madox81/Adema_ATTACK_DS huggingface dataset:
Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Phishing).

Tactics: TA0043
Techniques: T1591.004, T1591
Input: Admin tools such as TeamViewer have been used by several groups targeting institutions in countries of interest to the Russian state and criminal campaigns.

Tactics: TA0011
Techniques: T1219
Input: These reviews should also check if new privileged cloud accounts have been created that were not authorized.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078.004, T1078
Input: Trojan.Karagany can gather information about the user on a compromised host.

Tactics: TA0007
Techniques: T1033
Input: Alternatively, an arbitrary DLL can be loaded if permissions allow writing a fully-qualified pathname for that DLL to HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.010
Input: AppleSeed can use a second channel for C2 when the primary channel is in upload mode.

Tactics: TA0011
Techniques: T1008
Input: ScreenSaveActive - set to '1' to enable the screensaver

Tactics: TA0003, TA0004
Techniques: T1546, T1546.002
Input: Defenders should also check their analysis tools to ensure they do not interpret the RTLO character and instead print the true name of the file containing it.

Tactics: TA0005
Techniques: T1036, T1036.002
Input: Threat Group-3390 actors use NBTscan to discover vulnerable systems.

Tactics: TA0007
Techniques: T1016
Input: Upon opening the attachment (and potentially clicking past protections), the adversary's payload exploits a vulnerability or directly executes on the user's system.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Bonadan has maliciously altered the OpenSSH binary on targeted systems to create a backdoor.

Tactics: TA0003
Techniques: T1554
Input: Wiarp creates a backdoor through which remote attackers can create a service.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: For example, through behaviors such as Modify System Image, Reduce Key Space, and Disable Crypto Hardware, an adversary can negatively effect and/or eliminate a device’s ability to securely encrypt network traffic.

Tactics: TA0005
Techniques: T1600
Input: Industroyer downloads a shellcode payload from a remote C2 server and loads it into memory.

Tactics: TA0011
Techniques: T1105
Input: SoreFang can download additional payloads from C2.

Tactics: TA0011
Techniques: T1105
Input: It appears the same actor developed both the Komplex and XAgentOSX tools, based on similarities within the following project paths found within the tools: Komplex: /Users/kazak/Desktop/Project/komplex XAgent OSX: /Users/kazak/Desktop/Project/XAgentOSX We believe it is possible that Sofacy uses Komplex to download and install the XAgentOSX tool to use its expanded command set on the compromised system

Tactics: TA0007
Techniques: T1087
Input: Adversaries can add other programs or processes to this registry value which will automatically launch at boot.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: The lnk files were an especially interesting development because the powershell code they contain for decoding and dropping the payload is nearly identical to that utilized by the Zebrocy threat actor a month earlier

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: KeyBoy uses Python scripts for installing files and performing execution.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: QuarantineEvents is a SQLite database containing a list of all files assigned the com.apple.quarantine attribute, located at ~/Library/Preferences/com.apple.LaunchServices.QuarantineEventsV2.

Tactics: TA0005
Techniques: T1553.001, T1553
Input: Malware researchers can reverse engineer malware variants that use DGAs and determine future domains that the malware will attempt to contact, but this is a time and resource intensive effort.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: In AWS and GCP environments, adversaries can trigger a request for a short-lived access token with the privileges of another user account.

Tactics: TA0005, TA0008
Techniques: T1550.001, T1550
Input: Monitor for API calls that may attempt to gather information about the system language of a victim in order to infer the geographical location of that host.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: Lslsass can dump active logon session password hashes from the lsass process.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Double-clicking a .cpl file also causes rundll32.exe to execute.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Look for strings or other signatures left in system artifacts related to decoding steganography.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: JHUHUGIT performs code injection injecting its own functions to browser processes.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Adversaries may use flaws in the permissions for Registry keys related to services to redirect from the originally specified executable to one that they control, in order to launch their own code when a service starts.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.011, T1574
Input: Monitor for network traffic associated with requests and/or downloads of container images, especially those that may be anomalous or known malicious.

