madox81/Adema_ATTACK_DS huggingface dataset:
Input: Olympic Destroyer attempts to copy itself to remote machines on the network.

Tactics: TA0008
Techniques: T1570
Input: Patchwork installed its payload in the startup programs folder as "Baidu Software Update."

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Monitor for newly constructed network connections (typically over port 3389) that may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP).

Tactics: TA0008
Techniques: T1021.001, T1021
Input: The net user username \password \domain commands in Net can be used to create a domain account.

Tactics: TA0003
Techniques: T1136, T1136.002
Input: Services such as Windows Remote Management and VNC can also be used externally.

Tactics: TA0001, TA0003
Techniques: T1133
Input: An APT19 HTTP malware variant decrypts strings using single-byte XOR keys.

Tactics: TA0005
Techniques: T1140
Input: Restrict read/write access to systemd unit files to only select privileged users who have a legitimate need to manage system services.

Tactics: TA0003, TA0004
Techniques: T1543.002, T1543
Input: Ramsay can use the Windows COM API to schedule tasks and maintain persistence.

Tactics: TA0002
Techniques: T1559, T1559.001
Input: Ensure proper permissions are set for Registry hives to prevent users from modifying keys for system components that may lead to privilege escalation.

Tactics: TA0003, TA0004, TA0005
Techniques: T1112, T1574
Input: Winnti for Windows can check for the presence of specific files prior to moving to the next phase of execution.

Tactics: TA0007
Techniques: T1083
Input: Furthermore, email forwarding rules can allow adversaries to maintain persistent access to victim's emails even after compromised credentials are reset by administrators.

Tactics: TA0009
Techniques: T1114, T1114.003
Input: Online news outlets and general websites were breached and weaponized as a vehicle for watering hole attacks

Tactics: TA0001
Techniques: T1189
Input: Depending on the browser, adversaries may also manipulate an extension's update url to install updates from an adversary controlled server or manipulate the mobile configuration file to silently install additional extensions.

Tactics: TA0003
Techniques: T1176
Input: P.A.S. Webshell can gain remote access and execution on target web servers.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: InvisiMole can launch a remote shell to execute commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Look for abnormal process call trees from known services and for execution of other commands that could relate to Discovery or other adversary techniques.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Figure 5: Sample pseudo-HTTP beacon The pseudo-HTTP protocol uses any proxies discovered by the HTTP proxy monitoring thread or added by the adminka command

Tactics: TA0011
Techniques: T1071, T1090
Input: Utilize a trust model such as Docker Content Trust with digital signatures to ensure runtime verification of the integrity and publisher of specific image tags.

Tactics: TA0002
Techniques: T1204.003, T1204
Input: APT-C-36 obtained and used a modified variant of Imminent Monitor.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: This may take the form of sending a series of packets with certain characteristics before a port will be opened that the adversary can use for command and control.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205
Input: Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution.

Tactics: TA0002
Techniques: T1203
Input: There are a subset of root certificates that are consistent across Windows systems and can be used for comparison:  Also consider enabling the Registry Global Object Access Auditing  setting in the Advanced Security Audit policy to apply a global system access control list (SACL) and event auditing on modifications to Registry values (sub)keys related to SIPs and trust providers:

Tactics: TA0005
Techniques: T1553
Input: Monitor for newly executed processes that are associated with abuse of IPC mechanisms

Tactics: TA0002
Techniques: T1559
Input: These profilers are designed to monitor, troubleshoot, and debug managed code executed by the .NET CLR.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.012, T1574
Input: At this point the process can be unmapped using APIs calls such as ZwUnmapViewOfSection or NtUnmapViewOfSection  before being written to, realigned to the injected code, and resumed via VirtualAllocEx, WriteProcessMemory, SetThreadContext, then ResumeThread respectively.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion.

Tactics: TA0011
Techniques: T1090.001, T1090
Input: The unauthorized image allows adversaries to modify device configuration, add malicious capabilities to the device, and introduce backdoors to maintain control of the network device while minimizing detection through use of a standard functionality.

Tactics: TA0003, TA0005
Techniques: T1542.005, T1542
Input: Some TrickBot samples have used HTTP over ports 447 and 8082 for C2.

