madox81/Adema_ATTACK_DS huggingface dataset:
Input: In Windows, enable and configure event logging and PowerShell logging to check for the hidden window style.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Adversaries may gather information about the victim's organization that can be used during targeting.

Tactics: TA0043
Techniques: T1591
Input: Taidoor has the ability to use native APIs for execution including GetProcessHeap, GetProcAddress, and LoadLibrary.

Tactics: TA0002
Techniques: T1106
Input: chinapolicyanalysis.org 185.130.212.168 Domain used for spear phish sender e-mail address and to host malicious documents

Tactics: TA0007
Techniques: T1016
Input: Python code can also be compiled into binary executables.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: * The sdclt.exe bypass uses the [HKEY_CURRENT_USER]\Software\Microsoft\Windows\CurrentVersion\App Paths\control.exe and [HKEY_CURRENT_USER]\Software\Classes\exefile\shell\runas\command\isolatedCommand Registry keys.Analysts should monitor these Registry settings for unauthorized changes.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: SILENTTRINITY can bypass ScriptBlock logging to execute unmanaged PowerShell code from memory.

Tactics: TA0005
Techniques: T1562.003, T1562
Input: IcedID has been delivered via phishing e-mails with malicious attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: VBScript is a default scripting language on Windows hosts and can also be used in place of JavaScript on HTML Application (HTA) webpages served to Internet Explorer (though most modern browsers do not come with VBScript support).

Tactics: TA0002
Techniques: T1059.005, T1059
Input: On Windows 10, enable cloud-delivered protection and Attack Surface Reduction (ASR) rules to block the execution of files that resemble ransomware.

Tactics: TA0040
Techniques: T1486
Input: Ke3chang has used compromised credentials and a .NET tool to dump data from Microsoft Exchange mailboxes.

Tactics: TA0009
Techniques: T1114, T1114.002
Input: Common features of LKM based rootkits include: hiding itself, selective hiding of files, processes and network activity, as well as log tampering, providing authenticated backdoors, and enabling root access to non-privileged users.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: See the following for more information and examples of false flags being used in cyberattacks: Wave your false flags! …or the Nightmares and Nuances of a Self-Aware Attribution Space OlympicDestroyer is here to trick the industry Malware description The malware was first seen packed with VMProtect; when unpacked the sample didn’t show any similarities with previously known malware

Tactics: TA0005
Techniques: T1027.002, T1027
Input: SILENTTRINITY contains a module to conduct Kerberoasting.

Tactics: TA0006
Techniques: T1558.003, T1558
Input: HotCroissant has the ability to do real time screen viewing on an infected host.

Tactics: TA0009
Techniques: T1113
Input: A Volgmer variant is encoded using a simple XOR cipher.

Tactics: TA0005
Techniques: T1027
Input: Monitor email clients and applications for suspicious activity, such as missing messages or abnormal configuration and/or log entries.

Tactics: TA0005
Techniques: T1564, T1564.008
Input: Dyre has the ability to identify the computer name, OS version, and hardware configuration on a compromised host.

Tactics: TA0007
Techniques: T1082
Input: gh0st RAT has used the InterlockedExchange, SeShutdownPrivilege, and ExitWindowsEx Windows API functions.

Tactics: TA0002
Techniques: T1106
Input: Use of these infrastructure solutions allows an adversary to stage, launch, and execute an operation.

Tactics: TA0042
Techniques: T1583
Input: Require that all executables be placed in write-protected directories.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.007, T1574.008, T1574.009, T1574
Input: Monitor for queried domain name system (DNS) registry data that may compromise third-party DNS servers that can be used during targeting.

Tactics: TA0042
Techniques: T1584.002, T1584
Input: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.

Tactics: TA0010
Techniques: T1567.002, T1567
Input: Zebrocy has a command to create a scheduled task for persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: BADFLICK has captured victim IP address details.

