madox81/Adema_ATTACK_DS huggingface dataset:
Input: LookBack can list running processes.

Tactics: TA0007
Techniques: T1057
Input: An adversary may access the Docker API to collect logs that contain credentials to cloud, container, and various other resources in the environment.

Tactics: TA0006
Techniques: T1552, T1552.007
Input: CDNs allow an organization to host content from a distributed, load balanced array of servers.

Tactics: TA0043
Techniques: T1596, T1596.004
Input: Tropic Trooper has encrypted traffic with the C2 to prevent network detection.

Tactics: TA0011
Techniques: T1573
Input: A variant of Emissary appends junk data to the end of its DLL file to create a large file that may exceed the maximum size that anti-virus programs can scan.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: There are dedicated rootkit detection tools that look for specific types of rootkit behavior.

Tactics: TA0005
Techniques: T1014
Input: Third-party applications can also leverage Apple’s Hardened Runtime, ensuring these environment variables are subject to imposed restrictions.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.006, T1574
Input: 19-2 A startup event for persistence The malware will run 2 .dlls from regsvr32 simultaneously, spawning userinit, ctfmon, and svchost processes

Tactics: TA0003, TA0004, TA0005
Techniques: T1218, T1547.001, T1547, T1218.010
Input: An adversary may abuse these protocols to communicate with systems under their control within a victim network while also mimicking normal, expected traffic.

Tactics: TA0011
Techniques: T1071.002, T1071, T1071.003, T1071.001
Input: Try to exploit the following Remote Code Execution vulnerabilities in the targeted servers:  a) CVE-2012-0874: JBoss Enterprise Application Platform Multiple Security Bypass Vulnerabilities b) CVE-2010-1871: JBoss Seam Framework remote code execution c) JBoss AS 3/4/5/6: Remote Command Execution (exploit) d) CVE-2017-10271: Oracle WebLogic wls-wsat Component Deserialization RCE e) CVE-2018-2894: Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware

Tactics: TA0002
Techniques: T1203
Input: SombRAT can run upload to decrypt and upload files from storage.

Tactics: TA0005
Techniques: T1140
Input: One approach is to use N-Gram methods to determine a randomness score for strings used in the domain name.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: Once registered, a rogue DC may be able to inject and replicate changes into AD infrastructure for any domain object, including credentials and keys.

Tactics: TA0005
Techniques: T1207
Input: If the adversary has sufficient permissions to establish a new federation trust with their own Active Directory Federation Services (AD FS) server, they may instead generate their own trusted token-signing certificate.

Tactics: TA0006
Techniques: T1606, T1606.002
Input: MuddyWater has used cmd.exe net user /domain to enumerate domain users.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: CrackMapExec can dump hashed passwords associated with Active Directory using Windows' Directory Replication Services API (DRSUAPI), or Volume Shadow Copy.

Tactics: TA0006
Techniques: T1003.003, T1003
Input: Compromising a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers as well as that added by the compromised third-party.

Tactics: TA0042
Techniques: T1584.003, T1584
Input: Kazuar obtains a list of running processes through WMI querying and the ps command.

Tactics: TA0007
Techniques: T1057
Input: Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.010
Input: APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious attachment.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Silence has used environment variable string substitution for obfuscation.

Tactics: TA0005
Techniques: T1027
Input: Internal spearphishing is multi-staged campaign where an email account is owned either by controlling the user's device with previously installed malware or by compromising the account credentials of the user.

Tactics: TA0008
Techniques: T1534
Input: Leviathan has downloaded additional scripts and files from adversary-controlled servers.

Tactics: TA0011
Techniques: T1105
Input: Since the kernel is responsible for enforcing security and the kernel extensions run as apart of the kernel, kexts are not governed by macOS security policies.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: OnionDuke steals credentials from its victims.

Tactics: TA0006
Techniques: T1003
Input: Cobalt Group used msxsl.exe to bypass AppLocker and to invoke Jscript code from an XSL file.

