madox81/Adema_ATTACK_DS huggingface dataset:
Input: Gorgon Group has used macros in Spearphishing Attachments as well as executed VBScripts on victim machines.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: gh0st RAT has encrypted TCP communications to evade detection.

Tactics: TA0011
Techniques: T1573
Input: FatDuke can get user agent strings for the default browser from HKCU\Software\Classes\http\shell\open\command.

Tactics: TA0007
Techniques: T1012
Input: RTM can obtain the victim username and permissions.

Tactics: TA0007
Techniques: T1033
Input: Wizard Spider has installed TrickBot as a service named ControlServiceA in order to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: gh0st RAT can create a new service to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Disable/restrict the WinRM Service to help prevent uses of PowerShell for remote execution.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: BLACKCOFFEE has the capability to delete files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Monitor for changes to MBR and VBR as they occur for indicators for suspicious activity and further analysis.

Tactics: TA0003, TA0005
Techniques: T1542.003, T1542
Input: Many of these protections depend on the architecture and target application binary for compatibility and may not work for all software or services targeted.

Tactics: TA0008
Techniques: T1210
Input: One version of Helminth uses a PowerShell script.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Permissions gained from the modification of infrastructure components may bypass restrictions that prevent access to existing infrastructure.

Tactics: TA0005
Techniques: T1578
Input: Rundll32 can also be used to execute scripts such as JavaScript.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: For macOS ensure Remote Login is disabled under Sharing Preferences.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: Empire uses PowerSploit's Invoke-Kerberoast to request service tickets and return crackable ticket hashes.

Tactics: TA0006
Techniques: T1558.003, T1558
Input: 3PARA RAT uses HTTP for command and control.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Data captured via this technique may include user credentials, especially those sent over an insecure, unencrypted protocol.

Tactics: TA0006, TA0007
Techniques: T1040
Input: A Threat Group-3390 tool can add the binary’s path to the Registry key Software\Microsoft\Windows\CurrentVersion\Run to add persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: CMSTP.exe accepts an installation information file (INF) as a parameter and installs a service profile leveraged for remote access connections.

Tactics: TA0005
Techniques: T1218, T1218.003
Input: Clambling can enumerate processes on a targeted system.

Tactics: TA0007
Techniques: T1057
Input: Adversaries may use password recovery tools to obtain plain text passwords from the Credential Manager.

Tactics: TA0006
Techniques: T1555, T1555.004
Input: Seth-Locker can execute commands via the command line shell.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment.

Tactics: TA0007
Techniques: T1580
Input: The Derusbi malware supports timestomping.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: Zeus Panda uses PowerShell to download and execute the payload.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: ShimRat can impersonate Windows services and antivirus products to avoid detection on compromised systems.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Watches uninstall time, checks time diff (local time vs internet time)

Tactics: TA0007
Techniques: T1124
Input: Audit software deployment logs and look for suspicious or unauthorized activity.

Tactics: TA0002, TA0008
Techniques: T1072
Input: Poseidon Group tools attempt to spoof anti-virus processes as a means of self-defense.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Bandook is delivered via a malicious Word document inside a zip file.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: APT32 likely used COVID-19-themed malicious attachments against Chinese speaking targets.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Once these variables are set, the malware uses the SoapHttpClientProtocol class to communicate with its C2 server, which issues an HTTP POST requests that appears as:  As you can see from the above request, the SoapHttpClientProtocol class neatly structures data into an HTTP POST request

Tactics: TA0011
Techniques: T1071
Input: CrackMapExec can execute PowerShell commands via WMI.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Deployments of this type can also be configured to maintain a quantity of containers over time, automating the process of maintaining persistence within a cluster.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.007, T1053
Input: Detailed command-line logging is not enabled by default in Windows.

Tactics: TA0004, TA0005
Techniques: T1134.002, T1134.003, T1134, T1134.001
Input: Domains provide a centralized means of managing how computer resources (ex: computers, user accounts) can act, and interact with each other, on a network.

