madox81/Adema_ATTACK_DS huggingface dataset:
Input: Lucifer can collect the IP address of a compromised host.

Tactics: TA0007
Techniques: T1016
Input: FIN8 has distributed targeted emails containing links to malicious documents with embedded macros.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: OilRig has used HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: IIS provides several mechanisms to extend the functionality of the web servers.

Tactics: TA0003
Techniques: T1505.004, T1505
Input: ObliqueRAT has gained execution on targeted systems through luring users to click on links to malicious URLs.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Chaes has exfiltrated its collected data from the infected machine to the C2, sometimes using the MIME protocol.

Tactics: TA0010
Techniques: T1048
Input: GALLIUM used Web shells to persist in victim environments and assist in execution and exfiltration.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: RTM has attempted to lure victims into opening e-mail attachments to execute malicious code.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: We are not sure if this works, but the command name would suggest it is meant to take a screenshot   $command Runs a PowerShell command and sends the output to the C2   slp:\d+ Sets the sleep interval between C2 beacons   $testmode Issues DNS queries of A, AAAA, AC, CNAME, MX, TXT, SRV and SOA types to the C2 servers attempting to determine which DNS query types were successful

Tactics: TA0011
Techniques: T1071, T1571, T1008
Input: GALLIUM used DLL side-loading to covertly load PoisonIvy into memory on the victim machine.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: On Windows, users can mark specific files as hidden by using the attrib.exe binary.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: A user visits a website that is used to host the adversary controlled content.

Tactics: TA0001
Techniques: T1189
Input: Destructive dstr command in BE2 config file Also, on some machines, documents were encrypted, but no related plugin could be found

Tactics: TA0005
Techniques: T1027
Input: Reading raw keystroke data from the hardware buffer.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Bazar can delete its loader using a batch file in the Windows temporary folder.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: QakBot can inject itself into processes including explore.exe, Iexplore.exe, and Mobsync.exe.

Tactics: TA0004, TA0005
Techniques: T1055
Input: POWERTON has used AES for encrypting C2 traffic.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: The Windows command shell (cmd) is the primary command prompt on Windows systems.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: This round of FIN7 phishing lures implements hidden shortcut files (LNK files) to initiate the infection and VBScript functionality launched by mshta.exe to infect the victim

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: BBSRAT can delete files and directories.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: APT29 has used multiple software exploits for common client software, like Microsoft Word, Exchange, and Adobe Reader, to gain code execution.

Tactics: TA0002
Techniques: T1203
Input: Poseidon Group obtains and saves information about victim network interfaces and addresses.

Tactics: TA0007
Techniques: T1049
Input: PowerStallion uses a XOR cipher to encrypt command output written to its OneDrive C2 server.

Tactics: TA0005
Techniques: T1027
Input: Gelsemium can use junk code to generate random activity to obscure malware behavior.

Tactics: TA0005, TA0007
Techniques: T1497
Input: Compare recent invocations of signed binaries that may be used to proxy execution with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity.

Tactics: TA0005
Techniques: T1218
Input: IndigoZebra sent spearphishing emails containing malicious attachments that urged recipients to review modifications in the file which would trigger the attack.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Cobalt Strike can use net localgroup to list local groups on a system.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: Enable Safe DLL Search Mode to force search for system DLLs in directories with greater restrictions ( %SYSTEMROOT%)to be used before local directory DLLs ( a user's home directory)

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: In March, we came across an email with a malware attachment that used the Gamaredon group’s tactics.

Tactics: TA0002
Techniques: T1204
Input: Hildegard has downloaded additional scripts that build and run Monero cryptocurrency miners.

Tactics: TA0011
Techniques: T1105
Input: Emotet has maintained persistence through a scheduled task.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: To disable installer detection, instead add: "EnableInstallerDetection"=dword:00000000.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.010, T1574
Input: This limits the amount of time credentials can be used to access resources if a credential is compromised without your knowledge.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078.004, T1078
Input: When the Trojan runs as an executable within the “DsvHelper” folder, the Trojan will create a shortcut (.lnk file) and save the shortcut to the ‘DsvHelper’ folder

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Resource fork content may also be obfuscated/encrypted until execution.

Tactics: TA0005
Techniques: T1564, T1564.009
Input: AuditCred can download files and additional malware.

Tactics: TA0011
Techniques: T1105
Input: Link-Local Multicast Name Resolution (LLMNR) and NetBIOS Name Service (NBT-NS) are Microsoft Windows components that serve as alternate methods of host identification.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: SDBbot has the ability to delete files from a compromised host.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Inception used a file listing plugin to collect information about file and directories both on local and remote drives.

Tactics: TA0007
Techniques: T1083
Input: Another example is using the Windows copy /b command to reassemble binary fragments into a malicious payload.

