madox81/Adema_ATTACK_DS huggingface dataset:
Input: Sensitive data can be collected from any removable media (optical disk drive, USB memory, ) connected to the compromised system prior to Exfiltration.

Tactics: TA0009
Techniques: T1025
Input: Industroyer has a data wiper component that enumerates keys in the Registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services.

Tactics: TA0007
Techniques: T1012
Input: Bankshot searches for certain Registry keys to be configured before executing the payload.

Tactics: TA0007
Techniques: T1012
Input: This increases the complexity for an adversary because they need to know an additional password.

Tactics: TA0006
Techniques: T1555.001, T1555
Input: An adversary may delete a cloud instance after they have performed malicious activities in an attempt to evade detection and remove evidence of their presence.

Tactics: TA0005
Techniques: T1578.003, T1578
Input: Some Backdoor.Oldrea samples use standard Base64 + bzip2, and some use standard Base64 + reverse XOR + RSA-2048 to decrypt data received from C2 servers.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: After encryption, Diavol will capture the desktop background window, set the background color to black, and change the desktop wallpaper to a newly created bitmap image with the text "All your files are encrypted!

Tactics: TA0040
Techniques: T1491.001, T1491
Input: Files with invalid code signatures will fail digital signature validation checks, but they may appear more legitimate to users and security tools may improperly handle these files.

Tactics: TA0005
Techniques: T1036, T1036.001
Input: Modifications to or creation of .manifest and .local redirection files that do not correlate with software updates are suspicious.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574
Input: To execute operating system commands through SQL syntax the adversary may have to enable additional functionality, such as xp_cmdshell for MSSQL Server.

Tactics: TA0003
Techniques: T1505.001, T1505
Input: Comnie continues to load an embedded bitmap (BMP) file and decrypt data at offset 0x512

Tactics: TA0005
Techniques: T1140
Input: Bazar can enumerate shared drives on the domain.

Tactics: TA0007
Techniques: T1135
Input: Versions of Babuk have been packed.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: SILENTTRINITY can transfer files from an infected host to the C2 server.

Tactics: TA0010
Techniques: T1041
Input: For detecting system and user scope abuse of the COR_PROFILER variable, monitor the Registry for changes to COR_ENABLE_PROFILING, COR_PROFILER, and COR_PROFILER_PATH that correspond to system and user environment variables that do not correlate to known developer tools.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.012, T1574
Input: Monitor executed commands and arguments that may abuse Microsoft Outlook's Home Page feature to obtain persistence on a compromised system.

Tactics: TA0003
Techniques: T1137, T1137.004
Input: APT29 has used various forms of spearphishing attempting to get a user to click on a malicous link.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: File association selections are stored in the Windows Registry and can be edited by users, administrators, or programs that have Registry access or by administrators using the built-in assoc utility.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.001
Input: menuPass has used net use to conduct connectivity checks to machines.

Tactics: TA0007
Techniques: T1049
Input: Dtrack can collect the RegisteredOwner, RegisteredOrganization, and InstallDate registry values.

Tactics: TA0007
Techniques: T1012
Input: OilRig has used web shells, often to maintain access to a victim network.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Passwords and access keys should be rotated regularly.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078.004, T1078
Input: Once a user logs out, the history is flushed to the user’s .bash_history file.

Tactics: TA0006
Techniques: T1552.003, T1552
Input: Adversaries may abuse the Windows service control manager to execute malicious commands or payloads.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: FLASHFLOOD employs the same encoding scheme as SPACESHIP for data it stages.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: The SPN associated with the Directory Replication Service (DRS) Remote Protocol interface (GUID E3514235–4B06–11D1-AB04–00C04FC2DCD2) can be set without logging.

Tactics: TA0005
Techniques: T1207
Input: TeamTNT has checked for running containers with docker ps and for specific container names with docker inspect.

Tactics: TA0007
Techniques: T1613
Input: Kimsuky has obfuscated binary strings including the use of XOR encryption and Base64 encoding.

