madox81/Adema_ATTACK_DS huggingface dataset:
Input: URL inspection within email (including expanding shortened links) can also help detect links leading to known malicious sites.Monitor social media traffic for suspicious activity, including messages requesting information as well as abnormal file or data transfers (especially those involving unknown, or otherwise suspicious accounts).

Tactics: TA0043
Techniques: T1598
Input: Whitefly has consistently used a technique known as search order hijacking to run Vcrodat.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: OSInfo specifically looks for Domain Admins and power users within the domain.

Tactics: TA0007
Techniques: T1069.002, T1069
Input: TeamTNT has searched for security products on infected machines.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: BlackEnergy has run a plug-in on a victim to spread through the local network by using PsExec and accessing admin shares.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: SUNBURST created an Image File Execution Options (IFEO) Debugger registry value for the process dllhost.exe to trigger the installation of Cobalt Strike.

Tactics: TA0003, TA0004
Techniques: T1546.012, T1546
Input: NETWIRE can use launch agents for persistence.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: Ryuk has used the C$ network share for lateral movement.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Figure 2: AuditCred/ROptimizer Service If successfully installed, this particular backdoor poses quite a threat to its target

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: The White Company has obfuscated their payloads through packing.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Chrommme has the ability to list drives and obtain the computer name of a compromised host.

Tactics: TA0007
Techniques: T1082
Input: Adversaries may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.002, T1556
Input: Remove vulnerable Group Policy Preferences.

Tactics: TA0006
Techniques: T1552, T1552.006
Input: Data could also be concealed within the transferred files.

Tactics: TA0011
Techniques: T1071.002, T1071
Input: {HostProgram}_profile.ps1

Tactics: TA0003, TA0004
Techniques: T1546.013, T1546
Input: This is the only instance we observed where a hardcoded Google Drive URL was included in RogueRobin, which may suggest that the author may have overlooked this during testing

Tactics: TA0007
Techniques: T1083
Input: PlugX can use the Windows API functions GetProcAddress, LoadLibrary, and CreateProcess to execute another process.

Tactics: TA0002
Techniques: T1106
Input: This user action will typically be observed as follow-on behavior from Spearphishing Attachment.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: KillDisk attempts to reboot the machine by terminating specific processes.

Tactics: TA0040
Techniques: T1529
Input: The Remsec loader implements itself with the name Security Support Provider, a legitimate Windows function.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Valak has used scheduled tasks to execute additional payloads and to gain persistence on a compromised host.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim.

Tactics: TA0007
Techniques: T1120
Input: cmd can be used to delete files from the file system.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: PubPrn.vbs is a Visual Basic script that publishes a printer to Active Directory Domain Services.

Tactics: TA0005
Techniques: T1216.001, T1216
Input: Understanding standard usage patterns is important to avoid a high number of false positives.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: In Windows environments, adversaries could obtain details on running processes using the Tasklist utility via cmd or Get-Process via PowerShell.

Tactics: TA0007
Techniques: T1057
Input: File systems provide a structure to store and access data from physical storage.

Tactics: TA0005
Techniques: T1564, T1564.005
Input: LazyScripter has leveraged dynamic DNS providers for C2 communications.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Helminth has checked for the domain admin group and Exchange Trusted Subsystem groups using the commands net group Exchange Trusted Subsystem /domain and net group domain admins /domain.

Tactics: TA0007
Techniques: T1069.002, T1069
Input: APT19 used an HTTP malware variant and a Port 22 malware variant to gather the hostname and CPU information from the victim’s machine.

Tactics: TA0007
Techniques: T1082
Input: APT3 has a tool that can delete files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Kimsuky has used Blogspot to host malicious content such as beacons, file exfiltrators, and implants.

Tactics: TA0042
Techniques: T1608.001, T1608
Input: This document was also the first of the mid-November cluster which used the user/USER author name instead of Joohn, further supporting the scenario of the document being copied between systems

Tactics: TA0007
Techniques: T1033
Input: MarkiRAT can utilize cmd.exe to execute commands in a victim's environment.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: RogueRobin created a shortcut in the Windows startup folder to launch a PowerShell script each time the user logs in to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Adversaries may also abuse external sharing features to share sensitive documents with recipients outside of the organization.

Tactics: TA0009
Techniques: T1213
Input: DarkComet can access the victim’s webcam to take pictures.

Tactics: TA0009
Techniques: T1125
Input: After the database is unlocked, these credentials may be copied to memory.

Tactics: TA0006
Techniques: T1555.005, T1555
Input: TeamTNT has also targeted exposed kubelets for Kubernetes environments.

