service or system without using Valid Accounts.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556
Input: APT28 has delivered JHUHUGIT and Koadic by executing PowerShell commands through DDE in Word documents.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: JPIN checks for the presence of certain security-related processes and deletes its installer/uninstaller component if it identifies any of them.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Refer to NIST guidelines when creating password policies for master passwords.

Tactics: TA0006
Techniques: T1555.005, T1555
Input: Monitor executed commands and arguments for actions that are associated with local account creation, such as net user /add , useradd , and dscl -create

Tactics: TA0003
Techniques: T1136, T1136.001
Input: LiteDuke has the ability to discover the proxy configuration of Firefox and/or Opera.

Tactics: TA0007
Techniques: T1016
Input: These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.

Tactics: TA0011
Techniques: T1568
Input: Carbanak lists running processes.

Tactics: TA0007
Techniques: T1057
Input: Winnti Group has used a program named ff.exe to search for specific documents on compromised hosts.

Tactics: TA0007
Techniques: T1083
Input: Anchor has used NTFS to hide files.

Tactics: TA0005
Techniques: T1564, T1564.004
Input: Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.002
Input: Okrum's payload is encrypted and embedded within its loader, or within a legitimate PNG file.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: Windshift has used Visual Basic 6 (VB6) payloads.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Tools can also be staged on web services, such as an adversary controlled GitHub repo.

Tactics: TA0042
Techniques: T1608, T1608.002
Input: Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

Tactics: TA0002
Techniques: T1059
Input: Environment variables, such as %USERNAME% and $USER, may also be used to access this information.

Tactics: TA0007
Techniques: T1033
Input: Rather than establishing an AiTM position, adversaries may also abuse DHCP spoofing to perform a DHCP exhaustion attack ( Service Exhaustion Flood) by generating many broadcast DISCOVER messages to exhaust a network’s DHCP allocation pool.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.003
Input: Monitor for newly executed processes that may abuse Unix shell commands and scripts for execution.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: ZeroT shellcode decrypts and decompresses its RC4-encrypted payload.

Tactics: TA0005
Techniques: T1140
Input: Silence has used port 444 when sending data about the system from the client to the server.

Tactics: TA0011
Techniques: T1571
Input: Cuba has used SeDebugPrivilege and AdjustTokenPrivileges to elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1134
Input: Adversaries can install new AppInit DLLs binaries to execute this technique.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.010
Input: FYAnti can search the C:\Windows\Microsoft.NET\ directory for files of a specified size.

Tactics: TA0007
Techniques: T1083
Input: IcedID has the ability to identify Workgroup membership.

Tactics: TA0007
Techniques: T1069
Input: Hildegard has modified /etc/ld.so.preload to overwrite readdir() and readdir64().

Tactics: TA0005
Techniques: T1014
Input: Linfo creates a backdoor through which remote attackers can retrieve system information.

Tactics: TA0007
Techniques: T1082
Input: KONNI has hardcoded API calls within its functions to use on the victim's machine.

Tactics: TA0002
Techniques: T1106
Input: This information allows a threat actor to determine if their messages were delivered, which users are more susceptible to opening them, and basic information regarding the target’s operating system and e-mail client (or browser)

Tactics: TA0007
Techniques: T1082
Input: CrackMapExec can discover the password policies applied to the target system.

Tactics: TA0007
Techniques: T1201
Input: For example, Forfiles, the Program Compatibility Assistant (pcalua.exe), components of the Windows Subsystem for Linux (WSL), as well as other utilities may invoke the execution of programs and commands from a Command and Scripting Interpreter, Run window, or via scripts.

Tactics: TA0005
Techniques: T1202
Input: SNUGRIDE is capable of executing commands and spawning a reverse shell.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: This may include things such as firewall rules and anti-virus.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: China Chopper's server component can perform brute force password guessing against authentication portals.

Tactics: TA0006
Techniques: T1110, T1110.001
Input: This log contains the external IP, the geographic location, the machine name, the time the machine was infected, as well as fields to be logged in the threat actor’s database

Tactics: TA0005, TA0007, TA0011
Techniques: T1070, T1090.003, T1124, T1090
Input: Thread Name   Description    Key logger  Logs key strokes for configured processes and sends them to the command and control (C2) server    Form grabber  Monitors HTTP traffic for form data and sends it to the C2 server    POS monitor  Monitors for changes to logs stored in C:\NSB\Coalition\Logs and nsb.pos.client.log and sends parsed data to the C2 server    PST monitor  Searches recursively for newly created Outlook personal storage table (PST) files within user directories and sends them to the C2 server    HTTP proxy monitor  Monitors HTTP traffic for requests sent to HTTP proxies, saves the proxy address and credentials for future use    Table 1: Monitoring threads Commands In addition to its file management capabilities, this data-stealing backdoor supports 34 commands that can be received from the C2 server

Tactics: TA0009, TA0011, TA0010
Techniques: T1041, T1132, T1071, T1560, T1090
Input: Pillowmint has also obfuscated the AES key used for encryption.

Tactics: TA0005
Techniques: T1027
Input: The observation of the signal packets to trigger the communication can be conducted through different methods.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205, T1205.001
Input: The backdoor will modify the registry for the Windows Media Player to store its C&C configuration.

Tactics: TA0005
Techniques: T1112
Input: Collect usage logs from cloud administrator accounts to identify unusual activity in the assignment of roles to those accounts.

Tactics: TA0003
Techniques: T1098, T1098.003
Input: Adversaries may abuse systemd timers to perform task scheduling for initial or recurring execution of malicious code.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.006, T1053