madox81/Adema_ATTACK_DS huggingface dataset:
Input: Tropic Trooper used shellcode with an XOR algorithm to decrypt a payload.

Tactics: TA0005
Techniques: T1140
Input: Monitor executed commands and arguments for sdbinst.exe for potential indications of application shim abuse.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1136, T1136.001, T1078, T1078.003
Input: This user action will typically be observed as follow-on behavior from Spearphishing Link.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: SSH is a protocol that allows authorized users to open remote shells on other computers.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: Elise executes net start after initial communication is made to the remote server.

Tactics: TA0007
Techniques: T1007
Input: Monitor for unexpected disk partition table entries, or blocks of otherwise unusual memory that warrant deeper investigation

Tactics: TA0003, TA0005
Techniques: T1542.002, T1542
Input: If a match if found, SynAck sleeps for 300 seconds and then exits without encrypting files.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: Usage of the Windows command shell may be common on administrator, developer, or power user systems depending on job function.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Thread Execution Hijacking is commonly performed by suspending an existing process then unmapping/hollowing its memory, which can then be replaced with malicious code or the path to a DLL.

Tactics: TA0004, TA0005
Techniques: T1055.003, T1055
Input: JHUHUGIT obtains a list of running processes on the victim.

Tactics: TA0007
Techniques: T1057
Input: TSCookie has the ability to discover drive information on the infected host.

Tactics: TA0007
Techniques: T1083
Input: CrossRAT is capable of taking screen captures.

Tactics: TA0009
Techniques: T1113
Input: Configure access controls and firewalls to limit access to domain controllers and systems used to create and manage accounts.

Tactics: TA0003
Techniques: T1136, T1136.002
Input: Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: Waterbear can use API hooks on GetExtendedTcpTable to retrieve a table containing a list of TCP endpoints available to the application.

Tactics: TA0007
Techniques: T1049
Input: Olympic Destroyer will shut down the compromised system after it is done modifying system configuration settings.

Tactics: TA0040
Techniques: T1529
Input: Reaver collects system information from the victim, including CPU speed, computer name, volume serial number, ANSI code page, OEM code page identifier for the OS, Microsoft Windows version, and memory information.

Tactics: TA0007
Techniques: T1082
Input: Similar to Accessibility Features, on Windows Vista and later as well as Windows Server 2008 and later, a Registry key may be modified that configures "cmd.exe," or another program that provides backdoor access, as a "debugger" for an accessibility program (ex: utilman.exe).

Tactics: TA0003, TA0004
Techniques: T1546.012, T1546
Input: BISCUIT has a command to enumerate running processes and identify their owners.

Tactics: TA0007
Techniques: T1057
Input: VBA enables documents to contain macros used to automate the execution of tasks and other functionality on the host.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: BBK has the ability to download files from C2 to the infected host.

Tactics: TA0011
Techniques: T1105
Input: An adversary can leverage a computer's peripheral devices (, integrated cameras or webcams) or applications (, video call services) to capture video recordings for the purpose of gathering information.

Tactics: TA0009
Techniques: T1125
Input: Monitor executed commands and arguments for actions that are associated with local account creation, such as net user /add /domain.

Tactics: TA0003
Techniques: T1136, T1136.002
Input: SHARPSTATS has the ability to identify the current date and time on the compromised host.

Tactics: TA0007
Techniques: T1124
Input: Ecipekac has used a valid, legitimate digital signature to evade detection.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: OceanSalt has been executed via malicious macros.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: We’ve seen two onion addresses used in different samples:  g5wcesdfjzne7255.onion (Down) r2elajikcosf7zee.onion (Alive at time of writing)  The HTTP resource always starts with /api/osx/ and contains actions such as:  /api/osx/started to report the bot has just started /api/osx/keychain to exfiltrate the content of the keychain /api/osx/get_task?bot_id={botid}&version={version} to request a task (described below) /api/osx/cmd_executed to report a the output of a command that was executed /api/osx/task_complete?bot_id={botid}&task_id={taskid} to report a task was completed  HTTP POST content has two fields: bot_id and data

Tactics: TA0002, TA0011
Techniques: T1071, T1106
Input: The policy of the domain also includes configuration settings that may apply between domains in a multi-domain/forest environment.