Tactics: TA0001, TA0003
Techniques: T1133
Input: Adversaries may use this information to determine which users have elevated permissions, such as the users found within the local administrators group.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: ZLib has the ability to download files.

Tactics: TA0011
Techniques: T1105
Input: PowerShower has added a registry key so future powershell.exe instances are spawned off-screen by default, and has removed all registry entries that are left behind during the dropper process.

Tactics: TA0005
Techniques: T1112
Input: Windows stores local service configuration information in the Registry under HKLM\SYSTEM\CurrentControlSet\Services.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.011, T1574
Input: Winnti for Linux has used a custom TCP protocol with four-byte XOR for command and control (C2).

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Andariel has collected large numbers of files from compromised network systems for later extraction.

Tactics: TA0009
Techniques: T1005
Input: The same process can be accomplished through a comparison of the run-time memory, though this is non-trivial and may require assistance from the vendor.

Tactics: TA0002, TA0003, TA0005
Techniques: T1059.008, T1542.005, T1542, T1059
Input: APT39 has used PowerShell to execute malicious code.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: BabyShark has encoded data using certutil before exfiltration.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Axiom has used exploits for multiple vulnerabilities including CVE-2014-0322, CVE-2012-4792, CVE-2012-1889, and CVE-2013-3893.

Tactics: TA0002
Techniques: T1203
Input: SQLRat relies on users clicking on an embedded image to execute the scripts.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: In some cases an adversary might modify specific user rights like SeEnableDelegationPrivilege, set in <GPO_PATH>\MACHINE\Microsoft\Windows NT\SecEdit\GptTmpl.inf, to achieve a subtle AD backdoor with complete control of the domain because the user account under the adversary's control would then be able to modify GPOs.

Tactics: TA0004, TA0005
Techniques: T1484.001, T1484
Input: When PowerShell is necessary, restrict PowerShell execution policy to administrators.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: One such example is use of certutil to decode a remote access tool portable executable file that has been hidden inside a certificate file.

Tactics: TA0005
Techniques: T1140
Input: Mythic supports scripting of file downloads from agents.

Tactics: TA0009
Techniques: T1119
Input: Seth-Locker can encrypt files on a targeted system, appending them with the suffix .seth.

Tactics: TA0040
Techniques: T1486
Input: Turla has used multiple backdoors which communicate with a C2 server via email attachments.

Tactics: TA0011
Techniques: T1071, T1071.003
Input: TYPEFRAME can uninstall malware components using a batch script.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: PowerSploit contains a collection of Exfiltration modules that can harvest credentials using Mimikatz.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: User file association preferences are stored under  [HKEY_CURRENT_USER]\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts and override associations configured under [HKEY_CLASSES_ROOT].

Tactics: TA0003, TA0004
Techniques: T1546, T1546.001
Input: New services created by RawPOS are made to appear like legitimate Windows services, with names such as "Windows Management Help Service", "Microsoft Support", and "Windows Advanced Task Manager".

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Pseudo-HTTP Protocol Messages for the pseudo-HTTP protocol are delimited with the ‘|’ character

Tactics: TA0011
Techniques: T1071
Input: reg save HKLM\system system

Tactics: TA0006
Techniques: T1003, T1003.002
Input: Hydraq's backdoor also enables remote attackers to modify and delete subkeys.

Tactics: TA0005
Techniques: T1112
Input: This ensures that only the intended recipient can read the encrypted data.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: It named Meterpreter as a WAV file type, probably in the hope that this would not raise suspicions

Tactics: TA0005
Techniques: T1036
Input: This command would inject an import table entry consisting of the specified DLL into the module at the given base address.

Tactics: TA0005
Techniques: T1218, T1218.013
Input: CHOPSTICK checks for antivirus and forensics software.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Monitor for changes made to files outside of an update or patch that may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

Tactics: TA0005
Techniques: T1036
Input: APT37 has a function in the initial dropper to bypass Windows UAC in order to execute the next payload with higher privileges.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: OilRig has delivered macro-enabled documents that required targets to click the "enable content" button to execute the payload on the system.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Monitor for execution of utilities, like chmod, and their command-line arguments to look for setuid or setguid bits being set.

Tactics: TA0004, TA0005
Techniques: T1548, T1548.001
Input: Kobalos can spawn a new pseudo-terminal and execute arbitrary commands at the command prompt.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: Crimson can use a HTTP GET request to download its final payload.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: These changes may bypass process creation detection and/or later process memory analysis.

Tactics: TA0005
Techniques: T1564.010, T1564
Input: In our analysis, the macro is obfuscated, character by character, using the decimal ASCII code

Tactics: TA0005
Techniques: T1027
Input: Adversaries may purchase information about their already identified targets, or use purchased data to discover opportunities for successful breaches.

