madox81/Adema_ATTACK_DS huggingface dataset:
Input: OopsIE stages the output from command execution and collected files in specific folders before exfiltration.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Crutch has used a hardcoded GitHub repository as a fallback channel.

Tactics: TA0011
Techniques: T1008
Input: Leviathan has established domains that impersonate legitimate entities to use for targeting efforts.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: Threat Group-3390 actors installed a credential logger on Microsoft Exchange servers.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: APT33 has used valid accounts for initial access and privilege escalation.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: Valak can use wmic process call create in a scheduled task to launch plugins and for execution.

Tactics: TA0002
Techniques: T1047
Input: MegaCortex has used code signing certificates issued to fake companies to bypass security controls.

Tactics: TA0042
Techniques: T1588, T1588.003
Input: Egregor has used BITSadmin to download and execute malicious DLLs.

Tactics: TA0003, TA0005
Techniques: T1197
Input: Sandworm Team has crafted phishing emails containing malicious hyperlinks.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: ComRAT has used PowerShell to load itself every time a user logs in to the system.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: NETEAGLE is capable of reading files over the C2 channel.

Tactics: TA0010
Techniques: T1041
Input: Monitor executed commands and arguments that may attempt to gather information about the system language of a victim in order to infer the geographical location of that host.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: CORESHELL downloads another dropper from its C2 server.

Tactics: TA0011
Techniques: T1105
Input: Ramsay can use netstat to enumerate network connections.

Tactics: TA0007
Techniques: T1049
Input: SharpStage has decompressed data received from the C2 server.

Tactics: TA0005
Techniques: T1140
Input: Carbon enumerates values in the Registry.

Tactics: TA0007
Techniques: T1012
Input: Ursnif droppers have used COM properties to execute malware in hidden windows.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: GuLoader can use HTTP to retrieve additional binaries.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Monitor executed commands and arguments for actions that could be taken to gather common compilers, such as csc.exe and GCC/MinGW, and correlate with other suspicious behavior to reduce false positives from normal user and administrator behavior.

Tactics: TA0005
Techniques: T1027.004, T1027
Input: BootComplete starts the AutoStartup service and the AutoStartup service makes sure that MainActivity is always running

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: In Linux, the passwd utility may be used to change passwords.

Tactics: TA0040
Techniques: T1531
Input: Attor has manipulated the time of last access to files and registry keys after they have been created or modified.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: APT28 has cleared event logs, including by using the commands wevtutil cl System and wevtutil cl Security.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: Within Linux and MacOS systems, sudo (sometimes referred to as "superuser do") allows users to perform commands from terminals with elevated privileges and to control who can perform these commands on the system.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: FLASHFLOOD achieves persistence by making an entry in the Registry's Run key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Metamorfo has used YouTube to store and hide C&C server domains.

Tactics: TA0011
Techniques: T1102.001, T1102
Input: Trojan.Karagany can enumerate files and directories on a compromised host.

Tactics: TA0007
Techniques: T1083
Input: Adversaries may abuse Python commands and scripts for execution.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: APT29 has used WinRM via PowerShell to execute command and payloads on remote hosts.

Tactics: TA0008
Techniques: T1021, T1021.006
Input: Epic uses the rem reg query command to obtain values from Registry keys.

Tactics: TA0007
Techniques: T1012
Input: The bootkit shares code with some variants of BlackEnergy.

Tactics: TA0003, TA0005
Techniques: T1542.003, T1542
Input: To gain access to kernel memory to modify variables related to signature checks, such as modifying g_CiOptions to disable Driver Signature Enforcement, adversaries may conduct Exploitation for Privilege Escalation using a signed, but vulnerable driver.

Tactics: TA0005
Techniques: T1553, T1553.006
Input: OnionDuke uses Twitter as a backup C2.

Tactics: TA0011
Techniques: T1102.003, T1102
Input: Adversaries may use an existing, legitimate external Web service as a means for sending commands to a compromised system without receiving return output over the Web service channel.

