madox81/Adema_ATTACK_DS huggingface dataset:
Input: Consider analyzing packet contents to detect application layer protocols, leveraging SSL/TLS inspection for encrypted traffic, that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, protocol port mismatch, anomalous syntax, or structure).

Tactics: TA0010
Techniques: T1030
Input: TrickBot has been known to use PowerShell to download new payloads, open documents, and upload data to command and control servers.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: 3PARA RAT command and control commands are encrypted within the HTTP C2 channel using the DES algorithm in CBC mode with a key derived from the MD5 hash of the string HYF54&%9&jkMCXuiS.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Adversaries can execute content with an attached resource fork, at a specified offset, that is moved to an executable location then invoked.

Tactics: TA0005
Techniques: T1564, T1564.009
Input: DEATHRANSOM can enumerate logical drives on a target system.

Tactics: TA0007
Techniques: T1082
Input: Gamaredon Group has attempted to get users to click on Office attachments with malicious macros embedded.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Adversaries can use common management tools and protocols, such as Simple Network Management Protocol (SNMP) and Smart Install (SMI), to access network configuration files.

Tactics: TA0009
Techniques: T1602, T1602.002
Input: Adversaries may also abuse MMC to execute malicious .msc files.

Tactics: TA0005
Techniques: T1218, T1218.014
Input: This action is repeated until the dwell time value is bigger or equal to the dwell time value for the standby mode

Tactics: TA0007
Techniques: T1124
Input: Confucius has exploited Microsoft Office vulnerabilities, including CVE-2015-1641, CVE-2017-11882, and CVE-2018-0802.

Tactics: TA0002
Techniques: T1203
Input: Octopus has encoded C2 communications in Base64.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: If the property is enabled and/or a user changes their password after it is enabled, an adversary may be able to obtain the plaintext of passwords created/changed after the property was enabled.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.005
Input: The payload will use a specific regular expressions dependent on the type of DNS query was used to obtain the command string, which can be seen in Table 2:    DNS TYPE Regex Pattern   A Address:\s+(\d+.\d+.\d+.\d+)   AC \d+-\d+-(\d+)-([\w\d+/=]+)-\d-.ac.$Global:domain   AAAA Address:\s+(([a-fA-F0-9]{0,4}:{1,4}[\w|:]+){1,8})   CNAME,MX,TXT,SRV,SOA (\d+)-([\w\d/=+]{0,})\-.$Global:domain    Table 2 Types of responses provided by C2 These regular expressions are used to build strings that the payload will then subject to its command handler

Tactics: TA0007, TA0011
Techniques: T1071, T1016
Input: KOCTOPUS has relied on victims clicking a malicious document for execution.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Operation Wocao has used scheduled tasks to execute malicious PowerShell code on remote systems.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: /var/log/kern.log: Kernel logs

Tactics: TA0005
Techniques: T1070, T1070.002
Input: Zebrocy gathers the current time zone and date information from the system.

Tactics: TA0007
Techniques: T1124
Input: APT39 has used various strains of malware to query the Registry.

Tactics: TA0007
Techniques: T1012
Input: PowerDuke has a command to get the victim's domain and NetBIOS name.

Tactics: TA0007
Techniques: T1016
Input: BoomBox has gained execution through user interaction with a malicious file.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Monitor Registry writes to HKLM\SYSTEM\ControlSet001\Control\Print\Environments\[Windows architecture]\Print Processors\[user defined]\Driver or HKLM\SYSTEM\CurrentControlSet\Control\Print\Environments\[Windows architecture]\Print Processors\[user defined]\Driver as they pertain to print processor installations.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.012
Input: BADNEWS attempts to hide its payloads using legitimate filenames.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Nerex creates a backdoor through which remote attackers can download files onto a compromised host.

Tactics: TA0011
Techniques: T1105
Input: Monitor for changes made to files that may perform shell escapes or exploit vulnerabilities in an application with the setsuid or setgid bits to get code running in a different user’s context.

Tactics: TA0004, TA0005
Techniques: T1548, T1548.001
Input: APT32 has infected victims by tricking them into visiting compromised watering hole websites.