Tactics: TA0005
Techniques: T1140
Input: Adversaries may abuse this functionality to execute arbitrary files while potentially bypassing application control.

Tactics: TA0005
Techniques: T1220
Input: Turla has exploited vulnerabilities in the VBoxDrv.sys driver to obtain kernel mode privileges.

Tactics: TA0004
Techniques: T1068
Input: Monitor specifically for events related to activation of instances that are occurring outside of normal activity/planned operations.

Tactics: TA0005
Techniques: T1578, T1578.004
Input: For example, the transport agent may only carry out an action like copying in-transit attachments and saving them for later exfiltration if the recipient email address matches an entry on a list provided by the adversary.

Tactics: TA0003
Techniques: T1505.002, T1505
Input: This poses a greater risk of unauthorized disclosure and may help facilitate data manipulation, Credential Access, or Collection efforts.

Tactics: TA0005
Techniques: T1600
Input: More_eggs uses HTTPS for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: ZeroT gathers the victim's IP address and domain information, and then sends it to its C2 server.

Tactics: TA0007
Techniques: T1016
Input: Gorgon Group malware can download additional files from C2 servers.

Tactics: TA0011
Techniques: T1105
Input: Ragnar Locker has used sc.exe to execute a service that it creates.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Naikon has modified a victim's Windows Run registry to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Goopy has the ability to exfiltrate data over the Microsoft Outlook C2 channel.

Tactics: TA0010
Techniques: T1041
Input: Agent Tesla has used process hollowing to create and manipulate processes through sections of unmapped memory by reallocating that space with its malicious code.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: Limit communications with the container service to local Unix sockets or remote access via SSH.

Tactics: TA0002, TA0005, TA0006, TA0007
Techniques: T1552, T1609, T1552.007, T1610, T1613
Input: PROMETHIUM has created self-signed certificates to sign malicious installers.

Tactics: TA0042
Techniques: T1587.002, T1587
Input: Ebury has intercepted unencrypted private keys as well as private key pass-phrases.

Tactics: TA0006
Techniques: T1552.004, T1552
Input: Remcos uses the infected hosts as SOCKS5 proxies to allow for tunneling and proxying.

Tactics: TA0011
Techniques: T1090
Input: Subdomain hijacking can occur when organizations have DNS entries that point to non-existent or deprovisioned resources.

Tactics: TA0042
Techniques: T1584.001, T1584
Input: Anchor can use secondary C2 servers for communication after establishing connectivity and relaying victim information to primary C2 servers.

Tactics: TA0011
Techniques: T1008
Input: Waterbear has used RC4 encrypted shellcode and encrypted functions.

Tactics: TA0005
Techniques: T1027
Input: Transparent Tribe has embedded links to malicious downloads in e-mails.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: OilRig has a tool called CANDYKING to capture a screenshot of user's desktop.

Tactics: TA0009
Techniques: T1113
Input: Ramsay can detect system information--including disk names, total space, and remaining space--to create a hardware profile GUID which acts as a system identifier for operators.

Tactics: TA0007
Techniques: T1082
Input: Monitor executed commands and arguments that may employ various means to detect and avoid virtualization and analysis environments.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001, T1497.002
Input: Decrypting the Configuration As previously mentioned, the real configuration data is stored in the first stage shellcode but it is not stored in cleartext, but encrypted and compressed

Tactics: TA0005
Techniques: T1027
Input: Command arguments used before and after the invocation of odbcconf.exe may also be useful in determining the origin and purpose of the DLL being loaded.

Tactics: TA0005
Techniques: T1218, T1218.008
Input: Kinsing has searched bash_history for credentials.

Tactics: TA0006
Techniques: T1552.003, T1552
Input: Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories.

Tactics: TA0008
Techniques: T1080
Input: AppleSeed can exfiltrate files via the C2 channel.

Tactics: TA0010
Techniques: T1041
Input: yty contains junk code in its binary, likely to confuse malware analysts.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: For example, on Windows tasks may spawn from svchost.exe or the Windows Task Scheduler taskeng.exe for older OS versions.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: Monitor system logs to review instance activities occurring across all cloud environments and regions.

Tactics: TA0005
Techniques: T1535
Input: Remote DLL preloading attacks occur when a program sets its current directory to a remote location such as a Web share before loading a DLL.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: SodaMaster can use RegOpenKeyW to access the Registry.

