madox81/Adema_ATTACK_DS huggingface dataset:
Input: Capabilities exist to overwrite the system firmware, which may give sophisticated adversaries a means to install malicious firmware updates as a means of persistence on a system that may be difficult to detect.

Tactics: TA0003, TA0005
Techniques: T1542.001, T1542
Input: Observed vulnerabilities include:  CVE-2012-0158  CVE-2017-0199  CVE-2017-8759  CVE-2017-11882       Figure 2: APT40 attack lifecycle  Establish Foothold APT40 uses a variety of malware and tools to establish a foothold, many of which are either publicly available or used by other threat groups

Tactics: TA0002
Techniques: T1203
Input: It also extracted command-line arguments and individual arguments from the running MsBuild.exe process to identify the directory path of the Orion software Visual Studio solution.

Tactics: TA0007
Techniques: T1057
Input: Creating processes with a different token may require the credentials of the target user, specific privileges to impersonate that user, or access to the token to be used (ex: gathered via other means such as Token Impersonation/Theft or Make and Impersonate Token).

Tactics: TA0004, TA0005
Techniques: T1134.002, T1134
Input: RainyDay can decrypt its payload via a XOR key.

Tactics: TA0005
Techniques: T1140
Input: Mis-Type uses cmd.exe to run commands for enumerating the host.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: HTRAN can proxy TCP socket connections to obfuscate command and control infrastructure.

Tactics: TA0011
Techniques: T1090
Input: Skeleton key works through a patch on an enterprise domain controller authentication process (LSASS) with credentials that adversaries may use to bypass the standard authentication system.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.001
Input: This also describes which commands users can run as other users or groups.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Create a token object.

Tactics: TA0004, TA0005
Techniques: T1134.002, T1134.003, T1134, T1134.001
Input: REvil can decode encrypted strings to enable execution of commands and payloads.

Tactics: TA0005
Techniques: T1140
Input: Monitor for the use of access tokens to access services such as email that were created using SAML tokens which do not have corresponding 1202 events ( "The Federation Service validated a new credential") in the domain.

Tactics: TA0006
Techniques: T1606, T1606.002
Input: DRATzarus can use the GetTickCount and GetSystemTimeAsFileTime API calls to inspect system time.

Tactics: TA0007
Techniques: T1124
Input: Be aware that there are methods of bypassing the PowerShell execution policy, depending on environment configuration.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Naikon has used WMIC.exe for lateral movement.

Tactics: TA0002
Techniques: T1047
Input: The PipeMon installer has modified the Registry key HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments\Windows x64\Print Processors to install PipeMon as a Print Processor.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.012
Input: Rancor has used msiexec to download and execute malicious installer files over HTTP.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: Adversaries may search content delivery network (CDN) data about victims that can be used during targeting.

Tactics: TA0043
Techniques: T1596, T1596.004
Input: Chaes has used Installutill to download content.

Tactics: TA0005
Techniques: T1218, T1218.004
Input: Kerberos TGS tickets are also known as service tickets.

Tactics: TA0006
Techniques: T1558.002, T1558
Input: If SIP is enabled, the kext signature is verified before being added to the AuxKC.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: Hildegard has queried the Cloud Instance Metadata API for cloud credentials.

Tactics: TA0006
Techniques: T1552, T1552.005
Input: APT12 has used multiple variants of DNS Calculation including multiplying the first two octets of an IP address and adding the third octet to that value in order to get a resulting command and control port.

Tactics: TA0011
Techniques: T1568, T1568.003
Input: Clop can enumerate all processes on the victim's machine.

Tactics: TA0007
Techniques: T1057
Input: Flagpro can use Native API to enable obfuscation including GetLastError and GetTickCount.

Tactics: TA0002
Techniques: T1106
Input: The code then decodes this set of import symbols and resolves addresses for its networking and data stealing functionality: InternetCloseHandle InternetReadFile HttpSendRequestA HttpOpenRequestA HttpQueryInfoA InternetConnectA InternetCrackUrlA InternetOpenA InternetSetOptionW GetAdaptersInfo Much like the prior office monkey “atiumdag.dll” component, this code collects identifying system information using standard win32 API calls: Computer name – GetComputerNameW User name – GetUserNameW Adapter GUID, ip address, mac address – GetAdaptersInfo Windows version – GetVersionExW It then uses the runtime resolved networking API calls to send the collected data back to a hardcoded c2 and set of urls

Tactics: TA0002, TA0005, TA0007
Techniques: T1140, T1106, T1016
Input: CHOPSTICK may store RC4 encrypted configuration information in the Windows Registry.

