madox81/Adema_ATTACK_DS huggingface dataset:
Input: It then launches player.exe, a CozyDuke dropper maintaining anti-detection techniques: 3d3363598f87c78826c859077606e514,player.exe,338kb,Trojan.Win32.CozyBear.v,CompiledOn:2014.07.02 21:13:33 Anti-detection and trojan functionality The file collects system information, and then invokes a WMI instance in the root\securitycenter namespace to identify security products installed on the system, meaning that this code was built for x86 systems, wql here: SELECT * FROM AntiVirusProduct SELECT * FROM FireWallProduct The code hunts for several security products to evade: CRYSTAL KASPERSKY SOPHOS DrWeb AVIRA COMODO Dragon In addition to the WMI/wql use, it also hunts through the “SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\” registry key looking for security products to avoid

Tactics: TA0005, TA0007
Techniques: T1518.001, T1036, T1518
Input: Also monitor for and investigate changes to host adapter settings, such as addition and/or replication of communication interfaces.

Tactics: TA0010
Techniques: T1011.001, T1011
Input: Hydraq creates a backdoor through which remote attackers can retrieve IP addresses of compromised machines.

Tactics: TA0007
Techniques: T1016
Input: WarzoneRAT can create HKCU\Software\Classes\Folder\shell\open\command as a new registry key during privilege escalation.

Tactics: TA0005
Techniques: T1112
Input: APT28 has performed timestomping on victim files.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: Drovorub can use the WebSocket protocol and has initiated communication with C2 servers with an HTTP Upgrade request.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Mustang Panda has sent malicious files requiring direct victim interaction to execute.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Limit privileges of user accounts so only authorized users can edit the rc.common file.

Tactics: TA0003, TA0004
Techniques: T1037.004, T1037
Input: Empire can leverage its implementation of Mimikatz to obtain and use silver tickets.

Tactics: TA0006
Techniques: T1558.002, T1558
Input: Establish network access control policies, such as using device certificates and the 802.1x standard.

Tactics: TA0001
Techniques: T1200
Input: The SSL/TLS protocol suite includes mechanisms for the client and server to agree on an encryption algorithm to use for subsequent secure connections.

Tactics: TA0040
Techniques: T1499.002, T1499
Input: From those servers the threat actor could use a web shell to retrieve the encrypted archives:  copy \\{FILE PATH}\c$\programdata\*.tmp \\{FILE PATH}\ServiceDesk\custom\style After exfiltrating the files, the threat actor used web shell access on the staging server to delete the staged RAR archives and detach their network shares, likely to avoid detection

Tactics: TA0003, TA0005
Techniques: T1505.003, T1070, T1505, T1070.004
Input: SeaDuke is capable of persisting via the Registry Run key or a .lnk file stored in the Startup directory.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Disable Autorun if it is unnecessary.

Tactics: TA0001, TA0008, TA0010
Techniques: T1052, T1091, T1052.001
Input: MacSpy uses Tor for command and control.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: Higaisa named a shellcode loader binary svchast.exe to spoof the legitimate svchost.exe.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Autoruns will hide entries signed by Microsoft or Windows by default, so ensure "Hide Microsoft Entries" and "Hide Windows Entries" are both deselected.

Tactics: TA0005
Techniques: T1553, T1553.003
Input: Consider monitoring for commands and arguments that may be atypical for benign use of virtualization software.

Tactics: TA0005
Techniques: T1564, T1564.006
Input: HIDEDRV is a rootkit that hides certain operating system artifacts.

Tactics: TA0005
Techniques: T1014
Input: The creation of a snapshot is a common part of operations within many cloud environments.

Tactics: TA0005
Techniques: T1578, T1578.001
Input: AuditCred is installed as a new service on the system.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: A variety of popular websites exist for adversaries to register for a web-based service that can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service) or Exfiltration Over Web Service.

Tactics: TA0042
Techniques: T1583.006, T1583
Input: Final1stspy obtains victim Microsoft Windows version information and CPU architecture.