Tactics: TA0004, TA0005
Techniques: T1484
Input: P.A.S. Webshell has the ability to create reverse shells with Perl scripts.

Tactics: TA0002
Techniques: T1059
Input: Containment provided by enclaving also makes incident cleanup significantly less costly.Configure firewalls to disallow Remote Desktop Protocol (RDP) traffic coming from outside of the network boundary, except for in specific configurations such as when tunneled through a secondary virtual private network (VPN) with lower privileges.Audit existing firewall rules and close all ports that are not explicitly needed for business

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Adversaries can modify key-value pairs in plist files to influence system behaviors, such as hiding the execution of an application ( Hidden Window) or running additional commands for persistence (ex: Launch Agent/Launch Daemon or Re-opened Applications).

Tactics: TA0005
Techniques: T1647
Input: Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Backdoor.Oldrea can use a network scanning module to identify ICS-related ports.

Tactics: TA0007
Techniques: T1046
Input: BitPaymer can import a hard-coded RSA 1024-bit public key, generate a 128-bit RC4 key for each file, and encrypt the file in place, appending .locked to the filename.

Tactics: TA0040
Techniques: T1486
Input: Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.

Tactics: TA0005
Techniques: T1027, T1027.005, T1027.001
Input: Turla has used net user to enumerate local accounts on the system.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: APT3 has a tool that can detect the existence of remote systems.

Tactics: TA0007
Techniques: T1018
Input: Activity may be from interactive login sessions or process ownership from accounts being used to execute binaries on a remote system as a particular account.

Tactics: TA0001, TA0003, TA0004, TA0005, TA0006, TA0008
Techniques: T1556.003, T1078, T1556, T1078.003, T1078.002, T1556.001, T1550
Input: Penquin will connect to C2 only after sniffing a "magic packet" value in TCP or UDP packets matching specific conditions.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205
Input: Adversaries may use Valid Accounts to log into a service specifically designed to accept remote connections, such as telnet, SSH, and VNC.

Tactics: TA0008
Techniques: T1021
Input: Pupy can also perform pass-the-ticket.

Tactics: TA0005, TA0008
Techniques: T1550.003, T1550
Input: Domain Fronting may be used in conjunction to avoid defenses.

Tactics: TA0011
Techniques: T1219
Input: POWERSTATS can retrieve OS name/architecture and computer/domain name information from compromised hosts.

Tactics: TA0007
Techniques: T1082
Input: BadPatch uses WMI to enumerate installed security products in the victim’s environment.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Additionally malware reports itself to its hardcoded command and control servers and established a backdoor connection, so the attacker may have a permanent remote connection

Tactics: TA0011
Techniques: T1008
Input: PlugX allows actors to spawn a reverse shell on a victim.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: APT29 has used the legitimate mailing service Constant Contact to send phishing e-mails.

Tactics: TA0001
Techniques: T1566.003, T1566
Input: Stuxnet infected WinCC machines via a hardcoded database server password.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.001
Input: The following screenshot shows the command execution functionality in action:            Figure 4: Command Execution     The paramString parameter shown in the above screenshot can be any command received from C&C

Tactics: TA0002, TA0009
Techniques: T1113, T1059
Input: Fox Kitten has used valid credentials with various services during lateral movement.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: Adversaries may leverage these mechanisms to execute malicious content.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Background From October 2012 to May 2014, FireEye observed APT12 utilizing RIPTIDE, a proxy-aware backdoor that communicates via HTTP to a hard-coded command and control (C2) server

Tactics: TA0011
Techniques: T1071
Input: Bazar can implement DGA using the current date as a seed variable.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: Astaroth uses a software packer called Pe123\RPolyCryptor.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Monitor compressed/archive and image files downloaded from the Internet as the contents may not be tagged with the MOTW.

