madox81/Adema_ATTACK_DS huggingface dataset:
Input: The password for the user's login keychain can be changed from the user's login password.

Tactics: TA0006
Techniques: T1555.001, T1555
Input: Maze has created scheduled tasks using name variants such as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update", to launch Maze at a specific time.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Caterpillar WebShell has a module to perform brute force attacks on a system.

Tactics: TA0006
Techniques: T1110
Input: Dipsind uses HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: BRONZE BUTLER has made use of Python-based remote access tools.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Variable Name Description   gdu Google Drive URL for downloading files to the Google Drive account   gduu Google Drive URL for uploading files to the Google Drive account   gdue Google Drive URL for updating a file on the Google Drive account   gdo2t Google Drive URL used to get the OAUTH access_token   client_id The client_id for the OAUTH application   cs The client_secret for OAUTH   r_t The refresh_token for OAUTH    Table 6 Variables used to store settings needed to use Google Drive as a C2 To obtain an OAUTH access token to authenticate to the actor provided Google account, the Trojan sends an HTTP POST request to a URL stored in the gdo2t variable with grant_type, client_id, client_secret, and refresh_token fields added to the HTTP header and in the POST data

Tactics: TA0011
Techniques: T1102
Input: Commands such as net user and net localgroup of the Net utility and id and groupson macOS and Linux can list local users and groups.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Zeus Panda checks processes on the system and if they meet the necessary requirements, it injects into that process.

Tactics: TA0004, TA0005
Techniques: T1055.002, T1055
Input: QakBot can use VBS to download and execute malicious files.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Its encoding method has been modified from time to time, aligned with major upgrade of PlugX itself

Tactics: TA0007
Techniques: T1124
Input: TajMahal has the ability to steal data from the clipboard of an infected host.

Tactics: TA0009
Techniques: T1115
Input: IFEOs are represented as Debugger values in the Registry under HKLM\SOFTWARE{\Wow6432Node}\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ where <executable> is the binary on which the debugger is attached.

Tactics: TA0003, TA0004
Techniques: T1546.012, T1546
Input: The sudoers file should be strictly edited such that passwords are always required and that users can't spawn risky processes as users with higher privilege.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: On macOS, monitor for execution of kextload commands and user installed kernel extensions performing abnormal and/or potentially malicious activity (such as creating network connections).

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: Turla RPC backdoors can collect files from USB thumb drives.

Tactics: TA0009
Techniques: T1025
Input: SMOKEDHAM has added created user accounts to local Admin groups.

Tactics: TA0003
Techniques: T1098
Input: Pony attachments have been delivered via compressed archive files.

Tactics: TA0005
Techniques: T1027
Input: MiniDuke can use DGA to generate new Twitter URLs for C2.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: APT32 has moved and renamed pubprn.vbs to a .txt file to avoid detection.

Tactics: TA0005
Techniques: T1036.003, T1036
Input: OS Credential Dumping can be used to obtain password hashes, this may only get an adversary so far when Pass the Hash is not an option.

Tactics: TA0006
Techniques: T1110, T1110.002
Input: Flagpro can use cmd.exe to execute commands received from C2.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: EvilBunny has used EnumProcesses() to identify how many process are running in the environment.

Tactics: TA0007
Techniques: T1057
Input: Common methods to acquire this information include port and/or vulnerability scans using tools that are brought onto a system.

Tactics: TA0007
Techniques: T1046
Input: Sandworm Team has acquired open-source tools for some of it's operations; for example it acquired Invoke-PSImage to establish an encrypted channel from a compromised host to Sandworm Team's C2 server as part of its preparation for the 2018 Winter Olympics attack.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: HAFNIUM has used rundll32 to load malicious DLLs.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: ADVSTORESHELL collects, compresses, encrypts, and exfiltrates data to the C2 server every 10 minutes.

Tactics: TA0010
Techniques: T1029
Input: SombRAT has collected data and files from a compromised host.