Tactics: TA0005
Techniques: T1220
Input: Example commands to find Registry keys related to password information:

Tactics: TA0006
Techniques: T1552, T1552.002
Input: DarkVishnya created new services for shellcode loaders distribution.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: APT12 has used RIPTIDE, a RAT that uses HTTP to communicate.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Payloads may be compressed, archived, or encrypted in order to avoid detection.

Tactics: TA0005
Techniques: T1027
Input: Turla and its RPC backdoors have used APIs calls for various tasks related to subverting AMSI and accessing then executing commands through RPC and/or named pipes.

Tactics: TA0002
Techniques: T1106
Input: A number of native Windows utilities have been used by adversaries to disable or delete system recovery features:

Tactics: TA0040
Techniques: T1490
Input: PlugX can enumerate and query for information contained within the Windows Registry.

Tactics: TA0007
Techniques: T1012
Input: A pointer to the memory address of the KernelCallbackTable can be obtained by locating the PEB (ex: via a call to the NtQueryInformationProcess() Native API function).

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.013, T1574
Input: PUNCHBUGGY can gather AVs registered in the system.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Octopus has exfiltrated data to file sharing sites.

Tactics: TA0010
Techniques: T1567.002, T1567
Input: APT32 has used scheduled task raw XML with a backdated timestamp of June 2, 2016.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: Use MDM to disable user's ability to install or approve kernel extensions, and ensure all approved kernel extensions are in alignment with policies specified in com.apple.syspolicy.kernel-extension-policy.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: EnvyScout can use protocol handlers to coax the operating system to send NTLMv2 authentication responses to attacker-controlled infrastructure.

Tactics: TA0006
Techniques: T1187
Input: Sibot has been executed via a scheduled task.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: XCSSET will compress entire ~/Desktop folders excluding all .git folders, but only if the total data size is under 200MB.

Tactics: TA0009
Techniques: T1560
Input: Monitor and analyze the execution and arguments of hh.exe.

Tactics: TA0005
Techniques: T1218, T1218.001
Input: Mimikatz’s LSADUMP::DCShadow module can be used to make AD updates by temporarily setting a computer to be a DC.

Tactics: TA0005
Techniques: T1207
Input: It may be possible to remove PowerShell from systems when not needed, but a review should be performed to assess the impact to an environment, since it could be in use for many legitimate purposes and administrative functions.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: PowerShower has added a registry key so future powershell.exe instances are spawned with coordinates for a window position off-screen by default.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Indrik Spider has collected credentials from infected systems, including domain accounts.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.002
Input: Ursnif droppers have used WMI classes to execute PowerShell commands.

Tactics: TA0002
Techniques: T1047
Input: PowerShower has collected system information on the infected host.

Tactics: TA0007
Techniques: T1082
Input: TinyTurla can set its configuration parameters in the Registry.

Tactics: TA0005
Techniques: T1112
Input: KGH_SPY can collect credentials from the Windows Credential Manager.

Tactics: TA0006
Techniques: T1555, T1555.004
Input: SUNBURST had commands that allow an attacker to write or delete registry keys, and was observed stopping services by setting their HKLM\SYSTEM\CurrentControlSet\services\[service_name]\Start registry entries to value 4.

Tactics: TA0005
Techniques: T1112
Input: These configuration scripts run at the permission level of their directory and are often used to set environment variables, create aliases, and customize the user’s environment.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: Neoichor can check for Internet connectivity by contacting bing[.]com with the request format bing[.]com?id=<GetTickCount>.

Tactics: TA0007
Techniques: T1016.001, T1016
Input: For example, adding a module name that is undefined to the PROJECT stream will inhibit attempts of reading the VBA source code through the GUI.