Tactics: TA0002
Techniques: T1106
Input: The body of the POST request may contain files contained in the cabinet format

Tactics: TA0007
Techniques: T1083
Input: Kerrdown has been distributed through malicious e-mail attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Dtrack has used process hollowing shellcode to target a predefined list of processes from %SYSTEM32%.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: The following Registry keys can control automatic startup of services during boot:

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: This version of the campaign made malicious use of unins000.exe, a process that belongs to the Brazilian information security company GAS Tecnologia, to gather personal information undetected

Tactics: TA0007
Techniques: T1082
Input: CVE-2014-4113 is a privilege escalation vulnerability that was disclosed publicly on 2014-10-14

Tactics: TA0004
Techniques: T1068
Input: ROKRAT can send collected data to cloud storage services such as PCloud.

Tactics: TA0010
Techniques: T1567.002, T1567
Input: Darkhotel malware can collect a list of running processes on a system.

Tactics: TA0007
Techniques: T1057
Input: Clicking on a link may also lead to other execution techniques such as exploitation of a browser or application vulnerability via Exploitation for Client Execution.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: SombRAT can use the getprocesslist command to enumerate processes on a compromised host.

Tactics: TA0007
Techniques: T1057
Input: Examples of actions are to run a system command or send an email.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.014
Input: APT39 has used various tools to proxy C2 communications.

Tactics: TA0011
Techniques: T1090, T1090.002
Input: FatDuke can list running processes on the localhost.

Tactics: TA0007
Techniques: T1057
Input: Ensure proper process and file permissions are in place to inhibit adversaries from disabling or interfering with critical services.

Tactics: TA0040
Techniques: T1489
Input: SombRAT has the ability to modify its process memory to hide process command-line arguments.

Tactics: TA0005
Techniques: T1564.010, T1564
Input: Similarly, at may also be used for Privilege Escalation if the binary is allowed to run as superuser via sudo.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: This is technically a deprecated technology (superseded by Launch Daemon), and thus the appropriate folder, /Library/StartupItems isn’t guaranteed to exist on the system by default, but does appear to exist by default on macOS Sierra.

Tactics: TA0003, TA0004
Techniques: T1037, T1037.005
Input: Monitor newly executed processes that may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment.

Tactics: TA0007
Techniques: T1518
Input: Monitor newly constructed .manifest and .local redirection files that do not correlate with software updates.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Spark has used a custom XOR algorithm to decrypt the payload.

Tactics: TA0005
Techniques: T1140
Input: Code snippet of the obfuscated document After deobfuscation, we can see that the payload is written in the Perl programming language

Tactics: TA0005
Techniques: T1027
Input: Adversaries may search digital certificate data to gather actionable information.

Tactics: TA0043
Techniques: T1596, T1596.003
Input: Stealth Falcon malware attempts to determine the installed version of .NET by querying the Registry.

Tactics: TA0007
Techniques: T1012
Input: Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.

Tactics: TA0003
Techniques: T1098.005, T1098
Input: To establish persistence, Truvasys adds a Registry Run key with a value "TaskMgr" in an attempt to masquerade as the legitimate Windows Task Manager.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: BLACKCOFFEE uses Microsoft’s TechNet Web portal to obtain an encoded tag containing the IP address of a command and control server and then communicates separately with that IP address for C2.

Tactics: TA0011
Techniques: T1104
Input: The account names visually look similar to legitimate government organization names or other trusted third-party entities

Tactics: TA0005
Techniques: T1036
Input: ROADTools can enumerate Azure AD systems and devices.

Tactics: TA0007
Techniques: T1018
Input: menuPass has used DLL search order hijacking.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: ObliqueRAT can copy specific files, webcam captures, and screenshots to local directories.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Phishing for information frequently involves social engineering techniques, such as posing as a source with a reason to collect information (ex: Establish Accounts or Compromise Accounts) and/or sending multiple, seemingly urgent messages.

Tactics: TA0043
Techniques: T1598
Input: Keydnap uses the keychaindump project to read securityd memory.

Tactics: TA0006
Techniques: T1555.002, T1555
Input: Some SeaDuke samples have a module to extract email from Microsoft Exchange servers using compromised credentials.

Tactics: TA0001, TA0003, TA0004, TA0005, TA0009
Techniques: T1114, T1078, T1114.002
Input: ZxShell can create a new service using the service parser function ProcessScCommand.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: QUADAGENT was likely obfuscated using Invoke-Obfuscation.

Tactics: TA0005
Techniques: T1027
Input: The function builds the contents of a second file by concatenating several strings together, but this second file is a .sct file that the function will write to a file %TEMP%\12-B-366.txt

Tactics: TA0005
Techniques: T1140, T1070, T1070.006
Input: Grandoreiro can use run keys and create link files in the startup folder for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: The decrypted shellcode is dropped as a Microsoft Word plugin WLL  into C:\Users\ADMINI~1\AppData\Roaming\Microsoft\Word\STARTUP.

