madox81/Adema_ATTACK_DS huggingface dataset:
Input: OwaAuth uses incoming HTTP requests with a username keyword and commands and handles them as instructions to perform actions.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Local Accounts may also be abused to elevate privileges and harvest credentials through OS Credential Dumping.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.003
Input: Bankshot grabs a user token using WTSQueryUserToken and then creates a process by impersonating a logged-on user.

Tactics: TA0004, TA0005
Techniques: T1134.002, T1134
Input: Monitor executed commands and arguments associated with disabling or the modification of system firewalls such as netsh advfirewall firewall set rule group="file and printer sharing" new enable=Yes,ufw disable, and ufw logging off.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: Ptrace system call injection involves attaching to and modifying a running process.

Tactics: TA0004, TA0005
Techniques: T1055.008, T1055
Input: Once a user has double-clicked the embedded image, the form executes a VB setup script

Tactics: TA0002
Techniques: T1204
Input: StoneDrill has the capability to discover the system OS, Windows version, architecture and environment.

Tactics: TA0007
Techniques: T1082
Input: AADInternals can create a backdoor by converting a domain to a federated domain which will be able to authenticate any user across the tenant.

Tactics: TA0004, TA0005
Techniques: T1484
Input: FIN8 has cleared logs during post compromise cleanup activities.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: These audits should also include if default accounts have been enabled, or if new local accounts are created that have not be authorized.

Tactics: TA0001, TA0003, TA0004, TA0005, TA0006
Techniques: T1078, T1556, T1556.001
Input: Almost any network protocol may be used for flooding.

Tactics: TA0040
Techniques: T1498, T1498.001
Input: By default, access to these ccache entries is federated through the KCM daemon process via the Mach RPC protocol, which uses the caller's environment to determine access.

Tactics: TA0006
Techniques: T1558
Input: Command_Down_exec: This command downloads and executes new modules.  It takes a url as the argument and uses that to download and execute files

Tactics: TA0011
Techniques: T1105
Input: Clop has used a simple XOR operation to decrypt strings.

Tactics: TA0005
Techniques: T1140
Input: Implant directory contained in the malicious Flash file

Tactics: TA0007
Techniques: T1083
Input: AutoIt backdoor attempts to escalate privileges by bypassing User Access Control.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Ursnif has deleted data staged in tmp files after exfiltration.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Dragonfly has exploited CVE-2011-0611 in Adobe Flash Player to gain execution on a targeted system.

Tactics: TA0002
Techniques: T1203
Input: Since it is a very long term group, some victims may be impossible to identify now

Tactics: TA0007
Techniques: T1083
Input: Lazarus Group has digitally signed malware and utilities to evade detection.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Wevtutil can be used to disable specific event logs on the system.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: LoudMiner used a batch script to run the Linux virtual machine as a service.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Monitor for a file that may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware.

Tactics: TA0005
Techniques: T1070
Input: StrongPity has a file searcher component that can automatically collect and archive files based on a predefined list of file extensions.

Tactics: TA0009
Techniques: T1119
Input: Exploitation of this vulnerability allows an attacker to escalate privileges on the affected system

Tactics: TA0004
Techniques: T1068
Input: Additionally, it is possible to turn off logging to this file using the PowerShell command Set-PSReadlineOption -HistorySaveStyle SaveNothing.

Tactics: TA0005
Techniques: T1562.003, T1562
Input: gsecdump can dump Windows password hashes from the SAM.

Tactics: TA0006
Techniques: T1003, T1003.002
Input: FIVEHANDS can enumerate network shares and mounted drives on a network.

Tactics: TA0007
Techniques: T1135
Input: Cobian RAT has a feature to perform voice recording on the victim’s machine.

Tactics: TA0009
Techniques: T1123
Input: Wizard Spider has used networkdll for network discovery and psfin specifically for financial and point of sale indicators.

Tactics: TA0007
Techniques: T1018
Input: POWRUNER can capture a screenshot from a victim.