Tactics: TA0007
Techniques: T1082
Input: Adversaries may create self-signed SSL/TLS certificates that can be used to further their operations, such as encrypting C2 traffic (ex: Asymmetric Cryptography with Web Protocols) or even enabling Adversary-in-the-Middle if added to the root of trust ( Install Root Certificate).

Tactics: TA0042
Techniques: T1587, T1587.003
Input: Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data.

Tactics: TA0040
Techniques: T1565
Input: This information can be used to enumerate offsets (including the stack) and gadgets (or instructions within the program that can be used to build a malicious payload) otherwise hidden by process memory protections such as address space layout randomization (ASLR).

Tactics: TA0004, TA0005
Techniques: T1055.009, T1055
Input: Epic collects the OS version, hardware information, computer name, available system memory status, disk space information, and system and user language settings.

Tactics: TA0007
Techniques: T1082
Input: Zyklon is a publicly available, full-featured backdoor capable of keylogging, password harvesting, downloading and executing additional plugins, conducting distributed denial-of-service (DDoS) attacks, and self-updating and self-removal

Tactics: TA0011
Techniques: T1105
Input: Figure 10: Network traffic to download final payload (words.exe) Once executed, the file performs the following activities:  Drops a copy of itself in %AppData%\svchost.exe\svchost.exe and drops an XML file, which contains configuration information for Task Scheduler (as shown in Figure 11)

Tactics: TA0005
Techniques: T1036
Input: CopyKittens encrypts data with a substitute cipher prior to exfiltration.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: RIPTIDE’s first communication with its C2 server fetches an encryption key, and the RC4 encryption key is used to encrypt all further communication

Tactics: TA0011
Techniques: T1573
Input: Sandworm Team used malware to enumerate email settings, including usernames and passwords, from the M.E.Doc application.

Tactics: TA0007
Techniques: T1087.003, T1087
Input: A version of KONNI searches for filenames created with a previous version of the malware, suggesting different versions targeted the same victims and the versions may work together.

Tactics: TA0007
Techniques: T1083
Input: Confucius has used a file stealer that can examine system drives, including those other than the C drive.

Tactics: TA0007
Techniques: T1082
Input: The AppInit DLL functionality is disabled in Windows 8 and later versions when secure boot is enabled.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.010
Input: DarkWatchman can stage local data in the Windows Registry.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Instead of using systeminfo and tasklist commands, the C# variant of Zebrocy uses WMI queries to gather this information

Tactics: TA0002
Techniques: T1047
Input: Use process monitoring to monitor the execution and arguments of verclsid.exe.

Tactics: TA0005
Techniques: T1218, T1218.012
Input: Adversaries may send spearphishing messages with a malicious attachment to elicit sensitive information that can be used during targeting.

Tactics: TA0043
Techniques: T1598.002, T1598
Input: Crutch can exfiltrate files from compromised systems.

Tactics: TA0009
Techniques: T1005
Input: The decoded string from the Sch resource is: SchTasks /Create /SC MINUTE /MO 3 /TN “%n%” /TR “wscript %path%” /f The decoded string from the VBS resource is: CreateObject(“WScript.Shell”).Run(“%app%”) The %n% string in the schtasks command above will be replaced with the GUID saved to GDI.bin

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Chimera has used a Windows version of the Linux touch command to modify the date and time stamp on DLLs.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: PoshC2 can enumerate files on the local file system and includes a module for enumerating recently accessed files.

Tactics: TA0007
Techniques: T1083
Input: If the dwell time value for the active mode has been set, but the package has not been received, the dwell time value is incremented by the dwell time value for the active period

Tactics: TA0007
Techniques: T1124
Input: Imminent Monitor has a PasswordRecoveryPacket module for recovering browser passwords.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: BRONZE BUTLER has masked executables with document file icons including Word and Adobe PDF.

Tactics: TA0005
Techniques: T1036
Input: Monitor executed commands and arguments that may abuse AppleScript for execution.

Tactics: TA0002
Techniques: T1059.002, T1059
Input: Windshift has used malware to identify the username on a compromised host.

Tactics: TA0007
Techniques: T1033
Input: Emphasis may be placed on detecting related aspects of the adversary lifecycle, such as how malware interacts with the hidden file system or how a hidden file system is loaded.

