madox81/Adema_ATTACK_DS huggingface dataset:
Input: A VNC server must be manually installed by the user or adversary.

Tactics: TA0008
Techniques: T1021.005, T1021
Input: DarkComet gathers the username from the victim’s machine.

Tactics: TA0007
Techniques: T1033
Input: Cobalt Strike can be configured to have commands relayed over a peer-to-peer network of infected hosts.

Tactics: TA0011
Techniques: T1090.001, T1090
Input: GrimAgent can use the Windows Command Shell to execute commands, including its own removal.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Every Launch Agent and Launch Daemon must have a corresponding plist file on disk which can be monitored.

Tactics: TA0002
Techniques: T1569.001, T1569
Input: ThreatNeedle relies on a victim to click on a malicious document for initial execution.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: CORESHELL can communicate over SMTP and POP3 for C2.

Tactics: TA0011
Techniques: T1071, T1071.003
Input: Adversaries may exploit software vulnerabilities in an attempt to collect credentials.

Tactics: TA0006
Techniques: T1212
Input: Maze has checked the language of the machine with function GetUserDefaultUILanguage and terminated execution if the language matches with an entry in the predefined list.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: Machete hijacks the clipboard data by creating an overlapped window that listens to keyboard events.

Tactics: TA0009
Techniques: T1115
Input: Fox Kitten has used PowerShell scripts to access credential data.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Compare recent invocations of hh.exe with prior history of known good arguments to determine anomalous and potentially adversarial activity (ex: obfuscated and/or malicious commands).

Tactics: TA0005
Techniques: T1218, T1218.001
Input: DarkComet has dropped itself onto victim machines with file names such as WinDefender.Exe and winupdate.exe in an apparent attempt to masquerade as a legitimate file.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Proton gathers credentials in files for keychains.

Tactics: TA0006
Techniques: T1555.001, T1555
Input: Adversaries may use the information from System Location Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Tactics: TA0007
Techniques: T1614
Input: APT29 has granted company administrator privileges to a newly created service principal.

Tactics: TA0003
Techniques: T1098, T1098.003
Input: attachedTemplate.dotm xxx 11/15/18 05:35 11/15/18 05:35 109.248.148[.]42    Table 2 Remote templates downloaded by Dear Joohn delivery documents As seen in Table 1, the delivery documents accessed their respective remote templates from four C2 servers at the following IP addresses:  185.203.118[.]198 145.249.105[.]165 188.241.58[.]170  109.248.148[.]42  These initial C2 IP addresses not only hosted the remote templates that subsequently load the first-stage Zebrocy or Cannon payloads, but the IP addresses also hosted the C2 server for the first-stage payloads themselves

Tactics: TA0011
Techniques: T1105
Input: EnvyScout has been executed through malicious files attached to e-mails.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Successfully checking the loader will execute the dllhost.exe process and create a hardcode mutex to avoid injecting it into the wrong dllhost.exe, as there can be multiple instances of it depending on the number of programs using the Internet Information Services