Tactics: TA0011
Techniques: T1102.003, T1102
Input: Thrip has obtained and used tools such as Mimikatz and PsExec.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Information about hosts may include a variety of details, including administrative data (ex: name, assigned IP, functionality, ) as well as specifics regarding its configuration (ex: operating system, language, ).

Tactics: TA0043
Techniques: T1592
Input: Bazar can use various APIs to allocate memory and facilitate code execution/injection.

Tactics: TA0002
Techniques: T1106
Input: As immediate response may require rapid engagement of 3rd parties, analyze the risk associated to critical resources being affected by Network DoS attacks and create a disaster recovery plan/business continuity plan to respond to incidents.

Tactics: TA0040
Techniques: T1498
Input: Adversaries may develop capabilities to support their operations throughout numerous phases of the adversary lifecycle.

Tactics: TA0042
Techniques: T1587
Input: After this file is copied, the original ‘Update.~tmp’ file is deleted

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Attackers using Comnie are leveraging malicious macros that initially hide decoy documents and shows them when the victim enables macros

Tactics: TA0002
Techniques: T1059
Input: RTM has named the scheduled task it creates "Windows Update".

Tactics: TA0005
Techniques: T1036.004, T1036
Input: RegDuke can download files from C2.

Tactics: TA0011
Techniques: T1105
Input: Silent Librarian has obtained free and publicly available tools including SingleFile and HTTrack to copy login pages of targeted organizations.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Carbon can use Pastebin to receive C2 commands.

Tactics: TA0011
Techniques: T1102
Input: Figure 3: no detections for SpeakUp in Virus Total In an attempt to endure the investigation process by security researchers, the second stage payload was encoded with salted base64

Tactics: TA0005
Techniques: T1027
Input: Rather than developing their own capabilities in-house, adversaries may purchase, freely download, or steal them.

Tactics: TA0042
Techniques: T1588
Input: A botnet is a network of compromised systems that can be instructed to perform coordinated tasks.

Tactics: TA0042
Techniques: T1584, T1583.005, T1583, T1584.005
Input: Kobalos decrypts strings right after the initial communication, but before the authentication process.

Tactics: TA0005
Techniques: T1140
Input: Target-specific values can be derived from specific network shares, physical devices, software/software versions, files, joined AD domains, system time, and local/external IP addresses.

Tactics: TA0005
Techniques: T1480, T1480.001
Input: The dropped files are either in the root of the “ProgramData” folder or in a subdirectory

Tactics: TA0007
Techniques: T1083
Input: APT3 has a tool that can enumerate the permissions associated with Windows groups.

Tactics: TA0007
Techniques: T1069
Input: NanoCore can modify the victim's firewall.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: Contextual data about a group which describes group and activity around it that may attempt to find cloud groups and permission settings.

Tactics: TA0007
Techniques: T1069, T1069.003
Input: vaultcmd.exe is a native Windows executable that can be used to enumerate credentials stored in the Credential Locker through a command-line interface.

Tactics: TA0006
Techniques: T1555, T1555.004
Input: Here is the code:The goal of this code is to get information from the properties of the document ("Subject", "Company", "Category", "Hyperlink base" and finally "Comments")

Tactics: TA0005
Techniques: T1140
Input: Sibot has obfuscated scripts used in execution.

Tactics: TA0005
Techniques: T1027
Input: ShimRat has registered two registry keys for shim databases.

Tactics: TA0005
Techniques: T1112
Input: Bazar can collect the IP address and NetBIOS name of an infected machine.

Tactics: TA0007
Techniques: T1016
Input: It appears to us that one organization had its entire Active Directory dumped out, making up most of the credentials we found in the data dump

Tactics: TA0006
Techniques: T1003
Input: Dragonfly has attempted to brute force credentials to gain access.

Tactics: TA0006
Techniques: T1110
Input: ROADTools automatically gathers data from Azure AD environments using the Azure Graph API.

