madox81/Adema_ATTACK_DS huggingface dataset:
Input: Tropic Trooper has detected a target system’s OS version and system volume information.

Tactics: TA0007
Techniques: T1082
Input: TA505 has sent spearphishing emails containing malicious links.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: AADInternals can create new Azure AD users.

Tactics: TA0003
Techniques: T1136, T1136.003
Input: Adversaries can use a compromised social media profile to create new, or hijack existing, connections to targets of interest.

Tactics: TA0042
Techniques: T1586.001, T1586
Input: Train users to identify aspects of phishing attempts where they're asked to enter credentials into a site that has the incorrect domain for the application they are logging into.

Tactics: TA0006
Techniques: T1539
Input: Monitor executed commands and arguments that may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Mythic supports domain fronting via custom request headers.

Tactics: TA0011
Techniques: T1090.004, T1090
Input: Kimsuky has exploited various vulnerabilities for initial access, including Microsoft Exchange vulnerability CVE-2020-0688.

Tactics: TA0001
Techniques: T1190
Input: The x_mode command is disabled by default, but when enabled via a command received from the DNS tunneling channel, it allows RogueRobin to receive a unique identifier and to get jobs by using Google Drive API requests

Tactics: TA0011
Techniques: T1071
Input: The discovery of these available resources may help adversaries determine their next steps in the Cloud environment, such as establishing Persistence.An adversary may also use this information to change the configuration to make the bucket publicly accessible, allowing data to be accessed without authentication.

Tactics: TA0007
Techniques: T1580
Input: HDS Deletes the file created by the HD command to reverse the effect

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Adversaries may gather the victim's IP addresses that can be used during targeting.

Tactics: TA0043
Techniques: T1590, T1590.005
Input: NavRAT leverages cmd.exe to perform discovery techniques.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Lazarus Group has obtained a variety of tools for their operations, including Responder, PuTTy PSCP, Wake-On-Lan, ChromePass, and dbxcli.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: MuddyWater has used a Word Template, Normal.dotm, for persistence.

Tactics: TA0003
Techniques: T1137, T1137.001
Input: Cardinal RAT contains watchdog functionality that periodically ensures HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load is set to point to its executable.

Tactics: TA0007
Techniques: T1012
Input: Information about identities may include a variety of details, including personal data (ex: employee names, email addresses, ) as well as sensitive details such as credentials.

Tactics: TA0043
Techniques: T1589
Input: menuPass has used several tools to scan for open NetBIOS nameservers and enumerate NetBIOS sessions.

Tactics: TA0007
Techniques: T1016
Input: FIN7 has performed C2 using DNS via A, OPT, and TXT records.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: APT28 used weaponized Microsoft Word documents abusing the remote template function to retrieve a malicious macro.

Tactics: TA0005
Techniques: T1221
Input: Setting the timestamp_timeout to 0 will require the user to input their password every time sudo is executed.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: A flood of ACK packets are sent to the target.

Tactics: TA0040
Techniques: T1499, T1499.001
Input: Sakula also has the capability to invoke a reverse shell.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: TA551 has used HTTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: PipeMon modules are stored encrypted on disk.

Tactics: TA0005
Techniques: T1027
Input: Adversaries may impair command history logging to hide commands they run on a compromised system.

Tactics: TA0005
Techniques: T1562.003, T1562
Input: Remcos has a command to hide itself through injecting into another process.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Monitor Windows Task Scheduler stores in %systemroot%\System32\Tasks for change entries related to scheduled tasks that do not correlate with known software, patch cycles,

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: The Windows Credential Manager separates website credentials from application or network credentials in two lockers.

Tactics: TA0006
Techniques: T1555, T1555.004
Input: In preparation for its attack against the 2018 Winter Olympics, Sandworm Team conducted online research of partner organizations listed on an official PyeongChang Olympics partnership site.

Tactics: TA0043
Techniques: T1591.002, T1591
Input: APT3 has used a tool to dump credentials by injecting itself into lsass.exe and triggering with the argument "dig."

Tactics: TA0006
Techniques: T1003, T1003.001
Input: The adversary can then use exfiltration techniques such as Transfer Data to Cloud Account in order to access the sniffed traffic.