Tactics: TA0001
Techniques: T1189
Input: In this case, after the payload is delivered via an exploit the threat actor places files (named upload.bat, upload.rar, and period.txt, download.txt or silent.txt) in a directory on a Dropbox account

Tactics: TA0011
Techniques: T1105
Input: Ferocious has the ability to add a Class ID in the current user Registry hive to enable persistence mechanisms.

Tactics: TA0005
Techniques: T1112
Input: Monitor newly executed processes that may gather information in an attempt to calculate the geographical location of a victim host.

Tactics: TA0007
Techniques: T1614
Input: The Windows Registry stores configuration information that can be used by the system or other programs.

Tactics: TA0006
Techniques: T1552, T1552.002
Input: When System Integrity Protection (SIP) is enabled in macOS, the aforementioned environment variables are ignored when executing protected binaries.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.006, T1574
Input: EKANS removes backups of Volume Shadow Copies to disable any restoration capabilities.

Tactics: TA0040
Techniques: T1490
Input: njRAT can browse file systems using a file manager module.

Tactics: TA0007
Techniques: T1083
Input: OLDBAIT can use SMTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.003
Input: Threat Group-3390 has hosted malicious payloads on Dropbox.

Tactics: TA0042
Techniques: T1608.001, T1608
Input: CHM content is displayed using underlying components of the Internet Explorer browser  loaded by the HTML Help executable program (hh.exe).

Tactics: TA0005
Techniques: T1218, T1218.001
Input: Blue Mockingbird has used Windows Scheduled Tasks to establish persistence on local and remote hosts.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: The default lifetime of a SAML token is one hour, but the validity period can be specified in the NotOnOrAfter value of the conditions ... element in a token.

Tactics: TA0006
Techniques: T1606, T1606.002
Input: ShimRatReporter listed all non-privileged and privileged accounts available on the machine.

Tactics: TA0007
Techniques: T1087
Input: StoneDrill has obfuscated its module with an alphabet-based table or XOR encryption.

Tactics: TA0005
Techniques: T1027
Input: Microsoft also created, and enabled by default, Registry keys to completely disable DDE execution in Word and Excel.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: Kimsuky has created accounts with net user.

Tactics: TA0003
Techniques: T1136, T1136.001
Input: Cobalt Strike uses a custom command and control protocol that is encapsulated in HTTP, HTTPS, or DNS.

Tactics: TA0011
Techniques: T1572
Input: APT28 has deployed a bootkit along with Downdelph to ensure its persistence on the victim.

Tactics: TA0003, TA0005
Techniques: T1542.003, T1542
Input: Monitor for loading and/or execution of artifacts associated with PowerShell specific assemblies, such as System.Management.Automation.dll (especially to unusual process names/locations).

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Detection of this technique may be difficult due to the various APIs that may be used.

Tactics: TA0009
Techniques: T1125
Input: Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, ) during acquisition of infrastructure (Domains) to help facilitate Drive-by Compromise.

Tactics: TA0042
Techniques: T1608.004, T1608
Input: Ursnif has used crypto key information stored in the Registry to decrypt Tor clients dropped to disk.

Tactics: TA0005
Techniques: T1140
Input: RTM has been delivered as archived Windows executable files masquerading as PDF documents.

Tactics: TA0005
Techniques: T1036
Input: Lazarus Group has targeted victims with spearphishing emails containing malicious Microsoft Word documents.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Microsoft Sysinternals PsExec is a popular administration tool that can be used to execute binaries on remote systems using a temporary Windows service.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Monitor interactions with network shares, such as reads or file transfers, using remote services such as Server Message Block (SMB).

Tactics: TA0008
Techniques: T1021
Input: LockerGoga has been observed deleting its original launcher after execution.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: APT41 leveraged code-signing certificates to sign malware when targeting both gaming and non-gaming organizations.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Pupy can use an add on feature when creating payloads that allows you to create custom Python scripts ("scriptlets") to perform tasks offline (without requiring a session) such as sandbox detection, adding persistence,

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Dtrack’s can download and upload a file to the victim’s computer.

Tactics: TA0011
Techniques: T1105
Input: FoggyWeb can configure custom listeners to passively monitor all incoming HTTP GET and POST requests sent to the AD FS server from the intranet/internet and intercept HTTP requests that match the custom URI patterns defined by the actor.