Tactics: TA0003
Techniques: T1137
Input: The chinapolicyanalysis.org domain was used as the sender address, as well as the hosting location of the malicious RTF document

Tactics: TA0007
Techniques: T1016
Input: This IP also belongs to the same service provider and class B network range as another IP we had associated with DarkHydrus, 107.175.150[.]113 which specifically resolved to a domain name containing a victim organization’s name

Tactics: TA0007
Techniques: T1016
Input: Some specifics from in-the-wild use include:

Tactics: TA0006
Techniques: T1187
Input: Kerberos (88/TCP)

Tactics: TA0006
Techniques: T1110.004, T1110, T1110.001, T1110.003
Input: Elise encrypts exfiltrated data with RC4.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Monitor newly executed processes that may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms.

Tactics: TA0005
Techniques: T1562
Input: Monitor access to file resources that contain local accounts and groups information such as /etc/passwd, /Users directories, and the Windows SAM database.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Mofang has also encrypted payloads before they are downloaded to victims.

Tactics: TA0005
Techniques: T1027
Input: ROKRAT has an audio capture and eavesdropping module.

Tactics: TA0009
Techniques: T1123
Input: DEL Deletes a specified file

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Information from these scans may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services).

Tactics: TA0043
Techniques: T1595.001, T1595
Input: CORESHELL can communicate over HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: DropBook is a Python-based backdoor compiled with PyInstaller.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Pandora has the ability to install itself as a Windows service.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: BoomBox has the ability to download next stage malware components to a compromised system.

Tactics: TA0011
Techniques: T1105
Input: These can be added ad-hoc to the compiled binary as long as adjustments are made to the rest of the fields and dependencies.

Tactics: TA0003, TA0004
Techniques: T1546.006, T1546
Input: Bankshot leverages a known zero-day vulnerability in Adobe Flash to execute the implant into the victims’ machines.

Tactics: TA0002
Techniques: T1203
Input: These credential materials can be harvested by an administrative user or SYSTEM and used to conduct Lateral Movement using Use Alternate Authentication Material.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: APT29 has written malware variants in Visual Basic.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Only files with sizes less than 500MB are encrypted.

Tactics: TA0040
Techniques: T1486
Input: REvil has used encrypted strings and configuration files.

Tactics: TA0005
Techniques: T1027
Input: Monitor executed commands and arguments that may attempt to exfiltrate data over Bluetooth rather than the command and control channel.

Tactics: TA0010
Techniques: T1011.001, T1011
Input: Dridex has relied upon users clicking on a malicious attachment delivered through spearphishing.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Adversaries may hook into Windows application programming interface (API) functions to collect user credentials.

Tactics: TA0006, TA0009
Techniques: T1056.004, T1056
Input: RCSession can launch itself from a hollowed svchost.exe process.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: TA505 has used lures to get users to enable content in malicious attachments and execute malicious files contained in archives.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Monitor process execution logs to include PowerShell Transcription focusing on those that perform a combination of behaviors including reading web browser process memory, utilizing regular expressions, and those that contain numerous keywords for common web applications (Gmail, Twitter, Office365, ).

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Detection efforts may be focused on related stages of the adversary lifecycle, such as during Phishing, Endpoint Denial of Service, or Network Denial of Service.

Tactics: TA0042
Techniques: T1584, T1583.005, T1583, T1584.005
Input: ZIRCONIUM has used tools to download malicious files to compromised hosts.

Tactics: TA0011
Techniques: T1105
Input: Adversaries may also name images a certain way to increase the chance of users mistakenly deploying an instance or container from the image (ex: Match Legitimate Name or Location).

Tactics: TA0002
Techniques: T1204.003, T1204
Input: Psylo has a command to download a file to the system from its C2 server.

Tactics: TA0011
Techniques: T1105
Input: Monitor executed commands and arguments that may use hidden windows to conceal malicious activity from the plain sight of users.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Ke3chang has performed frequent and scheduled data collection from victim networks.

Tactics: TA0009
Techniques: T1119
Input: Ensure that, where available, local passwords are always encrypted, per vendor recommendations.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: StoneDrill has several VBS scripts used throughout the malware's lifecycle.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Adversaries may alter application binaries used to display data in order to cause runtime manipulations.

Tactics: TA0040
Techniques: T1565.003, T1565
Input: Monitor for API calls that may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software.

Tactics: TA0006, TA0007
Techniques: T1033, T1003
Input: Monitor for abnormal process creations, such as a Command and Scripting Interpreter spawning from a potentially exploited application.

Tactics: TA0002, TA0005, TA0006
Techniques: T1203, T1211, T1212
Input: TA505 has used malware to gather credentials from FTP clients and Outlook.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: Emotet has been delivered by phishing emails containing attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: jRAT can map UPnP ports.

Tactics: TA0007
Techniques: T1120