Tactics: TA0005
Techniques: T1027
Input: Bazar has manually loaded ntdll from disk in order to identity and remove API hooks set by security products.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Monitor for files being accessed that may search for common password storage locations to obtain user credentials.

Tactics: TA0006
Techniques: T1555
Input: Adversaries may register a malicious transport agent to provide a persistence mechanism in Exchange Server that can be triggered by adversary-specified email events.

Tactics: TA0003
Techniques: T1505.002, T1505
Input: WhisperGate can pause for 20 seconds to bypass antivirus solutions.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Pony has used several Windows functions for various purposes.

Tactics: TA0002
Techniques: T1106
Input: ShadowPad has downloaded code from a C2 server.

Tactics: TA0011
Techniques: T1105
Input: Green Lambert can collect data from a compromised host.

Tactics: TA0009
Techniques: T1005
Input: To decode this information, BADNEWS takes the following steps:  Base64-decode the string Perform the decoding cipher used in previous versions Base64-decode the result Decrypt the result using the Blowfish algorithm and a static key  A script, which is included in the Appendix, will decrypt data from these dead drop resolvers

Tactics: TA0005
Techniques: T1140
Input: POWERSTATS can use JavaScript code for execution.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Protocols such as HTTP and HTTPS that carry web traffic may be very common in environments.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: ShadowPad maintains a configuration block and virtual file system in the Registry.

Tactics: TA0005
Techniques: T1112
Input: Window listings could convey information about how the system is used or give context to information collected by a keylogger.

Tactics: TA0007
Techniques: T1010
Input: Cryptoistic can engage in encrypted communications with C2.

Tactics: TA0011
Techniques: T1573
Input: CoinTicker executes a Python script to download its second stage.

Tactics: TA0002, TA0011
Techniques: T1059.006, T1105, T1059
Input: Adversaries may upload malware to third-party or adversary controlled infrastructure to make it accessible during targeting.

Tactics: TA0042
Techniques: T1608.001, T1608
Input: Some Orz versions have an embedded DLL known as MockDll that uses process hollowing and Regsvr32 to execute another payload.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions.

Tactics: TA0005
Techniques: T1070
Input: Crutch has used the WinRAR utility to compress and encrypt stolen files.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: An APT3 downloader first establishes a SOCKS5 connection to 192.157.198[.]103 using TCP port 1913; once the server response is verified, it then requests a connection to 192.184.60[.]229 on TCP port 81.

Tactics: TA0011
Techniques: T1104
Input: YAHOYAH uses HTTP GET requests to download other files that are executed in memory.

Tactics: TA0011
Techniques: T1105
Input: GuLoader has relied upon users clicking on links to malicious documents.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Remote access tools with built-in features may interact directly with the Windows API to gather information.

Tactics: TA0007, TA0009, TA0040
Techniques: T1007, T1114, T1565.003, T1482, T1565, T1082, T1124, T1114.001, T1565.002
Input: Egregor has used an encoded PowerShell command by a service created by Cobalt Strike for lateral movement.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: WhisperGate can locate files based on hardcoded file extensions.

Tactics: TA0007
Techniques: T1083
Input: Cobalt Group has used HTTPS for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Fysbis has been encrypted using XOR and RC4.

Tactics: TA0005
Techniques: T1027
Input: PlugX also has a module to change service configurations as well as start, control, and delete services.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Kazuar gathers information about network adapters.

Tactics: TA0007
Techniques: T1016
Input: The White Atlas framework often utilized a small Javascript script to execute the malware dropper payload after it was decrypted by the VBA macro code, then to delete the dropper afterwards

Tactics: TA0002, TA0005
Techniques: T1070, T1070.004, T1059
Input: An adversary may use systemd timers to execute malicious code at system startup or on a scheduled basis for persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.006, T1053
Input: FIN7 has also digitally signed their phishing documents, backdoors and other staging tools to bypass security controls.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Its C2 is based on IIS using .asp technology to handle the victims’ HTTP requests

Tactics: TA0011
Techniques: T1071
Input: Minimize permissions and access for service accounts to limit impact of exploitation.