Tactics: TA0005
Techniques: T1612
Input: HermeticWiper can enumerate common folders such as My Documents, Desktop, and AppData.

Tactics: TA0007
Techniques: T1083
Input: UPPERCUT has the capability to gather the system’s hostname and OS version.

Tactics: TA0007
Techniques: T1082
Input: They may also be found as parameters to deployment commands in container logs.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: Perform regular firmware updates to mitigate risks of exploitation and/or abuse.

Tactics: TA0003, TA0005
Techniques: T1542.002, T1542
Input: APT28 has used a variety of utilities, including WinRAR, to archive collected data with password protection.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Consider using application control to prevent execution of binaries that are susceptible to abuse and not required for a given system or network.

Tactics: TA0005
Techniques: T1218
Input: One variant of Zebrocy uses WMI queries to gather information.

Tactics: TA0002
Techniques: T1047
Input: Some third party utilities may be preinstalled, such as tar on Linux and macOS or zip on Windows systems.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is compressed with Zlib, encrypted, and uploaded to a C2 server.

Tactics: TA0009
Techniques: T1560.002, T1560
Input: Indrik Spider used fake updates for FlashPlayer plugin and Google Chrome as initial infection vectors.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: MacOS users can leverage Endpoint Security Framework file events monitoring these specific files.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: The following screensaver settings are stored in the Registry (HKCU\Control Panel\Desktop\) and could be manipulated to achieve persistence:

Tactics: TA0003, TA0004
Techniques: T1546, T1546.002
Input: Blue Mockingbird has used Mimikatz to retrieve credentials from LSASS memory.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Script blocking extensions can help prevent the execution of scripts and HTA files that may commonly be used during the exploitation process.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Crutch has staged stolen files in the C:\AMD\Temp directory.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: FoggyWeb can be disguised as a Visual Studio file such as Windows.Data.TimeZones.zh-PH.pri to evade detection.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Gamaredon Group has incorporated dynamic DNS domains in its infrastructure.

Tactics: TA0011
Techniques: T1568
Input: Gorgon Group attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Monitor unexpected changes and/or interactions with termsrv.dll, which is typically stored in %SystemRoot%\System32\.

Tactics: TA0003
Techniques: T1505.005, T1505
Input: Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service binary target path locations.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.010, T1574
Input: The security software will likely be targeted directly for exploitation.

Tactics: TA0005
Techniques: T1211
Input: Automatically forward events to a log server or data repository to prevent conditions in which the adversary can locate and manipulate data on the local system.

Tactics: TA0005
Techniques: T1070, T1070.002, T1070.001
Input: Loadable Kernel Modules (LKMs) are pieces of code that can be loaded and unloaded into the kernel upon demand.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: Irdsnhrxxxfery64 manipulation on userinit.exe & unins000.exe Injection Technique To Increase Stealthiness After locating one of the target processes, the malware uses Process Hollowing (MITRE Technique T1093) to evasively create a new process from a legitimate source

Tactics: TA0004, TA0005, TA0007
Techniques: T1057, T1055.012, T1055
Input: TeamTNT uses malware that adds cryptocurrency miners as a service.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Once decrypted, we are provided with a large list of strings, as seen below (note that the data has been truncated for brevity):  Figure 12 Decrypted strings from embedded BMP file After these strings are decrypted, the malware will load a series of Microsoft Windows API calls to be used later on

Tactics: TA0005
Techniques: T1140
Input: Threat Group-3390 actors have used gsecdump to dump credentials.

Tactics: TA0006
Techniques: T1003, T1003.002, T1003.004
Input: Disable SSH if it is not necessary on a host or restrict SSH access for specific users/groups using /etc/ssh/sshd_config.