Tactics: TA0005
Techniques: T1112
Input: APT3 has used a tool that can obtain info about local and global group users, power users, and administrators.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: WastedLocker's custom crypter, CryptOne, leveraged the VirtualAlloc() API function to help execute the payload.

Tactics: TA0002
Techniques: T1106
Input: APT29 used UPX to pack files.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Most decompression techniques decompress the executable code in memory.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Monitor Fine-Grained Password Policies and regularly audit user accounts and group settings.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.005
Input: For comparison, if we were to inspect Fysbis “RemoteShell” associated strings in one of the stripped variants, we would only see the following:  Figure 3: Sofacy Fysbis stripped binary string references to RemoteShell capability Compare this with what is available from the non-stripped variant:  Figure 4: Sofacy Fysbis non-stripped binary strings referenes to RemoteShell capability Little static analysis gifts like these can help to speed defender enumeration of capabilities and – more importantly – further contribute to correlation and detection across related samples

Tactics: TA0005
Techniques: T1027
Input: If the UAC protection level of a computer is set to anything but the highest level, certain Windows programs can elevate privileges or execute some elevated Component Object Model objects without prompting the user through the UAC notification box.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: To make profile pages appear more legitimate, APT17 has created biographical sections and posted in forum threads.

Tactics: TA0042
Techniques: T1585
Input: Kimsuky has collected victim organization information including but not limited to organization hierarchy, functions, press releases, and others.

Tactics: TA0043
Techniques: T1591
Input: To establish persistence, SslMM identifies the Start Menu Startup directory and drops a link to its own executable disguised as an "Office Start," "Yahoo Talk," "MSN Gaming Z0ne," or "MSN Talk" shortcut.

Tactics: TA0003, TA0004, TA0005
Techniques: T1547.009, T1036.005, T1547.001, T1036, T1547
Input: The payload (abbad7acd…) is an executable that appears to have been created by a VBScript to Executable tool and further obfuscated with a cryptor

Tactics: TA0005
Techniques: T1027
Input: Cobalt Strike can query shared drives on the local system.

Tactics: TA0007
Techniques: T1135
Input: Comnie uses the net user command.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Lazarus Group has used nmap from a router VM to scan ports on systems within the restricted segment of an enterprise network.

Tactics: TA0007
Techniques: T1046
Input: POWRUNER may collect information about the currently logged in user by running whoami on a victim.

Tactics: TA0007
Techniques: T1033
Input: Cobalt Group has executed JavaScript scriptlets on the victim's machine.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: APT1 hijacked FQDNs associated with legitimate websites hosted by hop points.

Tactics: TA0042
Techniques: T1584.001, T1584
Input: FIN6 used PowerShell to execute an encoded command

Tactics: TA0002
Techniques: T1059.001, T1059
Input: However, an adversary may hijack the syscall interface code stubs mapped into a process from the vdso shared object to execute syscalls to open and map a malicious shared object.

Tactics: TA0004, TA0005
Techniques: T1055.014, T1055
Input: Monitor processes for those that may be used to modify binary headers.

Tactics: TA0003, TA0004
Techniques: T1546.006, T1546
Input: MuddyWater has controlled POWERSTATS from behind a proxy network to obfuscate the C2 location.

Tactics: TA0011
Techniques: T1090, T1090.002
Input: Vulnerabilities may exist, usually in operating system components and software commonly running at higher permissions, that can be exploited to gain higher levels of access on the system.

Tactics: TA0004
Techniques: T1068
Input: Monitor application logs for changes to settings and other events associated with network protocols and other services commonly abused for AiTM.

Tactics: TA0006, TA0009
Techniques: T1557
Input: NanoCore can capture audio feeds from the system.

Tactics: TA0009
Techniques: T1123
Input: Sliver has the ability to support C2 communications over HTTP/S.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Adversaries may search DNS data to gather actionable information.

Tactics: TA0043
Techniques: T1596, T1596.001
Input: StoneDrill has used the WMI command-line (WMIC) utility to run tasks.

