madox81/Adema_ATTACK_DS huggingface dataset:
Input: Some variants of the Zeroaccess Trojan have been known to store data in Extended Attributes.

Tactics: TA0005
Techniques: T1564, T1564.004
Input: Use application control where appropriate.

Tactics: TA0002
Techniques: T1059.003, T1059.004, T1059.001, T1059.005, T1059.002, T1059
Input: Upon execution, Metamorfo has unzipped itself after being downloaded to the system and has performed string decryption.

Tactics: TA0005
Techniques: T1140
Input: WastedLocker can identify network adjacent and accessible drives.

Tactics: TA0007
Techniques: T1135
Input: SHOTPUT has a command to retrieve information about connected users.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Monitor newly constructed processes,  browsers, for to gather personal information about users (ex: banking sites, interests, social media, )

Tactics: TA0007
Techniques: T1217
Input: To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware designed for destroying data may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares..

Tactics: TA0040
Techniques: T1485
Input: Remexi collects text from the clipboard.

Tactics: TA0009
Techniques: T1115
Input: Within MFT entries are file attributes,  such as Extended Attributes (EA) and Data [known as Alternate Data Streams (ADSs) when more than one Data attribute is present], that can be used to store arbitrary data (and even complete files).

Tactics: TA0005
Techniques: T1564, T1564.004
Input: Additionally, a small number of campaigns over this same period also made use of various file-sharing platforms like Dropbox for hosting the malicious documents rather than directly attaching them to the messages themselves.Figure 2: Example malicious Excel documentSimilar to the technique described in our previous blog about Remcos, the contents of the documents have been intentionally made to appear as if they are blurry, with the user being prompted to enable editing to have a clearer view of the contents

Tactics: TA0002
Techniques: T1204
Input: Information about networks may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases).

Tactics: TA0043
Techniques: T1590
Input: These utilities may often be signed with legitimate certificates that allow them to execute on a system and proxy execution of malicious code through a trusted process that effectively bypasses application control solutions.

Tactics: TA0005
Techniques: T1127
Input: These connections may be direct or may include trying to connect through others.

Tactics: TA0042
Techniques: T1586.001, T1585, T1585.001, T1586
Input: It should be noted that in most of these cases the backdoor was embedded as a packed payload in another executable or in a weaponized document file of some kind

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Magic Hound malware has a function to determine whether the C2 server wishes to execute the newly dropped file in a hidden window.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Script blocking extensions can help prevent the execution of JavaScript that may commonly be used during the exploitation process.

Tactics: TA0001
Techniques: T1189
Input: Change GPOs to define shorter timeouts sessions and maximum amount of time any single session can be active.

Tactics: TA0008
Techniques: T1563.002, T1021.001, T1021, T1563
Input: Some Orz strings are base64 encoded, such as the embedded DLL known as MockDll.

Tactics: TA0005
Techniques: T1027
Input: BBK has the ability to use HTTP in communications with C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: For example, an adversary may enable features such as concurrent Remote Desktop Protocol sessions by either patching the termsrv.dll file or modifying the ServiceDll value to point to a DLL that provides increased RDP functionality.

Tactics: TA0003
Techniques: T1505.005, T1505
Input: Adversaries may also use RDP in conjunction with the Accessibility Features or Terminal Services DLL for Persistence.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: regsvr32.exe is a native Windows utility for registering and unregistering DLLs and ActiveX controls in the Windows registry.    The script attempts to load the malicious module using regsvr with the run function.   Procmon shows the malicious module loaded to the Avast process

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.