Tactics: TA0004, TA0005
Techniques: T1484
Input: ObliqueRAT can gain persistence by a creating a shortcut in the infected user's Startup directory.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Monitor for changes to Registry entries associated with Winlogon that do not correlate with known software, patch cycles,  Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current Winlogon helper values.

Tactics: TA0003, TA0004
Techniques: T1547.004, T1547
Input: Bisonal has supported use of a proxy server.

Tactics: TA0011
Techniques: T1090
Input: Adversaries may also leverage the AiTM position to attempt to monitor and/or modify traffic, such as in Transmitted Data Manipulation.

Tactics: TA0006, TA0009
Techniques: T1557
Input: Domain accounts can cover user, administrator, and service accounts.

Tactics: TA0003
Techniques: T1136, T1136.002
Input: MFA systems, such as Duo or Okta, allow users to associate devices with their accounts in order to complete MFA requirements.

Tactics: TA0003
Techniques: T1098.005, T1098
Input: When opened and then executed, the key components of the HTA file downloads and executes further malware from a remote URLand loads a decoy image hosted externally (Figure 3)

Tactics: TA0011
Techniques: T1105
Input: Lazarus Group has disguised malicious template files as JPEG files to avoid detection.

Tactics: TA0005
Techniques: T1036
Input: MuddyWater has used file sharing services including OneHub to distribute tools.

Tactics: TA0042
Techniques: T1583.006, T1583
Input: Axiom has used steganography to hide its C2 communications.

Tactics: TA0011
Techniques: T1001, T1001.002
Input: VERMIN uses WMI to check for anti-virus software installed on the system.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit DLL hijacking opportunities in services and processes.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: In one instance we observed, one of the initial malware delivered to the victim, RATANKBA (TROJ_RATANKBA.A), connects to a legitimate but compromised website (eye-watch[.]in:443, a mobile application-selling site) from which a hack tool (nbt_scan.exe) is also downloaded

Tactics: TA0005
Techniques: T1036
Input: Monitor for newly executed processes that may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053
Input: Carberp has exploited multiple Windows vulnerabilities (CVE-2010-2743, CVE-2010-3338, CVE-2010-4398, CVE-2008-1084) and a .NET Runtime Optimization vulnerability for privilege escalation.

Tactics: TA0004
Techniques: T1068
Input: Denis ran multiple system checks, looking for processor and register characteristics, to evade emulation and analysis.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Hydraq creates a backdoor through which remote attackers can check for the existence of files, including its own components, as well as retrieve a list of logical drives.

Tactics: TA0007
Techniques: T1083
Input: Also define who can create a process level token to only the local and network service through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Replace a process level token.

Tactics: TA0004, TA0005
Techniques: T1134.002, T1134.003, T1134, T1134.001
Input: Close all browser sessions regularly and when they are no longer needed.

Tactics: TA0009
Techniques: T1185
Input: The White Company has taken advantage of a known vulnerability in Microsoft Word (CVE 2012-0158) to execute code.

Tactics: TA0002
Techniques: T1203
Input: ChChes is capable of downloading files, including additional modules.

Tactics: TA0011
Techniques: T1105
Input: Therefore, devices may wrongly add or update the MAC address of the IP address in their ARP cache.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.002
Input: SpicyOmelette can identify payment systems, payment gateways, and ATM systems in compromised environments.

Tactics: TA0007
Techniques: T1018
Input: APT3 enables the Remote Desktop Protocol for persistence.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: MuddyWater has used mshta.exe to execute its POWERSTATS payload and to pass a PowerShell one-liner for execution.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: BLUELIGHT can zip files before exfiltration.

Tactics: TA0009
Techniques: T1560
Input: After decoding their C2 server IP addresses, from obfuscated strings, both trojans will attempt to collect host information and send it to the C2 server.

Tactics: TA0007
Techniques: T1082
Input: Additionally, some implementations can introduce visible artifacts for the user (ex: a watermark in the corner of the screen stating the system is in Test Mode).

