madox81/Adema_ATTACK_DS huggingface dataset:
Input: Specifically, the following GitHub repositories appear to be controlled by the MuddyWater threat actor(s):  [unknown SHA256]  Downloads payload from: hxxps://raw.githubusercontent[.]com/F0R3X/BrowserFontArabic/master/ArabicBrowserFont.exe   [unknown SHA256]  Downloads payload from: hxxps://raw.githubusercontent[.]com/F0R3X/BrowserFontArabic/master/FontArabic.exe     9b5e36bb7518a9e333c31d09b589102f89e3425571dd434820ab3c437dc4e0d9 (and several others)  Downloads payload from: hxxps://raw.githubusercontent[.]com/ReactDeveloper2017/react/master/src/test/test.js    Interestingly, both profiles were populated with forked repositories to give them an air of legitimacy as shown in figure 2

Tactics: TA0005
Techniques: T1027
Input: This build tool encrypts the binary’s strings with a fresh key for each build

Tactics: TA0005
Techniques: T1027
Input: Kazuar uses /bin/bash to execute commands on the victim’s machine.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: Monitor for files viewed in isolation that may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel.

Tactics: TA0010
Techniques: T1048, T1048.001
Input: For example, on Windows systems, encrypted credentials may be obtained from Google Chrome by reading a database file, AppData\Local\Google\Chrome\User Data\Default\Login Data and executing a SQL query: SELECT action_url, username_value, password_value FROM logins;.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: It can bypass UAC through eventvwr.exe and sdclt.exe.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: POWERSTATS can use DDE to execute additional payloads on compromised hosts.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: The tool dumps process memory, then harvests passwords and hashes by looking for text strings and regex patterns for how given applications such as Gnome Keyring, sshd, and Apache use memory to store such authentication artifacts.

Tactics: TA0006
Techniques: T1003, T1003.007
Input: New processes are typically spawned directly from their parent, or calling, process unless explicitly specified.

Tactics: TA0004, TA0005
Techniques: T1134.004, T1134
Input: On Windows 10 and 11, enable Microsoft Vulnerable Driver Blocklist to assist in hardening against third party-developed service drivers.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: NanHaiShu collects the username from the victim.

Tactics: TA0007
Techniques: T1033
Input: Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.

Tactics: TA0007
Techniques: T1069.002, T1069
Input: RATANKBA uses the command reg query "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\InternetSettings".

Tactics: TA0007
Techniques: T1012
Input: Compromised systems may leverage popular websites and social media to host command and control (C2) instructions.

Tactics: TA0011
Techniques: T1102.002, T1102.003, T1102
Input: FIN10 has used stolen credentials to connect remotely to victim networks using VPNs protected with only a single factor.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: KOMPROGO is capable of retrieving information about the infected system.

Tactics: TA0007
Techniques: T1082
Input: Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as Network Sniffing or Transmitted Data Manipulation.

Tactics: TA0006, TA0009
Techniques: T1557
Input: Adversaries may delete their commands from these logs by manually clearing the history (history -c) or deleting the bash history file rm ~/.bash_history.

Tactics: TA0005
Techniques: T1070, T1070.003
Input: Reaver installs itself as a new service.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: GravityRAT uses WMI to check the BIOS and manufacturer information for strings like "VMWare", "Virtual", and "XEN" and another WMI request to get the current temperature of the hardware to determine if it's a virtual machine environment.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Calisto uses the zip -r command to compress the data collected on the local system.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: InvisiMole can remotely activate the victim’s webcam to capture content.

Tactics: TA0009
Techniques: T1125
Input: Such transfers may utilize existing cloud provider APIs and the internal address space of the cloud provider to blend into normal traffic or avoid data transfers over external network interfaces.

Tactics: TA0010
Techniques: T1537
Input: Once identity is established, the token allows actions to be authorized, without passing the actual credentials of the user.

