madox81/Adema_ATTACK_DS huggingface dataset:
Input: LaZagne can obtain credential information running Linux processes.

Tactics: TA0006
Techniques: T1003, T1003.007
Input: If it is not normally used or is disabled, then this may be an indicator of suspicious behavior.

Tactics: TA0008
Techniques: T1021, T1021.006
Input: Frankenstein has run a command script to set up persistence as a scheduled task named "WinUpdate", as well as other encoded commands from the command-line.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: InvisiMole has a command to create, set, copy, or delete a specified Registry key or value.

Tactics: TA0005
Techniques: T1112
Input: Account credentials gathered by adversaries may be those directly associated with the target victim organization or attempt to take advantage of the tendency for users to use the same passwords across personal and business accounts.

Tactics: TA0043
Techniques: T1589, T1589.001
Input: Sys10 collects the computer name, OS versioning information, and OS install date and sends the information to the C2.

Tactics: TA0007
Techniques: T1082
Input: Ke3chang performs local network connection discovery using netstat.

Tactics: TA0007
Techniques: T1049
Input: Ragnar Locker has attempted to stop services associated with business applications and databases to release the lock on files used by these applications so they may be encrypted.

Tactics: TA0040
Techniques: T1489
Input: Reasons for Defacement include delivering messaging, intimidation, or claiming (possibly false) credit for an intrusion.

Tactics: TA0040
Techniques: T1491
Input: Caterpillar WebShell has a module to use a rootkit on a system.

Tactics: TA0005
Techniques: T1014
Input: HAWKBALL has exploited Microsoft Office vulnerabilities CVE-2017-11882 and CVE-2018-0802 to deliver the payload.

Tactics: TA0002
Techniques: T1203
Input: HyperBro can unpack and decrypt its payload prior to execution.

Tactics: TA0005
Techniques: T1140
Input: APT29 has compromised email accounts to further enable phishing campaigns.

Tactics: TA0042
Techniques: T1586.002, T1586
Input: WindTail can use the open command to execute an application.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: Instead of wiping specific disk structures or files, adversaries with destructive intent may wipe arbitrary portions of disk content.

Tactics: TA0040
Techniques: T1561.001, T1561
Input: Deobfuscated, we can see it is the HawkEye Keylogger — Reborn v9, Version=9.0.1.6

Tactics: TA0006, TA0009
Techniques: T1056
Input: OSX_OCEANLOTUS.D has changed permissions of a second-stage payload to an executable via chmod.

Tactics: TA0005
Techniques: T1222.002, T1222
Input: Javali has used the MSI installer to download and execute malicious payloads.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: Often Valid Accounts are required, along with access to the remote system's SMB/Windows Admin Shares for RPC communication.

Tactics: TA0005
Techniques: T1112
Input: The switch statement checks for 19 cases, between 101 and 119. (Updated to correct command IDs, thanks @mykill!)    Command ID Function   Description   101 getInfoOSX Gathers username and OSX version and responds using the encrypted form of the following string: “Mac OS X – [OSX version] x64<br>\nUser name – [username]”   102 getProcessList Runs “ps aux” to obtain a list of running processes   103 remoteShell Runs supplied command using “/bin/sh”   104 getInstalledAPP Gets a list of installed applications by running the command “ls -la /Applications”   105 showBackupIosFolder Checks to see if an IOS device was backed up to the system by running the command “ls -la ~/Library/Application\ Support/MobileSync/Backup/”   106 downloadFileFromPath Uploads a file from a specified path   107 createFileInSystem Downloads a file, specifically provided within the C2 server’s HTTP response   108 execFile Executes a specified file on the system using the NSTask:launch method   109 deletFileFromPath Deletes a specified file using the NSFileManager:removeFileAtPath method   110 takeScreenShot Takes a screenshot using the CGGetActiveDisplayList, CGDisplayCreateImage, NSImage:initWithCGImage methods

Tactics: TA0002, TA0005, TA0011
Techniques: T1070, T1070.006, T1071, T1106
Input: MegaCortex loads injecthelper.dll into a newly created rundll32.exe process.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Adversaries may send victims emails containing malicious attachments or links, typically to execute malicious code on victim systems.