Tactics: TA0009
Techniques: T1113
Input: Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574
Input: Tropic Trooper used letmein to scan for saved usernames on the target system.

Tactics: TA0007
Techniques: T1033
Input: Example execution techniques that rely on authenticated sessions over SMB/RPC are Scheduled Task/Job, Service Execution, and Windows Management Instrumentation.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: The attacker made use of Cobalt Strike’s “psexec” lateral movement command to create a Windows service named with a random 16-character string on the target system and execute encoded PowerShell

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Dragonfly has conducted SQL injection attacks, exploited vulnerabilities CVE-2019-19781 and CVE-2020-0688 for Citrix and MS Exchange, and CVE-2018-13379 for Fortinet VPNs.

Tactics: TA0001
Techniques: T1190
Input: Adversaries may gather information about the victim's host software that can be used during targeting.

Tactics: TA0043
Techniques: T1592, T1592.002
Input: OilRig has used credential dumping tools such as Mimikatz to steal credentials to accounts logged into the compromised system and to Outlook Web Access.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Turla has obtained and customized publicly-available tools like Mimikatz.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: ConnectWise can be used to execute PowerShell commands on target machines.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: ADVSTORESHELL can enumerate registry keys.

Tactics: TA0007
Techniques: T1012
Input: This DoS attack may also reduce the availability and functionality of the targeted system(s) and network.

Tactics: TA0040
Techniques: T1498, T1498.001
Input: Additional bypass methods are regularly discovered and some used in the wild, such as:

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Bad Rabbit has attempted to bypass UAC and gain elevated administrative privileges.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Malicious extensions can be installed into a browser through malicious app store downloads masquerading as legitimate extensions, through social engineering, or by an adversary that has already compromised a system.

Tactics: TA0003
Techniques: T1176
Input: OceanSalt can collect the name and ID for every process running on the system.

Tactics: TA0007
Techniques: T1057
Input: A specific example is when an adversary injects software into a browser that allows them to inherit cookies, HTTP sessions, and SSL client certificates of a user then use the browser as a way to pivot into an authenticated intranet.

Tactics: TA0009
Techniques: T1185
Input: Adversaries may bypass process and/or signature-based defenses by proxying execution of malicious content with signed, or otherwise trusted, binaries.

Tactics: TA0005
Techniques: T1218
Input: Net Crawler uses Windows admin shares to establish authenticated sessions to remote systems over SMB as part of lateral movement.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Additionally, some variants of FakeM use modified SSL code for communications back to C2 servers, making SSL decryption ineffective.

Tactics: TA0011
Techniques: T1001, T1001.003
Input: These frameworks typically provide language wrappers/abstractions to API functionalities and are designed for ease-of-use/portability of code.

Tactics: TA0002
Techniques: T1106
Input: A defender who is monitoring for large transfers to outside the cloud environment through normal file transfers or over command and control channels may not be watching for data transfers to another account within the same cloud provider.

Tactics: TA0010
Techniques: T1537
Input: Meteor will delete the folder containing malicious scripts if it detects the hostname as PIS-APP, PIS-MOB, WSUSPROXY, or PIS-DB.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Cuba can query service status using QueryServiceStatusEx function.

Tactics: TA0007
Techniques: T1007
Input: Telemetry data regarding API use may not be useful depending on how a system is normally used, but may provide context to other potentially malicious activity occurring on a system.

Tactics: TA0009
Techniques: T1125
Input: Chaes has collected the username and UID from the infected machine.

Tactics: TA0007
Techniques: T1033
Input: Adversaries may impersonate a fake SSL/TLS handshake to make it look like subsequent traffic is SSL/TLS encrypted, potentially interfering with some security tooling, or to make the traffic look like it is related with a trusted entity.

Tactics: TA0011
Techniques: T1001, T1001.003
Input: PoetRAT has the ability to list all running processes.

Tactics: TA0007
Techniques: T1057
Input: Goopy has the ability to enumerate the infected system's user name.

