madox81/Adema_ATTACK_DS huggingface dataset:
Input: Windows API calls such as FindWindow, FindWindowEx, EnumWindows, EnumChildWindows, and those that can be used to modify memory within another process, such as VirtualAllocEx/WriteProcessMemory, may be abused for this technique.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.015
Input: The ccache file may also be converted into a Windows format using tools such as Kekeo.

Tactics: TA0006
Techniques: T1558
Input: HotCroissant has the ability to collect the username on the infected host.

Tactics: TA0007
Techniques: T1033
Input: MacSpy can record the sounds from microphones on a computer.

Tactics: TA0009
Techniques: T1123
Input: Confucius has crafted and sent victims malicious attachments to gain initial access.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Confucius has used a file stealer that checks the Document, Downloads, Desktop, and Picture folders for documents and images with specific extensions.

Tactics: TA0007
Techniques: T1083
Input: Adversaries may use binary padding to add junk data and change the on-disk representation of malware.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: COM is a system within Windows to enable interaction between software components through the operating system.

Tactics: TA0003, TA0004
Techniques: T1546.015, T1546
Input: Sandworm Team also collected a list of computers using specific software as part of its targeting efforts.

Tactics: TA0043
Techniques: T1592, T1592.002
Input: Establish an organizational policy that prohibits password storage in files.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: Ixeshe can list file and directory information.

Tactics: TA0007
Techniques: T1083
Input: Monitor logging, messaging, and other artifacts highlighting the health of host sensors (ex: metrics, errors, and/or exceptions from logging applications) that may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms.

Tactics: TA0005
Techniques: T1562
Input: The AllowReversiblePasswordEncryption property specifies whether reversible password encryption for an account is enabled or disabled.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.005
Input: In the case of network designs that do not require NAT, address translation can be used by adversaries to obscure their activities, as changing the addresses of packets that traverse a network boundary device can make monitoring data transmissions more challenging for defenders.

Tactics: TA0005
Techniques: T1599, T1599.001
Input: The shellcode of the embedded object is designed to download an image, which is, in fact, a new shellcode used to decode an embedded executable

Tactics: TA0011
Techniques: T1105
Input: Empire contains multiple modules for injecting into processes, such as Invoke-PSInject.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Shamoon queries several Registry keys to identify hard disk partitions to overwrite.

Tactics: TA0007
Techniques: T1012
Input: Filtering or blocking these ports will inhibit VNC traffic utilizing default ports.

Tactics: TA0008
Techniques: T1021.005, T1021
Input: Some versions of DEATHRANSOM have performed language ID and keyboard layout checks; if either of these matched Russian, Kazakh, Belarusian, Ukrainian or Tatar DEATHRANSOM would exit.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: OilRig has used net.exe in a script with net accounts /domain to find the password policy of a domain.

Tactics: TA0007
Techniques: T1201
Input: MuddyWater has distributed URLs in phishing e-mails that link to lure documents.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: When using msxsl.exe adversaries may also give the XML/XSL files an arbitrary file extension.

Tactics: TA0005
Techniques: T1220
Input: If running in a Windows environment, Kazuar saves a DLL to disk that is injected into the explorer.exe process to execute the payload.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Leviathan has compromised email accounts to conduct social engineering attacks.

Tactics: TA0042
Techniques: T1586.002, T1586
Input: Meteor has the ability to search for Kaspersky Antivirus on a victim's machine.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: PoetRAT has exfiltrated data over the C2 channel.

Tactics: TA0010
Techniques: T1041
Input: TAINTEDSCRIBE can download additional modules from its C2 server.

Tactics: TA0011
Techniques: T1105
Input: Monitor for contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions,

Tactics: TA0003, TA0004, TA0005
Techniques: T1027.004, T1036, T1027, T1036.007, T1546, T1055
Input: Evilnum can steal cookies and session information from browsers.

Tactics: TA0006
Techniques: T1539
Input: Gold Dragon uses HTTP for communication to the control servers.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: With Windows 10, Microsoft implemented new protections called Credential Guard to protect the LSA secrets that can be used to obtain credentials through forms of credential dumping.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: TajMahal has the ability to steal documents from the local system including the print spooler queue.

