madox81/Adema_ATTACK_DS huggingface dataset:
Input: Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

Tactics: TA0009
Techniques: T1185
Input: Donut can generate shellcode outputs that execute via JavaScript or JScript.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: APT38 has used CHM files to move concealed payloads.

Tactics: TA0005
Techniques: T1218, T1218.001
Input: Kimsuky has used JScript for logging and downloading additional tools.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Monitor for changes made to AD settings for unexpected modifications to domain trust settings, such as when a user or application modifies the federation settings on the domain.

Tactics: TA0004, TA0005
Techniques: T1484, T1484.002
Input: Revenge RAT uses Base64 to encode information sent to the C2 server.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Volgmer stores the encoded configuration file in the Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Security.

Tactics: TA0005
Techniques: T1112
Input: RegDuke can use control-flow flattening or the commercially available .NET Reactor for obfuscation.

Tactics: TA0005
Techniques: T1027
Input: CookieMiner can steal saved usernames and passwords in Chrome as well as credit card credentials.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: The Cobalt Strike System Profiler can use JavaScript to perform reconnaissance actions.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Operation Wocao's proxy implementation "Agent" can upgrade the socket in use to a TLS socket.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Empire has the ability to obfuscate commands using Invoke-Obfuscation.

Tactics: TA0005
Techniques: T1027
Input: Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.

Tactics: TA0007
Techniques: T1012
Input: Monitor executed commands and arguments that may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: For macOS, the functionality of this technique is similar but may leverage zsh, the default shell for macOS 10.15+.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: Stuxnet uses encrypted configuration blocks and writes encrypted files to disk.

Tactics: TA0005
Techniques: T1027
Input: Check for common UAC bypass weaknesses on Windows systems to be aware of the risk posture and address issues where appropriate.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Phishing can be targeted, known as spearphishing.

Tactics: TA0043, TA0001
Techniques: T1566, T1598
Input: Monitor for alike file hashes or characteristics (ex: filename) that are created on multiple hosts.

Tactics: TA0008
Techniques: T1570
Input: Summary information for the three binaries we analyzed follows:    MD5 364ff454dcf00420cff13a57bcb78467   SHA-256 8bca0031f3b691421cb15f9c6e71ce193355d2d8cf2b190438b6962761d0c6bb   ssdeep 3072:n+1R4tREtGN4qyGCXdHPYK9l0H786O26BmMAwyWMn/qwwiHNl:n+1R43QcILXdF0w6IBmMAwwCwwi   Size 141.2 KB (144560 bytes)   Type ELF 64-bit (stripped)   Install as root /bin/rsyncd   Root install desc synchronize and backup service   Install as non-root ~/.config/dbus-notifier/dbus-inotifier   Non-root install desc system service d-bus notifier   C2 azureon-line[.]com (TCP/80)   Usage Timeframe Late 2014    Table 1: Sample 1 – Late 2014 Sofacy 64-bit Fysbis    MD5 075b6695ab63f36af65f7ffd45cccd39   SHA-256 02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592   ssdeep 3072:9ZAxHANuat3WWFY9nqjwbuZf454UNqRpROIDLHaSeWb3LGmPTrIW33HxIajF:9ZAxHANJAvbuZf454UN+rveQLZPTrV3Z   Size 175.9 KB (180148 bytes)   Type ELF 32-bit (stripped)   Install as root /bin/ksysdefd   Root install desc system kernel service defender   Install as non-root ~/.config/ksysdef/ksysdefd   Non-root install desc system kernel service defender   C2 198.105.125[.]74 (TCP/80)   Usage Timeframe Early 2015    Table 2: Sample 2 – Early 2015 Sofacy 32-bit Fysbis    MD5 e107c5c84ded6cd9391aede7f04d64c8   SHA-256 fd8b2ea9a2e8a67e4cb3904b49c789d57ed9b1ce5bebfe54fe3d98214d6a0f61   ssdeep 6144:W/D5tpLWtr91gmaVy+mdckn6BCUdc4mLc2B9:4D5Lqgkcj+   Size 314.4 KB (321902 bytes)   Type ELF 64-bit (not stripped)   Install as root /bin/ksysdefd   Root install desc system kernel service defender   Install as non-root ~/.config/ksysdef/ksysdefd   Non-root install desc system kernel service defender   C2 mozilla-plugins[.]com (TCP/80)   Usage Timeframe Late 2015    Table 3: Sample 3 – Late 2015 Sofacy 64-bit Fysbis Overall, these binaries are assessed as low sophistication, but effective

Tactics: TA0002, TA0003, TA0004, TA0007
Techniques: T1569.002, T1543.002, T1082, T1543, T1569
Input: Clop can use cmd.exe to help execute commands on the system.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: RedLeaves can capture screenshots.

