madox81/Adema_ATTACK_DS huggingface dataset:
Input: Adversaries may abuse verclsid.exe to proxy execution of malicious code.

Tactics: TA0005
Techniques: T1218, T1218.012
Input: From these reports, we know that the group uses an abundance of tools and tactics, ranging across zero-day exploits targeting common applications such as Java or Microsoft Office, heavy use of spear-phishing attacks, compromising legitimate websites to stage watering-hole attacks, and targeting over a variety of operating systems – Windows, OSX, Linux, even mobile iOS

Tactics: TA0001
Techniques: T1189
Input: Microsoft refers to its implementation of the Remote Desktop Protocol (RDP) as Remote Desktop Services (RDS).

Tactics: TA0008
Techniques: T1563.002, T1021.001, T1021, T1563
Input: Mivast has the capability to open a remote shell and run basic commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: This can allow an adversary a path to access the cloud or container APIs, exploit container host access via Escape to Host, or take advantage of weak identity and access management policies.

Tactics: TA0001
Techniques: T1190
Input: FoggyWeb has the ability to communicate with C2 servers over HTTP GET/POST requests.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Comnie runs the net view command

Tactics: TA0007
Techniques: T1018
Input: APT32 has also renamed a Cobalt Strike beacon payload to install_flashplayers.exe.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: With double-flux additional hosts can act as a proxy to the C2 host, further insulating the true source of the C2 channel.

Tactics: TA0011
Techniques: T1568.001, T1568
Input: Mis-Type uses Base64 encoding for C2 traffic.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Kimsuky has created social media accounts to monitor news and security trends as well as potential targets.

Tactics: TA0042
Techniques: T1585, T1585.001
Input: Some parameters are interchangeable with others, such as Program and ProgramArguments parameters but one must be present.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis.

Tactics: TA0005
Techniques: T1140
Input: PoisonIvy stages collected data in a text file.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Pupy can access a connected webcam and capture pictures.

Tactics: TA0009
Techniques: T1125
Input: Using bash as an example, the default shell for most GNU/Linux systems, adversaries may add commands that launch malicious binaries into the /etc/profile and /etc/profile.d files.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: Windows contains accessibility features that may be launched with a key combination before a user has logged in (ex: when the user is on the Windows logon screen).

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: Password spraying uses one password ( 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain.

Tactics: TA0006
Techniques: T1110, T1110.003
Input: menuPass has used DLL side-loading to launch versions of Mimikatz and PwDump6 as well as UPPERCUT.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: Suspicious program execution through services may show up as outlier processes that have not been seen before when compared against historical data.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Monitor newly executed processes for applications that can be used to query the Registry, such as Reg, and collect command parameters that may indicate credentials are being searched.

Tactics: TA0006
Techniques: T1552, T1552.002
Input: Monitor newly executed processes that may perform sudo caching and/or use the suoders file to elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: Nltest may be used to enumerate the parent domain of a local machine using /parentdomain.

Tactics: TA0007
Techniques: T1016
Input: BRONZE BUTLER has obtained and used open-source tools such as Mimikatz, gsecdump, and Windows Credential Editor.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: SILENTTRINITY can use cmd.exe to enable lateral movement using DCOM.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Once established within a system or network, an adversary may use automated techniques for collecting internal data.

Tactics: TA0009
Techniques: T1119
Input: Fox Kitten has used prodump to dump credentials from LSASS.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: APT1 gathered a list of running processes on the system using tasklist /v.

Tactics: TA0007
Techniques: T1057
Input: RTM can check for specific files and directories associated with virtualization and malware analysis.

Tactics: TA0007
Techniques: T1083
Input: Adversaries may also query for specific readings from these devices.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Monitor executed commands and arguments that connect to remote shares, such as Net, on the command-line interface and Discovery techniques that could be used to find remotely accessible systems.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Lizar can migrate the loader into another process.

Tactics: TA0004, TA0005
Techniques: T1055
Input: WIRTE has attempted to lure users into opening malicious MS Word and Excel files to execute malicious payloads.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Atypical root certificates have also been pre-installed on systems by the manufacturer or in the software supply chain and were used in conjunction with malware/adware to provide Adversary-in-the-Middle capability for intercepting information transmitted over secure TLS/SSL communications.

Tactics: TA0005
Techniques: T1553, T1553.004
Input: Consider use of services that may aid in tracking of newly acquired infrastructure, such as WHOIS databases for domain registration information.

Tactics: TA0042
Techniques: T1583
Input: BackdoorDiplomacy has obtained a variety of open-source reconnaissance and red team tools for discovery and lateral movement.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: FIN6 has used WMI to automate the remote execution of PowerShell scripts.