Tactics: TA0009
Techniques: T1005
Input: /var/log/httpd/: Web server access and error logs

Tactics: TA0005
Techniques: T1070, T1070.002
Input: MuddyWater has used PowerShell for execution.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: For example, an adversary may implement and apply a FGPP to users or groups if the Domain Functional Level is set to "Windows Server 2008" or higher.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.005
Input: Tropic Trooper has tested if the localhost network is available and other connection capability on an infected system using command scripts.

Tactics: TA0007
Techniques: T1049
Input: PoisonIvy creates a backdoor through which remote attackers can open a command-line interface.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Monitor executed commands and arguments from the BITSAdmin tool (especially the ‘Transfer’, 'Create', 'AddFile', 'SetNotifyFlags', 'SetNotifyCmdLine', 'SetMinRetryDelay', 'SetCustomHeaders', and 'Resume' command options) Admin logs, PowerShell logs, and the Windows Event log for BITS activity.

Tactics: TA0003, TA0005
Techniques: T1197
Input: SLOTHFULMEDIA can add, modify, and/or delete registry keys.

Tactics: TA0005
Techniques: T1112
Input: Kimsuky has used a macOS Python implant to gather data as well as MailFetcher.py code to automatically collect email data.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Monitor executed commands and arguments that may erase the contents of storage devices on specific systems or in large numbers in a network to interrupt availability to system and network resources.

Tactics: TA0040
Techniques: T1561.001, T1561
Input: In addition to looking for NTDS files on active Domain Controllers, adversaries may search for backups that contain the same or similar information.

Tactics: TA0006
Techniques: T1003.003, T1003
Input: BabyShark has cleaned up all files associated with the secondary payload execution.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: During the booting process of a computer, firmware and various startup services are loaded before the operating system.

Tactics: TA0003, TA0005
Techniques: T1542
Input: POWERTON has the ability to dump password hashes.

Tactics: TA0006
Techniques: T1003, T1003.002
Input: Use deep packet inspection to look for artifacts of common exploit traffic, such as known payloads.

Tactics: TA0008
Techniques: T1210
Input: APT28 sent spearphishing emails containing malicious Microsoft Office and RAR attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Depending on individual configurations, defenders may need to query the environment variables $XDG_CONFIG_HOME or $XDG_CONFIG_DIRS to determine the paths of Autostart entries.

Tactics: TA0003, TA0004
Techniques: T1547.013, T1547
Input: Adversaries may manipulate a process PEB to evade defenses.

Tactics: TA0005
Techniques: T1564.010, T1564
Input: Backdoored images may be uploaded to a public repository via Upload Malware, and users may then download and deploy an instance or container from the image without realizing the image is malicious, thus bypassing techniques that specifically achieve Initial Access.

Tactics: TA0002
Techniques: T1204.003, T1204
Input: Credential dumpers may also use methods for reflective Process Injection to reduce potential indicators of malicious activity.

Tactics: TA0006, TA0007
Techniques: T1033, T1003, T1003.001
Input: Explosive has collected the username from the infected host.

Tactics: TA0007
Techniques: T1033
Input: yty gets an output of running processes using the tasklist command.

Tactics: TA0007
Techniques: T1057
Input: Modify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Ole associated with system-wide security defaults for all COM applications that do no set their own process-wide security.

Tactics: TA0002
Techniques: T1559, T1559.001
Input: Operation Wocao can use the ping command to discover remote systems.

Tactics: TA0007
Techniques: T1018
Input: Proton uses an encrypted file to store commands and configuration values.

Tactics: TA0005
Techniques: T1140
Input: The directory creation.  Downloading the Payloads The remote XSL script downloads twelve files from the C2 server that masquerade themselves as JPEG, GIF, and extensionless files

Tactics: TA0011
Techniques: T1105
Input: BoomBox can use RunDLL32 for execution.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Nebulae has the capability to upload collected files to C2.

Tactics: TA0009
Techniques: T1005
Input: DarkWatchman can use TLS to encrypt its C2 channel.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: APT41 deployed a Monero cryptocurrency mining tool in a victim’s environment.