Tactics: TA0008
Techniques: T1210
Input: There are various means to encapsulate a protocol within another protocol.

Tactics: TA0011
Techniques: T1572
Input: The actors also deleted specific Registry keys.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: BlackEnergy has the capability to communicate over a backup channel via plus.google.com.

Tactics: TA0011
Techniques: T1008
Input: ChChes steals credentials stored inside Internet Explorer.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: SynAck clears event logs.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: Adversaries may also be able to silently create subdomains pointed at malicious servers without tipping off the actual owner of the DNS server.

Tactics: TA0042
Techniques: T1584.002, T1584
Input: Physical locations of a target organization may also be exposed to adversaries via online or other accessible data sets (ex: Search Victim-Owned Websites or Social Media).

Tactics: TA0043
Techniques: T1591, T1591.001
Input: By chance encounter, victims may directly download/install these backdoored files via User Execution.

Tactics: TA0042
Techniques: T1608.001, T1608
Input: yty establishes persistence by creating a scheduled task with the command SchTasks /Create /SC DAILY /TN BigData /TR " + path_file + "/ST 09:30".

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Rover automatically collects files from the local system and removable drives based on a predefined list of file extensions on a regular timeframe.

Tactics: TA0009
Techniques: T1119
Input: Monitor for newly constructed processes to match an existing service executables.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.005, T1574
Input: Protect shared folders by minimizing users who have write access.

Tactics: TA0008
Techniques: T1080
Input: GETMAIL extracts emails from archived Outlook .pst files.

Tactics: TA0009
Techniques: T1114, T1114.001
Input: Example network shares include C$, ADMIN$, and IPC$.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Monitor for newly constructed network connections that may use Valid Accounts to remotely control machines using Virtual Network Computing (VNC).

Tactics: TA0008
Techniques: T1021.005, T1021
Input: Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1136, T1078, T1136.002, T1078.002
Input: APT39 has utilized malicious VBS scripts in malware.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: XCSSET uses a malicious browser application to replace the legitimate browser in order to continuously capture credentials, monitor web traffic, and download additional modules.

Tactics: TA0003
Techniques: T1554
Input: It may also be unusual for verclsid.exe to have any child processes or to make network connections or file modifications.

Tactics: TA0005
Techniques: T1218, T1218.012
Input: HAFNIUM has created and granted privileges to domain accounts.

Tactics: TA0003
Techniques: T1136, T1136.002
Input: AppleSeed has the ability to use JavaScript to execute PowerShell.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Ferocious has checked for AV software as part of its persistence process.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: During post-compromise activity, adversaries may utilize servers for various tasks, including for Command and Control.

Tactics: TA0042
Techniques: T1584.004, T1583.004, T1584, T1583
Input: The information may be useful to an adversary attempting to compromise accounts by taking advantage of the tendency for users to use the same passwords across personal and business accounts.

Tactics: TA0006
Techniques: T1110.004, T1110
Input: S-Type may create a temporary user on the system named "Lost_{Unique Identifier}" with the password "pond~!@6"{Unique Identifier}."

Tactics: TA0003
Techniques: T1136, T1136.001
Input: KeyBoy has a command to launch a file browser or explorer on the system.

Tactics: TA0007
Techniques: T1083
Input: Regin contains a keylogger.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Consider using IP allowlisting along with user account management to ensure that data access is restricted not only to valid users but only from expected IP ranges to mitigate the use of stolen credentials to access data.

Tactics: TA0009
Techniques: T1530
Input: The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread (which calls the LoadLibrary API responsible for loading the DLL).

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: MechaFlounder has been downloaded as a file named lsass.exe, which matches the legitimate Windows file.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Adversaries can use accounts created with email providers to further their operations, such as leveraging them to conduct Phishing for Information or Phishing.

Tactics: TA0042
Techniques: T1585, T1585.002
Input: Additionally, detecting failed attempts by a user for a certain object, followed by escalation of privileges by the same user, and access to the same object may be an indication of suspicious activity.