Tactics: TA0005
Techniques: T1553, T1553.006
Input: Pillowmint has encrypted stolen credit card information with AES and further encoded it with Base64.

Tactics: TA0009
Techniques: T1560
Input: Figure 6 Authentication dialog box with fake credentials entered On the C2 server, we observed Phishery receiving the inbound request and capturing the credentials, as seen in Figure 7

Tactics: TA0006
Techniques: T1003
Input: Brave Prince collects hard drive content and system configuration information.

Tactics: TA0007
Techniques: T1082
Input: 14, 2017, FireEye observed an attacker using an exploit for the Microsoft Office vulnerability to target a government organization in the Middle East

Tactics: TA0002
Techniques: T1203
Input: NanoCore can perform keylogging on the victim’s machine.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: WhisperGate can recognize the presence of monitoring tools on a target system.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: JPIN can enumerate Registry keys.

Tactics: TA0007
Techniques: T1012
Input: Indicator   Type   Context       198.56.185.179   IP address   Used by BRONZE UNION to connect to China Chopper web shell     211.255.155.194   IP address   Likely associated with VPN used by BRONZE UNION to connect to China Chopper web shell     211.255.155.199   IP address   Likely associated with VPN used by BRONZE UNION to connect to China Chopper web shell     211.255.155.202   IP address   Likely associated with VPN used by BRONZE UNION to connect to China Chopper web shell     211.255.155.204   IP address   Likely associated with VPN used by BRONZE UNION to connect to China Chopper web shell     211.255.155.215   IP address   Likely associated with VPN used by BRONZE UNION to connect to China Chopper web shell     211.255.155.218   IP address   Likely associated with VPN used by BRONZE UNION to connect to China Chopper web shell     211.255.155.219   IP address   Likely associated with VPN used by BRONZE UNION to connect to China Chopper web shell     211.255.155.224   IP address   Likely associated with VPN used by BRONZE UNION to connect to China Chopper web shell     104.130.244.126   IP address   Used by BRONZE UNION to connect to web shells     96.90.63.57   IP address   Used by BRONZE UNION to connect to web shells     117.136.63.145   IP address   Used by BRONZE UNION to connect to web shells     cd5aaa37ee165071f914ceec8fd09e0f   MD5 hash   OwaAuth web shell used by BRONZE UNION     2b5aa30f8f0575bdfe1ddebc8dac8c56a91137a8   SHA1 hash   OwaAuth web shell used by BRONZE UNION     0e823a5b64ee761b70315548d484b5b9c4b61968b5068f9a8687c612ddbfeb80   SHA256 hash   OwaAuth web shell used by BRONZE UNION     javaws.exe   Filename   Malware used in BRONZE UNION SWC that downloads and executes a second-stage payload     98c5f2a680fe9de19683120be90ea75c   MD5 hash   Malware used in BRONZE UNION SWC (javaws.exe)F     daa03d4aa72a16fff910142982b057b195018e6d   SHA1 hash   Malware used in BRONZE UNION SWC (javaws.exe)     ec60e57419f24fabbe67451cb1055b3d2684ab2534cd55c4a88cc395f9ed1b09   SHA256 hash   Malware used in BRONZE UNION SWC (javaws.exe)     45.114.9.174   IP address   Used by BRONZE UNION to host second-stage payload for SWC     Table 1

Tactics: TA0001, TA0002, TA0003, TA0004, TA0005, TA0006, TA0007, TA0008, TA0011
Techniques: T1053.005, T1189, T1505.003, T1070, T1070.006, T1110, T1550.002, T1053, T1021, T1090.003, T1574.002, T1027, T1505, T1090, T1016, T1574, T1102, T1550, T1027.001
Input: The full obfuscated command inside the .lnk file

Tactics: TA0003, TA0004, TA0005
Techniques: T1547.009, T1027, T1547
Input: In addition, it conducts peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol.

