madox81/Adema_ATTACK_DS huggingface dataset:
Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: Drive-by Compromise).

Tactics: TA0043
Techniques: T1596, T1596.004
Input: Ensure that Network Level Authentication is enabled to force the remote desktop session to authenticate before the session is created and the login screen displayed.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: OilRig has also used certutil to decode base64-encoded files on victims.

Tactics: TA0005
Techniques: T1140
Input: With most embedded devices, this can be achieved by downloading a copy of the desired version of the operating system file and reconfiguring the device to boot from that file on next system restart.

Tactics: TA0005
Techniques: T1601, T1601.002
Input: Windows Transactional NTFS (TxF) was introduced in Vista as a method to perform safe file operations.

Tactics: TA0004, TA0005
Techniques: T1055.013, T1055
Input: BADCALL communicates on ports 443 and 8000 with a FakeTLS method.

Tactics: TA0011
Techniques: T1571
Input: SpeakUp uses cron tasks to ensure persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: BackConfig has the ability to use HTTPS for C2 communiations.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Calisto can collect data from user directories.

Tactics: TA0009
Techniques: T1005
Input: MuddyWater has used malware that checked if the ProgramData folder had folders or files with the keywords "Kasper," "Panda," or "ESET."

Tactics: TA0007
Techniques: T1083
Input: The JHUHUGIT dropper can delete itself from the victim.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: AppleJeus can install itself as a service.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: XAgentOSX contains the ftpUpload function to use the FTPManager:uploadFile method to upload files from the target system.

Tactics: TA0011
Techniques: T1071.002, T1071
Input: Dark Caracal collected complete contents of the 'Pictures' folder from compromised Windows systems.

Tactics: TA0009
Techniques: T1005
Input: Use of MFA is recommended and provides a higher level of security than user names and passwords alone, but organizations should be aware of techniques that could be used to intercept and bypass these security mechanisms.

Tactics: TA0006
Techniques: T1111
Input: They can be purchased or, in some cases, acquired for free.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: Avenger has the ability to use HTTP in communication with C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: IcedID has the ability to identify the computer name and OS version on a compromised host.

Tactics: TA0007
Techniques: T1082
Input: and then deletes the original launcher

Tactics: TA0005
Techniques: T1070, T1070.004
Input: This should be done extensively on all applications in order to establish a baseline, followed up on with periodic audits of new or updated applications.

Tactics: TA0006
Techniques: T1528
Input: Tropic Trooper has used JPG files with encrypted payloads to mask their backdoor routines and evade detection.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: Verify integrity of live processes by comparing code in memory to that of corresponding static binaries, specifically checking for jumps and other instructions that redirect code flow.

Tactics: TA0006, TA0009
Techniques: T1056.004, T1056
Input: EvilBunny's dropper has checked the number of processes and the length and strings of its own file name to identify if the malware is in a sandbox environment.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Ping can be used to identify remote systems within a network.

Tactics: TA0007
Techniques: T1018
Input: Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities.

Tactics: TA0005
Techniques: T1027.006, T1553, T1027, T1553.005
Input: APT33 has used HTTP over TCP ports 808 and 880 for command and control.

Tactics: TA0011
Techniques: T1571
Input: Stuxnet used MS10-073 and an undisclosed Task Scheduler vulnerability to escalate privileges on local Windows machines.

Tactics: TA0004
Techniques: T1068
Input: OSX/Shlayer uses the command sh -c tail -c +1381... to extract bytes at an offset from a specified file.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: The group has also used downloaded encrypted payloads over HTTP.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: The service control manager is accessible to users via GUI components as well as system utilities such as sc.exe and Net.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Monitor for newly constructed services/daemons that may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

Tactics: TA0005
Techniques: T1036
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.

Tactics: TA0040
Techniques: T1499, T1499.004
Input: BoxCaon can upload files from a compromised host.

Tactics: TA0009
Techniques: T1005
Input: Lizar has a plugin to retrieve information about all active network sessions on the infected server.