Tactics: TA0006, TA0007
Techniques: T1040
Input: Information about business roles may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites).

Tactics: TA0043
Techniques: T1591.004, T1591
Input: Grandoreiro can determine the time on the victim machine via IPinfo.

Tactics: TA0007
Techniques: T1124
Input: KONNI can download files and execute them on the victim’s machine.

Tactics: TA0011
Techniques: T1105
Input: Disabling SIDHistory on forest trusts using the netdom tool (netdom trust /domain: /EnableSIDHistory:no on the domain controller)

Tactics: TA0004, TA0005
Techniques: T1134.005, T1134
Input: Kazuar stages command output and collected data in files before exfiltration.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: menuPass has used the Microsoft administration tool csvde.exe to export Active Directory data.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: Cuba can use the command cmd.exe /c del to delete its artifacts from the system.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Users typically interact with code repositories through a web application or command-line utilities such as git.

Tactics: TA0009
Techniques: T1213, T1213.003
Input: An example of adversary use of unused AWS regions is to mine cryptocurrency through Resource Hijacking, which can cost organizations substantial amounts of money over time depending on the processing power used.

Tactics: TA0005
Techniques: T1535
Input: LiteDuke can use HTTP GET requests in C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.

Tactics: TA0040
Techniques: T1489
Input: Psylo uses HTTPS for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: MailSniper can be used for searching through email in Exchange and Office 365 environments.

Tactics: TA0009
Techniques: T1114, T1114.002
Input: For example, if a token grants access to a victim’s primary email, the adversary may be able to extend access to all other services which the target subscribes by triggering forgotten password routines.

Tactics: TA0005, TA0008
Techniques: T1550.001, T1550
Input: SoreFang can collect usernames from the local system via net.exe user.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: KONNI has stored collected information and discovered processes in a tmp file.

Tactics: TA0009
Techniques: T1005
Input: These certificates, such as those used for encrypted web traffic (HTTPS SSL/TLS communications), contain information about the registered organization such as name and location.

Tactics: TA0043
Techniques: T1596, T1596.003
Input: KOCTOPUS has been disguised as legitimate software programs associated with the travel and airline industries.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: In Figure 9, below, red indicates targeted IP addresses, malware, registrant information, and domains associated with the targeted attack campaign while blue indicates criminal attack IP addresses, malware used, registrant information, and domains:  Figure 9

Tactics: TA0007
Techniques: T1016
Input: Comnie allows the attacker to provide and subsequently execute a batch script (BAT), executable file (EXE), or dynamic-link library (DLL)

Tactics: TA0002
Techniques: T1059
Input: DropBook can collect the names of all files and folders in the Program Files directories.

Tactics: TA0007
Techniques: T1083
Input: Monitor for many failed authentication attempts across various accounts that may result from password spraying attempts.

Tactics: TA0006
Techniques: T1110.004, T1110, T1110.002, T1110.001, T1110.003
Input: If the command and control network is a wired Internet connection, the exfiltration may occur, for example, over a WiFi connection, modem, cellular data connection, Bluetooth, or another radio frequency (RF) channel.

Tactics: TA0010
Techniques: T1011
Input: HyperBro can list all services and their configurations.

Tactics: TA0007
Techniques: T1007
Input: CrackMapExec can dump hashed passwords from LSA secrets for the targeted system.

Tactics: TA0006
Techniques: T1003, T1003.004
Input: Sliver can encode binary data into a .PNG file for C2 communication.

Tactics: TA0011
Techniques: T1001, T1001.002
Input: NETEAGLE can send process listings over the C2 channel.

Tactics: TA0007
Techniques: T1057
Input: LANS Deletes the file created by the LAN command to reverse the effect

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Set PowerShell execution policy to execute only signed scripts.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: The group has also used a malware variant, HIGHNOON, to enumerate active RDP sessions.

Tactics: TA0007
Techniques: T1049
Input: Event ID 4769 is generated on the Domain Controller when using a golden ticket after the KRBTGT password has been reset twice, as mentioned in the mitigation section.