Tactics: TA0011
Techniques: T1571
Input: Matryoshka uses DNS for C2.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: As cloud storage solutions typically use globally unique names, adversaries may also use target-specific wordlists and tools such as s3recon and GCPBucketBrute to enumerate public and private buckets on cloud infrastructure.

Tactics: TA0043
Techniques: T1595.003, T1595
Input: To use Google Drive, the x_mode command received from the C2 server via DNS tunneling will be followed by a newline-delimited list of settings needed to interact with the Google Drive account

Tactics: TA0011
Techniques: T1102
Input: OilRig has used WMI for execution.

Tactics: TA0002
Techniques: T1047
Input: If a container is compromised, an attacker may be able to steal the container’s token and thereby gain access to Kubernetes API commands.

Tactics: TA0006
Techniques: T1528
Input: Egregor can modify the GPO to evade detection.

Tactics: TA0004, TA0005
Techniques: T1484.001, T1484
Input: Pteranodon has used various API calls.

Tactics: TA0002
Techniques: T1106
Input: APT28 has used a variety of public exploits, including CVE 2020-0688 and CVE 2020-17144, to gain execution on vulnerable Microsoft Exchange; they have also conducted SQL injection attacks against external websites.

Tactics: TA0001
Techniques: T1190
Input: Figure 9: Example of callback Earlier versions of UPPERCUT used the hard-coded string “this is the encrypt key” for Blowfish encryption when communicating with a C2

Tactics: TA0011
Techniques: T1573
Input: Generate payloads in various formats:      Format Architecture Short Name     Android Package x86 & ARMv7 apk   Linux Binary x86 lin_x86   Linux Binary x64 lin_x64   Linux Shared Object x86 so_x86   Linux Shared Object x64 so_x64   Windows PE Executable x86 exe_x86   Windows PE Executable x64 exe_x64   Windows DLL x86 dll_x86   Windows DLL x64 dll_x64   Python Script x86 & x64 py   PyInstaller x86 & x64 pyinst   Python Oneliner x86 & x64 py_oneliner   Powershell x86 & x64 ps1   Powershell Oneliner x86 & x64 ps1_oneliner   Ducky Script N/A rubber_ducky      Deploy in memory from a single command line using python or powershell one-liners

Tactics: TA0002, TA0007
Techniques: T1106, T1059.001, T1010, T1059
Input: Clop can delete the shadow volumes with vssadmin Delete Shadows /all /quiet and can use bcdedit to disable recovery options.

Tactics: TA0040
Techniques: T1490
Input: Adversaries may create a domain account to maintain access to victim systems.

Tactics: TA0003
Techniques: T1136, T1136.002
Input: Monitor for logon behavior (ex: EID 4624 Logon Type 3) using Valid Accounts to interact with a remote network share using Server Message Block (SMB).

Tactics: TA0008
Techniques: T1021, T1021.002
Input: This DLL can be located in C:\Windows\System32 and will be loaded by the print spooler service, spoolsv.exe, on boot.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.010
Input: TFTP boot (netbooting) is commonly used by network administrators to load configuration-controlled network device images from a centralized management server.

Tactics: TA0003, TA0005
Techniques: T1542.005, T1542
Input: An adversary may gather the system time and/or time zone from a local or remote system.

Tactics: TA0007
Techniques: T1124
Input: CaddyWiper has the ability to destroy information about a physical drive's partitions including the MBR, GPT, and partition entries.

Tactics: TA0040
Techniques: T1561, T1561.002
Input: ConnectWise can record video on remote hosts.

Tactics: TA0009
Techniques: T1125
Input: Monitor executed commands and arguments that may abuse time providers to execute DLLs when the system boots.

Tactics: TA0003, TA0004
Techniques: T1547.003, T1547
Input: Monitor for COM objects loading DLLs and other modules not typically associated with the application.

Tactics: TA0002, TA0008
Techniques: T1559, T1021.003, T1559.001, T1021
Input: OSInfo has enumerated the local administrators group.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: These logon scripts run with the privileges of the user they are assigned to.