Tactics: TA0007, TA0009
Techniques: T1619, T1530
Input: If running as administrator, TDTESS installs itself as a new service named bmwappushservice to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Green Lambert can add init.d and rc.d files in the /etc folder to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1037.004, T1037
Input: Cloud environments typically utilize restrictive security groups and firewall rules that only allow network activity from trusted IP addresses via expected ports and protocols.

Tactics: TA0005
Techniques: T1562.007, T1562
Input: It is also possible for the user to not be aware of the addition of such an auto-forwarding rule and not suspect that their account has been compromised; email-forwarding rules alone will not affect the normal usage patterns or operations of the email account.

Tactics: TA0009
Techniques: T1114, T1114.003
Input: MCMD can use Registry Run Keys for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Chaes has used a script that extracts the web session cookie and sends it to the C2 server.

Tactics: TA0006
Techniques: T1539
Input: Green Lambert has been disguised as a Growl help file.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: To make detection analysis more challenging, malicious services may also incorporate Masquerade Task or Service (ex: using a service and/or payload name related to a legitimate OS or benign software component).

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: APT28 has changed extensions on files containing exfiltrated data to make them appear benign, and renamed a web shell instance to appear as a legitimate OWA page.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Some of the targeted apps were:    Whatsapp  YouTube Video Downloader  Google Update   Instagram  Hack Wifi   AirDroid   WifiHacker     Facebook   Photoshop   SkyTV     Hotstar  Trump Dash   PokemonGo  With many more to come

Tactics: TA0011
Techniques: T1102
Input: Code signing certificates may be used to bypass security policies that require signed code to execute on a system.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Adversaries may gather the victim's physical location(s) that can be used during targeting.

Tactics: TA0043
Techniques: T1591, T1591.001
Input: These strings have the following format:uuid=[Victim ID]#un=[Username]#cn=[Hostname]#on=[OS Version]#lan=[IP Address]#nop=#ver=1.0uuid=[Victim ID]#un=[Username]#An example of the first string may be seen below:uuid=e29ac6c0-7037-11de-816d-806e6f6e696351c5#un=Josh Grunzweig#cn=WIN-LJLV2NKIOKP#on=mav6miv1#lan=192.168.217.141#nop=#ver=1.0It should be noted that the variables used for this string are different from previous versions

Tactics: TA0007
Techniques: T1033
Input: Proton captures the content of the desktop with the screencapture binary.

Tactics: TA0009
Techniques: T1113
Input: The file names may vary from one version of the malware to another

Tactics: TA0007
Techniques: T1083
Input: Chaes can steal login credentials and stored financial information from the browser.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: WellMail can receive data and executable scripts from C2.

Tactics: TA0011
Techniques: T1105
Input: WhiskeyBravo can be used to overwrite the first 4.9MB of physical drives.

Tactics: TA0040
Techniques: T1561.001, T1561
Input: Remsec harvests plain-text credentials as a password filter registered on domain controllers.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.002, T1556
Input: Adversaries may place a program in an earlier entry in the list of directories stored in the PATH environment variable, which Windows will then execute when it searches sequentially through that PATH listing in search of the binary that was called from a script or the command line.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.007, T1574
Input: Silence can create, delete, or modify a specified Registry key or value.

Tactics: TA0005
Techniques: T1112
Input: Dacls can collect data on running and parent processes.

Tactics: TA0007
Techniques: T1057
Input: Monitor for changes made in cloud environments for events that indicate storage objects have been anomalously modified.

Tactics: TA0040
Techniques: T1486
Input: CookieMiner has loaded coinmining software onto systems to mine for Koto cryptocurrency.

Tactics: TA0040
Techniques: T1496
Input: ThiefQuest prepends a copy of itself to the beginning of an executable file while maintaining the name of the executable.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Adversaries may inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055.003, T1055
Input: Adversaries may access network configuration files to collect sensitive data about the device and the network.

Tactics: TA0009
Techniques: T1602, T1602.002
Input: External connection proxies are used to mask the destination of C2 traffic and are typically implemented with port redirectors.

