madox81/Adema_ATTACK_DS huggingface dataset:
Input: Monitor for newly executed processes

Tactics: TA0006, TA0009
Techniques: T1056.002, T1056
Input: MarkiRAT can check for the Telegram installation directory by enumerating the files on disk.

Tactics: TA0007
Techniques: T1518
Input: Stuxnet also uses a 31-byte long static byte string to XOR data sent to command and control servers.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Grandoreiro can block the Deibold Warsaw GAS Tecnologia security tool at the firewall level.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: When dropped onto a second victim, it also enumerates drives connected to the system.

Tactics: TA0007
Techniques: T1120
Input: Turla has used a custom .NET tool to collect documents from an organization's internal central database.

Tactics: TA0009
Techniques: T1213
Input: Frankenstein has used CVE-2017-11882 to execute code on the victim's machine.

Tactics: TA0002
Techniques: T1203
Input: Monitor for events collected that may attempt to find cloud groups and permission settings.

Tactics: TA0007
Techniques: T1069, T1069.003
Input: APT37 has used Python scripts to execute payloads.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Chimera has harvested data from victim's e-mail including through execution of wmic /node: process call create "cmd /c copy c:\Users\\\backup.pst c:\windows\temp\backup.pst" copy "i:\\\My Documents\.pst"copy.

Tactics: TA0009
Techniques: T1114, T1114.001
Input: RTM has the ability to remove Registry entries that it created during execution.

Tactics: TA0005
Techniques: T1070
Input: Penquin can sniff network traffic to look for packets matching specific conditions.

Tactics: TA0006, TA0007
Techniques: T1040
Input: An organization can gather PowerShell execution details in a data analytic platform to supplement it with other data.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Monitor for unusual queries to the cloud provider's storage service.

Tactics: TA0007, TA0009
Techniques: T1619, T1530
Input: Empire includes various modules for enumerating Group Policy.

Tactics: TA0007
Techniques: T1615
Input: Some embedded network device platforms may have the capability to calculate the checksum of the file, while others may not.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: Explosive has leveraged its keylogging capabilities to gain access to administrator accounts on target servers.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Crutch has established persistence with a scheduled task impersonating the Outlook item finder.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Malware samples and infrastructure for hxxp://stemtopx[.]com    Pattern Example   [domain]/work/docnew/[filename]   [domain]/administrator/help/[filename]   [domain]/xe/m/[filename]   [domain]/xe/s/[filename]   [domain]/images/yupsia/exe/[filename]   [domain]/images/yupsia/doc/[filename]    Table 2

Tactics: TA0005, TA0007
Techniques: T1036, T1016
Input: Pony can download additional files onto the infected system.

Tactics: TA0011
Techniques: T1105
Input: Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.

Tactics: TA0006
Techniques: T1539
Input: FIN7 has used application shim databases for persistence.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: VERMIN uses HTTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Russia Ukraine Poland Lithuania Belarus Azerbaijan Kyrgyzstan Kazakhstan Iran Israel Turkey Libya Kuwait Taiwan Vietnam India Croatia Germany Belgium Sweden  Victim profiles point to an expansive interest in ICS:  power generation site owners power facilities construction power generation operators large suppliers and manufacturers of heavy power related materials investors  However, we also noticed that the target list includes government, property holding, and technology organizations as well:  high level government other ICS construction federal land holding agencies municipal offices federal emergency services space and earth measurement and assessment labs national standards body banks high-tech transportation academic research  Victim cases We gained insight into significant BE2 victim profiles over the summer of 2014

Tactics: TA0007, TA0011
Techniques: T1007, T1090.003, T1083, T1090
Input: Winnti for Linux has decoded XOR encoded strings holding its configuration upon execution.