Tactics: TA0002
Techniques: T1047
Input: Metamorfo has used raw TCP for C2.

Tactics: TA0011
Techniques: T1095
Input: Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware or unusual data transfer over known protocols like FTP can be used to mitigate activity at the network level.

Tactics: TA0011
Techniques: T1105
Input: For example, in Windows 10 and Windows Server 2016 and above, Windows Defender Application Control (WDAC) policy rules may be applied to block the mshta.exe application and to prevent abuse.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: FIVEHANDS can use WMI to delete files on a  target machine.

Tactics: TA0002
Techniques: T1047
Input: Aquatic Panda has encoded commands in Base64.

Tactics: TA0005
Techniques: T1027
Input: Cannon uses SMTP/S and POP3/S for C2 communications by sending and receiving emails.

Tactics: TA0011
Techniques: T1071, T1071.003
Input: WIRTE has used VBScript  in its operations.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Adversaries use these types of proxies to manage command and control communications, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths to avoid suspicion.

Tactics: TA0011
Techniques: T1090, T1090.002
Input: Ensure password complexity and uniqueness such that the passwords cannot be cracked or guessed.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Comnie executes VBS scripts.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: LiteDuke can create persistence by adding a shortcut in the CurrentVersion\Run Registry key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: File Modification

Tactics: TA0005
Techniques: T1600
Input: This differs from Steal Application Access Token and other similar behaviors in that the tokens are new and forged by the adversary, rather than stolen or intercepted from legitimate users.

Tactics: TA0006
Techniques: T1606, T1606.002
Input: APT1 has sent spearphishing emails containing hyperlinks to malicious files.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Adversaries may attempt to find local system groups and permission settings.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: Hashes For a list of all hashes of malware encountered during this campaign, please refer to the following file

Tactics: TA0007
Techniques: T1083
Input: zwShell can modify the Registry.

Tactics: TA0005
Techniques: T1112
Input: Adversaries may continue with an operation, assuming that individual events like an anti-virus detect will not be investigated or that an analyst will not be able to conclusively link that event to other activity occurring on the network.

Tactics: TA0005
Techniques: T1027, T1027.005
Input: Windshift has used compromised websites to register custom URL schemes on a remote system.

Tactics: TA0001
Techniques: T1189
Input: Mimikatz contains functionality to acquire credentials from the Windows Credential Manager.

Tactics: TA0006
Techniques: T1555, T1555.004
Input: APT29 used Kerberos ticket attacks for lateral movement.

Tactics: TA0005, TA0008
Techniques: T1550.003, T1550
Input: Detection efforts may be focused on other phases of the adversary lifecycle, such as Drive-by Compromise or Exploitation for Client Execution.

Tactics: TA0042
Techniques: T1608.004, T1608
Input: APT12 has sent emails with malicious Microsoft Office documents and PDFs attached.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Monitor for newly constructed network connections that may attempt to exfiltrate data over a different network medium than the command and control channel.

Tactics: TA0010
Techniques: T1011
Input: Monitor and analyze traffic patterns and packet inspection associated to protocol(s), leveraging SSL/TLS inspection for encrypted traffic, that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure).

Tactics: TA0043, TA0042, TA0003, TA0008, TA0011, TA0040
Techniques: T1499, T1586.001, T1499.003, T1071.002, T1071, T1563, T1071.003, T1505, T1001.001, T1598, T1001, T1598.003, T1071.001, T1001.003, T1586, T1001.002
Input: Kimsuky has placed scripts in the startup folder for persistence and modified the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce Registry key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: An adversary may target the systems of those known to conduct vulnerability research (including commercial vendors).

Tactics: TA0042
Techniques: T1588.006, T1588
Input: Dragonfly has used batch scripts to enumerate administrators and users in the domain.

Tactics: TA0007
Techniques: T1069.002, T1069
Input: TinyTurla can upload files from a compromised host.

Tactics: TA0009
Techniques: T1005
Input: Adversaries will likely need to place new binaries in locations to be executed through this weakness.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.007, T1574.008, T1574.009, T1574
Input: Kazuar can delete files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Winnti for Windows can delete the DLLs for its various components from a compromised host.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: BlackTech has used the SNScan tool to find other potential targets on victim networks.

