madox81/Adema_ATTACK_DS huggingface dataset:
Input: Get Directory Information The malware gets information for the provided directory address using the following WINAPI calls:

Tactics: TA0007
Techniques: T1083
Input: xCaon has encrypted data sent to the C2 server using a XOR key.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: GOLD SOUTHFIELD has breached Managed Service Providers (MSP's) to deliver malware to MSP customers.

Tactics: TA0001
Techniques: T1199
Input: QuasarRAT can communicate over a reverse proxy using SOCKS5.

Tactics: TA0011
Techniques: T1090
Input: RedLeaves can communicate to its C2 over HTTP and HTTPS if directed.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Monitor for newly constructed files that may forge web cookies that can be used to gain access to web applications or Internet services.

Tactics: TA0005
Techniques: T1218, T1218.002
Input: Once it is encrypted using the XOR algorithm, the buffer is encoded with BASE64

Tactics: TA0005
Techniques: T1027
Input: Aquatic Panda has used native OS commands to understand privilege levels and system details.

Tactics: TA0007
Techniques: T1082
Input: Monitor for newly constructed files associated with running a virtual instance, such as binary files associated with common virtualization technologies (ex: VirtualBox, VMware, QEMU, Hyper-V).

Tactics: TA0005
Techniques: T1564, T1564.006
Input: In cloud environments, an instance's availability zone may also be discovered by accessing the instance metadata service from the instance.

Tactics: TA0007
Techniques: T1614
Input: Additionally, the first stage JavaScript creates a scheduled task that executes the second stage code within a minute – this delayed execution helps to bypass behavior analysis since the second stage is not directly executed by the first stage

Tactics: TA0002, TA0003, TA0004, TA0005, TA0009
Techniques: T1053.005, T1053, T1027, T1059, T1074
Input: The padding used is commonly generated by a function to create junk data and then appended to the end or applied to sections of malware.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: DRATzarus can be partly encrypted with XOR.

Tactics: TA0005
Techniques: T1027
Input: GrimAgent can use a decryption algorithm for strings based on Rotate on Right (RoR) and Rotate on Left (RoL) functionality.

Tactics: TA0005
Techniques: T1140
Input: Adversaries can use the COM system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence.

Tactics: TA0003, TA0004
Techniques: T1546.015, T1546
Input: For example, data may be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

Tactics: TA0009
Techniques: T1025
Input: Depending on the access configuration of the logon scripts, either local credentials or an administrator account may be necessary.

Tactics: TA0003, TA0004
Techniques: T1037.001, T1037.003, T1037
Input: Additionally, in the event Kaspersky is detected, the malware will immediately run the ‘Conime.lnk’ shortcut file in a new process after it is created

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Here’s a python code to decode

Tactics: TA0005
Techniques: T1140
Input: Kessel has collected the system architecture, OS version, and MAC address information.

Tactics: TA0007
Techniques: T1082
Input: APT29 has use mshta to execute malicious scripts on a compromised host.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: The adversary can then send malicious links or attachments through these services.

Tactics: TA0001
Techniques: T1566.003, T1566
Input: CookieMiner has used the curl --upload-file command to exfiltrate data over HTTP.

Tactics: TA0010
Techniques: T1048.003, T1048
Input: APT32's macOS backdoor can receive a "delete" command.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Monitor for execution of commands and arguments associated with enumeration or information gathering of domain accounts and groups, such as net user /domain and net group /domain, dscacheutil -q groupon macOS, and ldapsearch on Linux.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: Even if internal instances exist, organizations may have public-facing email infrastructure and addresses for employees.

Tactics: TA0043
Techniques: T1589.002, T1589
Input: Monitor for newly constructed network connections that may use Fast Flux DNS to hide a command and control channel behind an array of rapidly changing IP addresses linked to a single domain resolution.

Tactics: TA0011
Techniques: T1568.001, T1568
Input: After the sequence is completed, opening a port may be accomplished by the host-based firewall, but could also be implemented by custom software.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205
Input: Whitefly has used search order hijacking to run the loader Vcrodat.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: BLUELIGHT can enumerate files and collect associated metadata.

