madox81/Adema_ATTACK_DS huggingface dataset:
Input: The Trojan uses HTTP POST requests, as seen in Figure 1 to send data to the C2 server, and GET requests to receive commands from the server, as seen in Figure 2

Tactics: TA0011
Techniques: T1071
Input: gsecdump can dump LSA secrets.

Tactics: TA0006
Techniques: T1003, T1003.004
Input: Monitor executed commands and arguments for actions that could be taken to change, conceal, and/or delete information in the Registry.

Tactics: TA0005
Techniques: T1112
Input: Adversaries may also be able to escalate privileges from administrator to root as the emond service is executed with root privileges by the Launch Daemon service.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.014
Input: An adversary may compress and/or encrypt data that is collected prior to exfiltration.

Tactics: TA0009
Techniques: T1560
Input: Comnie executes BAT scripts.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: NETWIRE has been executed through convincing victims into clicking malicious links.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Trusted Relationship).

Tactics: TA0043
Techniques: T1596, T1596.003
Input: SLOTHFULMEDIA has the capability to enumerate services.

Tactics: TA0007
Techniques: T1007
Input: Sandworm Team has run net use to connect to network shares.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Machete has distributed Machete through a fake blog website.

Tactics: TA0001
Techniques: T1189
Input: Monitor and analyze SSL/TLS traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure).

Tactics: TA0001
Techniques: T1566, T1566.002, T1566.001
Input: APT32 has used hidden or non-printing characters to help masquerade service names, such as appending a Unicode no-break space character to a legitimate service name.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: ComRAT can execute PowerShell scripts loaded into memory or from the file system.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: For example, Apple Remote Desktop (ARD) on macOS is native software used for remote management.

Tactics: TA0008
Techniques: T1021
Input: Remote access tools with built-in features may interact directly with the Windows API to perform these functions outside of typical system utilities.

Tactics: TA0040
Techniques: T1489
Input: The shellcode decodes and decompresses another DLL, which is an updated variant of UPPERCUT

Tactics: TA0005
Techniques: T1140
Input: njRAT enumerates the current user during the initial infection.

Tactics: TA0007
Techniques: T1033
Input: Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as:

Tactics: TA0009
Techniques: T1213, T1213.001
Input: MMC can also be used to open Microsoft created .msc files to manage system configuration.

Tactics: TA0005
Techniques: T1218, T1218.014
Input: Deploying a multi-layered approach including access policies, anti-virus, network monitoring and whitelisting can help ensure customers are protected against threats such as this.  Users of Kaspersky products are protected as well against this threat by one of the following detections:  PDM:Exploit.Win32.Generic HEUR:Exploit.SWF.Generic HEUR:Exploit.MSOffice.Generic  More information about BlackOasis APT is available to customers of Kaspersky Intelligence Reporting Service

Tactics: TA0004
Techniques: T1068
Input: PoshC2 can use Invoke-RunAs to make tokens.

Tactics: TA0004, TA0005
Techniques: T1134.002, T1134
Input: This decrypted data is written to the following location:  %TEMP%\WUpdate.~tmp  This ‘WUpdate.~tmp’ file is then copied to a filename of ‘Applet.cpl’, which is placed in the previously identified file path

Tactics: TA0005, TA0009
Techniques: T1140, T1074
Input: Consider disabling DCOM through Dcomcnfg.exe.

Tactics: TA0008
Techniques: T1021.003, T1021
Input: Adversaries who have the password hash of a target service account ( SharePoint, MSSQL) may forge Kerberos ticket granting service (TGS) tickets, also known as silver tickets.

Tactics: TA0006
Techniques: T1558.002, T1558
Input: Example profile locations include:* $PsHome\Profile.ps1* $PsHome\Microsoft.

Tactics: TA0003, TA0004
Techniques: T1546.013, T1546
Input: Monitor systems for abnormal Python usage and python.exe behavior, which could be an indicator of malicious activity.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Monitor processes for unexpected termination related to security tools/services.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Password policies can be set and discovered on Windows, Linux, and macOS systems via various command shell utilities such as net accounts (/domain), Get-ADDefaultDomainPasswordPolicy, chage -l , cat /etc/pam.d/common-password, and pwpolicy getaccountpolicies  .

