madox81/Adema_ATTACK_DS huggingface dataset:
Input: Monitor for processes being viewed that may inject malicious code into processes via thread local storage (TLS) callbacks in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055.005, T1055
Input: Cobalt Strike can spawn processes with alternate PPIDs.

Tactics: TA0004, TA0005
Techniques: T1134.004, T1134
Input: Rather than creating and cultivating accounts ( Establish Accounts), adversaries may compromise existing accounts.

Tactics: TA0042
Techniques: T1586
Input: Micropsia can perform microphone recording.

Tactics: TA0009
Techniques: T1123
Input: We have seen the following HTTP POST parameters within the Zebrocy C++ samples: porg structOne oq volume DDE Details The author of the DDE document used in the February 2018 attacks used some obfuscation techniques in an attempt to evade detection

Tactics: TA0011
Techniques: T1071
Input: Denis can launch a remote shell to execute arbitrary commands on the victim’s machine.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: OilRig has also used CVE-2017-11774 to roll back the initial patch designed to protect against Home Page abuse.

Tactics: TA0003
Techniques: T1137, T1137.004
Input: Sandworm Team had gathered user, IP address, and server data related to RDP sessions on a compromised host.

Tactics: TA0007
Techniques: T1049
Input: Higaisa’s JavaScript file used a legitimate Microsoft Office 2007 package to side-load the OINFO12.OCX dynamic link library.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: Monitor for changes made to system log files, typically stored in  /var/log or /Library/Logs, for unexpected modifications to access permissions and attributes

Tactics: TA0005
Techniques: T1070, T1070.002
Input: For example, the FailureCommand key may be changed so that the service is executed in an elevated context anytime the service fails or is intentionally corrupted.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.011, T1574
Input: APT32 compromised McAfee ePO to move laterally by distributing malware as a software deployment task.

Tactics: TA0002, TA0008
Techniques: T1072
Input: The rest of MirageFox functions similarly to previous malware created by APT15, first collecting information about the computer like the username, CPU information, architecture, and so forth

Tactics: TA0007
Techniques: T1082
Input: By assigning one or both user permissions to a folder, the adversary can utilize any other account in the tenant to maintain persistence to the target user’s mail folders.

Tactics: TA0003
Techniques: T1098.002, T1098
Input: Chaes has used an unsigned, crafted DLL module named hha.dll that was designed to look like a legitimate 32-bit Windows DLL.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: The C2 server response to a beacon sent by a variant of Emissary contains a 36-character GUID value that is used as an encryption key for subsequent network communications.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Metamorfo has encrypted C2 commands with AES-256.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: RATANKBA performs a reflective DLL injection using a given pid.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: TA551 has used encoded ASCII text for initial C2 communications.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: REvil can encrypt files on victim systems and demands a ransom to decrypt the files.

Tactics: TA0040
Techniques: T1486
Input: TSCookie has the ability to execute shell commands on the infected host.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Pysa can perform OS credential dumping using Mimikatz.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Adversaries may abuse these technologies in various ways as a means of executing arbitrary commands.

Tactics: TA0002
Techniques: T1059
Input: Ramsay can use ipconfig and Arp to collect network configuration information, including routing information and ARP tables.

Tactics: TA0007
Techniques: T1016
Input: Use best practices for authentication protocols, such as Kerberos, and ensure web traffic that may contain credentials is protected by SSL/TLS.

Tactics: TA0006, TA0007, TA0009
Techniques: T1557, T1040, T1557.002
Input: CoverageAdditional ways our customers can detect and block this threat are listed below.Advanced Malware Protection (AMP) is ideally suited to prevent the execution of the malware used by these threat actors.CWS or WSA web scanning prevents access to malicious websites and detects malware used in these attacks.Email Security can block malicious emails sent by threat actors as part of their campaign.Network Security appliances such as NGFW, NGIPS, and Meraki MX can detect malicious activity associated with this threat.AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products.Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network.Open Source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.IOCsFilesOffice Documents:c4be15f9ccfecf7a463f3b1d4a17e7b4f95de939e057662c3f97b52f7fa3c52fe5511b22245e26a003923ba476d7c36029939b2d1936e17a9b35b396467179aeefb235776851502672dba5ef45d96cc65cb9ebba1b49949393a6a85b9c822f52Seduploader Dropper:522fd9b35323af55113455d823571f71332e53dde988c2eb41395cf6b0c15805Sedupload Payload:ef027405492bc0719437eb58c3d2774cc87845f30c40040bbebbcc09a4e3dd18NetworksCC:myinvestgroup[.]com

Tactics: TA0001, TA0002, TA0007
Techniques: T1518.001, T1566.003, T1566, T1566.002, T1518, T1204
Input: Zeus Panda uses HTTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: It is believed that a patch management system for an anti-virus product commonly installed among targeted companies was used to distribute the Wiper malware.

