madox81/Adema_ATTACK_DS huggingface dataset:
Input: Monitor for newly executed processes that may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions.

Tactics: TA0004, TA0005
Techniques: T1548
Input: KOCTOPUS has used PowerShell commands to download additional files.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Malware Delivery Method  In all emails sent to these government officials, the actor used the same attachment: a malicious Microsoft Word document that exploited the CVE-2012-0158 vulnerability to drop a malicious payload

Tactics: TA0001
Techniques: T1566, T1566.001
Input: If establishing persistence by installation as a new service fails, one variant of Elise establishes persistence for the created .exe file by setting the following Registry key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\svchost : %APPDATA%\Microsoft\Network\svchost.exe.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: PowerSploit contains a collection of CodeExecution modules that inject code (DLL, shellcode) into a process.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: DEATHRANSOM has the ability to use WMI to delete volume shadow copies.

Tactics: TA0002
Techniques: T1047
Input: Or, they may need to build extensive infrastructure if they want to test, communicate, and control other aspects of their activities on their own systems.

Tactics: TA0042
Techniques: T1583.004, T1583
Input: Figure 4: Embedded URL in OLE object    Figure 5: HTTP GET request to download the next level payload The downloaded file, doc.doc, is XML-based and contains a PowerShell command (shown in Figure 6) that subsequently downloads the binary Pause.ps1

Tactics: TA0011
Techniques: T1105
Input: Users can be trained to identify social engineering techniques and spearphishing emails with malicious links which includes phishing for consent with OAuth 2.0

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Monitor executed commands and arguments that may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions.

Tactics: TA0004, TA0005
Techniques: T1548
Input: Some legitimate LaunchDaemons point to unsigned code that could be exploited.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: Adversaries may abuse components of Terminal Services to enable persistent access to systems.

Tactics: TA0003
Techniques: T1505.005, T1505
Input: procdump -ma lsass.exe lsass_dump

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Kerrdown can decode, decrypt, and decompress multiple layers of shellcode.

Tactics: TA0005
Techniques: T1140
Input: Monitor executed commands and arguments that may exfiltrate data to a cloud storage service rather than over their primary command and control channel.

Tactics: TA0010
Techniques: T1567.002, T1567
Input: menuPass has installed updates and new malware on victims.

Tactics: TA0011
Techniques: T1105
Input: GuLoader can establish persistence via the Registry under HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Trojan.Karagany can perform reconnaissance commands on a victim machine via a cmd.exe process.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: The malicious modules in regsvr32.exe memory After the Irdsnhrxxxfery98 module is loaded, the malware searches different processes to continue its malicious activity depending on the way Irdsnhrxxxfery64 was loaded

Tactics: TA0005
Techniques: T1218, T1218.010
Input: AppleJeus has been installed via MSI installer.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: Kessel can RC4-encrypt credentials before sending to the C2.

Tactics: TA0009
Techniques: T1560
Input: Since the execution can be proxied by an account with higher permissions, such as SYSTEM or service accounts, an adversary may be able to abuse these triggered execution mechanisms to escalate their privileges.

Tactics: TA0003, TA0004
Techniques: T1546
Input: NotPetya can use PsExec to help propagate itself across a network.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Monitor for unusual Exchange and Office 365 email account permissions changes that may indicate excessively broad permissions being granted to compromised accounts.

Tactics: TA0003
Techniques: T1098.002, T1098
Input: StoneDrill can obtain the current date and time of the victim machine.

Tactics: TA0007
Techniques: T1124
Input: Crimson has the ability to determine the date and time on a compromised host.

Tactics: TA0007
Techniques: T1124
Input: Monitor network traffic for anomalies associated with known AiTM behavior.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.003
Input: BitPaymer has used dynamic API resolution to avoid identifiable strings within the binary, including RegEnumKeyW.

Tactics: TA0002
Techniques: T1106
Input: Inception has used PowerShell to execute malicious commands and payloads.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: APT28 has used several malicious applications that abused OAuth access tokens to gain access to target email accounts, including Gmail and Yahoo Mail.

Tactics: TA0005, TA0008
Techniques: T1550.001, T1550
Input: DarkWatchman has been delivered as compressed RAR payloads in ZIP files to victims.

Tactics: TA0005
Techniques: T1027
Input: Sidewinder has configured tools to automatically send collected files to attacker controlled servers.

Tactics: TA0010
Techniques: T1020
Input: Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as  Ping or net view using Net.

Tactics: TA0007
Techniques: T1018
Input: Figure 4: Downloading second stage Seminar.rtf The downloaded Seminar.rtf contains an embedded binary file that is dropped in %temp% via Equation Editor executable

Tactics: TA0011
Techniques: T1105
Input: AppleJeus has sent data to its C2 server via POST requests.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Cryptoistic can retrieve files from the local file system.

