madox81/Adema_ATTACK_DS huggingface dataset:
Input: Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.

Tactics: TA0011
Techniques: T1102.001, T1102.002, T1102.003, T1102
Input: AppleSeed has the ability to create the Registry key name EstsoftAutoUpdate at HKLU\Software\Microsoft/Windows\CurrentVersion\RunOnce to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Stuxnet propagates using the MS10-061 Print Spooler and MS08-067 Windows Server Service vulnerabilities.

Tactics: TA0008
Techniques: T1210
Input: Fysbis has the ability to search for files.

Tactics: TA0007
Techniques: T1083
Input: APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: CSPY Downloader has been delivered via malicious documents with embedded macros.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: InvisiMole can sort and collect specific documents as well as generate a list of all files on a newly inserted drive and store them in an encrypted file.

Tactics: TA0009
Techniques: T1119
Input: Egregor's payloads are custom-packed, archived and encrypted to prevent analysis.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: BitPaymer can enumerate existing Windows services on the host that are configured to run as LocalSystem.

Tactics: TA0007
Techniques: T1007
Input: Mustang Panda has encrypted C2 communications with RC4.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: RDAT can exfiltrate data gathered from the infected system via the established Exchange Web Services API C2 channel.

Tactics: TA0010
Techniques: T1041
Input: Every username not listed in at.deny is allowed to invoke at.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: WellMail can identify the IP address of the victim system.

Tactics: TA0007
Techniques: T1016
Input: Gazer can establish persistence by setting the value "Shell" with "explorer.exe, %malware_pathfile%" under the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon.

Tactics: TA0003, TA0004
Techniques: T1547.004, T1547
Input: Particularly investigate irregular patterns of activity (ex: accounts making numerous requests, Event ID 4769, within a small time frame, especially if they also request RC4 encryption [Type 0x17]).

Tactics: TA0006
Techniques: T1558.003, T1558
Input: ThiefQuest uses the function kill_unwanted to obtain a list of running processes and kills each process matching a list of security related processes.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Lastly, the new variant of RogueRobin is capable of using the Google Drive cloud service for its C2 channel, suggesting that DarkHydrus may be shifting to abusing legitimate cloud services for their infrastructure

Tactics: TA0011
Techniques: T1102
Input: Windows API calls such as CreateRemoteThread and those that can be used to modify memory within another process, such as VirtualAllocEx/WriteProcessMemory, may be used for this technique.

Tactics: TA0004, TA0005
Techniques: T1055.002, T1055, T1055.001
Input: Green Lambert has encrypted strings.

Tactics: TA0005
Techniques: T1027
Input: Do not store credentials within the Registry.

Tactics: TA0006
Techniques: T1552, T1552.002
Input: AC,CNAME,MX,TXT,SRV,SOA Uses the regular expression ‘Address:\s+(\d+.\d+.\d+.\d+)’ and uses the decimal value in the first octet of that IPv4 address    Table 1 Breakdown of query types Once the system identifier is obtained, the payload gathers system specific information and sends it to the C2 server

Tactics: TA0007
Techniques: T1082, T1016
Input: The Winnti for Windows dropper can place malicious payloads on targeted systems.

Tactics: TA0011
Techniques: T1105
Input: SDBbot has the ability to use application shimming for persistence if it detects it is running as admin on Windows XP or 7, by creating a shim database to patch services.exe.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: An APT3 downloader establishes SOCKS5 connections for its initial C2.

Tactics: TA0011
Techniques: T1090, T1090.002, T1095
Input: BADNEWS can use multiple C2 channels, including RSS feeds, Github, forums, and blogs.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: Kerrdown has gained execution through victims opening malicious links.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Metasploit’s post exploitation module: post/windows/gather/credentials/gpp

Tactics: TA0006
Techniques: T1552, T1552.006
Input: Dtrack can collect a variety of information from victim machines.

Tactics: TA0009
Techniques: T1005
Input: Trojan.Karagany can detect commonly used and generic virtualization platforms based primarily on drivers and file paths.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Malicious AppCert DLLs may also provide persistence by continuously being triggered by API activity.