Tactics: TA0005
Techniques: T1140
Input: A dropper used by Putter Panda installs itself into the ASEP Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run with a value named McUpdate.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: The emails had a malicious Excel macro document attached, which when executed led to a new Microsoft Visual Basic (VB) script-based malware family which we are dubbing “BabyShark”

Tactics: TA0001
Techniques: T1566, T1566.001
Input: One of the first steps that several Mosquito installer packages performed after writing and running this local_update js file was to export all local host’s WiFi profiles (settings and passwords) to %APPDATA%\<profile>.xml with a command line call: cmd.exe /c netsh wlan export profile key=clear folder="%APPDATA%" They then gather more network information with a call to ipconfig and arp -a

Tactics: TA0007
Techniques: T1016
Input: Donut code modules use various API functions to load and inject code.

Tactics: TA0002
Techniques: T1106
Input: FoggyWeb can compile and execute source code sent to the compromised AD FS server via a specific HTTP POST.

Tactics: TA0005
Techniques: T1027.004, T1027
Input: Adversaries may create cloud instances in unused geographic service regions in order to evade detection.

Tactics: TA0005
Techniques: T1535
Input: Monitor log files for process execution through command-line and scripting activities.

Tactics: TA0002
Techniques: T1059
Input: TYPEFRAME has used ports 443, 8080, and 8443 with a FakeTLS method.

Tactics: TA0011
Techniques: T1571
Input: Blue Mockingbird has obfuscated the wallet address in the payload binary.

Tactics: TA0005
Techniques: T1027
Input: dsquery can be used to gather information on user accounts within a domain.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: Block SMB traffic from exiting an enterprise network with egress filtering or by blocking TCP ports 139, 445 and UDP port 137.

Tactics: TA0006
Techniques: T1187
Input: Depending on how the infrastructure is provisioned, this could provide persistent access if the infrastructure provisioning tool is instructed to always use the latest image.

Tactics: TA0003
Techniques: T1525
Input: PLEAD has the ability to proxy network communications.

Tactics: TA0011
Techniques: T1090
Input: Winnti for Windows has the ability to encrypt and compress its payload.

Tactics: TA0005
Techniques: T1027
Input: Turian can create a remote shell and execute commands using cmd.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Since msxsl.exe is not installed by default, an adversary will likely need to package it with dropped files.

Tactics: TA0005
Techniques: T1220
Input: RedLeaves can use HTTP over non-standard ports, such as 995, for C2.

Tactics: TA0011
Techniques: T1571
Input: An example of this buffer at runtime is below:   00000000: 43 3A 5C 55 73 65 72 73  5C 4D 53 5C 44 65 73 6B  C:\Users\MS\Desk 00000010: 74 6F 70 5C 52 53 2D 41  54 54 20 56 33 5C 50 6C  top\RS-ATT V3\Pl 00000020: 75 67 69 6E 42 69 6E 00  00 00 00 00 00 00 00 00  uginBin………uginBin……… [TRUNCATED] 00000100: 00 00 00 00 43 3A 5C 55  73 65 72 73 5C 4D 53 5C  ….C:\Users\MS\ 00000110: 44 65 73 6B 74 6F 70 5C  52 53 2D 41 54 54 20 56  Desktop\RS-ATT V 00000120: 33 5C 5A 43 6F 6E 66 69  67 00 00 00 00 00 00 00  3\ZConfig…….ZConfig……

Tactics: TA0007
Techniques: T1033, T1087
Input: In one version of the malware, the code checks if the “ProgramData” folder has folders or files with the keywords “Kasper“, “Panda“, or “ESET“

Tactics: TA0007
Techniques: T1083
Input: Also consider monitoring and alerting on the replication of AD objects (Audit Detailed Directory Service Replication Events 4928 and 4929).

Tactics: TA0005
Techniques: T1207
Input: VERMIN collects keystrokes from the victim machine.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: POWRUNER can use HTTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: In some cases, identifying overlapping characteristics in malware used by different adversaries may point to a shared quartermaster.

Tactics: TA0042
Techniques: T1588, T1588.001
Input: Diavol can receive configuration updates and additional payloads including wscpy.exe from C2.

Tactics: TA0011
Techniques: T1105
Input: BoomBox can search for specific files and directories on a machine.