Tactics: TA0002
Techniques: T1047
Input: Babuk can stop anti-virus services on a compromised host.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Molerats used various implants, including those built with JS, on target machines.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: MuddyWater has performed credential dumping with Mimikatz and procdump64.exe.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Netwalker can detect and terminate active security software-related processes on infected systems.

Tactics: TA0005, TA0007
Techniques: T1518.001, T1562.001, T1518, T1562
Input: WellMess can use HTTP and HTTPS in C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: IcedID has the ability to download additional modules and a configuration file from C2.

Tactics: TA0011
Techniques: T1105
Input: Operation Wocao has discovered removable disks attached to a system.

Tactics: TA0007
Techniques: T1120
Input: Maze has used the "WNetOpenEnumW", "WNetEnumResourceW", "WNetCloseEnum" and "WNetAddConnection2W" functions to enumerate the network resources on the infected machine.

Tactics: TA0007
Techniques: T1049
Input: Look for indications of common characters that may indicate an attempt to trick users into misidentifying the file type, such as a space as the last character of a file name or the right-to-left override characters"\u202E", "[U+202E]", and "%E2%80%AE".

Tactics: TA0005
Techniques: T1036
Input: Volume Shadow Copy

Tactics: TA0006
Techniques: T1003.003, T1003
Input: Login items can be added via a shared file list or Service Management Framework.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.015
Input: Monitor newly executed processes that may abuse system services or daemons to execute commands or programs.

Tactics: TA0002
Techniques: T1569
Input: Zebrocy also runs the systeminfo command to gather system information.

Tactics: TA0007
Techniques: T1082
Input: OilRig has run whoami on a victim.

Tactics: TA0007
Techniques: T1033
Input: For example, adversaries can use a mDNS query (such as dns-sd -B _ssh._tcp .)

Tactics: TA0007
Techniques: T1046
Input: Machete's main backdoor Machete is also written in Python.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: EVILNUM can make modifications to the Regsitry for persistence.

Tactics: TA0005
Techniques: T1112
Input: 19-1 regsvr32 running the .dlls  Fig

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Nomadic Octopus as attempted to lure victims into clicking on malicious attachments within spearphishing emails.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: TajMahal has used an encrypted Virtual File System to store plugins.

Tactics: TA0005
Techniques: T1027
Input: Monitor for calls to OpenProcess that can be used to manipulate lsass.exe running on a domain controller as well as for malicious modifications to functions exported from authentication-related system DLLs (such as cryptdll.dll and samsrv.dll).

Tactics: TA0003, TA0005, TA0006
Techniques: T1556
Input: Andariel has used watering hole attacks, often with zero-day exploits, to gain initial access to victims within a specific IP range.

Tactics: TA0001
Techniques: T1189
Input: PowerShower has sent HTTP GET and POST requests to C2 servers to send information and receive instructions.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Monitor executed commands and arguments that may access to a host may attempt to access Local Security Authority (LSA) secrets.

Tactics: TA0006
Techniques: T1003, T1003.004
Input: After the print processors are installed, the print spooler service, which starts during boot, must be restarted in order for them to run.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.012
Input: In all of the DropIt samples we collected, the dropper will then save the executable to the user’s %TEMP% folder and execute the file, specifically to one of the following filenames:  %TEMP%\spp.exe %TEMP%\sloo.exe %TEMP%\spoo.exe %TEMP%\vschos.exe  We have also seen Magic Hound using DropIt like a binder Trojan, specifically dropping a legitimate decoy executable along with the malicious executable as a payload

Tactics: TA0004, TA0005
Techniques: T1036, T1055.012, T1055
Input: MCMD can upload additional files to a compromised host.

Tactics: TA0011
Techniques: T1105
Input: Correlating a user session with a distinct lack of new commands in their .bash_history can be a clue to suspicious behavior.

Tactics: TA0005
Techniques: T1562.003, T1562
Input: An obfuscated command is located inside the Target bar in the .lnk file properties.   Hidden command inside the .lnk file

Tactics: TA0003, TA0004, TA0005
Techniques: T1547.009, T1070, T1070.006, T1547
Input: Blue Mockingbird has obtained and used tools such as Mimikatz.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: The displacement of the injected code does introduce the additional requirement for functionality to remap memory references.

Tactics: TA0004, TA0005
Techniques: T1055.002, T1055
Input: Olympic Destroyer uses WMI to help propagate itself across a network.

Tactics: TA0002
Techniques: T1047
Input: NETWIRE has been executed through use of VBScripts.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Enumeration of COM objects, via Query Registry or PowerShell, may also precede malicious use.

Tactics: TA0008
Techniques: T1021.003, T1021
Input: SilverTerrier uses FTP for C2 communications.