Tactics: TA0006, TA0007
Techniques: T1040
Input: On macOS systems the dscl -create command can be used to create a local account.

Tactics: TA0003
Techniques: T1136, T1136.001
Input: SoreFang can decode and decrypt exfiltrated data sent to C2.

Tactics: TA0005
Techniques: T1140
Input: Monitor Azure Activity Logs for Service Principal and Application modifications.

Tactics: TA0003
Techniques: T1098.001, T1098
Input: Koadic can retrieve the contents of the IP routing table as well as information about the Windows domain.

Tactics: TA0007
Techniques: T1016
Input: CoinTicker initially downloads a hidden encoded file.

Tactics: TA0005
Techniques: T1027
Input: Please see the referenced Windows API pages for more information.

Tactics: TA0004, TA0005
Techniques: T1134
Input: Koadic performs most of its operations using Windows Script Host (Jscript) and to run arbitrary shellcode.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Use process monitoring to monitor the execution and arguments of Regsvcs.exe and Regasm.exe.

Tactics: TA0005
Techniques: T1218.009, T1218
Input: Likewise, files that are modified outside of an update or patch are suspect.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: TDTESS provides a reverse shell on the victim.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: It then reads and decrypts the content between these values to yield an IP address as shown below:       ---- BEGIN SSH2 PUBLIC KEY ----Comment: "rsa-key"AAAAB3NzaC1yc2EAAAABJQAAAQEAhLxZe4Qli9xt/WknQK9CDLWubpgknZ0HIHSd8uV/TJvLsRkjpV+U/tMiMxjDwLAHVtNcww2h8bXTtw387M2Iv/mJjQ9Lv3BdNiM3/KvmlpeJZrrFu2n5UC9=DZKSDAAADOECEDFDOCCDEDIDOCIDEDOCHDDZJS=oT+Ps8wD4f0NBUtDdEdXhWp3nxv/mJjQ9Lv3BCFDBd09UZzLrfBO1S0nxrHsxlJ+bPaJE2Q/oxLXTrpeJ6AHyLyeUaBha3q9niJ=---- END SSH2 PUBLIC KEY ----     A Python script to decode strings encrypted with this technique is given in Appendix B – Python Scripts

Tactics: TA0005
Techniques: T1140
Input: Monitor for telemetry that provides context of security software services being disabled or modified.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Ensure IIS DLLs and binaries are signed by the correct application developers.

Tactics: TA0003
Techniques: T1505.004, T1505
Input: Adversaries may also purchase credentials from dark web or other black-markets.

Tactics: TA0043
Techniques: T1589, T1589.001
Input: Note that every string is decrypted with different XOR parameter which may fail some of the automatic analyzers.

Tactics: TA0005
Techniques: T1027
Input: IFEOs can be set directly via the Registry or in Global Flags via the GFlags tool.

Tactics: TA0003, TA0004
Techniques: T1546.012, T1546
Input: DEATHRANSOM can delete volume shadow copies on compromised hosts.

Tactics: TA0040
Techniques: T1490
Input: Monitor for file creation and files transferred into the network

Tactics: TA0011
Techniques: T1105
Input: Also consider inspecting and scanning file formats commonly abused to bypass MOTW (ex: .arj, .gzip, .iso, .vhd).

Tactics: TA0005
Techniques: T1553, T1553.005
Input: Adversaries may abuse a container administration service to execute commands within a container.

Tactics: TA0002
Techniques: T1609
Input: This suggests that other WMI-based VM detection techniques may also detect certain physical systems if those systems do not support the specific WMI query

Tactics: TA0002
Techniques: T1047
Input: QakBot can use PowerShell to download and execute payloads.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: If an adversary has sufficient permissions, they can disable logging to avoid detection of their activities.

Tactics: TA0005
Techniques: T1562.008, T1562
Input: The group also ran a modified version of NBTscan to identify available NetBIOS name servers.

Tactics: TA0007
Techniques: T1016
Input: Axiom has acquired dynamic DNS services for use in the targeting of intended victims.

Tactics: TA0042
Techniques: T1583, T1583.002
Input: BRONZE BUTLER has exfiltrated files stolen from file shares.