Tactics: TA0009
Techniques: T1113
Input: SUPERNOVA was installed via exploitation of a SolarWinds Orion API authentication bypass vulnerability (CVE-2020-10148).

Tactics: TA0002
Techniques: T1203
Input: Data may also be acquired and staged through Windows system management tools such as Windows Management Instrumentation and PowerShell.

Tactics: TA0009
Techniques: T1039, T1074.002, T1074.001, T1074
Input: Hydraq creates a Registry subkey to register its created service, and can also uninstall itself later by deleting this value.

Tactics: TA0005
Techniques: T1112
Input: Cobian RAT obfuscates communications with the C2 server using Base64 encoding.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: POWERSOURCE queries Registry keys in preparation for setting Run keys to achieve persistence.

Tactics: TA0007
Techniques: T1012
Input: FIVEHANDS has the ability to decrypt its payload prior to execution.

Tactics: TA0005
Techniques: T1140
Input: If scripts are not commonly used on a system, but enabled, scripts running out of cycle from patching or other administrator functions are suspicious.

Tactics: TA0002, TA0005, TA0006, TA0007, TA0009, TA0010
Techniques: T1559, T1059.007, T1059.003, T1140, T1005, T1564.003, T1056.002, T1560.002, T1119, T1562.002, T1560.003, T1482, T1059.006, T1020, T1059.004, T1560, T1564, T1059.001, T1059.005, T1016, T1562, T1216.001, T1059, T1056, T1615, T1216
Input: Pass the ticket (PtT) is a method of authenticating to a system using Kerberos tickets without having access to an account's password.

Tactics: TA0005, TA0008
Techniques: T1550.003, T1550
Input: As we discover new tools used by this group, we have consistently discovered overlapping artifacts with previously used tools and infrastructure

Tactics: TA0007
Techniques: T1518.001, T1518
Input: If the first resolved domain IP address starts with 24.125.X.X, then it is set to 1

Tactics: TA0007
Techniques: T1016
Input: When the Hide500Users key value is set to TRUE, users with a userID under 500 do not appear on the login screen and in System Preferences.

Tactics: TA0005
Techniques: T1564.002, T1564
Input: HAWKBALL is a backdoor that communicates to a single hard-coded C2 server using HTTP

Tactics: TA0011
Techniques: T1071
Input: SID Filtering can be applied by:

Tactics: TA0004, TA0005
Techniques: T1134.005, T1134
Input: Compare recent invocations of mavinject.exe with prior history of known good arguments and injected DLLs to determine anomalous and potentially adversarial activity.

Tactics: TA0005
Techniques: T1218, T1218.013
Input: Wizard Spider has used scheduled tasks to install TrickBot, using task names to appear legitimate such as WinDotNet, GoogleTask, or Sysnetsf.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Adversaries may attempt to find domain-level groups and permission settings.

Tactics: TA0007
Techniques: T1069.002, T1069
Input: Wdigest: The Digest Authentication protocol is designed for use with Hypertext Transfer Protocol (HTTP) and Simple Authentication Security Layer (SASL) exchanges.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Operation Wocao has used PowerShell to add and delete rules in the Windows firewall.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: Ramsay can execute its embedded components via CreateProcessA and ShellExecute.

Tactics: TA0002
Techniques: T1106
Input: RTM can scan victim drives to look for specific banking software on the machine to determine next actions.

Tactics: TA0007
Techniques: T1518
Input: Applications such as Adobe Reader and Flash, which are common in enterprise environments, have been routinely targeted by adversaries attempting to gain access to systems.

Tactics: TA0002
Techniques: T1203
Input: For example, Windows Security Log events (Event ID 4670) are created when DACLs are modified.