Tactics: TA0040
Techniques: T1496
Input: Sowbug listed remote shared drives that were accessible from a victim.

Tactics: TA0007
Techniques: T1135
Input: Using Windows Shortcut files (.lnk) in the Startup folder that invoke the Windows Scripting Host (wscript.exe) to execute a Jscript backdoor for persistence

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Disallow or restrict removable media at an organizational policy level if they are not required for business operations.

Tactics: TA0011, TA0010
Techniques: T1052, T1092, T1052.001
Input: Adversaries may gather information about the victim's network topology that can be used during targeting.

Tactics: TA0043
Techniques: T1590, T1590.004
Input: Operation Wocao has gained initial access via vulnerable webservers.

Tactics: TA0001
Techniques: T1190
Input: to find other systems broadcasting the ssh service.

Tactics: TA0007
Techniques: T1046
Input: Lizar has encrypted data before sending it to the server.

Tactics: TA0009
Techniques: T1560
Input: Bundlore has been spread through malicious advertisements on websites.

Tactics: TA0001
Techniques: T1189
Input: Empire can enumerate antivirus software on the target.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: DustySky has two hard-coded domains for C2 servers; if the first does not respond, it will try the second.

Tactics: TA0011
Techniques: T1008
Input: Monitor the command-line arguments of executing processes for suspicious words or regular expressions that may indicate searching for a password (for example: password, pwd, login, secure, or credentials).

Tactics: TA0006
Techniques: T1552
Input: Google's Admin Activity audit logs within their Cloud Audit logs can be used to detect the usage of gcloud compute instances delete to delete a VM.

Tactics: TA0005
Techniques: T1578.003, T1578
Input: Mimikatz

Tactics: TA0006
Techniques: T1003, T1003.002
Input: Analyze the contents of .service files present on the file system and ensure that they refer to legitimate, expected executables.

Tactics: TA0003, TA0004
Techniques: T1543.002, T1543
Input: APT28 encrypted a .dll payload using RTL and a custom encryption algorithm.

Tactics: TA0005
Techniques: T1027
Input: To detect changes in ETW you can also monitor the registry key which contains configurations for all ETW event providers: HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AUTOLOGGER_NAME{PROVIDER_GUID}

Tactics: TA0005
Techniques: T1562.006, T1562
Input: APT41 used compromised credentials to log on to other systems.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: Techniques to systematically guess the passwords used to compute hashes are available, or the adversary may use a pre-computed rainbow table to crack hashes.

Tactics: TA0006
Techniques: T1110, T1110.002
Input: Once brought into the victim environment ( Ingress Tool Transfer) files may then be copied from one system to another to stage adversary tools or other files over the course of an operation.

Tactics: TA0008
Techniques: T1570
Input: Nebulae can create a service to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: APT19 used an HTTP malware variant and a Port 22 malware variant to collect the victim’s username.

Tactics: TA0007
Techniques: T1033
Input: Users need to be trained to not authorize third-party applications they don’t recognize.

Tactics: TA0006
Techniques: T1528
Input: With LSA Protection enabled, monitor the event logs (Events 3033 and 3063) for failed attempts to load LSA plug-ins and drivers.

Tactics: TA0003, TA0004
Techniques: T1547.008, T1547
Input: Sidewinder has lured targets to click on malicious files to gain execution in the target environment.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Kexts need to be signed with a developer ID that is granted privileges by Apple allowing it to sign Kernel extensions.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: Reaver encrypts some of its files with XOR.

Tactics: TA0005
Techniques: T1027
Input: Some Sakula samples install themselves as services for persistence by calling WinExec with the net start argument.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: By manipulating data, adversaries may attempt to affect a business process, organizational understanding, or decision making.

Tactics: TA0040
Techniques: T1565
Input: Ensure all listed files are in alignment with approved extensions

Tactics: TA0003
Techniques: T1176
Input: The malicious DLL is also responsible for terminating the cliconfg.exe process and deleting the malicious NTWDBLIB.dll using: cmd /c taskkill /im cliconfg.exe /f /t && del /f /q NTWDBLIB.DLL All the following capabilities described are implemented by the malicious service DLL implant unless specified.   Variant using North Korean Red Cross Another variant (hash: 9e2c0bd19a77d712055ccc0276fdc062e9351436) of the malicious Word dropper uses the same Base64-decoding scheme with a different custom key

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1055, T1574
Input: APT29 has used administrative accounts to connect over SMB to targeted users.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Bandook can download files to the system.

