madox81/Adema_ATTACK_DS huggingface dataset:
Input: TEARDROP files had names that resembled legitimate Window file and directory names.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: HELLOKITTY can use WMI to delete volume shadow copies.

Tactics: TA0002
Techniques: T1047
Input: RDAT has executed commands using cmd.exe /c.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: SNUGRIDE communicates with its C2 server over HTTP.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: ROKRAT relies on a specific victim hostname to execute and decrypt important strings.

Tactics: TA0005
Techniques: T1480, T1480.001
Input: GOLD SOUTHFIELD has exploited Oracle WebLogic vulnerabilities for initial compromise.

Tactics: TA0001
Techniques: T1190
Input: Comnie executes a batch script to store discovery information in %TEMP%\info.dat and then uploads the temporarily file to the remote C2 server.

Tactics: TA0009
Techniques: T1119
Input: PowerSploit contains a collection of Privesc-PowerUp modules that can discover and exploit unquoted path vulnerabilities.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.009, T1574
Input: Green Lambert can use proxies for C2 traffic.

Tactics: TA0011
Techniques: T1090
Input: In order to evade network level detection, the downloader uses steganography.

Tactics: TA0011
Techniques: T1001
Input: Monitor for an attempt by a user to gain access to a network or computing resource, often by providing credentials that may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware.

Tactics: TA0005
Techniques: T1070
Input: Empire can use modules like Invoke-SessionGopher to extract private key and session information.

Tactics: TA0006
Techniques: T1552.004, T1552
Input: Examples include dir, tree, ls, find, and locate.

Tactics: TA0007
Techniques: T1083
Input: LaZagne can perform credential dumping from LSA secrets to obtain account and password information.

Tactics: TA0006
Techniques: T1003, T1003.004
Input: If a networked device does not have the link layer address of a particular networked device, it may send out a broadcast ARP request to the local network to translate the IP address to a MAC address.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.002
Input: jRAT can list and manage startup entries.

Tactics: TA0003, TA0004
Techniques: T1037, T1037.005
Input: APT40 also uses publicly available brute-forcing tools and a custom utility called DISHCLOTH to attack different protocols and services

Tactics: TA0006
Techniques: T1110
Input: Astaroth exfiltrates collected information from its r1.log file to the external C2 server.

Tactics: TA0010
Techniques: T1041
Input: APT19 used HTTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: InstallUtil is a command-line utility that allows for installation and uninstallation of resources by executing specific installer components specified in .NET binaries.

Tactics: TA0005
Techniques: T1218, T1218.004
Input: The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: AADInternals can register a device to Azure AD.

Tactics: TA0003
Techniques: T1098.005, T1098
Input: BRONZE BUTLER has placed malware on file shares and given it the same name as legitimate documents on the share.

Tactics: TA0008
Techniques: T1080
Input: If the installed product is on a predetermined list, the dropper will exit.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: PS1 can inject its payload DLL Into memory.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Monitor newly executed processes, such as eventvwr.exe and sdclt.exe, that may bypass UAC mechanisms to elevate process privileges on system.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Ryuk can use stolen domain admin accounts to move laterally within a victim domain.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.002
Input: Adversaries may build capabilities that can be used during targeting.

Tactics: TA0042
Techniques: T1587
Input: APT39 has downloaded tools to compromised hosts.

Tactics: TA0011
Techniques: T1105
Input: BISCUIT has a command to launch a command shell on the system.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: SLOTHFULMEDIA can enumerate open ports on a victim machine.

Tactics: TA0007
Techniques: T1049
Input: Monitor for newly constructed files from files that write or overwrite many files to a network shared directory may be suspicious.

Tactics: TA0008
Techniques: T1080
Input: Chimera has used scheduled tasks to invoke Cobalt Strike including through batch script schtasks /create /ru "SYSTEM" /tn "update" /tr "cmd /c c:\windows\temp\update.bat" /sc once /f /st and to maintain persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: BlackTech has used Putty for remote access.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: Umbreon provides access using both standard facilities like SSH and additional access using its backdoor Espeon, providing a reverse shell upon receipt of a special packet

Tactics: TA0002
Techniques: T1059.003, T1059
Input: In one instance, menuPass added PlugX as a service with a display name of "Corel Writing Tools Utility."

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Valak has the ability to exfiltrate data over the C2 channel.

Tactics: TA0010
Techniques: T1041
Input: PipeMon can iterate over the running processes to find a suitable injection target.

Tactics: TA0007
Techniques: T1057
Input: DustySky checks for the existence of anti-virus.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: The server responds with an OFFER message, which includes an available network address.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.003
Input: Adversaries may set files and directories to be hidden to evade detection mechanisms.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Windows API calls such as CreateRemoteThread, SuspendThread/SetThreadContext/ResumeThread, QueueUserAPC/NtQueueApcThread, and those that can be used to modify memory within another process, such as VirtualAllocEx/WriteProcessMemory, may be used for this technique.