Tactics: TA0003, TA0004
Techniques: T1037.003, T1037
Input: Monitor for files being accessed to exfiltrate data to a code repository rather than over their primary command and control channel.

Tactics: TA0010
Techniques: T1567.001, T1567
Input: Kimsuky has used a tool called GREASE to add a Windows admin account in order to allow them continued access via RDP.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.003
Input: Grandoreiro can list installed security products including the Trusteer and Diebold Warsaw GAS Tecnologia online banking protections.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Dark Caracal collected file listings of all default Windows directories.

Tactics: TA0007
Techniques: T1083
Input: Adversaries may gather credentials by reading files located inside of the Credential Lockers.

Tactics: TA0006
Techniques: T1555, T1555.004
Input: HAFNIUM has operated from leased virtual private servers (VPS) in the United States.

Tactics: TA0042
Techniques: T1583.003, T1583
Input: TinyZBot can install as a Windows service for persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Adversaries may choose to stage data from a victim network in a centralized location prior to Exfiltration to minimize the number of connections made to their C2 server and better evade detection.

Tactics: TA0009
Techniques: T1074
Input: Consider technical controls to prevent the disabling of services or deletion of files involved in system recovery.

Tactics: TA0040
Techniques: T1490
Input: Metamorfo has a function that can watch the contents of the system clipboard for valid bitcoin addresses, which it then overwrites with the attacker's address.

Tactics: TA0040
Techniques: T1565, T1565.002
Input: Additionally, botnets are available for rent or purchase.

Tactics: TA0042
Techniques: T1583
Input: WINDSHIELD is capable of file deletion along with other file system interaction.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Lazarus Group has attempted to get users to launch a malicious Microsoft Word attachment delivered via a spearphishing email.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: OwaAuth web shell PDB string

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Adversaries may hide malicious Visual Basic for Applications (VBA) payloads embedded within MS Office documents by replacing the VBA source code with benign data.

Tactics: TA0005
Techniques: T1564, T1564.007
Input: gh0st RAT has altered the InstallTime subkey.

Tactics: TA0005
Techniques: T1112
Input: It is not configured by default and has hardware and firmware system requirements.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Monitoring changes to the Windows Registry may reveal malicious attempts to modify trust settings, such as the installation of root certificates.

Tactics: TA0005
Techniques: T1553
Input: Adversaries may try to gather information about registered local system services.

Tactics: TA0007
Techniques: T1007
Input: OSX_OCEANLOTUS.D has a variant that is packed with UPX.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: BRONZE BUTLER has used a batch script that adds a Registry Run key to establish malware persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Darkhotel used a virus that propagates by infecting executables stored on shared drives.

Tactics: TA0008
Techniques: T1080
Input: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Kimsuky has used RDP to establish persistence.

Tactics: TA0001, TA0003
Techniques: T1133
Input: These four were then all modified on the same date and time on October 13, 2018 08:21

Tactics: TA0007
Techniques: T1124
Input: Adversaries may use the original IP address of an attacking system, or spoof the source IP address to make the attack traffic more difficult to trace back to the attacking system or to enable reflection.

Tactics: TA0040
Techniques: T1499, T1498
Input: Elise can download additional files from the C2 server for execution.

Tactics: TA0011
Techniques: T1105
Input: Figure 4 Microsoft Word attempting to download the remote template If the C2 server is active at the time the document is opened, it will successfully retrieve the malicious macro and load it in the same Microsoft Word session

Tactics: TA0011
Techniques: T1105
Input: Configure multi-factor authentication systems to disallow enrolling new devices for inactive accounts.

Tactics: TA0003
Techniques: T1098.005, T1098
Input: Winnti Group used a rootkit to modify typical server functionality.

Tactics: TA0005
Techniques: T1014
Input: sqlmap can be used to automate exploitation of SQL injection vulnerabilities.

Tactics: TA0001
Techniques: T1190
Input: The Odbcconf.exe binary may be digitally signed by Microsoft.

Tactics: TA0005
Techniques: T1218, T1218.008
Input: Suckfly used legitimate account credentials that they dumped to navigate the internal victim network as though they were the legitimate account owner.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: This will enable the setuid bit.