Tactics: TA0005, TA0008
Techniques: T1550
Input: Lizar can run Mimikatz to harvest credentials.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: It was also able to use a component of multinational antivirus software Avast to gain information about the target system, as well as a process belonging to Brazilian information security company GAS Tecnologia to gather personal information

Tactics: TA0007
Techniques: T1518.001, T1518, T1082
Input: Deep Discovery Inspector protects customers from these threats via this DDI Rule:  DDI Rule 18 : DNS response of a queried malware Command and Control domain DDI Rule 15 : Many unsuccessful logon attempts (nbt_scan.exe) DDI Rule 38 : Multiple unsuccessful logon attempts (nbt_scan.exe)  TippingPoint customers are protected from these threats via these ThreatDV filters:  27218: HTTP: TROJ_RATANKBA_A Checkin 28219: HTTP: TROJ_RATANKBA_A Checkin 02 27220: HTTPS: TROJ_RATANKBA_A Checkin 27221: HTTP: Sundown EK Flash Exploit (SWF_EXPLOYT.YYRQ)  A list of related Indicators of Compromise (IoCs) can be found in this appendix

Tactics: TA0011
Techniques: T1071
Input: Cobalt Strike includes a capability to modify the Beacon payload to eliminate known signatures or unpacking methods.

Tactics: TA0005
Techniques: T1027, T1027.005
Input: Some versions of UPPERCUT have used the hard-coded string "this is the encrypt key" for Blowfish encryption when communicating with a C2.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Additionally, if weak linking is used, such as the LC_LOAD_WEAK_DYLIB function, an application will still execute even if an expected dylib is not present.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.004, T1574
Input: Sibot has queried the registry for proxy server information.

Tactics: TA0007
Techniques: T1012
Input: Adversaries may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055.002, T1055
Input: Attor's Blowfish key is encrypted with a public RSA key.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Linfo creates a backdoor through which remote attackers can start a remote shell.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Disable Autoruns if it is unnecessary.

Tactics: TA0011
Techniques: T1092
Input: TSCookie has the ability to proxy communications with command and control (C2) servers.

Tactics: TA0011
Techniques: T1090
Input: During our analysis, we observed one loader running “rr.exe” with the following arguments:open cmd.exe /c c:\\temp\\rr.exe SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\spp.exe" iexploreThe “rr.exe” payload dropped to the system does nothing more than use the supplied command line arguments to create a registry key to execute the payload each time the system starts

Tactics: TA0004, TA0005
Techniques: T1036, T1055.012, T1055
Input: The main function gets pertinent strings to communicate with its C2 by calling a sub-function with a specific number that the sub-function uses as a case within a switch statement to decrypt the desired string

Tactics: TA0005
Techniques: T1140
Input: Doki has executed shell scripts with /bin/sh.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: PowerShell File Analysis The PowerShell script employs several layers of obfuscation to hide its actual functionality

Tactics: TA0002
Techniques: T1059.001, T1059
Input: This allows persistent access to instances within the cloud environment without further usage of the compromised cloud accounts.

Tactics: TA0003
Techniques: T1098.001, T1098
Input: MD5 File Name Exploit 73f493f6a2b0da23a79b50765c164e88 議程最新修正及注意事項.doc CVE-2012-0158 f6fafb7c30b1114befc93f39d0698560 0824.1.doc CVE-2012-0158 eaa6e03d9dae356481215e3a9d2914dc 簡易名冊0全國各警察機關主官至分局長.doc CVE-2012-0158 06da4eb2ab6412c0dc7f295920eb61c4 附檔.doc CVE-2012-0158 53baedf3765e27fb465057c48387c9b6 103年第3屆通訊錄.doc CVE-2012-0158 00a95fb30be2d6271c491545f6c6a707 2014 09 17 Welcome Reception for Bob and Jason_invitation.doc CVE-2012-0158 4ab6bf7e6796bb930be2dd0141128d06 產諮會_Y103(2)委員會_從東協新興國家崛起(0825).doc CVE-2012-0158   Figure 4: Identified exploit documents for HIGHTIDE  When the file is opened, it drops HIGHTIDE in the form of an executable file onto the infected system

Tactics: TA0002, TA0007, TA0011
Techniques: T1203, T1090.003, T1083, T1090
Input: The DOC file contains an embedded OLE Object that, upon execution, triggers the download of an additional DOC file from the stored URL (seen in Figure 3)

Tactics: TA0011
Techniques: T1105
Input: ADVSTORESHELL is capable of setting and deleting Registry values.