Tactics: TA0005
Techniques: T1553, T1553.005
Input: Mimikatz can be used to extract secrets from memory.

Tactics: TA0006
Techniques: T1003, T1003.004
Input: This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN).

Tactics: TA0011
Techniques: T1572
Input: NotPetya uses rundll32.exe to install itself on remote systems when accessed via PsExec or wmic.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Monitor for API calls that may forge credential materials that can be used to gain access to web applications or Internet services.

Tactics: TA0005
Techniques: T1218
Input: TrailBlazer has used filenames that match the name of the compromised system in attempt to avoid detection.

Tactics: TA0005
Techniques: T1036
Input: HAWKBALL has created a cmd.exe reverse shell, executed commands, and uploaded output via the command line.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: The Sysinternals Autoruns tool may also be used to analyze auto-starting locations, including DLLs listed as time providers.

Tactics: TA0003, TA0004
Techniques: T1547.003, T1547
Input: It has the following command line argument help: info  <Server/Domain> [options] [options]:   -d Domain   -o OsInfo   -t TsInfo   -n NetuseInfo   -s ShareInfo ShareDir   -c Connect Test   -a Local And Global Group User Info   -l Local Group User Info   -g Global Group User Info   -ga Group Administrators   -gp Group Power Users   -gd Group Domain Admins   -f <infile> //input server list from infile, OneServerOneLine info <\\server> <user> ChromePass: A tool from NirSoft used for recovering passwords stored in the Chrome browser

Tactics: TA0007
Techniques: T1087, T1069
Input: Denis encodes the data sent to the server in Base64.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: MuddyWater has used JavaScript files to execute its POWERSTATS payload.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: ThiefQuest uses various API to perform behaviors such as executing payloads and performing local enumeration.

Tactics: TA0002
Techniques: T1106
Input: The same code snippets are combined into a second stage JavaScript in “C:\Users\<User Name>\”

Tactics: TA0007
Techniques: T1033
Input: RCSession can write its configuration file to the Registry.

Tactics: TA0005
Techniques: T1112
Input: Use auditing tools capable of detecting privilege and service abuse opportunities on systems within an enterprise and correct them.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: In some cases a local DNS sinkhole may be used to help prevent behaviors associated with dynamic resolution.

Tactics: TA0011
Techniques: T1568
Input: admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about files and directories: dir c:\ >> %temp%\download dir "c:\Documents and Settings" >> %temp%\download dir "c:\Program Files\" >> %temp%\download dir d:\ >> %temp%\download

Tactics: TA0007
Techniques: T1083
Input: Okrum loader only executes the payload after the left mouse button has been pressed at least three times, in order to avoid being executed within virtualized or emulated environments.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.002
Input: 2, 2018, we published a blog detailing the use of an Adobe Flash zero-day vulnerability (CVE-2018-4878) by a suspected North Korean cyber espionage group that we now track as APT37 (Reaper)

Tactics: TA0002
Techniques: T1203
Input: IcedID has used ZwQueueApcThread to inject itself into remote processes.

Tactics: TA0004, TA0005
Techniques: T1055.004, T1055
Input: ShimRat can download additional files.

Tactics: TA0011
Techniques: T1105
Input: File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, ).

Tactics: TA0005
Techniques: T1222.002, T1222, T1222.001
Input: ComRAT has used unique per machine passwords to decrypt the orchestrator payload and a hardcoded XOR key to decrypt its communications module.

Tactics: TA0005
Techniques: T1140
Input: Common data encoding schemes include ASCII, Unicode, hexadecimal, Base64, and MIME.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Monitor for newly constructed logon behavior across code repositories ( Github) which can be configured to report access to certain pages and documents.

Tactics: TA0009
Techniques: T1213, T1213.003
Input: Adversaries may search and gather information about victims from closed sources that can be used during targeting.

Tactics: TA0043
Techniques: T1597
Input: TajMahal has the ability to identify the MAC address on an infected host.