Tactics: TA0009
Techniques: T1005
Input: Upon reboot, the system executes the script's contents as root, resulting in persistence.

Tactics: TA0003, TA0004
Techniques: T1037.004, T1037
Input: PipeMon can attempt to gain administrative privileges using token impersonation.

Tactics: TA0004, TA0005
Techniques: T1134.002, T1134
Input: ROKRAT has relied upon users clicking on a malicious attachment delivered through spearphishing.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: JScript is the Microsoft implementation of the same scripting standard.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: ShadowPad has collected the PID of a malicious process.

Tactics: TA0007
Techniques: T1057
Input: PUNCHBUGGY has Gzipped information and saved it to a random temp file before exfil.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Threat actors can use online resources and lookup tools to harvest information about certificates.

Tactics: TA0043
Techniques: T1596, T1596.003
Input: Use process monitoring to monitor the execution and arguments of InstallUtil.exe.

Tactics: TA0005
Techniques: T1218, T1218.004
Input: The Information Gathering Tool (IGT) tool is coded in Delphi and includes powershell and SQL components across a dozen different drops

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Bankshot binds and listens on port 1058 for HTTP traffic while also utilizing a FakeTLS method.

Tactics: TA0011
Techniques: T1571
Input: UBoatRAT encrypts instructions in the payload using a simple XOR cipher.

Tactics: TA0005
Techniques: T1027
Input: Monitor executed commands and arguments arguments for actions that could be taken to collect and combine files.

Tactics: TA0009
Techniques: T1074.002, T1074.001, T1074
Input: Via WMI (winmgmt), the JavaScript or VBscript code in the SCT file spawns a PowerShell one-liner which finally consumes the text file

Tactics: TA0002
Techniques: T1059
Input: BackConfig has the ability to set folders or files to be hidden from the Windows Explorer default view.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Goopy has the ability to delete emails used for C2 once the content has been copied.

Tactics: TA0005
Techniques: T1070
Input: StreamEx has the ability to remotely execute commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: The decompressed PowerShell payload has some similarities to the PowerShell Empire agent, such as the use of a jitter value and commands referred to by job ID, but we do not have conclusive evidence that the author of this tool used Empire as a basis for their tool

Tactics: TA0002
Techniques: T1059.001, T1059
Input: An adversary may hide malicious VBA code by overwriting the VBA source code location with zero’s, benign code, or random bytes while leaving the previously compiled malicious p-code.

Tactics: TA0005
Techniques: T1564, T1564.007
Input: KeyBoy can launch interactive shells for communicating with the victim machine.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: KGH_SPY can collect credentials from WINSCP.

Tactics: TA0006
Techniques: T1555
Input: Telnet (23/TCP)

Tactics: TA0006
Techniques: T1110.004, T1110, T1110.001, T1110.003
Input: Astaroth uses certutil and BITSAdmin to download additional malware.

Tactics: TA0011
Techniques: T1105
Input: Any user or administrator within the organization (or adversary with valid credentials) may be able to create rules to automatically move or delete emails.

Tactics: TA0005
Techniques: T1564, T1564.008
Input: To contain the impact of a previously generated golden ticket, reset the built-in KRBTGT account password twice, which will invalidate any existing golden tickets that have been created with the KRBTGT hash and other Kerberos tickets derived from it.

Tactics: TA0005, TA0008
Techniques: T1550.003, T1550
Input: RTM tries to add a scheduled task to establish persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Industroyer has used a Trojanized version of the Windows Notepad application for an additional backdoor persistence mechanism.

Tactics: TA0003
Techniques: T1554
Input: Data may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

Tactics: TA0009
Techniques: T1005
Input: RDFSNIFFER has the capability of deleting local files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Rocke has used uname -m to collect the name and information about the infected system's kernel.

Tactics: TA0007
Techniques: T1082
Input: These credentials can be stored and/or misplaced in many locations on a system, including plaintext files ( Bash History), operating system or application-specific repositories ( Credentials in Registry), or other specialized files/artifacts ( Private Keys).

Tactics: TA0006
Techniques: T1552
Input: KGH_SPY can decrypt encrypted strings and write them to a newly created folder.

Tactics: TA0005
Techniques: T1140
Input: menuPass has used the Csvde tool to collect Active Directory files and data.

Tactics: TA0009
Techniques: T1119
Input: In order to move laterally from a compromised host, adversaries may take advantage of trust relationships established with other systems via public key authentication in active SSH sessions by hijacking an existing connection to another system.