Tactics: TA0007
Techniques: T1016
Input: The Trojan will then read the hexadecimal formatted contents of this file in 1500 byte blocks, sending each 1500 bytes of data from the file to the C2 server via an HTTP GET request to a URL with the following structure:http://<c2 domain>/resp?<hex(Environment.UserName/Environment.MachineName)>AAZ<hex(command prompt output)> The upload command (2) writes data provided by the C2 to a specified file

Tactics: TA0011
Techniques: T1071
Input: The oletools toolkit leverages the pcodedmp disassembler to detect VBA stomping by comparing keywords present in the VBA source code and p-code.

Tactics: TA0005
Techniques: T1564, T1564.007
Input: POWRUNER may collect information on the victim's anti-virus software.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: 4 Upload edg499.dat, which includes the list of interesting files

Tactics: TA0007
Techniques: T1083
Input: The malware then sets the hijacked service to start automatically to establish persistence.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.010, T1574
Input: TYPEFRAME can gather the disk volume information.

Tactics: TA0007
Techniques: T1082
Input: Pillowmint has deleted the filepath %APPDATA%\Intel\devmonsrv.exe.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: PlugX has a module to enumerate drives and find files recursively.

Tactics: TA0007
Techniques: T1083
Input: Monitor for newly constructed logon behavior across systems that share accounts, either user, admin, or service accounts.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.003, T1556, T1556.001
Input: Deep Panda has used the sticky-keys technique to bypass the RDP login screen on remote systems during intrusions.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: Exaramel for Linux uses crontab for persistence if it does not have root privileges.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: Consider monitoring files downloaded from the Internet, possibly by HTML Smuggling, for suspicious activities.

Tactics: TA0005
Techniques: T1027.006, T1027
Input: macOS applications use plist files, such as the info.plist file, to store properties and configuration settings that inform the operating system how to handle the application at runtime.

Tactics: TA0005
Techniques: T1647
Input: From our analysis, stealing keystrokes is the main function of RunningRat; however, the DLL has code for more extensive functionality

Tactics: TA0005, TA0006, TA0009
Techniques: T1140, T1056
Input: Bundlore can persist via a LaunchAgent.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: Metamorfo has used cmd.exe /c to execute files.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Enable the UpdateFolderPermissions action for all logon types.

Tactics: TA0003
Techniques: T1098.002, T1098
Input: Malware used by Putter Panda attempts to terminate processes corresponding to two components of Sophos Anti-Virus (SAVAdminService.exe and SavService.exe).

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Programs listed in the load value of the registry key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows run when any user logs on.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: P8RAT can check the compromised host for processes associated with VMware or VirtualBox environments.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: (Source: SecureWorks) Reentry attempt After BRONZE UNION was evicted from a compromised environment, which involved blocking the group's known infrastructure, CTU researchers observed the group attempting to reconnect to its OWA web shells and a backup web shell it had deployed during the intrusion

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Some Reaver variants use raw TCP for C2.

Tactics: TA0011
Techniques: T1095
Input: Machete collects the hostname of the target computer.

Tactics: TA0007
Techniques: T1082
Input: Cobalt Strike can query HKEY_CURRENT_USER\Software\Microsoft\Office\\Excel\Security\AccessVBOM\  to determine if the security setting for restricting default programmatic access is enabled.

Tactics: TA0007
Techniques: T1012
Input: Ke3chang performs process discovery using tasklist commands.

Tactics: TA0007
Techniques: T1057
Input: Requests for malicious execution can be passed through the application's XPC Services handler.