Tactics: TA0009
Techniques: T1119
Input: Another variant is encoded with XOR.

Tactics: TA0005
Techniques: T1027
Input: TinyTurla has been deployed as w64time.dll to appear legitimate.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: As we can see, the following information is present within this configuration:  Remote Command and Control (C2) server Remote port Sleep timer  Reaver continues to collect various information from the victim machine, including the following:  CPU speed Computer name Username IP Address Microsoft Windows version Physical and virtual memory information  The malware proceeds to communicate with the remote server via HTTP GET and POST requests

Tactics: TA0007
Techniques: T1082
Input: In Azure, monitor for az monitor diagnostic-settings delete.

Tactics: TA0005
Techniques: T1562.008, T1562
Input: KONNI has modified registry keys of ComSysApp, Svchost, and xmlProv on the machine to gain persistence.

Tactics: TA0005
Techniques: T1112
Input: Mustang Panda has used servers under their control to validate tracking pixels sent to phishing victims.

Tactics: TA0042
Techniques: T1608
Input: Spearphishing may also involve social engineering techniques, such as posing as a trusted source.

Tactics: TA0001
Techniques: T1566, T1566.002, T1566.001
Input: Egregor can conduct Active Directory reconnaissance using tools such as Sharphound or AdFind.

Tactics: TA0007
Techniques: T1069.002, T1069
Input: Magic Hound has used open-source JNDI exploit kits to leverage the Log4j (CVE-2021-44228) vulnerability.

Tactics: TA0001
Techniques: T1190
Input: MacOS system logs may also indicate when AuthorizationExecuteWithPrivileges is being called.

Tactics: TA0004, TA0005
Techniques: T1548.004, T1548
Input: Penquin has mimicked the Cron binary to hide itself on compromised systems.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Kimsuky has signed files with the name EGIS CO., Ltd.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Crutch has conducted C2 communications with a Dropbox account using the HTTP API.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Silence has used VBS scripts.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Adversaries can use netsh.exe helper DLLs to trigger execution of arbitrary code in a persistent manner.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.007
Input: Following data collection, FIN6 has compressed log files into a ZIP archive prior to staging and exfiltration.

Tactics: TA0009
Techniques: T1560
Input: An APT28 backdoor may collect the entire contents of an inserted USB device.

Tactics: TA0009
Techniques: T1025
Input: Adversaries frequently manipulate file extensions and icons in order to make attached executables appear to be document files, or files exploiting one application appear to be a file for a different one.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Adversaries may use scripting to automate these checks  into one script and then have the program exit if it determines the system to be a virtual environment.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Where possible, also enable multi-factor authentication on externally facing services.

Tactics: TA0006
Techniques: T1110.004, T1110, T1110.002, T1110.001, T1110.003
Input: Micropsia can download and execute an executable from the C2 server.

Tactics: TA0011
Techniques: T1105
Input: Scripts can be executed via the command line utility osascript, they can be compiled into applications or script files via osacompile, and they can be compiled and executed in memory of other programs by leveraging the OSAKit Framework.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Monitor for anomalous authentication activity, such as logons or other user session activity associated with unknown accounts and/or using SAML tokens which do not have corresponding 4769 and 1200 events in the domain.. Monitor for unexpected and abnormal access to resources, including access of websites and cloud-based applications by the same user in different locations or by different systems that do not match expected configurations.

Tactics: TA0006
Techniques: T1606
Input: Wizard Spider has used spearphishing attachments to deliver Microsoft documents containing macros or PDFs containing malicious links to download either Emotet, Bokbot, TrickBot, or Bazar.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Chimera has utilized various scans and queries to find domain controllers and remote services in the target environment.

Tactics: TA0007
Techniques: T1018
Input: likely in an attempt to masquerade as a red-teaming tool rather than an advanced actor

Tactics: TA0005
Techniques: T1036
Input: Lazarus Group has used social media platforms, including LinkedIn and Twitter, to send spearphishing messages.