Tactics: TA0003, TA0004
Techniques: T1546.009, T1546
Input: Carberp has used user mode rootkit techniques to remain hidden on the system.

Tactics: TA0005
Techniques: T1014
Input: Monitor for executed processes (such as tracert or ping) that may check for Internet connectivity on compromised systems.

Tactics: TA0007
Techniques: T1016.001, T1016
Input: Monitor WMI event subscription entries, comparing current WMI event subscriptions to known good subscriptions for each host.

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: Evilnum has deleted files used during infection.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Consider using the host firewall to restrict file sharing communications such as SMB.

Tactics: TA0008
Techniques: T1021, T1021.002, T1570
Input: Kimsuky has created new services for persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: NETWIRE has used web services including Paste.ee to host payloads.

Tactics: TA0011
Techniques: T1102
Input: Adversaries may perform software packing or virtual machine software protection to conceal their code.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Use of VNC may be legitimate depending on the environment and how it’s used.

Tactics: TA0008
Techniques: T1021.005, T1021
Input: File Indicators Samples Observed from Spear Phishing Messages Above    Filename Chinas_Arctic_Dream.doc   File Size 6587812 bytes   MD5 598eeb6a18233023f3551097aa49b083   SHA1 e9a46966f93fe15c22636a5033c61c725add8fa5   Notes Malicious RTF document that exploits CVE-2017-8570 and drops QuasarRAT file qrat.exe

Tactics: TA0005, TA0007, TA0011
Techniques: T1036, T1090.003, T1083, T1090
Input: NotPetya drops PsExec with the filename dllhost.dat.

Tactics: TA0005
Techniques: T1036
Input: Trojan.Karagany can inject a suspended thread of its own process into a new process and initiate via the ResumeThread API.

Tactics: TA0004, TA0005
Techniques: T1055.003, T1055
Input: Commonly abused command arguments include chmod +x, chmod -R 755, and chmod 777.

Tactics: TA0005
Techniques: T1222.002, T1222
Input: Metamorfo has searched the Program Files directories for specific folders and has searched for strings related to its mutexes.

Tactics: TA0007
Techniques: T1083
Input: Like the ChinaChopper web shell, the OwaAuth web shell requires a password

Tactics: TA0002, TA0003
Techniques: T1505.003, T1505, T1059
Input: On Linux and macOS systems, a variety of utilities also exist, such as curl, scp, sftp, tftp, rsync, finger, and wget.

Tactics: TA0011
Techniques: T1105
Input: Lokibot has tricked recipients into enabling malicious macros by getting victims to click "enable content" in email attachments.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Use the program sxstrace.exe that is included with Windows along with manual inspection to check manifest files for side-loading vulnerabilities in software.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574
Input: Monitor executed commands and arguments that may acquire user credentials from third-party password managers.

Tactics: TA0006
Techniques: T1555.005, T1555
Input: Bisonal has relied on users to execute malicious file attachments delivered via spearphishing emails.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: MCMD can use scheduled tasks for persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: 37 38 zlib64.dll zlib32.dll Open source “zlib” version 1.2.3 used by libpngXX.dll for compressing screenshots (ssXX.dll)

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1055, T1574
Input: [random string]/[random string].

Tactics: TA0005
Techniques: T1564, T1564.001
Input: GrimAgent has the ability to set persistence using the Task Scheduler.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Establishing a persona may require development of additional documentation to make them seem real.

Tactics: TA0042
Techniques: T1585
Input: HTTPBrowser has used DNS for command and control.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Monitor for changes made to command history files, such as ConsoleHost_history.txt, ~/.zsh_history, or ~/.bash_history, for unexpected modifications to contents, access permissions, and attributes.

Tactics: TA0005
Techniques: T1070, T1070.003
Input: Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers.