Tactics: TA0002
Techniques: T1559, T1559.003
Input: Appendix Indicators of Compromise    11227ECA89CC053FB189FAC3EBF27497  Seminar.rtf    4DE5ADB865B5198B4F2593AD436FCEFF  Seminar.rtf    78734CD268E5C9AB4184E1BBE21A6EB9  Zam<RandomNumber>.doc    92F63B1227A6B37335495F9BCB939EA2  FELIXROOT Dropper    DE10A32129650849CEAF4009E660F72F  FELIXROOT Backdoor    Table 4: FELIXROOT IOCs  Network Indicators of Compromise 217.12.204.100/news 217.12.204.100:443/news 193.23.181.151/Seminar.rtf Accept-Encoding: gzip, deflate content-Type: application/x-www-form-urlencoded Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.2) Configuration Files  Version 1: {"1" : "https://88.198.13.116:8443/xmlservice","2" : "30","4" : "GufseGHbc","6" : "3", "7" : “http://88.198.13.116:8080/xmlservice"}  Version 2: {"1" : "https://217.12.204.100/news/","2" : "30","4" : "KdfrJKN","6" : "3", "7" : "http://217.12.204.100/news/"} FireEye Detections    MD5  Product  Signature  Action    11227ECA89CC053FB189FAC3EBF27497  NX/EX/AX  Malware.Binary.rtf  Block    4DE5ADB865B5198B4F2593AD436FCEFF  NX/EX/AX  Malware.Binary.rtf  Block    78734CD268E5C9AB4184E1BBE21A6EB9  NX/EX/AX  Malware.Binary  Block    92F63B1227A6B37335495F9BCB939EA2  NX/EX/AX  FE_Dropper_Win32_FELIXROOT_1  Block    DE10A32129650849CEAF4009E660F72F  NX/EX/AX  FE_Backdoor_Win32_FELIXROOT_2  Block    11227ECA89CC053FB189FAC3EBF27497  HX  IOC  Alert    4DE5ADB865B5198B4F2593AD436FCEFF  HX  IOC  Alert    Table 5: FireEye Detections Acknowledgements Special thanks to Jonell Baltazar, Alex Berry and Benjamin Read for their contributions to this blog.

Tactics: TA0007, TA0008
Techniques: T1007, T1087, T1021, T1021.002, T1018
Input: Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with.

Tactics: TA0005
Techniques: T1036, T1553, T1553.002, T1036.001
Input: Process Doppelgänging also invokes an outdated and undocumented implementation of the Windows process loader via calls to NtCreateProcessEx and NtCreateThreadEx as well as API calls used to modify memory within another process, such as WriteProcessMemory.

Tactics: TA0004, TA0005
Techniques: T1055.013, T1055
Input: Lucifer can use system resources to mine cryptocurrency, dropping XMRig to mine Monero.

Tactics: TA0040
Techniques: T1496
Input: 8 Upload the TPX498.dat file, which contains the list of collected keystrokes

Tactics: TA0006, TA0009
Techniques: T1056
Input: FeedBack.php validates the sender by User-Agent, saves the data in the “RAR” server directory and stores the metadata in the mssql database for later reference

Tactics: TA0009
Techniques: T1074
Input: Methods for doing that include built-in functionality of malware or by using utilities present on the system.

Tactics: TA0005
Techniques: T1140
Input: BoomBox can establish persistence by writing the Registry value MicroNativeCacheSvc to HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Monitor executed commands and arguments that may search for private key certificate files on compromised systems for insecurely stored credentials.

Tactics: TA0006
Techniques: T1552.004, T1552
Input: If the C2 server is discovered or shut down, the threat actors can update the encoded IP address on TechNet to maintain control of the victims’ machines.

Tactics: TA0011
Techniques: T1104
Input: T9000 gathers and beacons the MAC and IP addresses during installation.

Tactics: TA0007
Techniques: T1016
Input: KeyBoy issues the command reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" to achieve persistence.

Tactics: TA0003, TA0004
Techniques: T1547.004, T1547
Input: Adversaries may also attempt to infer the location of a victim host using IP addressing, such as via online geolocation IP-lookup services.

Tactics: TA0007
Techniques: T1614
Input: For example, if domain-x and domain-y are customers of the same CDN, it is possible to place domain-x in the TLS header and domain-y in the HTTP header.

Tactics: TA0011
Techniques: T1090.004, T1090
Input: Check the integrity of the existing BIOS or EFI to determine if it is vulnerable to modification.

Tactics: TA0003, TA0005
Techniques: T1542.001, T1542
Input: POSHSPY uses a WMI event subscription to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: Data loss prevention can detect and block sensitive data being copied to USB devices.

Tactics: TA0010
Techniques: T1052, T1052.001
Input: Patchwork attempted to use RDP to move laterally.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Monitor for suspicious files ( .pdf, .docx, .jpg, ) viewed in isolation that may steal data by exfiltrating it over a different protocol than that of the existing command and control channel.