Tactics: TA0001
Techniques: T1566.003, T1566
Input: GoldMax can download and execute additional files.

Tactics: TA0011
Techniques: T1105
Input: Dragonfly has compressed data into .zip files prior to exfiltration.

Tactics: TA0009
Techniques: T1560
Input: If the C2 server provides the appropriate echoed data in the response, the Trojan attempts to determine what  commands the C2 wishes to run by issuing a request to the following URL:http://<c2 domain>/what?<hex(Environment.UserName/Environment.MachineName)> After issuing the what command, the Trojan will parse the C2’s response for the string Oops, which the Trojan will treat as the C2 making a mistake and will exit

Tactics: TA0011, TA0010
Techniques: T1041, T1132, T1573, T1071, T1571, T1008
Input: Adversaries may delete or remove built-in operating system data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

Tactics: TA0040
Techniques: T1490
Input: Clop can kill several processes and services related to backups and security solutions.

Tactics: TA0040
Techniques: T1489
Input: Cadelspy has the ability to steal data from the clipboard.

Tactics: TA0009
Techniques: T1115
Input: NotPetya encrypts user files and disk structures like the MBR with 2048-bit RSA.

Tactics: TA0040
Techniques: T1486
Input: Dragonfly has deleted many of its files used during operations as part of cleanup, including removing applications and deleting screenshots.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Kimsuky has sent internal spearphishing emails for lateral movement after stealing victim information.

Tactics: TA0008
Techniques: T1534
Input: Azure CLI (AZ CLI) and the Google Cloud Identity Provider API also provide interfaces to obtain permissions groups.

Tactics: TA0007
Techniques: T1069, T1069.003
Input: Night Dragon has obtained and used tools such as gsecdump.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: WhisperGate can Base64 encode strings, store downloaded files in reverse byte order,  and use the Eazfuscator tool to obfuscate its third stage.

Tactics: TA0005
Techniques: T1027
Input: CORESHELL is installed via execution of rundll32 with an export named "init" or "InitW."

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Cobalt Group has used public sites such as github.com and sendspace.com to upload files and then download them to victim computers.

Tactics: TA0011
Techniques: T1105
Input: Smoke Loader deobfuscates its code.

Tactics: TA0005
Techniques: T1140
Input: Adversaries may gather information about the victim's client configurations that can be used during targeting.

Tactics: TA0043
Techniques: T1592, T1592.004
Input: HyperBro has the ability to start and stop a specified service.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: This shortcut file points to the path of the previously written ‘Applet.cpl’ file

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Remcos can launch a remote command line to execute commands on the victim’s machine.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Packing an executable changes the file signature in an attempt to avoid signature-based detection.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Carbon has a command to inject code into a process.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Machete has embedded malicious macros within spearphishing attachments to download additional files.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: PoetRAT has used a Python tool named klog.exe for keylogging.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Monitor 2FA/MFA application logs for suspicious events such as unusual login attempt source location, mismatch in location of login attempt and smart device approving 2FA/MFA request prompts.

Tactics: TA0006
Techniques: T1621
Input: InvisiMole can inject itself into another process to avoid detection including use of a technique called ListPlanting that customizes the sorting algorithm in a ListView structure.

Tactics: TA0004, TA0005
Techniques: T1055
Input: SUNBURST collected the username from a compromised host.

Tactics: TA0007
Techniques: T1033
Input: APT37 has used Windows DDE for execution of commands and a malicious VBS.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: ComRAT has used a scheduled task to launch its PowerShell loader.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Consider disabling Microsoft Office macros/active content to prevent the execution of malicious payloads in documents , though this setting may not mitigate the Forced Authentication use for this technique.

Tactics: TA0005
Techniques: T1221
Input: Flame can use MS10-061 to exploit a print spooler vulnerability in a remote system with a shared printer in order to move laterally.