Tactics: TA0007
Techniques: T1033
Input: At this point QueueUserAPC can be used to invoke a function (such as LoadLibrayA pointing to a malicious DLL).

Tactics: TA0004, TA0005
Techniques: T1055.004, T1055
Input: When the Duqu command and control is operating over HTTP or HTTPS, Duqu uploads data to its controller by appending it to a blank JPG file.

Tactics: TA0011
Techniques: T1001, T1001.002
Input: BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications.

Tactics: TA0003, TA0005
Techniques: T1197
Input: GreyEnergy can download additional modules and payloads.

Tactics: TA0011
Techniques: T1105
Input: APT3 has a tool that looks for files and directories on the local file system.

Tactics: TA0007
Techniques: T1083
Input: Clambling can collect information from a compromised host.

Tactics: TA0009
Techniques: T1005
Input: Analysis of Daserf has shown that it regularly undergoes technical improvements to evade anti-virus detection.

Tactics: TA0005
Techniques: T1027, T1027.005
Input: RainyDay can use scheduled tasks to achieve persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Machete has used AES to exfiltrate documents.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: LSA secrets are stored in the registry at HKEY_LOCAL_MACHINE\SECURITY\Policy\Secrets.

Tactics: TA0006
Techniques: T1003, T1003.004
Input: Otherwise, the implanted code will pass the credentials on for verification of potentially valid credentials.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.004
Input: Monitor for changes made to windows Registry keys and/or values that adversaries might use to disable or modify System Firewall settings such as HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: Operation Wocao has used the command net localgroup administrators to list all administrators part of a local group.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: Adversaries may execute their own payloads by placing a malicious dynamic library (dylib) with an expected name in a path a victim application searches at runtime.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.004, T1574
Input: Monitor for network traffic originating from unknown/unexpected hardware devices.

Tactics: TA0001, TA0003, TA0006, TA0008, TA0009, TA0010, TA0040
Techniques: T1557.001, T1557, T1200, T1557.002, T1029, T1565, T1570, T1133, T1565.002
Input: Custom databases are stored in:

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: HTAs are standalone applications that execute using the same models and technologies of Internet Explorer, but outside of the browser.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: Monitor for suspicious file access activity, specifically indications that a process is reading multiple files in a short amount of time and/or using command-line arguments indicative of searching for credential material (ex: regex patterns).

Tactics: TA0006
Techniques: T1552
Input: POSHSPY WMI Component The WMI component of the POSHSPY backdoor leverages a Filter to execute the PowerShell component of the backdoor on a regular basis

Tactics: TA0002
Techniques: T1047, T1059.001, T1059
Input: Password policies are a way to enforce complex passwords that are difficult to guess or crack through Brute Force.

Tactics: TA0007
Techniques: T1201
Input: Empire contains modules that can discover and exploit path interception opportunities in the PATH environment variable.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.007, T1574
Input: In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain.

Tactics: TA0003
Techniques: T1098
Input: Regardless of the file extensions, the files dropped by the macro are EITHER INF, SCT and text files OR VBS and text files

Tactics: TA0005, TA0007, TA0011
Techniques: T1070, T1090.003, T1083, T1090, T1070.004
Input: send a POST response to the C&C server to extract the user’s login credentials. redirect users to fake phishing websites.

Tactics: TA0009
Techniques: T1185
Input: NTDLL.dll

Tactics: TA0002
Techniques: T1129
Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or for initial access (ex: Supply Chain Compromise or External Remote Services).

Tactics: TA0043
Techniques: T1592, T1592.002
Input: ShimRatReporter had the ability to download additional payloads.

Tactics: TA0011
Techniques: T1105
Input: BackdoorDiplomacy has used web shells to establish an initial foothold and for lateral movement within a victim's system.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Take snapshots of MBR and VBR and compare against known good samples.

Tactics: TA0003, TA0005
Techniques: T1542.003, T1542
Input: AADInternals can be used to create SAML tokens using the AD Federated Services token signing certificate.