Tactics: TA0007
Techniques: T1083
Input: Mshta.exe is a utility that executes Microsoft HTML Applications (HTA) files.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: The adversary can then claim that they forgot their password in order to make changes to the domain registration.

Tactics: TA0042
Techniques: T1584.001, T1584
Input: FIN6 used another set of compromised credentials with membership to additional groups in the domain to RDP to other hosts

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Tools such as Systeminfo can be used to gather detailed system information.

Tactics: TA0007
Techniques: T1082
Input: ZxShell has used rundll32.exe to execute other DLLs and named pipes.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Some detection methods require vendor support to aid in investigation.

Tactics: TA0005
Techniques: T1600.001, T1600, T1600.002
Input: The times of day that APT33 threat actors were active suggests that they were operating in a time zone close to 04:30 hours ahead of Coordinated Universal Time (UTC)

Tactics: TA0007
Techniques: T1124
Input: Monitor process API calls to AddMonitor.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.010
Input: Gold Dragon stores information gathered from the endpoint in a file named 1.hwp.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Unlike Invalid Code Signature, this activity will result in a valid signature.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: The LC_LOAD_DYLIB header in a Mach-O binary tells macOS and OS X which dynamic libraries (dylibs) to load during execution time.

Tactics: TA0003, TA0004
Techniques: T1546.006, T1546
Input: QuietSieve can use HTTPS in C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Adversaries may steal data by exfiltrating it over an asymmetrically encrypted network protocol other than that of the existing command and control channel.

Tactics: TA0010
Techniques: T1048.002, T1048
Input: The agent control panel has three tabs that have interfaces that allow the actor to issue commands, as well as upload and download files to and from the agent

Tactics: TA0003, TA0004, TA0011
Techniques: T1543.001, T1105, T1543
Input: Accounts could also be disabled by Group Policy.

Tactics: TA0040
Techniques: T1531
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may modify visual content available internally or externally to an enterprise network.

Tactics: TA0040
Techniques: T1491
Input: TA459 has used PowerShell for execution of a payload.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: NetPass is a free network password recovery tool that, according to its developer Nirsoft, can recover passwords including:  Login passwords of remote computers on LAN

Tactics: TA0006
Techniques: T1003
Input: If the key does not exist, gh0st RAT will create and run the service.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: This field contains a URL that the Trojan will use to upload the contents of the <process ID of Trojan>.txt file, which will be structured as <process ID of Trojan>.<C2 domain> where the process ID is encoded with the same character substitution function as seen previously in Table 4

Tactics: TA0007
Techniques: T1057
Input: Control flow integrity checking is another way to potentially identify and stop a software exploit from occurring.

Tactics: TA0001, TA0002, TA0004, TA0005, TA0008
Techniques: T1189, T1210, T1203, T1211, T1068
Input: BBSRAT can compress data with ZLIB prior to sending it back to the C2 server.

Tactics: TA0009
Techniques: T1560.002, T1560
Input: CookieMiner has used a Unix shell script to run a series of commands targeting macOS.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: BRONZE BUTLER has used VBS and VBE scripts for execution.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: MoonWind obtains the victim IP address.

Tactics: TA0007
Techniques: T1016
Input: BitPaymer has attempted to install itself as a service to maintain persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Catchamas gathers the Mac address, IP address, and the network adapter information from the victim’s machine.

Tactics: TA0007
Techniques: T1016
Input: Olympic Destroyer uses the native Windows utilities vssadmin, wbadmin, and bcdedit to delete and disable operating system recovery features such as the Windows backup catalog and Windows Automatic Repair.

Tactics: TA0040
Techniques: T1490
Input: Monitor for networks that solicits and obtains the configuration information of the queried device.

Tactics: TA0040
Techniques: T1565, T1565.002
Input: email client, Outlook, and Windows Credential Store.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: Audio files may be written to disk and exfiltrated later.

Tactics: TA0009
Techniques: T1123
Input: The simplest, "single-flux" method, involves registering and de-registering an addresses as part of the DNS A (address) record list for a single DNS name.

