madox81/Adema_ATTACK_DS huggingface dataset:
Input: This provides the adversary with all the plaintext passwords for users, WiFi, mail, browsers, certificates, secure notes,

Tactics: TA0006
Techniques: T1555.002, T1555
Input: APT32 has used macros, COM scriptlets, and VBS scripts.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: APT29 used the Get-AcceptedDomain PowerShell cmdlet to enumerate accepted domains through an Exchange Management Shell.

Tactics: TA0007
Techniques: T1482
Input: Silence has used a valid certificate to sign their primary loader Silence.Downloader (aka TrueBot).

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Monitor newly executed processes that may attempt to find domain-level groups and permission settings.

Tactics: TA0007
Techniques: T1069.002, T1069
Input: SMOKEDHAM can continuously capture keystrokes.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control (Web Service) or Exfiltration Over Web Service.

Tactics: TA0042
Techniques: T1583.006, T1583
Input: Others will make an in-memory copy of the SAM table before reading hashes.

Tactics: TA0006, TA0007
Techniques: T1033, T1003, T1003.002
Input: Wizard Spider has shut down or uninstalled security applications on victim systems that might prevent ransomware from executing.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Rocke has extracted tar.gz files after downloading them from a C2 server.

Tactics: TA0005
Techniques: T1140
Input: OilRig has used keylogging tools called KEYPUNCH and LONGWATCH.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.

Tactics: TA0005
Techniques: T1112
Input: This is because sudo has the ability to cache credentials for a period of time.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: Clambling has the ability to enumerate network shares.

Tactics: TA0007
Techniques: T1135
Input: Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.

Tactics: TA0002
Techniques: T1203
Input: Monitor specifically for events related to deactivation of instances that are occurring outside of planned operations.

Tactics: TA0005
Techniques: T1578, T1578.004
Input: This variation of the Zebrocy downloader begins by gathering the serial number for the storage volume with the label “C:\” and the computer name

Tactics: TA0007
Techniques: T1082
Input: FinFisher extracts and decrypts stage 3 malware, which is stored in encrypted resources.

Tactics: TA0005
Techniques: T1140
Input: Fysbis has masqueraded as trusted software rsyncd and dbus-inotifier.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Gamaredon Group tools can delete files used during an operation.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Babuk has the ability to enumerate files on a targeted system.

Tactics: TA0007
Techniques: T1083
Input: Local File: wmic process list /FORMAT:evil[.]xsl

Tactics: TA0005
Techniques: T1220
Input: Tasklist can be used to enumerate security software currently running on a system by process name of known products.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: P.A.S. Webshell has the ability to copy files on a compromised host.

Tactics: TA0009
Techniques: T1005
Input: ADVSTORESHELL can delete files and directories.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Frankenstein has run encoded commands from the command line.

Tactics: TA0005
Techniques: T1027
Input: Applications and appliances that utilize default username and password should be changed immediately after the installation, and before deployment to a production environment.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.001
Input: Pisloader obfuscates files by splitting strings into smaller sub-strings and including "garbage" strings that are never used.

Tactics: TA0005
Techniques: T1027
Input: Command  Action    sign  Requests system information    settings  Requests settings from C2 server    logs  Uploads harvested passwords    wallet  Uploads harvested cryptocurrency wallet data    proxy  Indicates SOCKS proxy port opened    miner  Cryptocurrency miner commands    error  Reports errors to C2 server    ddos  DDoS attack commands    Table 1: Zyklon accepted commands The following figures show the initial request and subsequent server response for the “settings” (Figure 13), “sign” (Figure 14), and “ddos” (Figure 15) commands

Tactics: TA0002, TA0011
Techniques: T1090, T1059
Input: Reflection attacks often take advantage of protocols with larger responses than requests in order to amplify their traffic, commonly known as a Reflection Amplification attack.

Tactics: TA0040
Techniques: T1498, T1498.002
Input: Writing payloads to shared sections also avoids the use of highly monitored API calls such as WriteProcessMemory and CreateRemoteThread.

Tactics: TA0004, TA0005
Techniques: T1055.011, T1055
Input: LSA secrets can also be dumped from memory.