Tactics: TA0005, TA0008
Techniques: T1550.003, T1550
Input: InvisiMole lists local users and session information.

Tactics: TA0007
Techniques: T1033
Input: DownPaper uses PowerShell for execution.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Turla has used fsutil fsinfo drives to list connected drives.

Tactics: TA0007
Techniques: T1120
Input: Ursnif droppers have used VBA macros to download and execute the malware's full executable payload.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: When one PlugX succeeds to infect a host, it then accesses to every IP address in the local network one-by-one and communicate with any connectable nodes, using one of the following protocols listed in Table 2

Tactics: TA0007, TA0011
Techniques: T1008, T1016
Input: This may include custom or publicly available encoding/compression algorithms (such as base64) as well as embedding data within protocol headers and fields.

Tactics: TA0010
Techniques: T1048.003, T1048
Input: There are multiple mechanisms that can be used with Office for persistence when an Office-based application is started; this can include the use of Office Template Macros and add-ins.

Tactics: TA0003
Techniques: T1137
Input: Monitor for unusual kernel driver installation activity that may wipe or corrupt raw disk data on specific systems or in large numbers in a network to interrupt availability to system and network resources.

Tactics: TA0040
Techniques: T1561
Input: Bundlore uses the pkill cfprefsd command to prevent users from inspecting processes.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: USBStealer collects files matching certain criteria from the victim and stores them in a local directory for later exfiltration.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: SslMM contains a feature to manipulate process privileges and tokens.

Tactics: TA0004, TA0005
Techniques: T1134
Input: Adversaries may take control of preexisting sessions with remote services to move laterally in an environment.

Tactics: TA0008
Techniques: T1563
Input: Diavol can collect the username from a compromised host.

Tactics: TA0007
Techniques: T1033
Input: TajMahal has the ability to use the open source libraries XZip/Xunzip and zlib to compress files.

Tactics: TA0009
Techniques: T1560.002, T1560
Input: HermeticWiper can use cmd.exe /Q/c move CSIDL_SYSTEM_DRIVE\temp\sys.tmp1 CSIDL_WINDOWS\policydefinitions\postgresql.exe 1> \\127.0.0.1\ADMIN$\_1636727589.6007507 2>&1 to deploy on an infected system.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Monitor the use of application access tokens to interact with resources or services that do not fit the organization baseline.

Tactics: TA0005, TA0008
Techniques: T1550.001, T1550
Input: In the event this privilege was obtained, the common startup folder is queried by reading the following registry key:  HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Common Startup  Alternatively, if the privilege was unable to be obtained, Reaver.v2 will obtain the user’s startup folder by querying the following registry key:  HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Startup  Reaver proceeds to write a shortcut file to ‘%TEMP%\~WUpdate.lnk’

Tactics: TA0003, TA0004, TA0007
Techniques: T1547.001, T1547, T1012
Input: China Chopper's server component is capable of opening a command terminal.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Adversaries may attempt to take advantage of a weakness in an Internet-facing computer or program using software, data, or commands in order to cause unintended or unanticipated behavior.

Tactics: TA0001
Techniques: T1190
Input: Gelsemium can use token manipulation to bypass UAC on Windows7 systems.

Tactics: TA0004, TA0005
Techniques: T1134
Input: Adversaries may also attempt to obscure malicious code from analysis by abusing the manner in which rundll32.exe loads DLL function names.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: The XSL script contains additional hard coded variables sVarRaz and sVar2RazX, which contain file paths that direct to the downloaded files.   The file’s path

Tactics: TA0011
Techniques: T1105
Input: BackdoorDiplomacy has obtained and used leaked malware, including DoublePulsar, EternalBlue, EternalRocks, and EternalSynergy, in its operations.

Tactics: TA0042
Techniques: T1588, T1588.001
Input: For DoS attacks targeting the hosting system directly, see Endpoint Denial of Service.

Tactics: TA0040
Techniques: T1498
Input: Sowbug has used credential dumping tools.

Tactics: TA0006
Techniques: T1003
Input: Meteor can use wmic.exe as part of its effort to delete shadow copies.

Tactics: TA0002
Techniques: T1047
Input: FIN6 has used Metasploit Bind and Reverse TCP stagers.