Tactics: TA0005, TA0008
Techniques: T1550.001, T1550
Input: Lazarus Group has studied publicly available information about a targeted organization to tailor spearphishing efforts against specific departments and/or individuals.

Tactics: TA0043
Techniques: T1591
Input: APT28 has used a UEFI (Unified Extensible Firmware Interface) rootkit known as LoJax.

Tactics: TA0005
Techniques: T1014
Input: Transparent Tribe has sent spearphishing e-mails with attachments to deliver malicious payloads.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Limit permissions to discover cloud accounts in accordance with least privilege.

Tactics: TA0007
Techniques: T1087, T1087.004
Input: Monitor for newly executed processes that may create or modify Launch Daemons to execute malicious payloads as part of persistence.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: Additionally, built-in features native to network devices and Network Device CLI may be used.

Tactics: TA0007
Techniques: T1049
Input: Adversaries may delete or modify artifacts generated on a host system to remove evidence of their presence or hinder defenses.

Tactics: TA0005
Techniques: T1070
Input: Ursnif has used encoded data in HTTP URLs for C2.

Tactics: TA0011
Techniques: T1132
Input: gh0st RAT has checked for the existence of a Service key to determine if it has already been installed on the system.

Tactics: TA0007
Techniques: T1012
Input: The discovery modules used with Duqu can collect information on accounts and permissions.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Pteranodon executes functions using rundll32.exe.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Operation Wocao has executed commands through the installed web shell via Tor exit nodes.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: Upon execution, the initialized file downloads multiple malicious payloads from remote servers

Tactics: TA0011
Techniques: T1105
Input: Monitor for unexpected deletion of an active directory object, such as Windows EID 5141.

Tactics: TA0004, TA0005
Techniques: T1484.001, T1484
Input: Example command: certutil -addstore -f -user ROOT ProgramData\cert512121.der.

Tactics: TA0005
Techniques: T1553, T1553.004
Input: OopsIE uses the command prompt to execute commands on the victim's machine.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Monitor for newly constructed files by unusual accounts outside of normal administration duties

Tactics: TA0003, TA0004
Techniques: T1037.003, T1037, T1037.005
Input: Adversaries may search in different closed databases depending on what information they seek to gather.

Tactics: TA0043
Techniques: T1597
Input: Once adversaries have provisioned infrastructure (ex: a server for use in command and control), internet scans may help proactively discover adversary acquired infrastructure.

Tactics: TA0042
Techniques: T1583
Input: Leviathan has used protocol tunneling to further conceal C2 communications and infrastructure.

Tactics: TA0011
Techniques: T1572
Input: Monitor newly created logons and credentials used in events and review for discrepancies.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: Adversaries will create fake social media accounts and message employees for potential job opportunities.

Tactics: TA0001
Techniques: T1566.003, T1566
Input: The group has also used macros to execute payloads.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Turla has used shellcode to download Meterpreter after compromising a victim.

Tactics: TA0011
Techniques: T1105
Input: RDAT has masqueraded as VMware.exe.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Analyze process behavior to determine if a process is performing actions it usually does not and/or do no align with its logged command-line arguments.

Tactics: TA0005
Techniques: T1564.010, T1564
Input: Koadic can obtain the OS version and build, computer name, and processor architecture from a compromised host.

Tactics: TA0007
Techniques: T1082
Input: The data field within the message is a string of custom base64 encoded data that the malware decodes using the same custom base64 routine mentioned earlier and decrypts it using AES and the pre-shared key

Tactics: TA0005, TA0011
Techniques: T1140, T1132, T1573
Input: Wizard Spider has established persistence using Userinit by adding the Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.

Tactics: TA0003, TA0004
Techniques: T1547.004, T1547
Input: EVILNUM can achieve persistence through the Registry Run key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.

Tactics: TA0002
Techniques: T1203
Input: Zeus Panda can hook GetClipboardData function to watch for clipboard pastes to collect.