Tactics: TA0007
Techniques: T1083
Input: Upon execution in a vulnerable environment, the PowerShell based payload takes over

Tactics: TA0002
Techniques: T1059.001, T1059
Input: It has also used the Registry entry HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run vpdn "%ALLUSERPROFILE%\%APPDATA%\vpdn\VPDN_LU.exe" to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Astaroth searches for different processes on the system.

Tactics: TA0007
Techniques: T1057
Input: ThiefQuest hides a copy of itself in the user's ~/Library directory by using a .

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Magic Hound granted compromised email accounts read access to the email boxes of additional targeted accounts.

Tactics: TA0003
Techniques: T1098.002, T1098
Input: Blue Mockingbird has collected hardware details for the victim's system, including CPU and memory information.

Tactics: TA0007
Techniques: T1082
Input: *Command_Create&Inject:  This command creates a new process (using a supplied filename as the process name) and then injects malicious code into it

Tactics: TA0004, TA0005
Techniques: T1055
Input: Use user training as a way to bring awareness and raise suspicion for potentially malicious events and dialog boxes (ex: Office documents prompting for credentials).

Tactics: TA0006, TA0009
Techniques: T1056.002, T1056
Input: Host enumeration and lateral movement After gaining an initial foothold in a compromised environment, the threat actors quickly identify and explore accessible systems

Tactics: TA0007
Techniques: T1018
Input: APT3 obfuscates files or information to help evade defensive measures.

Tactics: TA0005
Techniques: T1027
Input: Adversaries may utilize email rules within a compromised user's mailbox to delete and/or move emails to less noticeable folders.

Tactics: TA0005
Techniques: T1564, T1564.008
Input: jRAT can capture passwords from common web browsers such as Internet Explorer, Google Chrome, and Firefox.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Epic has a command to delete a file from the machine.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Cobalt Strike's Beacon payload is capable of capturing screenshots.

Tactics: TA0009
Techniques: T1113
Input: Xbash can perform port scanning of TCP and UDP ports.

Tactics: TA0007
Techniques: T1046
Input: DustySky lists all installed software for the infected machine.

Tactics: TA0007
Techniques: T1518
Input: Each service unit file may contain numerous directives that can execute system commands:

Tactics: TA0003, TA0004
Techniques: T1543.002, T1543
Input: MegaCortex has changed user account passwords and logged users off the system.

Tactics: TA0040
Techniques: T1531
Input: Examples of commands that can modify the code signing policy of a system include bcdedit.exe -set TESTSIGNING ON on Windows and csrutil disable on macOS.

Tactics: TA0005
Techniques: T1553, T1553.006
Input: PoshC2 can use protocols like HTTP/HTTPS for command and control traffic.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Attor's installer plugin can schedule rundll32.exe to load the dispatcher.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Several Unix-like systems have moved to Systemd and deprecated the use of RC scripts.

Tactics: TA0003, TA0004
Techniques: T1037.004, T1037
Input: Adversaries may employ various forms of Masquerading and Obfuscated Files or Information to increase the likelihood that a user will open and successfully execute a malicious file.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: There are several examples of different types of threats leveraging mshta.exe during initial compromise and for execution of code

Tactics: TA0005
Techniques: T1218.005, T1218
Input: Monitor executed commands and arguments that may abuse Microsoft Outlook rules to obtain persistence on a compromised system.

Tactics: TA0003
Techniques: T1137, T1137.005
Input: From an Over-Pass-The-Hash perspective, an adversary wants to exchange the hash for a Kerberos authentication ticket (TGT).

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: Similarly, on macOS the configurations for how applications run are listed in property list (plist) files.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Once adversaries have provisioned software on a compromised VPS (ex: for use as a command and control server), internet scans may reveal VPSs that adversaries have compromised.

Tactics: TA0042
Techniques: T1584.003, T1584
Input: Crimson has the ability to delete files from a compromised host.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Misconfiguration by end users is a common problem.