Tactics: TA0003
Techniques: T1098.004, T1098
Input: CSPY Downloader can bypass UAC using the SilentCleanup task to execute the binary with elevated privileges.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Cache.dll connectback urls: 209.200.83.43/ajax/links.php 209.200.83.43/ajax/api.php 209.200.83.43/ajax/index.php 209.200.83.43/ajax/error.php 209.200.83.43/ajax/profile.php 209.200.83.43/ajax/online.php 209.200.83.43/ajax/loader.php 209.200.83.43/ajax/search.php Observed user-agent string on the wire, but it’s dynamically generated based on the Windows system settings (retrieved using standard win32 api “ObtainUserAgentString”): “User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727; .NET CLR 3.0.04506.648; .NET CLR 3.5.21022)” Communications with the CozyDuke C2 include key/value pairs passed as URL parameters

Tactics: TA0002, TA0007
Techniques: T1087, T1106
Input: Derusbi variants have been seen that use Registry persistence to proxy execution through regsvr32.exe.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: CharmPower can use PowerShell for payload execution and C2 communication.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Create Run Key)   0x1234 512 Folder to Install   0x1434 512 Service Name   0x1634 512 Service Display Name   0x1834 512 Service Description   0x1a34 4 Registry Root Key Value for Run Registry Key Configuration   0x1a38 512 Run Registry Key Name   0x1c38 512 Run Registry Key Value   0x1e38 4 Enable/Disable Code injection   0x1e3c 512 * 4 Program Name for Code Injection x 4   0x263c 4 Enable/Disable Code injection for UAC Bypass   0x2640 512 * 4 Program Name to inject code for UAC Bypass x 4   0x2e40 512 Authentication Character String for PlugX   0x3040 512 Authentication Character String for C&C Server   0x3240 512 Mutex Name   0x3440 4 Enable/Disable Screen Capture   0x3444 4 * 5 Screen Capture Configuration Value   0x3458 528 Folder to Store Screen Captures   0x3658 4 Enable/Disable P2P(TCP)   0x365c 4 P2P(TCP) Port Number   0x3660 4 Enable/Disable P2P(UDP)   0x3664 4 P2P(UDP) Port Number   0x3668 4 Enable/Disable P2P(ICMP)   0x366c 4 P2P(ICMP) Port Number   0x3670 4 Enable/Disable P2P(IP Protocol Number 255)   0x3674 4 P2P(IP Protocol Number 255) Port Number   0x3678 4 Enable/Disable P2P Scanning   0x367c 4 * 4 P2P Scanning Beginning Address x 4   0x368c 4 * 4 P2P Scanning End Address x 4   0x369c 6 Run program if this MAC Address is used   0x36a2 2 Not used    Appendix B:  SHA-256 hash value of P2P PlugX  bc65e2859f243ff45b12cd184bfed7b809f74e67e5bb61bc92ed94058d3d2515 93c85a8dd0becc4e396eea2dc15c0010ff58d2b873d44fd7e45711a27cfe613b 0ff134057a8b2e31b148fedfdd185f5b1a512149499a8c5c0915cf10b10a613e         朝長 秀誠 (Shusei Tomonaga)  Since December 2012, he has been engaged in malware analysis and forensics investigation, and is especially involved in analyzing incidents of targeted attacks

Tactics: TA0003, TA0004, TA0005
Techniques: T1547.001, T1547, T1562.001, T1548.002, T1548, T1562
Input: Gaining access to the host may provide the adversary with the opportunity to achieve follow-on objectives, such as establishing persistence, moving laterally within the environment, or setting up a command and control channel on the host.

Tactics: TA0004
Techniques: T1611
Input: Monitor executed commands and arguments for actions that could be taken to gather tasks may also be created through Windows system management tools such as Windows Management Instrumentation and PowerShell, so additional logging may need to be configured to gather the appropriate data.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: The malicious DLL is not a service DLL because it lacks ServiceMain()

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: PowerShell supports several profiles depending on the user or host program.

Tactics: TA0003, TA0004
Techniques: T1546.013, T1546
Input: Maze has issued a shutdown command on a victim machine that, upon reboot, will run the ransomware within a VM.

Tactics: TA0040
Techniques: T1529
Input: Hydraq creates a backdoor through which remote attackers can monitor services.