Tactics: TA0005
Techniques: T1564, T1564.005
Input: Second, the threat actors exploit CVE-2017-8570 to achieve code execution via a malicious “scriptlet” file, or .sct file, which is also embedded in the malicious RTF document

Tactics: TA0002
Techniques: T1203
Input: Gazer obtains the current user's security identifier.

Tactics: TA0007
Techniques: T1033
Input: TA505 has used fast flux to mask botnets by distributing payloads across multiple IPs.

Tactics: TA0011
Techniques: T1568.001, T1568
Input: After running within the %TEMP% path, Comnie will delete the original file

Tactics: TA0005
Techniques: T1070, T1070.004
Input: By requiring a password, even if an adversary can get terminal access, they must know the password to run anything in the sudoers file.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: Monitor for any attempts to enable scripts running on a system would be considered suspicious.

Tactics: TA0002, TA0005, TA0006, TA0007, TA0009, TA0010
Techniques: T1559, T1059.007, T1140, T1005, T1564.003, T1056.002, T1559.001, T1560.002, T1119, T1562.002, T1560.003, T1482, T1559.002, T1020, T1560, T1564, T1059.001, T1059.005, T1016, T1562, T1216.001, T1059, T1056, T1615, T1216
Input: However, adversaries commonly use token stealing to elevate their security context from the administrator level to the SYSTEM level.

Tactics: TA0004, TA0005
Techniques: T1134
Input: They are known for “living off the land,” meaning they use already available tools and software installed on the computer to operate, and once inside a target network, they will tailor their malware specifically to the target

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Kimsuky has used RDP for direct remote point-and-click access.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Sandworm Team has used PowerShell scripts to run a credential harvesting tool in memory to evade defenses.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Ke3chang has used implants to collect the system language ID of a compromised machine.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes.

Tactics: TA0006, TA0009
Techniques: T1056
Input: ZIRCONIUM has used the AES256 algorithm with a SHA1 derived key to decrypt exploit code.

Tactics: TA0005
Techniques: T1140
Input: RainyDay has the ability to capture screenshots.

Tactics: TA0009
Techniques: T1113
Input: Monitor for unexpected deletion of  client software binaries to establish persistent access to systems.

Tactics: TA0003
Techniques: T1554
Input: Network sniffing may also reveal configuration details, such as running services, version numbers, and other network characteristics ( IP addresses, hostnames, VLAN IDs) necessary for subsequent Lateral Movement and/or Defense Evasion activities.

Tactics: TA0006, TA0007
Techniques: T1040
Input: KONNI can delete files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: In Google Workspace, the GAL is shared with Microsoft Outlook users through the Google Workspace Sync for Microsoft Outlook (GWSMO) service.

Tactics: TA0007
Techniques: T1087.003, T1087
Input: Search order hijacking is also a common practice for hijacking DLL loads and is covered in DLL Search Order Hijacking.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.008, T1574
Input: Adversaries may use Patch System Image to change the operating system of a network device, implementing their own custom NAT mechanisms to further obscure their activities

Tactics: TA0005
Techniques: T1599, T1599.001
Input: Scarlet Mimic has used the left-to-right override character in self-extracting RAR archive spearphishing attachment file names.

Tactics: TA0005
Techniques: T1036, T1036.002
Input: In one example, BRONZE UNION actors leveraged initial web shell access on Internet-facing systems to conduct internal reconnaissance, including domain enumeration and network state, via ipconfig, net use, net user, and net view commands

Tactics: TA0007
Techniques: T1018
Input: This prevented the User Access Control window from appearing.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574
Input: APT28 has collected files from network shared drives.

Tactics: TA0009
Techniques: T1039
Input: InnaputRAT variants have attempted to appear legitimate by adding a new service named OfficeUpdateService.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: WIRTE has used HTTPS over ports 2083 and 2087 for C2.