Tactics: TA0009
Techniques: T1530
Input: Changes to %windir%\system32\inetsrv\config\applicationhost.config could indicate an IIS module installation.

Tactics: TA0003
Techniques: T1505.004, T1505
Input: LightNeuron can be configured to exfiltrate data during nighttime or working hours.

Tactics: TA0010
Techniques: T1029
Input: REvil can query the Registry to get random file extensions to append to encrypted files.

Tactics: TA0007
Techniques: T1012
Input: Ryuk has used a combination of symmetric (AES) and asymmetric (RSA) encryption to encrypt files.

Tactics: TA0040
Techniques: T1486
Input: For example, a common signature related to reflective code loading on Windows is mechanisms related to the .NET Common Language Runtime (CLR) -- such as mscor.dll, mscoree.dll, and clr.dll -- loading into abnormal processes (such as notepad.exe)

Tactics: TA0005
Techniques: T1620
Input: Sys10 uses HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Adversaries can abuse these components to execute malware, such as remote access tools, to maintain persistence through system reboots.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.014
Input: Malicious component firmware could provide both a persistent level of access to systems despite potential typical failures to maintain access and hard disk re-images, as well as a way to evade host software-based defenses and integrity checks.

Tactics: TA0003, TA0005
Techniques: T1542.002, T1542
Input: TajMahal has the ability to inject DLLs for malicious plugins into running processes.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: FALLCHILL can collect operating system (OS) version information, processor information, system name, and information about installed disks from the victim.

Tactics: TA0007
Techniques: T1082
Input: njRAT can capture screenshots of the victim’s machines.

Tactics: TA0009
Techniques: T1113
Input: Periodically baseline registered SIPs and trust providers (Registry entries and files on disk), specifically looking for new, modified, or non-Microsoft entries.

Tactics: TA0005
Techniques: T1553, T1553.003
Input: Sign profiles to avoid them from being modified.

Tactics: TA0003, TA0004
Techniques: T1546.013, T1546
Input: Scan downloads for malicious signatures and attempt to test software and updates prior to deployment while taking note of potential suspicious activity.

Tactics: TA0001
Techniques: T1195.001, T1195, T1195.002
Input: Web Application Firewalls may be used to limit exposure of applications to prevent exploit traffic from reaching the application.

Tactics: TA0001
Techniques: T1190
Input: Pteranodon creates various subdirectories under %Temp%\reports\% and copies files to those subdirectories.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: RogueRobin enumerates running processes to search for Wireshark and Windows Sysinternals suite.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: The DLL is also digitally signed by a certificate from “AirVPN”

Tactics: TA0005
Techniques: T1553, T1553.002
Input: ADVSTORESHELL achieves persistence by adding itself to the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: ABK has the ability to download files from C2.

Tactics: TA0011
Techniques: T1105
Input: Lizar can collect the computer name from the machine,.

Tactics: TA0007
Techniques: T1082
Input: Fysbis can perform keylogging.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: TA459 has attempted to get victims to open malicious Microsoft Word attachment sent via spearphishing.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Weak linking enables developers to run an application on multiple macOS versions as new APIs are added.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.004, T1574
Input: Monitor services for changes made to Launch Daemons to execute malicious payloads as part of persistence.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: AuditCred uses XOR and RC4 to perform decryption on the code functions.

Tactics: TA0005
Techniques: T1140
Input: WhisperGate can make an HTTPS connection to download additional files.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Enable account restrictions to prevent login attempts, and the subsequent 2FA/MFA service requests, from being initiated from suspicious locations or when the source of the login attempts do not match the location of the 2FA/MFA smart device.

Tactics: TA0006
Techniques: T1621
Input: Hydraq creates a backdoor through which remote attackers can delete files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Invoke-PSImage can be used to embed a PowerShell script within the pixels of a PNG file.

Tactics: TA0005
Techniques: T1027
Input: Also monitor DLL load operations in lsass.exe.

