madox81/Adema_ATTACK_DS huggingface dataset:
Input: Following the successful injection of SUNBURST, SUNSPOT deleted a temporary file it created named InventoryManager.bk after restoring the original SolarWinds Orion source code to the software library.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Carbon uses the net group command.

Tactics: TA0007
Techniques: T1069
Input: Rocke has deleted files on infected machines.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Adversaries may search freely available websites and/or domains for information about victims that can be used during targeting.

Tactics: TA0043
Techniques: T1593
Input: Depending on flood volume, on-premises filtering may be possible by blocking source addresses sourcing the attack, blocking ports that are being targeted, or blocking protocols being used for transport.

Tactics: TA0040
Techniques: T1498
Input: PoetRAT has used a .NET tool named dog.exe to exiltrate information over an e-mail account.

Tactics: TA0010
Techniques: T1048
Input: Adversaries may compromise third-party infrastructure that can be used during targeting.

Tactics: TA0042
Techniques: T1584
Input: Zebrocy stores all collected information in a single file before exfiltration.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: The SQLRat script is designed to make a direct SQL connection to a Microsoft database controlled by the attackers and execute the contents of various tables

Tactics: TA0011
Techniques: T1105
Input: These scans may also include more broad attempts to Gather Victim Host Information that can be used to identify more commonly known, exploitable vulnerabilities.

Tactics: TA0043
Techniques: T1595, T1595.002
Input: APT29 has registered algorithmically generated Twitter handles that are used for C2 by malware, such as HAMMERTOSS.

Tactics: TA0042
Techniques: T1583.006, T1583
Input: Staging web resources necessary to conduct Drive-by Compromise when a user browses to a site.

Tactics: TA0042
Techniques: T1608
Input: Adversaries may modify the SSH authorized_keys file to maintain persistence on a victim host.

Tactics: TA0003
Techniques: T1098.004, T1098
Input: Limit the usage of local administrator accounts to be used for day-to-day operations that may expose them to potential adversaries.

Tactics: TA0003
Techniques: T1136, T1136.001
Input: Monitor for changes to login hook files (/Library/Preferences/com.apple.loginwindow.plist), especially by unusual accounts outside of normal administration duties.

Tactics: TA0003, TA0004
Techniques: T1037.002, T1037
Input: However, kexts are still allowed as "Legacy System Extensions" since there is no System Extension for Kernel Programming Interfaces.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: The weakness in the system can be a bug, a glitch, or a design vulnerability.

Tactics: TA0001
Techniques: T1190
Input: DOGCALL is encrypted using single-byte XOR.

Tactics: TA0005
Techniques: T1027
Input: TeamTNT executed Hildegard through the kubelet API run command and by executing commands on running containers.

Tactics: TA0002
Techniques: T1609
Input: Kinsing has downloaded additional lateral movement scripts from C2.

Tactics: TA0011
Techniques: T1105
Input: ServHelper contains modules that will use schtasks to carry out malicious operations.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Turla surveys a system upon check-in to discover active local network connections using the netstat -an, net use, net file, and net session commands.

Tactics: TA0007
Techniques: T1049
Input: When the device is inserted into another system, it opens autorun.inf and loads the malware.

Tactics: TA0001, TA0008
Techniques: T1091
Input: Adversaries may obtain capabilities to support their operations throughout numerous phases of the adversary lifecycle.

Tactics: TA0042
Techniques: T1588
Input: The COR_PROFILER can also be used to elevate privileges (ex: Bypass User Account Control) if the victim .NET process executes at a higher permission level, as well as to hook and Impair Defenses provided by .NET processes.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.012, T1574
Input: The C2 server used by XTunnel provides a port number to the victim to use as a fallback in case the connection closes on the currently used port.

Tactics: TA0011
Techniques: T1008
Input: zwShell has used RDP for lateral movement.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Common credential dumpers such as Mimikatz access the LSA Subsystem Service (LSASS) process by opening the process, locating the LSA secrets key, and decrypting the sections in memory where credential details are stored.

