madox81/Adema_ATTACK_DS huggingface dataset:
Input: For more information on LOLbins in the wild, read our research into a different Trojan.  LOLbins and Trojans: How the Ramnit Trojan Spreads via sLoad in a Cyberattack Indicators of CompromisE     SHA1 01782747C12Bf06A52704A144DB59FEC41B3CB36   Hash   NF-e513468.zip     SHA1 1F83403398964D4E8B6C70B171C51CD278909172   Hash   Script.js     SHA1 CE8BDB56CCAC55C6881701EBD39DA316EE7ED18D   Hash   lrdsnhrxxfery64.~     SHA1 926137A50f473BBD257CD19E207C1C9114F6B215   Hash   lrdsnhrxxfery98.~     SHA1 5579E03EB1DA076EF939196CB14F8B769F30A302   Hash   lrdsnhrxxferyb.jpg     SHA1 B2734835888756929EE3FF4DCDE85080CB299D2A   Hash   lrdsnhrxxferyc.jpg     SHA1 206352E13D601239E2D043D971EA6657C091071A   Hash   lrdsnhrxxferydwwn.gif     SHA1 EAE82A63A980998F8D388BCCE7D967F28309F593   Hash   lrdsnhrxxferydwwn.gif     SHA1 9CD5A399C9320CBFB87C9D1CAD3BC366FB12E54F   Hash   lrdsnhrxxferydx.gif     SHA1 206352E13D601239E2D043D971EA6657C091071A   Hash   lrdsnhrxxferye.jpg     SHA1 4CDE9A53A9A49D606BC89E74D47398A69E767056   Hash   lrdsnhrxxferyg.gif     SHA1 F99319B1B321AE9F2D1F0361BC756A43D25444CE   Hash   lrdsnhrxxferygx.gif     SHA1 B85C106B68ED410107f97A2CC38b7EC05353F1FA   Hash   lrdsnhrxxferyxa.~     SHA1 77809236FDF621ABE37B32BF073B0B893E9CE67A   Hash   lrdsnhrxxferyxb.~     SHA1 B85C106B68ED410107f97A2CC38b7EC05353F1fA   Hash   lrdsnhrxxferyxa.~     SHA1 C2F3350AC58DE900768032554C009C4A78C47CCC   Hash   r1.log     104.129.204[.]41   IP   C2     63.251.126[.]7   IP   C2     195.157.15[.]100   IP   C2     173.231.184[.]59   IP   C2     64.95.103[.]181   IP   C2     19analiticsx00220a[.]com   Domain   C2     qnccmvbrh.wilstonbrwsaq[.]pw   Domain   C2

Tactics: TA0005, TA0008, TA0011, TA0010
Techniques: T1041, T1550.002, T1573, T1071, T1027, T1571, T1008, T1102, T1550, T1027.001
Input: The Delphi variant of Cannon does not use legitimate web-based email services for its C2 communications, instead opting to use email accounts at an actor owned domain, ambcomission[.]com

Tactics: TA0011
Techniques: T1102
Input: FoggyWeb's loader has reflectively loaded .NET-based assembly/payloads into memory.

Tactics: TA0005
Techniques: T1620
Input: Move system's root of trust to hardware to prevent tampering with the SPI flash memory.

Tactics: TA0003, TA0005
Techniques: T1542.001, T1542
Input: Leviathan has used PowerShell for execution.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: HyperBro can be delivered encrypted to a compromised host.

Tactics: TA0005
Techniques: T1027
Input: Use multi-factor authentication for logons to code repositories.

Tactics: TA0009
Techniques: T1213, T1213.003
Input: Monitor for common formats of RTLO characters within filenames such as \u202E, [U+202E], and %E2%80%AE.

Tactics: TA0005
Techniques: T1036, T1036.002
Input: Get2 has the ability to identify running processes on an infected host.

Tactics: TA0007
Techniques: T1057
Input: Monitor for API calls associated with gathering information on domain trust relationships that may be used to identify lateral movement like DSEnumerateDomainTrusts() Win32 API call to spot activity associated with Domain Trust Discovery.