Tactics: TA0001
Techniques: T1566
Input: Cyclops Blink can encrypt C2 messages with AES-256-CBC sent underneath TLS.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: FIN7 has encrypted virtual disk volumes on ESXi servers using a version of Darkside ransomware.

Tactics: TA0040
Techniques: T1486
Input: Sibot has installed a second-stage script in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot registry key.

Tactics: TA0005
Techniques: T1112
Input: Process injection is a method of executing arbitrary code in the address space of a separate live process.

Tactics: TA0004, TA0005
Techniques: T1055
Input: On Windows, the built-in klist utility can be used to list and analyze cached Kerberos tickets.

Tactics: TA0006
Techniques: T1558
Input: ServHelper has a module to delete itself from the infected machine.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Prevent adversary access to privileged accounts or access necessary to replace system firmware.

Tactics: TA0040
Techniques: T1495
Input: RobbinHood uses cmd.exe on the victim's computer.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Naid creates Registry entries that store information about a created service and point to a malicious DLL dropped to disk.

Tactics: TA0005
Techniques: T1112
Input: Helminth creates folders to store output from batch scripts prior to sending the information to its C2 server.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: APT29 has used Rundll32.exe to execute payloads.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: In the example above, the “spp.exe” executable would be added to an auto-run registry key at: SOFTWARE\Microsoft\Windows\CurrentVersion\Run\iexplore Many of the Fetch samples attempted to obfuscate their functionality by encrypting their embedded strings with AES using the same key “agkrhfpdbvhdhrkj”; however, the loader’s main goal involved running the following command:/c powershell -window hidden -EncodedCommand JAAwAG8AOABlACAAPQAgACcAJABmADkAQgAgAD0AIAAnACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAawBlAHIAbgBlAGwAMwAyAC4AZABsAGwAIgApAF0AcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAGUAeAB0AGUAcgBuACAASQBuAHQAUAB0AHIAIABWAGkAcgB0AHUAYQBsAEEAbABsAG8AYwAoAEkAbgB0AFAAdAByACAAbABwAEEAZABkAHIAZQBzAHMALAAgAHUAaQBuAHQAIABkAHcAUwBpAHoAZQAsA&lt;snip&gt;The base64 encoded command decodes to the following:$0o8e = '$f9B = ''[DllImport("kernel32.dll")]public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);[DllImport("kernel32.dll")]public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);[DllImport("msvcrt.dll")]public static extern IntPtr memset(IntPtr dest, uint src, uint count);'';$w = Add-Type -memberDefinition $f9B -Name "Win32" -namespace Win32Functions -passthru;[Byte[]];[Byte[]]$z = &lt;shellcode REDACTED for brevity&gt;;$g = 0x1000;if ($z.Length -gt 0x1000){$g = $z.Length};$rJr=$w::VirtualAlloc(0,0x1000,$g,0x40);for ($i=0;$i -le ($z.Length-1);$i++) {$w::memset([IntPtr]($rJr.ToInt32()+$i), $z[$i], 1)};$w::CreateThread(0,0,$rJr,0,0,0);for (;;){Start-sleep 60};';$e = [System.Convert]::ToBase64String([System.Text.Encoding]::Unicode.GetBytes($0o8e));$DKn = "-enc ";if([IntPtr]::Size -eq 8){$b32 = $env:SystemRoot + "\syswow64\WindowsPowerShell\v1.0\powershell";iex "&amp; $b32 $DKn $e"}else{;iex "&amp; powershell $DKn $e";}The decoded command above builds a buffer that it uses to store shellcode and creates a thread to execute it

Tactics: TA0002
Techniques: T1059.001, T1059
Input: The Instance Metadata API is provided as a convenience to assist in managing applications and is accessible by anyone who can access the instance.

Tactics: TA0006
Techniques: T1552, T1552.005
Input: FoggyWeb can masquerade the output of C2 commands as a fake, but legitimately formatted WebP file.

Tactics: TA0005
Techniques: T1036
Input: Collecting and comparing disk and resource filenames for binaries by looking to see if the InternalName, OriginalFilename, and/or ProductName match what is expected could provide useful leads, but may not always be indicative of malicious activity.