Tactics: TA0011
Techniques: T1071.002, T1071
Input: Grandoreiro can use a DGA for hiding C2 addresses, including use of an algorithm with a user-specific key that changes daily.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: Rancor attempted to get users to click on an embedded macro within a Microsoft Office Excel document to launch their malware.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: WannaCry uses an exploit in SMBv1 to spread itself to other remote systems on a network.

Tactics: TA0008
Techniques: T1210
Input: P.A.S. Webshell can list PHP server configuration details.

Tactics: TA0007
Techniques: T1518
Input: Monitor for logged domain name system (DNS) data that may compromise third-party infrastructure that can be used during targeting.

Tactics: TA0042
Techniques: T1584
Input: DDKONG uses Rundll32 to ensure only a single instance of itself is running at once.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: They may also search for VME artifacts before dropping secondary or additional payloads.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001, T1497.002
Input: TeamTNT runs netstat -anp to search for rival malware connections.

Tactics: TA0007
Techniques: T1049
Input: NETWIRE can retrieve passwords from messaging and mail client applications.

Tactics: TA0006
Techniques: T1555
Input: A variant of HOPLIGHT hooks lsass.exe, and lsass.exe then checks the Registry for the data value 'rdpproto' under the key SYSTEM\CurrentControlSet\Control\Lsa Name.

Tactics: TA0007
Techniques: T1012
Input: CSPY Downloader has been packed with UPX.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: GuLoader can download further malware for execution on the victim's machine.

Tactics: TA0011
Techniques: T1105
Input: Silence attempts to get users to launch malicious attachments delivered via spearphishing emails.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Magic Hound has acquired the personal email addresses of some individuals they intend to target.

Tactics: TA0043
Techniques: T1589.002, T1589
Input: KEYMARBLE uses a customized XOR algorithm to encrypt C2 communications.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: TeamTNT has disabled and uninstalled security tools.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: If KillDisk gets the access token, then it attempt to modify the token privileges with AdjustTokenPrivileges.

Tactics: TA0004, TA0005
Techniques: T1134
Input: Mythic provides various transform functions to encode and/or randomize C2 data.

Tactics: TA0011
Techniques: T1132
Input: KONNI has been packed for obfuscation.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Downgrading the system image to an older versions may allow an adversary to evade defenses by enabling behaviors such as Weaken Encryption.

Tactics: TA0005
Techniques: T1601, T1601.002
Input: Okrum's backdoor has used cmd.exe to execute arbitrary commands as well as batch scripts to update itself to a newer version.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Kazuar adds a .lnk file to the Windows startup folder.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: For attacks attempting to saturate the providing network, see Network Denial of Service.

Tactics: TA0040
Techniques: T1499
Input: Standard file systems include FAT, NTFS, ext4, and APFS.

Tactics: TA0005
Techniques: T1564, T1564.005
Input: OfficeScan’s Vulnerability Protection shields endpoints from identified and unknown vulnerability exploits even before patches are even deployed. Trend Micro™ Deep Discovery™ provides detection, in-depth analysis, and proactive response to attacks using exploits and other similar threats through specialized engines, custom sandboxing, and seamless correlation across the entire attack lifecycle, allowing it to detect these attacks even without any engine or pattern update

Tactics: TA0004
Techniques: T1068
Input: Andariel has downloaded additional tools and malware onto compromised hosts.

Tactics: TA0011
Techniques: T1105
Input: Adversaries often target the availability of DNS and web services, however others have been targeted as well.

Tactics: TA0040
Techniques: T1499.002, T1499
Input: BLINDINGCAN has uploaded files from victim machines.

Tactics: TA0009
Techniques: T1005
Input: APT33 has sent spearphishing emails containing links to .hta files.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: SpeakUp encodes its second-stage payload with Base64.

Tactics: TA0005
Techniques: T1027
Input: FIN5 has obtained and used a customized version of PsExec, as well as use other tools such as pwdump, SDelete, and Windows Credential Editor.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: A variation of APC injection, dubbed "Early Bird injection", involves creating a suspended process in which malicious code can be written and executed before the process' entry point (and potentially subsequent anti-malware hooks) via an APC.

Tactics: TA0004, TA0005
Techniques: T1055.004, T1055
Input: It allows a user to connect to another system via an encrypted tunnel, commonly authenticating through a password, certificate or the use of an asymmetric encryption key pair.

Tactics: TA0008
Techniques: T1563, T1563.001
Input: Stealth Falcon malware uses PowerShell commands to perform various functions, including gathering system information via WMI and executing commands from its C2 server.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Empire contains a variety of enumeration modules that have an option to use API calls to carry out tasks.

Tactics: TA0002
Techniques: T1106
Input: Night Dragon sent spearphishing emails containing links to compromised websites where malware was downloaded.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Hildegard has packed ELF files into other binaries.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: There are several different ways this can occur.

Tactics: TA0006
Techniques: T1187
Input: TEMP.Veles has used scheduled task XML triggers.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Services, daemons, or agents may be created with administrator privileges but executed under root/SYSTEM privileges.