Tactics: TA0011
Techniques: T1572
Input: TEMP.Veles used timestomping to modify the $STANDARD_INFORMATION attribute on tools.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: Adversaries may abuse the Windows command shell for execution.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Like many threat groups, TG-3390 conducts strategic web compromises (SWCs), also known as watering hole attacks, on websites associated with the target organization's vertical or demographic to increase the likelihood of finding victims with relevant information

Tactics: TA0001
Techniques: T1189
Input: ZeroT has obfuscated DLLs and functions using dummy API calls inserted between real instructions.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: Monitor executed commands and arguments in command history in either the console or as part of the running memory to determine if unauthorized or suspicious commands were used to modify device configuration.

Tactics: TA0003, TA0005
Techniques: T1542.005, T1542
Input: The spear phishing emails and attached malicious macro documents typically have geopolitical themes

Tactics: TA0001
Techniques: T1566, T1566.001
Input: XCSSET uses the plutil command to modify the LSUIElement, DFBundleDisplayName, and CFBundleIdentifier keys in the /Contents/Info.plist file to change how XCSSET is visible on the system.

Tactics: TA0005
Techniques: T1647
Input: This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.

Tactics: TA0005
Techniques: T1070
Input: Then it checks to see if it was launched by RUNDLL32.exe along with parameter #1

Tactics: TA0005
Techniques: T1218, T1218.011
Input: APT38 have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: Some SAML tokens features, such as the location of a user, may not be as easy to claim.

Tactics: TA0006
Techniques: T1606, T1606.002
Input: This tool was originally intended to aid defenders in simulating obfuscated PowerShell commands to better their defenses

Tactics: TA0005
Techniques: T1027
Input: MCMD can modify processes to prevent them from being visible on the desktop.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: For instance, the following 15 bytes were used to generate an HTTP parameter during our analysis:    Random Value Constant Value agent_id   0F EE C8 83 56 0E 9F F0 EB 98 43 30 30 30 30    The resulting ciphertext is then encoded using XAgent’s base64 encoding routine that starts by building the following encoding alphabet: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_ As you can see, this is not the standard base64 alphabet, rather it is the “URL and Filename safe” Base 64 Alphabet from RFC 4648, as the “+” in the standard alphabet is replaced with “-” and the “/” replaced with “_”

Tactics: TA0005, TA0011
Techniques: T1132, T1027
Input: Persistence Once started, the Keydnap backdoor installs a plist file in /Library/LaunchAgents/ if it has root privileges or $USER/Library/LaunchAgents/ otherwise to achieve persistence across reboots

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: Monitor executed commands and arguments that may steal data by exfiltrating it over a different protocol than that of the existing command and control channel.

Tactics: TA0010
Techniques: T1048
Input: FELIXROOT deletes the Registry key HKCU\Software\Classes\Applications\rundll32.exe\shell\open.

Tactics: TA0005
Techniques: T1112
Input: Otherwise, it runs a search for the “/bin/rsyncd” string within the files found in the /etc/ folder

Tactics: TA0007
Techniques: T1083
Input: Chimera has nltest /domain_trusts to identify domain trust relationships.

Tactics: TA0007
Techniques: T1482
Input: KEYMARBLE gathers the MAC address of the victim’s machine.

Tactics: TA0007
Techniques: T1016
Input: Sandworm Team's CredRaptor tool can collect saved passwords from various internet browsers.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: KARAE can upload and download files, including second-stage malware.

Tactics: TA0011
Techniques: T1105
Input: Lazarus Group malware has maintained persistence on a system by creating a LNK shortcut in the user’s Startup folder.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Gold Dragon lists the directories for Desktop, program files, and the user’s recently accessed files.

Tactics: TA0007
Techniques: T1083
Input: WindTail has the ability to generate the current date and time.

Tactics: TA0007
Techniques: T1124
Input: MCMD can Base64 encode output strings prior to sending to C2.

Tactics: TA0005
Techniques: T1027
Input: Monitor for suspicious sequences of events, such as the creation of multiple snapshots within a short period of time.

Tactics: TA0005
Techniques: T1578
Input: zwShell can browse the file system.