Tactics: TA0005
Techniques: T1036.003, T1036.005, T1036
Input: Mosquito uses the ipconfig command.

Tactics: TA0007
Techniques: T1016
Input: As mentioned previously, Buckeye also uses a number of hacking tools, including the following: Keylogger: The keylogger is configured using the command line parameters: NetworkService, Replace, Install, Register and Unregister

Tactics: TA0006, TA0009
Techniques: T1056
Input: Hildegard has used the BOtB tool that can break out of containers.

Tactics: TA0004
Techniques: T1611
Input: Launch Agents can also be executed using the Launchctl command.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: The Trojan downloads the contents of this file by crafting an HTTP request to a URL structured as follows: <Google Drive URL in ‘gdu’> + <first file identifier> + “?alt=media” With the contents of the file downloaded, the Trojan sets the modification_time variable to the current modification time so the Trojan knows when the actor makes further changes to the file

Tactics: TA0005, TA0007, TA0011
Techniques: T1070, T1070.006, T1090.003, T1083, T1105, T1090
Input: Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.001
Input: jRAT’s Java payload is encrypted with AES.

Tactics: TA0005
Techniques: T1027
Input: NotPetya contains a modified version of Mimikatz to help gather credentials that are later used for lateral movement.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: TrickBot uses module networkDll for process list discovery.

Tactics: TA0007
Techniques: T1057
Input: MoonWind completes network communication via raw sockets.

Tactics: TA0011
Techniques: T1095
Input: Monitor for unexpected deletions of user accounts.

Tactics: TA0040
Techniques: T1531
Input: BBK has the ability to inject shellcode into svchost.exe.

Tactics: TA0004, TA0005
Techniques: T1055
Input: The group has also used other obfuscation methods, including Base64 obfuscation of VBScripts and PowerShell commands.

Tactics: TA0005
Techniques: T1027
Input: Security can be limited on browser app stores so it may not be difficult for malicious extensions to defeat automated scanners.

Tactics: TA0003
Techniques: T1176
Input: Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows ( unauthorized, gratuitous, or anomalous traffic patterns attempting to access internal and external websites and services).

Tactics: TA0040
Techniques: T1491
Input: LightNeuron has used AES and XOR to decrypt configuration files and commands.

Tactics: TA0005
Techniques: T1140
Input: Metamorfo has a function to kill processes associated with defenses and can prevent certain processes from launching.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: OSX_OCEANLOTUS.D uses Word macros for execution.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: APT3 has a tool that can enumerate current network connections.

Tactics: TA0007
Techniques: T1049
Input: QakBot can use Rundll32.exe to enable C2 communication.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Check the system for multiple dylibs with the same name and monitor which versions have historically been loaded into a process.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.004, T1574
Input: Anchor can self delete its dropper after the malware is successfully deployed.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Compromised credentials for cloud accounts can be used to harvest sensitive data from online storage accounts and databases.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078.004, T1078
Input: menuPass has used esentutl to change file extensions to their true type that were masquerading as .txt files.

Tactics: TA0005
Techniques: T1036
Input: The PCODE of the virtual machine is packed with the aplib packer

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Skidmap has the ability to check if /usr/sbin/setenforce exists.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Monitor for API calls that may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems.

Tactics: TA0003, TA0004
Techniques: T1547
Input: User activity-based checks will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.002
Input: FoggyWeb's loader can use API functions to load the FoggyWeb backdoor into the same Application Domain within which the legitimate AD FS managed code is executed.

Tactics: TA0002
Techniques: T1106
Input: The DropIt Trojan we analyzed is an executable that builds an embedded executable by decoding embedded blobs of base64 encoded data and concatenating them together in the correct order

Tactics: TA0011
Techniques: T1132
Input: Agent.btz collects the network adapter’s IP and MAC address as well as IP addresses of the network adapter’s default gateway, primary/secondary WINS, DHCP, and DNS servers, and saves them into a log file.

Tactics: TA0007
Techniques: T1016
Input: If the computer is domain joined, then group policy can help restrict the ability to create or hide users.