Tactics: TA0007
Techniques: T1201
Input: The payload uses WMI queries and checks running processes for evidence that the script may be executing within an analysis environment

Tactics: TA0002
Techniques: T1047
Input: Stuxnet reduces the integrity level of objects to allow write actions.

Tactics: TA0005
Techniques: T1562
Input: Bandook has a command built in to use a raw TCP socket.

Tactics: TA0011
Techniques: T1095
Input: Adversaries may opt to wipe arbitrary portions of disk data and/or wipe disk structures like the master boot record (MBR).

Tactics: TA0040
Techniques: T1561
Input: A Golden Ticket can be obtained for the domain using the Key Distribution Service account KRBTGT account NTLM hash, which enables generation of TGTs for any account in Active Directory.

Tactics: TA0005, TA0008
Techniques: T1550.003, T1550
Input: Dark Caracal makes their malware look like Flash Player, Office, or PDF documents in order to entice a user to click on it.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: On embedded devices, downgrading the version typically only requires replacing the operating system file in storage.

Tactics: TA0005
Techniques: T1601, T1601.002
Input: Hi-Zor creates a Registry Run key to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Unknown Logger is capable of spreading to USB devices.

Tactics: TA0001, TA0008
Techniques: T1091
Input: Valak has the ability to base64 encode and XOR encrypt strings.

Tactics: TA0005
Techniques: T1027
Input: Matryoshka is capable of performing screen captures.

Tactics: TA0009
Techniques: T1113
Input: Whitefly has named the malicious DLL the same name as DLLs belonging to legitimate software from various security vendors.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Information about users could also be enumerated via other active means ( Active Scanning) such as probing and analyzing responses from authentication services that may reveal valid usernames in a system.

Tactics: TA0043
Techniques: T1589
Input: This is very similar to Thread Local Storage but creates a new process rather than targeting an existing process.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: SpeakUp downloads and executes additional files from a remote server.

Tactics: TA0011
Techniques: T1105
Input: Shared file list login items can be set using scripting languages such as AppleScript, whereas the Service Management Framework uses the API call SMLoginItemSetEnabled.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.015
Input: Limit permissions for who can create symbolic links in Windows to appropriate groups such as Administrators and necessary groups for virtualization.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: BackConfig can leverage API functions such as ShellExecuteA and HttpOpenRequestA in the process of downloading and executing files.

Tactics: TA0002
Techniques: T1106
Input: APT29 added Registry Run keys to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Based on dynamic and static analysis of the malware sample associated with the supservermgr[.]com domain however, we were able to determine several unique artifacts which allowed us to expand our dataset and discover additional findings

Tactics: TA0007
Techniques: T1016
Input: RegDuke can hide data in images, including use of the Least Significant Bit (LSB).

Tactics: TA0005
Techniques: T1027.003, T1027
Input: Some resources in Prikormka are encrypted with a simple XOR operation or encoded with Base64.

Tactics: TA0005
Techniques: T1027
Input: Hikit has been spread through spear phishing.

Tactics: TA0001
Techniques: T1566
Input: Takes screenshots when recording VoiceIP app audio

Tactics: TA0009
Techniques: T1113, T1123
Input: Script blocking extensions can help prevent the execution of JavaScript and HTA files that may commonly be used during the exploitation process.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Raindrop decrypted its Cobalt Strike payload using an AES-256 encryption algorithm in CBC mode with a unique key per sample.

Tactics: TA0005
Techniques: T1140
Input: In containerized environments, this may also be done by creating a resource in a namespace that matches the naming convention of a container pod or cluster.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Many methods have been discovered to bypass UAC.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: This shortcut file points to the path of the previously written ‘winhelp.cpl’ file

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: During execution, Threat Group-3390 malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.