Tactics: TA0043
Techniques: T1597.002, T1597
Input: Adversaries may upload, install, or otherwise set up capabilities that can be used during targeting.

Tactics: TA0042
Techniques: T1608
Input: The majority of businesses still maintain Windows-heavy user environments where certain core infrastructure components also operate under Windows servers (e.g., Active Directory, SharePoint, etc.)

Tactics: TA0007
Techniques: T1010
Input: Windows shared drive and SMB/Windows Admin Shares connections can be removed when no longer needed.

Tactics: TA0005
Techniques: T1070, T1070.005
Input: POWERSTATS can delete all files on the C:\, D:\, E:\ and, F:\ drives using PowerShell Remove-Item commands.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: /grant Everyone:F /T /C /Q to make some of its files hidden and grant all users full access controls.

Tactics: TA0005
Techniques: T1222, T1222.001
Input: Blue Mockingbird has used Windows Explorer to manually copy malicious files to remote hosts over SMB.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: The malware initiates its main function of capturing user keystrokes and sending them to the control server using standard Windows networking APIs

Tactics: TA0006, TA0009
Techniques: T1056
Input: HermeticWiper has the ability to stop the Volume Shadow Copy service.

Tactics: TA0040
Techniques: T1489
Input: Goopy has the ability to disable Microsoft Outlook's security policies to disable macro warnings.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Many vendors provide digitally signed operating system images to validate the integrity of the software used on their platform.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: Popular open source projects that are used as dependencies in many applications may also be targeted as a means to add malicious code to users of the dependency.

Tactics: TA0001
Techniques: T1195
Input: Penquin can delete downloaded executables after running them.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: BRONZE BUTLER has used PowerShell for execution.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Even when these registered DLLs do not comply with the CPL file specification and do not export CPlApplet functions, they are loaded and executed through its DllEntryPoint when Control Panel is executed.

Tactics: TA0005
Techniques: T1218, T1218.002
Input: SUNBURST used Rundll32 to execute payloads.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: BackdoorDiplomacy has used EarthWorm for network tunneling with a SOCKS5 server and port transfer functionalities.

Tactics: TA0011
Techniques: T1095
Input: RainyDay can use a file exfiltration tool to upload specific files to Dropbox.

Tactics: TA0010
Techniques: T1567.002, T1567
Input: NOKKI can delete files to cover tracks.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Nomadic Octopus has targeted victims with spearphishing emails containing malicious attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Configure applications to use the application bundle structure which leverages the /Resources folder location.

Tactics: TA0005
Techniques: T1564, T1564.009
Input: BackConfig has the ability to identify folders and files related to previous infections.

Tactics: TA0007
Techniques: T1083
Input: Train users to look for double extensions in filenames, and in general use training as a way to bring awareness to common phishing and spearphishing techniques and how to raise suspicion for potentially malicious events.

Tactics: TA0005
Techniques: T1036, T1036.007
Input: OilRig has created scheduled tasks that run a VBScript to execute a payload on victim machines.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.

Tactics: TA0011
Techniques: T1573
Input: Adversaries may plant trojan dynamic-link library files (DLLs) in a directory that will be searched before the location of a legitimate library that will be requested by a program, causing Windows to load their malicious library when it is called for by the victim program.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: The method adversaries use will depend on the specific mechanism they seek to subvert.

Tactics: TA0005
Techniques: T1553
Input: The client broadcasts a REQUEST message, which includes the network address offered.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.003
Input: GravityRAT collects the MAC address, computer name, and CPU information.

Tactics: TA0007
Techniques: T1082
Input: For example, compromised business accounts are often used to send messages to other accounts in the network of the target business while creating inbox rules (ex: Internal Spearphishing), so the messages evade spam/phishing detection mechanisms.

Tactics: TA0003
Techniques: T1098.002, T1098
Input: PoshC2 has modules for enumerating domain trusts.

Tactics: TA0007
Techniques: T1482
Input: Dragonfly has compromised user credentials and used valid accounts for operations.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: MarkiRAT can exfiltrate locally stored data via its C2.

Tactics: TA0010
Techniques: T1041
Input: Then, they can send a Spearphishing Link to the target user to entice them to grant access to the application.

Tactics: TA0006
Techniques: T1528
Input: Where authorized_keys files are modified via cloud APIs or command line interfaces, an adversary may achieve privilege escalation on the target virtual machine if they add a key to a higher-privileged user.

Tactics: TA0003
Techniques: T1098.004, T1098
Input: Adversaries may scan IP blocks in order to Gather Victim Network Information, such as which IP addresses are actively in use as well as more detailed information about hosts assigned these addresses.

