madox81/Adema_ATTACK_DS huggingface dataset:
Input: This version of HALFBAKED connects to the following C2 server: hxxp://198[.]100.119.6:80/cd hxxp://198[.]100.119.6:443/cd hxxp://198[.]100.119.6:8080/cd This version of HALFBAKED listens for the following commands from the C2 server:  info: Sends victim machine information (OS, Processor, BIOS and running processes) using WMI queries processList: Send list of process running screenshot: Takes screen shot of victim machine (using 58d2a83f777688.78384945.ps1) runvbs: Executes a VB script runexe: Executes EXE file runps1: Executes PowerShell script delete: Delete the specified file update: Update the specified file  All communication between the backdoor and attacker C2 are encoded using the following technique, represented in pseudo code: Function send_data(data)                 random_string = custom_function_to_generate_random_string()                 encoded_data = URLEncode(SimpleEncrypt(data))                 post_data("POST”, random_string & "=" & encoded_data, Hard_coded_c2_url, Create_Random_Url(class_id)) The FireEye iSIGHT Intelligence MySIGHT Portal contains additional information based on our investigations of a variety of topics discussed in this post, including FIN7 and the HALFBAKED backdoor

Tactics: TA0005, TA0010
Techniques: T1041, T1070, T1070.004
Input: This may be done by placing an executable in a commonly trusted directory (ex: under System32) or giving it the name of a legitimate, trusted program (ex: svchost.exe).

Tactics: TA0005
Techniques: T1036.005, T1036
Input: JCry has encrypted files and demanded Bitcoin to decrypt those files.

Tactics: TA0040
Techniques: T1486
Input: Zebrocy creates an entry in a Registry Run key for the malware to execute on startup.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Loading, unloading, and manipulating modules on Linux systems can be detected by monitoring for the following commands: modprobe, insmod, lsmod, rmmod, or modinfo  Adversaries may run commands on the target system before loading a malicious module in order to ensure that it is properly compiled.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: Data loss prevention can detect and block sensitive data being uploaded via web browsers.

Tactics: TA0010
Techniques: T1048.002, T1048
Input: Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Tactics: TA0007
Techniques: T1082
Input: Configure browsers/applications to regularly delete persistent web cookies.

Tactics: TA0006
Techniques: T1606, T1606.001
Input: Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Tactics: TA0043
Techniques: T1596.002, T1591.004, T1589.003, T1592, T1591.003, T1590.002, T1589, T1593, T1591.002, T1589.001, T1597.002, T1590, T1596, T1590.004, T1596.005, T1590.006, T1590.005, T1590.003, T1591, T1592.003, T1597, T1593.001, T1596.004, T1591.001, T1593.002, T1596.003, T1597.001, T1590.001, T1596.001
Input: Torisma has used XOR and Base64 to decode C2 data.

Tactics: TA0005
Techniques: T1140
Input: Adversaries can establish persistence by adding a malicious binary path or shell commands to rc.local, rc.common, and other RC scripts specific to the Unix-like distribution.

Tactics: TA0003, TA0004
Techniques: T1037.004, T1037
Input: The service checks every 60 seconds to determine if the malware is running; if not, it will spawn a new instance.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: For example, it is possible to load a DLL at logon using a "Depend" key with RunOnceEx: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "C:\temp\evil[.]dll"

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Carbanak also uses XOR with random keys for its communications.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Mshta.exe may not be necessary within a given environment since its functionality is tied to older versions of Internet Explorer that have reached end of life.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: SNUGRIDE establishes persistence through a Registry Run key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: FrameworkPOS can collect elements related to credit card data from process memory.

Tactics: TA0009
Techniques: T1005
Input: Monitor for newly constructed files that may deface systems internal to an organization in an attempt to intimidate or mislead users.

Tactics: TA0040
Techniques: T1491.001, T1491
Input: Group5 disguised its malicious binaries with several layers of obfuscation, including encrypting the files.

Tactics: TA0005
Techniques: T1027
Input: email with an embedded tracking link

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Adversaries may also use malware that leverages a system's network bandwidth as part of a botnet in order to facilitate Network Denial of Service campaigns and/or to seed malicious torrents.