Tactics: TA0010
Techniques: T1048
Input: APT37 has used an audio capturing utility known as SOUNDWAVE that captures microphone input.

Tactics: TA0009
Techniques: T1123
Input: Use multi-factor authentication wherever possible.

Tactics: TA0006, TA0007
Techniques: T1040
Input: CredSSP:  Provides SSO and Network Level Authentication for Remote Desktop Services.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Get2 has the ability to identify the current username of an infected host.

Tactics: TA0007
Techniques: T1033
Input: Adversaries may also communicate with an already open port, but the service listening on that port will only respond to commands or trigger other malicious functionality if passed the appropriate magic value(s).

Tactics: TA0003, TA0005, TA0011
Techniques: T1205
Input: LightNeuron can be configured to automatically collect files under a specified directory.

Tactics: TA0009
Techniques: T1119
Input: TinyTurla has the ability to encrypt C2 traffic with SSL/TLS.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Adversaries may use scripts automatically executed at boot or logon initialization to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1037
Input: MacSpy uses HTTP for command and control.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: FIN4 has created rules in victims' Microsoft Outlook accounts to automatically delete emails containing words such as "hacked," "phish," and "malware" in a likely attempt to prevent organizations from communicating about their activities.

Tactics: TA0005
Techniques: T1564, T1564.008
Input: Sidewinder has used malware to collect information on files and directories.

Tactics: TA0007
Techniques: T1083
Input: PlugX allows the operator to capture screenshots.

Tactics: TA0009
Techniques: T1113
Input: This document exploited a newer vulnerability, CVE-2017-0199

Tactics: TA0002
Techniques: T1203
Input: The startup folder path for all users is C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Adversaries may attempt to render the system unable to boot by overwriting critical data located in structures such as the master boot record (MBR) or partition table.

Tactics: TA0040
Techniques: T1561, T1561.002
Input: Monitor for logged domain name system (DNS) data that may purchase domains that can be used during targeting.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: Adversaries may add login items to execute upon user login to gain persistence or escalate privileges.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.015
Input: If Adobe Flash or Microsoft Silverlight is no longer required, DHS recommends that those applications be removed from systems.The IOCs provided with this alert include IP addresses determined to be part of the HIDDEN COBRA botnet infrastructure, identified as DeltaCharlie

Tactics: TA0007
Techniques: T1016
Input: Nebulae can achieve persistence through a Registry Run key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: MAPIGET steals email still on Exchange servers that has not yet been archived.

Tactics: TA0009
Techniques: T1114, T1114.002
Input: Pupy can enable/disable RDP connection and can start a remote desktop session using a browser web socket client.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: WhisperGate can shutdown a compromised host through execution of ExitWindowsEx with the EXW_SHUTDOWN flag.

Tactics: TA0040
Techniques: T1529
Input: Hildegard has modified DNS resolvers to evade DNS monitoring tools.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Zebrocy identifies network drives when they are added to victim systems.

Tactics: TA0007
Techniques: T1135
Input: EvilBunny has used WMI to gather information about the system.

Tactics: TA0002
Techniques: T1047
Input: APT29 used WMI to steal credentials and execute backdoors at a future time.

Tactics: TA0002
Techniques: T1047
Input: Even for those platforms that have the capability, it is recommended to download a copy of the file to a trusted computer to calculate the checksum with software that is not compromised.

Tactics: TA0005
Techniques: T1601
Input: Consider monitoring for Windows event ID (EID) 400, which shows the version of PowerShell executing in the EngineVersion field (which may also be relevant to detecting a potential Downgrade Attack) as well as if PowerShell is running locally or remotely in the HostName field.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: In macOS 11+, the use of the profiles tool can no longer install configuration profiles, however .mobileconfig files can be planted and installed with user interaction.

Tactics: TA0003
Techniques: T1176
Input: Adversaries may take advantage of routing schemes in Content Delivery Networks (CDNs) and other services which host multiple domains to obfuscate the intended destination of HTTPS traffic or traffic tunneled through HTTPS.

