madox81/Adema_ATTACK_DS huggingface dataset:
Input: Ensure proper system and access isolation for critical network systems through use of group policy.

Tactics: TA0002, TA0008
Techniques: T1072
Input: SysUpdate can load DLLs through vulnerable legitimate executables.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: JPIN can obtain network information, including DNS, IP, and proxies.

Tactics: TA0007
Techniques: T1016
Input: Night Dragon used privately developed and customized remote access tools.

Tactics: TA0042
Techniques: T1587, T1587.001
Input: Epic uses the nbtstat -n and nbtstat -s commands on the victim’s machine.

Tactics: TA0007
Techniques: T1016
Input: The command does not attempt to kill the specific Office process that would load the particular delivery document, such as Excel in the case of this “.xlam” file, but instead attempts to kill processes associated with Word, Excel, PowerPoint and Publisher

Tactics: TA0007
Techniques: T1057
Input: Different ways to achieve this exist, including TCP state-exhaustion attacks such as SYN floods and ACK floods.

Tactics: TA0040
Techniques: T1499, T1499.001
Input: Sidewinder has used JavaScript to drop and execute malware loaders.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: A common use for this is when applications run in the system tray, but don't also want to show up in the Dock.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: PlugX can use RC4 encryption in C2 communications.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Cryptoistic has the ability delete files from a compromised host.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: HotCroissant has the ability to retrieve a list of files in a given directory as well as drives and drive types.

Tactics: TA0007
Techniques: T1083
Input: APT39 has used tools for capturing keystrokes.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: The WhisperGate third stage can use the AdvancedRun.exe tool to execute commands in the context of the Windows TrustedInstaller group.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.001
Input: Ensure proper user permissions are in place to prevent adversaries from disabling or modifying firewall settings.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: APT41 exploited CVE-2020-10189 against Zoho ManageEngine Desktop Central, and CVE-2019-19781 to compromise Citrix Application Delivery Controllers (ADC) and gateway devices.

Tactics: TA0001
Techniques: T1190
Input: HiddenWasp encrypts its configuration and payload.

Tactics: TA0005
Techniques: T1027
Input: Monitor for newly executed processes that can be used to discover remote systems, such as ping.exe and tracert.exe, especially when executed in quick succession.

Tactics: TA0007
Techniques: T1018
Input: Monitor for changes made to windows registry keys or values.

Tactics: TA0005
Techniques: T1112
Input: Magic Hound gathered credentials from two victims that they then attempted to validate across 75 different websites.

Tactics: TA0043
Techniques: T1589, T1589.001
Input: This type of Network DoS takes advantage of a third-party server intermediary that hosts and will respond to a given spoofed source IP address.

Tactics: TA0040
Techniques: T1498, T1498.002
Input: zwShell can obtain the victim IP address.

Tactics: TA0007
Techniques: T1016
Input: Zebrocy collects the OS version, computer name and serial number for the storage volume C:.

Tactics: TA0007
Techniques: T1082
Input: Monitor for changes made to windows registry keys or values that may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware.

Tactics: TA0005
Techniques: T1070
Input: QakBot has collected usernames and passwords from Firefox and Chrome.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: SHA256 Filename PowerShell Filename Variant   5f001f3387ddfc0314446d0c950da2cec4c786e2374d42beb3acce6883bb4e63 <redacted> Technical Services.exe Office365DCOMCheck.ps1 Bat2exe   d948d5b3702e140ef5b9247d26797b6dcdfe4fdb6f367bb217bc6b5fc79df520 tafahom.exe, Sales Modification.exe SystemDiskClean.ps1 .NET    Table 1

Tactics: TA0005
Techniques: T1036
Input: Any matching files are encrypted and written to a local user directory.

Tactics: TA0009
Techniques: T1119
Input: NavRAT creates a Registry key to ensure a file gets executed upon reboot in order to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Conficker has obfuscated its code to prevent its removal from host machines.