Tactics: TA0040
Techniques: T1496
Input: TeamTNT has used UPX and Ezuri packer to pack its binaries.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Monitor Windows logs (ex: EIDs 1341, 1342, 1020, and 1063) for changes to DHCP settings.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.003
Input: PoisonIvy captures window titles.

Tactics: TA0007
Techniques: T1010
Input: Carberp has masqueraded as Windows system file names, as well as "chkntfs.exe" and "syscron.exe".

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Monitor for newly constructed files that may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: A version of KONNI has dropped a Windows shortcut into the Startup folder to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Periodically review user accounts and remove those that are inactive or unnecessary.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078.004, T1078
Input: Normally an application is run in the current user’s context, regardless of which user or group owns the application.

Tactics: TA0004, TA0005
Techniques: T1548, T1548.001
Input: POSHSPY encrypts C2 traffic with AES and RSA.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: HAMMERTOSS binaries contain an algorithm that generates a different Twitter handle for the malware to check for instructions every day.

Tactics: TA0011
Techniques: T1102.003, T1102
Input: Higaisa used ipconfig to gather network configuration information.

Tactics: TA0007
Techniques: T1016
Input: Monitor executed commands and arguments that may abuse the Windows command shell for execution.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Monitor for newly executed processes (such as mstsc.exe) that may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP).

Tactics: TA0008
Techniques: T1021.001, T1021
Input: APT28 has used tools to take screenshots from victims.

Tactics: TA0009
Techniques: T1113
Input: PROMETHIUM has disguised malicious installer files by bundling them with legitimate software installers.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Cobalt Group has used odbcconf to proxy the execution of malicious DLL files.

Tactics: TA0005
Techniques: T1218, T1218.008
Input: Only install browser extensions from trusted sources that can be verified.

Tactics: TA0003
Techniques: T1176
Input: Cloned certificate chains will carry many of the same metadata characteristics of the source and can be used to sign malicious code that may then bypass signature validation tools (ex: Sysinternals, antivirus, ) used to block execution and/or uncover artifacts of Persistence.

Tactics: TA0005
Techniques: T1553, T1553.004
Input: Siloscape searches for the Kubernetes config file and other related files using a regular expression.

Tactics: TA0007
Techniques: T1083
Input: JPIN can send email over SMTP.

Tactics: TA0011
Techniques: T1071, T1071.003
Input: ActiveMime Lure Files  MD5  2017年员工工资性津贴额统计报告.doc (2017 Statistical Report on Staff Salary and Allowances) 5458a2e4d784abb1a1127263bd5006b5  Thong tin.doc (Information) ce50e544430e7265a45fab5a1f31e529  Phan Vu Tutn CV.doc  4f761095ca51bfbbf4496a4964e41d4f  Ke hoach cuu tro nam 2017.doc (2017 Bailout Plan) e9abe54162ba4572c770ab043f576784  Instructions to GSIS.doc  fba089444c769700e47c6b44c362f96b  Hoi thao truyen thong doc lap.doc (Traditional Games) f6ee4b72d6d42d0c7be9172be2b817c1   Giấy yêu cầu bồi thường mới 2016 - hằng.doc (New 2016 Claim Form) aa1f85de3e4d33f31b4f78968b29f175  Hoa don chi tiet tien no.doc (Debt Details) 5180a8d9325a417f2d8066f9226a5154  Thu moi tham du Hoi luan.doc (Collection of Participants) f6ee4b72d6d42d0c7be9172be2b817c1  Danh sach nhan vien vi pham ky luat.doc (List of Employee Violations) 6baafffa7bf960dec821b627f9653e44  Nội-dung-quảng-cáo.doc (Internal Content Advertising) 471a2e7341f2614b715dc89e803ffcac  HĐ DVPM-VTC 31.03.17.doc  f1af6bb36cdf3cff768faee7919f0733   Table 2: Sampling of APT32 Lure Files The Base64 encoded ActiveMime data also contained an OLE file with malicious macros

Tactics: TA0005, TA0007, TA0011
Techniques: T1090.003, T1027, T1083, T1090
Input: Figure 8: Network communication to download the Pause.ps1 payload Zyklon Delivery In all these techniques, the same domain is used to download the next level payload (Pause.ps1), which is another PowerShell script that is Base64 encoded (as seen in Figure 8)

Tactics: TA0011
Techniques: T1105
Input: Information about network trusts may include a variety of details, including second or third-party organizations/domains (ex: managed service providers, contractors, ) that have connected (and potentially elevated) network access.