Tactics: TA0001, TA0003, TA0004, TA0005, TA0006
Techniques: T1003.006, T1003.003, T1003, T1003.002, T1003.004, T1078, T1556, T1078.002, T1556.001, T1003.001, T1003.005
Input: Ajax Security Team has used personalized spearphishing attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Scripts can be run from the command-line via osascript /path/to/script or osascript -e "script here".

Tactics: TA0002
Techniques: T1059.002, T1059
Input: Systemd timers may be activated remotely via the systemctl command line utility, which operates over SSH.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.006, T1053
Input: xCmd can be used to execute binaries on remote systems by creating and starting a service.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Magic Hound has established email accounts using fake personas for spearphishing operations.

Tactics: TA0042
Techniques: T1585, T1585.002
Input: Industroyer uses heavily obfuscated code in its Windows Notepad backdoor.

Tactics: TA0005
Techniques: T1027
Input: If a link is being visited by a user, block unknown or unused files in transit by default that should not be downloaded or by policy from suspicious sites as a best practice to prevent some vectors, such as .scr, .exe, .pif, .cpl,  Some download scanning devices can open and analyze compressed and encrypted formats, such as zip and rar that may be used to conceal malicious files.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: StrongPity can identify the hard disk volume serial number on a compromised host.

Tactics: TA0007
Techniques: T1082
Input: GreyEnergy uses cmd.exe to execute itself in-memory.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: VBShower has attempted to obtain a VBS script from command and control (C2) nodes over HTTP.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Similar to Virtualization/Sandbox Evasion, if the adversary detects a debugger, they may alter their malware to disengage from the victim or conceal the core functions of the implant.

Tactics: TA0005, TA0007
Techniques: T1622
Input: To change the operating system in storage, the adversary will typically use the standard procedures available to device operators.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: ShimRatReporter sent generated reports to the C2 via HTTP POST requests.

Tactics: TA0010
Techniques: T1041
Input: Disk check, forensic utilities, and data from device drivers ( processes and API calls) may reveal anomalies that warrant deeper investigation

Tactics: TA0003, TA0005
Techniques: T1542
Input: Pay2Key can identify the IP and MAC addresses of the compromised host.

Tactics: TA0007
Techniques: T1016
Input: Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.

Tactics: TA0003, TA0004, TA0005
Techniques: T1547.001, T1027.002, T1027, T1547
Input: If infrastructure or patterns in tooling have been previously identified, internet scanning may uncover when an adversary has staged tools to make them accessible for targeting.Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult.

Tactics: TA0042
Techniques: T1608, T1608.002
Input: Cobalt Strike can timestomp any files or payloads placed on a target machine to help them blend in.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: PLEAD has the ability to list processes on the compromised host.

Tactics: TA0007
Techniques: T1057
Input: Caterpillar WebShell has a module to download and upload files to the system.

Tactics: TA0011
Techniques: T1105
Input: Kinsing was run through a deployed Ubuntu container.

Tactics: TA0002, TA0005
Techniques: T1610
Input: This can either be done live in memory during system runtime for immediate effect, or in storage to implement the change on the next boot of the network device.

Tactics: TA0005
Techniques: T1601
Input: APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access.

Tactics: TA0001
Techniques: T1190
Input: POORAIM can conduct file browsing.

Tactics: TA0007
Techniques: T1083
Input: Chimera has obtained and used tools such as BloodHound, Cobalt Strike, Mimikatz, and PsExec.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Taidoor can use TCP for C2 communications.

Tactics: TA0011
Techniques: T1095
Input: Client software enables users to access services provided by a server.

Tactics: TA0003
Techniques: T1554
Input: Microsoft's Enhanced Mitigation Experience Toolkit (EMET) Attack Surface Reduction (ASR) feature can be used to block regsvr32.exe from being used to bypass application control.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Monitor for newly constructed processes and/or command-lines that execute during the boot up process to check for unusual or unknown applications and behavior

Tactics: TA0003, TA0004
Techniques: T1037, T1037.005
Input: Remsec can obtain information about network configuration, including the routing table, ARP cache, and DNS cache.