Tactics: TA0005
Techniques: T1564.002, T1564
Input: Monitoring for Windows authentication logs are also useful in determining when authenticated network shares are established and by which account, and can be used to correlate network share activity to other events to investigate potentially malicious activity.

Tactics: TA0005
Techniques: T1070, T1070.005
Input: Bazar's loader can delete scheduled tasks created by a previous instance of the malware.

Tactics: TA0005
Techniques: T1070
Input: Adversaries may perform RDP session hijacking which involves stealing a legitimate user's remote session.

Tactics: TA0008
Techniques: T1563.002, T1563
Input: Adversaries may abuse PubPrn to execute malicious payloads hosted on remote sites.

Tactics: TA0005
Techniques: T1216.001, T1216
Input: BADCALL disables the Windows firewall before binding to a port.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: APT39 has used malware to delete files after they are deployed on a compromised host.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Javali has achieved execution through victims clicking links to malicious websites.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Some installers may also require elevated privileges that will result in privilege escalation when executing adversary controlled code.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.005, T1574
Input: RegDuke can decrypt strings with a key either stored in the Registry or hardcoded in the code.

Tactics: TA0005
Techniques: T1140
Input: f) Hadoop YARN ResourceManager – Command Execution (exploit) g) CVE-2016-3088: Apache ActiveMQ Fileserver File Upload Remote Code Execution Vulnerability

Tactics: TA0002, TA0011
Techniques: T1203, T1105
Input: DCOM can also execute macros in existing documents and may also invoke Dynamic Data Exchange (DDE) execution directly through a COM created instance of a Microsoft Office application, bypassing the need for a malicious document.

Tactics: TA0008
Techniques: T1021.003, T1021
Input: Kimsuky created and used a mailing toolkit to use in spearphishing attacks.

Tactics: TA0042
Techniques: T1587
Input: Attack Lifecycle  Initial Compromise APT40 has been observed leveraging a variety of techniques for initial compromise, including web server exploitation, phishing campaigns delivering publicly available and custom backdoors, and strategic web compromises

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Code Integrity event logging may also provide valuable indicators of malicious SIP or trust provider loads, since protected processes that attempt to load a maliciously-crafted trust validation component will likely fail (Event ID 3033).

Tactics: TA0005
Techniques: T1553, T1553.003
Input: Exaramel for Linux has a command to download a file from  and to a remote C2 server.

Tactics: TA0011
Techniques: T1105
Input: SHUTDOWN Shuts down the system using cmd /s /t 0   RESTART Reboots the system using cmd /r /t 0   PROCANDSOFT Lists all active processes and all installed software and uploads the results to the C2 server using a POST command at the “/log.php”

Tactics: TA0002, TA0011
Techniques: T1071, T1059
Input: Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account.

Tactics: TA0003
Techniques: T1098.002, T1098
Input: Aria-body has used TCP in C2 communications.

Tactics: TA0011
Techniques: T1095
Input: Monitor for API calls to OpenProcess that can be used to manipulate lsass.exe running on a domain controller

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.001
Input: Monitor abnormal PowerShell commands, unusual loading of PowerShell drives or modules.

Tactics: TA0003, TA0004
Techniques: T1546.013, T1546
Input: Magic Hound has acquired mobile phone numbers of potential targets, possibly for mobile malware or additional phishing operations.

Tactics: TA0043
Techniques: T1589
Input: Adversaries may also hide the rule by making use of the Microsoft Messaging API (MAPI) to modify the rule properties, making it hidden and not visible from Outlook, OWA or most Exchange Administration tools.

Tactics: TA0009
Techniques: T1114, T1114.003
Input: BlackTech has exploited a buffer overflow vulnerability in Microsoft Internet Information Services (IIS) 6.0, CVE-2017-7269, in order to establish a new HTTP or command and control (C2) server.

Tactics: TA0001
Techniques: T1190
Input: Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult.

Tactics: TA0042
Techniques: T1584.003, T1584.001, T1588.006, T1584.004, T1586.002, T1583.004, T1583.003, T1584.002, T1584, T1588, T1583.005, T1585, T1587, T1587.004, T1588.001, T1583.006, T1587.001, T1588.005, T1585.002, T1583, T1584.005, T1583.002, T1586
Input: SombRAT can store harvested data in a custom database under the %TEMP% directory.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: ISAPI extensions and filters may have access to all IIS web requests and responses.