Tactics: TA0008
Techniques: T1563, T1563.001
Input: It executes the other modules and collects initial information about the machine, including information about the network, locale, and the keyboard language.    The main module collecting information about the machine

Tactics: TA0007
Techniques: T1087, T1082, T1016
Input: 4H RAT obfuscates C2 communication using a 1-byte XOR with the key 0xBE.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Rocke has changed file permissions of files so they could not be modified.

Tactics: TA0005
Techniques: T1222.002, T1222
Input: Adversaries can use this technique to load malicious code at startup that will persist on system reboot and execute as SYSTEM.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.010
Input: Adversaries may also alter other Registry keys in the service’s Registry tree.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.011, T1574
Input: Consider monitoring and/or blocking suspicious execution of Active Directory PowerShell modules, such as Set-ADUser and Set-ADAccountControl, that change account configurations.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.005
Input: Similar to the previous case, if Avast and aswrundll.exe are on the machine, Irdsnhrxxxfery98 will be injected into that process instead of regsvr32.exe.   Irdsnhrxxxfery64 injecting lrdsnhrxxfery98

Tactics: TA0004, TA0005
Techniques: T1218, T1055, T1218.010
Input: Receiving C2 instructions from user profiles created by the adversary on legitimate websites/forums such as Github and Microsoft's TechNet portal

Tactics: TA0011
Techniques: T1102
Input: Meteor can attempt to uninstall Kaspersky Antivirus or remove the Kaspersky license; it can also add all files and folders related to the attack to the Windows Defender exclusion list.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Monitor file reads that may acquire user credentials from third-party password managers.

Tactics: TA0006
Techniques: T1555.005, T1555
Input: Grandoreiro can download its second stage from a hardcoded URL within the loader's code.

Tactics: TA0011
Techniques: T1105
Input: ShimRat has decompressed its core DLL using shellcode once an impersonated antivirus component was running on a system.

Tactics: TA0005
Techniques: T1140
Input: APT19 used PowerShell commands to execute payloads.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Monitor for files being accessed by an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel.

Tactics: TA0010
Techniques: T1567
Input: Ensure that AllowReversiblePasswordEncryption property is set to disabled unless there are application requirements.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556
Input: Chaes has used Base64 to encode C2 communications.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Malicious rules will execute when an adversary sends a specifically crafted email to the user.

Tactics: TA0003
Techniques: T1137, T1137.005
Input: DarkHydrus has used -WindowStyle Hidden to conceal PowerShell windows.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: OOXML files are packed together ZIP archives compromised of various XML files, referred to as parts, containing properties that collectively define how a document is rendered.

Tactics: TA0005
Techniques: T1221
Input: Adversaries may use VB payloads to execute malicious commands.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Gelsemium can collect data from a compromised host.

Tactics: TA0009
Techniques: T1005
Input: WastedLocker can enumerate files and directories just prior to encryption.

Tactics: TA0007
Techniques: T1083
Input: FIN7 uses CARBANAK as a post-exploitation tool in later phases of an intrusion to cement their foothold in a network and maintain access, frequently using the video command to monitor users and learn about the victim network, as well as the tunnel command to proxy connections into isolated portions of the victim environment

Tactics: TA0007, TA0011
Techniques: T1049, T1090
Input: This file is stored under the path /proc/\/maps, where the \ directory is the unique pid of the program being interrogated for such authentication data.

Tactics: TA0006
Techniques: T1003, T1003.007
Input: Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system.

Tactics: TA0007
Techniques: T1033
Input: Monitor for newly constructed processes and/or command-lines that can be used instead of invoking cmd ( pcalua.exe, winrs.exe, cscript/wscript.exe, hh.exe, or bash.exe)

Tactics: TA0005
Techniques: T1202
Input: Adversaries may add credentials for Service Principals and Applications in addition to existing legitimate credentials in Azure AD.

Tactics: TA0003
Techniques: T1098.001, T1098
Input: APT18 uses HTTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Popular Web services acting as an exfiltration mechanism may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to compromise.

Tactics: TA0010
Techniques: T1567
Input: Fox Kitten has used Google Chrome bookmarks to identify internal resources and assets.

Tactics: TA0007
Techniques: T1217
Input: Grandoreiro can use SSL in C2 communication.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: DOMAIN  FIRST SEEN  LAST SEEN  IP ADDRESS  securitywap.com  2014-11-17  2014-11-20  192.184.60.229  www.securitywap.com  2014-11-17  2014-11-20  192.184.60.229   In addition, the join.playboysplus[.]com exploit and payload delivery site resolves to 104.151.248.173

Tactics: TA0004, TA0007
Techniques: T1068, T1016
Input: Use of multi-factor authentication for public-facing webmail servers is a recommended best practice to minimize the usefulness of usernames and passwords to adversaries.

Tactics: TA0009
Techniques: T1114, T1114.002
Input: Dragonfly has exploited a Windows Netlogon vulnerability (CVE-2020-1472) to obtain access to Windows Active Directory servers.