Tactics: TA0007
Techniques: T1016
Input: WellMess can identify the IP address and user domain on the target machine.

Tactics: TA0007
Techniques: T1016
Input: Donut can generate shellcode outputs that execute via Ruby.

Tactics: TA0002
Techniques: T1059
Input: Several BRONZE BUTLER tools encode data with base64 when posting it to a C2 server.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: PittyTiger attempts to obtain legitimate credentials during operations.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: Cobalt Strike can spawn a job to inject into LSASS memory and dump password hashes.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Adversaries may leverage external-facing remote services to initially access and/or persist within a network.

Tactics: TA0001, TA0003
Techniques: T1133
Input: SUNSPOT decrypts SUNBURST, which was stored in AES128-CBC encrypted blobs.

Tactics: TA0005
Techniques: T1140
Input: APT38 has used web shells for persistence or to ensure redundant access.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Msiexec.exe can also execute DLLs.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: APT29 obtained Ticket Granting Service (TGS) tickets for Active Directory Service Principle Names to crack offline.

Tactics: TA0006
Techniques: T1558.003, T1558
Input: NativeZone has, upon execution, displayed a message box that appears to be related to a Ukrainian electronic document management system.

Tactics: TA0005
Techniques: T1036
Input: BRONZE BUTLER has used RC4 encryption (for Datper malware) and AES (for xxmm malware) to obfuscate HTTP traffic.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Monitor for newly constructed services/daemons that may attempt to hide artifacts associated with their behaviors to evade detection.

Tactics: TA0005
Techniques: T1564
Input: Stuxnet can create registry keys to load driver files.

Tactics: TA0005
Techniques: T1112
Input: FALLCHILL uses fake Transport Layer Security (TLS) to communicate with its C2 server.

Tactics: TA0011
Techniques: T1001, T1001.003
Input: However, it is not as commonly monitored as other Internet Protocols such as TCP or UDP and may be used by adversaries to hide communications.

Tactics: TA0011
Techniques: T1095
Input: APT32 used the netstat -anpo tcp command to display TCP connections on the victim's machine.

Tactics: TA0007
Techniques: T1049
Input: OwaAuth is a Web shell that appears to be exclusively used by Threat Group-3390.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Windshift has used fake personas on social media to engage and target victims.

Tactics: TA0001
Techniques: T1566.003, T1566
Input: One example of this is MS14-068, which targets Kerberos and can be used to forge Kerberos tickets using domain user permissions.

Tactics: TA0006
Techniques: T1212
Input: Ke3chang performs service discovery using net start commands.

Tactics: TA0007
Techniques: T1007
Input: APT28 has routed traffic over Tor and VPN servers to obfuscate their activities.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: Adversaries can use this to their advantage to hide files and folders anywhere on the system and evading a typical user or system analysis that does not incorporate investigation of hidden files.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Fox Kitten has accessed Registry hives ntuser.dat and UserClass.dat.

Tactics: TA0007
Techniques: T1012
Input: Hildegard has used shell scripts for execution.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: Figure 6 Hardcoded Google Drive URL used in RogueRobin sample When the modification_time for the first file changes, the Trojan downloads the contents from the first file uploaded to the Google Drive

Tactics: TA0011
Techniques: T1102
Input: Bundlore has used Python scripts to execute payloads.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: LookBack executes the cmd.exe command.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Application access tokens may function within a limited lifetime, limiting how long an adversary can utilize the stolen token.

Tactics: TA0006
Techniques: T1528
Input: Emotet has been observed encrypting the data it collects before sending it to the C2 server.

Tactics: TA0009
Techniques: T1560
Input: This behavior may also be combined with other tricks (such as Parent PID Spoofing) to manipulate or further evade process-based detections.