Tactics: TA0007
Techniques: T1482
Input: Kimsuky has used emails containing Word, Excel and/or HWP (Hangul Word Processor) documents in their spearphishing campaigns.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: On a non-server Windows OS this increased functionality may also enable an adversary to avoid Terminal Services prompts that warn/log out users of a system when a new RDP session is created.

Tactics: TA0003
Techniques: T1505.005, T1505
Input: EVILNUM has used the malware variant, TerraTV, to run a legitimate TeamViewer application to connect to compromrised machines.

Tactics: TA0011
Techniques: T1219
Input: OSInfo discovers the current domain information.

Tactics: TA0007
Techniques: T1016
Input: Another variation of this technique is to utilize temporary storage attached to the compute instance.

Tactics: TA0005
Techniques: T1578, T1578.004
Input: Monitor for DLL/PE file events, such as the Control_RunDLL and ControlRunDLLAsUser API functions in shell32.dll.

Tactics: TA0005
Techniques: T1218, T1218.002
Input: Bankshot encodes commands from the control server using a range of characters and gzip.

Tactics: TA0011
Techniques: T1132, T1132.002
Input: Adversaries may attempt to exfiltrate data via a physical medium, such as a removable drive.

Tactics: TA0010
Techniques: T1052
Input: Oftentimes, a customer will only use a subset of the available regions and may not actively monitor other regions.

Tactics: TA0005
Techniques: T1535
Input: Command arguments used before and after Regsvcs.exe or Regasm.exe invocation may also be useful in determining the origin and purpose of the binary being executed.

Tactics: TA0005
Techniques: T1218.009, T1218
Input: Koadic can download files off the target system to send back to the server.

Tactics: TA0009
Techniques: T1005
Input: Reaver deletes the original dropped file from the victim.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: GrimAgent has the ability to enumerate files and directories on a compromised host.

Tactics: TA0007
Techniques: T1083
Input: Other variants have set the following Registry keys for persistence: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\imejp : [self] and HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IAStorD.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Monitor for API calls that may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence.

Tactics: TA0003, TA0004
Techniques: T1543
Input: They then identify the Exchange server and attempt to install the OwaAuth web shell

Tactics: TA0003
Techniques: T1505.003, T1505
Input: The forwardingSMTPAddress parameter used in a forwarding process that is managed by administrators and not by user actions.

Tactics: TA0009
Techniques: T1114, T1114.003
Input: SeaDuke compressed data with zlib prior to sending it over C2.

Tactics: TA0009
Techniques: T1560.002, T1560
Input: Adversaries may setup email forwarding rules to collect sensitive information.

Tactics: TA0009
Techniques: T1114, T1114.003
Input: DLL injection is a method of executing arbitrary code in the address space of a separate live process.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: SEASHARPEE can timestomp files on victims using a Web shell.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: Turian can store copied files in a specific directory prior to exfiltration.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: StoneDrill has downloaded and dropped temporary files containing scripts; it additionally has a function to upload files from the victims machine.

Tactics: TA0011
Techniques: T1105
Input: ROADTools leverages valid cloud credentials to perform enumeration operations using the internal Azure AD Graph API.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078.004, T1078
Input: APT28 has collected emails from victim Microsoft Exchange servers.

Tactics: TA0009
Techniques: T1114, T1114.002
Input: TrickBot can modify registry entries.

Tactics: TA0005
Techniques: T1112
Input: The p-code is executed when the MS Office version specified in the _VBA_PROJECT stream (which contains the version-dependent description of the VBA project) matches the version of the host MS Office application.

Tactics: TA0005
Techniques: T1564, T1564.007
Input: Rancor has downloaded additional malware, including by using certutil.

Tactics: TA0011
Techniques: T1105
Input: Ursnif has registered itself as a system service in the Registry for automatic execution at system startup.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Remsec is capable of using DNS for C2.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: A malicious HTML page can be crafted that will execute code when loaded by Outlook Home Page.

Tactics: TA0003
Techniques: T1137, T1137.004
Input: This campaign began with a handful of spear phishing emails to South Korean targets and containing malicious attachments

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Limit the privileges of user accounts so that only authorized administrators can perform Winlogon helper changes.