Tactics: TA0009
Techniques: T1005
Input: Tropic Trooper has used SSL to connect to C2 servers.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: BabyShark has executed the whoami command.

Tactics: TA0007
Techniques: T1033
Input: When a program is executed, the shim cache is referenced to determine if the program requires the use of the shim database (.sdb).

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: Similar to TFTP Boot, an adversary may upgrade the ROMMON image locally or remotely (for example, through TFTP) with adversary code and restart the device in order to overwrite the existing ROMMON image.

Tactics: TA0003, TA0005
Techniques: T1542.004, T1542
Input: NETEAGLE will decrypt resources it downloads with HTTP requests by using RC4 with the key "ScoutEagle."

Tactics: TA0011
Techniques: T1573, T1573.001
Input: DarkWatchman encodes data using hexadecimal representation before sending it to the C2 server.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: APT32 has used Dropbox, Amazon S3, and Google Drive to host malicious downloads.

Tactics: TA0011
Techniques: T1102
Input: The KDC service runs all on domain controllers that are part of an Active Directory domain.

Tactics: TA0006
Techniques: T1558, T1558.001
Input: This may be used in persistent threat incidents as well as BEC (Business Email Compromise) incidents where an adversary can add Additional Cloud Roles to the accounts they wish to compromise.

Tactics: TA0003
Techniques: T1098.002, T1098
Input: Siloscape maps the host’s C drive to the container by creating a global symbolic link to the host through the calling of NtSetInformationSymbolicLink.

Tactics: TA0004
Techniques: T1611
Input: PLAINTEE has downloaded and executed additional plugins.

Tactics: TA0011
Techniques: T1105
Input: TG-3390 actors favor At.exe to create scheduled tasks for executing commands on remote systems

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053, T1059
Input: Kobalos can chain together multiple compromised machines as proxies to reach their final targets.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: Confucius has lured victims to execute malicious attachments included in crafted spearphishing emails related to current topics.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: In this campaign, the group sent spear phishing emails containing malicious documents that led to the installation of the UPPERCUT backdoor

Tactics: TA0001
Techniques: T1566.003, T1566, T1566.002, T1566.001
Input: ShadowPad has used FTP for C2 communications.

Tactics: TA0011
Techniques: T1071.002, T1071
Input: Use least privilege for service accounts will limit what permissions the exploited process gets on the rest of the system.

Tactics: TA0001
Techniques: T1190
Input: Inventory systems for unauthorized Python installations.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: down_new has the ability to download files to the compromised host.

Tactics: TA0011
Techniques: T1105
Input: Carbon creates a base directory that contains the files and folders that are collected.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Credential resources obtained through exploitation may be detectable in use if they are not normally used or seen.

Tactics: TA0006
Techniques: T1212
Input: ROKRAT has been delivered via spearphishing emails that contain a malicious Hangul Office or Microsoft Word document.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: China Chopper's server component can upload local files.

Tactics: TA0009
Techniques: T1005
Input: Cobalt Strike can perform port scans from an infected host.

Tactics: TA0007
Techniques: T1046
Input: OilRig has used compromised credentials to access other systems on a victim network.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: APT41 used a tool called CLASSFON to covertly proxy network communications.

Tactics: TA0011
Techniques: T1090
Input: Adversaries may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems.

Tactics: TA0003, TA0004
Techniques: T1547
Input: Restrict unallowed ISAPI extensions and filters from running by specifying a list of ISAPI extensions and filters that can run on IIS.

Tactics: TA0003
Techniques: T1505.004, T1505
Input: BitPaymer can modify the timestamp of an executable so that it can be identified and restored by the decryption tool.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: FlawedAmmyy may obfuscate portions of the initial C2 handshake.

Tactics: TA0011
Techniques: T1001
Input: njRAT can create, delete, or modify a specified Registry key or value.

Tactics: TA0005
Techniques: T1112
Input: Browsers typically create a new process for each tab that is opened and permissions and certificates are separated accordingly.