Tactics: TA0004, TA0005
Techniques: T1055
Input: LitePower has the ability to list local drives and enumerate the OS architecture.

Tactics: TA0007
Techniques: T1082
Input: See Valid Accounts for more information.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: CosmicDuke takes periodic screenshots and exfiltrates them.

Tactics: TA0009
Techniques: T1113
Input: Monitoring the creation of (sub)keys within the Windows Registry may reveal malicious root certificate installation.

Tactics: TA0005
Techniques: T1553, T1553.004
Input: This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.

Tactics: TA0011
Techniques: T1001
Input: ShadowPad has discovered system information including memory status, CPU frequency, OS versions, and volume serial numbers.

Tactics: TA0007
Techniques: T1082
Input: Magic Hound has collected .PST archives.

Tactics: TA0009
Techniques: T1114, T1114.001
Input: LookBack can kill processes and delete services.

Tactics: TA0040
Techniques: T1489
Input: InvisiMole can deliver trojanized versions of software and documents, relying on user execution.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.

Tactics: TA0011
Techniques: T1219
Input: Trend Micro Solutions Trend Micro™ Deep Security™ and Vulnerability Protection provide virtual patching that protects endpoints from threats such as malicious redirections to malware-hosting URLs, as well as those that exploit unpatched vulnerabilities

Tactics: TA0004
Techniques: T1068
Input: We are unable to confirm if all of these stolen credentials are indeed valid sets of credentials, but based upon previously observed activity, timestamping, and known behaviors, it is highly probable that these credentials were or may still be valid

Tactics: TA0006
Techniques: T1003
Input: Maintain Presence APT40 primarily uses backdoors, including web shells, to maintain presence within a victim environment

Tactics: TA0003
Techniques: T1505.003, T1505
Input: APT1 has been known to use credential dumping using Mimikatz.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: WannaCry enumerates current remote desktop sessions and tries to execute the malware on each session.

Tactics: TA0008
Techniques: T1563.002, T1563
Input: Sibot has executed downloaded DLLs with rundll32.exe.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Ursnif has dropped payload and configuration files to disk.

Tactics: TA0011
Techniques: T1105
Input: Other techniques such as Dynamic Linker Hijacking may be used to populate a target process with more available gadgets.

Tactics: TA0004, TA0005
Techniques: T1055.009, T1055
Input: Previously the fake website linked to the following documents in a third fake Oxford domain, oxford[.]in: http://oxford[.]in/downloads/ls1.doc http://oxford[.]in/downloads/ls2.doc http://oxford[.]in/downloads/ls3.doc http://oxford[.]in/downloads/ls4.do The documents were unavailable during our research, and their content is unknown to us

Tactics: TA0011
Techniques: T1071, T1105
Input: Once the second DLL is executed, it gathers information about the victim system’s setup, such as operating system version, and driver and processor information

Tactics: TA0007
Techniques: T1082
Input: DOGCALL can capture microphone data from the victim's machine.

Tactics: TA0009
Techniques: T1123
Input: Cleaver has obtained and used open-source tools such as PsExec, Windows Credential Editor, and Mimikatz.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: KEYMARBLE can capture screenshots of the victim’s machine.

Tactics: TA0009
Techniques: T1113
Input: MuddyWater has run tools including Browser64 to steal passwords saved in victim web browsers.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Leviathan has sent spearphishing emails with malicious attachments, including .rtf, .doc, and .xls files.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Add-ins can be used to obtain persistence because they can be set to execute code when an Office application starts.

Tactics: TA0003
Techniques: T1137, T1137.006
Input: For example, we can see it will inject itself to one these three processes:  %ProgramFiles(x86)%\Sophos\AutoUpdate\ALUpdate.exe %ProgramFiles(x86)%\Common Files\Java\Java Update\jusched.exe %ProgramFiles(x86)%\Common Files\Adobe\ARM\1.0\armsvc.exe  The attempt to inject itself into a process belonging to antivirus product suite is particularly bold

Tactics: TA0004, TA0005
Techniques: T1036, T1055
Input: ComRAT has used a task name associated with Windows SQM Consolidator.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Given the regional file format used there is a chance that some security software suites may not handle them well, and this may have provided an evasion case for the attacker.The documents sent to the targets were titled "Analysis of "Northern New Year in 2017" and used the official logo of the Korean Ministry of Unification

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Bandook has used AES encryption for C2 communication.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: IcedID has been executed through Word documents with malicious embedded macros.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: That may correlate with browser extension installation.

Tactics: TA0003
Techniques: T1176
Input: [extension], for example HKEY_CLASSES_ROOT.txt.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.001
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may leverage Microsoft Office-based applications for persistence between startups.