Tactics: TA0004, TA0005
Techniques: T1548, T1548.001
Input: Windows services will have a service name as well as a display name.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: For example, adversaries may leverage compromised infrastructure (potentially also in conjunction with Digital Certificates) to further blend in and support staged information gathering and/or Phishing campaigns.

Tactics: TA0042
Techniques: T1584
Input: C2 Command   Purpose    reboot  Reboot the system using shutdown command    shutdown  Shut down the system using shutdown command    clean  Wipe the Drives, C:\, D:\, E:\, F:\    screenshot  Take a screenshot of the System    upload  Encrypt and upload the information from the system    excel  Leverage Excel.Application COM object for code execution    outlook  Leverage Outlook.Application COM object for code execution    risk  Leverage DCOM object for code execution   Conclusion This activity shows us that TEMP.Zagros stays up-to-date with the latest code execution and persistence mechanism techniques, and that they can quickly leverage these techniques to update their malware

Tactics: TA0002, TA0003, TA0004, TA0005, TA0007, TA0009
Techniques: T1053.005, T1140, T1053, T1106, T1082, T1113
Input: Command Functionality   Init Create a reverse shell   Write Write a file to the compromised system from the C2 server   List List the files in a directory   Upload Upload a file from the compromised system to the C2 server    Table 2

Tactics: TA0011, TA0010
Techniques: T1041, T1105
Input: Once the payload is successfully executed, it will proceed to copy files to the following locations:  C:\ProgramData\ManagerApp\AdapterTroubleshooter.exe C:\ProgramData\ManagerApp\15b937.cab C:\ProgramData\ManagerApp\install.cab C:\ProgramData\ManagerApp\msvcr90.dll C:\ProgramData\ManagerApp\d3d9.dll  The “AdapterTroubleshooter.exe” file is a legitimate binary which is leveraged to use the famous DLL search order hijacking technique.  The “d3d9.dll” file is malicious and is loaded into memory by the legit binary upon execution.  Once loaded, the DLL will then inject FinSpy into the Winlogon process

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574.002, T1055, T1574
Input: A spearphishing attachment containing a document with a resource that is automatically loaded when the document is opened ( Template Injection). The document can include, for example, a request similar to file[:]//[remote address]/Normal.dotm to trigger the SMB request.

Tactics: TA0006
Techniques: T1187
Input: IcedID has called ZwWriteVirtualMemory, ZwProtectVirtualMemory, ZwQueueApcThread, and NtResumeThread to inject itself into a remote process.

Tactics: TA0002
Techniques: T1106
Input: OSInfo performs a connection test to discover remote systems in the network

Tactics: TA0007
Techniques: T1018
Input: A variant of ADVSTORESHELL encrypts some C2 with RSA.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: malicious documents and files that are downloaded from a link and executed on the user's computer

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Zeus Panda decrypts strings in the code during the execution process.

Tactics: TA0005
Techniques: T1140
Input: Malicious hooking mechanisms may capture API calls that include parameters that reveal user authentication credentials.

Tactics: TA0006, TA0009
Techniques: T1056.004, T1056
Input: In addition to API commands, adversaries can utilize open source tools to discover cloud storage infrastructure through Wordlist Scanning.

Tactics: TA0007
Techniques: T1580
Input: For example, template properties may reference a file, serving as a pre-formatted document blueprint, that is fetched when the document is loaded.

Tactics: TA0005
Techniques: T1221
Input: Higaisa used malicious e-mail attachments to lure victims into executing LNK files.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: For C2 over DNS, Helminth converts ASCII characters into their hexadecimal values and sends the data in cleartext.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: USBferry can use tasklist to gather information about the process running on the infected system.

Tactics: TA0007
Techniques: T1057
Input: Authentication logs can be used to audit logins to specific web applications, but determining malicious logins versus benign logins may be difficult if activity matches typical user behavior.

Tactics: TA0009
Techniques: T1185
Input: Mivast has the capability to download and execute .exe files.