Tactics: TA0007
Techniques: T1049
Input: PLEAD has been executed via malicious links in e-mails.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: POSHSPY downloads and executes additional PowerShell code and Windows binaries.

Tactics: TA0011
Techniques: T1105
Input: SUNBURST dynamically resolved C2 infrastructure for randomly-generated subdomains within a parent domain.

Tactics: TA0011
Techniques: T1568
Input: Some examples of event types include system startup and user authentication.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.014
Input: TEXTMATE uses DNS TXT records for C2.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: PLEAD has the ability to list open windows on the compromised host.

Tactics: TA0007
Techniques: T1010
Input: Tomiris has used SCHTASKS /CREATE /SC DAILY /TN StartDVL /TR "[path to self]" /ST 10:00 to establish persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Hildegard has collected the host's OS, CPU, and memory information.

Tactics: TA0007
Techniques: T1082
Input: Inventory workstations for unauthorized VNC server software.

Tactics: TA0008
Techniques: T1021.005, T1021
Input: WastedLocker has the ability to save and execute files as an alternate data stream (ADS).

Tactics: TA0005
Techniques: T1564, T1564.004
Input: Before executing malicious code, Ragnar Locker checks the Windows API GetLocaleInfoW and doesn't encrypt files if it finds a former Soviet country.

Tactics: TA0007
Techniques: T1614
Input: Turla has used various JavaScript-based backdoors.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Specifically, any version providing increased password complexity or policy enforcement preventing default or weak passwords.

Tactics: TA0006
Techniques: T1110, T1110.001
Input: FIN8 has used malicious e-mail attachments to lure victims into executing malware.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Xbash has maliciously encrypted victim's database systems and demanded a cryptocurrency ransom be paid.

Tactics: TA0040
Techniques: T1486
Input: Encrypting communications using AES and RSA public key cryptography   5

Tactics: TA0011
Techniques: T1573
Input: Nebulae can use RC4 and XOR to encrypt C2 communications.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: GRIFFON has used sctasks for persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Traditional antivirus software and other systems that rely on low-level indicators do not effectively detect and block common and pervasive malware

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Adversaries may attempt to exfiltrate data over a different network medium than the command and control channel.

Tactics: TA0010
Techniques: T1011
Input: Adversaries may communicate using application layer protocols associated with electronic mail delivery to avoid detection/network filtering by blending in with existing traffic.

Tactics: TA0011
Techniques: T1071, T1071.003
Input: Lazarus Group persistence mechanisms have used forfiles.exe to execute .htm files.

Tactics: TA0005
Techniques: T1202
Input: Orz can gather the victim's Internet Explorer version.

Tactics: TA0007
Techniques: T1518
Input: Sibot will delete an associated registry key if a certain server response is received.

Tactics: TA0005
Techniques: T1070
Input: Monitor requests of new ticket granting ticket or service tickets to a Domain Controller.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550.003, T1550
Input: Monitor for files that write or overwrite many files to a network shared directory may be suspicious.

Tactics: TA0008
Techniques: T1080
Input: Ensure that temporary access tokens are issued rather than permanent credentials, especially when access is being granted to entities outside of the internal security boundary.

Tactics: TA0009
Techniques: T1530
Input: Doki has resolved the path of a process PID to use as a script argument.

Tactics: TA0007
Techniques: T1083
Input: An OAuth access token enables a third-party application to interact with resources containing user data in the ways requested by the application without obtaining user credentials.

Tactics: TA0006
Techniques: T1528
Input: Once a persona has been developed an adversary can use it to create connections to targets of interest.

Tactics: TA0042
Techniques: T1585, T1585.001
Input: DustySky scans the victim for files that contain certain keywords and document types including PDF, DOC, DOCX, XLS, and XLSX, from a list that is obtained from the C2 as a text file.

Tactics: TA0007
Techniques: T1083
Input: Once infected, victims will reach out to and be redirected by these resolvers.

Tactics: TA0011
Techniques: T1102.001, T1102
Input: Netwalker can use WMI to delete Shadow Volumes.