Tactics: TA0005
Techniques: T1140
Input: Microsoft has released a PowerShell script to safely gather mail forwarding rules and custom forms in your mail environment as well as steps to interpret the output.

Tactics: TA0003
Techniques: T1137, T1137.004, T1137.003, T1137.005
Input: BADCALL encrypts C2 traffic using an XOR/ADD cipher.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Monitor for API calls that may attempt to gather information about attached peripheral devices and components connected to a computer system.

Tactics: TA0007
Techniques: T1120
Input: TA505 has used .iso files to deploy malicious .lnk files.

Tactics: TA0005
Techniques: T1553, T1553.005
Input: APT29 drops a Windows shortcut file for execution.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: All strings used by the Trojan are encrypted with the XOR algorithm

Tactics: TA0005
Techniques: T1027
Input: UAC bypass via DLL hijacking requires:  A Windows executable with the auto-elevate property in its manifest A Windows executable in a secure directory (%systemroot%\system32)  The malicious NTWDBLIB DLL performs the simple task of setting up the malicious ipnet.dll as a service by running one of the two batch files contained in the CAB file (which is also dropped to %systemroot%\system32):  NTWDBLIB executing the installer batch files under the context of cliconfg.exe.  The batch files involved in the attack modify the system service COMSysApp to load the malicious ipnet.dll

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548, T1055
Input: Bazar can attempt to overload sandbox analysis by sending 1550 calls to printf.

Tactics: TA0005, TA0007
Techniques: T1497
Input: RedLeaves can enumerate drives and Remote Desktop sessions.

Tactics: TA0007
Techniques: T1049
Input: Ursnif has gathered information about running processes.

Tactics: TA0007
Techniques: T1057
Input: APT32 has used malicious links to direct users to web pages designed to harvest credentials.

Tactics: TA0043
Techniques: T1598, T1598.003
Input: Cardinal RAT can communicate over multiple C2 host and port combinations.

Tactics: TA0011
Techniques: T1008
Input: BitPaymer can set values in the Registry to help in execution.

Tactics: TA0005
Techniques: T1112
Input: Enforce role-based access control to limit accounts to the least privileges they require.

Tactics: TA0006
Techniques: T1528
Input: KGH_SPY can collect information on installed applications.

Tactics: TA0007
Techniques: T1518
Input: Gamaredon Group has inserted malicious macros into existing documents, providing persistence when they are reopened.

Tactics: TA0003
Techniques: T1137
Input: Adversaries may abuse AppleScript for execution.

Tactics: TA0002
Techniques: T1059.002, T1059
Input: Astaroth can launch itself via DLL Search Order Hijacking.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Excel does not have a template file created by default, but one can be added that will automatically be loaded.

Tactics: TA0003
Techniques: T1137, T1137.001
Input: Information reported by vendors may also reveal opportunities other forms of reconnaissance (ex: Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Exploit Public-Facing Application or External Remote Services).

Tactics: TA0043
Techniques: T1597, T1597.001
Input: Adversaries can use resource forks to hide malicious data that may otherwise be stored directly in files.

Tactics: TA0005
Techniques: T1564, T1564.009
Input: Dragonfly has placed trojanized installers for control system software on legitimate vendor app stores.

Tactics: TA0001
Techniques: T1195, T1195.002
Input: Dragonfly used the command query user on victim hosts.

Tactics: TA0007
Techniques: T1033
Input: Confucius has used mshta.exe to execute malicious VBScript.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: Appendix Malware Family Descriptions    Malware Family  Description  Availability    DROPSHOT  Dropper that has been observed dropping and launching the TURNEDUP backdoor, as well as the SHAPESHIFT wiper malware  Non-Public    NANOCORE  Publicly available remote access Trojan (RAT) available for purchase

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Remsec can obtain a list of users.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: jRAT can list security software, such as by using WMIC to identify anti-virus products installed on the victim’s machine and to obtain firewall details.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Filename  vsrss.exe    File Size  446976 bytes    MD5  5c3456d5932544b779fe814133344fdb    SHA1  7ab750afb25457a81c27a98dc6dfd51c27e61b0e    Notes Delphi RAT file that beacons to ebeijingcn.live

Tactics: TA0005
Techniques: T1036
Input: When automated exfiltration is used, other exfiltration techniques likely apply as well to transfer the information out of the network, such as Exfiltration Over C2 Channel and Exfiltration Over Alternative Protocol.