Tactics: TA0011
Techniques: T1105
Input: If the file does not exist, the Trojan will send the C2 server a message < File Not Found > by sending the following URL:http://<c2 domain>/resp?<hex(Environment.UserName/Environment.MachineName)>AAZ<hex(“< File Not Found >”)> If the file exists, the Trojan will read the contents of the specified file and compresses the contents using the GZipStream class

Tactics: TA0005, TA0011
Techniques: T1070, T1070.006, T1105, T1070.004
Input: Anchor can create and execute services to load its payload.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Some systems may automatically restart critical applications and services when crashes occur, but they can likely be re-exploited to cause a persistent denial of service (DoS) condition.

Tactics: TA0040
Techniques: T1499, T1499.004
Input: Adversaries may use the information from Query Registry during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Tactics: TA0007
Techniques: T1012
Input: HAFNIUM has acquired web services for use in C2 and exfiltration.

Tactics: TA0042
Techniques: T1583.006, T1583
Input: OilRig has used reg query "HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default" on a victim to query the Registry.

Tactics: TA0007
Techniques: T1012
Input: Daserf uses custom base64 encoding to obfuscate HTTP traffic.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Seasalt has the capability to identify the drive type on a victim.

Tactics: TA0007
Techniques: T1083
Input: Regin appears to have functionality to modify remote Registry information.

Tactics: TA0005
Techniques: T1112
Input: SQLRat has used a character insertion obfuscation technique, making the script appear to contain Chinese characters.

Tactics: TA0005
Techniques: T1027
Input: NavRAT copies itself into a running Internet Explorer process to evade detection.

Tactics: TA0004, TA0005
Techniques: T1055
Input: SMOKEDHAM has used Powershell to download UltraVNC and Ngrok from third-party file sharing sites.

Tactics: TA0011
Techniques: T1105
Input: If this file is renamed to evil.txt, then when double clicked by a user, it will launch with the default text editing application (not executing the binary).

Tactics: TA0005
Techniques: T1036.006, T1036
Input: This plugin provides the attacker with the ability to both list files and download/upload files on the victim machine

Tactics: TA0007, TA0011
Techniques: T1090.003, T1083, T1105, T1090
Input: BloodHound can use .NET API calls in the SharpHound ingestor component to pull Active Directory data.

Tactics: TA0002
Techniques: T1106
Input: RedLeaves can gather extended system information including the hostname, OS version number, platform, memory information, time elapsed since system startup, and CPU information.

Tactics: TA0007
Techniques: T1082
Input: The built-in Windows command-line utility Reg may be used for local or remote Registry modification.

Tactics: TA0005
Techniques: T1112
Input: REvil has the capability to stop services and kill processes.

Tactics: TA0040
Techniques: T1489
Input: BUBBLEWRAP can communicate using HTTP or HTTPS.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Ramsay can scan for network drives which may contain documents for collection.

Tactics: TA0007
Techniques: T1135
Input: Information about the installed software may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices).

Tactics: TA0043
Techniques: T1592, T1592.002
Input: Consider periodic review of auditpol settings for Administrator accounts and perform dynamic baselining on SIEM(s) to investigate potential malicious activity.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: Detecting dynamically generated domains can be challenging due to the number of different DGA algorithms, constantly evolving malware families, and the increasing complexity of the algorithms.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: Likewise, if software DLL loads are collected and analyzed, any unusual DLL load that can be correlated with a COM object Registry modification may indicate COM hijacking has been performed.

Tactics: TA0003, TA0004
Techniques: T1546.015, T1546
Input: Pony has been delivered via spearphishing emails which contained malicious links.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Empire can exploit vulnerabilities such as MS16-032 and MS16-135.

Tactics: TA0004
Techniques: T1068
Input: Ramsay has been embedded in documents exploiting CVE-2017-0199, CVE-2017-11882, and CVE-2017-8570.

Tactics: TA0002
Techniques: T1203
Input: Zebrocy has a command to delete files and directories.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Clambling can use cmd.exe for command execution.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Green Lambert can collect the date and time from a compromised host.

Tactics: TA0007
Techniques: T1124
Input: HiddenWasp adds itself as a shared object to the LD_PRELOAD environment variable.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.006, T1574