Tactics: TA0011
Techniques: T1568.001, T1568
Input: Users may edit the system’s SSH config file to modify the directives PubkeyAuthentication and RSAAuthentication to the value "yes" to ensure public key and RSA authentication are enabled.

Tactics: TA0003
Techniques: T1098.004, T1098
Input: HKEY_CURRENT_USER\Software\Microsoft\Office test\Special\Perf

Tactics: TA0003
Techniques: T1137.002, T1137
Input: httpclient uses HTTP for command and control.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Chimera has used legitimate credentials to login to an external VPN, Citrix, SSH, and other remote services.

Tactics: TA0001, TA0003
Techniques: T1133
Input: LazyScripter has lured users to open malicious email attachments.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: iKitten will zip up the /Library/Keychains directory before exfiltrating it.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Pandora can start and inject code into a new svchost process.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Block execution of Regsvcs.exe and Regasm.exe if they are not required for a given system or network to prevent potential misuse by adversaries.

Tactics: TA0005
Techniques: T1218.009, T1218
Input: TrickBot downloads several additional files and saves them to the victim's machine.

Tactics: TA0011
Techniques: T1105
Input: APT37 has created scheduled tasks to run malicious scripts on a compromised host.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: These policies allow administrators to set local accounts.

Tactics: TA0006
Techniques: T1552, T1552.006
Input: CHOPSTICK encrypts C2 communications with TLS.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Turian can scan for removable media to collect data.

Tactics: TA0007
Techniques: T1120
Input: Remsec is capable of deleting files on the victim.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Adversaries can add or insert a path to a malicious script in the com.apple.loginwindow.plist file, using the LoginHook or LogoutHook key-value pair.

Tactics: TA0003, TA0004
Techniques: T1037.002, T1037
Input: Control Panel items, specifically CPL files, may also bypass application and/or file extension allow lists.

Tactics: TA0005
Techniques: T1218, T1218.002
Input: Monitor for changes to windows registry keys or values that may target multi-factor authentication mechanisms, such as smart cards, to gain access to credentials that can be used to access systems, services, and network resources.

Tactics: TA0006
Techniques: T1111
Input: Crimson can add Registry run keys for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Monitor account activity logs to see actions performed and activity associated with the Kubernetes dashboard and other web applications.

Tactics: TA0007
Techniques: T1613
Input: KeyBoy installs a keylogger for intercepting credentials and keystrokes.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Restrict write access to logon scripts to specific administrators.

Tactics: TA0003, TA0004
Techniques: T1037
Input: FIN4 has lured victims to launch malicious attachments delivered via spearphishing emails (often sent from compromised accounts).

Tactics: TA0002
Techniques: T1204.002, T1204
Input: The White Company has sent phishing emails with malicious Microsoft Word attachments to victims.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: PowerDuke has commands to get the current directory name as well as the size of a file.

Tactics: TA0007
Techniques: T1083
Input: BlackTech has used built-in API functions.

Tactics: TA0002
Techniques: T1106
Input: Sandworm Team has used a keylogger to capture keystrokes by using the SetWindowsHookEx function.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Track library metadata, such as a hash, and compare libraries that are loaded at process execution time against previous executions to detect differences that do not correlate with patching or updates.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574
Input: Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports for that particular network segment.

Tactics: TA0011
Techniques: T1571
Input: The malware proceeds to connect to the C2 server at 5.189.145.248 at regular intervals through the use of TCP over port 10500

Tactics: TA0011
Techniques: T1571
Input: FlawedAmmyy has used SEAL encryption during the initial C2 handshake.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: The Windows security identifier (SID) is a unique value that identifies a user or group account.

Tactics: TA0004, TA0005
Techniques: T1134.005, T1134
Input: Emotet is known to use RSA keys for encrypting C2 traffic.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Examples of cloud storage services include Dropbox and Google Docs.

Tactics: TA0010
Techniques: T1567.002, T1567
Input: Empire can capture webcam data on Windows and macOS systems.

Tactics: TA0009
Techniques: T1125
Input: Timestomping may be used along with file name Masquerading to hide malware and tools.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: Babuk can enumerate all services running on a compromised host.

