madox81/Adema_ATTACK_DS huggingface dataset:
Input: These methods may include using a familiar naming convention and/or password protecting the file and supplying instructions to a user on how to open it.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Grandoreiro can store its configuration in the Registry at HKCU\Software\ under frequently changing names including %USERNAME% and ToolTech-RM.

Tactics: TA0005
Techniques: T1112
Input: Rocke downloaded a file "libprocesshider", which could hide files on the target system.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Web proxies can be used to enforce an external network communication policy that prevents use of unauthorized external services.

Tactics: TA0010
Techniques: T1567.001, T1567.002, T1567
Input: In environments with high-maturity, it may be possible to leverage User-Behavioral Analytics (UBA) platforms to detect and alert on user-based anomalies.

Tactics: TA0009
Techniques: T1213, T1213.003
Input: POWRUNER may collect information about the system by running hostname and systeminfo on a victim.

Tactics: TA0007
Techniques: T1082
Input: HOPLIGHT has been observed collecting system time from victim machines.

Tactics: TA0007
Techniques: T1124
Input: HOPLIGHT has used its C2 channel to exfiltrate data.

Tactics: TA0010
Techniques: T1041
Input: Policies, procedures, and standards

Tactics: TA0009
Techniques: T1213, T1213.001, T1213.002
Input: The most notable change to this variant of Zebrocy, other than the programming language used, is the way the tool gathers the system information and running processes

Tactics: TA0007
Techniques: T1057
Input: FIN7 captured screenshots and desktop video recordings.

Tactics: TA0009
Techniques: T1113
Input: Remexi silently executes received commands with cmd.exe.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: KOCTOPUS has been distributed as a malicious link within an email.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Sidewinder has sent e-mails with malicious links often crafted for specific targets.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Matryoshka is capable of providing Meterpreter shell access.

Tactics: TA0002
Techniques: T1059
Input: Cuba has been dropped onto systems and used for lateral movement via obfuscated PowerShell scripts.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Inception has used a reconnaissance module to gather information about the operating system and hardware on the infected host.

Tactics: TA0007
Techniques: T1082
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may abuse legitimate extensible development features of servers to establish persistent access to systems.

Tactics: TA0003
Techniques: T1505
Input: TeamTNT has deployed different types of containers into victim environments to facilitate execution.

Tactics: TA0002, TA0005
Techniques: T1610
Input: Adversaries can also modify the LSUIElement key in an application’s info.plist file  to run the app in the background.

Tactics: TA0005
Techniques: T1647
Input: Cyclops Blink can download files via HTTP and HTTPS.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: The legitimate owaauth.dll file resides in %ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\Auth\ while CTU researchers have observed the backdoor using the same filename in the %ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\bin\ directory

Tactics: TA0005
Techniques: T1036
Input: BloodHound can collect information about domain groups and members.

Tactics: TA0007
Techniques: T1069.002, T1069
Input: CrackMapExec can brute force credential authentication by using a supplied list of usernames and a single password.

Tactics: TA0006
Techniques: T1110, T1110.003
Input: In addition to network level detections, endpoint logging and instrumentation can be useful for detection.

Tactics: TA0040
Techniques: T1499.002, T1499, T1499.003
Input: FatDuke can used pipes to connect machines with restricted internet access to remote machines via other infected hosts.

Tactics: TA0011
Techniques: T1090.001, T1090
Input: DLL functions can also be exported and executed by an ordinal number (ex: rundll32.exe file.dll,#1).

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Out1 can use HTTP and HTTPS in communications with remote hosts.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Downgrade Attacks can also be used to establish an AiTM position, such as by negotiating a less secure, deprecated, or weaker version of communication protocol (SSL/TLS) or encryption algorithm.

Tactics: TA0006, TA0009
Techniques: T1557
Input: TrickBot uses vncDll module to remote control the victim machine.

Tactics: TA0011
Techniques: T1219
Input: Kimsuky has gathered credentials using Mimikatz and ProcDump.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: The information may be used to enhance their awareness of the system and network environment or may be used for further actions.

Tactics: TA0007
Techniques: T1120
Input: Pony also obfuscates the memory flow by adding junk instructions when executing to make analysis more difficult.

Tactics: TA0005
Techniques: T1027
Input: Monitor for Process Injection against browser applications.

Tactics: TA0009
Techniques: T1185
Input: A thorough explanation of what information is collected can be found in a breakdown by Cofense from late 2018.   The script verifies all parts of the malware have been downloaded.  After downloading the payload, the XSL script checks to make sure every piece of the malware was downloaded.   One of the twelve download commands as detected by the Cybereason platform in same variant of Astaroth.   The twelve downloaded files

Tactics: TA0011
Techniques: T1105
Input: In GCP, monitor for: google.logging.v2.ConfigServiceV2.UpdateSink.

Tactics: TA0005
Techniques: T1562.008, T1562
Input: The CLI may be used to manipulate traffic flows to intercept or manipulate data, modify startup configuration parameters to load malicious system software, or to disable security features or logging to avoid detection.

Tactics: TA0002
Techniques: T1059.008, T1059
Input: These programs control flow of execution before the operating system takes control.

Tactics: TA0003, TA0005
Techniques: T1542
Input: XCSSET identifies the macOS version and uses ioreg to determine serial number.

Tactics: TA0007
Techniques: T1082
Input: KillDisk registers as a service under the Plug-And-Play Support name.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Kessel has collected the DNS address of the infected host.

Tactics: TA0007
Techniques: T1016
Input: SILENTTRINITY is written in Python and can use multiple Python scripts for execution on targeted systems.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: For example, malware may execute share modules to load additional components or features.

Tactics: TA0002
Techniques: T1129
Input: Flame identifies security software such as antivirus through the Security module.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: If you compare the HTTP GET request from the RIPTIDE samples (Figure 1) to the HTTP GET request from the HIGHTIDE samples (Figure 3) you can see the malware author changed the following items:  User Agent Format and structure of the HTTP Uniform Resource Identifier (URI)   Figure 3: HIGHTIDE GET Request Example Similar to RIPTIDE campaigns, APT12 infects target systems with HIGHTIDE using a Microsoft Word (.doc) document that exploits CVE-2012-0158

Tactics: TA0011
Techniques: T1071
Input: WastedLocker has copied a random file from the Windows System32 folder to the %APPDATA% location under a different hidden filename.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Aria-body has the ability to collect data from USB devices.

Tactics: TA0009
Techniques: T1025