madox81/Adema_ATTACK_DS huggingface dataset:
Input: Sykipot may use net group "domain admins" /domain to display accounts in the "domain admins" permissions group and net localgroup "administrators" to list local system administrator group membership.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: It is difficult to detect when hashes are cracked, since this is generally done outside the scope of the target network.

Tactics: TA0006
Techniques: T1110.004, T1110, T1110.002, T1110.003
Input: However, in some cases, adversaries can also steal application refresh tokens, allowing them to obtain new access tokens without prompting the user.

Tactics: TA0006
Techniques: T1528
Input: The credentials appear to have been stolen via multiple techniques, including using post-exploition password recovery tools such as MimiKatz or its variant ZhuMimiKatz

Tactics: TA0006
Techniques: T1003
Input: Stealth Falcon malware gathers passwords from the Windows Credential Vault.

Tactics: TA0006
Techniques: T1555, T1555.004
Input: Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence.

Tactics: TA0003, TA0004
Techniques: T1543
Input: XCSSET downloads browser specific AppleScript modules using a constructed URL with the curl command, https://" & domain & "/agent/scripts/" & moduleName & ".applescript.

Tactics: TA0011
Techniques: T1105
Input: Operation Wocao has obtained the password for the victim's password manager via a custom keylogger.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Adversaries may acquire user credentials from third-party password managers.

Tactics: TA0006
Techniques: T1555.005, T1555
Input: DLL side loading is often used to maintain persistence on the compromised system

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: Cobian RAT can launch a remote command shell interface for executing commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: RTM runs its core DLL file using rundll32.exe.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: VBShower used HKCU\Software\Microsoft\Windows\CurrentVersion\Run\[a-f0-9A-F]{8} to maintain persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: SharpStage can use WMI for execution.

Tactics: TA0002
Techniques: T1047
Input: Monitor changes made to cloud services for unexpected modifications to settings and/or data.

Tactics: TA0005
Techniques: T1562
Input: APT3 has been known to use -WindowStyle Hidden to conceal PowerShell windows.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Grandoreiro can obtain C2 information from Google Docs.

Tactics: TA0011
Techniques: T1102.001, T1102
Input: SLOTHFULMEDIA has enumerated processes by ID, name, or privileges.

Tactics: TA0007
Techniques: T1057
Input: Metamorfo has encrypted payloads and strings.

Tactics: TA0005
Techniques: T1027
Input: SilverTerrier uses SMTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.003
Input: KONNI has pretended to be the xmlProv Network Provisioning service.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Some of the key obfuscation techniques used are:   Character Replacement: Several instances of character replacement and string reversing techniques (Figure 10) make analysis difficult

Tactics: TA0005
Techniques: T1027
Input: Monitor for an attempts by a user to gain access to a network or computing resource, often by providing credentials via remote terminal services, that do not have a corresponding entry in a command history file.

Tactics: TA0005
Techniques: T1070, T1070.003
Input: Hancitor has used Base64 to encode malicious links.

Tactics: TA0005
Techniques: T1027
Input: Empire contains an implementation of Mimikatz to gather credentials from memory.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: FELIXROOT encrypts strings in the backdoor using a custom XOR algorithm.

Tactics: TA0005
Techniques: T1027
Input: Encryption malware may also leverage Internal Defacement, such as changing victim wallpapers, or otherwise intimidate victims by sending ransom notes or other messages to connected printers (known as "print bombing").

Tactics: TA0040
Techniques: T1486
Input: Blue Mockingbird has used mofcomp.exe to establish WMI Event Subscription persistence mechanisms configured from a *.mof file.

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: SYNful Knock can be sent instructions via special packets to change its functionality.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205
Input: APT29 wrote the encrypted and base64-encoded PowerShell backdoor code into that property

Tactics: TA0005
Techniques: T1027
Input: Emotet has been observed leveraging a module that can scrape email addresses from Outlook.