Tactics: TA0011
Techniques: T1571
Input: PHOTO: a DLL backdoor also reported publicly as “Derusbi”, capable of obtaining directory, file, and drive listing; creating a reverse shell; performing screen captures; recording video and audio; listing, terminating, and creating processes; enumerating, starting, and deleting registry keys and values; logging keystrokes, returning usernames and passwords from protected storage; and renaming, deleting, copying, moving, reading, and writing to files

Tactics: TA0007
Techniques: T1083
Input: Dragonfly has modified the Registry to hide created user accounts.

Tactics: TA0005
Techniques: T1564.002, T1564
Input: Darkhotel has decrypted strings and imports using RC4 during execution.

Tactics: TA0005
Techniques: T1140
Input: Bonadan can use the ps command to discover other cryptocurrency miners active on the system.

Tactics: TA0007
Techniques: T1057
Input: Clop can make modifications to Registry keys.

Tactics: TA0005
Techniques: T1112
Input: Proton persists via Launch Agent.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: Cobalt Strike can make tokens from known credentials.

Tactics: TA0004, TA0005
Techniques: T1134.003, T1134
Input: This may also reduce the likelihood of being collected for analysis.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: CrackMapExec can gather the user accounts within domain groups.

Tactics: TA0007
Techniques: T1069.002, T1069
Input: A backdoor used by APT29 created a Tor hidden service to forward traffic from the Tor client to local ports 3389 (RDP), 139 (Netbios), and 445 (SMB) enabling full remote access from outside the network and has also used TOR.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: ThiefQuest uploads files via unencrypted HTTP.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Cuba can modify services by using the OpenService and ChangeServiceConfig functions.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Adversaries can provide malicious content to an XPC service daemon for local code execution.

Tactics: TA0002
Techniques: T1559, T1559.003
Input: Magic Hound has used compromised domains to host links targeted to specific phishing victims.

Tactics: TA0042
Techniques: T1584.001, T1584
Input: FIVEHANDS has the ability to delete volume shadow copies on compromised hosts.

Tactics: TA0040
Techniques: T1490
Input: Avenger has the ability to XOR encrypt files to be sent to C2.

Tactics: TA0005
Techniques: T1027
Input: This may further enable use of additional techniques for gaining access to systems.

Tactics: TA0003
Techniques: T1098.002, T1098
Input: Monitoring DLL module loads may generate a significant amount of data and may not be directly useful for defense unless collected under specific circumstances, since benign use of Windows modules load functions are common and may be difficult to distinguish from malicious behavior.

Tactics: TA0002
Techniques: T1129
Input: After obtaining a digital certificate, an adversary may then install that certificate (see Install Digital Certificate) on infrastructure under their control.

Tactics: TA0042
Techniques: T1588.004, T1588
Input: In Linux and macOS environments, scheduled tasks using at can be audited locally, or through centrally collected logging, using syslog, or auditd events from the host.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: Avenger has the ability to identify installed anti-virus products on a compromised host.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Adversaries may therefore obscure malicious code by creating multiple identical exported function names and appending W and/or A to harmless ones.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: The tool would connect to the SQL SharePoint database and issue a query to dump all data from the database to a temporary file affixed with 'spdata'

Tactics: TA0006
Techniques: T1003
Input: Monitor access to files and directories related to cryptographic keys and certificates as a means for potentially detecting access patterns that may indicate collection and exfiltration activity.

Tactics: TA0006
Techniques: T1552.004, T1552
Input: Windows Security Support Provider (SSP) DLLs are loaded into LSSAS process at system start.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: ShimRatReporter spoofed itself as AlphaZawgyl_font.exe, a specialized Unicode font.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: The adversary may reply with their MAC address, thus deceiving the victim by making them believe that they are communicating with the intended networked device.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.002
Input: However, execution via process doppelgänging may evade detection from security products since the execution is masked under a legitimate process.

Tactics: TA0004, TA0005
Techniques: T1055.013, T1055
Input: BISCUIT uses SSL for encrypting C2 communications.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: The actors have made some small changes, such as altering the variable names to avoid Yara detection

Tactics: TA0005
Techniques: T1027
Input: Restrict storage and execution of Control Panel items to protected directories, such as C:\Windows, rather than user directories.

Tactics: TA0005
Techniques: T1218, T1218.002
Input: Epic uses the net view command on the victim’s machine.