Tactics: TA0007
Techniques: T1046
Input: Cracked hashes may enable Persistence, Privilege Escalation, and Lateral Movement via access to Valid Accounts.

Tactics: TA0006
Techniques: T1558.003, T1558, T1558.004
Input: A port monitor can be set through the AddMonitor API call to set a DLL to be loaded at startup.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.010
Input: Adversaries may use also third party utilities, such as 7-Zip, WinRAR, and WinZip, to perform similar activities.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Crimson contains a command to collect the victim PC name, disk drive information, and operating system.

Tactics: TA0007
Techniques: T1082
Input: Cannon can collect the current time zone information from the victim’s machine.

Tactics: TA0007
Techniques: T1124
Input: Octopus has uploaded stolen files and data from a victim's machine over its C2 channel.

Tactics: TA0010
Techniques: T1041
Input: POWERTON has used HTTP/HTTPS for C2 traffic.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Prikormka contains a keylogger module that collects keystrokes and the titles of foreground windows.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Figure 4 – Backdoored authentication function in SSH server As you can see in Figure 4, this version of Dropbear SSH will authenticate the user if the password passDs5Bu9Te7 was entered

Tactics: TA0008
Techniques: T1021
Input: Cobalt Strike can produce a sessions report from compromised hosts.

Tactics: TA0007
Techniques: T1049
Input: The value is derived using the IOService to access the IOPlatformUUID property, which is equivalent to the “Hardware UUID” listed in the system information application, as seen in the Figure 3 screenshot of our analysis system

Tactics: TA0007
Techniques: T1082
Input: Consider modifying SAML responses to include custom elements for each service provider.

Tactics: TA0006
Techniques: T1606, T1606.002
Input: WarzoneRAT has the capability to act as a reverse proxy.

Tactics: TA0011
Techniques: T1090
Input: njRAT can access the victim's webcam.

Tactics: TA0009
Techniques: T1125
Input: BackConfig has used a custom routine to decrypt strings.

Tactics: TA0005
Techniques: T1140
Input: Also enable application control solutions such as AppLocker and/or Device Guard to block the loading of malicious content.

Tactics: TA0005
Techniques: T1553
Input: Limit service accounts to minimal required privileges, including membership in privileged groups such as Domain Administrators.

Tactics: TA0006
Techniques: T1558.003, T1558.002, T1558
Input: Crimson can capture webcam video on targeted systems.

Tactics: TA0009
Techniques: T1125
Input: QakBot can use large file sizes to evade detection.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: Clean up SID-History attributes after legitimate account migration is complete.

Tactics: TA0004, TA0005
Techniques: T1134.005, T1134
Input: HermeticWiper can initiate a system shutdown.

Tactics: TA0040
Techniques: T1529
Input: MSSQL (1433/TCP)

Tactics: TA0006
Techniques: T1110.004, T1110, T1110.001, T1110.003
Input: Monitor file access on removable media that may attempt to exfiltrate data via a physical medium, such as a removable drive.

Tactics: TA0010
Techniques: T1052
Input: BLUELIGHT can harvest cookies from Internet Explorer, Edge, Chrome, and Naver Whale browsers.

Tactics: TA0006
Techniques: T1539
Input: BADFLICK has searched for files on the infected host.

Tactics: TA0007
Techniques: T1083
Input: Filename SHA256 Description   7za.exe dd6d7af00ef4ca89a319a230cdd094275c3a1d365807fe5b34133324bdaa0229 7-Zip 17.01 beta   hb.exe 3ca3a957c526eaeabcf17b0b2cd345c0fffab549adfdf04470b6983b87f7ec62 Hobocopy   nbt.exe c9d5dc956841e000bfd8762e2f0b48b66c79b79500e894b4efa7fb9ba17e4e9e nbtscan 1.0.35   rx.exe a6a0fbfee08367046d3d26fb4b4cf7779f7fb6eaf7e60e1d9b6bf31c5be5b63e IntelliAdmin Remote Execute v1.0   tardigrade.exe fe1b011fe089969d960d2dce2a61020725a02e15dbc812ee6b6ecc6a98875392 Tardigrade application

Tactics: TA0005
Techniques: T1036
Input: Turla has used IronPython scripts as part of the IronNetInjector toolchain to drop payloads.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Network intrusion detection and prevention systems that use network signatures may be able to prevent traffic to remote access services.