Tactics: TA0007
Techniques: T1083
Input: The following commands are available:    Command  SubCommand Description   VER  Generates the following IRC client command that will be sent to the C2 server:   PRIVMSG <username> :    8 LED= 20160124   KILL  Trojan disconnects from the IRC server and terminates itself   RESET  Trojan disconnects from the IRC server and runs the executable again   OS  Obtains the Windows version and responds to the C2 with the following message “PRIVMSG <username> :<one of the following version strings>”:   Windows NT Windows 95 Windows 98 Windows ME Windows 2003 Windows XP Windows 7 Windows Vista Unkown os info   !SH EXEC Not supported    MD Creates a specified directory

Tactics: TA0002, TA0007
Techniques: T1106, T1010
Input: Helminth has used Tasklist to get information on processes.

Tactics: TA0007
Techniques: T1057
Input: It requires the remote Registry service to be running on the target system.

Tactics: TA0005
Techniques: T1112
Input: Authentication cookies are commonly used in web applications, including cloud-based services, after a user has authenticated to the service so credentials are not passed and re-authentication does not need to occur as frequently.

Tactics: TA0005, TA0008
Techniques: T1550.004, T1550
Input: Monitor for file names that are mismatched between the file name on disk and that of the binary's PE metadata, this is a likely indicator that a binary was renamed after it was compiled.

Tactics: TA0005
Techniques: T1036.003, T1036
Input: Octopus has used wmic.exe for local discovery information.

Tactics: TA0002
Techniques: T1047
Input: OilRig uses remote services such as VPN, Citrix, or OWA to persist in an environment.

Tactics: TA0001, TA0003
Techniques: T1133
Input: LaZagne can obtain credentials from macOS Keychains.

Tactics: TA0006
Techniques: T1555.001, T1555
Input: Adversaries may prepare an operational environment to infect systems that visit a website over the normal course of browsing.

Tactics: TA0042
Techniques: T1608.004, T1608
Input: Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.

Tactics: TA0040
Techniques: T1499
Input: APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password spray attacks.

Tactics: TA0006
Techniques: T1110, T1110.003
Input: Empire includes keylogging capabilities for Windows, Linux, and macOS systems.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: The emond binary at /sbin/emond will load any rules from the /etc/emond.d/rules/ directory and take action once an explicitly defined event takes place.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.014
Input: Set directory access controls to prevent file writes to the search paths for applications, both in the folders where applications are run from and the standard dylib folders.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.004, T1574
Input: Pillowmint has used a malicious shim database to maintain persistence.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: APT39 has used malware to turn off the RequireSigned feature which ensures only signed DLLs can be run on Windows.

Tactics: TA0005
Techniques: T1553, T1553.006
Input: Hi-Zor uses various XOR techniques to obfuscate its components.

Tactics: TA0005
Techniques: T1027
Input: PoshC2 contains modules for local privilege escalation exploits such as CVE-2016-9192 and CVE-2016-0099.

Tactics: TA0004
Techniques: T1068
Input: KillDisk retrieves the hard disk name by calling the CreateFileA to \.\PHYSICALDRIVE0 API.

Tactics: TA0007
Techniques: T1082
Input: Aria-body has the ability to delete files and directories on compromised hosts.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Operation Wocao has used PowerShell on compromised systems.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Carberp has connected to C2 servers via HTTP.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Adversaries may abuse Windows safe mode to disable endpoint defenses.

Tactics: TA0005
Techniques: T1562.009, T1562
Input: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: APT3 will copy files over to Windows Admin Shares (like ADMIN$) as part of lateral movement.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Execution via TLS callback injection may also evade detection from security products since the execution is masked under a legitimate process.

Tactics: TA0004, TA0005
Techniques: T1055.005, T1055
Input: The payload sends system information about the infected computer to the C&C server and downloads additional tools.

Tactics: TA0007
Techniques: T1082
Input: Peppy can use HTTP to communicate with C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: WMI classes are the primary structure within WMI

Tactics: TA0002
Techniques: T1047
Input: Adversaries may use ARP cache poisoning as a means to intercept network traffic.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.002
Input: Monitor executed commands and arguments for actions that are used to perform remote behavior

Tactics: TA0002
Techniques: T1047
Input: Operation Wocao can proxy traffic through multiple infected systems.

Tactics: TA0011
Techniques: T1090.001, T1090