Tactics: TA0005
Techniques: T1564.010, T1564
Input: [1] https://www.clearskysec.com/report-the-copykittens-are-targeting-israelis/ [2] https://www.clearskysec.com/copykitten-jpost/

Tactics: TA0011
Techniques: T1071
Input: The generated buffer is encoded using the BASE64 alphabet to be sent in the POST request

Tactics: TA0011
Techniques: T1132
Input: Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.003
Input: Analyzing DLL exports and comparing to runtime arguments may be useful in uncovering obfuscated function calls.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Adversaries may install SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: Asymmetric Cryptography with Web Protocols) or lending credibility to a credential harvesting site.

Tactics: TA0042
Techniques: T1608.003, T1608
Input: Cobalt Strike can use PsExec to execute a payload on a remote host.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: This technique is similar to ROMMONkit and may result in the network device running a modified image.

Tactics: TA0003, TA0005
Techniques: T1542.005, T1542
Input: The Glimpse panel showing three compromised systems To interact with a specific agent, the actor selects the entry to open in the agent control panel

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: BitPaymer can use icacls /reset and takeown /F to reset a targeted executable's permissions and then take ownership.

Tactics: TA0005
Techniques: T1222, T1222.001
Input: Monitor for newly constructed network connections that may attempt to exfiltrate data over Bluetooth rather than the command and control channel.

Tactics: TA0010
Techniques: T1011.001, T1011
Input: QakBot can identify remote systems through the net view command.

Tactics: TA0007
Techniques: T1018
Input: GrimAgent can identify the country code on a compromised host.

Tactics: TA0007
Techniques: T1614
Input: Flame has a module named BeetleJuice that contains Bluetooth functionality that may be used in different ways, including transmitting encoded information from the infected system over the Bluetooth protocol, acting as a Bluetooth beacon, and identifying other Bluetooth devices in the vicinity.

Tactics: TA0010
Techniques: T1011.001, T1011
Input: Sidewinder has exploited vulnerabilities to gain execution including CVE-2017-11882 and CVE-2020-0674.

Tactics: TA0002
Techniques: T1203
Input: This encoded information then gets an additional header added and sent across the network.

Tactics: TA0011
Techniques: T1132
Input: When executed, the .NET Framework wrapper will first check if VMware tools is running in background, this is done via a simple process check, searching for any process named “vmtoolsd.” Provided there are no matching processes running, the malware continues execution, creating a registry entry with the name ‘MSASCuiLTasks’ in HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce for persistence

Tactics: TA0003, TA0004, TA0007
Techniques: T1057, T1547.001, T1547
Input: Use process monitoring to monitor the execution and arguments of msxsl.exe and wmic.exe.

Tactics: TA0005
Techniques: T1220
Input: Monitor for the deployment of suspicious or unknown container images and pods in your environment, particularly containers running as root.

Tactics: TA0004
Techniques: T1611
Input: Hancitor has been delivered via phishing emails with malicious attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: OilRig has run tasklist on a victim's machine.

Tactics: TA0007
Techniques: T1057
Input: The stylecs.aspx webshell provides fairly significant functionality, as its developer wrote this webshell in JScript that ultimately runs any supplied JScript code provided to it within the HTTP request..

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Whitefly has the ability to download additional tools from the C2.

Tactics: TA0011
Techniques: T1105
Input: APT32 has obtained and used tools such as Mimikatz and Cobalt Strike, and a variety of other open-source tools from GitHub.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Keydnap uses a resource fork to present a macOS JPEG or text file icon rather than the executable's icon assigned by the operating system.

Tactics: TA0005
Techniques: T1564, T1564.009
Input: (Source: Dell SecureWorks) As shown in Figure 10, the unpacked JavaScript code reveals an iframe pointing to an IP address that is hosting the exploit

Tactics: TA0007
Techniques: T1016
Input: BlackTech has used spearphishing e-mails with links to cloud services to deliver malware.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: FELIXROOT uses HTTP and HTTPS to communicate with the C2 server.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: DRATzarus can use the GetTickCount and GetSystemTimeAsFileTime API calls to measure function timing.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: SamSam has used garbage code to pad some of its malware components.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: WannaCry encrypts user files and demands that a ransom be paid in Bitcoin to decrypt those files.

Tactics: TA0040
Techniques: T1486