Tactics: TA0007
Techniques: T1007
Input: Figure 3: Script code embedded in 29[.]html used to download and run Revenge RAT The script shown in Figure 4 is almost identical to the one used by the script contents of 29[.]html (in Figure 3), the only difference being the absence of a sleep command and the usage of the “forfiles” utility

Tactics: TA0002
Techniques: T1059
Input: Embed "scriptlets" in generated payloads to perform some tasks "offline" without needing network connectivity (ex: start keylogger, add persistence, execute custom python script, check_vm, etc.)   Multiple Target Platforms:      Platform Support Status     Windows XP Supported   Windows 7 Supported   Windows 8 Supported   Windows 10 Supported   Linux Supported   Mac OSX Limited Support   Android Limited Support    Documentation All documentation can be found on the wiki

Tactics: TA0002, TA0007
Techniques: T1106, T1010
Input: For operations incorporating social engineering, the utilization of a persona on social media may be important.

Tactics: TA0042
Techniques: T1585, T1585.001
Input: Monitor for newly constructed .LNK, .SCF, or any other files on systems and within virtual environments that contain resources that point to external network resources

Tactics: TA0006
Techniques: T1187
Input: Global LSA secret (G$MSRADIUSCHAPKEY)

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.005
Input: LockerGoga has encrypted files, including core Windows OS files, using RSA-OAEP MGF1 and then demanded Bitcoin be paid for the decryption key.

Tactics: TA0040
Techniques: T1486
Input: In Windows, when files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

Tactics: TA0005
Techniques: T1553, T1553.005
Input: Diavol can attempt to stop security software.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: PowerDuke uses steganography to hide backdoors in PNG files, which are also encrypted using the Tiny Encryption Algorithm (TEA).

Tactics: TA0005
Techniques: T1027.003, T1027
Input: Configure settings for scheduled tasks to force tasks to run under the context of the authenticated account instead of allowing them to run as SYSTEM.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053, T1053.002
Input: Spearphishing for information is an attempt to trick targets into divulging information, frequently credentials or other actionable information.

Tactics: TA0043
Techniques: T1598.001, T1598.002, T1598, T1598.003
Input: One variant of BlackEnergy creates a new service using either a hard-coded or randomly generated name.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: gsecdump

Tactics: TA0006
Techniques: T1003, T1003.002
Input: Conti can use CreateIoCompletionPort(), PostQueuedCompletionStatus(), and GetQueuedCompletionPort() to rapidly encrypt files, excluding those with the extensions of .exe, .dll, and .lnk.

Tactics: TA0040
Techniques: T1486
Input: DarkComet adds several Registry entries to enable automatic execution at every system startup.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: The last query is to the subdomain ihc[.]stage[.]12019683[.]ns2[.]true-deals[.]com):   The delivered second stage shellcode is encrypted:  METERPRETER: After decryption of the second stage shellcode, the shellcode deletes the ‘MZ’ prefix from within a very important part of the shellcode

Tactics: TA0002, TA0005
Techniques: T1027, T1059
Input: Therefore discovery data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Lateral Movement, based on the information obtained.

Tactics: TA0007
Techniques: T1087.002, T1087, T1087.004, T1087.001
Input: Monitor for API calls (such as NetUserEnum()) that may attempt to gather local accounts information such as type of user, privileges and groups.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Evilnum has used malicious JavaScript files on the victim's machine.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Detection is challenging because all messages forwarded because of an auto-forwarding rule have the same presentation as a manually forwarded message.

Tactics: TA0009
Techniques: T1114, T1114.003
Input: Backdoor.Oldrea collects information about running processes.

Tactics: TA0007
Techniques: T1057
Input: Sibot has also used the Win32_Process class to execute a malicious DLL.

Tactics: TA0002
Techniques: T1047
Input: Adversaries may gather information about the victim's network trust dependencies that can be used during targeting.

Tactics: TA0043
Techniques: T1590, T1590.003
Input: Ursnif has also been used to download and execute additional payloads.

Tactics: TA0011
Techniques: T1105
Input: APT41 used certutil to download additional files.

Tactics: TA0011
Techniques: T1105
Input: jRAT has the capability to log keystrokes from the victim’s machine, both offline and online.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: This strangeness was related to values listed in newer BlackEnergy configuration files

Tactics: TA0005
Techniques: T1027
Input: The actors also searched for documents based on a specific date range and attempted to identify all installed software on a victim.