Tactics: TA0010
Techniques: T1020
Input: Avenger has the ability to download files from C2 to a compromised host.

Tactics: TA0011
Techniques: T1105
Input: Configuration Config.ini is the file where the malware stores its encrypted configuration data

Tactics: TA0005
Techniques: T1027
Input: Inspecting the class C network for 185.162.235.0/24 shows us that another IP on the same network resolves to an OilRig domain, msoffice-cdn[.]com which we identified in August 2017

Tactics: TA0007
Techniques: T1016
Input: TA505 has used msiexec to download and execute malicious Windows Installer files.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: Monitor for execution of commands and arguments associated with enumeration or information gathering of email addresses and accounts such as Get-AddressList, Get-GlobalAddressList, and Get-OfflineAddressBook.

Tactics: TA0007
Techniques: T1087.003, T1087
Input: Monitor for unusual kernel driver installation activity that may configure system settings to automatically execute a program during system boot or logon to maintain persistence or gain higher-level privileges on compromised systems.

Tactics: TA0003, TA0004
Techniques: T1547
Input: Adversaries may install a Launch Daemon configured to execute at startup by using the RunAtLoad parameter set to true and the Program parameter set to the malicious executable path.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: ETW interruption can be achieved multiple ways, however most directly by defining conditions using the PowerShell Set-EtwTraceProvider cmdlet or by interfacing directly with the Registry to make alterations.

Tactics: TA0005
Techniques: T1562.006, T1562
Input: SoreFang has the ability to encode and RC6 encrypt data sent to C2.

Tactics: TA0005
Techniques: T1027
Input: BUBBLEWRAP collects system information, including the operating system version and hostname.

Tactics: TA0007
Techniques: T1082
Input: Properly configure firewalls and proxies to limit outgoing traffic to only necessary ports and through proper network gateway systems.

Tactics: TA0011
Techniques: T1095
Input: Sykipot may use ipconfig /all to gather system network configuration details.

Tactics: TA0007
Techniques: T1016
Input: When it is executed, it creates two files: an LNK file that points to %system32%\rundll32.exe, and the FELIXROOT loader component

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: nbtstat can be used to discover local NetBIOS domain names.

Tactics: TA0007
Techniques: T1016
Input: Adversaries may also take steps to cultivate a persona around the email account, such as through use of Social Media Accounts, to increase the chance of success of follow-on behaviors.

Tactics: TA0042
Techniques: T1585, T1585.002
Input: For example, on the target host use procdump:

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Kinsing has attempted to brute force hosts over SSH.

Tactics: TA0006
Techniques: T1110
Input: Adversaries may store malicious data or binaries in file attribute metadata instead of directly in files.

Tactics: TA0005
Techniques: T1564, T1564.004
Input: Green Lambert can create a Launch Agent with the RunAtLoad key-value pair set to true, ensuring the com.apple.GrowlHelper.plist file runs every time a user logs in.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: Hikit has the ability to create a remote shell and run given commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Monitor for the execution of commands that could modify the code signing policy of a system, such as bcdedit.exe -set TESTSIGNING ON.

Tactics: TA0005
Techniques: T1553, T1553.006
Input: BLUELIGHT can download additional files onto the host.

Tactics: TA0011
Techniques: T1105
Input: Leviathan has received C2 instructions from user profiles created on legitimate websites such as Github and TechNet.

Tactics: TA0011
Techniques: T1102.003, T1102
Input: For example, the command security dump-keychain –d will dump all Login Keychain credentials from ~/Library/Keychains/login.keychain-db.

Tactics: TA0006
Techniques: T1555.001, T1555
Input: Chimera has used Windows admin shares to move laterally.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Data from configuration repositories may be exposed by various protocols and software and can store a wide variety of data, much of which may align with adversary Discovery objectives.