Tactics: TA0004, TA0005
Techniques: T1055
Input: TA505 has used PowerShell to download and execute malware and reconnaissance scripts.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: A menuPass macro deletes files after it has decoded and decompressed them.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: KGH_SPY can send data to C2 with HTTP POST requests.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: FIN7 has signed Carbanak payloads with legally purchased code signing certificates.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Monitor for newly executed processes that may abuse the Windows command shell for execution.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: The Check Point IPS blade provides protections against these threats:  Command Injection Over HTTP NoneCMS ThinkPHP Remote Code Execution (CVE-2018-20062) Oracle WebLogic WLS Security Component Remote Code Execution (CVE-2017-10271) Oracle WebLogic WLS Server Component Arbitrary File Upload(CVE-2018-2894) Hadoop YARN ResourceManager Remote Command Execution Apache ActiveMQ Fileserver Multi Methods Directory Traversal(CVE-2016-3088) JBoss Seam 2 Framework Remote Code Execution (CVE-2010-1871) JBoss Enterprise Application Platform Invoker Servlets Remote Code Execution (CVE-2012-0874) Red Hat JBoss AS Remote Code Execution Suspicious Linux Shell Downloader  The Check Point Anti-Bot blade provides protections against this threat:  Linux.SpeakUp  IOCs Md5: SpeakUp Scripts:     0a4e5831a2d3115acb3e989f0f660a6f   0b5e1eb67be7c3020610b321f68375c1   968d1906be7eb8321a3afac5fde77467   074d7a4417d55334952d264c0345d885   f357f32d7c2ddfef4b5850e7506c532b   b6311bffcea117dceac5ccac0a243ae5   2adf4e4512aaafab75e8411aa7121ffa   a73c7b777d31b0a8ef270809e2ed6510   114cda60d215e44baeef22b7db0c64d5   8f725fc5406ebf679c5c7ade3e8d5f70   4a80a075c7c6b5e738a7f4b60b7b101f   e18749e404baec2aa29f4af001164d1b   1a377b5d5d2162327f0706cc84427780   1da94e156609d7e880c413a124bad004   713260a53eff05ad44aad8d6899f1c6e   36cda3c77ba380d6388a01aafcbaa6c7   0f83482368343f5c811bac84a395d2c0   8dd6cb5f33d25512805c70bd3db5f433   e4ca1e857034cbe0428d431c15ec8608   36502273cee61825dc97d62a3dffe729   f16c5a6342ccc253b1de177d3fa310b1   08d7674532cc226931570e6a99d5ba30   279c4aa955085480f3ad0c19aa36a93b    XMRig Miners: f79be3df4cbfe81028040796733ab07f a21a3d782d30b51515834a7bf68adc8e c572a10ca12f3bd9783c6d576aa080fb b60ec230644b740ca4dd6fd45059a4be 5e6b6fcd7913ae4917b0cdb0f09bf539 ae875c496535be196449547a15205883 068d424a1db93ec0c1f90f5e501449a3 996e0c8190880c8bf1b8ffb0826cf30f C&Cs:    67[.]209.177.163   173[.]82.104.196   5[.]196.70.86   120[.]79.247.183   5[.]2.73.127/lnsqqFE2jK/pprtnp153WWW.php   Speakupomaha[.]com/misc/ui/images/Indxe.php   Linuxservers[.]000webhostapp[.]com/hp.html   linuxsrv134[.]xp3[.]biz    Monero Wallets: 47UW2Qv7AB4CsD8L5WWSvx58ztrzHhcMeYN7AJry9aMZhGDLXGwBHLv8LpaDUxpmdWfqbbfrqpdieQAeVSMCU1qY4BFABPY 4Aa3TcU7ixMVcYwbsw8ENVbFwt4ZuqrNBVij5TRvPCTpGRK5BKBHQPu7ahT7z2A6547a5Lcn7yPZV1xU22ZbviqxUX7JVuP 4An3Radh69LgcTHJf1U3awa9ffej4b6DcUmEv8wirsDm8zRMSjifrwybH2AzHdEsW8eew3rFtk4QbGJMxqitfxmZJhABxpT

Tactics: TA0002, TA0005, TA0011
Techniques: T1140, T1569.002, T1203, T1106, T1105, T1569, T1059
Input: Winlogon\Notify - points to notification package DLLs that handle Winlogon events

Tactics: TA0003, TA0004
Techniques: T1547.004, T1547
Input: Chimera has used multiple password spraying attacks against victim's remote services to obtain valid user and administrator accounts.

Tactics: TA0006
Techniques: T1110, T1110.003
Input: The vmtools.dll file is a modified DLL that both ensures persistence and loads MSBuild.exe, which is the BADNEWS malware renamed to spoof a legitimate Microsoft Visual Studio tool

Tactics: TA0005
Techniques: T1036
Input: ASPXTool — A modified version of the ASPXSpy web shell (see Figure 6)

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Patchwork encrypted the collected files' path with AES and then encoded them with base64.

Tactics: TA0009
Techniques: T1560
Input: Monitor executed commands and arguments that may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.

Tactics: TA0007
Techniques: T1016
Input: A variant of ADVSTORESHELL encrypts some C2 with 3DES.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Net Crawler uses credential dumpers such as Mimikatz and Windows Credential Editor to extract cached credentials from Windows systems.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: PowerShell scripts also exist that contain credential dumping functionality, such as PowerSploit's Invoke-Mimikatz module,  which may require additional logging features to be configured in the operating system to collect necessary information for analysis.

Tactics: TA0006, TA0007
Techniques: T1033, T1003
Input: Monitor processes and command-line arguments to see if critical processes are terminated or stop running.