Tactics: TA0007
Techniques: T1087.003, T1087
Input: njRAT is capable of logging keystrokes.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: This differs from the previous OopsIE variant that used a hardcoded task name for the scheduled task

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: This exception invokes the exception handler containing the HTTP communication code, allowing it to run

Tactics: TA0005
Techniques: T1140
Input: Azorult has also downloaded a ransomware payload called Hermes.

Tactics: TA0011
Techniques: T1105
Input: MechaFlounder uses a python-based payload.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Once adversaries leverage the web service as infrastructure (ex: for command and control), it may be possible to look for unique characteristics associated with adversary software, if known.

Tactics: TA0042
Techniques: T1583.006, T1583
Input: Adversaries may also add their malicious applications to the list of minimal services that start in safe mode by modifying relevant Registry values ( Modify Registry).

Tactics: TA0005
Techniques: T1562.009, T1562
Input: APT32 ran legitimately-signed executables from Symantec and McAfee which load a malicious DLL.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: ComRAT has also used a unique password to decrypt the file used for its hidden file system.

Tactics: TA0005
Techniques: T1140
Input: It can also provide a reverse shell.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Comnie establishes persistence via a .lnk file in the victim’s startup path.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Revenge RAT schedules tasks to run malicious scripts at different intervals.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: ZIRCONIUM has used a tool to capture the time on a compromised host in order to register it with C2.

Tactics: TA0007
Techniques: T1124
Input: When the shellcode embedded within the malicious EPS is executed, the following three files are dropped:  %PROGRAMDATA%\Microsoft\DeviceSync\VMwareCplLauncher.exe %PROGRAMDATA%\Microsoft\DeviceSync\vmtools.dll %PROGRAMDATA%\Microsoft\DeviceSync\MSBuild.exe  In the list of dropped files, VMwareCplLauncher.exe is a legitimate, signed VMware executable that serves to ultimately deliver the BADNEWS payload

Tactics: TA0005
Techniques: T1036
Input: Adversaries may deliver payloads to victims that bypass security controls through HTML Smuggling by abusing JavaScript Blobs and/or HTML5 download attributes.

Tactics: TA0005
Techniques: T1027.006, T1027
Input: Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.002
Input: Navigating to the web page manually to view:source reveals the code, which at the time of writing happened to not be obfuscated in any significant way

Tactics: TA0005
Techniques: T1027
Input: Monitor for processes that can be used to enumerate user accounts and groups such as net.exe and net1.exe, especially when executed in quick succession.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Ixeshe has used registry values and file names associated with Adobe software, such as AcroRd32.exe.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: In one incident, the threat actor used the Wrapikatz tool (w.exe) with a usage statement that retrieves various passwords and Windows credentials from memory and compiles them in w.txt: c:\programdata\w.exe –w –l –c>>c:\programdata\w.txt In a separate incident, the threat actor used access provided by extensive web shell deployment to harvest account credentials:  2016-10-03T09:27:47   dir 2016-10-03T09:28:11   w64.log >ppp.log 2016-10-03T09:30:10     PowerShell.exe -ExecutionPolicy Bypass -File getpwd.ps1 >iistail.log  In another example, BRONZE UNION leveraged the Kekeo credential abuse tool to exploit CVE-2014-6324, a vulnerability in Microsoft's implementation of the Kerberos network authentication protocol

Tactics: TA0004, TA0006, TA0007
Techniques: T1003, T1068, T1018
Input: In this particular instance, the payload is encoded via base64, which certutil decodes

Tactics: TA0005
Techniques: T1140
Input: Operation Wocao has deleted Windows Event Logs to hinder forensic investigation.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: njRAT has used HTTP to receive stolen information from the infected machine.

Tactics: TA0010
Techniques: T1041
Input: TrickBot has been delivered via malicious links in phishing e-mails.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: ZxShell has a feature to perform SYN flood attack on a host.

Tactics: TA0040
Techniques: T1499
Input: Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

Tactics: TA0003, TA0004
Techniques: T1546.015, T1546
Input: After the C2 information has been collected, BADNEWS leverages HTTP for communication with the remote servers

Tactics: TA0011
Techniques: T1071
Input: ShimRatReporter gathered the local proxy, domain, IP, routing tables, mac address, gateway, DNS servers, and DHCP status information from an infected host.