Tactics: TA0003, TA0004
Techniques: T1547.004, T1547
Input: Chaes used the CreateFileW() API function with read permissions to access downloaded payloads.

Tactics: TA0002
Techniques: T1106
Input: Fox Kitten has named binaries and configuration files svhost and dllhost respectively to appear legitimate.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: FruitFly takes screenshots of the user's desktop.

Tactics: TA0009
Techniques: T1113
Input: QakBot can encrypt and pack malicious payloads.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Unlike other forms of persistent remote access, they do not initiate connections.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: FakeRun’s PDB string (D:\Work\Project\VS\house\Apple\Apple_20180115\Release\FakeRun.pdb) indicates the loader will execute dllhost.exe and inject one malicious DLL file, which is the backdoor, into this process

Tactics: TA0004, TA0005
Techniques: T1055
Input: Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.

Tactics: TA0011
Techniques: T1092
Input: Bazar can retrieve information from the infected machine.

Tactics: TA0009
Techniques: T1005
Input: RCSession can be installed via DLL side-loading.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: Windows password filters are password policy enforcement mechanisms for both domain and local accounts.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.002, T1556
Input: {HostProgram}_profile.ps1* $Home\My Documents\PowerShell\Profile.ps1* $Home\My Documents\PowerShell\Microsoft.

Tactics: TA0003, TA0004
Techniques: T1546.013, T1546
Input: Diavol can collect the computer name and OS version from the system.

Tactics: TA0007
Techniques: T1082
Input: Xbash can create a cronjob for persistence if it determines it is on a Linux system.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: Monitor for newly executed processes that may attempt to get information about running processes on a system.

Tactics: TA0007
Techniques: T1057
Input: Figure 2: Exploit Shellcode used to Locate and Decode Payload The shellcode (Figure 2) searches for and decodes the executable payload contained in memory between the beginning and ending file markers 0xBABABABA and 0xBBBBBBBB, respectively

Tactics: TA0005
Techniques: T1140
Input: SQLRat has used PowerShell to create a Meterpreter session.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: DNS information may include a variety of details, including registered name servers as well as records that outline addressing for a target’s subdomains, mail servers, and other hosts.

Tactics: TA0043
Techniques: T1590.002, T1590, T1596, T1596.001
Input: Monitor newly executed processes that may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles.

Tactics: TA0003, TA0004
Techniques: T1546.013, T1546
Input: Domain accounts can cover users, administrators, and services.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.002
Input: LookBack can enumerate services on the victim machine.

Tactics: TA0007
Techniques: T1007
Input: Hildegard has started a monero service.

Tactics: TA0003, TA0004
Techniques: T1543.002, T1543
Input: ZxShell can delete files from the system.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Patchwork leveraged the DDE protocol to deliver their malware.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: Monitor for anomalous file transfer activity between accounts and/or to untrusted/unexpected VPCs.

Tactics: TA0010
Techniques: T1537
Input: It then uses WebDAV to upload to a Box cloud drive.

Tactics: TA0010
Techniques: T1048
Input: Operation Wocao has scanned for open ports and used nbtscan to find NETBIOS nameservers.

Tactics: TA0007
Techniques: T1046
Input: BackdoorDiplomacy has disguised their backdoor droppers with naming conventions designed to blend into normal operations.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: The information stored under a service's Registry keys can be manipulated to modify a service's execution parameters through tools such as the service controller, sc.exe,  PowerShell, or Reg.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.011, T1574
Input: Consider monitoring for Process Hollowing, which includes monitoring for process creation (especially those in a suspended state) as well as access and/or modifications of these processes (especially by the parent process) via Windows API calls.

Tactics: TA0005
Techniques: T1564.010, T1564
Input: In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: Cyclops Blink has the ability to query device information.

Tactics: TA0007
Techniques: T1082
Input: TinyTurla has been installed using a .bat file.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Make it difficult for adversaries to advance their operation through exploitation of undiscovered or unpatched vulnerabilities by using sandboxing.

Tactics: TA0004, TA0005, TA0008
Techniques: T1210, T1211, T1068
Input: KARAE can collect system information.