Tactics: TA0005
Techniques: T1222, T1222.001
Input: The headers are XOR encrypted with <hdrXORKey1> and <hdrXORKey2> combined and reversed

Tactics: TA0005
Techniques: T1027
Input: Wevtutil can be used to clear system and security event logs from the system.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: Lokibot downloaded several staged items onto the victim's machine.

Tactics: TA0011
Techniques: T1105
Input: Adversaries can also abuse poor configurations of these mechanisms to escalate privileges without needing the user's password.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: Monitor and investigate attempts to modify extended file attributes with utilities such as xattr.

Tactics: TA0005
Techniques: T1553.001, T1553
Input: Attor has opened the registry and performed query searches.

Tactics: TA0007
Techniques: T1012
Input: APT41 used the Steam community page as a fallback mechanism for C2.

Tactics: TA0011
Techniques: T1008
Input: xCaon has communicated with the C2 server by sending POST requests over HTTP.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: DRATzarus can also remotely shut down into sleep mode under specific conditions to evade detection.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: When the Terminal.app is opened, the application launches a zsh login shell and a zsh interactive shell.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: Adversaries may search public WHOIS data for information about victims that can be used during targeting.

Tactics: TA0043
Techniques: T1596.002, T1596
Input: Limit or restrict program execution using anti-virus software.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Even for those platforms that have the capability, it is recommended to download a copy of the file to a trusted computer to calculate the checksum with software that is not compromised.https://tools.cisco.com/security/center/resources/integrity_assurance.html#7

Tactics: TA0005
Techniques: T1601, T1601.001
Input: "Enterprise applications -> User settings -> Enterprise applications: Users can consent to apps accessing company data on their behalf" can be set to "no" to prevent users from consenting to allow third-party multi-tenant applications

Tactics: TA0006
Techniques: T1528
Input: Monitor executed commands and arguments that can leverage a computer's peripheral devices (, integrated cameras or webcams) or applications (, video call services) to capture video recordings for the purpose of gathering information.

Tactics: TA0009
Techniques: T1125
Input: How the operating system locates libraries to be used by a program can also be intercepted.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574
Input: Certain signed scripts that can be used to execute other programs may not be necessary within a given environment.

Tactics: TA0005
Techniques: T1216.001, T1216
Input: WhisperGate can stop its execution when it recognizes the presence of certain monitoring tools.

Tactics: TA0005, TA0007
Techniques: T1497
Input: Monitor windows registry keys that may be deleted or alter generated artifacts on a host system, including logs or captured files such as quarantined malware.

Tactics: TA0005
Techniques: T1070
Input: NanHaiShu uses mshta.exe to load its program and files.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: ADVSTORESHELL can list connected devices.

Tactics: TA0007
Techniques: T1120
Input: We found a brute-force tool called NLBrute , with configuration files that tell us it had been set up to use an included set of username and passwords to try to break in to machines that have Remote Desktop enabled

Tactics: TA0006
Techniques: T1110
Input: Hijack Clipboard Bitcoin Address Zyklon has the ability to hijack the clipboard, and replaces the user’s copied bitcoin address with an address served up by the actor’s control server

Tactics: TA0007, TA0009
Techniques: T1115, T1016
Input: Comnie uses Rundll32 to load a malicious DLL.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: UPPERCUT can download and upload files to and from the victim’s machine.

Tactics: TA0011
Techniques: T1105
Input: The Winnti for Windows dropper component can verify the existence of a single command line parameter and either terminate if it is not found or later use it as a decryption key.

Tactics: TA0005
Techniques: T1480, T1480.001
Input: Monitor for modification of PowerShell command history settings through processes being created with -HistorySaveStyle SaveNothing command-line arguments and use of the PowerShell commands Set-PSReadlineOption -HistorySaveStyle SaveNothing and Set-PSReadLineOption -HistorySavePath {File Path}.

Tactics: TA0005
Techniques: T1562.003, T1562
Input: URL parameter Sample data Description   c= Victim->Administrator Hostname and username   l= 192.168.1.100 Compromised system's IP address   o= 5,1,1,32 Windows major and minor version, coupled with architecture (32 v

Tactics: TA0007
Techniques: T1082
Input: An adversary may use legitimate desktop support and remote access software, such as Team Viewer, AnyDesk, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.