Tactics: TA0009
Techniques: T1115
Input: If HWP.exe is found running on the system, the malware finds the currently open file in HWP by extracting the file path from the command-line argument passed to HWP.exe This word file (usually named *.hwp) is copied into the temporary file path  C:\DOCUME~1\<username>\LOCALS~1\Temp\2.hwp  hwp is an exact copy of the file loaded into HWP.exe The malware reads the contents of 2.hwp and finds an “MZ magic marker” in the file indicated by the string “JOYBERTM”   Checking for the MZ marker in the HWP file

Tactics: TA0005, TA0009
Techniques: T1070, T1070.006, T1036, T1070.004, T1074
Input: Monitor for changes made to launch agents to repeatedly execute malicious payloads as part of persistence.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: Changes to the Office macro security settings should also be investigated

Tactics: TA0003
Techniques: T1137, T1137.001
Input: Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk.

Tactics: TA0005
Techniques: T1620
Input: Windows allows logon scripts to be run whenever a specific user or group of users log into a system.

Tactics: TA0003, TA0004
Techniques: T1037.001, T1037
Input: TA505 has been seen injecting a DLL into winword.exe.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: A module in CozyCar allows arbitrary commands to be executed by invoking C:\Windows\System32\cmd.exe.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Ramsay can collect data from network drives and stage it for exfiltration.

Tactics: TA0009
Techniques: T1039
Input: APT29 has embedded an ISO file within an HTML attachment that contained JavaScript code to initiate malware execution.

Tactics: TA0005
Techniques: T1027.006, T1027
Input: Commands such as net localgroup of the Net utility, dscl .

Tactics: TA0007
Techniques: T1069.001, T1069
Input: These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.

Tactics: TA0003
Techniques: T1098
Input: IcedID has created a scheduled task that executes every hour to establish persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: APT39 used secure shell (SSH) to move laterally among their targets.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and manipulate backups.

Tactics: TA0040
Techniques: T1565.001, T1565
Input: Koadic can use Rundll32 to execute additional payloads.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may leverage code repositories to collect valuable information.

Tactics: TA0009
Techniques: T1213, T1213.003
Input: The adversaries modify publicly available tools such as ASPXSpy to remove identifying characteristics that network defenders use to identify web shells

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Adversaries may also Upload Malware and have the link target point to malware for download/execution by the user.

Tactics: TA0042
Techniques: T1608.005, T1608
Input: Cobalt Strike can be configured to use TCP, ICMP, and UDP for C2 communications.

Tactics: TA0011
Techniques: T1095
Input: Astaroth logs keystrokes from the victim's machine.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Overwrite a file with all zeros and mark it for deletion on reboot  Wiping files with zeros and marking it for deletion on reboot.   Delete files using the DeleteFile() API Load an arbitrary library into its process space

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Adversaries must first copy code into the target process’ memory space, which can be performed various ways including by directly obtaining a handle to the SysListView32 child of the victim process window (via Windows API calls such as FindWindow and/or EnumWindows) or other Process Injection methods.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.015
Input: If the service is necessary, lock down critical enclaves with separate WinRM infrastructure and follow WinRM best practices on use of host firewalls to restrict WinRM access to allow communication only to/from specific devices.

Tactics: TA0008
Techniques: T1021, T1021.006
Input: Cherry Picker exfiltrates files over FTP.

Tactics: TA0010
Techniques: T1048.003, T1048
Input: /var/log/utmp or /var/log/wtmp: Login records

Tactics: TA0005
Techniques: T1070, T1070.002
Input: ZLib communicates over HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: An APT3 downloader uses the Windows command "cmd.exe" /C whoami to verify that it is running with the elevated privileges of "System."

Tactics: TA0007
Techniques: T1033
Input: If they are not typically used within an environment then execution of them may be suspicious

Tactics: TA0005
Techniques: T1218.005, T1218
Input: APT29 has stolen Chrome browser cookies by copying the Chrome profile directories of targeted users.