Tactics: TA0009
Techniques: T1185
Input: Train users to only accept 2FA/MFA requests from login attempts they initiated, to review source location of the login attempt prompting the 2FA/MFA requests, and to report suspicious/unsolicited prompts.

Tactics: TA0006
Techniques: T1621
Input: Users listed in the at.allow are enabled to schedule actions using at, whereas users listed in at.deny file disabled from the utility.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: Spearphishing attachment is different from other forms of spearphishing in that it employs the use of malware attached to an email.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: APT29 changed domain federation trust settings using Azure AD administrative permissions to configure the domain to accept authorization tokens signed by their own SAML signing certificate.

Tactics: TA0004, TA0005
Techniques: T1484, T1484.002
Input: Sandworm Team has leased servers from resellers instead of leasing infrastructure directly from hosting companies to enable its operations.

Tactics: TA0042
Techniques: T1583.004, T1583
Input: System info:  Computer name System info using: cmd /c systeminfo >%temp%\temp.ini List of currently running process using: cmd /c tasklist >%temp%\temp.ini    Exfiltration  The data exfiltration process runs in the following sequence: The temp.ini files are copied into a text file that matches the pattern:  From <COMPUTER-NAME> (<Month>-<Day> <Hour>-<Minute>-<Second>).txt

Tactics: TA0007, TA0009
Techniques: T1057, T1560, T1082, T1074
Input: Anchor can terminate itself if specific execution flags are not present.

Tactics: TA0005
Techniques: T1480
Input: Monitor for anomalous Kerberos activity, such as malformed or blank fields in Windows logon/logoff events (Event ID 4624, 4672, 4634), RC4 encryption within ticket granting tickets (TGTs), and ticket granting service (TGS) requests without preceding TGT requests.Monitor the lifetime of TGT tickets for values that differ from the default domain duration.

Tactics: TA0006
Techniques: T1558
Input: Tools CTU researchers observed BRONZE UNION using the following tools in intrusions since the 2015 analysis, but clients should assume that the threat group still has access to the previously reported tools

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Legitimate programs used in suspicious ways, like msiexec.exe downloading an MSI file from the Internet, may be indicative of an intrusion.

Tactics: TA0005
Techniques: T1218
Input: Execution via DLL injection may also evade detection from security products since the execution is masked under a legitimate process.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Consider limiting the number of cached credentials (HKLM\SOFTWARE\Microsoft\Windows NT\Current Version\Winlogon\cachedlogonscountvalue)

Tactics: TA0006
Techniques: T1003, T1003.005
Input: Nibatad is also a loader that leverages search order hijacking, and downloads an encrypted payload to the infected computer.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Monitor for unusual kernel driver installation activity

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: BONDUPDATER can download or upload files from its C2 server.

Tactics: TA0011
Techniques: T1105
Input: SILENTTRINITY can gather Windows Vault credentials.

Tactics: TA0006
Techniques: T1555, T1555.004
Input: Netwalker can determine the system architecture it is running on to choose which version of the DLL to use.

Tactics: TA0007
Techniques: T1082
Input: Windows Event Logs are a record of a computer's alerts and notifications.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: Web browsers are a common target through Drive-by Compromise and Spearphishing Link.

Tactics: TA0002
Techniques: T1203
Input: Adversaries may hijack a legitimate user’s remote desktop session to move laterally within an environment.

Tactics: TA0008
Techniques: T1563.002, T1563
Input: Kimsuky has exfiltrated stolen files and data to actor-controlled Blogspot accounts.

Tactics: TA0010
Techniques: T1567.002, T1567
Input: A module in Prikormka collects information on available printers and disk drives.

Tactics: TA0007
Techniques: T1120
Input: Windshift has used links embedded in e-mails to lure victims into executing malicious code.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: ROKRAT can modify the HKEY_CURRENT_USER\Software\Microsoft\Office\ registry key so it can bypass the VB object model (VBOM) on a compromised host.