Tactics: TA0002
Techniques: T1047
Input: JPIN can communicate over FTP.

Tactics: TA0011
Techniques: T1071.002, T1071
Input: Dacls can establish persistence via a LaunchAgent.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: Sliver can upload files from the C2 server to the victim machine using the upload command.

Tactics: TA0011
Techniques: T1105
Input: SombRAT can enumerate services on a victim machine.

Tactics: TA0007
Techniques: T1007
Input: If an application opts-in, a file downloaded from the Internet will be given a quarantine flag before being saved to disk.

Tactics: TA0005
Techniques: T1553.001, T1553
Input: Adversaries may gather credentials from potential victims in various ways, such as direct elicitation via Phishing for Information.

Tactics: TA0043
Techniques: T1589, T1589.001
Input: Naikon uses commands such as netsh interface show to discover network interface settings.

Tactics: TA0007
Techniques: T1016
Input: The campaigns maintain persistence on machines by creating two daily scheduled task entries.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Returns the screenshot to the C2 via: <img src=’data:image/jpeg;base64,[base64 of screenshot]’ width=800 height=500 /><br>   111 startTakeScreenShot Creates a thread to take a screenshot at a set interval (default: every 10 seconds)

Tactics: TA0009
Techniques: T1113
Input: APT28 has used a modified and obfuscated version of the reGeorg web shell to maintain persistence on a target's Outlook Web Access (OWA) server.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: ADVSTORESHELL connects to port 80 of a C2 server using Wininet API.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.

Tactics: TA0009
Techniques: T1005
Input: Monitor for newly executed processes that may abuse the Windows service control manager to execute malicious commands or payloads.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: HAMMERTOSS has used -WindowStyle hidden to conceal PowerShell windows.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: On macOS, identify users with an userID under 500 and the Hide500Users key value in the /Library/Preferences/com.apple.loginwindow plist file set to TRUE.

Tactics: TA0005
Techniques: T1564.002, T1564
Input: MegaCortex has used a Base64 key to decode its components.

Tactics: TA0005
Techniques: T1140
Input: KeyBoy can gather extended system information, such as information about the operating system, disks, and memory.

Tactics: TA0007
Techniques: T1082
Input: Azorult can capture screenshots of the victim’s machines.

Tactics: TA0009
Techniques: T1113
Input: BLUELIGHT can collect the local time on a compromised host.

Tactics: TA0007
Techniques: T1124
Input: OopsIE compresses collected files with GZipStream before sending them to its C2 server.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Bazar can enumerate the victim's desktop.

Tactics: TA0007
Techniques: T1083
Input: Leviathan has inserted garbage characters into code, presumably to avoid anti-virus detection.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: SQLRat has used SQL to execute JavaScript and VB scripts on the host system.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: HiddenWasp uses an RC4-like algorithm with an already computed PRGA generated key-stream for network communication.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: AppleSeed has the ability to communicate with C2 over HTTP.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: KOCTOPUS has checked the OS version using wmic.exe and the find command.

Tactics: TA0007
Techniques: T1082
Input: Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

Tactics: TA0007, TA0009
Techniques: T1007, T1087.002, T1087, T1049, T1114, T1082, T1010, T1087.001, T1114.001
Input: CharmPower can send additional modules over C2 encrypted with a simple substitution cipher.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection.

Tactics: TA0007
Techniques: T1083
Input: NETWIRE can use XDG Autostart Entries to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.013, T1547
Input: Pupy can grab a system’s information including the OS version, architecture,

Tactics: TA0007
Techniques: T1082
Input: This may allow API callers to execute a binary, run a CLI command, load modules,  as thousands of similar API functions exist for various system operations.

Tactics: TA0002
Techniques: T1106
Input: Goopy has checked for the Google Updater process to ensure Goopy was loaded properly.