Tactics: TA0005
Techniques: T1564, T1564.007
Input: PUNCHBUGGY mimics filenames from %SYSTEM%\System32 to hide DLLs in %WINDIR% and/or %TEMP%.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: For Launch Daemons with the RunAtLoad parameter set to true, ensure the Program parameter points to signed code or executables are in alignment with enterprise policy.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.

Tactics: TA0001
Techniques: T1566.003, T1566
Input: Chaes has used the Puppeteer module to hook and monitor the Chrome web browser to collect user information from infected hosts.

Tactics: TA0009
Techniques: T1185
Input: In the following example, archives for exfiltration were renamed as .tmp files:  move \\{FILE PATH}\c$\programdata\AT.part01.rar  \\{FILE PATH}\c$\programdata\at01.tmp The TMP files were then staged for exfiltration on Internet-facing servers that had previously been compromised with the China Chopper web shell

Tactics: TA0005, TA0009
Techniques: T1070, T1070.004, T1074
Input: Denis has several commands to search directories for files.

Tactics: TA0007
Techniques: T1083
Input: Use process monitoring to monitor the execution and arguments of odbcconf.exe.

Tactics: TA0005
Techniques: T1218, T1218.008
Input: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Consider analyzing newly constructed network connections that are sent or received by untrusted hosts, unexpected hardware devices, or other uncommon data flows.

Tactics: TA0010
Techniques: T1020
Input: After decrypting itself in memory, RARSTONE downloads a DLL file from its C2 server and loads it in the memory space of a hidden Internet Explorer process.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Bazar can use Winlogon Helper DLL to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.004, T1547
Input: DealersChoice leverages vulnerable versions of Flash to perform execution.

Tactics: TA0002
Techniques: T1203
Input: Kerrdown can use DLL side-loading to load malicious DLLs.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: Actions may be related to network and system information Discovery, Collection, or other programmable post-compromise behaviors and could be used as indicators of detection leading back to the source.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: The script will first attempt to communicate with the C2 server using HTTPS (HTTP if unsuccessful), which involves GET requests using the session ID within the request’s cookie in the PHPSESSID field, as seen in the example GET request:       GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.246Host: www.rdppath[.]comCookie: PHPSESSID=<c2 provided session id>Connection: Keep-Alive     If the payload is unable to reach the C2 via HTTPS/HTTP, the payload yet again falls back to DNS tunneling

Tactics: TA0011, TA0010
Techniques: T1041, T1071, T1008
Input: APT39 has used stolen credentials to compromise Outlook Web Access (OWA).

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: Silence has used the Farse6.1 utility (based on Mimikatz) to extract credentials from lsass.exe.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Lokibot will delete its dropped files after bypassing UAC.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: HotCroissant has the ability to identify the IP address of the compromised machine.

Tactics: TA0007
Techniques: T1016
Input: This can help them to discover old, vulnerable pages or hidden administrative portals that could become the target of further operations (ex: Exploit Public-Facing Application or Brute Force).

Tactics: TA0043
Techniques: T1595.003, T1595
Input: NETWIRE can capture session logon details from a compromised host.

Tactics: TA0007
Techniques: T1049
Input: Fox Kitten has used sticky keys to launch a command prompt.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: PUNCHBUGGY has saved information to a random temp file before exfil.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Resolving DNS requests with on-premise/proxy servers may also disrupt adversary attempts to conceal data within DNS packets.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Guardrails ensure that a payload only executes against an intended target and reduces collateral damage from an adversary’s campaign.

Tactics: TA0005
Techniques: T1480
Input: An adversary may monitor vulnerability disclosures/databases to understand the state of existing, as well as newly discovered, vulnerabilities.

Tactics: TA0042
Techniques: T1588.006, T1588
Input: Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap.

Tactics: TA0011
Techniques: T1090.001, T1090, T1090.002
Input: The technique of having a signed, legitimate, executable load a malicious library is commonly referred to as side-loading, and has been witnessed in a number of campaigns and malware families in the past

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: Gamaredon Group malware has used CreateProcess to launch additional malicious components.