Tactics: TA0008
Techniques: T1210
Input: Adversaries may buy and/or steal capabilities that can be used during targeting.

Tactics: TA0042
Techniques: T1588
Input: An adversary may introduce new firewall rules or policies to allow access into a victim cloud environment.

Tactics: TA0005
Techniques: T1562.007, T1562
Input: Monitor user account logs for suspicious events: unusual login attempt source location, mismatch in location of login attempt and smart device receiving 2FA/MFA request prompts, and high volume of repeated login attempts, all of which may indicate user's primary credentials have been compromised minus 2FA/MFA mechanism.

Tactics: TA0006
Techniques: T1621
Input: Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data.

Tactics: TA0040
Techniques: T1565.001, T1491.001, T1491.002, T1565, T1561.001, T1491, T1485, T1561, T1490, T1561.002
Input: Magic Hound has registered fraudulent domains such as "mail-newyorker.com" and "news12.com.recover-session-service.site" to target specific victims with phishing attacks.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: The authentication process is handled by mechanisms, such as the Local Security Authentication Server (LSASS) process and the Security Accounts Manager (SAM) on Windows, pluggable authentication modules (PAM) on Unix-based systems, and authorization plugins on MacOS systems, responsible for gathering, storing, and validating credentials.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556
Input: It mimics the icon Finder usually applies to JPEG or text files to increase the likelihood the recipient will double-click the file

Tactics: TA0007
Techniques: T1083
Input: By default, the property should be set to Disabled.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.005
Input: It continues parsing protocol layers including SCTP, SCCP, and TCAP and finally extracts SMS message data and routing metadata.

Tactics: TA0006, TA0007
Techniques: T1040
Input: Kimsuky has executed Windows commands by using cmd and running batch scripts.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: An APT19 HTTP malware variant used Base64 to encode communications to the C2 server.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Adversaries may search victim-owned websites to gather actionable information.

Tactics: TA0043
Techniques: T1594
Input: CharmPower can enumerate drives and list the contents of the C: drive on a victim's computer.

Tactics: TA0007
Techniques: T1083
Input: P8RAT can download additional payloads to a target system.

Tactics: TA0011
Techniques: T1105
Input: The visited website may compromise the web browser using an exploit, or the user will be prompted to download applications, documents, zip files, or even executables depending on the pretext for the email in the first place.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: APT41 used cmd.exe /c to execute commands on remote machines.APT41 used a batch file to install persistence for the Cobalt Strike BEACON loader.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: The results of the decoded data may be seen below:    Figure 13 Decrypted information The decrypted data contains URLs for various online services that will be used by the attacker for downloading data that will contain the command and control (C2) server(s) and port(s) to be used by Comnie

Tactics: TA0005, TA0010
Techniques: T1140, T1041, T1048
Input: Adversaries may search private data from threat intelligence vendors for information that can be used during targeting.

Tactics: TA0043
Techniques: T1597, T1597.001
Input: The Performance key contains the name of a driver service's performance DLL and the names of several exported functions in the DLL.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.011, T1574
Input: Web Distributed Authoring and Versioning (WebDAV) is also typically used by Windows systems as a backup protocol when SMB is blocked or fails.

Tactics: TA0006
Techniques: T1187
Input: Kasidet has the ability to identify any anti-virus installed on the infected system.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Office add-ins can be used to add functionality to Office programs.

Tactics: TA0003
Techniques: T1137, T1137.006
Input: Adversaries may send spearphishing emails with a malicious attachment in an attempt to gain access to victim systems.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: This can result in significantly furthering an adversary's objective in cases where credentials gained from web browsers overlap with privileged accounts ( domain administrator).

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Leveraging Existing Windows Services to Deliver Malware Windows Management Instrumentation Console (WMIC) provides a command line interface to WMI

Tactics: TA0002
Techniques: T1047
Input: Bundlore has disguised a malicious .app file as a Flash Player update.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Monitor for changes made to processes that may inject dynamic-link libraries (DLLs) into processes in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001