Tactics: TA0005
Techniques: T1112
Input: If an adversary creates resources in an unused region, they may be able to operate undetected.

Tactics: TA0005
Techniques: T1535
Input: IPC is typically used by processes to share data, communicate with each other, or synchronize execution.

Tactics: TA0002
Techniques: T1559
Input: Pillowmint has been compressed and stored within a registry key.

Tactics: TA0005
Techniques: T1027
Input: Microsoft released an optional patch update - KB3045645 - that will remove the "auto-elevate" flag within the sdbinst.exe.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: Mustang Panda has hosted malicious payloads on DropBox including PlugX.

Tactics: TA0042
Techniques: T1608.001, T1608
Input: MegaCortex has added entries to the Registry for ransom contact information.

Tactics: TA0005
Techniques: T1112
Input: Daserf can take screenshots.

Tactics: TA0009
Techniques: T1113
Input: Consider analyzing newly constructed network connections that are sent or received by untrusted hosts, unexpcted hardware devices, or other uncommon data flows.

Tactics: TA0003, TA0005, TA0011, TA0010
Techniques: T1020.001, T1205, T1020, T1205.001
Input: FinFisher renames one of its .dll files to uxtheme.dll in an apparent attempt to masquerade as a legitimate file.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Monitor for newly executed processes that may be indicative of credential dumping.

Tactics: TA0006, TA0007
Techniques: T1033, T1003, T1003.001
Input: Windows 8.1 and Windows Server 2012 R2 may generate events when unsigned SSP DLLs try to load into the LSA by setting the Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe with AuditLevel = 8.

Tactics: TA0003, TA0004
Techniques: T1547.005, T1547
Input: Monitor Registry creation for services that may start on safe mode.

Tactics: TA0005
Techniques: T1562.009, T1562
Input: The GoldMax Linux variant has used a crontab entry with a @reboot line to gain persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: BoxCaon uploads files and data from a compromised host over the existing C2 channel.

Tactics: TA0010
Techniques: T1041
Input: China Chopper's server component can list directory contents.

Tactics: TA0007
Techniques: T1083
Input: Maze also calls certain functions dynamically to hinder analysis.

Tactics: TA0005
Techniques: T1027
Input: HiddenWasp creates a user account as a means to provide initial persistence to the compromised machine.

Tactics: TA0003
Techniques: T1136, T1136.001
Input: The Komplex C2 channel uses HTTP POST requests.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: StoneDrill has relied on injecting its payload directly into the process memory of the victim's preferred browser.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Adversaries may search for private key certificate files on compromised systems for insecurely stored credentials.

Tactics: TA0006
Techniques: T1552.004, T1552
Input: Kimsuky has used an information gathering module that will hide an AV software window from the victim.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641.

Tactics: TA0002
Techniques: T1203
Input: Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via Accessibility Features, Boot or Logon Initialization Scripts, or tainting/hijacking other instrumental binary/configuration files via Hijack Execution Flow.

Tactics: TA0005
Techniques: T1222, T1222.001
Input: BADNEWS has a command to take a screenshot and send it to the C2 server.

Tactics: TA0009
Techniques: T1113
Input: APT41 collected MAC addresses from victim machines.

Tactics: TA0007
Techniques: T1016
Input: Sidewinder has named malicious files rekeywiz.exe to match the name of a legitimate Windows executable.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Orangeworm has used HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: The executable attempts to download a couple of files from different sources and saves them in the AppData and Startup folders for persistence, then invokes the first downloaded file – Picture2.exe

Tactics: TA0011
Techniques: T1105
Input: Monitor for API calls associated with altering data.

Tactics: TA0040
Techniques: T1565.003, T1565, T1565.002
Input: Monitor executed commands and arguments of net use commands associated with establishing and removing remote shares over SMB, including following best practices for detection of Windows Admin Shares.