Tactics: TA0043
Techniques: T1590, T1590.003
Input: Kimsuky has used modified versions of PHProxy to examine web traffic between the victim and the accessed website.

Tactics: TA0006, TA0009
Techniques: T1557
Input: Keydnap puts a space after a false .jpg extension so that execution actually goes through the Terminal.app program.

Tactics: TA0005
Techniques: T1036.006, T1036
Input: With an OAuth access token an adversary can use the user-granted REST API to perform functions such as email searching and contact enumeration.

Tactics: TA0005, TA0008
Techniques: T1550.001, T1550
Input: Magic Hound used various social media channels (such as LinkedIn) as well as messaging services (such as WhatsApp) to spearphish victims.

Tactics: TA0001
Techniques: T1566.003, T1566
Input: ComRAT has used HTTP requests for command and control.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Zeus Panda adds persistence by creating Registry Run keys.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Kivars has the ability to remotely trigger keyboard input and mouse clicks.

Tactics: TA0008
Techniques: T1021
Input: menuPass has collected various files from the compromised computers.

Tactics: TA0009
Techniques: T1005
Input: StoneDrill has been observed deleting the temporary files once they fulfill their task.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Frankenstein has communicated with a C2 via an encrypted RC4 byte stream and AES-CBC.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Night Dragon has performed SQL injection attacks of extranet web servers to gain access.

Tactics: TA0001
Techniques: T1190
Input: Monitor for changes made to files for unexpected modifications to file names that are mismatched between the file name on disk and that of the binary's PE metadata.

Tactics: TA0005
Techniques: T1036.003, T1036
Input: Deletes existing file

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Pony has attempted to lure targets into downloading an attached executable (ZIP, RAR, or CAB archives) or document (PDF or other MS Office format).

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Figure 3 Hardware ID used by XAgent to uniquely identify compromised hosts When generating the URLs within the HTTP POST and GET requests, XAgent sets one HTTP parameter using a specific data structure that contains this agent_id value

Tactics: TA0011
Techniques: T1071
Input: Adversaries may also compromise shared network directories through binary infections by appending or prepending its code to the healthy binary on the shared network directory.

Tactics: TA0008
Techniques: T1080
Input: PE injection is commonly performed by copying code (perhaps without a file on disk) into the virtual address space of the target process before invoking it via a new thread.

Tactics: TA0004, TA0005
Techniques: T1055.002, T1055
Input: Monitor executed commands and arguments acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

Tactics: TA0007
Techniques: T1069
Input: Threat Group-3390 has compromised the Able Desktop installer to gain access to victim's environments.

Tactics: TA0001
Techniques: T1195, T1195.002
Input: Some adversaries may also use Automated Collection on removable media.

Tactics: TA0009
Techniques: T1025
Input: Monitor for suspicious account behavior across cloud services that share account.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078.004, T1078
Input: It also downloads additional plugins.

Tactics: TA0011
Techniques: T1105
Input: Empire can use various modules to search for files containing passwords.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: VB is a programming language created by Microsoft with interoperability with many Windows technologies such as Component Object Model and the Native API through the Windows API.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Use of utilities, such as FTP, that does not normally occur may also be suspicious.

Tactics: TA0011
Techniques: T1105
Input: Monitor for the execution of commands and arguments that can be used for adversaries to modify services' registry keys and values through applications such as Windows Management Instrumentation and PowerShell.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.011, T1574
Input: Adversaries may also opt to enumerate processes via /proc.

Tactics: TA0007
Techniques: T1057
Input: Wizard Spider used Base64 encoding to obfuscate an Empire service and PowerShell commands.