Tactics: TA0007
Techniques: T1057
Input: njRAT has a module that steals passwords saved in victim web browsers.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: FYAnti has used ConfuserEx to pack its .NET module.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: After initial compromise, Chaos will download a second stage to establish a more permanent presence on the affected system.

Tactics: TA0011
Techniques: T1104
Input: Data loss prevention can detect and block sensitive data being sent over unencrypted protocols.

Tactics: TA0010
Techniques: T1041, T1048.003, T1048
Input: ZxShell has a command to perform video device spying.

Tactics: TA0009
Techniques: T1125
Input: RDFSNIFFER has used several Win32 API functions to interact with the victim machine.

Tactics: TA0002
Techniques: T1106
Input: Maze has injected the malware DLL into a target process.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: ZIRCONIUM has used a tool to capture the username on a compromised host in order to register it with C2.

Tactics: TA0007
Techniques: T1033
Input: WellMail can use TCP for C2 communications.

Tactics: TA0011
Techniques: T1095
Input: WIRTE has named a first stage dropper Kaspersky Update Agent in order to appear legitimate.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Environmental keying may be used to deliver an encrypted payload to the target that will use target-specific values to decrypt the payload before execution.

Tactics: TA0005
Techniques: T1480, T1480.001
Input: Egregor has used rundll32 during execution.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: APT32 has disguised a Cobalt Strike beacon as a Flash Installer.

Tactics: TA0005
Techniques: T1036
Input: Non-localized resources are placed at the top level directory of an application bundle, while localized resources are placed in the /Resources folder.

Tactics: TA0005
Techniques: T1564, T1564.009
Input: Xbash can create a Startup item for persistence if it determines it is on a Windows system.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: DRATzarus can collect information from a compromised host.

Tactics: TA0009
Techniques: T1005
Input: Reaver collects the victim's IP address.

Tactics: TA0007
Techniques: T1016
Input: Bisonal has used a dynamic DNS service for C2.

Tactics: TA0011
Techniques: T1568
Input: RunningRAT contains code to open and copy data from the clipboard.

Tactics: TA0009
Techniques: T1115
Input: Cobalt Group deleted the DLL dropper from the victim’s machine to cover their tracks.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Kinsing was executed with an Ubuntu container entry point that runs shell scripts.

Tactics: TA0002
Techniques: T1609
Input: Also, FoggyWeb can encode C2 command output within a legitimate WebP file.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: APT28 executed CHOPSTICK by using rundll32 commands such as rundll32.exe "C:\Windows\twain_64.dll".

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Adversaries may abuse any alias in Windows Management Instrumentation provided they utilize the /FORMAT switch.

Tactics: TA0005
Techniques: T1220
Input: Consider utilizing the Antimalware Scan Interface (AMSI) on Windows 10 to analyze commands after being processed/interpreted.

Tactics: TA0005
Techniques: T1027
Input: In Mac and Linux, netstat and lsof can be used to list current connections.

Tactics: TA0007
Techniques: T1049
Input: RainyDay can use a file exfiltration tool to copy files to C:\ProgramData\Adobe\temp prior to exfiltration.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Year  Country  Industry  Malware  2014  Vietnam  Network Security  WINDSHIELD  2014  Germany  Manufacturing  WINDSHIELD  2015  Vietnam  Media  WINDSHIELD  2016  Philippines  Consumer products  KOMPROGO WINDSHIELD SOUNDBITE BEACON   2016  Vietnam  Banking  WINDSHIELD  2016  Philippines  Technology Infrastructure  WINDSHIELD  2016  China  Hospitality  WINDSHIELD  2016  Vietnam  Media  WINDSHIELD  2016  United States  Consumer Products  WINDSHIELD PHOREAL BEACON SOUNDBITE  Table 1: APT32 Private Sector Targeting Identified by FireEye APT32 Interest in Political Influence and Foreign Governments In addition to focused targeting of the private sector with ties to Vietnam, APT32 has also targeted foreign governments, as well as Vietnamese dissidents and journalists since at least 2013