Tactics: TA0005
Techniques: T1070, T1070.005
Input: Monitor for executed processes that may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

Tactics: TA0007
Techniques: T1049
Input: FinFisher creates a new Windows service with the malicious executable for persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: A Destover-like implant used by Lazarus Group can obtain the current system time and send it to the C2 server.

Tactics: TA0007
Techniques: T1124
Input: Most cloud environments support separate virtual private cloud (VPC) instances that enable further segmentation of cloud systems.

Tactics: TA0003
Techniques: T1136, T1136.003, T1098.001, T1098
Input: OSX_OCEANLOTUS.D has disguised its app bundle by adding special characters to the filename and using the icon for legitimate Word documents.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Kimsuky has sent spearphishing emails containing a link to a document that contained malicious macros or took the victim to an actor-controlled domain.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Domain trusts allow the users of the trusted domain to access resources in the trusting domain.

Tactics: TA0007
Techniques: T1482
Input: Dridex's strings are obfuscated using RC4.

Tactics: TA0005
Techniques: T1027
Input: Monitor for contextual data about a group which describes group and activity around it.

Tactics: TA0007
Techniques: T1069
Input: Such signaling may also be used to open a closed service port such as telnet, or to trigger module modification of malware implants on the device, adding, removing, or changing malicious capabilities.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205
Input: Enabling SMB Signing can stop NTLMv2 relay attacks.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: Security controls such as web content filters may not identify smuggled malicious files inside of HTML/JS files, as the content may be based on typically benign MIME types such as text/plain and/or text/html.

Tactics: TA0005
Techniques: T1027.006, T1027
Input: The COR_PROFILER is a .NET Framework feature which allows developers to specify an unmanaged (or external of .NET) profiling DLL to be loaded into each .NET process that loads the Common Language Runtime (CLR).

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.012, T1574
Input: BADNEWS encrypts C2 data with a ROR by 3 and an XOR by 0x23.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: For example, in AWS an adversary may disable CloudWatch/CloudTrail integrations prior to conducting further malicious activity.

Tactics: TA0005
Techniques: T1562.008, T1562
Input: Monitor for operations (execution, copies, ) with file names that contain colons.

Tactics: TA0005
Techniques: T1564, T1564.004
Input: If this function is successfully loaded, it will ultimately spawn a new instance of itself with the Rundll32Call export via a call to rundll32.exe

Tactics: TA0005
Techniques: T1218, T1218.011
Input: This is very similar to Process Hollowing but targets an existing process rather than creating a process in a suspended state.

Tactics: TA0004, TA0005
Techniques: T1055.003, T1055
Input: Adversaries may abuse CMSTP to proxy execution of malicious code.

Tactics: TA0005
Techniques: T1218, T1218.003
Input: Endpoint systems may be compromised through browsing to adversary controlled sites, as in Drive-by Compromise.

Tactics: TA0042
Techniques: T1608.004, T1608
Input: Pasam creates a backdoor through which remote attackers can retrieve information such as hostname and free disk space.

Tactics: TA0007
Techniques: T1082
Input: menuPass has used tcping.exe, similar to Ping, to probe port status on systems of interest.

Tactics: TA0007
Techniques: T1046
Input: Run keys may exist under multiple hives.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Once the OAuth access token is granted, the application can gain potentially long-term access to features of the user account through Application Access Token.

Tactics: TA0006
Techniques: T1528
Input: Magic Hound malware can list a victim's logical drives and the type, as well the total/free space of the fixed devices.

Tactics: TA0007
Techniques: T1083
Input: BendyBear can check for analysis environments and signs of debugging using the Windows API kernel32!GetTickCountKernel32 call.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Additionally, adversaries may use Masquerading techniques (such as changing DLL file names, file extensions, or function names) to further conceal execution of a malicious payload.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: It also uses a custom XOR algorithm to obfuscate code.