Tactics: TA0006
Techniques: T1003, T1003.004
Input: Utilities used to perform software packing are called packers.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to obtain information about services: net start >> %temp%\download

Tactics: TA0007
Techniques: T1007
Input: For example, the creation of an instance by a new user account or the unexpected creation of one or more snapshots followed by the creation of an instance may indicate suspicious activity.In AWS, CloudTrail logs capture the creation of an instance in the RunInstances event, and in Azure the creation of a VM may be captured in Azure activity logs.

Tactics: TA0005
Techniques: T1578.002, T1578
Input: Bazar can establish persistence by writing shortcuts to the Windows Startup folder.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: The chmod command can set these bits with bitmasking, chmod 4777 [file] or via shorthand naming, chmod u+s [file].

Tactics: TA0004, TA0005
Techniques: T1548, T1548.001
Input: These scans can also be performed in various ways, including using native features of network protocols such as ICMP.

Tactics: TA0043
Techniques: T1595
Input: Peirates can initiate a port scan against a given IP address.

Tactics: TA0007
Techniques: T1046
Input: Lizar can retrieve network information from a compromised host.

Tactics: TA0007
Techniques: T1016
Input: Adversaries may modify property list files (plist files) to enable other malicious activity, while also potentially evading and bypassing system defenses.

Tactics: TA0005
Techniques: T1647
Input: Cuba can use the function GetIpNetTable to recover the last connections to the victim's machine.

Tactics: TA0007
Techniques: T1049
Input: Psylo has commands to enumerate all storage devices and to find all files that start with a particular string.

Tactics: TA0007
Techniques: T1083
Input: Machete has has relied on users opening malicious links delivered through spearphishing to execute malware.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Monitor for unexpected modifications to file timestamps

Tactics: TA0005
Techniques: T1070, T1070.006
Input: LightNeuron uses AES to encrypt C2 traffic.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Droppers used by Putter Panda use RC4 or a 16-byte XOR key consisting of the bytes 0xA0 – 0xAF to obfuscate payloads.

Tactics: TA0005
Techniques: T1027
Input: FIN8 has used FTP to exfiltrate collected data.

Tactics: TA0010
Techniques: T1048.003, T1048
Input: Prikormka creates a directory, %USERPROFILE%\AppData\Local\SKC\, which is used to store collected log files.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: ROKRAT can use  the GetForegroundWindow and GetWindowText APIs to discover where the user is typing.

Tactics: TA0007
Techniques: T1010
Input: Mosquito stores configuration values under the Registry key HKCU\Software\Microsoft[dllname] and modifies Registry keys under HKCR\CLSID...\InprocServer32with a path to the launcher.

Tactics: TA0005
Techniques: T1112
Input: Monitor executed commands and arguments that may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers.

Tactics: TA0003, TA0004
Techniques: T1546.012, T1546
Input: The type of modification and the impact it will have depends on the type of data as well as the goals and objectives of the adversary.

Tactics: TA0040
Techniques: T1565.001, T1565
Input: Ramsay can stage data prior to exfiltration in %APPDATA%\Microsoft\UserSetting and %APPDATA%\Microsoft\UserSetting\MediaCache.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Apply patch KB2962486 which prevents credentials from being stored in GPPs.

Tactics: TA0006
Techniques: T1552, T1552.006
Input: Monitor for unexpected files ( .pdf, .docx, .jpg, ) viewed for collecting internal data.

Tactics: TA0009
Techniques: T1119
Input: Hildegard has created a user named "monerodaemon".

Tactics: TA0003
Techniques: T1136, T1136.001
Input: Lazarus Group malware KiloAlfa contains keylogging functionality.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Darkhotel has sent spearphishing emails with malicious RAR and .LNK attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: BackConfig has been signed with self signed digital certificates mimicking a legitimate software company.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Ensure that local administrator accounts have complex, unique passwords across all systems on the network.

Tactics: TA0001, TA0003, TA0004, TA0005, TA0006
Techniques: T1003.006, T1003.003, T1003, T1003.002, T1003.004, T1078, T1078.003, T1003.001, T1003.005
Input: TSCookie has the ability to steal saved passwords from the Internet Explorer, Edge, Firefox, and Chrome browsers.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Monitor executed commands and arguments, such as requests for credentials and/or strings related to creating password prompts that may be malicious.