Tactics: TA0005
Techniques: T1112
Input: RainyDay can use the QuarksPwDump tool to obtain local passwords and domain cached credentials.

Tactics: TA0006
Techniques: T1555, T1555.004
Input: Cobalt Strike's execute-assembly command can run a .NET executable within the memory of a sacrificial process by loading the CLR.

Tactics: TA0005
Techniques: T1620
Input: KONNI has executed malicious JavaScript code.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: They also obtained ntds.dit from domain controllers.

Tactics: TA0006
Techniques: T1003.003, T1003
Input: Consider use of services that may aid in tracking of newly acquired domains, such as WHOIS databases and/or passive DNS.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: WellMess can identify domain group membership for the current user.

Tactics: TA0007
Techniques: T1069.002, T1069
Input: The HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx is also available but is not created by default on Windows Vista and newer.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Reaver.v1 has been observed delivering a payload that uses HTTP for network communication, while versions 2 and 3 use a payload that uses raw TCP connections for this communication

Tactics: TA0007, TA0011
Techniques: T1049, T1071
Input: Sandworm Team has also used VPN tunnels established in legitimate software company infrastructure to gain access to internal networks of that software company's users.

Tactics: TA0001, TA0003
Techniques: T1133
Input: Hunter queried the following URIs in a specific order to determine if the associated software configurations are insecure, and all queries contained the HttpClient User-Agent:  GET /manager/html/ — Tomcat web application manager GET /jmx-console/ — JBoss configuration GET /CFIDE/administrator/login.cfm — ColdFusion configuration  Installation TG-3390 uses DLL side loading, a technique that involves running a legitimate, typically digitally signed, program that loads a malicious DLL

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: LightNeuron is controlled via commands that are embedded into PDFs and JPGs using steganographic methods.

Tactics: TA0011
Techniques: T1001, T1001.002
Input: Note: As part of this technique, adversaries may attempt to manually edit these Registry keys (ex: Regedit) or utilize the legitimate registration process using Regsvr32.

Tactics: TA0005
Techniques: T1553, T1553.003
Input: There are a subset of root certificates that are consistent across Windows systems and can be used for comparison: * 18F7C1FCC3090203FD5BAA2F861A754976C8DD25* 245C97DF7514E7CF2DF8BE72AE957B9E04741E85* 3B1EFD3A66EA28B16697394703A72CA340A05BD5* 7F88CD7223F3C813818C994614A89C99FA3B5247* 8F43288AD272F3103B6FB1428485EA3014C0BCFE* A43489159A520F0D93D032CCAF37E7FE20A8B419* BE36A4562FB2EE05DBB3D32323ADF445084ED656* CDD4EEAE6000AC7F40C3802C171E30148030C072

Tactics: TA0005
Techniques: T1553, T1553.004
Input: Monitor Registry key modifications to HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\.Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing the Active Setup Registry locations and startup folders.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.014
Input: Monitor for unusual kernel driver installation activity.

Tactics: TA0040
Techniques: T1561
Input: Monitor for the SAM registry key being accessed that may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software.

Tactics: TA0006, TA0007
Techniques: T1033, T1003
Input: Seasalt has a command to delete a specified file.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Strider has registered its persistence module on domain controllers as a Windows LSA (Local System Authority) password filter to acquire credentials any time a domain, local user, or administrator logs in or changes a password.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.002, T1556
Input: MoonWind has a command to return a directory listing for a specified directory.

Tactics: TA0007
Techniques: T1083
Input: Monitor for newly constructed processes and/or command-lines for actions that could be taken to gather system and network information.

Tactics: TA0007
Techniques: T1069
Input: Inception has used weaponized documents attached to spearphishing emails for reconnaissance and initial compromise.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: TEXTMATE executes cmd.exe to provide a reverse shell to adversaries.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Cobalt Strike can track key presses with a keylogger module.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: FIN8 has used remote code execution to download subsequent payloads.