Tactics: TA0005
Techniques: T1027
Input: Ferocious can use GET.WORKSPACE in Microsoft Excel to determine the OS version of the compromised host.

Tactics: TA0007
Techniques: T1082
Input: Pandora has the ability to gain system privileges through Windows services.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: APT38 has used Hermes ransomware to encrypt files with AES256.

Tactics: TA0040
Techniques: T1486
Input: The files uploaded to this webshell included the same compiled python script that would scan remote systems that were vulnerable to CVE-2017-0144 (EternalBlue) that we saw uploaded to the other errr.aspx webshell.

Tactics: TA0002
Techniques: T1059
Input: Monitor emond rules creation by checking for files modified in /etc/emond.d/rules/ and /private/var/db/emondClients.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.014
Input: OilRig has tested malware samples to determine AV detection and subsequently modified the samples to ensure AV evasion.

Tactics: TA0005
Techniques: T1027, T1027.005
Input: NavRAT uses tasklist /v to check running processes.

Tactics: TA0007
Techniques: T1057
Input: Monitor for files being accessed to exfiltrate data to a cloud storage service rather than over their primary command and control channel.

Tactics: TA0010
Techniques: T1567.002, T1567
Input: They have also dropped QuasarRAT binaries as files named microsoft_network.exe and crome.exe.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: ZLib has the ability to obtain screenshots of the compromised system.

Tactics: TA0009
Techniques: T1113
Input: Attor has encrypted data symmetrically using a randomly generated Blowfish (OFB) key which is encrypted with a public RSA key.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Tropic Trooper has hidden payloads in Flash directories and fake installer files.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: APT38 has used PowerShell to execute commands and other operational tasks.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: StreamEx has the ability to enumerate drive types.

Tactics: TA0007
Techniques: T1083
Input: SysUpdate can search files on a compromised host.

Tactics: TA0007
Techniques: T1083
Input: http://www.cankayasrc[.]com/style/js/main.php http://ektamservis[.]com/includes/main.php http://gtme[.]ae/font-awesome/css/main.php  Recommendations for organizations Effective protection from targeted attacks focuses on advanced detective, preventive and investigative capabilities via solutions and training, allowing an organization to control any activities on their network or suspicious files on user systems

Tactics: TA0011
Techniques: T1071
Input: Pay2Key has designated machines in the compromised network to serve as reverse proxy pivot points to channel communications with C2.

Tactics: TA0011
Techniques: T1090.001, T1090
Input: Adversaries may "pass the hash" using stolen password hashes to move laterally within an environment, bypassing normal system access controls.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: Monitor for an attempt by a user to gain access to a network or computing resource, often by providing credentials to cloud service management consoles.

Tactics: TA0006
Techniques: T1539
Input: Monitor for newly constructed network connections using Windows Remote Management (WinRM), such as remote WMI connection attempts (typically over port 5985 when using HTTP and 5986 for HTTPS).

Tactics: TA0008
Techniques: T1021, T1021.006
Input: Services may also be modified through Windows system management tools such as Windows Management Instrumentation and PowerShell, so additional logging may need to be configured to gather the appropriate data.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Carberp has searched the Image File Execution Options registry key for "Debugger" within every subkey.

Tactics: TA0007
Techniques: T1012
Input: Kobalos replaced the SSH client with a trojanized SSH client to steal credentials on compromised systems.

Tactics: TA0003
Techniques: T1554
Input: ShimRat communicated over HTTP and HTTPS with C2 servers.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Adversaries may create virtual images which are smaller than those of typical virtual machines.

Tactics: TA0005
Techniques: T1564, T1564.006
Input: Adversaries may compromise access to third-party web services that can be used during targeting.

Tactics: TA0042
Techniques: T1584, T1584.006
Input: Once the host-based enumeration information was obtained, it was base64-encoded and then appended to the URL post request to a C2, whereas in previous versions this information was written to a text file.

Tactics: TA0011
Techniques: T1132
Input: Deobfuscation tools can be used to detect these indicators in files/payloads.

Tactics: TA0005
Techniques: T1027
Input: Monitor newly executed processes that result from the execution of subscriptions ( spawning from the WmiPrvSe.exe WMI Provider Host process).