Tactics: TA0006, TA0009
Techniques: T1056.002, T1056
Input: Remsec can obtain a list of active connections and open ports.

Tactics: TA0007
Techniques: T1049
Input: APT41 used DNS for C2 communications.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Sibot has downloaded a DLL to the C:\windows\system32\drivers\ folder and renamed it with a .sys extension.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: When possible, applications that use SSH keys should be updated periodically and properly secured.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: RTM collects data from the clipboard.

Tactics: TA0009
Techniques: T1115
Input: gh0st RAT has the capability to list processes.

Tactics: TA0007
Techniques: T1057
Input: BlackEnergy communicates with its C2 server over HTTP.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Detecting Avast  A unique feature of this latest Astaroth Trojan campaign is the malware's ability to search for specific security products and exploit them

Tactics: TA0007
Techniques: T1518.001, T1518
Input: If system, software, or web browser credential disclosure is a significant concern, technical controls, policy, and user training may be used to prevent storage of credentials in improper locations.

Tactics: TA0006
Techniques: T1555
Input: Members of the Administrators, Domain Admins, and Enterprise Admin groups or computer accounts on the domain controller are able to run DCSync to pull password data from Active Directory, which may include current and historical hashes of potentially useful accounts such as KRBTGT and Administrators.

Tactics: TA0006
Techniques: T1003.006, T1003
Input: Most of the strings in ADVSTORESHELL are encrypted with an XOR-based algorithm; some strings are also encrypted with 3DES and reversed.

Tactics: TA0005
Techniques: T1027
Input: It can also use Service Control Manager to start new services.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Payloads may also be split into separate, seemingly benign files that only reveal malicious functionality when reassembled.

Tactics: TA0005
Techniques: T1027
Input: AdFind has the ability to query Active Directory for computers.

Tactics: TA0007
Techniques: T1018
Input: The deprecated at utility could also be abused by adversaries (ex: At), though at.exe can not access tasks created with schtasks or the Control Panel.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Poseidon Group searches for administrator accounts on both the local victim machine and the network.

Tactics: TA0007
Techniques: T1087.002, T1087, T1087.001
Input: HD Creates a file in the Temp path and names it “hd” + PCID then invokes another program module named hd.test1 to identify logical drives

Tactics: TA0007
Techniques: T1083
Input: Web shells are heavily relied on for nearly all stages of the attack lifecycle

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Bundlore will enumerate the macOS version to determine which follow-on behaviors to execute using /usr/bin/sw_vers -productVersion.

Tactics: TA0007
Techniques: T1082
Input: Tropic Trooper has used a copy function to automatically exfiltrate sensitive data from air-gapped systems using USB storage.

Tactics: TA0010
Techniques: T1020
Input: Carberp has exfiltrated data via HTTP to already established C2 servers.

Tactics: TA0010
Techniques: T1041
Input: Filename Created On Last Modified First Seen Total Time (In Days)   Passport.docx instruction.docx 9/11/18 04:22 10/13/18 08:21 10/18/18 07:38 37.1   DN_325_170428_DEA…invitation.docx 9/11/18 04:22 10/13/18 08:21 10/25/18 08:15 44.12   crash list(Lion Air Boeing 737).docx Бурханов.docx 9/11/18 04:22 10/13/18 08:21 11/01/18 06:50 51.1   Заявление.docx 9/11/18 04:22 10/13/18 08:21 11/01/18 11:41 51.3   1500029.docx 10/18/18 06:59 10/18/18 07:00 10/18/18 08:47 0.4   2018_10_13_17_15_21.docx 10/18/18 06:59 10/18/18 07:00 10/24/18 07:38 6.2   Rocket attacks on Israel.docx 11/13/18 12:17 11/13/18 10:46 11/14/18 05:14 0.7   Brexit 15.11.2018.docx DIP 89 OIC Condemns 14 Nov Attacks.docx 15.11 attacks.docx 11/14/18 14:17 11/15/18 04:50 11/15/18 06:28 0.8   201811131257.docx 11/14/18 14:33 11/15/18 04:50 11/15/18 12:31 0.9    Table 3 Timestamps of delivery documents (all times in UTC)  Figure 7 Dear Joohn timeline Based off the timestamps we have, four delivery documents were initially created on September 11, 2018 04:22 UTC