Tactics: TA0003
Techniques: T1137
Input: Sandworm Team has disabled event logging on compromised systems.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: Flame can create backdoor accounts with login "HelpAssistant" on domain connected systems if appropriate rights are available.

Tactics: TA0003
Techniques: T1136, T1136.001
Input: Detection efforts may focus on follow-on exfiltration activity, where compressed or encrypted files can be detected in transit with a network intrusion detection or data loss prevention system analyzing file headers.

Tactics: TA0009
Techniques: T1560.002, T1560.001, T1560.003, T1560
Input: PoetRAT has made registry modifications to alter its behavior upon execution.

Tactics: TA0005
Techniques: T1112
Input: Wizard Spider has used "ipconfig" to identify the network configuration of a victim machine.

Tactics: TA0007
Techniques: T1016
Input: APT15 was also observed using Mimikatz to dump credentials and generate Kerberos golden tickets

Tactics: TA0006
Techniques: T1003
Input: Monitor for newly executed processes that may be used by an adversary to gain Initial Access that require user interaction.

Tactics: TA0002
Techniques: T1204
Input: Derusbi is capable of capturing video.

Tactics: TA0009
Techniques: T1125
Input: Legitimate scheduled tasks may be created during installation of new software or through system administration functions.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: Kimsuky has also used malicious VBA macros within maldocs disguised as forms that trigger when a victim types any content into the lure.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: SIPs are responsible for enabling API functions to create, retrieve, calculate, and verify signatures.

Tactics: TA0005
Techniques: T1553, T1553.003
Input: Identify and block potentially malicious software that may be executed through the Winlogon helper process by using application control  tools like AppLocker   that are capable of auditing and/or blocking unknown DLLs.

Tactics: TA0003, TA0004
Techniques: T1547.004, T1547
Input: Higaisa has exploited CVE-2018-0798 for execution.

Tactics: TA0002
Techniques: T1203
Input: DEATHRANSOM can use public and private key pair encryption to encrypt files for ransom payment.

Tactics: TA0040
Techniques: T1486
Input: There are many different ways to inject code into a process, many of which abuse legitimate functionalities.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Bazar has been downloaded via Windows BITS functionality.

Tactics: TA0003, TA0005
Techniques: T1197
Input: FIN6 has deployed a utility script named kill.bat to disable anti-virus.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: However, adversaries may attempt to execute a previous version of PowerShell that does not support SBL with the intent to Impair Defenses while running malicious scripts that may have otherwise been detected.

Tactics: TA0005
Techniques: T1562.010, T1562
Input: Restrict write access to the /Library/Security/SecurityAgentPlugins directory.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556
Input: xCaon has a command to start an interactive shell.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Tactics: TA0004
Techniques: T1068
Input: ZxShell has used FTP for C2 connections.

Tactics: TA0011
Techniques: T1071.002, T1071
Input: It also copies files from USB devices to a predefined directory.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Even so, there can be thousands of possible domains generated per day; this makes it impractical for defenders to preemptively register all possible C2 domains due to the cost.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: Look for additional activity that may indicate an adversary has gained higher privileges.

Tactics: TA0004
Techniques: T1068
Input: Figure 12: RSA public key 1    Figure 13: RSA public key 2    Figure 14: AES encryption parameters After encryption, the cipher text to be sent over C2 is Base64 encoded

Tactics: TA0011
Techniques: T1573
Input: Within cloud environments, adversaries may attempt to discover services running on other cloud hosts.

Tactics: TA0007
Techniques: T1046
Input: Cobalt Group has compromised legitimate web browser updates to deliver a backdoor.

Tactics: TA0001
Techniques: T1195, T1195.002
Input: Adversaries may duplicate then impersonate another user's token to escalate privileges and bypass access controls.

Tactics: TA0004, TA0005
Techniques: T1134, T1134.001
Input: Since domain configuration settings control many of the interactions within the Active Directory (AD) environment, there are a great number of potential attacks that can stem from this abuse.

Tactics: TA0004, TA0005
Techniques: T1484
Input: KEYS Deletes the file named by tempPath + “ky” file so as not to upload anything

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Adversaries can also hide a user’s home folder by changing the chflags to hidden.

Tactics: TA0005
Techniques: T1564.002, T1564
Input: Monitor for newly constructed processes and/or command-lines that  execute /etc/rc.local if present.

Tactics: TA0003, TA0004
Techniques: T1037.004, T1037
Input: watch/?   search/?  find/?    results/? open/?    search/?  close/?   The “ai” value stands for the payload title

Tactics: TA0007
Techniques: T1083
Input: FIVEHANDS can receive a command line argument to limit file encryption to specified directories.

Tactics: TA0002
Techniques: T1059
Input: RainyDay can use side-loading to run malicious executables.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: HiddenWasp downloads a tar compressed archive from a download server to the system.