Tactics: TA0008
Techniques: T1210
Input: Threat Group-3390 obtained a KeePass database from a compromised host.

Tactics: TA0006
Techniques: T1555.005, T1555
Input: Another method leverages raw sockets, which enables the malware to use ports that are already open for use by other programs.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205, T1205.001
Input: When the file is executed, the ThiefQuest code is executed first.

Tactics: TA0003
Techniques: T1554
Input: BadPatch searches for files with specific file extensions.

Tactics: TA0007
Techniques: T1083
Input: AppleJeus has used shell scripts to execute commands after installation and set persistence mechanisms.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: Bazar can use a timer to delay execution of core functionality.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: (Source: Dell SecureWorks) Both the redirect code on the compromised site and the exploit code appear and disappear, indicating that the adversaries add the code when they want to leverage the SWC and remove the code when it is not in use to limit the visibility of their operations

Tactics: TA0005
Techniques: T1140
Input: Adversaries may search scan databases to gather actionable information.

Tactics: TA0043
Techniques: T1596, T1596.005
Input: A Threat Group-3390 tool can read and decrypt stored Registry values.

Tactics: TA0007
Techniques: T1012
Input: On Linux, auditd can alert every time a user's actual ID and effective ID are different (this is what happens when you sudo).

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: FIN7 has harvested valid administrative credentials for lateral movement.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: Monitor for newly executed processes that may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware.

Tactics: TA0005
Techniques: T1070
Input: The script saves the decoded and decompressed executable to %APPDATA%\Microsoft\Windows\Templates\WindowsTemplate.exe and creates an LNK shortcut at %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\OneDrive.lnk to persistently run WindowsTemplate.exe each time Windows starts up

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: GoldMax can spawn a command shell, and execute native commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: HermeticWiper has the ability to receive a command parameter to sleep prior to carrying out destructive actions on a targeted host.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Additionally, the number of programs with setuid or setgid bits set should be minimized across a system.

Tactics: TA0004, TA0005
Techniques: T1548, T1548.001
Input: Rising Sun can enumerate all running processes and process information on an infected machine.

Tactics: TA0007
Techniques: T1057
Input: Adversaries may obtain tools to support their operations, including to support execution of post-compromise behaviors.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Adversaries may directly access a volume to bypass file access controls and file system monitoring.

Tactics: TA0005
Techniques: T1006
Input: These trust objects may include accounts, credentials, and other authentication material applied to servers, tokens, and domains.

Tactics: TA0004, TA0005
Techniques: T1484, T1484.002
Input: Escalate Privileges APT40 uses a mix of custom and publicly available credential harvesting tools to escalate privileges and dump password hashes

Tactics: TA0004, TA0006, TA0007
Techniques: T1003, T1068, T1018
Input: A module in Prikormka collects information from the victim about its IP addresses and MAC addresses.

Tactics: TA0007
Techniques: T1016
Input: Frankenstein has used WMI queries to check if various security applications were running, including VMWare and Virtualbox.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: OopsIE also encodes collected data in hexadecimal format before writing to files on disk and obfuscates strings.

Tactics: TA0005
Techniques: T1027
Input: REvil has used PowerShell to delete volume shadow copies and download files.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: AdFind can enumerate domain users.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: WannaCry searches for variety of user files by file extension before encrypting them using RSA and AES, including Office, PDF, image, audio, video, source code, archive/compression format, and key and certificate files.

Tactics: TA0007
Techniques: T1083
Input: APT18 actors leverage legitimate credentials to log into external remote services.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1133
Input: Starting with .NET Framework 4, the profiling DLL does not need to be registered as long as the location of the DLL is specified in the COR_PROFILER_PATH environment variable.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.012, T1574
Input: Resource forks have been deprecated and replaced with the application bundle structure.

Tactics: TA0005
Techniques: T1564, T1564.009
Input: Adversaries may also fragment files across the existing file system structure in non-standard ways.

Tactics: TA0005
Techniques: T1564, T1564.005
Input: Flagpro has been used to execute net view on a targeted system.

Tactics: TA0007
Techniques: T1018
Input: Sidewinder has sent e-mails with malicious links to credential harvesting websites.

Tactics: TA0043
Techniques: T1598, T1598.003
Input: UBoatRAT checks for virtualization software such as VMWare, VirtualBox, or QEmu on the compromised machine.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: PDB strings containing the 'SyberSpace' username

Tactics: TA0007
Techniques: T1033
Input: They can also block end-user registration of applications by their users, to reduce risk.

Tactics: TA0006
Techniques: T1528
Input: JCry has used PowerShell to execute payloads.

Tactics: TA0002
Techniques: T1059.001, T1059