Tactics: TA0011
Techniques: T1090.004, T1090
Input: SeaDuke C2 traffic has been encrypted with RC4 and AES.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Donut includes a subproject DonutTest to inject shellcode into a target process.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Operation Wocao has used scripts to detect security software.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Browser extensions for some browsers can be controlled through Group Policy.

Tactics: TA0003
Techniques: T1176
Input: Honeybee uses a dropper called MaoCheng that harvests a stolen digital signature from Adobe Systems.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: The selection of the target process is influenced by the security software that is installed on the system (Duqu will inject into different processes depending on which security suite is installed on the infected host).

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Matryoshka is capable of stealing Outlook passwords.

Tactics: TA0006
Techniques: T1555
Input: Dragonfly has dropped and executed tools used for password cracking, including Hydra and CrackMapExec.

Tactics: TA0006
Techniques: T1110, T1110.002
Input: While it includes multiple ways to find Explorer, the preferred method is to get the process id from the current desktop window.

Tactics: TA0007
Techniques: T1057
Input: Built-in web application interfaces are leveraged for the insertion of any other kind of object that can be used to display web content or contain a script that executes on the visiting client ( forum posts, comments, and other user controllable web content).

Tactics: TA0001
Techniques: T1189
Input: Adversaries may abuse msiexec.exe to launch local or network accessible MSI files.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: SpeakUp can perform brute forcing using a pre-defined list of usernames and passwords in an attempt to log in to administrative panels.

Tactics: TA0006
Techniques: T1110, T1110.001
Input: Some versions of CozyCar will check to ensure it is not being executed inside a virtual machine or a known malware analysis sandbox environment.

Tactics: TA0005, TA0007
Techniques: T1497
Input: For example, using a Cloud Access Security Broker (CASB), admins can create a "High severity app permissions" policy that generates alerts if apps request high severity permissions or send permissions requests for too many users.Security analysts can hunt for malicious apps using the tools available in their CASB, identity provider, or resource provider (depending on platform.)

Tactics: TA0006
Techniques: T1528
Input: Bisonal has appended random binary data to the end of itself to generate a large binary.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: TEMP.Veles has used a publicly-available PowerShell-based tool, WMImplant.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: SILENTTRINITY can establish a LNK file in the startup folder for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Then, it will launch Dec.exe using PowerShell with the command “ cmd.exe /c powershell - WindowStyle Hidden Start-Process Dec.exe - WindowStyle maximized ”.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Alternatively, compromised systems may return no output at all in cases where adversaries want to send instructions to systems and do not want a response.

Tactics: TA0011
Techniques: T1102.003, T1102
Input: MegaCortex can stop and disable services on the system.

Tactics: TA0040
Techniques: T1489
Input: Reg may be used to interact with and modify the Windows Registry of a local or remote system at the command-line interface.

Tactics: TA0005
Techniques: T1112
Input: APT29 obtained PKI keys, certificate files and the private encryption key from an Active Directory Federation Services (AD FS) container to decrypt corresponding SAML signing certificates.

Tactics: TA0006
Techniques: T1552.004, T1552
Input: OilRig can download remote files onto victims.

Tactics: TA0011
Techniques: T1105
Input: NanHaiShu uses DNS for the C2 communications.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: On macOS, the removal of the com.apple.quarantine flag by a user instead of the operating system is a suspicious action and should be examined further.

Tactics: TA0005
Techniques: T1553
Input: It is possible to extract passwords from backups or saved virtual machines through OS Credential Dumping.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: APT33 has used compromised Office 365 accounts in tandem with Ruler in an attempt to gain control of endpoints.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078.004, T1078
Input: These entries will allow an application to automatically start during the startup of a desktop environment after user logon.

Tactics: TA0003, TA0004
Techniques: T1547.013, T1547
Input: The mailbox audit log will forward folder permission modification events to the Unified Audit Log.

Tactics: TA0003
Techniques: T1098.002, T1098
Input: Malicious XDG autostart entries may be detected by auditing file creation events within the /etc/xdg/autostart and ~/.config/autostart directories.

Tactics: TA0003, TA0004
Techniques: T1547.013, T1547