Tactics: TA0007
Techniques: T1082
Input: Trojan.Karagany can capture information regarding the victim's OS, security, and hardware configuration.

Tactics: TA0007
Techniques: T1082
Input: 17-3 Function names To target specific victims, Astaroth is locale aware; any attempts to run the malware without locale spoofing will result in failed downloads and the inability to run the .dll files

Tactics: TA0007
Techniques: T1083
Input: Adversaries may target system-wide logging or just that of a particular application.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: Failed login activity can be indicative of failed intrusion activity.If remote access between zones is an unavoidable business need, log and monitor these connections closely.In environments with a high risk of interception or intrusion, organizations should consider supplementing password authentication with other forms of authentication such as challenge/response or multifactor authentication using biometric or physical tokens.Logging PracticesSystem operators should follow these secure logging practices.Ensure event logging, including applications, events, login activities, and security attributes, is turned on or monitored for identification of security issues.Configure network logs to provide adequate information to assist in quickly developing an accurate determination of a security incident.Upgrade PowerShell to new versions with enhanced logging features and monitor the logs to detect usage of PowerShell commands, which are often malware-related.Secure logs in a centralized location and protect them from modification.Prepare an incident response plan that can be rapidly administered in case of a cyber intrusion

Tactics: TA0002, TA0005, TA0007, TA0011
Techniques: T1070, T1518.001, T1090.003, T1562.001, T1518, T1059.001, T1090, T1562, T1059
Input: Patch deployment systems regularly to prevent potential remote access through Exploitation for Privilege Escalation.

Tactics: TA0002, TA0008
Techniques: T1072
Input: Because this method may be used in conjunction with  Patch System Image, it may be appropriate to also verify the integrity of the vendor provided operating system image file.

Tactics: TA0005
Techniques: T1601
Input: MailSniper can be used for password spraying against Exchange and Office 365.

Tactics: TA0006
Techniques: T1110, T1110.003
Input: When Duqu is active, the operating system believes that the driver is legitimate, as it has been signed with a valid private key.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Limit remote user permissions if remote access is necessary.

Tactics: TA0008
Techniques: T1563.002, T1021.001, T1021, T1563
Input: Enforce execution of only signed PowerShell scripts.

Tactics: TA0003, TA0004
Techniques: T1546.013, T1546
Input: Confucius has lured victims into clicking on a malicious link sent through spearphishing.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: CSPY Downloader has attempted to appear as a legitimate Windows service with a fake description claiming it is used to support packed applications.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: RDAT can also embed additional messages within BMP images to communicate with the RDAT operator.

Tactics: TA0011
Techniques: T1001, T1001.002
Input: ifconfig can be used to display adapter configuration on Unix systems, including information for TCP/IP, DNS, and DHCP.

Tactics: TA0007
Techniques: T1016
Input: Pandora can use DLL side-loading to execute malicious payloads.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: MCMD has been named Readme.txt to appear legitimate.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Monitor for established network communications with anomalous IPs that have never been seen before in the environment that may indicate the download of malicious code.

Tactics: TA0005
Techniques: T1612
Input: ServHelper has commands for adding a remote desktop user and sending RDP traffic to the attacker through a reverse SSH tunnel.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Patchwork scanned the "Program Files" directories for a directory with the string "Total Security" (the installation path of the "360 Total Security" antivirus tool).

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Matryoshka uses reflective DLL injection to inject the malicious library and execute the RAT.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: Retriever uses .NET web services and the SoapHttpClientProtocol class to communicate with its C2 server, which generates HTTP requests resembling the example request in Figure 4

Tactics: TA0011
Techniques: T1071
Input: Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel.

Tactics: TA0010
Techniques: T1048
Input: Use of RDP may be legitimate, depending on the network environment and how it is used.

Tactics: TA0008
Techniques: T1563.002, T1563
Input: ZxShell has used HTTP for C2 connections.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: NanHaiShu launches a script to delete their original decoy file to cover tracks.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: SILENTTRINITY can find a process owned by a specific user and impersonate the associated token.