Tactics: TA0006
Techniques: T1539
Input: Conti can stop up to 146 Windows services related to security, backup, database, and email solutions through the use of net stop.

Tactics: TA0040
Techniques: T1489
Input: This technique bypasses some multi-factor authentication protocols since the session is already authenticated.

Tactics: TA0005, TA0008
Techniques: T1550.004, T1550
Input: Lazarus Group malware can use a common function to identify target files by their extension, and some also enumerate files and directories, including a Destover-like variant that lists files and gathers information for all drives.

Tactics: TA0007
Techniques: T1083
Input: FIN7 has exploited ZeroLogon (CVE-2020-1472) against vulnerable domain controllers.

Tactics: TA0008
Techniques: T1210
Input: Cyclops Blink has the ability to execute on device startup, using a modified RC script named S51armled.

Tactics: TA0003, TA0004
Techniques: T1037.004, T1037
Input: An adversary may Create Cloud Instance and stage data in that instance.

Tactics: TA0009
Techniques: T1074.002, T1074
Input: Attor has exfiltrated data over the C2 channel.

Tactics: TA0010
Techniques: T1041
Input: Several events will then be logged on scheduled task activity, including: Event ID 106 on Windows 7, Server 2008 R2 - Scheduled task registered; Event ID 4698 on Windows 10, Server 2016 - Scheduled task created;Event ID 4700 on Windows 10, Server 2016 - Scheduled task enabled;Event ID 4701 on Windows 10, Server 2016 - Scheduled task disabled

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Windigo has used a script to gather credentials in files left on disk by OpenSSH backdoors.

Tactics: TA0009
Techniques: T1005
Input: Many DGAs are time-based, generating a different domain for each time period (hourly, daily, monthly, etc).

Tactics: TA0011
Techniques: T1568, T1568.002
Input: APT28 has harvested user's login credentials.

Tactics: TA0043
Techniques: T1589, T1589.001
Input: BadPatch can download and execute or update malware.

Tactics: TA0011
Techniques: T1105
Input: Monitor for API calls that may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

Tactics: TA0007
Techniques: T1082
Input: Siloscape has decrypted the password of the C2 server with a simple byte by byte XOR.

Tactics: TA0005
Techniques: T1140
Input: Remote access tools may be installed and used post-compromise as alternate communications channel for redundant access or as a way to establish an interactive remote desktop session with the target system.

Tactics: TA0011
Techniques: T1219
Input: MoleNet can download additional payloads from the C2.

Tactics: TA0011
Techniques: T1105
Input: Prevent the creation of new network adapters where possible.

Tactics: TA0010
Techniques: T1011.001, T1011
Input: StoneDrill can take screenshots.

Tactics: TA0009
Techniques: T1113
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may abuse Microsoft transport agents to establish persistent access to systems.

Tactics: TA0003
Techniques: T1505.002, T1505
Input: PowerDuke hides many of its backdoor payloads in an alternate data stream (ADS).

Tactics: TA0005
Techniques: T1564, T1564.004
Input: Aria-body has the ability to use a reverse SOCKS proxy module.

Tactics: TA0011
Techniques: T1090
Input: Adversaries may make changes to the operating system of embedded network devices to weaken defenses and provide new capabilities for themselves.

Tactics: TA0005
Techniques: T1601
Input: This method bypasses standard authentication steps that require a cleartext password, moving directly into the portion of the authentication that uses the password hash.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: Ngrok has been used by threat actors to proxy C2 connections to ngrok service subdomains.

Tactics: TA0011
Techniques: T1102
Input: BoxCaon can collect the victim's MAC address by using the GetAdaptersInfo API.

Tactics: TA0007
Techniques: T1016
Input: menuPass has been seen changing malicious files to appear legitimate.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: If infrastructure or patterns in malware have been previously identified, internet scanning may uncover when an adversary has staged malware to make it accessible for targeting.Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult.