Tactics: TA0011
Techniques: T1219
Input: This technique can also execute local/remote scripts and, similar to its Regsvr32/ "Squiblydoo" counterpart, leverages a trusted, built-in Windows tool.

Tactics: TA0005
Techniques: T1220
Input: Offset Description   0x0 Victim GUID (8C8CEED9-4326-448B-919E-249EEC0238A3)   0x25 Victim IP Address (192.168.180.154)   0x45 Command (0x66660001)   0x49 Length of payload (0x2f – 47)   0x4d Field 1 – Windows major version (0x6 – Windows Vista+)   0x51 Field 2 – Windows minor version (0x1 – Windows 7)   0x55 Field 3 – Unknown (0x20)   0x59 Payload (default flag:4/2/2018 1:01:33 AM)    Table 5 – Beacon structure for PLAINTEE

Tactics: TA0007
Techniques: T1010
Input: Monitor for changes made to scheduled jobs that may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

Tactics: TA0005
Techniques: T1036
Input: CopyKittens uses ZPP, a .NET console program, to compress files with ZIP.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Turla has also used net group "Domain Computers" /domain, net group "Domain Controllers" /domain, and net group "Exchange Servers" /domain to enumerate domain computers, including the organization's DC and Exchange Server.

Tactics: TA0007
Techniques: T1018
Input: APT32 has used cmd.exe for execution.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Detecting the use of guardrails may be difficult depending on the implementation.

Tactics: TA0005
Techniques: T1480
Input: FTP (21/TCP)

Tactics: TA0006
Techniques: T1110.004, T1110, T1110.001, T1110.003
Input: Ryuk has used Wake-on-Lan to power on turned off systems for lateral movement.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205
Input: APT33 has used SniffPass to collect credentials by sniffing network traffic.

Tactics: TA0006, TA0007
Techniques: T1040
Input: The de facto standard across cloud service providers is to host the Instance Metadata API at http[:]//169.254.169.254.

Tactics: TA0006
Techniques: T1552, T1552.005
Input: It also does not protect against all forms of credential dumping.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: FatDuke can call ShellExecuteW to open the default browser on the URL localhost.

Tactics: TA0002
Techniques: T1106
Input: NBTscan can list NetBIOS computer names.

Tactics: TA0007
Techniques: T1018
Input: Micropsia can perform a recursive directory listing for all volume drives available on the victim's machine and can also fetch specific files by their paths.

Tactics: TA0007
Techniques: T1083
Input: Monitor for suspicious sequences of events, such as the mounting of a snapshot to a new instance by a new or unexpected user.

Tactics: TA0005
Techniques: T1578
Input: MiniDuke can use control flow flattening to obscure code.

Tactics: TA0005
Techniques: T1027
Input: Enabled features, such as Protected Process Light (PPL), for LSA.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.001
Input: Once the system is powered on, it may become a target for lateral movement.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205
Input: Dragonfly has injected SMB URLs into malicious Word spearphishing attachments to initiate Forced Authentication.

Tactics: TA0005
Techniques: T1221
Input: REvil has the capability to destroy files and folders.

Tactics: TA0040
Techniques: T1485
Input: The return traffic may occur in a variety of ways, depending on the Web service being utilized.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: Lazarus Group has compressed exfiltrated data with RAR and used RomeoDelta malware to archive specified directories in .zip format, encrypt the .zip file, and upload it to C2.

Tactics: TA0009
Techniques: T1560
Input: Update software regularly by employing patch management for internal enterprise endpoints and servers.

Tactics: TA0004, TA0005, TA0008
Techniques: T1210, T1211, T1068
Input: Modifications to this DLL could be done to execute arbitrary payloads (while also potentially preserving normal termsrv.dll functionality) as well as to simply enable abusable features of Terminal Services.

Tactics: TA0003
Techniques: T1505.005, T1505
Input: Various utilities and commands may acquire this information, including whoami.

Tactics: TA0007
Techniques: T1033
Input: NanHaiShu can gather information about the victim proxy server.

Tactics: TA0007
Techniques: T1016
Input: Monitor for changes made to files that may use hidden windows to conceal malicious activity from the plain sight of users.

Tactics: TA0005
Techniques: T1564.003, T1564