Tactics: TA0006, TA0007
Techniques: T1033, T1003
Input: Disk check, forensic utilities, and data from device drivers ( API calls) may reveal anomalies that warrant deeper investigation.

Tactics: TA0003, TA0005
Techniques: T1542
Input: RawDisk was used in Shamoon to help overwrite components of disk structure like the MBR and disk partitions.

Tactics: TA0040
Techniques: T1561, T1561.002
Input: IcedID can inject itself into a suspended msiexec.exe process to send beacons to C2 while appearing as a normal msi application.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: SDBbot has the ability to record video on a compromised host.

Tactics: TA0009
Techniques: T1125
Input: Preemptively search for files containing passwords or other credentials and take actions to reduce the exposure risk when found.

Tactics: TA0006
Techniques: T1552
Input: Cobalt Strike can execute a payload on a remote host with PowerShell.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Monitor for changes made to AD settings for unexpected modifications to user accounts, such as deletions or potentially malicious changes to user attributes (credentials, status, ).

Tactics: TA0004, TA0005, TA0040
Techniques: T1484.001, T1484, T1531
Input: Limit access to the root account and prevent users from loading kernel modules and extensions through proper privilege separation and limiting Privilege Escalation opportunities.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: Lack of log events may be suspicious.

Tactics: TA0005
Techniques: T1562
Input: Anti-virus can potentially detect malicious documents and attachments as they're scanned to be stored on the email server or on the user's computer.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: This technique does not write any data to disk.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Xbash can execute malicious VBScript payloads on the victim’s machine.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: During the past few months, APT34 has been able to quickly incorporate exploits for at least two publicly vulnerabilities (CVE-2017-0199 and CVE-2017-11882) to target organizations in the Middle East

Tactics: TA0002, TA0004
Techniques: T1203, T1068
Input: Frankenstein has enumerated hosts via Empire, gathering various local system information.

Tactics: TA0009
Techniques: T1005
Input: OwaAuth — This web shell and credential stealer deployed to Microsoft Exchange servers is installed as an ISAPI filter

Tactics: TA0003
Techniques: T1505.003, T1505
Input: USBStealer sets the timestamps of its dropper files to the last-access and last-write timestamps of a standard Windows library chosen on the system.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: Attacker deception and attribution The deobfuscated PowerShell code used by the MuddyWater group resembles previously seen PowerShell scripts that most likely served as prototypes

Tactics: TA0002
Techniques: T1059.001, T1059
Input: PLATINUM has sometimes used drive-by attacks against vulnerable browser plugins.

Tactics: TA0001
Techniques: T1189
Input: HAFNIUM gathered the fully qualified domain names (FQDNs) for targeted Exchange servers in the victim's environment.

Tactics: TA0043
Techniques: T1590
Input: Gazer logs its actions into files that are encrypted with 3DES.

Tactics: TA0005
Techniques: T1027
Input: These vulnerabilities were patched last December 28 2015, April 5, 2016, and May 12, 2016, respectively

Tactics: TA0004
Techniques: T1068
Input: Unix shells are the primary command prompt on Linux and macOS systems, though many variations of the Unix shell exist ( sh, bash, zsh, ) depending on the specific OS or distribution.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: Micropsia creates a RAR archive based on collected files on the victim's machine.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: BRONZE BUTLER has used a Windows 10 specific tool and xxmm to bypass UAC for privilege escalation.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Monitor for events associated with VB execution, such as Office applications spawning processes, usage of the Windows Script Host (typically cscript.exe or wscript.exe).

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Detection efforts may be focused on behaviors relating to the use of exploits ( Exploit Public-Facing Application, Exploitation for Client Execution, Exploitation for Privilege Escalation, Exploitation for Defense Evasion, Exploitation for Credential Access, Exploitation of Remote Services, and Application or System Exploitation).

Tactics: TA0042
Techniques: T1588, T1587, T1587.004, T1588.005
Input: Gamaredon Group's malware can take screenshots of the compromised computer every minute.