Tactics: TA0005
Techniques: T1027
Input: What does the resulting watering hole look like? The websites were compromised to redirect visitors to instances of both ScanBox and BEeF

Tactics: TA0001
Techniques: T1189
Input: The actors have also disabled proxy settings to allow direct communication from victims to the Internet.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: FIN7 has downloaded additional malware to execute on the victim's machine, including by using a PowerShell script to launch shellcode that retrieves an additional payload.

Tactics: TA0011
Techniques: T1105
Input: If detection of the obfuscation itself is not possible, it may be possible to detect the malicious activity that caused the obfuscated file (for example, the method that was used to write, read, or modify the file on the file system).

Tactics: TA0005
Techniques: T1027
Input: APT37 has sent spearphishing attachments attempting to get a user to open them.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: The use of cloud infrastructure can also make it easier for adversaries to rapidly provision, modify, and shut down their infrastructure.

Tactics: TA0042
Techniques: T1583.003, T1583
Input: Elise exfiltrates data using cookie values that are Base64-encoded.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Bazar can use Nltest tools to obtain information about the domain.

Tactics: TA0007
Techniques: T1482
Input: Many of these protections depend on the architecture and target application binary for compatibility and may not work for software targeted for defense evasion.

Tactics: TA0005
Techniques: T1211
Input: Metamorfo has a command to delete a Registry key it uses, \Software\Microsoft\Internet Explorer\notes.

Tactics: TA0005
Techniques: T1070
Input: Here is the content of the file: /shellcode <90909090909090909090E800<...redacted…>4D2D6DC95CBD5DC1811111111111111> def <7B0D0A2756...redacted…>312067657420636C6F736566696C650D0A717569740D0A7D> token pop exch pop Exec  The executed shellcode will first perform a decoding routine designed to download an additional payload from the internet

Tactics: TA0002, TA0011
Techniques: T1105, T1059
Input: Limit access to the root account and prevent users from modifying PAM components through proper privilege separation (ex SELinux, grsecurity, AppArmor, ) and limiting Privilege Escalation opportunities.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.003, T1556
Input: Turla has used HTTP and HTTPS for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Windows allows programs to have direct access to logical volumes.

Tactics: TA0005
Techniques: T1006
Input: Virtualization, sandbox, user activity, and related discovery techniques will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Ptrace system call injection may not be possible targeting processes that are non-child processes and/or have higher-privileges.

Tactics: TA0004, TA0005
Techniques: T1055.008, T1055
Input: Crimson can check the Registry for the presence of HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\last_edate to determine how long it has been installed on a host.

Tactics: TA0007
Techniques: T1012
Input: DCShadow may be used to create a rogue Domain Controller (DC).

Tactics: TA0005
Techniques: T1207
Input: For example, From <COMPUTER-NAME> (01-04 11-40-02).txt  All the text files are now packed into the archive temp.zip (%temp%\temp.zip) zip is Base64 encoded (with a custom key, same as that used in the malicious document) and then copied to post.txt txt is uploaded to the control server  Additional Commands and Capabilities The service-based DLL implant traverses to the /htdocs/ directory on the FTP server and looks for any files with the keywords:  TO EVERYONE: Commands issued to all infected endpoints TO <COMPUTERNAME>: Commands issued to endpoints matching the ComputerName  The following commands are supported by the malware implant:  cmd /c pull <filename>: Adds filename to temp.zip, Base64 encodes, and uploads to control server cmd /c chip <string>: Deletes current ipnet.ini config file

Tactics: TA0002, TA0009, TA0011
Techniques: T1132, T1560, T1059
Input: Symantec and Norton products offer the following detections: Antivirus  Backdoor.Pirpi Backdoor.Pirpi!dr Backdoor.Pirpi!gen1 Backdoor.Pirpi!gen2 Backdoor.Pirpi!gen3 Backdoor.Pirpi!gen4 Backdoor.Pirpi.A Backdoor.Pirpi.B Backdoor.Pirpi.C Backdoor.Pirpi.D Downloader.Pirpi Downloader.Pirpi!g1  Intrusion prevention system  System Infected: Backdoor.Pirpi Activity 3  Update–September 14, 2016: Indicators of compromise We have compiled a list of indicators of compromise for the campaigns described in this blog