Tactics: TA0011
Techniques: T1105
Input: Monitor newly executed processes that may establish persistence through executing malicious commands triggered by a user’s shell.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: QUADAGENT uses AES and a preshared key to decrypt the custom Base64 routine used to encode strings and scripts.

Tactics: TA0005
Techniques: T1140
Input: BabyShark has executed the ipconfig /all command.

Tactics: TA0007
Techniques: T1016
Input: Darkhotel has used malware that searched for files with specific patterns.

Tactics: TA0007
Techniques: T1083
Input: WastedLocker can enumerate removable drives prior to the encryption process.

Tactics: TA0007
Techniques: T1120
Input: Enforce the principle of least privilege by limiting dashboard visibility to only the required users.

Tactics: TA0007
Techniques: T1613
Input: Monitor for newly executed processes that can aid in sniffing network traffic to capture information about an environment, including authentication material passed over the network

Tactics: TA0006, TA0007
Techniques: T1040
Input: (Source: Dell SecureWorks) To facilitate lateral movement, the adversaries deploy ASPXTool web shells to internally accessible systems running IIS

Tactics: TA0003
Techniques: T1505.003, T1505
Input: For websites and databases, the OWASP top 10 and CWE top 25 highlight the most common web-based vulnerabilities.

Tactics: TA0001
Techniques: T1190
Input: These appeared to be hosted on either Linode or Google Cloud, with a preference for using the ASN AS63949

Tactics: TA0011
Techniques: T1102
Input: Carberp has used the NtQueryDirectoryFile and ZwQueryDirectoryFile functions to hide files and directories.

Tactics: TA0002
Techniques: T1106
Input: The Trojan uses the first four bytes of this hardware ID as a unique identifier for the system, which in our case was “0000”

Tactics: TA0007
Techniques: T1082
Input: Gelsemium has the ability to use DNS in communication with C2.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Compromised profiles may be leveraged during other phases of the adversary lifecycle, such as during Initial Access (ex: Spearphishing via Service).

Tactics: TA0042
Techniques: T1586.001, T1586
Input: Mustang Panda has embedded VBScript components in LNK files to download additional files and automate collection.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: BoxCaon has created a working folder for collected files that it sends to the C2 server.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Unique SIPs exist for most file formats (Executable, PowerShell, Installer, , with catalog signing providing a catch-all  ) and are identified by globally unique identifiers (GUIDs).

Tactics: TA0005
Techniques: T1553, T1553.003
Input: Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation.

Tactics: TA0005
Techniques: T1036
Input: Bad Rabbit has masqueraded as a Flash Player installer through the executable file install_flash_player.exe.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: The same situation applies to authentication by key pair – the server contains a pre-defined constant public key and it allows authentication only if a particular private key is used

Tactics: TA0006, TA0009
Techniques: T1056
Input: Monitor DLLs loaded into a process and detect DLLs that have the same file name but abnormal paths.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Blue Mockingbird has used Remote Desktop to log on to servers interactively and manually copy files to remote hosts.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: SpicyOmelette can enumerate running software on a targeted system.

Tactics: TA0007
Techniques: T1518
Input: MCMD can launch a console process (cmd.exe) with redirected standard input and output.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: RedLeaves can obtain information about network parameters.

Tactics: TA0007
Techniques: T1016
Input: Tropic Trooper's backdoor could list the infected system's installed software.

Tactics: TA0007
Techniques: T1518
Input: JSS Loader has the ability to download and execute PowerShell scripts.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: It is also beneficial to turn on PowerShell logging to gain increased fidelity in what occurs during execution (which is applied to .NET invocations).

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Adversaries may also use time as a metric to detect sandboxes and analysis environments, particularly those that attempt to manipulate time mechanisms to simulate longer elapses of time.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: ShimRatReporter listed all running processes on the machine.

Tactics: TA0007
Techniques: T1057
Input: In a renegotiation attack, the adversary establishes a SSL/TLS connection and then proceeds to make a series of renegotiation requests.

Tactics: TA0040
Techniques: T1499.002, T1499