Tactics: TA0009
Techniques: T1113
Input: MESSAGETAP uses the libpcap library to listen to all traffic and parses network protocols starting with Ethernet and IP layers.

Tactics: TA0006, TA0007
Techniques: T1040
Input: DustySky extracts basic information about the operating system.

Tactics: TA0007
Techniques: T1082
Input: Turla RPC backdoors have also enumerated the IPv4 TCP connection table via the GetTcpTable2 API call.

Tactics: TA0007
Techniques: T1049
Input: FlawedAmmyy has used HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Pupy uses a keylogger to capture keystrokes it then sends back to the server after it is stopped.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: FoggyWeb can remotely exfiltrate sensitive information from a compromised AD FS server.

Tactics: TA0010
Techniques: T1041
Input: APT30 may have used the SHIPSHAPE malware to move onto air-gapped networks.

Tactics: TA0001, TA0008
Techniques: T1091
Input: ShimRatReporter used LZ compression to compress initial reconnaissance reports before sending to the C2.

Tactics: TA0009
Techniques: T1560
Input: ThreatNeedle can collect data and files from a compromised host.

Tactics: TA0009
Techniques: T1005
Input: Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, Google, ).

Tactics: TA0042
Techniques: T1586
Input: Consider monitoring for modifications to system configuration files involved in shaping network traffic flow.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.003
Input: LaZagne can obtain credentials from chats, databases, mail, and WiFi.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: Encrypted Configuration in shellcode The configuration information for the malware, including the C2 information are encrypted in the first shellcode blob and are passed as an argument to the DllMain function of the main PlugX DLL

Tactics: TA0005, TA0007
Techniques: T1140, T1027, T1082
Input: JHUHUGIT has registered itself as a service to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Many strings in JHUHUGIT are obfuscated with a XOR algorithm.

Tactics: TA0005
Techniques: T1027
Input: Consider disabling external email forwarding.

Tactics: TA0009
Techniques: T1114, T1114.003
Input: Cobalt Strike can exploit Oracle Java vulnerabilities for execution, including CVE-2011-3544, CVE-2013-2465, CVE-2012-4681, and CVE-2013-2460.

Tactics: TA0002
Techniques: T1203
Input: Helminth encrypts data sent to its C2 server over HTTP with RC4.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Suspicious systemd services can also be identified by comparing results against a trusted system baseline.

Tactics: TA0003, TA0004
Techniques: T1543.002, T1543
Input: Monitor for suspicious network traffic that could be indicative of probing for user information, such as large/iterative quantities of authentication requests originating from a single source (especially if the source is known to be associated with an adversary/botnet).

Tactics: TA0043
Techniques: T1589
Input: StrongPity can install a service to execute itself as a service.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: This can be can be configured through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Increase scheduling priority.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053
Input: Caterpillar WebShell has a module to gather information from the compromrised asset, including the computer version, computer name, IIS version, and more.

Tactics: TA0007
Techniques: T1082
Input: Information about the hardware infrastructure may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices).

Tactics: TA0043
Techniques: T1592, T1592.001
Input: Naid collects the domain name from a compromised host.

Tactics: TA0007
Techniques: T1016
Input: Typical web servers and applications only require GET, POST, and HEAD.Where possible, minimize server fingerprinting by configuring web servers to avoid responding with banners identifying the server software and version number.Secure both the operating system and the application.Update and patch production servers regularly.Disable potentially harmful SQL-stored procedure calls.Sanitize and validate input to ensure that it is properly typed and does not contain escaped code.Consider using type-safe stored procedures and prepared statements.Audit transaction logs regularly for suspicious activity.Perform penetration testing on web services.Ensure error messages are generic and do not expose too much information.Permissions, Privileges, and Access ControlsSystem operators should take the following steps to limit permissions, privileges, and access controls.Reduce privileges to only those needed for a user’s duties.Restrict users’ ability (permissions) to install and run unwanted software applications, and apply the principle of “Least Privilege” to all systems and services

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Consider monitoring for excessive use of SendMessage and/or PostMessage API functions with LVM_SETITEMPOSITION and/or LVM_GETITEMPOSITION arguments.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.015
Input: COM is an inter-process communication (IPC) component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.