Tactics: TA0004
Techniques: T1068
Input: Figure 8 CARROTBAT downloading final payload via certutil   The downloaded CAB file has the following properties:    MD5 a943e196b83c4acd9c5ce13e4c43b4f4   SHA1 e66e416f300c7efb90c383a7630c9cfe901ff9fd   SHA256 cfe436c1f0ce5eb7ac61b32cd073cc4e4b21d5016ceef77575bef2c2783c2d62   File Type Microsoft Cabinet archive data, 181248 bytes, 3 files      The following three files and their descriptions are dropped by this CAB file:      Filename Purpose   Install.bat Installation batch script responsible for copying the other files to C:\Users\Public\Downloads and setting the Run registry key to ensure persistence

Tactics: TA0002, TA0005, TA0007, TA0011
Techniques: T1036, T1090.003, T1083, T1105, T1090, T1059
Input: Get-Process | select Company Checks to see if any running processes have “Wireshark” or “Sysinternals” as the company name

Tactics: TA0007
Techniques: T1057, T1518.001, T1518
Input: PROMETHIUM has used Registry run keys to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: It contains functionality to acquire information about credentials in many ways, including from the credential vault and DPAPI.

Tactics: TA0006
Techniques: T1555
Input: Gamaredon Group has also used its backdoors to automatically list interesting files (such as Office documents) found on a system.

Tactics: TA0007
Techniques: T1083
Input: MuddyWater can disable the system's local proxy settings.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: SideTwist can embed C2 responses in the source code of a fake Flickr webpage.

Tactics: TA0011
Techniques: T1001
Input: The second email references a Hong Kong University alumni organization that fears votes in a referendum to appoint a Vice-Chancellor will be co-opted by pro-Beijing interests.[9]  Figure 1: Lure Screenshots The group’s previous activities against financial and policy organizations have largely focused on spear phishing emails written in English, destined for Western audiences

Tactics: TA0009
Techniques: T1113
Input: Typically, management services over commonly used ports are used when guessing passwords.

Tactics: TA0006
Techniques: T1110, T1110.001
Input: Netwalker's PowerShell script can decode and decrypt multiple layers of obfuscation, leading to the Netwalker DLL being loaded into memory.

Tactics: TA0005
Techniques: T1140
Input: Monitor the start folder for additions or changes.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: GALLIUM packed some payloads using different types of packers, both known and custom.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Monitor for unexpected deletion of a cloud volume (ex: AWS delete-volume)

Tactics: TA0040
Techniques: T1485
Input: NanoCore has the capability to download and activate additional modules for execution.

Tactics: TA0011
Techniques: T1105
Input: Backdoor.Oldrea collects the current username from the victim.

Tactics: TA0007
Techniques: T1033
Input: Adversaries may use startup items automatically executed at boot initialization to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1037, T1037.005
Input: Even when we observed LuckyMouse using weaponized documents with CVE-2017-11882 (Microsoft Office Equation Editor, widely used by Chinese-speaking actors since December 2017), we can´t prove they were related to this particular attack

Tactics: TA0002
Techniques: T1203
Input: Change settings to prevent the browser from installing extensions without sufficient permissions.

Tactics: TA0003
Techniques: T1176
Input: The “upload” command downloads files from the CnC and saves them locally in “C:\ProgramData“

Tactics: TA0011
Techniques: T1105
Input: Monitor for modification of files (especially DLLs on webservers) that could be abused as malicious ISAPI extensions/filters or IIS modules.

Tactics: TA0003
Techniques: T1505.004, T1505
Input: Similarly, AMSI / ETW traces can be used to identify signs of arbitrary code execution from within the memory of potentially compromised processes.

Tactics: TA0005
Techniques: T1620
Input: Bad Rabbit enumerates open SMB shares on internal victim networks.

Tactics: TA0007
Techniques: T1135
Input: Monitor commands and arguments executed by container services.

Tactics: TA0002
Techniques: T1609
Input: Monitor for unexpected deletion to a file (ex: Sysmon EID 23)

Tactics: TA0040
Techniques: T1485