Tactics: TA0004, TA0005
Techniques: T1134, T1134.001
Input: The group has specifically used credentials stolen through a spearphishing email to login to the DCCC network.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent JavaScript scripts from executing potentially malicious downloaded content .

Tactics: TA0002
Techniques: T1059.007, T1059
Input: AppleJeus has required user execution of a malicious MSI installer.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: While User Execution frequently occurs shortly after Initial Access it may occur at other phases of an intrusion, such as when an adversary places a file in a shared directory or on a user's desktop hoping that a user will click on it.

Tactics: TA0002
Techniques: T1204
Input: Monitor for newly constructed containers that may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel.

Tactics: TA0002
Techniques: T1204
Input: Control Panel items can be executed directly from the command line, programmatically via an application programming interface (API) call, or by simply double-clicking the file.

Tactics: TA0005
Techniques: T1218, T1218.002
Input: Maze has inserted large blocks of junk code, including some components to decrypt strings and other important information for later in the encryption process.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: GrimAgent can enumerate the IP and domain of a target system.

Tactics: TA0007
Techniques: T1016
Input: QuasarRAT uses AES to encrypt network communication.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment.

Tactics: TA0011
Techniques: T1090.001, T1090
Input: Even if the arsenal of this actor is diverse, we have identified some patterns, copy-paste code from various public repositories and similarities between the different piece of code

Tactics: TA0005
Techniques: T1140
Input: Virtual dynamic shared object (vdso) hijacking is a method of executing arbitrary code in the address space of a separate live process.

Tactics: TA0004, TA0005
Techniques: T1055.014, T1055
Input: Monitor for newly constructed files that may modify client software binaries to establish persistent access to systems.

Tactics: TA0003
Techniques: T1554
Input: Monitor newly executed processes for actions that could be taken to add a new user and subsequently hide it from login screens.

Tactics: TA0005
Techniques: T1564.002, T1564
Input: Dragonfly has used batch scripts to enumerate network information, including information about trusts, zones, and the domain.

Tactics: TA0007
Techniques: T1016
Input: Create processes Write responses from the control server to a file Send information for all drives Write data sent by the control server to a temporary file matching the file path pattern %temp%\DWS00* Change the time of a file as specified by the control server  The malware changing the file time

Tactics: TA0005, TA0009, TA0010
Techniques: T1041, T1070, T1070.006, T1074
Input: Third-party applications and software deployment systems may be in use in the network environment for administration purposes (, SCCM, HBSS, Altiris, ).

Tactics: TA0002, TA0008
Techniques: T1072
Input: 68271df868f462c06e24a896a9494225,Office Monkeys LOL Video.zip Believe it or not, recipients in bulk run the file within: 95b3ec0a4e539efaa1faa3d4e25d51de,Office Monkeys (Short Flash Movie).exe This file in turn drops two executables to %temp%: 2aabd78ef11926d7b562fd0d91e68ad3, Monkeys.exe 3d3363598f87c78826c859077606e514, player.exe It first launches Monkeys.exe, playing a self-contained, very funny video of white-collar tie wearing chimpanzees working in a high rise office with a human colleague

Tactics: TA0005, TA0009
Techniques: T1125, T1036
Input: QakBot can run nltest /domain_trusts /all_trusts for domain trust discovery.

Tactics: TA0007
Techniques: T1482
Input: For example, the following string would be included in one of the HTTP parameters sent to the C2 server: eRmaVsr90D-7Ig1ngV3PkdouzP974 In this specific case, the actor made a mistake when configuring this XAgent sample with its C2 locations

Tactics: TA0011
Techniques: T1071, T1008
Input: KillDisk has called the Windows API to retrieve the hard disk handle and shut down the machine.

Tactics: TA0002
Techniques: T1106
Input: Internet scanners may be used to look for patterns associated with malicious content designed to collect client configuration information from visitors.Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Tactics: TA0043
Techniques: T1592, T1592.004
Input: Information about network topologies may include a variety of details, including the physical and/or logical arrangement of both external-facing and internal network environments.

Tactics: TA0043
Techniques: T1590, T1590.004
Input: USBStealer has several commands to delete files associated with the malware from the victim.

Tactics: TA0005
Techniques: T1070, T1070.004