Tactics: TA0006
Techniques: T1606, T1606.002
Input: Koadic has used scheduled tasks to add persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: The encoded payload is then made to look like a URI by having a random number of ‘/’ characters inserted at random locations within the encoded payload

Tactics: TA0011
Techniques: T1132
Input: Services may be created with administrator privileges but are executed under SYSTEM privileges, so an adversary may also use a service to escalate privileges.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.

Tactics: TA0040
Techniques: T1499
Input: Crutch can monitor for removable drives being plugged into the compromised machine.

Tactics: TA0007
Techniques: T1120
Input: Adversaries may create fake social media accounts and message employees for potential job opportunities.

Tactics: TA0043
Techniques: T1598.001, T1598
Input: Tropic Trooper has attempted to transfer USBferry from an infected USB device by copying an Autorun function to the target machine.

Tactics: TA0001, TA0008
Techniques: T1091
Input: Monitor for contextual data about named pipes on the system.

Tactics: TA0008
Techniques: T1570
Input: Denis queries the Registry for keys and values.

Tactics: TA0007
Techniques: T1012
Input: The encrypted file contains a config file of 0x78 bytes. The data is decrypted with an 0xD9 XOR operation.

Tactics: TA0005
Techniques: T1027
Input: Suckfly used a signed credential-dumping tool to obtain victim account credentials.

Tactics: TA0006
Techniques: T1003
Input: Rising Sun can modify file attributes to hide files.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: This history file is available to all sessions and contains all past history since the file is not deleted when the session ends.

Tactics: TA0005
Techniques: T1070, T1070.003
Input: Ramsay can scan for systems that are vulnerable to the EternalBlue exploit.

Tactics: TA0007
Techniques: T1046
Input: Adversaries may have the resources to build out and control their own botnet infrastructure or may rent time on an existing botnet to conduct an attack.

Tactics: TA0040
Techniques: T1499, T1498, T1498.001
Input: EnvyScout can write files to disk with JavaScript using a modified version of the open-source tool FileSaver.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: The NETWIRE client has been signed by fake and invalid digital certificates.

Tactics: TA0005
Techniques: T1036, T1036.001
Input: Attor has used Tor for C2 communication.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: EVILNUM has changed the creation date of files.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: VaporRage has the ability to download malicious shellcode to compromised systems.

Tactics: TA0011
Techniques: T1105
Input: PlugX has used DLL side-loading to evade anti-virus.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: There are multiple ways an adversary may escape to a host environment.

Tactics: TA0004
Techniques: T1611
Input: Several tools used by Suckfly have been command-line driven.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: GOLD SOUTHFIELD has conducted malicious spam (malspam) campaigns to gain access to victim's machines.

Tactics: TA0001
Techniques: T1566
Input: Gamaredon Group has used legitimate process names to hide malware including svchosst.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: The autonomous system name of the IP shows that the allocation is controlled by Serverius Holding B.V., which is an autonomous system name we have previously seen associated with the OilRig group

Tactics: TA0007
Techniques: T1082
Input: ECCENTRICBANDWAGON can capture and store keystrokes.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Leviathan has used regsvr32 for execution.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.

Tactics: TA0043, TA0042
Techniques: T1608.005, T1591.004, T1589.003, T1595.003, T1608.001, T1592, T1584.003, T1595.001, T1589.002, T1584.001, T1587.002, T1589, T1592.002, T1608.004, T1586.001, T1588.006, T1593, T1591.002, T1584.004, T1588.004, T1586.002, T1583.004, T1589.001, T1592.004, T1583.003, T1584, T1590, T1588, T1590.005, T1594, T1585, T1591, T1595, T1585.001, T1587, T1608, T1588.001, T1593.001, T1583.006, T1587.001, T1588.005, T1585.002, T1584.006, T1588.002, T1583, T1593.002, T1587.003, T1584.005, T1583.002, T1588.003, T1586, T1595.002, T1608.002, T1590.001
Input: POWRUNER may collect local group information by running net localgroup administrators or a series of other commands on a victim.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: LOWBALL Malware Analysis The spear phishing emails contained three attachments in total, each of which exploited an older vulnerability in Microsoft Office (CVE-2012-0158):  MD5  Filename  b9208a5b0504cb2283b1144fc455eaaa  使命公民運動 我們的異象.doc  ec19ed7cddf92984906325da59f75351  新聞稿及公佈.doc  6495b384748188188d09e9d5a0c401a4  (代發)[采訪通知]港大校友關注組遞信行動.doc   In all three cases, the payload was the same:  MD5  Filename  d76261ba3b624933a6ebb5dd73758db4  time.exe   This backdoor, known as LOWBALL, uses the legitimate Dropbox cloud-storage service to act as the CnC server