Tactics: TA0003, TA0004
Techniques: T1547.008, T1547
Input: IIS modules can be written as a DLL that exports RegisterModule, or as a .NET application that interfaces with ASP.NET APIs to access IIS HTTP requests.

Tactics: TA0003
Techniques: T1505.004, T1505
Input: Monitor for changes made to firmware.

Tactics: TA0003, TA0005
Techniques: T1542.001, T1542
Input: Mythic can use SOCKS proxies to tunnel traffic through another protocol.

Tactics: TA0011
Techniques: T1572
Input: RTM can search for specific strings within browser tabs using a Dynamic Data Exchange mechanism.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: netsh can be used as a persistence proxy technique to execute a helper DLL when netsh.exe is executed.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.007
Input: Forfiles can be used to act on (ex: copy, move, ) files/directories in a system during (ex: copy files into a staging area before).

Tactics: TA0009
Techniques: T1005
Input: Shamoon attempts to overwrite operating system files and disk structures with image files.

Tactics: TA0040
Techniques: T1485
Input: LightNeuron exfiltrates data over its email C2 channel.

Tactics: TA0010
Techniques: T1041
Input: Examples have been seen in the wild where template injection was used to load malicious code containing an exploit.

Tactics: TA0005
Techniques: T1221
Input: These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS).

Tactics: TA0007
Techniques: T1526
Input: The PowerShell script with the RogueRobin payload was obfuscated using the COMPRESS technique in Invoke-Obfuscation.

Tactics: TA0005
Techniques: T1027
Input: OSX provides a native command, pbpaste, to grab clipboard contents.

Tactics: TA0009
Techniques: T1115
Input: Access to specific areas of the Registry depends on account permissions, some requiring administrator-level access.

Tactics: TA0005
Techniques: T1112
Input: Flagpro has been used to run the tasklist command on a compromised system.

Tactics: TA0007
Techniques: T1057
Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Technical Databases, Search Open Websites/Domains, or Phishing for Information), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Phishing).

Tactics: TA0043
Techniques: T1590, T1590.001
Input: As shown in Figure 12, the script within the dupatechecker.doc file attempts to download another file named dupatechecker.exe from the same server

Tactics: TA0011
Techniques: T1105
Input: Monitor for unexpected process interactions with the Windows Registry ( reads) that may be related to gathering information.

Tactics: TA0007
Techniques: T1012
Input: Kwampirs collects a list of users belonging to the local users and administrators groups with the commands net localgroup administrators and net localgroup users.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: The results may also be used to identify routes, redirectors, and proxy servers.

Tactics: TA0007
Techniques: T1016.001, T1016
Input: The following capabilities have been observed in this payload:  Get drive information Modify files Modify directories Modify registry Spawn process Terminate process Modify services Kill self   Ties to SunOrcal Reaver was used concurrently with SunOrcal over the past year, to include two Reaver samples dropped from zip files hosted on a domain also being used as a SunOrcal C2 (www.fyoutside[.]com), and there is also passive DNS overlap amongst the C2s

Tactics: TA0005
Techniques: T1112
Input: Wiarp creates a backdoor through which remote attackers can download files.

Tactics: TA0011
Techniques: T1105
Input: Usual applications for login items could include what users add to configure their user environment, such as email, chat, or music applications, or what administrators include for organization settings and protections.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.015
Input: Gelsemium can set persistence with a Registry run key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Develop and publish policies that define acceptable information to be stored in code repositories.

Tactics: TA0009
Techniques: T1213, T1213.003
Input: POWERSTATS has used get_tasklist to discover processes on the compromised host.

Tactics: TA0007
Techniques: T1057
Input: Instead of hijacking existing DNS servers, adversaries may opt to configure and run their own DNS servers in support of operations.

Tactics: TA0042
Techniques: T1583, T1583.002
Input: Files that are tagged with MOTW are protected and cannot perform certain actions.