Tactics: TA0011
Techniques: T1219
Input: REvil can use Native API for execution and to retrieve active services.

Tactics: TA0002
Techniques: T1106
Input: CORESHELL obfuscates strings using a custom stream cipher.

Tactics: TA0005
Techniques: T1027
Input: WellMail can exfiltrate files from the victim machine.

Tactics: TA0009
Techniques: T1005
Input: Donut can generate shellcode outputs that execute via VBScript.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: According to the server’s code, the default command that it would issue to newly infected systems was a batch script contained in a file named 0000000000.bat

Tactics: TA0002
Techniques: T1059
Input: RCSession can use WinSock API for communication including WSASend and WSARecv.

Tactics: TA0002
Techniques: T1106
Input: SHA256 Compiled C2 account POP3S Account SMTPS Accounts   861b6bc1f9.

Tactics: TA0007
Techniques: T1087
Input: Confucius has used VBScript to execute malicious code.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: PlugX can be added as a service to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Bad Rabbit has encrypted files and disks using AES-128-CBC and RSA-2048.

Tactics: TA0040
Techniques: T1486
Input: Monitor for newly constructed files that may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems.

Tactics: TA0003, TA0004
Techniques: T1547
Input: Prior to Drive-by Compromise, adversaries must stage resources needed to deliver that exploit to users who browse to an adversary controlled site.

Tactics: TA0042
Techniques: T1608.004, T1608
Input: Emissary has the capability to execute ver and systeminfo commands.

Tactics: TA0007
Techniques: T1082
Input: They have also used WMI for the remote execution of files for lateral movement.

Tactics: TA0002
Techniques: T1047
Input: LookBack’s C2 proxy tool sends data to a C2 server over HTTP.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Malicious Home Pages will execute when the right Outlook folder is loaded/reloaded.

Tactics: TA0003
Techniques: T1137, T1137.004
Input: Bootkit

Tactics: TA0005
Techniques: T1564, T1564.005
Input: The Registry of a remote system may be modified to aid in execution of files as part of lateral movement.

Tactics: TA0005
Techniques: T1112
Input: Monitor cloud logs for API calls and other potentially unusual activity related to block object storage enumeration.

Tactics: TA0007
Techniques: T1580
Input: OopsIE can download files from its C2 server to the victim's machine.

Tactics: TA0011
Techniques: T1105
Input: Limit permissions so that users and user groups cannot create tokens.

Tactics: TA0004, TA0005
Techniques: T1134.002, T1134.003, T1134, T1134.001
Input: Turla has infected victims using watering holes.

Tactics: TA0001
Techniques: T1189
Input: The Windows screensaver application scrnsave.scr is located in C:\Windows\System32\, and C:\Windows\sysWOW64\  on 64-bit Windows systems, along with screensavers included with base Windows installations.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.002
Input: Aria-body has the ability to download additional payloads from C2.

Tactics: TA0011
Techniques: T1105
Input: Modify network and/or host firewall rules, as well as other network controls, to only allow legitimate BITS traffic.

Tactics: TA0003, TA0005
Techniques: T1197
Input: Cobalt Strike can use Base64, URL-safe Base64, or NetBIOS encoding in its C2 traffic.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Instead, an adversary can manipulate domain trusts to add their own signing certificate.

Tactics: TA0004, TA0005
Techniques: T1484, T1484.002
Input: Sliver can use AES-GCM-256 to encrypt a session key for C2 message exchange.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Ebury has implemented a fallback mechanism to begin using a DGA when the attacker hasn't connected to the infected system for three days.

Tactics: TA0011
Techniques: T1008
Input: Adversaries may also deceive users into performing actions such as enabling Remote Access Software, allowing direct control of the system to the adversary, or downloading and executing malware for User Execution.

Tactics: TA0002
Techniques: T1204
Input: Epic searches for anti-malware services running on the victim’s machine and terminates itself if it finds them.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: The Cobalt Strike System Profiler can discover applications through the browser and identify the version of Java the target has.