Tactics: TA0007
Techniques: T1007
Input: BLINDINGCAN has modified file and directory timestamps.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: Clambling can capture keystrokes on a compromised host.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: For connections that occur internally within an enclave (such as those between a proxy or pivot node and other nodes), commonly used protocols are SMB, SSH, or RDP.

Tactics: TA0011
Techniques: T1071
Input: Data captured by RawPOS is placed in a temporary file under a directory named "memdump".

Tactics: TA0009
Techniques: T1074.001, T1074
Input: There are several well-known vulnerabilities that exist in common services such as SMB  and RDP  as well as applications that may be used within internal networks such as MySQL  and web server services.

Tactics: TA0008
Techniques: T1210
Input: Static key hardcoded in the Remote Access Subauthentication DLL (RASSFM.DLL)

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.005
Input: OnionDuke can use a custom decryption algorithm to decrypt strings.

Tactics: TA0005
Techniques: T1140
Input: Malicious modifications to the PAM system may also be abused to steal credentials.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.003, T1556
Input: Tropic Trooper has lured victims into executing malware via malicious e-mail attachments.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Developers typically use XPC Services to provide applications stability and privilege separation between the application client and the daemon.

Tactics: TA0002
Techniques: T1559, T1559.003
Input: Environmental keying uses cryptography to constrain execution or actions based on adversary supplied environment specific conditions that are expected to be present on the target.

Tactics: TA0005
Techniques: T1480, T1480.001
Input: Consider monitoring for the presence or loading (ex: Sysmon Event ID 6) of known vulnerable drivers that adversaries may drop and exploit to execute code in kernel mode.

Tactics: TA0004
Techniques: T1068
Input: Adversaries may implant cloud or container images with malicious code to establish persistence after gaining access to an environment.

Tactics: TA0003
Techniques: T1525
Input: Again, a shortcut file is written to the %TEMP% path with a name of ‘~Update.lnk’, which is in turn copied to the identified startup path with a filename of ‘Windows help.lnk’

Tactics: TA0003, TA0004, TA0005
Techniques: T1547.009, T1036, T1547
Input: Adversaries may target user email on local systems to collect sensitive information.

Tactics: TA0009
Techniques: T1114, T1114.001
Input: Threat Group-3390 has detached network shares after exfiltrating files, likely to evade detection.

Tactics: TA0005
Techniques: T1070, T1070.005
Input: Ferocious can run GET.WORKSPACE in Microsoft Excel to check if a mouse is present.

Tactics: TA0007
Techniques: T1120
Input: Monitor for newly constructed processes with command-lines that create/modify or are executed from tasks.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: Ferocious can use COM hijacking to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1546.015, T1546
Input: REvil can mimic the names of known executables.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Monitor for contextual data about a malicious payload, such as compilation times, file hashes, as well as watermarks or other identifiable configuration information.

Tactics: TA0042
Techniques: T1588, T1587, T1588.001, T1587.001, T1588.002
Input: QuietSieve can search files on the target host by extension, including doc, docx, xls, rtf, odt, txt, jpg, pdf, rar, zip, and 7z.

Tactics: TA0007
Techniques: T1083
Input: PLATINUM has used various methods of process injection including hot patching.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Tomiris has been packed with UPX.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Information from these scans may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Exploit Public-Facing Application).

Tactics: TA0043
Techniques: T1595, T1595.002
Input: SDBbot has the ability to use the command shell to execute commands on a compromised host.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Dragonfly has created a directory named "out" in the user's %AppData% folder and copied files to it.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: ShimRat has installed a registry based start-up key HKCU\Software\microsoft\windows\CurrentVersion\Run to maintain persistence should other methods fail.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: This flood relies on raw volume to accomplish the objective, exhausting any of the various resources required by the victim software to provide the service.

Tactics: TA0040
Techniques: T1499.002, T1499
Input: A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Egregor can encrypt all non-system files using a hybrid AES-RSA algorithm prior to displaying a ransom note.

Tactics: TA0040
Techniques: T1486