Tactics: TA0002
Techniques: T1106
Input: System scans can be performed to identify unauthorized archival utilities.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: To decrypt the passwords, an adversary needs four components:

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.005
Input: Operation Wocao has used their own web shells, as well as those previously placed on target systems by other threat actors, for reconnaissance and lateral movement.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Monitor executed commands and arguments that may employ various time-based methods to detect and avoid virtualization and analysis environments.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Collecting disk and resource filenames for binaries, comparing that the InternalName, OriginalFilename, and/or ProductName match what is expected, could provide useful leads but may not always be indicative of malicious activity.

Tactics: TA0005
Techniques: T1036
Input: Socksbot creates a suspended svchost process and injects its DLL into it.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Monitor for newly constructed services/daemons.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.

Tactics: TA0004
Techniques: T1068
Input: Excel Personal.xlsb location:C:\Users\<username>\AppData\Roaming\Microsoft\Excel\XLSTART\PERSONAL.XLSB

Tactics: TA0003
Techniques: T1137, T1137.001
Input: Lokibot has the ability to copy itself to a hidden file and directory.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: 3PARA RAT has a command to retrieve metadata for files on disk as well as a command to list the current working directory.

Tactics: TA0007
Techniques: T1083
Input: In response to this request, the C2 server responds with a Base64-encoded RSA public key (seen in Figure 12)

Tactics: TA0011
Techniques: T1132
Input: Adversaries will likely change tool command and control signatures over time or construct protocols in such a way to avoid detection by common defensive tools.

Tactics: TA0010
Techniques: T1041, T1029
Input: GoldenSpy's uninstaller has base64-encoded its variables.

Tactics: TA0005
Techniques: T1027
Input: Lucifer can issue shell commands to download and execute additional payloads.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: KEYMARBLE has a command to search for files on the victim’s machine.

Tactics: TA0007
Techniques: T1083
Input: SPACESHIP copies staged data to removable drives when they are inserted into the system.

Tactics: TA0010
Techniques: T1052, T1052.001
Input: HotCroissant can remotely open applications on the infected host with the ShellExecuteA command.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Conti can spread itself by infecting other remote machines via network shared drives.

Tactics: TA0008
Techniques: T1080
Input: Nebulae can use DLL side-loading to gain execution.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: Koadic can obtain a list of directories.

Tactics: TA0007
Techniques: T1083
Input: Bandook has a command to list files on a system.

Tactics: TA0007
Techniques: T1083
Input: PowerShell Script “58d2a83f777942.26535794.ps1” is a multilayer obfuscated PowerShell script, which launches shellcode for a Cobalt Strike stager

Tactics: TA0002, TA0005
Techniques: T1027, T1059.001, T1059
Input: KOCTOPUS has obfuscated scripts with the BatchEncryption tool.

Tactics: TA0005
Techniques: T1027
Input: Turla has used VBS scripts throughout its operations.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Adversaries install new AppCertDLL binaries to execute this technique.

Tactics: TA0003, TA0004
Techniques: T1546.009, T1546
Input: On macOS and Linux curl may be used to invoke protocols such as HTTP/S or FTP/S to exfiltrate data from a system.

Tactics: TA0010
Techniques: T1048
Input: Gelsemium can check for the presence of specific security products.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Gelsemium can use multiple domains and protocols in C2.

Tactics: TA0011
Techniques: T1008
Input: Kwampirs copies itself over network shares to move laterally on a victim network.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.

Tactics: TA0003
Techniques: T1136, T1136.003
Input: OilRig malware ISMAgent falls back to its DNS tunneling mechanism if it is unable to reach the C2 server over HTTP.

Tactics: TA0011
Techniques: T1008
Input: Additionally, the Google Workspace Directory allows for users to get a listing of other users within the organization.