Tactics: TA0002, TA0008
Techniques: T1072
Input: The networked device that made the ARP request will then use as well as store that information in its ARP cache.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.002
Input: Lizar has used PowerShell scripts.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: With a botnet at their disposal, adversaries may perform follow-on activity such as large-scale Phishing or Distributed Denial of Service (DDoS).

Tactics: TA0042
Techniques: T1584, T1583.005, T1583, T1584.005
Input: Malware features Remexi boasts features that allow it to gather keystrokes, take screenshots of windows of interest (as defined in its configuration), steal credentials, logons and the browser history, and execute remote commands

Tactics: TA0009
Techniques: T1113
Input: FIN8 has used sslip.io, a free IP to domain mapping service that also makes SSL certificate generation easier for traffic encryption, as part of their command and control.

Tactics: TA0011
Techniques: T1102
Input: Correlate these network connections with remote login events and associated SMB-related activity such as file transfers and remote process execution.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: install.exe:     c:\Users\aa\Documents\Visual Studio 2008\Projects\MShell\Release        \MShell.pdb doc.exe:     c:\Users\aa\Documents\Visual Studio 2008\Projects\4113\Release            \4113.pdb test.exe:     C:\Users\aa\Documents\Visual Studio 2010\Projects\MyRat\Client\Client      \obj\x86\Release\Client.pdb The most interesting PDB string is the “4113.pdb,” which appears to reference CVE-2014-4113

Tactics: TA0002, TA0005, TA0007
Techniques: T1033, T1087, T1036, T1204
Input: AppleSeed has compressed collected data before exfiltration.

Tactics: TA0009
Techniques: T1560
Input: Monitor for spaces at the end of file names, that can easily be checked with file monitoring.

Tactics: TA0005
Techniques: T1036.006, T1036
Input: Siloscape makes various native API calls.

Tactics: TA0002
Techniques: T1106
Input: Packet::getData decrypts the received payload and Converter::outString descrambles the result

Tactics: TA0005
Techniques: T1140
Input: Kimsuky has used Visual Basic to download malicious payloads.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Turla has also used PowerShell scripts to load and execute malware in memory.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Instead of creating an entry in the sudoers file, which must be done by root, any user can specify the setuid or setgid flag to be set for their own applications ( Linux and Mac File and Directory Permissions Modification).

Tactics: TA0004, TA0005
Techniques: T1548, T1548.001
Input: Installing a previously acquired SSL/TLS certificate to use to encrypt command and control traffic (ex: Asymmetric Cryptography with Web Protocols).

Tactics: TA0042
Techniques: T1608
Input: Network protocols that use asymmetric encryption often utilize symmetric encryption once keys are exchanged, but adversaries may opt to manually share keys and implement symmetric cryptographic algorithms (ex: RC4, AES) vice using mechanisms that are baked into a protocol.

Tactics: TA0010
Techniques: T1048, T1048.001
Input: The Registry key is located at HKLM\ SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CredUI\EnumerateAdministrators.

Tactics: TA0007
Techniques: T1087.002, T1087, T1087.001
Input: KEYMARBLE can upload files to the victim’s machine and can download additional payloads.

Tactics: TA0011
Techniques: T1105
Input: Adversaries may search in private threat intelligence vendor data to gather actionable information.

Tactics: TA0043
Techniques: T1597, T1597.001
Input: A wide variety of infrastructure exists for hosting and orchestrating adversary operations.

Tactics: TA0042
Techniques: T1583
Input: BackdoorDiplomacy has dropped legitimate software onto a compromised host and used it to execute malicious DLLs.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: HAFNIUM has used the Exchange Power Shell module Set-OabVirtualDirectoryPowerShell to export mailbox data.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: The function will take another executable embedded in the initial Trojan as a resource named “M”, which it attempts to inject into the following process to execute: C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe While it’s configured to inject into cvtres.exe, the Trojan is also capable of injecting its code into the following process as well: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe   Embedded injector Trojan The R payload discussed above is nothing more than an injector Trojan, which accepts a path to an executable and a buffer of code to inject into the process as arguments

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: Adversaries may modify code signing policies in a number of ways, including through use of command-line or GUI utilities, Modify Registry, rebooting the computer in a debug/recovery mode, or by altering the value of variables in kernel memory.

Tactics: TA0005
Techniques: T1553, T1553.006
Input: Reaver creates a shortcut file and saves it in a Startup folder to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547.001, T1547
Input: Note: this will not deactivate the mount functionality itself.

Tactics: TA0005
Techniques: T1553, T1553.005
Input: APT38 has installed a new Windows service to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Both responses instruct the malware to download and load a remote plugin

Tactics: TA0011
Techniques: T1105
Input: POWERSTATS has connected to C2 servers through proxies.