Tactics: TA0007, TA0009, TA0011
Techniques: T1005, T1090.003, T1083, T1090
Input: Digitally signed malware The entire bundle (VPN client and malware) was digitally signed with a valid code signing certificate issued by Symantec to AI Squared, a legitimate software company that develops accessibility software:  Thumbprint: F340C0D841F9D99DBC289151C13391000366631C Serial number: 45 E4 7F 56 0B 01 B6 4E 68 39 5E 5D 79 2F 2E 09 Another Helminth sample, 1c23b3f11f933d98febfd5a92eb5c715, was signed with a different AI Squared code signing certificate: Thumbprint: 92B8C0872BACDC226B9CE4D783D5CCAD61C6158A Serial number:62 E0 44 E7 37 24 61 2D 79 4B 93 AF 97 46 13 48 This suggest that the attackers had got a hold of an Ai Squared signing key, potentially after compromising their network

Tactics: TA0005
Techniques: T1553, T1553.002
Input: GrimAgent can delete previously created tasks on a compromised host.

Tactics: TA0005
Techniques: T1070
Input: Adversaries may also assign mailbox folder permissions through individual folder permissions or roles.

Tactics: TA0003
Techniques: T1098.002, T1098
Input: This marker indicates the presence of an encrypted MZ marker in the .hwp file and is decrypted by the malware and written to the Startup folder for the user:  C:\Documents and Settings\<username>\Start Menu\Programs\Startup\viso.exe  This step establishes the persistence of the malware across reboots on the endpoint Once the decrypted MZ marker is written to the Startup folder, the 2.hwp is deleted from the endpoint  The malware might perform this activity for a couple of reasons:  Establish persistence for itself on the endpoint Establish persistence of another component of the malware on the endpoint Update itself on endpoint after a separate updater component downloads the update from the control server  The malware has limited reconnaissance and data-gathering capabilities and is not full-fledged spyware

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Evilnum has used a component called TerraLoader to check certain hardware and file information to detect sandboxed environments.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: HOMEFRY uses a command-line interface.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Meteor can fill a victim's files and directories with zero-bytes in replacement of real content before deleting them.

Tactics: TA0040
Techniques: T1485
Input: Peppy has the ability to automatically exfiltrate files and keylogs.

Tactics: TA0010
Techniques: T1020
Input: The Regin malware platform can use Windows admin shares to move laterally.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Because ICMP is part of the Internet Protocol Suite, it is required to be implemented by all IP-compatible hosts.

Tactics: TA0011
Techniques: T1095
Input: HAWKBALL has encrypted data with XOR before sending it over the C2 channel.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: Monitor for newly executed processes that may use scripts automatically executed at boot or logon initialization to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1037
Input: A JHUHUGIT variant accesses a screenshot saved in the clipboard and converts it to a JPG image.

Tactics: TA0009
Techniques: T1115
Input: Ursnif has used Systeminfo to gather system information.

Tactics: TA0007
Techniques: T1082
Input: Darkhotel has used a keylogger.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Monitor for processes being viewed that may inject malicious code into processes via ptrace (process trace) system calls in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055.008, T1055
Input: Blue Mockingbird has used Windows Registry modifications to specify a DLL payload.

Tactics: TA0005
Techniques: T1112
Input: PolyglotDuke can use steganography to hide C2 information in images.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: SDelete deletes data in a way that makes it unrecoverable.

Tactics: TA0005, TA0040
Techniques: T1070, T1485, T1070.004
Input: Adversaries may use email rules to hide inbound emails in a compromised user's mailbox.

Tactics: TA0005
Techniques: T1564, T1564.008
Input: Monitor executed commands and arguments that may attempt to take advantage of a weakness in an Internet-facing computer or program using software, data, or commands in order to cause unintended or unanticipated behavior.

Tactics: TA0002
Techniques: T1204.003, T1204
Input: Monitor for newly executed processes that may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment.