Tactics: TA0009
Techniques: T1039
Input: BadPatch collects the OS system, OS version, MAC address, and the computer name from the victim’s machine.

Tactics: TA0007
Techniques: T1082
Input: Meteor can change both the desktop wallpaper and the lock screen image to a custom image.

Tactics: TA0040
Techniques: T1491.001, T1491
Input: Infrastructure solutions include physical or cloud servers, domains, and third-party web and DNS services.

Tactics: TA0042
Techniques: T1584
Input: Once the user clicks on the fake Adobe Flash Player installer, it will extract/create the following malicious payload into the Startup directory to maintain its persistence:

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Magic Hound has attempted to lure victims into opening malicious links embedded in emails.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: The PSReadLine command history tracks the commands used in all PowerShell sessions and writes them to a file ($env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt by default).

Tactics: TA0005
Techniques: T1070, T1070.003
Input: Most of them manipulate the machine to download and execute different files

Tactics: TA0011
Techniques: T1105
Input: All other programs should be considered suspicious.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: njRAT can launch a command shell interface for executing commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: A legitimate website is compromised where adversaries have injected some form of malicious code such as JavaScript, iFrames, and cross-site scripting.

Tactics: TA0001
Techniques: T1189
Input: Monitor for suspicious email activity, such as numerous accounts receiving messages from a single unusual/unknown sender.

Tactics: TA0043
Techniques: T1598.002, T1598, T1598.003
Input: If the signature is valid, and the person examining the certificate trusts the signer, then they know they can use that key to communicate securely with its owner.

Tactics: TA0042
Techniques: T1608.003, T1608
Input: Implement strict Identity and Access Management (IAM) controls to prevent access to storage solutions except for the applications, users, and services that require access.

Tactics: TA0009
Techniques: T1530
Input: PoetRAT has used FTP for C2 communications.

Tactics: TA0011
Techniques: T1071.002, T1071
Input: Gamaredon Group malware has collected Microsoft Office documents from mapped network drives.

Tactics: TA0009
Techniques: T1039
Input: Stealth Falcon malware encrypts C2 traffic using RC4 with a hard-coded key.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Monitor network data for uncommon SMB data flows.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: The LNK file is finally used to identify a third file: a ZIP file

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: There are multiple ways to access the Task Scheduler in Windows.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Winnti Group looked for a specific process running on infected servers.

Tactics: TA0007
Techniques: T1057
Input: SynAck enumerates all running processes.

Tactics: TA0007
Techniques: T1057
Input: Network packets contain a string with two pieces of information: a file path and the contents of the file in a base64 encoded string.

Tactics: TA0010
Techniques: T1041
Input: It then uses the base64 encoding function with this alphabet to encode the data, which in the above case resulted in: D-7Ig1ngV3PkdouzP974 The Trojan then creates a string of 9 random symbols and appends the encoded ciphertext to this random string

Tactics: TA0005, TA0011
Techniques: T1132, T1573, T1027
Input: Lokibot has used several packing methods for obfuscation.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Monitor newly constructed files being written with extensions and/or headers associated with compressed or encrypted file types.

Tactics: TA0009
Techniques: T1560.002, T1560.001, T1560.003, T1560
Input: Analyze differences to determine if malicious changes have occurred.

Tactics: TA0003, TA0005
Techniques: T1542.001, T1542
Input: Higaisa used AES-128 to encrypt C2 traffic.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: APT3 has a tool that can run DLLs.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Monitor for anomalous Kerberos activity, such as malformed or blank fields in Windows logon/logoff events (Event ID 4624, 4634, 4672).

Tactics: TA0006
Techniques: T1558.002, T1558, T1558.001
Input: ISMInjector is obfuscated with the off-the-shelf SmartAssembly .NET obfuscator created by red-gate.com.

Tactics: TA0005
Techniques: T1027
Input: Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool.

Tactics: TA0005
Techniques: T1036, T1036.001
Input: Stuxnet can propagate via removable media using an autorun.inf file or the CVE-2010-2568 LNK vulnerability.

Tactics: TA0001, TA0008
Techniques: T1091
Input: LightNeuron gathers the victim computer name using the Win32 API call GetComputerName.