Tactics: TA0007
Techniques: T1518
Input: This PowerShell script is ineffective in gathering rules with modified PR_RULE_MSG_NAME and PR_RULE_MSG_PROVIDER properties caused by adversaries using a Microsoft Exchange Server Messaging API Editor (MAPI Editor), so only examination with the Exchange Administration tool MFCMapi can reveal these mail forwarding rules.

Tactics: TA0003
Techniques: T1137, T1137.005
Input: This spoofing could be executed via Visual Basic within a malicious Office document or any code that can perform Native API.

Tactics: TA0004, TA0005
Techniques: T1134.004, T1134
Input: For that we can use a Python script, included in Appendix B – Python Scripts

Tactics: TA0002
Techniques: T1059
Input: Grandoreiro has the ability to use HTTP in C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: HOPLIGHT has been observed collecting victim machine information like OS version, drivers, volume information and more.

Tactics: TA0007
Techniques: T1082
Input: Leviathan has used multi-hop proxies to disguise the source of their malicious traffic.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: AppleSeed can achieve execution through users running malicious file attachments distributed via email.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Depending on the configuration of the environment, an adversary may be able to enumerate more information via the graphical dashboard than an API.

Tactics: TA0007
Techniques: T1538
Input: Decrypted OwaAuth log file format

Tactics: TA0005
Techniques: T1140
Input: Adversaries may abuse email-forwarding rules to monitor the activities of a victim, steal information, and further gain intelligence on the victim or the victim’s organization to use as part of further exploits or operations.

Tactics: TA0009
Techniques: T1114, T1114.003
Input: REvil has infected victim machines through compromised websites and exploit kits.

Tactics: TA0001
Techniques: T1189
Input: BackConfig has the ability to gather the victim's computer name.

Tactics: TA0007
Techniques: T1082
Input: Pupy can record sound with the microphone.

Tactics: TA0009
Techniques: T1123
Input: APT33 has used WinRAR to compress data prior to exfil.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Okrum uses AES to encrypt network traffic.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Duqu uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols.

Tactics: TA0011
Techniques: T1572, T1071
Input: Once connectivity to the service provider IP was verified, the actor established the service provider IP as a proxy for the victim’s SOGU backdoor

Tactics: TA0003, TA0004, TA0007, TA0011
Techniques: T1543.003, T1543, T1090, T1016
Input: The screen capture below shows the decryption function.It then calls the StartAndPatchRegAsm function.This function tries to find the original Microsoft RegAsm executable path

Tactics: TA0009
Techniques: T1113
Input: APT38 has identified security software, configurations, defensive tools, and sensors installed on a compromised system.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Adversaries may choose to do this if they have sufficient access and proximity.

Tactics: TA0010
Techniques: T1011.001, T1011
Input: Monitor for unexpected deletion of an instance (ex: instance.delete within GCP Audit Logs)

Tactics: TA0040
Techniques: T1485
Input: Okrum can identify proxy servers configured and used by the victim, and use it to make HTTP requests to C2 its server.

Tactics: TA0011
Techniques: T1090, T1090.002
Input: The adversary may then perform actions that spawn additional processes as the logged-on user.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Ursnif has used an XOR-based algorithm to encrypt Tor clients dropped to disk.

Tactics: TA0005
Techniques: T1027
Input: Changes to the binary path and the service startup type changed from manual or disabled to automatic, if it does not typically do so, may be suspicious.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: MoleNet can execute commands via the command line utility.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Impacket can be used to sniff network traffic via an interface or raw socket.

Tactics: TA0006, TA0007
Techniques: T1040
Input: Specifically, the following subkeys have been known to be possibly vulnerable to abuse:

Tactics: TA0003, TA0004
Techniques: T1547.004, T1547
Input: Carbon can use HTTP in C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Zebrocy runs the ipconfig /all command.

Tactics: TA0007
Techniques: T1016
Input: RTM can record keystrokes from both the keyboard and virtual keyboard.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Andariel has hidden malicious executables within PNG files.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: The group has also leveraged default manufacturer's passwords to gain initial access to corporate networks via IoT devices such as a VOIP phone, printer, and video decoder.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: To change the operating system in memory, the adversary typically can use one of two methods.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: BADFLICK has compressed data using the aPLib compression library.

Tactics: TA0009
Techniques: T1560.002, T1560