Tactics: TA0003
Techniques: T1505.004, T1505
Input: WarzoneRAT can encrypt its C2 with RC4 with the password warzone160\x00.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Use strong passwords to increase the difficulty of credential hashes from being cracked if they are obtained.

Tactics: TA0006
Techniques: T1187
Input: BadPatch stores collected data in log files before exfiltration.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Tonto Team has used Python-based tools for execution.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Conficker resets system restore points and deletes backup files.

Tactics: TA0040
Techniques: T1490
Input: Monitor for changes made to windows registry keys or values for unexpected modifications

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Adversaries can use this feature to trick users into double clicking benign-looking files of any format and ultimately executing something malicious.

Tactics: TA0005
Techniques: T1036.006, T1036
Input: 78 runin.bin List of processes names and associated plugins should be run inside these processes

Tactics: TA0007
Techniques: T1057
Input: APT29 gained initial network access to some victims via a trojanized update of SolarWinds Orion software.

Tactics: TA0001
Techniques: T1195, T1195.002
Input: APT41 gained access to production environments where they could inject malicious code into legitimate, signed files and widely distribute them to end users.

Tactics: TA0001
Techniques: T1195, T1195.002
Input: Information repositories are tools that allow for storage of information, typically to facilitate collaboration or information sharing between users, and can store a wide variety of data that may aid adversaries in further objectives, or direct access to the target information.

Tactics: TA0009
Techniques: T1213
Input: CosmicDuke uses scheduled tasks typically named "Watchmon Service" for persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Cadelspy has the ability to steal information about printers and the documents sent to printers.

Tactics: TA0007
Techniques: T1120
Input: Ursnif has used Tor for C2.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: Windows Event ID 4661 can also be used to detect when a directory service has been accessed.

Tactics: TA0007
Techniques: T1615
Input: QuasarRAT has a built-in keylogger.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: NETWIRE has the ability to search for files on the compromised host.

Tactics: TA0007
Techniques: T1083
Input: Monitor for user accounts logged into systems that may use Valid Accounts to log into remote machines using Secure Shell (SSH).

Tactics: TA0008
Techniques: T1021, T1021.004
Input: Lazarus Group has used Themida to pack malicious DLLs and other files.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: FLASHFLOOD stages data it copies from the local system or removable drives in the "%WINDIR%\$NtUninstallKB885884$\" directory.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Cyclops Blink can upload files from a compromised host.

Tactics: TA0009
Techniques: T1005
Input: Thrip leveraged PowerShell to run commands to download payloads, traverse the compromised networks, and carry out reconnaissance.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: LookBack has used VBA macros in Microsoft Word attachments to drop additional files to the host.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Tools such as Sysinternals Autoruns can be used to detect changes to execution triggers that could be attempts at persistence.

Tactics: TA0003, TA0004
Techniques: T1546
Input: Execution via Thread Execution Hijacking may also evade detection from security products since the execution is masked under a legitimate process.

Tactics: TA0004, TA0005
Techniques: T1055.003, T1055
Input: Restrict execution of Msiexec.exe to privileged accounts or groups that need to use it to lessen the opportunities for malicious usage.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: OceanSalt can create a reverse shell on the infected endpoint using cmd.exe.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: H1N1 uses multiple techniques to obfuscate strings, including XOR.

Tactics: TA0005
Techniques: T1027
Input: Stuxnet uses a Windows rootkit to mask its binaries and other relevant files.

Tactics: TA0005
Techniques: T1014
Input: APT28 attempted to get users to click on Microsoft Office attachments containing malicious macro scripts.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: PsExec, a tool that has been used by adversaries, writes programs to the ADMIN$ network share to execute commands on remote systems.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Monitor executed commands and arguments for actions that will aid in compression or encrypting data that is collected prior to exfiltration, such as tar.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Koadic can gather hashed passwords by gathering domain controller hashes from NTDS.

Tactics: TA0006
Techniques: T1003.003, T1003