Tactics: TA0002
Techniques: T1559, T1559.001
Input: Kimsuky has searched for information on the target company's website.

Tactics: TA0043
Techniques: T1594
Input: As with legitimate development efforts, different skill sets may be required for developing exploits.

Tactics: TA0042
Techniques: T1587, T1587.004
Input: Melcoz has the ability to steal credentials from web browsers.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: APT39 has modified and used customized versions of publicly-available tools like PLINK and Mimikatz.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Turla has used net accounts and net accounts /domain to acquire password policy information.

Tactics: TA0007
Techniques: T1201
Input: APT37 has downloaded second stage malware from compromised websites.

Tactics: TA0011
Techniques: T1105
Input: Leviathan has utilized techniques like reflective DLL loading to write a DLL into memory and load a shell that provides backdoor access to the victim.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Wizard Spider has used HTTP for network communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: OSX_OCEANLOTUS.D uses the command xattr -d com.apple.quarantine to remove the quarantine file attribute used by Gatekeeper and Notarization checks.

Tactics: TA0005
Techniques: T1553.001, T1553
Input: Lazarus Group has hosted malicious files on compromised as well as Lazarus Group-controlled servers.

Tactics: TA0042
Techniques: T1608.001, T1608
Input: When performing NAT, the network device will rewrite the source and/or destination addresses of the IP address header.

Tactics: TA0005
Techniques: T1599, T1599.001
Input: Industroyer sends information about hardware profiles and previously-received commands back to the C2 server in a POST-request.

Tactics: TA0010
Techniques: T1041
Input: Ke3chang has dumped credentials, including by using Mimikatz.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: BoomBox has the ability to execute an LDAP query to enumerate the distinguished name, SAM account name, and display name for all domain users.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: Suspicious program execution through scheduled tasks may show up as outlier processes that have not been seen before when compared against historical data.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: Additionally, adversaries may use auditpol and its sub-commands in a command prompt to disable auditing or clear the audit policy.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: Silence has sent emails with malicious DOCX, CHM, LNK and ZIP attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Additionally, system configuration changes (such as the installation of third party package managing software) may cause folders such as usr/local/bin to become globally writeable.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: ShimRatReporter gathered a list of installed software on the infected host.

Tactics: TA0007
Techniques: T1518
Input: A Destover-like variant used by Lazarus Group also gathers process times.

Tactics: TA0007
Techniques: T1057
Input: Winnti for Linux has the ability to deploy modules directly from command and control (C2) servers, possibly for remote command execution, file exfiltration, and socks5 proxying on the infected host.

Tactics: TA0011
Techniques: T1105
Input: An adversary accomplishes a reflection attack by sending packets to reflectors with the spoofed address of the victim.

Tactics: TA0040
Techniques: T1498, T1498.002
Input: Adversaries can use a combination of these methods, such as spoofing and promoting toll-free numbers or call centers that are used to direct victims to malicious websites, to deliver and execute payloads containing malware or Remote Access Software.

Tactics: TA0002
Techniques: T1204
Input: TajMahal has the ability to manage an automated queue of egress files and commands sent to its C2.

Tactics: TA0010
Techniques: T1020
Input: Hydraq creates a backdoor through which remote attackers can download files and additional malware components.

Tactics: TA0011
Techniques: T1105
Input: Monitor for changes to windows registry keys and/or values that may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence.

Tactics: TA0003, TA0004
Techniques: T1543
Input: Some Volgmer variants add new services with display names generated by a list of hard-coded strings such as Application, Background, Security, and Windows, presumably as a way to masquerade as a legitimate service.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Bonadan can find the external IP address of the infected host.