Tactics: TA0011
Techniques: T1095
Input: RDAT can take a screenshot on the infected system.

Tactics: TA0009
Techniques: T1113
Input: 2e0361fd73f60c76c69806205307ccac, update.dll (MiniDuke), 425kb (internal name = “UserCache.dll“) 9e3f3b5e9ece79102d257e8cf982e09e, cache.dll (CozyDuke), 425kb (internal name = “UserCache.dll“) The two share identical export function names in their export directories, and the naming appears to be randomly assigned at compile time

Tactics: TA0004, TA0005
Techniques: T1055
Input: Exploit Analysis  Despite being an older vulnerability, many threat actors continue to leverage CVE-2012-0158 to exploit Microsoft Word

Tactics: TA0002, TA0004
Techniques: T1203, T1068
Input: Perform integrity checking on pre-OS boot mechanisms that can be manipulated for malicious purposes and compare against known good baseline behavior.

Tactics: TA0001
Techniques: T1195
Input: This does not alter the user's traffic in any way, and the proxy connection can be severed as soon as the browser is closed.

Tactics: TA0009
Techniques: T1185
Input: BlackEnergy has gathered information about network IP configurations using ipconfig.exe and about routing tables using route.exe.

Tactics: TA0007
Techniques: T1016
Input: APT41 has configured payloads to load via LD_PRELOAD.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.006, T1574
Input: ShimRatReporter gathered information automatically, without instruction from a C2, related to the user and host machine that is compiled into a report and sent to the operators.

Tactics: TA0009
Techniques: T1119
Input: Adversaries may iteratively probe infrastructure using brute-forcing and crawling techniques.

Tactics: TA0043
Techniques: T1595.003, T1595
Input: PlugX can use API hashing and modify the names of strings to evade detection.

Tactics: TA0005
Techniques: T1027
Input: LazyScripter has relied upon users clicking on links to malicious files.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: The main CozyCar dropper checks whether the victim has an anti-virus product installed.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Monitor files for changes that may create or modify Launch Daemons to execute malicious payloads as part of persistence.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: Periodically baseline instances to identify malicious modifications or additions.

Tactics: TA0005
Techniques: T1578.002, T1578.003, T1578, T1578.004
Input: Wizard Spider has used SMB to drop Cobalt Strike Beacon on a domain controller for lateral movement.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Carberp has collected a list of running processes.

Tactics: TA0007
Techniques: T1057
Input: Lokibot is delivered via a malicious XLS attachment contained within a spearhpishing email.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: An administrator can also configure a profile that applies to all users and host programs on the local computer.

Tactics: TA0003, TA0004
Techniques: T1546.013, T1546
Input: Monitor for newly executed processes when removable media is mounted.

Tactics: TA0011, TA0010
Techniques: T1052, T1092
Input: SOUNDBITE is capable of enumerating and manipulating files and directories.

Tactics: TA0007
Techniques: T1083
Input: WarzoneRAT has relied on a victim to open a malicious attachment within an email for execution.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Use process monitoring to detect and analyze the execution and arguments of CMSTP.exe.

Tactics: TA0005
Techniques: T1218, T1218.003
Input: FIN6 has extracted password hashes from ntds.dit to crack offline.

Tactics: TA0006
Techniques: T1110, T1110.002
Input: Frankenstein has collected information via Empire, which is automatically sent the data back to the adversary's C2.

Tactics: TA0010
Techniques: T1041, T1020
Input: Sykipot may use netstat -ano to display active network connections.

Tactics: TA0007
Techniques: T1049
Input: APT39 has utilized tools to capture mouse movements.

Tactics: TA0006, TA0009
Techniques: T1056
Input: OSX_OCEANLOTUS.D can collect the network interface MAC address on the infected host.

Tactics: TA0007
Techniques: T1016
Input: And, according to the collected config files, the group upgraded their malware communications from plain text http to encrypted https in October 2013

Tactics: TA0011
Techniques: T1071
Input: Stuxnet schedules a network job to execute two minutes after host infection.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Lokibot embedded the commands schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I inside a batch script.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: MuddyWater has used malware that leveraged WMI for execution and querying host information.

Tactics: TA0002
Techniques: T1047