Tactics: TA0007
Techniques: T1082
Input: Koadic can scan local network for open SMB.

Tactics: TA0007
Techniques: T1135
Input: iKitten adds an entry to the rc.common file for persistence.

Tactics: TA0003, TA0004
Techniques: T1037.004, T1037
Input: Example resources include specific websites, email services, DNS, and web-based applications.

Tactics: TA0040
Techniques: T1498
Input: The threat actors also took additional steps to replace some variable strings in the more recent samples, likely in an attempt to avoid signature-based detection from Yara rules. Once the document was opened, it prompted the user to enable the macro titled "BlackWater.bas".

Tactics: TA0002
Techniques: T1204
Input: Zebrocy uses SSL and AES ECB for encrypting C2 communications.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Adversaries may also utilize this technique to perform SID-History Injection and/or manipulate AD objects (such as accounts, access control lists, schemas) to establish backdoors for Persistence.

Tactics: TA0005
Techniques: T1207
Input: GoldenSpy's setup file installs initial executables under the folder %WinDir%\System32\PluginManager.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: QuasarRAT can obtain passwords from common FTP clients.

Tactics: TA0006
Techniques: T1555
Input: VERMIN is initially packed.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Spark can use cmd.exe to run commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Spark has been packed with Enigma Protector to obfuscate its contents.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: In general, adversaries may manipulate, overwrite, or corrupt firmware in order to deny the use of the system or devices.

Tactics: TA0040
Techniques: T1495
Input: Windows implements file and directory ACLs as Discretionary Access Control Lists (DACLs).

Tactics: TA0005
Techniques: T1222, T1222.001
Input: Confucius has used a file stealer to steal documents and images with the following extensions: txt, pdf, png, jpg, doc, xls, xlm, odp, ods, odt, rtf, ppt, xlsx, xlsm, docx, pptx, and jpeg.

Tactics: TA0009
Techniques: T1119
Input: Adversaries may exploit a system or application vulnerability to bypass security features.

Tactics: TA0005
Techniques: T1211
Input: Aria-body has the ability to inject itself into another process such as rundll32.exe and dllhost.exe.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: NBTscan can list active users on the system.

Tactics: TA0007
Techniques: T1033
Input: APT28 used other victims as proxies to relay command traffic, for instance using a compromised Georgian military email server as a hop point to NATO victims.

Tactics: TA0011
Techniques: T1090, T1090.002
Input: Secure Shell (SSH) is a standard means of remote access on Linux and macOS systems.

Tactics: TA0008
Techniques: T1563, T1563.001
Input: Mimikatz's SEKURLSA::Pth module can impersonate a user, with only a password hash, to execute arbitrary commands.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: njRAT can be configured to spread via removable drives.

Tactics: TA0001, TA0008
Techniques: T1091
Input: Proxies may be chosen based on the low likelihood that a connection to them from a compromised system would be investigated.

Tactics: TA0011
Techniques: T1090, T1090.002
Input: P.A.S. Webshell has the ability to list and extract data from SQL databases.

Tactics: TA0009
Techniques: T1213
Input: Waterbear can find the presence of a specific security software.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: H1N1 kills and disables services by using cmd.exe.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: ComRAT has encrypted its virtual file system using AES-256 in XTS mode and has encoded PowerShell scripts.

Tactics: TA0005
Techniques: T1027
Input: This setting should be defined for the local system account only.

Tactics: TA0004, TA0005
Techniques: T1134.002, T1134.003, T1134, T1134.001
Input: To run persistently on the system, the Trojan will first create a VBScript file:SpecialFolder.CommonApplicationData\srvResesponded.vbs that contains:CreateObject(“WScript.Shell”).Run(“%app%”) The Trojan replaces the %app% string in the above VBScript with the path to its executable

Tactics: TA0002
Techniques: T1059
Input: APT38 has obtained and used open-source tools such as Mimikatz.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Examining historical IP resolutions revealed a common IP between the active nameservers, 107.175.75[.]123

Tactics: TA0007
Techniques: T1016
Input: In this context the main function is executed."Console": with the argument, a persistence is configured and the malware will be executed at the next reboot ( HKCU\Software\Microsoft\Windows\CurrentVersion\Run\runsample )."Sample": with this argument, the malware executes the console command followed by the help command.The information collected is performed using WMI queries:Additionally the malware lists the running process via the Microsoft Windows API

Tactics: TA0002
Techniques: T1106
Input: Monitor executed commands and arguments that may employ various means to detect and avoid debugged environments.