Tactics: TA0007
Techniques: T1087.003, T1087
Input: Once the user enables macros, the macro will perform the following actions:  Displays decoy content Checks for the existence of a file at %APPDATA%\wscript.exe If %APPDATA%\wscript.exe does not exist, the macro converts an embedded hex-encoded string into bytes and saves this data to the %APPDATA%\wscript.exe

Tactics: TA0002
Techniques: T1204
Input: PoshC2 has modules for keystroke logging and capturing credentials from spoofed Outlook authentication messages.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Sidewinder has used mshta.exe to execute malicious payloads.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: By running SSH on the server in a compromised network, attackers can come back to the network whenever they want

Tactics: TA0007
Techniques: T1016
Input: For example, an adversary in a privileged user context ( administrator) may spawn a new process and assign the parent as a process running as SYSTEM (such as lsass.exe), causing the new process to be elevated via the inherited access token.

Tactics: TA0004, TA0005
Techniques: T1134.004, T1134
Input: Typically, this file keeps track of the user’s last 500 commands.

Tactics: TA0006
Techniques: T1552.003, T1552
Input: DOGCALL is capable of leveraging cloud storage APIs such as Cloud, Box, Dropbox, and Yandex for C2.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: SMOKEDHAM has used Google Drive and Dropbox to host files downloaded by victims via malicious links.

Tactics: TA0011
Techniques: T1102
Input: Remote access tools will call back to the first-stage command and control server for instructions.

Tactics: TA0011
Techniques: T1104
Input: ChinaChopper web shell

Tactics: TA0003
Techniques: T1505.003, T1505
Input: QUADAGENT uses multiple protocols (HTTPS, HTTP, DNS) for its C2 server as fallback channels if communication with one is unsuccessful.

Tactics: TA0011
Techniques: T1008
Input: Access through trusted third party relationship exploits an existing connection that may not be protected or receives less scrutiny than standard mechanisms of gaining access to a network.

Tactics: TA0001
Techniques: T1199
Input: Bankshot gathers system information, network addresses, disk type, disk free space, and the operation system version.

Tactics: TA0007
Techniques: T1082
Input: Sandworm Team has used various MS-SQL stored procedures.

Tactics: TA0003
Techniques: T1505.001, T1505
Input: Adversaries may attempt to overwrite files and directories with randomly generated data to make it irrecoverable.

Tactics: TA0040
Techniques: T1485
Input: Use application control configured to block execution of mshta.exe if it is not required for a given system or network to prevent potential misuse by adversaries.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: It writes encrypted data to %APPDATA%\Intel\Skype.

Tactics: TA0009
Techniques: T1125, T1123
Input: HermeticWiper has the ability to corrupt disk partitions, damage the Master Boot Record (MBR), and overwrite the Master File Table (MFT) of all available physical drives.

Tactics: TA0040
Techniques: T1561, T1561.002
Input: Pillowmint has collected credit card data using native API functions.

Tactics: TA0009
Techniques: T1005
Input: REvil can save encryption parameters and system information to the Registry.

Tactics: TA0005
Techniques: T1112
Input: SUNBURST C2 data attempted to appear as benign XML related to .NET assemblies or as a faux JSON blob.

Tactics: TA0011
Techniques: T1001, T1001.002
Input: Use Group Policy to disable screensavers if they are unnecessary.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.002
Input: Monitor for API calls that may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Monitor executed commands and arguments that are leveraging the use of resource forks, especially those immediately followed by potentially malicious activity such as creating network connections.

Tactics: TA0005
Techniques: T1564, T1564.009
Input: Traffic will appear to be going to domain-x, however the CDN may route it to domain-y.

Tactics: TA0011
Techniques: T1090.004, T1090
Input: Goopy has the ability to use cmd.exe to execute commands passed from an Outlook C2 channel.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Adversaries may abuse system services or daemons to execute commands or programs.

Tactics: TA0002
Techniques: T1569
Input: Search order hijacking occurs when an adversary abuses the order in which Windows searches for programs that are not given a path.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.008, T1574