Tactics: TA0007
Techniques: T1615
Input: Ferocious Kitten has conducted spearphishing campaigns containing malicious documents to lure victims to open the attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Monitor for unexpected/abnormal access to files that may be malicious collection of local data, such as user files (pdf, .docx, .jpg, ) or local databases.

Tactics: TA0009
Techniques: T1005
Input: POWERSTATS has established persistence through a scheduled task using the command "C:\Windows\system32\schtasks.exe" /Create /F /SC DAILY /ST 12:00 /TN MicrosoftEdge /TR "c:\Windows\system32\wscript.exe C:\Windows\temp\Windows.vbe".

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Azure AD creates several log entries when new devices are enrolled, which can be monitored for unexpected device registrations.

Tactics: TA0003
Techniques: T1098.005, T1098
Input: Adversaries may clear Windows Event Logs to hide the activity of an intrusion.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: Consider implementing access control mechanisms that include both authentication and authorization for code repositories.

Tactics: TA0009
Techniques: T1213, T1213.003
Input: POWRUNER may enumerate user directories on a victim.

Tactics: TA0007
Techniques: T1083
Input: Adversaries may choose domains that are similar to legitimate domains, including through use of homoglyphs or use of a different top-level domain (TLD).

Tactics: TA0042
Techniques: T1583.001, T1583
Input: This differs from Steal Web Session Cookie, Steal Application Access Token, and other similar behaviors in that the credentials are new and forged by the adversary, rather than stolen or intercepted from legitimate users.

Tactics: TA0006
Techniques: T1606
Input: JCry has been observed deleting shadow copies to ensure that data cannot be restored easily.

Tactics: TA0040
Techniques: T1490
Input: The DustySky dropper uses Windows Management Instrumentation to extract information about the operating system and whether an anti-virus is active.

Tactics: TA0002
Techniques: T1047
Input: FYAnti has the ability to decrypt an embedded .NET module.

Tactics: TA0005
Techniques: T1140
Input: PoisonIvy hides any strings related to its own indicators of compromise.

Tactics: TA0005
Techniques: T1027
Input: Staging of capabilities can aid the adversary in a number of initial access and post-compromise behaviors, including (but not limited to):

Tactics: TA0042
Techniques: T1608
Input: Rocke has cleared log files within the /var/log/ folder.

Tactics: TA0005
Techniques: T1070, T1070.002
Input: Mustang Panda has leveraged the legitimate email marketing service SMTP2Go for phishing campaigns.

Tactics: TA0042
Techniques: T1585, T1585.002
Input: To obtain a job, the Trojan builds a subdomain that has the following structure and issues a DNS query to the C2 server: c<unique identifier><job identifier padded with ‘0’ to make three digits><sequence number>c The generated subdomain is then subjected to a number-to-character substitution function that is the inverse of the Table 4, which effectively converts all the digits in the subdomain into characters

Tactics: TA0007
Techniques: T1082
Input: When the .lnk file is initialized, it spawns a CMD process

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Malware repositories can also be used to identify features of tool use associated with an adversary, such as watermarks in Cobalt Strike payloads.

Tactics: TA0042
Techniques: T1588
Input: APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

Tactics: TA0005
Techniques: T1112
Input: AppleSeed can disguise JavaScript files as PDFs.

Tactics: TA0005
Techniques: T1036
Input: The module loader can load DLLs via <file name="filename.extension" loadFrom="fully-qualified or relative pathname"> in an embedded or external "application manifest".

Tactics: TA0002
Techniques: T1129
Input: Diavol has a ENMDSKS command to enumerates available network shares.

Tactics: TA0007
Techniques: T1135
Input: Commands included in XDG autostart entries with execute after user logon in the context of the currently logged on user.

Tactics: TA0003, TA0004
Techniques: T1547.013, T1547
Input: Zeus Panda hooks processes by leveraging its own IAT hooked functions.

Tactics: TA0006, TA0009
Techniques: T1056.004, T1056
Input: Ursnif has used a DGA to generate domain names for C2.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: Checks for the presence of security tools (detailed in the Appendix) and if any of these security tools are discovered, then the system will be shut down, as shown in Figure 14

Tactics: TA0007
Techniques: T1518.001, T1518