Tactics: TA0007
Techniques: T1016
Input: APT28 has used pass the hash for lateral movement.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: Additional log storage and analysis infrastructure will likely be required for more robust detection capabilities.

Tactics: TA0009
Techniques: T1213, T1213.001
Input: Darkhotel has searched for anti-malware strings and anti-virus processes running on the system.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Analysis should attempt to relate shortcut creation events to other potentially suspicious events based on known adversary behavior such as process launches of unknown executables that make network connections.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: LookBack sets up a Registry Run key to establish a persistence mechanism.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: An adversary can use WMI to interact with local and remote systems and use it as a means to execute various behaviors, such as gathering information for Discovery as well as remote Execution of files as part of Lateral Movement.

Tactics: TA0002
Techniques: T1047
Input: This greatly reduces the resources available for providing the targeted service.

Tactics: TA0040
Techniques: T1499, T1499.001
Input: InvisiMole has used a custom implementation of DNS tunneling to embed C2 communications in DNS requests and replies.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: CookieMiner has checked for the presence of "Little Snitch", macOS network monitoring and application firewall software, stopping and exiting if it is found.

Tactics: TA0005, TA0007
Techniques: T1562.004, T1518.001, T1518, T1562
Input: Proc memory injection is a method of executing arbitrary code in the address space of a separate live process.

Tactics: TA0004, TA0005
Techniques: T1055.009, T1055
Input: Inception used a browser plugin to steal passwords and sessions from Internet Explorer, Chrome, Opera, Firefox, Torch, and Yandex.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Carbanak may use netsh to add local firewall rule exceptions.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: Template references injected into a document may enable malicious payloads to be fetched and executed when the document is loaded.

Tactics: TA0005
Techniques: T1221
Input: Ebury has been embedded into modified OpenSSH binaries to gain persistent access to SSH credential information.

Tactics: TA0003
Techniques: T1554
Input: Just like in the sandbox checks, the Trojan checks for an attached debugger each time it issues a DNS query; if it does detect a debugger it will issue a DNS query to resolve 676f6f646c75636b.gogle[.]co

Tactics: TA0005, TA0007
Techniques: T1497, T1518.001, T1518, T1124
Input: TEMP.Veles has relied on encrypted SSH-based tunnels to transfer tools and for remote command/program execution.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: The Cybereason platform was able to detect the malicious injection, identifying Irdsnhrxxxfery64.~, Irdsnhrxxxfery98.~, and module arqueiro.   The downloaded modules found in regsvr32.exe as detected by the Cybereason platform

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Blue Mockingbird has used batch script files to automate execution and deployment of payloads.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Final1stspy uses HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Monitor for newly constructed files that may abuse print processors to run malicious DLLs during system boot for persistence and/or privilege escalation.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.012
Input: Additionally, adversaries may exploit a Server-Side Request Forgery (SSRF) vulnerability in a public facing web proxy that allows them to gain access to the sensitive information via a request to the Instance Metadata API.

Tactics: TA0006
Techniques: T1552, T1552.005
Input: Filter DLLs can be positioned on local computers for local accounts and/or domain controllers for domain accounts.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.002, T1556
Input: If the at.deny exists and is empty, global use of at is permitted.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: CookieMiner has used Google Chrome's decryption and extraction operations.

Tactics: TA0005
Techniques: T1140
Input: APT41 attempted to masquerade their files as popular anti-virus software.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Stealth Falcon malware uses WMI to script data collection and command execution on the victim.

Tactics: TA0002
Techniques: T1059
Input: InvisiMole has used TCP to download additional modules.

Tactics: TA0011
Techniques: T1095
Input: Denis uses ipconfig to gather the IP address from the system.

Tactics: TA0007
Techniques: T1016
Input: P.A.S. Webshell can scan networks for open ports and listening services.

Tactics: TA0007
Techniques: T1046
Input: FIN6 has used the Stealer One credential stealer to target e-mail and file transfer utilities including FTP.