Tactics: TA0007
Techniques: T1018
Input: Zebrocy also runs the echo %APPDATA% command to list the contents of the directory.

Tactics: TA0007
Techniques: T1083
Input: Server Command and control server that communicates via DNS tunneling   Panel Graphical User Interface that allows actors to issue commands, upload and download files to Agents via the Server    Table 2

Tactics: TA0011
Techniques: T1071
Input: Ensure that proper logging of accounts used to log into systems is turned on and centrally collected.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: FELIXROOT uses Rundll32 for executing the dropper program.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: RARSTONE downloads its backdoor component from a C2 server and loads it directly into memory.

Tactics: TA0011
Techniques: T1105
Input: Additionally, the appendices of this report provide network signatures to aid in the detection and mitigation of HIDDEN COBRA activity.Network Signatures and Host-Based RulesThis section contains network signatures and host-based rules that can be used to detect malicious activity associated with HIDDEN COBRA actors

Tactics: TA0005, TA0007, TA0008, TA0011
Techniques: T1021, T1021.002, T1046, T1090.003, T1564, T1090, T1016, T1018, T1564.001
Input: Figure 3: Embedded URL in OLE object CVE-2017-11882 Similarly, we have also observed actors leveraging another recently discovered vulnerability (CVE-2017-11882) in Microsoft Office

Tactics: TA0002
Techniques: T1203
Input: GrimAgent can use Native API including GetProcAddress and ShellExecuteW.

Tactics: TA0002
Techniques: T1106
Input: Magic Hound has deleted and overwrote files to cover tracks.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Prevent critical business and system processes from being replaced, overwritten, or reconfigured to load potentially malicious code.

Tactics: TA0040
Techniques: T1565.003, T1565
Input: DustySky achieves persistence by creating a Registry entry in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Users can be trained to identify social engineering techniques and spearphishing messages with malicious links.

Tactics: TA0001
Techniques: T1566.003, T1566
Input: In this instance a spear phishing email was used containing a lure designed to socially engineer and entice the victim to executing a malicious attachment

Tactics: TA0001
Techniques: T1566, T1566.001
Input: InvisiMole can gather information on the mapped drives, OS version, computer name, DEP policy, memory size, and system volume serial number.

Tactics: TA0007
Techniques: T1082
Input: Patchwork used Base64 to encode C2 traffic.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Commands and scripts can be embedded in Initial Access payloads delivered to victims as lure documents or as secondary payloads downloaded from an existing C2.

Tactics: TA0002
Techniques: T1059
Input: Ptrace system call injection can also be done with PTRACE_POKETEXT/PTRACE_POKEDATA, which copy data to a specific address in the target processes’ memory (ex: the current address of the next instruction).

Tactics: TA0004, TA0005
Techniques: T1055.008, T1055
Input: RTLO is a non-printing Unicode character that causes the text that follows it to be displayed in reverse.

Tactics: TA0005
Techniques: T1036, T1036.002
Input: Adversaries may abuse IPC to execute arbitrary code or commands.

Tactics: TA0002
Techniques: T1559
Input: HAWKBALL has used an OLE object that uses Equation Editor to drop the embedded shellcode.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: esentutl can be used to copy files from a given URL.

Tactics: TA0011
Techniques: T1105
Input: StrongPity has named services to appear legitimate.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Evidence also supports the hypothesis that there is a encryption plugin for victim files (see below)

Tactics: TA0005
Techniques: T1027
Input: Monitor the registry for changes associated with system recovery features (ex: the creation of HKEY_CURRENT_USER\Software\Policies\Microsoft\PreviousVersions\DisableLocalPage).

Tactics: TA0040
Techniques: T1490
Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Spearphishing via Service).

Tactics: TA0043
Techniques: T1593, T1593.001
Input: Net can be used to query a remote system for available shared drives using the net view \\remotesystem command.

Tactics: TA0007
Techniques: T1135
Input: OopsIE can upload files from the victim's machine to its C2 server.

Tactics: TA0010
Techniques: T1041
Input: Mythic supports SSL encrypted C2.

Tactics: TA0011
Techniques: T1573, T1573.002