Tactics: TA0040
Techniques: T1489
Input: Strings in Attor's components are encrypted with a XOR cipher, using a hardcoded key and the configuration data, log files and plugins are encrypted using a hybrid encryption scheme of Blowfish-OFB combined with RSA.

Tactics: TA0005
Techniques: T1027
Input: NotPetya can use valid credentials with PsExec or wmic to spread itself to remote systems.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.003
Input: RTM has used an RSS feed on Livejournal to update a list of encrypted C2 server names.

Tactics: TA0011
Techniques: T1102.001, T1102
Input: RATANKBA runs the net view /domain and net view commands.

Tactics: TA0007
Techniques: T1018
Input: Figure 11 Embedded BMP file containing encrypted string data RC4 is used to decrypt this data using a 16-byte key that is stored within the BMP file at offset 0x502

Tactics: TA0005
Techniques: T1140
Input: Since internally defacing systems exposes an adversary's presence, it often takes place after other intrusion goals have been accomplished.

Tactics: TA0040
Techniques: T1491.001, T1491
Input: QUADAGENT used the PowerShell filenames Office365DCOMCheck.ps1 and SystemDiskClean.ps1.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Calisto adds permissions and remote logins to all users.

Tactics: TA0003
Techniques: T1098
Input: The configuration and strings are encrypted using 3DES and Base64 encoding

Tactics: TA0005
Techniques: T1027
Input: From a classic Pass-The-Hash perspective, this technique uses a hash through the NTLMv1 / NTLMv2 protocol to authenticate against a compromised endpoint.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: The attack is part of a trend where threat groups hide malicious activity by communicating with legitimate web services such as social networking and cloud storage sites to foil detection efforts.[2][3] A Cyber Campaign Likely Intended to Monitor Hong Kong Media During a Period of Crisis The threat group has previously used newsworthy events as lures to deliver malware.[4] They have largely targeted organizations involved in financial, economic and trade policy, typically using publicly available RATs such as Poison Ivy, as well some non-public backdoors.[5] The group started targeting Hong Kong media companies, probably in response to political and economic challenges in Hong Kong and China

Tactics: TA0011
Techniques: T1102
Input: Monitor for API calls that may abuse Pre-OS Boot mechanisms as a way to establish persistence on a system.

Tactics: TA0003, TA0005
Techniques: T1542
Input: Earlier versions of PowerShell do not have many logging features.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Gamaredon Group has delivered self-extracting 7z archive files within malicious document attachments, and used obfuscated or encrypted scripts.

Tactics: TA0005
Techniques: T1027
Input: SeaDuke uses a module to execute Mimikatz with PowerShell to perform Pass the Ticket.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: DarkHydrus used an open-source tool, Phishery, to inject malicious remote template URLs into Microsoft Word documents and then sent them to victims to enable Forced Authentication.

Tactics: TA0005
Techniques: T1221
Input: ObliqueRAT can break large files of interest into smaller chunks to prepare them for exfiltration.

Tactics: TA0010
Techniques: T1030
Input: InvisiMole determines a working directory where it stores all the gathered data about the compromised machine.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Astaroth uses JavaScript to perform its core functionalities.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Later implants used by APT28, such as CHOPSTICK, use a blend of HTTP, HTTPS, and other legitimate channels for C2, depending on module configuration.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: When used maliciously, LKMs can be a type of kernel-mode Rootkit that run with the highest operating system privilege (Ring 0).

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: MuddyWater has specifically targeted government agency employees with spearphishing e-mails.

Tactics: TA0043
Techniques: T1589.002, T1589
Input: StrongPity can determine if a user is logged in by checking to see if explorer.exe is running.

Tactics: TA0007
Techniques: T1057
Input: Monitor executed commands and arguments that may gather information about the victim's business relationships that can be used during targeting.

Tactics: TA0005
Techniques: T1480
Input: SLOTHFULMEDIA has deleted itself and the 'index.dat' file on a compromised machine to remove recent Internet history from the system.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: rundll32.exe C:\Windows\System32\comsvcs.dll MiniDump PID  lsass.dmp full

Tactics: TA0006
Techniques: T1003, T1003.001
Input: menuPass uses PowerSploit to inject shellcode into PowerShell.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Volatile Cedar can inject web shell code into a server.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Monitor for changes made to files that may abuse the Microsoft Office "Office Test" Registry key to obtain persistence on a compromised system.