Tactics: TA0011
Techniques: T1105
Input: Access to remote services may be used as a redundant or persistent access mechanism during an operation.

Tactics: TA0001, TA0003
Techniques: T1133
Input: Inception has used decoy documents to load malicious remote payloads via HTTP.

Tactics: TA0005
Techniques: T1221
Input: Launch Daemons are often used to provide access to shared resources, updates to software, or conduct automation tasks.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: BACKSPACE achieves persistence by creating a shortcut to itself in the CSIDL_STARTUP directory.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547.001, T1547
Input: Dragonfly has scanned targeted systems for vulnerable Citrix and Microsoft Exchange services.

Tactics: TA0043
Techniques: T1595, T1595.002
Input: Smoke Loader launches a scheduled task.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Skidmap has the ability to add the public key of its handlers to the authorized_keys file to maintain persistence on an infected host.

Tactics: TA0003
Techniques: T1098.004, T1098
Input: Reaver drops and executes a malicious CPL file as its payload.

Tactics: TA0005
Techniques: T1218, T1218.002
Input: JCry has created payloads in the Startup directory to maintain persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Silence has obtained and modified versions of publicly-available tools like Empire and PsExec.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: BloodHound can collect information about domain users, including identification of domain admin accounts.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: Adversaries may use DGAs for the purpose of Fallback Channels.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: Denis has a version written in PowerShell.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: FIN6 has used Comodo code-signing certificates.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: It’s important to remember, that while we were using Bitly links to help gauge click location, anyone who clicks these links (including researchers) are also counted

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Ke3chang has used tools to download files to compromised machines.

Tactics: TA0011
Techniques: T1105
Input: These Honeybee documents did not contain any specific lures, rather variations of a “not compatible” message attempting to convince the user to enable content

Tactics: TA0002
Techniques: T1204
Input: Silent Librarian has used compromised credentials to obtain unauthorized access to online accounts.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: XAgentOSX contains the readFiles function to return a detailed listing (sometimes recursive) of a specified directory.

Tactics: TA0007
Techniques: T1083
Input: If the capability exists, it may be of value to monitor and alert on users that are retrieving and viewing a large number of documents and pages; this behavior may be indicative of programmatic means being used to retrieve all data within the repository.

Tactics: TA0009
Techniques: T1213, T1213.001, T1213.002
Input: APT32 has used CVE-2016-7255 to escalate privileges.

Tactics: TA0004
Techniques: T1068
Input: CosmicDuke can use HTTP or HTTPS for command and control to hard-coded C2 servers.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Some network devices are built with a monolithic architecture, where the entire operating system and most of the functionality of the device is contained within a single file.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: In cloud environments, ensure that users are not granted permissions to create or modify traffic mirrors unless this is explicitly required.

Tactics: TA0006, TA0007
Techniques: T1040
Input: jRAT can list network connections.

Tactics: TA0007
Techniques: T1049
Input: KOCTOPUS has used VBScript to call wscript to execute a PowerShell command.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: APT28 has renamed the WinRAR utility to avoid detection.

Tactics: TA0005
Techniques: T1036
Input: Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control.

Tactics: TA0042
Techniques: T1584.003, T1584.001, T1584.004, T1583.004, T1583.003, T1584.002, T1584, T1583, T1583.002
Input: Olympic Destroyer uses the API call ChangeServiceConfigW to disable all services on the affected system.

Tactics: TA0040
Techniques: T1489
Input: Monitor for changes made to processes that may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055.002, T1055
Input: Installation of a root certificate on a compromised system would give an adversary a way to degrade the security of that system.

Tactics: TA0005
Techniques: T1553, T1553.004
Input: FIN4 has lured victims to click malicious links delivered via spearphishing emails (often sent from compromised accounts).

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Detection efforts may be focused on post-compromise phases of the adversary lifecycle.

Tactics: TA0042
Techniques: T1588, T1587, T1588.001, T1587.001, T1588.002
Input: QakBot has the ability to enumerate windows on a compromised host.

Tactics: TA0007
Techniques: T1010
Input: The backdoor will load the encrypted configuration file and decrypt it, then use Secure Sockets Layer (SSL) protocol to connect to command-and-control (C&C) servers

Tactics: TA0005
Techniques: T1140
Input: Winnti for Windows can XOR encrypt C2 traffic.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Bundlore can install malicious browser extensions that are used to hijack user searches.

Tactics: TA0003
Techniques: T1176
Input: StreamEx has the ability to enumerate system information.

Tactics: TA0007
Techniques: T1082
Input: Figure 14: System shut down upon discovery of security tools  Ability to receive PowerShell script from the C2 server and execute on the machine

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Sandworm Team has used backdoors that can delete files used in an attack from an infected system.

Tactics: TA0005
Techniques: T1070, T1070.004