Tactics: TA0007
Techniques: T1016
Input: OopsIE compresses collected files with a simple character replacement scheme before sending them to its C2 server.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: For example, a program can be forced to start on safe mode boot by adding a * in front of the "Startup" value name: HKLM\Software\Microsoft\Windows\CurrentVersion\Run["*Startup"="{Path}"] or by adding a key to HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal.

Tactics: TA0005
Techniques: T1562.009, T1562
Input: Aquatic Panda has attempted to harvest credentials through LSASS memory dumping.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: APT41 attempted to remove evidence of some of its activity by clearing Windows security and system events.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: Exaramel for Windows adds the configuration to the Registry in XML format.

Tactics: TA0005
Techniques: T1112
Input: All of these files reside in the victim’s %TEMP% directory:    Filename Description   9PT568.dat Contains victim unique identifier   TPX498.dat Keystroke logs   edg499.dat List of interesting files   TPX499.dat Temporarily holds screenshot when given command by C2   up Temporarily contains downloaded file to be executed when given command by C2      Other changes we noticed in this variant include how the malware obfuscates C2 information stored via dead drop resolvers

Tactics: TA0005, TA0010
Techniques: T1041, T1036
Input: The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.

Tactics: TA0007
Techniques: T1124
Input: Adversaries may search social media for information about victims that can be used during targeting.

Tactics: TA0043
Techniques: T1593, T1593.001
Input: Segment networks and systems appropriately to reduce access to critical systems and services to controlled methods.

Tactics: TA0008
Techniques: T1210
Input: JHUHUGIT can retrieve an additional payload from its C2 server.

Tactics: TA0011
Techniques: T1105
Input: POWRUNER is written in PowerShell.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Cloud service providers offer APIs allowing users to enumerate objects stored within cloud storage.

Tactics: TA0007
Techniques: T1619
Input: Leafminer used a tool called Imecab to set up a persistent remote access account on the victim machine.

Tactics: TA0003
Techniques: T1136, T1136.001
Input: Consider the following event IDs:Domain Controllers: "Audit Logon" (Success & Failure) for event ID 4625.Domain Controllers: "Audit Kerberos Authentication Service" (Success & Failure) for event ID 4771.All systems: "Audit Logon" (Success & Failure) for event ID 4648.

Tactics: TA0006
Techniques: T1110, T1110.003
Input: Similarly, in Azure, an adversary may update the authorized_keys file of a virtual machine via a PATCH request to the API.

Tactics: TA0003
Techniques: T1098.004, T1098
Input: Although small, the EWM is large enough to store a 32-bit pointer and is often used to point to a windows procedure.

Tactics: TA0004, TA0005
Techniques: T1055.011, T1055
Input: HOPLIGHT has multiple proxy options that mask traffic between the malware and the remote operators.

Tactics: TA0011
Techniques: T1090
Input: PowerSploit has modules such as Get-NetDomainTrust and Get-NetForestTrust to enumerate domain and forest trusts.

Tactics: TA0007
Techniques: T1482
Input: Newer HttpBrowser versions use SSL with self-signed certificates to encrypt network communications

Tactics: TA0005, TA0011
Techniques: T1573, T1553, T1553.002
Input: After compromising a victim, Poseidon Group discovers all running services.

Tactics: TA0007
Techniques: T1007
Input: Monitor executed commands and arguments for actions that could be taken to gather local email files.

Tactics: TA0009
Techniques: T1114, T1114.001
Input: Web Application Firewalls may detect improper inputs attempting exploitation.

Tactics: TA0001, TA0008
Techniques: T1210, T1190
Input: Clop has searched folders and subfolders for files to encrypt.

Tactics: TA0007
Techniques: T1083
Input: Monitor for newly constructed files by using the logging agents on Kubernetes nodes and retrieve logs from sidecar proxies for application and resource pods to monitor malicious container orchestration job deployments.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.007, T1053
Input: SUNBURST checked for a variety of antivirus/endpoint detection agents prior to execution.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Machete has sent phishing emails that contain a link to an external server with ZIP and RAR archives.

Tactics: TA0001
Techniques: T1566, T1566.002