Tactics: TA0011
Techniques: T1090, T1090.002
Input: tfvn[.]com[.]vnshirkeswitch[.]netguideofgeorgia[.]orggulfclouds[.]sitejhssourcingltd[.]comkamagra4uk[.]compioneerfitting[.]compositronicsindia[.]comscseguros[.]ptspldernet[.]comtoshioco[.]comwww[.]happytohelpyou[.]inIP addressesThe following IP addresses have been observed to be associated with malware campaigns.112.213.89[.]4067.23.254[.]6162.212.33[.]98153.92.5[.]124185.117.22[.]19723.94.188[.]24667.23.254[.]17072.52.150[.]218148.66.136[.]62107.180.24[.]253108.179.246[.]13818.221.35[.]21494.46.15[.]20066.23.237[.]18672.52.150[.]218URLs:The following URLs have been observed to be associated with malware campaigns.https[:]//a[.]pomf[.]cat/http[:]//pomf[.]cat/upload[.]php

Tactics: TA0011
Techniques: T1071
Input: RATANKBA lists the system’s processes.

Tactics: TA0007
Techniques: T1057
Input: CaddyWiper can use DsRoleGetPrimaryDomainInformation to determine the role of the infected machine.

Tactics: TA0007
Techniques: T1082
Input: QakBot can identify the installed antivirus product on a targeted system.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: On Linux and macOS, these command histories can be accessed in a few different ways.

Tactics: TA0005
Techniques: T1070, T1070.003
Input: In an Exchange environment, Administrators can use Get-InboxRule to discover and remove potentially malicious inbox rules.

Tactics: TA0005
Techniques: T1564, T1564.008
Input: Cyclops Blink can use the Linux API if_nameindex to gather network interface names.

Tactics: TA0007
Techniques: T1016
Input: MoonWind has a keylogger.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Microsoft Terminal Services, renamed to Remote Desktop Services in some Windows Server OSs as of 2022, enable remote terminal connections to hosts.

Tactics: TA0003
Techniques: T1505.005, T1505
Input: Load – Create a shared section of memory and load the malicious executable.

Tactics: TA0004, TA0005
Techniques: T1055.013, T1055
Input: Adversaries may inject malicious code into processes via VDSO hijacking in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055.014, T1055
Input: On Linux, local users can also be enumerated through the use of the /etc/passwd file.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: APT28 has compromised targets via strategic web compromise utilizing custom exploit kits.

Tactics: TA0001
Techniques: T1189
Input: DustySky captures PNG screenshots of the main screen.

Tactics: TA0009
Techniques: T1113
Input: OilRig has used Remote Desktop Protocol for lateral movement.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: QakBot can move laterally using worm-like functionality through exploitation of SMB.

Tactics: TA0008
Techniques: T1210
Input: Molerats has delivered compressed executables within ZIP files to victims.

Tactics: TA0005
Techniques: T1027
Input: LightNeuron has used filenames associated with Exchange and Outlook for binary and configuration files, such as winmail.dat.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Users often type usernames and passwords on the command-line as parameters to programs, which then get saved to this file when they log out.

Tactics: TA0006
Techniques: T1552.003, T1552
Input: BADNEWS identifies files with certain extensions from USB devices, then copies them to a predefined directory.

Tactics: TA0007
Techniques: T1083
Input: After Comnie collects the remote C2 information, it will communicate with these remote servers using HTTP requests

Tactics: TA0011
Techniques: T1071
Input: MURKYTOP uses the command-line interface.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: MuddyWater has used a PowerShell backdoor to check for Skype connections on the target machine.

Tactics: TA0007
Techniques: T1049
Input: Monitor processes that start at login for unusual or unknown applications.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.015
Input: Adversaries may leverage these drivers as Rootkits to hide the presence of malicious activity on a system.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: FIN7 used legitimate services like Google Docs, Google Scripts, and Pastebin for C2.

Tactics: TA0011
Techniques: T1102.002, T1102