Tactics: TA0004, TA0005, TA0007, TA0009, TA0011, TA0010
Techniques: T1140, T1041, T1070, T1005, T1518.001, T1090.003, T1083, T1518, T1560, T1571, T1008, T1090, T1070.004, T1134
Input: The email may also contain instructions on how to decrypt an attachment, such as a zip file password, in order to evade email boundary defenses.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: The file appears to have been compiled using a bat2exe tool, which will take batch files (.bat) and convert them to PE (.exe) files

Tactics: TA0007
Techniques: T1083
Input: Calisto has the capability to upload and download files to the victim's machine.

Tactics: TA0011
Techniques: T1105
Input: InvisiMole has used rundll32.exe for execution.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: JHUHUGIT has exploited CVE-2015-1701 and CVE-2015-2387 to escalate privileges.

Tactics: TA0004
Techniques: T1068
Input: Required Launch Daemons parameters include a Label to identify the task, Program to provide a path to the executable, and RunAtLoad to specify when the task is run.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: Alternatively, the adversary may send an AS-REQ message for each user.

Tactics: TA0006
Techniques: T1558, T1558.004
Input: PoisonIvy creates a backdoor through which remote attackers can upload files.

Tactics: TA0011
Techniques: T1105
Input: Keylogging Functionality XAgent also has a keylogger functionality that allows the threat actors to steal credentials as the user types them

Tactics: TA0006, TA0009
Techniques: T1056
Input: Grandoreiro has used compromised websites and Google Ads to bait victims into downloading its installer.

Tactics: TA0001
Techniques: T1189
Input: Responder captures hashes and credentials that are sent to the system after the name services have been poisoned.

Tactics: TA0006, TA0007
Techniques: T1040
Input: OSX_OCEANLOTUS.D can create a persistence file in the folder /Library/LaunchAgents.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: Modifying infrastructure components may also allow an adversary to evade detection and remove evidence of their presence.

Tactics: TA0005
Techniques: T1578
Input: If this fails, it attempts to add Registry Run keys.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Netwalker's DLL has also been embedded within the PowerShell script in hex format.

Tactics: TA0005
Techniques: T1027
Input: This behavior is distinct from Data Destruction because sections of the disk are erased instead of individual files.

Tactics: TA0040
Techniques: T1561.001, T1561
Input: Ryuk has enumerated files and folders on all mounted drives.

Tactics: TA0007
Techniques: T1083
Input: Kimsuky has used Blogspot pages for C2.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: These service processes may automatically execute specific binaries as part of their functionality or to perform other actions.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.010, T1574
Input: Whitefly has used Mimikatz to obtain credentials.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Monitor for API calls that may search for common password storage locations to obtain user credentials.

Tactics: TA0006
Techniques: T1555.005, T1555
Input: It should be noted that this kind of blocking may be circumvented by other techniques like Domain Fronting.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: There are many ways an adversary can hijack DLL loads.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Kimsuky has been observed disabling the system firewall.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: BlackTech has used stolen code-signing certificates for its malicious payloads.

Tactics: TA0042
Techniques: T1588, T1588.003
Input: Employ heuristic-based malware detection.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: KONNI has been delivered via spearphishing campaigns through a malicious Word document.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Through COM, a client object can call methods of server objects, which are typically Dynamic Link Libraries (DLL) or executables (EXE).

Tactics: TA0008
Techniques: T1021.003, T1021
Input: Monitor logs and other sources of command execution history for actions that could be taken to gather information about accounts, including the use of calls to cloud APIs that perform account discovery.

Tactics: TA0007
Techniques: T1087
Input: The RAT, however, had a multitude of functionalities (as listed in the table below) such as to download and execute, compress, encrypt, upload, search directories, etc

Tactics: TA0011
Techniques: T1105
Input: Monitor for newly executed processes with arguments that can modify property list (plist) files.

Tactics: TA0005
Techniques: T1647
Input: Establish centralized logging for the activity of container and Kubernetes cluster components.