Tactics: TA0007
Techniques: T1016
Input: SHARPSTATS has the ability to employ a custom PowerShell script.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: SysUpdate has the ability to capture screenshots.

Tactics: TA0009
Techniques: T1113
Input: Naikon has used the RoyalRoad exploit builder to drop a second stage loader, intel.wll, into the Word Startup folder on the compromised host.

Tactics: TA0003
Techniques: T1137, T1137.006
Input: ABK has the ability to inject shellcode into svchost.exe.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Unknown Logger can obtain information about the victim usernames.

Tactics: TA0007
Techniques: T1033
Input: The group has used a modified version of pentesting script wmiexec.vbs to execute commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Lazarus Group executed Responder using the command [Responder file path] -i [IP address] -rPv on a compromised host to harvest credentials and move laterally.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: Penquin can execute remote commands using bash scripts.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: Monitor executed commands and arguments that may check for Internet connectivity on compromised systems.

Tactics: TA0007
Techniques: T1016.001, T1016
Input: Many of these protections depend on the architecture and target application binary for compatibility.

Tactics: TA0001, TA0002
Techniques: T1189, T1203
Input: Some Volgmer variants use SSL to encrypt C2 communications.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Windows event logs may designate activity associated with an adversary's attempt to remove an account (ex: Event ID 4726 - A user account was deleted).

Tactics: TA0040
Techniques: T1531
Input: XCSSET prompts the user to input credentials using a native macOS dialog box leveraging the system process /Applications/Safari.app/Contents/MacOS/SafariForWebKitDevelopment.

Tactics: TA0006, TA0009
Techniques: T1056.002, T1056
Input: Adversaries may also tamper with artifacts deployed and utilized by security tools.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent execution of potentially obfuscated scripts.

Tactics: TA0005
Techniques: T1027
Input: Tomiris has the ability to sleep for at least nine minutes to evade sandbox-based analysis systems.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Patchwork dumped the login data database from \AppData\Local\Google\Chrome\User Data\Default\Login Data.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: APT28 has used a brute-force/password-spray tooling that operated in two modes: in brute-force mode it typically sent over 300 authentication attempts per hour per targeted account over the course of several hours or days.

Tactics: TA0006
Techniques: T1110, T1110.001
Input: Sharpshooter has sent malicious attachments via emails to targets.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Ke3chang has used Mimikatz to generate Kerberos golden tickets.

Tactics: TA0006
Techniques: T1558, T1558.001
Input: CosmicDuke collects user credentials, including passwords, for various programs including popular instant messaging applications and email clients as well as WLAN keys.

Tactics: TA0006
Techniques: T1555
Input: FIN8 has used scheduled tasks to maintain RDP backdoors.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Adversaries may hijack a legitimate user's SSH session to move laterally within an environment.

Tactics: TA0008
Techniques: T1563, T1563.001
Input: SUNSPOT used Windows API functions such as MoveFileEx and NtQueryInformationProcess as part of the SUNBURST injection process.

Tactics: TA0002
Techniques: T1106
Input: An RTF, an MSI file, a .NET Wrapper and two stages of Shellcode walk into a bar… Our journey begins with an RTF file named “New Salary Structure 2017.doc”, which exploits CVE-2017-0199

Tactics: TA0002
Techniques: T1203
Input: Adversaries can utilize AppleScript and Native API calls to create a login item to spawn malicious executables.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.015
Input: Consider analyzing self-signed code signing certificates for features that may be associated with the adversary and/or their developers, such as the thumbprint, algorithm used, validity period, and common name.

Tactics: TA0042
Techniques: T1587.002, T1587
Input: The script may be signed by Microsoft and is commonly executed through the Windows Command Shell via Cscript.exe.

Tactics: TA0005
Techniques: T1216.001, T1216
Input: Threat actors can use online resources or command-line utilities to pillage through WHOIS data for information about potential victims.