Tactics: TA0005
Techniques: T1553, T1553.005
Input: Raindrop was installed under names that resembled legitimate Windows file and directory names.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Bandook has used .PNG images within a zip file to build the executable.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: Zebrocy installs an application-defined Windows hook to get notified when a network drive has been attached, so it can then use the hook to call its RecordToFile file stealing method.

Tactics: TA0006, TA0009
Techniques: T1056.004, T1056
Input: An APT28 loader Trojan saved a batch script that uses rundll32 to execute a DLL payload.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Figure 12: DrAGon_MidDLe stores the list of proxy URLs used to interact with C2 server Section 2 The second section of the PowerShell script has the ability to perform encryption and decryption of messages that are exchanged between the system and the C2 server

Tactics: TA0011
Techniques: T1573, T1090
Input: POWRUNER may collect active network connections by running netstat -an on a victim.

Tactics: TA0007
Techniques: T1049
Input: Indrik Spider has downloaded additional scripts, malware, and tools onto a compromised host.

Tactics: TA0011
Techniques: T1105
Input: RainyDay can use proxy tools including boost_proxy_client for reverse proxy functionality.

Tactics: TA0011
Techniques: T1090
Input: Adversaries may use password cracking to attempt to recover usable credentials, such as plaintext passwords, when credential material such as password hashes are obtained.

Tactics: TA0006
Techniques: T1110, T1110.002
Input: WellMess can encrypt HTTP POST data using RC6 and a dynamically generated AES key encrypted with a hard coded RSA public key.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe).

Tactics: TA0005
Techniques: T1036.003, T1036
Input: Confucius has exfiltrated victim data to cloud storage service accounts.

Tactics: TA0010
Techniques: T1567.002, T1567
Input: Silent Librarian has established e-mail accounts to receive e-mails forwarded from compromised accounts.

Tactics: TA0042
Techniques: T1585, T1585.002
Input: FIN6 has used the Stealer One credential stealer to target web browsers.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Peirates can list AWS S3 buckets.

Tactics: TA0007
Techniques: T1619
Input: BendyBear is designed to download an implant from a C2 server.

Tactics: TA0011
Techniques: T1105
Input: In May 2016, we published a blog detailing a spear phishing campaign targeting banks in the Middle East region that used macro-enabled attachments to distribute POWBAT malware

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Deletion of all registry keys associated with the extraction of the SFX RAR Deletion of the User Assist Key entries related to applications that have been recently executed Deletion of all registry keys relating to services that have recently run  Clearly the attacker using this PlugX is paranoid about it being detected on disk, both in the registry and the file system

Tactics: TA0003, TA0004, TA0005, TA0007
Techniques: T1547.001, T1547, T1112, T1012
Input: Monitor access to file resources that contain local accounts and groups information such as /etc/passwd, /Users directories, and the SAM database.

Tactics: TA0007
Techniques: T1087
Input: AppleJeus has also used the open source ADVObfuscation library for its components.

Tactics: TA0005
Techniques: T1027
Input: Wizard Spider obtained a code signing certificate signed by Digicert for some of its malware.

Tactics: TA0042
Techniques: T1588, T1588.003
Input: Zebrocy executes the reg query command to obtain information in the Registry.

Tactics: TA0007
Techniques: T1012
Input: Restrict other users who are allowed to connect, or disallow all users to connect remotely to WMI.

Tactics: TA0002
Techniques: T1047
Input: ComRAT has encrypted and stored its orchestrator code in the Registry as well as a PowerShell script into the WsqmCons Registry key.

Tactics: TA0005
Techniques: T1112
Input: For the print processor to be correctly installed, it must be located in the system print-processor directory that can be found with the GetPrintProcessorDirectory API call.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.012
Input: Winnti for Windows has the ability to use encapsulated HTTP/S in C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: It also enables adversaries to switch between valid service accounts.

Tactics: TA0005, TA0008
Techniques: T1550.001, T1550
Input: An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed.

Tactics: TA0005
Techniques: T1562.006, T1562
Input: ZLib has the ability to discover and manipulate Windows services.

Tactics: TA0007
Techniques: T1007
Input: Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.007