Tactics: TA0011
Techniques: T1090, T1090.002
Input: Adversaries can set the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList Registry key value to 0 for a specific user to prevent that user from being listed on the logon screen.

Tactics: TA0005
Techniques: T1564.002, T1564
Input: Honeybee gathers computer name and information using the systeminfo command.

Tactics: TA0007
Techniques: T1082
Input: Values can be derived from target-specific elements and used to generate a decryption key for an encrypted payload.

Tactics: TA0005
Techniques: T1480, T1480.001
Input: Brave Prince gathers information about the Registry.

Tactics: TA0007
Techniques: T1012
Input: LDAP (389/TCP)

Tactics: TA0006
Techniques: T1110.004, T1110, T1110.001, T1110.003
Input: Exaramel for Windows has a command to execute VBS scripts on the victim’s machine.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: An APT28 loader Trojan uses a cmd.exe and batch script to run its payload.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Neoichor can upload files from a victim's machine.

Tactics: TA0009
Techniques: T1005
Input: While Malicious File frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: They may also be used as a component of malware to establish a reverse connection or back-connect to a service or adversary controlled system.

Tactics: TA0011
Techniques: T1219
Input: Frankenstein has used Word documents that prompts the victim to enable macros and run a Visual Basic script.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Brave Prince gathers network configuration information as well as the ARP cache.

Tactics: TA0007
Techniques: T1016
Input: GALLIUM collected data from the victim's local system, including password hashes from the SAM hive in the Registry.

Tactics: TA0009
Techniques: T1005
Input: Some UAC bypass methods rely on modifying specific, user-accessible Registry settings.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Mis-Type may create a file containing the results of the command cmd.exe /c ipconfig /all.

Tactics: TA0007
Techniques: T1016
Input: Monitor for unexpected and abnormal access to resources, including access of websites and cloud-based applications by the same user in different locations or by different systems that do not match expected configurations.

Tactics: TA0006
Techniques: T1606, T1606.001
Input: They have also dumped the LSASS process memory using the MiniDump function.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: RainyDay can download files to a compromised host.

Tactics: TA0011
Techniques: T1105
Input: APT33 has utilized PowerShell to download files from the C2 server and run various scripts.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Machete has used base64 encoding.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Molerats has sent malicious links via email trick users into opening a RAR archive and running an executable.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Adversaries may modify component firmware to persist on systems.

Tactics: TA0003, TA0005
Techniques: T1542.002, T1542
Input: LiteDuke can securely delete files by first writing random data to the file.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: REvil can inject itself into running processes on a compromised host.

Tactics: TA0004, TA0005
Techniques: T1055
Input: FIN8 has attempted to map to C$ on enumerated hosts to test the scope of their current credentials/context.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: The first stage shellcode contains an interesting NOP sled with alternative instructions, which was most likely designed in such a way to avoid detection by antivirus products looking for large NOP blocks inside flash files: NOP sled composed of 0x90 and 0x91 opcodes The main purpose of the initial shellcode is to download second stage shellcode from hxxp://89.45.67[.]107/rss/5uzosoff0u.iaf

Tactics: TA0002, TA0005, TA0011
Techniques: T1027, T1105, T1059
Input: Agent Tesla  has achieved persistence via scheduled tasks.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: A system's OS is responsible for managing the finite resources as well as preventing the entire system from being overwhelmed by excessive demands on its capacity.

Tactics: TA0040
Techniques: T1499, T1499.001
Input: gh0st RAT has used Zlib to compress C2 communications data before encrypting it.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: If they are required, follow best practices for securing them by requiring them to be signed and disabling user notification for allowing add-ins.

Tactics: TA0003
Techniques: T1137, T1137.001
Input: Carbon uses the command net time \127.0.0.1 to get information the system’s time.

Tactics: TA0007
Techniques: T1124
Input: BlackEnergy has gathered a process list by using Tasklist.exe.

Tactics: TA0007
Techniques: T1057
Input: WinMM sets a WH_CBT Windows hook to search for and capture files on the victim.

Tactics: TA0007
Techniques: T1083
Input: USB Monitor

Tactics: TA0003, TA0004
Techniques: T1547, T1547.010
Input: Crimson contains a command to collect the victim MAC address and LAN IP.

Tactics: TA0007
Techniques: T1016
Input: Blue Mockingbird has used frp, ssf, and Venom to establish SOCKS proxy connections.

Tactics: TA0011
Techniques: T1090
Input: Pysa has used Python scripts to deploy ransomware.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Indrik Spider has used Group Policy Objects to deploy batch scripts.

Tactics: TA0004, TA0005
Techniques: T1484.001, T1484
Input: Dridex contains a backconnect module for tunneling network traffic through a victim's computer.