Tactics: TA0003, TA0004
Techniques: T1543
Input: The discovery modules used with Duqu can collect information on network connections.

Tactics: TA0007
Techniques: T1049
Input: SpeakUp uses POST and GET requests over HTTP to communicate with its main C&C server.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: BADNEWS has a command to download an .exe and use process hollowing to inject it into a new process.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: ADVSTORESHELL can list files and directories.

Tactics: TA0007
Techniques: T1083
Input: Do not allow domain user accounts to be in the local Administrators group multiple systems.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: In the first, the adversary would make use of native debug commands in the original, unaltered running operating system that allow them to directly modify the relevant memory addresses containing the running operating system.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: - There were two interesting sub-classes found inside Main Activity: Receiver and Sender

Tactics: TA0005
Techniques: T1562.001, T1562
Input: The value stored in the Registry key will be executed after a user logs into the computer.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.014
Input: TrickBot can gather information about domain trusts by utilizing Nltest.

Tactics: TA0007
Techniques: T1482
Input: Windows Registry modifications.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Patchwork has signed malware with self-signed certificates from fictitious and spoofed legitimate software companies.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments ( monitor anomalies in use of files that do not normally initiate network connections or unusual connections initiated by regsvr32.exe, rundll.exe, .SCF, HTA, MSI, DLLs, or msiexec.exe).

Tactics: TA0002
Techniques: T1204, T1204.001
Input: InvisiMole avoids analysis by encrypting all strings, internal files, configuration data and by using a custom executable format.

Tactics: TA0005
Techniques: T1027
Input: POSHSPY uploads data in 2048-byte chunks.

Tactics: TA0010
Techniques: T1030
Input: SpeakUp attempts to exploit the following vulnerabilities in order to execute its malicious script: CVE-2012-0874, CVE-2010-1871, CVE-2017-10271, CVE-2018-2894, CVE-2016-3088, JBoss AS 3/4/5/6, and the Hadoop YARN ResourceManager.

Tactics: TA0002
Techniques: T1203
Input: Aquatic Panda has attempted to stop endpoint detection and response (EDR) tools on compromised systems.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Axiom actors have been known to use the Sticky Keys replacement within RDP sessions to obtain persistence.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: If the file in not known/trusted, SmartScreen will prevent the execution and warn the user not to run it.

Tactics: TA0005
Techniques: T1553, T1553.005
Input: Monitor DLL loads by processes, specifically looking for DLLs that are not recognized or not normally loaded into a process.

Tactics: TA0003, TA0004
Techniques: T1546.009, T1547, T1546
Input: Crimson can spread across systems by infecting removable media.

Tactics: TA0001, TA0008
Techniques: T1091
Input: This may also enable follow-on behaviors such as Network Sniffing or Transmitted Data Manipulation.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.003
Input: This module searches the infected system’s files to gather email addresses for information-stealing purposes.

Tactics: TA0009
Techniques: T1114
Input: Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server.

Tactics: TA0007
Techniques: T1057
Input: Silent Librarian has acquired domains to establish credential harvesting pages, often spoofing the target organization and using free top level domains .TK, .ML, .GA, .CF, and .GQ.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: TrickBot decodes the configuration data and modules.

Tactics: TA0005
Techniques: T1140
Input: The malware may modify the original entry point (OEP) of the healthy binary to ensure that it is executed before the legitimate code.

Tactics: TA0008
Techniques: T1080
Input: Cobalt Group has created new services to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: APT32 used WMI to deploy their tools on remote machines and to gather information about the Outlook process.

Tactics: TA0002
Techniques: T1047
Input: Monitor for changes made in the Active Directory that may use network logon scripts automatically executed at logon initialization to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1037.003, T1037
Input: Adversaries may also purchase information from less-reputable sources such as dark web or cybercrime blackmarkets.

Tactics: TA0043
Techniques: T1597.002, T1597
Input: JAVASCRIPT CODE SNIPPETS:  The first stage JavaScript copies additional JavaScript code snippets in txt format from the RTF document into a random directory “C:\Users\<User Name>\<Random guid>\”

Tactics: TA0002, TA0007
Techniques: T1033, T1059
Input: EvilBunny has used time measurements from 3 different APIs before and after performing sleep operations to check and abort if the malware is running in a sandbox.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: The Bazar loader is used to download and execute the Bazar backdoor.

Tactics: TA0011
Techniques: T1104
Input: Volatile Cedar can deploy additional tools.

Tactics: TA0011
Techniques: T1105
Input: They have manipulated scheduled tasks by updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Wingbird checks the victim OS version after executing to determine where to drop files based on whether the victim is 32-bit or 64-bit.

Tactics: TA0007
Techniques: T1082