Tactics: TA0006
Techniques: T1552, T1552.007
Input: Adversaries may remove indicators from tools if they believe their malicious tool was detected, quarantined, or otherwise curtailed.

Tactics: TA0005
Techniques: T1027, T1027.005
Input: SeaDuke uses an event filter in WMI code to execute a previously dropped executable shortly after system startup.

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: HTTPBrowser's code may be obfuscated through structured exception handling and return-oriented programming.

Tactics: TA0005
Techniques: T1027
Input: Cobalt Strike can identify targets by querying account groups on a domain contoller.

Tactics: TA0007
Techniques: T1069.002, T1069
Input: The MPK IRC Bot monitors active application windows and writes the title of the open window along with the logged keystrokes to a file at “%temp%\Save.tmp”

Tactics: TA0007
Techniques: T1010
Input: Blue Mockingbird has gained initial access by exploiting CVE-2019-18935, a vulnerability within Telerik UI for ASP.NET AJAX.

Tactics: TA0001
Techniques: T1190
Input: FatDuke has attempted to mimic a compromised user's traffic by using the same user agent as the installed browser.

Tactics: TA0005
Techniques: T1036
Input: Sakula uses single-byte XOR obfuscation to obfuscate many of its files.

Tactics: TA0005
Techniques: T1027
Input: Invoking non-Microsoft .msc files may be an indicator of malicious activity.

Tactics: TA0005
Techniques: T1218, T1218.014
Input: Lizar can execute PE files in the address space of the specified process.

Tactics: TA0004, TA0005
Techniques: T1055.002, T1055
Input: Clean up old Windows Registry keys when software is uninstalled to avoid keys with no associated legitimate binaries.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.007, T1574.008, T1574.009, T1574
Input: RCSession can use HTTP in C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Figure 8 shows the network communication of the Pause.ps1 download

Tactics: TA0011
Techniques: T1105
Input: The AuditD monitoring tool, which ships stock in many Linux distributions, can be used to watch for hostile processes opening this file in the proc file system, alerting on the pid, process name, and arguments of such programs.

Tactics: TA0006, TA0007
Techniques: T1033, T1003, T1003.007
Input: Adversaries may gather information about the victim's DNS that can be used during targeting.

Tactics: TA0043
Techniques: T1590.002, T1590
Input: Operation Wocao has used the CreateProcessA and ShellExecute API function to launch commands after being injected into a selected process.

Tactics: TA0002
Techniques: T1106
Input: Diavol has obfuscated its main code routines within bitmap images as part of its anti-analysis techniques.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: Monitor executed command and arguments that may exfiltrate data to a code repository rather than over their primary command and control channel.

Tactics: TA0010
Techniques: T1567.001, T1567
Input: Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode.

Tactics: TA0005
Techniques: T1562.009, T1562
Input: BlackMould can send commands to C2 in the body of HTTP POST requests.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: APT29 has used encoded PowerShell commands.

Tactics: TA0005
Techniques: T1027
Input: SPACESHIP achieves persistence by creating a shortcut in the current user's Startup folder.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547.001, T1547
Input: Smoke Loader uses HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: BitPaymer can use the tokens of users to create processes on infected systems.

Tactics: TA0004, TA0005
Techniques: T1134, T1134.001
Input: Pteranodon copies itself to the Startup folder to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Adversaries may abuse AuthorizationExecuteWithPrivileges to obtain root privileges in order to install malicious software on victims and install persistence mechanisms.

Tactics: TA0004, TA0005
Techniques: T1548.004, T1548
Input: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers.

Tactics: TA0003, TA0004
Techniques: T1546.012, T1546
Input: Cyclops Blink can use non-standard ports for C2 not typically associated with HTTP or HTTPS traffic.

Tactics: TA0011
Techniques: T1571
Input: Monitor for newly executed processes that may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.

Tactics: TA0007
Techniques: T1135
Input: Blue Mockingbird has executed custom-compiled XMRIG miner DLLs by configuring them to execute via the "wercplsupport" service.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: QakBot can identify peripheral devices on targeted systems.