Tactics: TA0005, TA0007
Techniques: T1622
Input: PUNCHTRACK is loaded and executed by a highly obfuscated launcher.

Tactics: TA0005
Techniques: T1027
Input: APT32 includes garbage code to mislead anti-malware software and researchers.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: Kimsuky has used pass the hash for authentication to remote access software used in C2.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: Variants of Emissary have used rundll32.exe in Registry values added to establish persistence.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Drovorub has de-obsfuscated XOR encrypted payloads in WebSocket messages.

Tactics: TA0005
Techniques: T1140
Input: APT18 obfuscates strings in the payload.

Tactics: TA0005
Techniques: T1027
Input: Similar to Process Injection, these values can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.010
Input: DNS traffic may also be allowed even before network authentication is completed.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Monitor executed commands and arguments that may establish persistence by executing malicious content triggered by an interrupt signal.

Tactics: TA0003, TA0004
Techniques: T1546.005, T1546
Input: The "Blackwater.bas" macro was obfuscated using a substitution cipher whereby the characters are replaced with their corresponding integer.

Tactics: TA0005
Techniques: T1027
Input: at the beginning of the file name followed by 9 random characters.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: WEBC2 can open an interactive command shell.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Torisma can collect the current time on a victim machine.

Tactics: TA0007
Techniques: T1124
Input: Exaramel for Windows has a command to launch a remote shell and executes commands on the victim’s machine.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Set group policies to restrict file permissions to the ~/launchagents folder.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: NBTscan can be used to collect MAC addresses.

Tactics: TA0007
Techniques: T1016
Input: New print processor DLLs are written to the print processor directory.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.012
Input: Use utilities that detect or mitigate common features used in exploitation, such as the Microsoft Enhanced Mitigation Experience Toolkit (EMET).

Tactics: TA0008
Techniques: T1080
Input: The latter PowerShell injects a shellcode into its own process using well-known CreateThread and VirtualAlloc techniques:   SHELLCODE: The shellcode phase of this attack is unique and demonstrates the constantly advancing abilities of attackers

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Consider monitoring API calls such as CredEnumerateA that may list credentials from the Windows Credential Manager.

Tactics: TA0006
Techniques: T1555, T1555.004
Input: Cuba can download files from its C2 server.

Tactics: TA0011
Techniques: T1105
Input: Dragonfly has manipulated .lnk files to gather user credentials in conjunction with Forced Authentication.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: WINDSHIELD C2 traffic can communicate via TCP raw sockets.

Tactics: TA0011
Techniques: T1095
Input: Chimera has collected credentials for the target organization from previous breaches for use in brute force attacks.

Tactics: TA0043
Techniques: T1589, T1589.001
Input: Molerats used executables to download malicious files from different sources.

Tactics: TA0011
Techniques: T1105
Input: Data is exchanged via HTTP POSTs.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: HTTPBrowser is capable of capturing keystrokes on victims.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Modify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole associated with system-wide security defaults for all COM applications that do not set their own process-wide security.

Tactics: TA0008
Techniques: T1021.003, T1021
Input: Sandworm Team has enumerated files on a compromised host.

Tactics: TA0007
Techniques: T1083
Input: FlawedAmmyy beacons out the victim operating system and computer name during the initial infection.

Tactics: TA0007
Techniques: T1082
Input: This technique may bypass system logging and security monitors such as security information and event management (SIEM) products (since actions taken on a rogue DC may not be reported to these sensors).

Tactics: TA0005
Techniques: T1207
Input: Zebrocy also uses AES and XOR to decrypt strings and payloads.

Tactics: TA0005
Techniques: T1140
Input: Adversaries may abuse the ROM Monitor (ROMMON) by loading an unauthorized firmware with adversary code to provide persistent access and manipulate device behavior that is difficult to detect.

Tactics: TA0003, TA0005
Techniques: T1542.004, T1542