Tactics: TA0043
Techniques: T1596.002, T1596
Input: There are two versions of safe mode: Safe Mode and Safe Mode with Networking.

Tactics: TA0005
Techniques: T1562.009, T1562
Input: Part of packed VM PCODE After unpacking, the PCODE it will look like the following: Unpacked PCODE After unpacking the virtual machine PCODE is then decrypted: Decrypted VM PCODE The custom virtual machine supports a total of 34 instructions: Example of parsed PCODE In this example, the “1b” instruction is responsible for executing native code that is specified in parameter field

Tactics: TA0005, TA0007
Techniques: T1497, T1140, T1027.002, T1027, T1027.001
Input: via an NTFS junction or symlink program.exe.local with the fully-qualified or relative pathname of a directory containing the DLLs specified in the IMPORT directory or forwarded EXPORTs;

Tactics: TA0002
Techniques: T1129
Input: JPIN can list running processes.

Tactics: TA0007
Techniques: T1057
Input: LaZagne can obtain credentials from Vault files.

Tactics: TA0006
Techniques: T1555, T1555.004
Input: WIRTE has used regsvr32.exe to trigger the execution of a malicious script.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: FIN7 has collected files and other sensitive information from a compromised network.

Tactics: TA0009
Techniques: T1005
Input: Additionally, on that same url, http://mdzz2019.noip[.]cn:3654/ is used to distribute more versions of this Gh0stRAT sample, along with a .zip file containing ASPXSpy, a web shell

Tactics: TA0003
Techniques: T1505.003, T1505
Input: AADInternals can send "consent phishing" emails containing malicious links designed to steal users’ access tokens.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: By default, Excel does not allow the download of data from the remote server, but will ask for the user’s consent by presenting the dialog box in Figure 2:  Figure 2 Excel security notice for .iqy files By enabling this data connection, the user allows Excel to obtain content from the URL in the .iqy file

Tactics: TA0002
Techniques: T1204
Input: New DLLs written to System32 that do not correlate with known good software or patching may also be suspicious.

Tactics: TA0003, TA0004
Techniques: T1547.004, T1547
Input: MacSpy can steal clipboard contents.

Tactics: TA0009
Techniques: T1115
Input: Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Stuxnet transforms encrypted binary data into an ASCII string in order to use it as a URL parameter value.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: More_eggs can download and launch additional payloads.

Tactics: TA0011
Techniques: T1105
Input: APT29 also used PowerShell to create new tasks on remote machines, identify configuration settings, evade defenses, exfiltrate data, and to execute other commands.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Zeus Panda has a command to delete a file.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Consider filtering network traffic to untrusted or known bad domains and resources.

Tactics: TA0011
Techniques: T1572
Input: The Penquin C2 mechanism is based on TCP and UDP packets.

Tactics: TA0011
Techniques: T1095
Input: Use of SSH may be legitimate depending on the environment and how it’s used.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: HermeticWiper can compress 32-bit and 64-bit driver files with the Lempel-Ziv algorithm.

Tactics: TA0005
Techniques: T1027
Input: Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via Accessibility Features, Boot or Logon Initialization Scripts, Unix Shell Configuration Modification, or tainting/hijacking other instrumental binary/configuration files via Hijack Execution Flow.

Tactics: TA0005
Techniques: T1222
Input: Depending on the version of Windows, an adversary may take advantage of these features in different ways.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: Anchor can execute payloads via shell scripting.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: ZIRCONIUM has exploited CVE-2017-0005 for local privilege escalation.

Tactics: TA0004
Techniques: T1068
Input: Cobalt Group has used the Plink utility to create SSH tunnels.

Tactics: TA0011
Techniques: T1572, T1573, T1573.002
Input: Adversaries may "pass the ticket" using stolen Kerberos tickets to move laterally within an environment, bypassing normal system access controls.

Tactics: TA0005, TA0008
Techniques: T1550.003, T1550
Input: Delegate other admin functions to separate accounts.