Tactics: TA0007
Techniques: T1120
Input: Ursnif has copied itself to and infected files in network drives for propagation.

Tactics: TA0008
Techniques: T1080
Input: Hi-Zor encrypts C2 traffic with TLS.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Emond is a Launch Daemon that accepts events from various services, runs them through a simple rules engine, and takes action.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.014
Input: Operators deploying Netwalker have used batch scripts to retrieve the Netwalker payload.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Monitor for abnormal access to files ( .pdf, .docx, .jpg, ), especially sensitive documents, through the use of automated processing after being gathered during Collection.

Tactics: TA0010
Techniques: T1020
Input: Turla has used a AMSI bypass, which patches the in-memory amsi.dll, in PowerShell scripts to bypass Windows antimalware products.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Chimera has staged stolen data locally on compromised hosts.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Empire can utilize built-in modules to modify service binaries and restore them to their original state.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Adversaries may gain persistence and elevate privileges by executing malicious content triggered by PowerShell profiles.

Tactics: TA0003, TA0004
Techniques: T1546.013, T1546
Input: While adversaries typically require root privileges to create/modify service unit files in the /etc/systemd/system and /usr/lib/systemd/system directories, low privilege users can create/modify service unit files in directories such as ~/.config/systemd/user/ to achieve user-level persistence.

Tactics: TA0003, TA0004
Techniques: T1543.002, T1543
Input: Determine if certain websites or attachment types (ex: .scr, .exe, .pif, .cpl, ) that can be used for phishing are necessary for business operations and consider blocking access if activity cannot be monitored well or if it poses a significant risk.

Tactics: TA0001
Techniques: T1566
Input: Adversaries may compromise social media accounts that can be used during targeting.

Tactics: TA0042
Techniques: T1586.001, T1586
Input: HermeticWizard can use WMI to create a new process on a remote machine via C:\windows\system32\cmd.exe /c start C:\windows\system32\\regsvr32.exe /s /iC:\windows\<filename>.dll.

Tactics: TA0002
Techniques: T1047
Input: Emotet has been observed using a hard coded list of passwords to brute force user accounts.

Tactics: TA0006
Techniques: T1110, T1110.001
Input: Monitor for executed commands and arguments for PowerShell cmdlets that can be used to retrieve or modify file and directory DACLs.

Tactics: TA0005
Techniques: T1222, T1222.001
Input: Derivative languages based on VB have also been created, such as Visual Basic for Applications (VBA) and VBScript.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Hildegard has searched for SSH keys, Docker credentials, and Kubernetes service tokens.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: POWERSTATS has detected security tools.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: 15 Database dump Decoded, it reveals a detailed log of each affected machine

Tactics: TA0006
Techniques: T1003
Input: HTRAN can inject into into running processes.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Hacking Team UEFI Rootkit is a UEFI BIOS rootkit developed by the company Hacking Team to persist remote access software on some targeted systems.

Tactics: TA0003, TA0005
Techniques: T1014, T1542.001, T1542
Input: Inception has ensured persistence at system boot by setting the value regsvr32 %path%\ctfmonrn.dll /s.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Shortcuts or symbolic links are ways of referencing other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Keydnap prompts the users for credentials.

Tactics: TA0006, TA0009
Techniques: T1056.002, T1056
Input: Wizard Spider has obtained and used publicly-available post-exploitation frameworks and tools like Metasploit, Empire, Mimikatz.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: With authenticated access there are several tools that can be used to find accounts.

Tactics: TA0007
Techniques: T1087, T1087.004
Input: Ferocious Kitten has obtained open source tools for its operations, including JsonCPP and Psiphon.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Access to Registry keys is controlled through access control lists and user permissions.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.011, T1574
Input: GoldenSpy can execute remote commands in the Windows command shell using the WinExec() API.

Tactics: TA0002
Techniques: T1106
Input: RAR Creates RAR files per logical drive containing data with timestamps for the past 7 days, then uploads RAR to the C2 server using a POST command at the path “/FeedBack.php”

Tactics: TA0009, TA0010
Techniques: T1041, T1560