Tactics: TA0001, TA0005, TA0011
Techniques: T1036, T1566.003, T1566, T1566.001, T1102
Input: The MIB may also contain device operational information, including running configuration, routing table, and interface details.

Tactics: TA0009
Techniques: T1602.001, T1602
Input: menuPass has staged data on remote MSP systems or other victim networks prior to exfiltration.

Tactics: TA0009
Techniques: T1074.002, T1074
Input: Ursnif has used HTTPS for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Valak has the ability to enumerate domain admin accounts.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: SLOTHFULMEDIA has downloaded files onto a victim machine.

Tactics: TA0011
Techniques: T1105
Input: This method is dependent upon the Network Boundary Bridging method in order to allow the adversaries to cross the protected network boundary of the Internet perimeter and into the organization’s WAN.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: Dipsind can be configured to only run during normal working hours, which would make its communications harder to distinguish from normal traffic.

Tactics: TA0010
Techniques: T1029
Input: Exfiltration BRONZE UNION has also leveraged various web shells to collect and stage data for exfiltration

Tactics: TA0003, TA0009, TA0011
Techniques: T1505.003, T1132, T1505, T1074
Input: Adversaries may use malicious code previously implanted in the boot loader, such as through the ROMMONkit method, to directly manipulate running operating system code in memory.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: Check pre-installed certificates on new systems to ensure unnecessary or suspicious certificates are not present.

Tactics: TA0005
Techniques: T1553, T1553.004
Input: StrongPity can use the HKCU\Software\Microsoft\Windows\CurrentVersion\Run Registry key for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: The following shows the specific IP addresses or strings used by the C2 to transmit a success or cancel message depending on the type of DNS query used for C2 communications:    DNS Type Successful Cancel   A,AC 1.1.1.\d+ 1.2.9.\d+   AAAA 2a00:: 2200::   CNAME,MX,TXT,SRV,SOA ok cancel    After providing system specific information, the payload will Interact with the C2 server to obtain commands, which the payload refers to as jobs

Tactics: TA0011
Techniques: T1071
Input: Monitor command-line arguments for script execution and subsequent behavior.

Tactics: TA0002
Techniques: T1059
Input: Adversaries may execute their own malicious payloads by hijacking environment variables the dynamic linker uses to load shared libraries.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.006, T1574
Input: The entries point to a handler for that extension located at HKEY_CLASSES_ROOT\[handler].

Tactics: TA0003, TA0004
Techniques: T1546, T1546.001
Input: The “screenshot” command takes a screenshot that is saved as a.PNG file in “ProgramData“

Tactics: TA0009
Techniques: T1113
Input: Empire can be used to conduct packet captures on target hosts.

Tactics: TA0006, TA0007
Techniques: T1040
Input: APT33 has attempted to use WMI event subscriptions to establish persistence on compromised hosts.

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: Conti has loaded an encrypted DLL into memory and then executes it.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: WINERACK can enumerate active windows.

Tactics: TA0007
Techniques: T1010
Input: Encrypted directories have had a ransom note of RyukReadMe.txt written to the directory.

Tactics: TA0040
Techniques: T1486
Input: Bankshot writes data into the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Pniumj.

Tactics: TA0005
Techniques: T1112