Tactics: TA0005, TA0006, TA0008
Techniques: T1550.003, T1558, T1558.001, T1550
Input: Stored procedures can be invoked via SQL statements to the database using the procedure name or via defined events ( when a SQL server application is started/restarted).

Tactics: TA0003
Techniques: T1505.001, T1505
Input: InvisiMole can use Data Protection API to encrypt its components on the victim’s computer, to evade detection, and to make sure the payload can only be decrypted and loaded on one specific compromised computer.

Tactics: TA0005
Techniques: T1480, T1480.001
Input: Rising Sun can detect the computer name, operating system, and other native system information.

Tactics: TA0007
Techniques: T1082
Input: The CLI is the primary means through which users and administrators interact with the device in order to view system information, modify device operations, or perform diagnostic and administrative functions.

Tactics: TA0002
Techniques: T1059.008, T1059
Input: File monitoring can check for the apple.awt.UIElement or any other suspicious plist tag in plist files and flag them.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: netstat can be used to enumerate local network connections, including active TCP connections and other network statistics.

Tactics: TA0007
Techniques: T1049
Input: FIN6 has used malicious JavaScript to steal payment card data from e-commerce sites.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Adversaries may modify XDG autostart entries to execute programs or commands during system boot.

Tactics: TA0003, TA0004
Techniques: T1547.013, T1547
Input: FIN8 has used the Plink utility to tunnel RDP back to C2 infrastructure.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: More_eggs's payload has been encrypted with a key that has the hostname and processor family information appended to the end.

Tactics: TA0005
Techniques: T1027
Input: APT41 used the storescyncsvc.dll BEACON backdoor to download a secondary backdoor.

Tactics: TA0011
Techniques: T1104
Input: Calisto adds a .plist file to the /Library/LaunchAgents folder to maintain persistence.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: Adversaries may send phishing messages to gain access to victim systems.

Tactics: TA0001
Techniques: T1566
Input: Adversaries may collect data related to managed devices from configuration repositories.

Tactics: TA0009
Techniques: T1602
Input: Adversaries may also create a valid Kerberos ticket using other user information, such as stolen password hashes or AES keys.

Tactics: TA0005, TA0008
Techniques: T1550.003, T1550
Input: [UUID].plist within the ~/Library/Preferences/ByHost directory.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.007
Input: Monitor for newly executed processes that may use Valid Accounts to log into remote machines using Secure Shell (SSH).

Tactics: TA0008
Techniques: T1021, T1021.004
Input: Dark Caracal took screenshots using their Windows malware.

Tactics: TA0009
Techniques: T1113
Input: Hydraq creates a backdoor through which remote attackers can retrieve information such as computer name, OS version, processor speed, memory size, and CPU speed.

Tactics: TA0007
Techniques: T1082
Input: APT29 has used TCP for C2 communications.

Tactics: TA0011
Techniques: T1095
Input: WhisperGate can enumerate connected remote logical drives.

Tactics: TA0007
Techniques: T1049
Input: Cryptoistic can use TCP in communications with C2.

Tactics: TA0011
Techniques: T1095
Input: Threat Group-3390 has used command-line interfaces for execution.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).

Tactics: TA0006
Techniques: T1003, T1003.001
Input: SynAck can manipulate Registry keys.

Tactics: TA0005
Techniques: T1112
Input: By achieving the adversary-in-the-middle (AiTM) position, adversaries may collect network communications, including passed credentials, especially those sent over insecure, unencrypted protocols.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.003
Input: Adversaries may abuse traffic mirroring to mirror or redirect network traffic through other network infrastructure they control.

Tactics: TA0010
Techniques: T1020.001, T1020
Input: Stuxnet uses a driver registered as a boot start service as the main load-point.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Honeybee's service-based DLL implant can execute a downloaded file with parameters specified using CreateProcessAsUser.

Tactics: TA0003, TA0004
Techniques: T1546.009, T1546
Input: Adversaries may also acquire credentials by searching web browser process memory for patterns that commonly match credentials.

Tactics: TA0006
Techniques: T1555.003, T1555