Tactics: TA0003
Techniques: T1137.002, T1137
Input: HermeticWizard has been signed by valid certificates assigned to Hermetica Digital.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Emotet has obfuscated macros within malicious documents to hide the URLs hosting the malware,  CMD.exe arguments, and PowerShell scripts.

Tactics: TA0005
Techniques: T1027
Input: Koadic can gather hashed passwords by dumping SAM/SECURITY hive.

Tactics: TA0006
Techniques: T1003, T1003.002
Input: Kazuar adds a sub-key under several Registry run keys.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: APT32 has collected e-mail addresses for activists and bloggers in order to target them with spyware.

Tactics: TA0043
Techniques: T1589.002, T1589
Input: If scripting is restricted for normal users, then any attempts to enable scripts running on a system would be considered suspicious.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Clop can enumerate network shares.

Tactics: TA0007
Techniques: T1135
Input: FALLCHILL has been installed as a Windows service.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Exaramel for Linux can run whoami to identify the system owner.

Tactics: TA0007
Techniques: T1033
Input: Linfo creates a backdoor through which remote attackers can change the frequency at which compromised hosts contact remote C2 infrastructure.

Tactics: TA0010
Techniques: T1029
Input: 59 60 61 62 freeimage_32.dll freeimageplus_32.dll freeimage_64.dll freeimageplus_64.dll FreeImage open source library supports popular graphics image formats (ver 3.15.4 2012-10-27) (http://freeimage.sourceforge.net)

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1055, T1574
Input: Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.

Tactics: TA0007
Techniques: T1057
Input: CORALDECK has exfiltrated data in HTTP POST headers.

Tactics: TA0010
Techniques: T1048.003, T1048
Input: BitPaymer can search for network shares on the domain or workgroup using net view .

Tactics: TA0007
Techniques: T1135
Input: Ursnif has injected HTML codes into banking sites to steal sensitive online banking information (ex: usernames and passwords).

Tactics: TA0009
Techniques: T1185
Input: Downdelph uses RC4 to encrypt C2 responses.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: DLL side-loading has been used to execute BBSRAT through a legitimate Citrix executable, ssonsvr.exe.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: API function names are also reversed, presumably to avoid detection in memory.

Tactics: TA0005
Techniques: T1027
Input: Astaroth uses the LoadLibraryExW() function to load additional modules.

Tactics: TA0002
Techniques: T1129
Input: Cobalt Group leveraged an open-source tool called SoftPerfect Network Scanner to perform network scanning.

Tactics: TA0007
Techniques: T1046
Input: FinFisher queries Registry values as part of its anti-sandbox checks.

Tactics: TA0007
Techniques: T1012
Input: Windows API calls such as WriteProcessMemory() and NtQueryInformationProcess() with the parameter set to ProcessBasicInformation may be used for this technique.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.013, T1574
Input: If a service binary path or failure parameters are changed to values that are not typical for that service and does not correlate with software updates, then it may be due to malicious activity.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.011, T1574
Input: FIN5 uses SDelete to clean up the environment and attempt to prevent detection.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Another variant decodes the embedded file by XORing it with the value "0x35".

Tactics: TA0005
Techniques: T1140
Input: TSCookie has encrypted network communications with RC4.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Dragonfly has used a batch script to gather folder and file names from victim hosts.

Tactics: TA0007
Techniques: T1083
Input: The persona may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, GitHub, Docker Hub, ).

Tactics: TA0042
Techniques: T1585
Input: OSX/Shlayer also leveraged system links pointing to bash scripts in the downloaded DMG file to bypass Gatekeeper, a flaw patched in macOS 11.3 and later versions.

Tactics: TA0005
Techniques: T1553.001, T1553
Input: Wizard Spider has established persistence via the Registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and a shortcut within the startup folder.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Pony has attempted to lure targets into clicking links in spoofed emails from legitimate banks.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: APT38 has used DYEPACK.FOX to manipulate PDF data as it is accessed to remove traces of fraudulent SWIFT transactions from the data displayed to the end user.

Tactics: TA0040
Techniques: T1565.003, T1565
Input: Monitor executed commands and arguments that could be taken to gather system information related to services.

Tactics: TA0007
Techniques: T1007
Input: .iqy files are simple text files containing a URL which are opened by default by Excel

Tactics: TA0007
Techniques: T1083
Input: Because the alternate authentication must be maintained by the system—either in memory or on disk—it may be at risk of being stolen through Credential Access techniques.