Tactics: TA0009
Techniques: T1602
Input: Invoke-Obfuscation calls the string obfuscation used by the actors to further obfuscate this script Reorder, which uses the string formatting functionality within PowerShell to reconstruct strings from out of order substrings (ex

Tactics: TA0005
Techniques: T1027
Input: Azorult can download and execute additional files.

Tactics: TA0011
Techniques: T1105
Input: Monitor executed commands and arguments that may search for SYSVOL data and/or GPP XML files, especially on compromised domain controllers.

Tactics: TA0006
Techniques: T1552, T1552.006
Input: Wizard Spider has modified the Registry key HKLM\System\CurrentControlSet\Control\SecurityProviders\WDigest by setting the UseLogonCredential registry value to 1 in order to force credentials to be stored in clear text in memory.

Tactics: TA0005
Techniques: T1112
Input: Tropic Trooper has executed commands through Microsoft security vulnerabilities, including CVE-2017-11882, CVE-2018-0802, and CVE-2012-0158.

Tactics: TA0002
Techniques: T1203
Input: Discovery techniques normally occur throughout an operation as an adversary learns the environment.

Tactics: TA0007
Techniques: T1580
Input: HyperStack can use default credentials to connect to IPC$ shares on remote machines.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.001
Input: Ramsay has been distributed through spearphishing emails with malicious attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Adversaries may use MMC commands to perform malicious tasks.

Tactics: TA0005
Techniques: T1218, T1218.014
Input: Agent.btz drops itself onto removable media devices and creates an autorun.inf file with an instruction to run that file.

Tactics: TA0001, TA0008
Techniques: T1091
Input: PowerSploit's Find-AVSignature AntivirusBypass module can be used to locate single byte anti-virus signatures.

Tactics: TA0005
Techniques: T1027, T1027.005
Input: When Windows boots up, it starts programs or applications called services that perform background system functions.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Adversaries may attempt to access credentials and other sensitive information by abusing a Windows Domain Controller's application programming interface (API)    to simulate the replication process from a remote domain controller using a technique called DCSync.

Tactics: TA0006
Techniques: T1003.006, T1003
Input: Large botnets can generate a significant amount of traffic from systems spread across the global Internet.

Tactics: TA0040
Techniques: T1498, T1498.001
Input: Adversaries may maliciously modify a part of this process to either reveal credentials or bypass authentication mechanisms.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556
Input: Adversaries may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel.

Tactics: TA0010
Techniques: T1567
Input: Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain.

Tactics: TA0007
Techniques: T1482
Input: Trojan.Karagany has used plugins with a self-delete capability.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level.

Tactics: TA0011, TA0010
Techniques: T1041, T1572, T1132.001, T1568, T1132, T1102.001, T1102.002, T1104, T1071.002, T1573, T1071.004, T1071, T1090.001, T1071.003, T1102.003, T1571, T1008, T1090, T1090.002, T1095, T1568.002, T1071.001, T1132.002, T1102, T1573.001, T1573.002
Input: APT41 used legitimate executables to perform DLL side-loading of their malware.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: Code is included to copy the clipboard, delete files, compress files, clear event logs, shut down the machine, and much more

Tactics: TA0005, TA0009, TA0011
Techniques: T1115, T1070, T1090.003, T1090, T1070.004
Input: Apps and files loaded onto the system from a USB flash drive, optical disk, external hard drive, from a drive shared over the local network, or using the curl command do not set this flag.

Tactics: TA0005
Techniques: T1553.001, T1553
Input: Fox Kitten has installed web shells on compromised hosts to maintain access.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Sandworm Team has exfiltrated internal documents, files, and other data from compromised hosts.

Tactics: TA0009
Techniques: T1005
Input: ROKRAT can access the HKLM\System\CurrentControlSet\Services\mssmbios\Data\SMBiosData Registry key to obtain the System manufacturer value to identify the machine type.

Tactics: TA0007
Techniques: T1012