Tactics: TA0011
Techniques: T1105
Input: Monitor for changes made to files that may stop or disable services on a system to render those services unavailable to legitimate users.

Tactics: TA0040
Techniques: T1489
Input: On Windows 10, enable Attack Surface Reduction (ASR) rules to block unsigned/untrusted executable files (such as .exe, .dll, or .scr) from running from USB removable drives.

Tactics: TA0001, TA0008
Techniques: T1091
Input: Cyclops Blink has also named RC scripts used for persistence after WatchGuard artifacts.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: LOWBALL uses the Dropbox API to request two files, one of which is the same file as the one dropped by the malicious email attachment.

Tactics: TA0011
Techniques: T1105
Input: Monitor executed commands and arguments for usage of the profiles tool, such as profiles install -type=configuration.

Tactics: TA0003
Techniques: T1176
Input: LaZagne can perform credential dumping from MSCache to obtain account and password information.

Tactics: TA0006
Techniques: T1003, T1003.005
Input: Other Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Other possibilities include social engineering a domain registration help desk to gain access to an account or taking advantage of renewal process gaps.

Tactics: TA0042
Techniques: T1584.001, T1584
Input: APT39 has used various tools to steal files from the compromised host.

Tactics: TA0009
Techniques: T1005
Input: Waterbear can leverage API functions for execution.

Tactics: TA0002
Techniques: T1106
Input: Monitor executed commands and arguments for actions that may interact with the Windows Registry to gather information about the system, configuration, and installed software.

Tactics: TA0007
Techniques: T1012
Input: MobileOrder has a command to upload to its C2 server victim browser bookmarks.

Tactics: TA0007
Techniques: T1217
Input: Hook module structure After decrypting the strings, it became clear that the Linux Hook main module communicated with the same CnC server as other Windows modules:  The CNC’s IP address in the Linux module This Linux module can process the following commands, some of which are similar to the Windows version:    die  delete all BlackEnergy2 files and system traces   kill  delete all BlackEnergy2 files and system traces and reboot   lexec  launch a command using bin/sh   rexec  download and launch file using ‘fork/exec’   update  rewrite self file   migrate  update the CnC server    Windows Plugins After the disclosure of an unusual CnC server that pushed Linux and the new Windows plugins we paid greater attention to new BE2 samples and associated CnCs

Tactics: TA0002, TA0005, TA0011
Techniques: T1070, T1106, T1105, T1070.004
Input: The VB.NET variant then gathers system information and running processes like other Zebrocy variants by running the following commands: systeminfo & tasklist The URL used to send the system information, running processes and a screenshot to the C2 server is: hxxp://109.248.148[.]42/agr-enum/progress-inform/cube.php?res=[serial number] The VB.NET variant of Zebrocy uses an HTTP POST request to the URL above to transmit the gathered data, of which is included within the HTTP POST data that is structured as follows (notice the spaces before and after ampersand “&”): data=[system information and running processes] & arg=[screenshot in BMP format] C# Zebrocy Variant The C# variant of Zebrocy is similar to other variants in functionality, but also has several unique attributes that are worth discussing

Tactics: TA0007, TA0011
Techniques: T1057, T1132, T1082
Input: PLEAD can harvest saved credentials from browsers such as Google Chrome, Microsoft Internet Explorer, and Mozilla Firefox.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Monitor for user authentication attempts, when requesting access tokens to services, that failed because of Conditional Access Policies (CAP).

Tactics: TA0006
Techniques: T1606, T1606.002
Input: Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: Bluetooth connections might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.

Tactics: TA0010
Techniques: T1011.001, T1011
Input: TAINTEDSCRIBE can enable Windows CLI access and execute files.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: For simple binary replacement on Windows XP and later as well as and Windows Server 2003/R2 and later, for example, the program (, C:\Windows\System32\utilman.exe) may be replaced with "cmd.exe" (or another program that provides backdoor access).