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: The actor has used several notable techniques in these incidents such as sniffing passwords from Wi-Fi traffic, poisoning the NetBIOS Name Service, and spreading laterally via the EternalBlue exploit.  APT28 Uses Malicious Document to Target Hospitality Industry FireEye has uncovered a malicious document sent in spear phishing emails to multiple companies in the hospitality industry, including hotels in at least seven European countries and one Middle Eastern country in early July

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Kimsuky has obtained specific Registry keys and values on a compromised host.

Tactics: TA0007
Techniques: T1012
Input: HAWKBALL has sent system information and files over the C2 channel.

Tactics: TA0010
Techniques: T1041
Input: EvilBunny has executed commands via scheduled tasks.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Other factors, such as access patterns (ex: multiple systems over a relatively short period of time) and activity that occurs after a remote login, may indicate suspicious or malicious behavior with RDP.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: None of the known documents contain a lure image or message to instruct the recipient to click the Enable Content button necessary to run the macro, as seen in Figure 1

Tactics: TA0002
Techniques: T1204
Input: Registry modifications may also include actions to hide keys, such as prepending key names with a null character, which will cause an error and/or be ignored when read via Reg or other utilities using the Win32 API.

Tactics: TA0005
Techniques: T1112
Input: Crimson contains a command to retrieve files from its C2 server.

Tactics: TA0011
Techniques: T1105
Input: Kinsing has used ps to list processes.

Tactics: TA0007
Techniques: T1057
Input: CostaRicto employed nmap and pscan to scan target environments.

Tactics: TA0007
Techniques: T1046
Input: The PEB is then updated with the new address of the table.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.013, T1574
Input: Monitor these custom elements in service provider access logs to detect any anomalous requests.

Tactics: TA0006
Techniques: T1606, T1606.002
Input: TINYTYPHON searches through the drive containing the OS, then all drive letters C through to Z, for documents matching certain extensions.

Tactics: TA0007
Techniques: T1083
Input: By default, /etc/shadow is only readable by the root user.

Tactics: TA0006
Techniques: T1003, T1003.008
Input: TeamTNT has encrypted its binaries via AES.

Tactics: TA0005
Techniques: T1027
Input: Adversaries may use an external proxy to act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure.

Tactics: TA0011
Techniques: T1090, T1090.002
Input: In this campaign the KopiLuwak backdoor was encoded and delivered in a Windows shortcut (.lnk) file

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: StoneDrill can wipe the master boot record of an infected computer.

Tactics: TA0040
Techniques: T1561, T1561.002
Input: njRAT enumerates the victim operating system and computer name during the initial infection.

Tactics: TA0007
Techniques: T1082
Input: JSS Loader can download and execute VBScript files.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Turla surveys a system upon check-in to discover Group Policy details using the gpresult command.

Tactics: TA0007
Techniques: T1615
Input: APT29 removed evidence of email export requests using Remove-MailboxExportRequest.

Tactics: TA0005
Techniques: T1070
Input: APT19 uses a Port 22 malware variant to modify several Registry keys.

Tactics: TA0005
Techniques: T1112
Input: Valak has been delivered via malicious links in e-mail.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: By default all user accounts in the domain have permission to read GPOs.

Tactics: TA0004, TA0005
Techniques: T1484.001, T1484
Input: Lazarus Group malware SierraCharlie uses RDP for propagation.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: APT38 have enumerated files and directories, or searched in specific locations within a compromised host.

Tactics: TA0007
Techniques: T1083
Input: Agent Tesla has exploited Office vulnerabilities such as CVE-2017-11882 and CVE-2017-8570 for execution during delivery.

Tactics: TA0002
Techniques: T1203
Input: GravityRAT supports file encryption (AES with the key "lolomycin2017").

Tactics: TA0005
Techniques: T1027
Input: The "Uploader" variant of HAMMERTOSS visits a hard-coded server over HTTP/S to download the images HAMMERTOSS uses to receive commands.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Cobalt Group has sent emails containing malicious attachments that require users to execute a file or macro to infect the victim machine.

Tactics: TA0002
Techniques: T1204.002, T1204