Tactics: TA0007
Techniques: T1083
Input: SCRNSAVE.exe - set to malicious PE path

Tactics: TA0003, TA0004
Techniques: T1546, T1546.002
Input: APT41 used exploit payloads that initiate download via ftp.

Tactics: TA0011
Techniques: T1071.002, T1071
Input: The CozyCar dropper has masqueraded a copy of the infected system's rundll32.exe executable that was moved to the malware's install directory and renamed according to a predefined configuration file.

Tactics: TA0005
Techniques: T1036.003, T1036
Input: FIN7 created a custom video recording capability that could be used to monitor operations in the victim's environment.

Tactics: TA0009
Techniques: T1125
Input: Endpoint sensing or network sensing can potentially detect malicious events once the file is opened (such as a Microsoft Word document or PDF reaching out to the internet or spawning powershell.exe).

Tactics: TA0002
Techniques: T1204.002, T1204
Input: One of Attor's plugins can collect user credentials via capturing keystrokes and can capture keystrokes pressed within the window of the injected process.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Look for inconsistencies between the various fields that store PPID information, such as the EventHeader ProcessId from data collected via Event Tracing for Windows (ETW), Creator Process ID/Name from Windows event logs, and the ProcessID and ParentProcessID (which are also produced from ETW and other utilities such as Task Manager and Process Explorer).

Tactics: TA0004, TA0005
Techniques: T1134.004, T1134
Input: Efforts should focus on minimizing the amount and sensitivity of data available to external parties.

Tactics: TA0043
Techniques: T1591.004, T1589.003, T1595.003, T1592, T1595.001, T1589.002, T1589, T1592.002, T1593, T1591.002, T1589.001, T1592.004, T1590, T1590.005, T1594, T1591, T1595, T1593.001, T1593.002, T1595.002, T1590.001
Input: Decrypted backdoor configuration Reverse analysis of TClient allowed us to determine how to decrypt the C&C information

Tactics: TA0005
Techniques: T1140
Input: Monitor for unusual kernel driver installation activity that may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.012
Input: Machete’s downloaded data is decrypted using AES.

Tactics: TA0005
Techniques: T1140
Input: Monitor for executed processes that may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls.

Tactics: TA0004, TA0005
Techniques: T1134
Input: APT29 has used social media platforms to hide communications to C2 servers.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: APT38 used a Trojan called KEYLIME to capture keystrokes from the victim’s machine.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Adversaries may attempt to access detailed information about the password policy used within an enterprise network or cloud environment.

Tactics: TA0007
Techniques: T1201
Input: Another JHUHUGIT variant has the capability to delete specified files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: PsExec can be used to download or upload a file over a network share.

Tactics: TA0008
Techniques: T1570
Input: TYPEFRAME can upload and download files to the victim’s machine.

Tactics: TA0011
Techniques: T1105
Input: build_downer has the ability to determine the local time to ensure malware installation only happens during the hours that the infected system is active.

Tactics: TA0007
Techniques: T1124
Input: ROCKBOOT is a Master Boot Record (MBR) bootkit that uses the MBR to establish persistence.

Tactics: TA0003, TA0005
Techniques: T1542.003, T1542
Input: Inception has used specific malware modules to gather domain membership.

Tactics: TA0007
Techniques: T1069.002, T1069
Input: SharpStage has the ability to download and execute additional payloads via a DropBox API.

Tactics: TA0011
Techniques: T1105
Input: BADNEWS establishes a backdoor over HTTP.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Explosive has a function to call the OpenClipboard wrapper.

Tactics: TA0002
Techniques: T1106
Input: The Azure CLI (AZ CLI) also provides an interface to obtain user accounts with authenticated access to a domain.

Tactics: TA0007
Techniques: T1087, T1087.004
Input: Take snapshots of boot records and firmware and compare against known good images.

Tactics: TA0003, TA0005
Techniques: T1542
Input: Astaroth collects information from the clipboard by using the OpenClipboard() and GetClipboardData() libraries.

Tactics: TA0009
Techniques: T1115