Tactics: TA0005, TA0008
Techniques: T1550
Input: Koadic can perform process injection by using a reflective DLL.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: An adversary may rely upon a user clicking a malicious link in order to divulge information (including credentials) or to gain execution, as in Malicious Link.

Tactics: TA0042
Techniques: T1608.005, T1608
Input: Unknown Logger is capable of recording keystrokes.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Patchwork has used spearphishing with links to deliver files with exploits to initial victims.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Ke3chang has used keyloggers.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: PoshC2 can use Get-PassPol to enumerate the domain password policy.

Tactics: TA0007
Techniques: T1201
Input: RGDoor establishes persistence on webservers as an IIS module.

Tactics: TA0003
Techniques: T1505.004, T1505
Input: Depending on the systems within the network, initializing one of these scripts could apply to more than one or potentially all systems.

Tactics: TA0003, TA0004
Techniques: T1037.003, T1037
Input: Crutch has the ability to persist using scheduled tasks.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: macOS and Linux both keep track of system or user-initiated actions via system logs.

Tactics: TA0005
Techniques: T1070, T1070.002
Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Phishing or Hardware Additions).

Tactics: TA0043
Techniques: T1591, T1591.001
Input: Peppy can download and execute remote files.

Tactics: TA0011
Techniques: T1105
Input: If this information is not present, the computer will not be able to load an operating system during the boot process, leaving the computer unavailable.

Tactics: TA0040
Techniques: T1561, T1561.002
Input: On Linux and macOS, hijacking dynamic linker variables may grant access to the victim process's memory, system/network resources, and possibly elevated privileges.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.006, T1574
Input: Monitor executed commands and arguments for actions that could be utilized to unlink, rename, or delete files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Adversaries may enumerate objects in cloud storage infrastructure.

Tactics: TA0007
Techniques: T1619
Input: SslMM sends information to its hard-coded C2, including OS version, service pack information, processor speed, system name, and OS install date.

Tactics: TA0007
Techniques: T1082
Input: ROMMON is a Cisco network device firmware that functions as a boot loader, boot image, or boot helper to initialize hardware and software when the platform is powered on or reset.

Tactics: TA0003, TA0005
Techniques: T1542.004, T1542
Input: Before registering new passwords in the Security Accounts Manager (SAM), the Local Security Authority (LSA) requests validation from each registered filter.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.002, T1556
Input: Drovorub can execute arbitrary commands as root on a compromised system.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: FELIXROOT encrypts collected data with AES and Base64 and then sends it to the C2 server.

Tactics: TA0009
Techniques: T1560
Input: Metamorfo has used MsiExec.exe to automatically execute files.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: Monitor for unexpected files used to gather credentials when the files are rendered

Tactics: TA0006
Techniques: T1187
Input: Adversaries may abuse control.exe to proxy execution of malicious payloads.

Tactics: TA0005
Techniques: T1218, T1218.002
Input: Common office and productivity applications such as Microsoft Office are also targeted through Phishing.

Tactics: TA0002
Techniques: T1203
Input: KGH_SPY can exfiltrate collected information from the host to the C2 server.

Tactics: TA0010
Techniques: T1041
Input: Malware may be used to inject false credentials into the authentication process on a domain controller with the intent of creating a backdoor used to access any user’s account and/or credentials (ex: Skeleton Key).

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.001
Input: Monitor access to code repositories, especially performed by privileged users such as Active Directory Domain or Enterprise Administrators as these types of accounts should generally not be used to access code repositories.

Tactics: TA0009
Techniques: T1213, T1213.003
Input: ARTIFACTS: Documents:     2781526f6b302da00661b9a6a625a5a6ecf4ffccafa61202e9b0e9b61b657867     c357396ca82fdcd6b6f46b748f2b6941051dbc81be5326cf9548e6e95507af7c     ffebcc4d2e851baecd89bf11103e3c9de86f428fdeaf0f8b33d9ea6f5ef56685     Domains:  true-deals[.]com; strikes-withlucky[.]com Email account in registration is: isvarawski@yahoo.com Attacker email account: adrian.1987clark@yahoo.com

Tactics: TA0007
Techniques: T1087
Input: From the user's perspective though, this is very hard to notice from within the Finder.app or on the command-line in Terminal.app.

Tactics: TA0005
Techniques: T1036.006, T1036