Tactics: TA0011
Techniques: T1090
Input: Kwampirs collects password policy information with the command net accounts.

Tactics: TA0007
Techniques: T1201
Input: The group also adds its second stage payload to the startup programs as "Net Monitor."

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Operation Wocao has used a custom protocol for command and control.

Tactics: TA0011
Techniques: T1095
Input: Adversaries may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: Astaroth checks for the presence of Avast antivirus in the C:\Program\Files\ folder.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: If running with elevated privileges, OSX/Shlayer uses the spctl command to disable Gatekeeper protection for a downloaded file.

Tactics: TA0005
Techniques: T1553.001, T1553
Input: Bad Rabbit’s infpub.dat file creates a scheduled task to launch a malicious executable.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Monitor executed commands and arguments that may establish persistence by executing malicious content triggered by a file type association.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.001
Input: PinchDuke steals credentials from compromised hosts.

Tactics: TA0006
Techniques: T1003, T1555.003, T1555
Input: FatDuke can AES encrypt C2 communications.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Protect generated event files that are stored locally with proper permissions and authentication and limit opportunities for adversaries to increase privileges by preventing Privilege Escalation opportunities.

Tactics: TA0005
Techniques: T1070, T1070.002, T1070.001
Input: SynAck enumerates all running services.

Tactics: TA0007
Techniques: T1007
Input: Donut can use HTTP to download previously staged shellcode payloads.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: China Chopper's server component executes code sent via HTTP POST commands.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Responder is used to poison name services to gather hashes and credentials from systems within a local network.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: Adversaries may abuse list-view controls to inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.015
Input: Diavol has Base64 encoded the RSA public key used for encrypting files.

Tactics: TA0005
Techniques: T1027
Input: ZLib has the ability to execute shell commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Kimsuky has used browser extensions including Google Chrome to steal passwords and cookies from browsers.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: XCSSET uses the chmod +x command to grant executable permissions to the malicious file.

Tactics: TA0005
Techniques: T1222.002, T1222
Input: Users must specifically change settings to have these files viewable.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Monitor for the activation or invocation of a container (ex: docker start or docker restart)

Tactics: TA0002
Techniques: T1204
Input: Doki has used a script that gathers information from a hardcoded list of IP addresses and uploads to an Ngrok URL.

Tactics: TA0010
Techniques: T1020
Input: PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit search order hijacking vulnerabilities.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.008, T1574
Input: Adversaries may use the capabilities of WMI to subscribe to an event and execute arbitrary code when that event occurs, providing persistence on a system.

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: Adversaries may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system.

Tactics: TA0003
Techniques: T1137, T1137.004
Input: Confucius has downloaded additional files and payloads onto a compromised host following initial access.

Tactics: TA0011
Techniques: T1105
Input: The shellcode executed by this PowerShell is the exact same as in the delivery documents, using code from Metasploit which can obtain additional shellcode to execute using an HTTP request to the following URL: http://www7.chrome-up[.]date/0m5EE We were not able to retrieve the shellcode hosted at this URL

Tactics: TA0002, TA0011
Techniques: T1071, T1059.001, T1059
Input: njRAT can search a list of running processes for Tr.exe.

Tactics: TA0007
Techniques: T1057
Input: This process ultimately attempts to run the Trojan every three minutes, which is important as OopsIE relies on this scheduled task as it does not include a main loop to continue its execution

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Correlation of other events with behavior surrounding API function calls using API monitoring will provide additional context to an event that may assist in determining if it is due to malicious behavior.

Tactics: TA0002
Techniques: T1106
Input: keylogger) may be missing for these platforms

Tactics: TA0006, TA0009
Techniques: T1056
Input: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.

Tactics: TA0002
Techniques: T1047
Input: Dragonfly has likely obtained a list of hosts in the victim environment.

Tactics: TA0007
Techniques: T1018
Input: A Patchwork payload deletes Resiliency Registry keys created by Microsoft Office applications in an apparent effort to trick users into thinking there were no issues during application runs.

Tactics: TA0005
Techniques: T1112
Input: For example, if virtualization software is installed by the adversary the Registry may provide detection opportunities.

Tactics: TA0005
Techniques: T1564, T1564.006
Input: Mitigation of some variants of this technique could be achieved through the use of stateful firewalls, depending upon how it is implemented.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205, T1205.001
Input: Threat Group-3390 has deleted existing logs and exfiltrated file archives from a victim.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Cobalt Strike can use rundll32.exe to load DLL from the command line.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: GreyEnergy has a module to inject a PE binary into a remote process.

Tactics: TA0004, TA0005
Techniques: T1055.002, T1055
Input: A Winnti for Windows implant file was named ASPNET_FILTER.DLL, mimicking the legitimate ASP.NET ISAPI filter DLL with the same name.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: All login shells on a system use /etc/profile when initiated.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004