Tactics: TA0043
Techniques: T1595.001, T1595
Input: Kazuar can accept multiple URLs for C2 servers.

Tactics: TA0011
Techniques: T1008
Input: SpeakUp encodes C&C communication using Base64.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Command Functionality   A List logical drives   B List directory (Z1 = directory name to list)   C Read data from file (Z1 = filename to read)   D Write content to file (Z1 = filename to write, Z2 = content to write)   E Delete file in directory (Z1 = file)   F Generate custom web response "->|value in Z1|<-"   G Write hex-encoded content to file (Z1 = filename to write, Z2 = hex encoded content to write)   H Call _Notice(Z1, Z2)   I Move/rename file or directory (Z1 = target, Z2 = new name)   J Create directory (Z1 = directory name)   K Timestomp file or directory (Z1 = target, Z2 = time/date string to stomp to)   L Download file from Internet (Z1 = URL, Z2 = filename to write to)   M Launch process (Z1 = process name, Z2 = arguments)   N Test connect to SQL database (Z1 = SqlConnect String)   O SQL Get database table scheme (Z1 = \r delimited parameters to command)   P SQL Get database table scheme with restrictions (Z1 = \r delimited parameters to command)   Q SQL execute SQL command (Z1 = \r delimited parameters to command)    Table 4

Tactics: TA0003, TA0004, TA0005, TA0007, TA0009, TA0011
Techniques: T1070, T1070.006, T1547.001, T1036, T1090.003, T1083, T1547, T1090, T1074
Input: Stuxnet collects the IP address of a compromised system.

Tactics: TA0007
Techniques: T1016
Input: DealersChoice makes modifications to open-source scripts from GitHub and executes them on the victim’s machine.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: An older version of CHOPSTICK has a module that monitors all mounted volumes for files with the extensions .doc, .docx, .pgp, .gpg, .m2f, or .m2o.

Tactics: TA0007
Techniques: T1083
Input: Clop can uninstall or disable security products.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: The downloaded .7zip file contains a .lnk file that, once pressed, initializes the malware

Tactics: TA0003, TA0004, TA0011
Techniques: T1547.009, T1547, T1105
Input: Monitor network traffic content for files and other potentially malicious content, especially data coming in from abnormal/unknown domain and IPs.

Tactics: TA0011
Techniques: T1105
Input: Information about an application's list-view settings are stored within the process' memory in a SysListView32 control.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.015
Input: XAgentOSX contains the deletFileFromPath function to delete a specified file using the NSFileManager:removeFileAtPath method.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Agent Tesla has used HTTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Cardinal RAT checks its current working directory upon execution and also contains watchdog functionality that ensures its executable is located in the correct path (else it will rewrite the payload).

Tactics: TA0007
Techniques: T1083
Input: Avaddon can collect the external IP address of the victim.

Tactics: TA0007
Techniques: T1016
Input: Mustang Panda's PlugX variant has created a hidden folder on USB drives named RECYCLE.BIN to store malicious executables and collected data.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Monitor handle opens on volumes that are made by processes to determine when they may be directly collecting data from logical drives.

Tactics: TA0005
Techniques: T1006
Input: Kazuar uploads files from a specified directory to the C2 server.

Tactics: TA0009
Techniques: T1005
Input: Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure).

Tactics: TA0043, TA0042, TA0001, TA0003, TA0005, TA0006, TA0007, TA0008, TA0011, TA0010, TA0040
Techniques: T1599, T1505.003, T1499.002, T1219, T1599.001, T1041, T1070, T1499, T1003.006, T1572, T1598.001, T1033, T1003, T1563.002, T1568, T1102.001, T1102.002, T1491.001, T1598.002, T1048.002, T1573, T1048.003, T1011.001, T1563, T1090.001, T1090.003, T1566.003, T1048, T1566, T1585, T1491.002, T1595, T1102.003, T1585.001, T1499.001, T1567.001, T1563.001, T1090.004, T1491, T1505, T1598, T1568.003, T1534, T1567.002, T1090, T1090.002, T1567, T1011, T1095, T1102, T1573.001, T1586, T1048.001, T1573.002, T1499.004, T1595.002, T1615, T1221
Input: BRONZE BUTLER has also used a tool called RarStar that encodes data with a custom XOR algorithm when posting it to a C2 server.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: There are tools available from the host operating system to perform cleanup, but adversaries may use other tools as well.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Detection efforts may be focused on related behaviors, such as Web Protocols, Asymmetric Cryptography, and/or Install Root Certificate.

Tactics: TA0042
Techniques: T1588.004, T1588