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: Utilize Yama (ex: /proc/sys/kernel/yama/ptrace_scope) to mitigate ptrace based process injection by restricting the use of ptrace to privileged users only.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Similar to Command and Scripting Interpreter, the native API and its hierarchy of interfaces provide mechanisms to interact with and utilize various components of a victimized system.

Tactics: TA0002
Techniques: T1106
Input: Windows event logs may designate activity associated with an adversary's attempt to remove access to an account:Event ID 4723 - An attempt was made to change an account's passwordEvent ID 4724 - An attempt was made to reset an account's passwordEvent ID 4725 - A user account was disabled

Tactics: TA0040
Techniques: T1531
Input: yty uses the net view command for discovery.

Tactics: TA0007
Techniques: T1018
Input: A Gamaredon Group file stealer can gather the victim's username to send to a C2 server.

Tactics: TA0007
Techniques: T1033
Input: After escalating privileges, MegaCortex calls TerminateProcess(), CreateRemoteThread, and other Win32 APIs.

Tactics: TA0002
Techniques: T1106
Input: DropBook can communicate with its operators by exploiting the Simplenote, DropBox, and the social media platform, Facebook, where it can create fake accounts to control the backdoor and receive instructions.

Tactics: TA0011
Techniques: T1102
Input: Ke3chang performs account discovery using commands such as net localgroup administrators and net group "REDACTED" /domain on specific permissions groups.

Tactics: TA0007
Techniques: T1087.002, T1087, T1087.001
Input: RegDuke can persist using a WMI consumer that is launched every time a process named WINWORD.EXE is started.

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: This code can then be invoked by redirecting the execution flow of the process via patched memory address references stored in a process' global offset table (which store absolute addresses of mapped library functions).

Tactics: TA0004, TA0005
Techniques: T1055.014, T1055
Input: Monitor for unexpected access to passwords and hashes stored in memory, processes must open a maps file in the /proc filesystem for the process being analyzed.

Tactics: TA0006
Techniques: T1003, T1003.007
Input: Its presence on a compromised system allows a threat actor to spawn a reverse shell, upload or download files, and capture keystrokes

Tactics: TA0011
Techniques: T1105
Input: Hi-Zor communicates with its C2 server over HTTPS.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Adversaries may also subsequently log off and/or perform a System Shutdown/Reboot to set malicious changes into place.

Tactics: TA0040
Techniques: T1531
Input: BackConfig has used compressed and decimal encoded VBS scripts.

Tactics: TA0005
Techniques: T1027
Input: Linux environments support several different IPC mechanisms, two of which being sockets and pipes.

Tactics: TA0002
Techniques: T1559
Input: Monitor for newly constructed logon behavior that may breach or otherwise leverage organizations who have access to intended victims.

Tactics: TA0001
Techniques: T1199
Input: Web service providers also commonly use SSL/TLS encryption, giving adversaries an added level of protection.

Tactics: TA0010
Techniques: T1567
Input: RainyDay has the ability to switch between TCP and HTTP for C2 if one method is not working.

Tactics: TA0011
Techniques: T1008
Input: DarkComet can execute various types of scripts on the victim’s machine.

Tactics: TA0002
Techniques: T1059
Input: The Dacls Mach-O binary has been disguised as a .nib file.

Tactics: TA0005
Techniques: T1036
Input: 13 Copy file to adbFle.tmp, and upload it to the C2

Tactics: TA0011
Techniques: T1105
Input: InvisiMole can obtain running services on the victim.

Tactics: TA0007
Techniques: T1007
Input: Monitor newly constructed files that may modify or add LSASS drivers to obtain persistence on compromised systems.

Tactics: TA0003, TA0004
Techniques: T1547.008, T1547
Input: Require secure port access to communicate with the APIs over TLS by disabling unauthenticated access to the Docker API, Kubernetes API Server, and container orchestration web applications.

Tactics: TA0002, TA0005
Techniques: T1610
Input: Drovorub can use TCP to communicate between its agent and client modules.

Tactics: TA0011
Techniques: T1095