Tactics: TA0006
Techniques: T1555
Input: Ramsay can use ImprovedReflectiveDLLInjection to deploy components.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Flagpro can download additional malware from the C2 server.

Tactics: TA0011
Techniques: T1105
Input: Gorgon Group has obtained and used tools such as QuasarRAT and Remcos.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Monitor for the usage of APIs that create or import SSH keys, particularly by unexpected users or accounts such as the root account.

Tactics: TA0003
Techniques: T1098.001, T1098
Input: Monitor newly executed processes associated with running a virtual instance, such as those launched from binary files associated with common virtualization technologies (ex: VirtualBox, VMware, QEMU, Hyper-V).

Tactics: TA0005
Techniques: T1564, T1564.006
Input: OSX_OCEANLOTUS.D has variants that check a number of system parameters to see if it is being run on real hardware or in a virtual machine environment, such as sysctl hw.model.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: The file is saved to: C:\Users\[Username]\AppData\Local\Temp\notepad.exe  00 00 04  Content after command ID is written to: C:\Users\[Username]\AppData\Local\Temp\notepad2.exe  00 00 05  The files notepad1.exe and notepad2.exe are concatenated together and written to C:\Users\[Username]\AppData\Local\Temp\newnotepad.exe and executed  00 00 06  The contents of the following file is sent to the server: C:\Users\[Username]\AppData\Local\Temp\note.txt  00 00 07  The string following the command ID is executed using "cmd /C" and results are sent to server   Links to APT3 On October 28, we observed APT3 sending out spearphishing messages containing a compressed executable attachment

Tactics: TA0002, TA0005, TA0007
Techniques: T1033, T1087, T1036, T1204
Input: Machete stores zipped files with profile data from installed web browsers.

Tactics: TA0009
Techniques: T1560
Input: GreyEnergy chooses a service, drops a DLL file, and writes it to that serviceDLL Registry key.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: SynAck gathers user names from infected hosts.

Tactics: TA0007
Techniques: T1033
Input: FIN7 lured victims to double-click on images in the attachments they sent which would then execute the hidden LNK file.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Lizar has a plugin designed to obtain a list of processes.

Tactics: TA0007
Techniques: T1057
Input: Hildegard has used history -c to clear script shell logs.

Tactics: TA0005
Techniques: T1070, T1070.003
Input: Additionally, administrators should perform an audit of all OAuth applications and the permissions they have been granted to access organizational data.

Tactics: TA0006
Techniques: T1528
Input: Lizar can collect email accounts from Microsoft Outlook and Mozilla Thunderbird.

Tactics: TA0007
Techniques: T1087.003, T1087
Input: Aquatic Panda has deleted malicious executables from compromised machines.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: WannaCry uses vssadmin, wbadmin, bcdedit, and wmic to delete and disable operating system recovery features.

Tactics: TA0040
Techniques: T1490
Input: As seen in the above request, the Trojan will generate a URL for its beacon with the following structure:http://<c2 domain>/chk?<hex(Environment.UserName/Environment.MachineName)> The Trojan will issue a request to this URL to check (hence the chk string in the URL) to see if the C2 server has a command for the Trojan to run

Tactics: TA0011
Techniques: T1071
Input: Aquatic Panda has attempted and failed to run Bash commands on a Windows host by passing them to cmd /C.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Tonto Team has used keylogging tools in their operations.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Monitor process being accessed that may acquire user credentials from third-party password managers.

Tactics: TA0006
Techniques: T1555.005, T1555
Input: WMI can be accessed using a variety of tools, including the Windows WMI Command-line (wmic.exe), or through APIs accessible to programming and scripting languages such as PowerShell

Tactics: TA0002
Techniques: T1047
Input: Kivars has the ability to uninstall malware from the infected host.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Strider has used a hidden file system that is stored as a file on disk.

Tactics: TA0005
Techniques: T1564, T1564.005