Tactics: TA0005
Techniques: T1027
Input: APT32 has set up Dropbox, Amazon S3, and Google Drive to host malicious downloads.

Tactics: TA0042
Techniques: T1583.006, T1583
Input: REvil can use WMI to monitor for and kill specific processes listed in its configuration file.

Tactics: TA0002
Techniques: T1047
Input: It also uses a one-byte xor against 0x91 to encode configuration data.

Tactics: TA0005
Techniques: T1027
Input: T9000 gathers and beacons the system time during installation.

Tactics: TA0007
Techniques: T1124
Input: SombRAT has the ability to use an embedded SOCKS proxy in C2 communications.

Tactics: TA0011
Techniques: T1090
Input: Emissary has the capability to execute the command net localgroup administrators.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: CopyKittens digitally signed an executable with a stolen certificate from legitimate company AI Squared.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: CaddyWiper can enumerate all files and directories on a compromised host.

Tactics: TA0007
Techniques: T1083
Input: It communicates with ftp.bytehost31[.]org via FTP for command and control (C2)

Tactics: TA0011
Techniques: T1071
Input: Use host-based security software to block LLMNR/NetBIOS traffic.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: Pass the hash (PtH) is a method of authenticating as a user without having access to the user's cleartext password.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: Cyclops Blink can use various Linux API functions including those for execution and discovery.

Tactics: TA0002
Techniques: T1106
Input: NetWire has a built-in keylogger that can capture inputs from peripheral devices such as USB card readers

Tactics: TA0006, TA0009
Techniques: T1056
Input: APT19 has obtained and used publicly-available tools like Empire.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies.

Tactics: TA0005
Techniques: T1218.009, T1218
Input: Gazer can execute a task to download a file.

Tactics: TA0011
Techniques: T1105
Input: Deny remote use of local admin credentials to log into systems.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Deep Panda uses net.exe to connect to network shares using net use commands with compromised credentials.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Adversaries may modify system firmware to persist on systems.The BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) or Extensible Firmware Interface (EFI) are examples of system firmware that operate as the software interface between the operating system and hardware of a computer.

Tactics: TA0003, TA0005
Techniques: T1542.001, T1542
Input: The setuid and setguid bits are indicated with an "s" instead of an "x" when viewing a file's attributes via ls -l. The find command can also be used to search for such files.

Tactics: TA0004, TA0005
Techniques: T1548, T1548.001
Input: They have also used zero-day exploits.

Tactics: TA0002
Techniques: T1203
Input: MuddyWater has used malware that can upload additional files to the victim’s machine.

Tactics: TA0011
Techniques: T1105
Input: On Windows systems, the PSReadLine module tracks commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt by default).

Tactics: TA0005
Techniques: T1562.003, T1562
Input: MarkiRAT can store collected data locally in a created .nfo file.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: At installation, the MSI file drops three files and creates one hidden directory (UFile) into C:\ProgramData\Apple\Update\, likely as a ruse

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Monitor for unexpected files ( .pdf, .docx, .jpg, )  interacting with network shares.

Tactics: TA0009
Techniques: T1039
Input: Sandworm Team has used a large-scale botnet to target Small Office/Home Office (SOHO) network devices.

Tactics: TA0042
Techniques: T1584, T1584.005
Input: Repeated requests to those features may be able to exhaust system resources and deny access to the application or the server itself.

Tactics: TA0040
Techniques: T1499, T1499.003
Input: QakBot can enumerate a list of installed programs.

Tactics: TA0007
Techniques: T1518
Input: Monitor for changes made to files that may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: The command index table and command handler address table.  Implant Capabilities Based on the responses received from the control server, the malware can carry out the following malicious tasks:  Recursively generate a list of files in a directory and send to the control server Terminate a specific process

Tactics: TA0011
Techniques: T1102
Input: The creation of a new instance or VM is a common part of operations within many cloud environments.

Tactics: TA0005
Techniques: T1578.002, T1578