Tactics: TA0042
Techniques: T1608.001, T1608
Input: When the operating system is patched in storage, this can be achieved in either the resident storage (typically a form of flash memory, which is non-volatile) or via TFTP Boot.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: SUPERNOVA has masqueraded as a legitimate SolarWinds DLL.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: APT32 used GetPassword_x64 to harvest credentials.

Tactics: TA0006
Techniques: T1003
Input: Lazarus Group has conducted C2 over HTTP and HTTPS.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Once adversaries have provisioned software on a compromised server (ex: for use as a command and control server), internet scans may reveal servers that adversaries have compromised.

Tactics: TA0042
Techniques: T1584.004, T1584
Input: APT29 has conducted widespread scanning of target environments to identify vulnerabilities for exploit.

Tactics: TA0043
Techniques: T1595, T1595.002
Input: In one instance, APT29 created a Filter named BfeOnServiceStartTypeChange (Figure 1), which they configured to execute every Monday, Tuesday, Thursday, Friday, and Saturday at 11:33 am local time.     Figure 1: “BfeOnServiceStartTypeChange” WMI Query Language (WQL) filter condition The BfeOnServiceStartTypeChange Filter was bound to the CommandLineEventConsumer WindowsParentalControlsMigration

Tactics: TA0002
Techniques: T1047
Input: Execution via proc memory injection may also evade detection from security products since the execution is masked under a legitimate process.

Tactics: TA0004, TA0005
Techniques: T1055.009, T1055
Input: This functionality could also be built into remote access tools.

Tactics: TA0009
Techniques: T1119
Input: Seasalt creates a Registry entry to ensure infection after reboot under HKLM\Software\Microsoft\Windows\currentVersion\Run.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Adversaries may use new DLLs to execute this technique.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Newer versions of TrickBot have been known to use a custom communication protocol which sends the data unencrypted over port 443.

Tactics: TA0011
Techniques: T1571
Input: Monitor for newly executed processes that may execute their own malicious payloads by hijacking vulnerable file path references.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.009, T1574
Input: The deletion of a new instance or virtual machine is a common part of operations within many cloud environments.

Tactics: TA0005
Techniques: T1578.003, T1578
Input: ShimRat has installed a Windows service to maintain persistence on victim machines.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Block unknown devices and accessories by endpoint security configuration and monitoring agent.

Tactics: TA0001
Techniques: T1200
Input: Cuba has used cmd.exe /c and batch files for execution.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Silence has been observed making videos of victims to observe bank employees day to day activities.

Tactics: TA0009
Techniques: T1125
Input: VaporRage can use HTTP to download shellcode from compromised websites.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: HyperBro can run shellcode it injects into a newly created process.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Detection of compromised ( LinkById: T1078) in-use by adversaries may help as well.

Tactics: TA0006
Techniques: T1003
Input: Use application control to mitigate installation and use of unapproved virtualization software.

Tactics: TA0005
Techniques: T1564, T1564.006
Input: AppleSeed has the ability to execute its payload via PowerShell.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Legitimate applications (such as Software Deployment Tools and other administrative programs) may utilize Remote Services to access remote hosts.

Tactics: TA0008
Techniques: T1021
Input: Chrommme can decrypt its encrypted internal code.

Tactics: TA0005
Techniques: T1140
Input: The assembly code used to create the shellcode can be obtained from: https://github.com/rapid7/metasploit-framework/blob/master/external/source/shellcode/windows/x86/src/block/block_api.asm https://github.com/rapid7/metasploit-framework/blob/master/external/source/shellcode/windows/x86/src/block/block_reverse_http.asm The purpose of the shellcode is to obtain additional shellcode to execute using an HTTP request to the URL “hxxp://45.76.128[.]165:4443/0w0O6”

Tactics: TA0002, TA0011
Techniques: T1071, T1059
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: POWERSOURCE uses DNS TXT records for C2.

Tactics: TA0011
Techniques: T1071.004, T1071