madox81/Adema_ATTACK_DS huggingface dataset:
Input: The SSH server can be configured to use standard password authentication or public-private keypairs in lieu of or in addition to a password.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: If an SMS message contained either a phone number, IMSI number, or keyword that matched the predefined list, it is saved to a CSV file for later theft by the threat actor.

Tactics: TA0009
Techniques: T1119
Input: Donut can generate code modules that enable in-memory execution of VBScript, JScript, EXE, DLL, and dotNET payloads.

Tactics: TA0005
Techniques: T1620
Input: * Some Control Panel items are extensible via Shell extensions registered in HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Controls Folder{name}\Shellex\PropertySheetHandlers where {name} is the predefined name of the system item.

Tactics: TA0005
Techniques: T1218, T1218.002
Input: Information about victims may be available for purchase within reputable private sources and databases, such as paid subscriptions to feeds of scan databases or other data aggregation services.

Tactics: TA0043
Techniques: T1597.002, T1597
Input: The time provider manager, directed by the service control manager, loads and starts time providers listed and enabled under this key at system startup and/or whenever parameters are changed.

Tactics: TA0003, TA0004
Techniques: T1547.003, T1547
Input: To ensure data integrity, TxF enables only one transacted handle to write to a file at a given time.

Tactics: TA0004, TA0005
Techniques: T1055.013, T1055
Input: These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.

Tactics: TA0002
Techniques: T1106
Input: Denis deploys additional backdoors and hacking tools to the system.

Tactics: TA0011
Techniques: T1105
Input: APT37 injects its malware variant, ROKRAT, into the cmd.exe process.

Tactics: TA0004, TA0005
Techniques: T1055
Input: When a user logs into a service, a session will be established that will allow them to maintain a continuous interaction with that service.

Tactics: TA0008
Techniques: T1563
Input: Clambling has the ability to enumerate Registry keys, including KEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt\strDataDir to search for a bitcoin wallet.

Tactics: TA0007
Techniques: T1012
Input: Caterpillar WebShell has a command to modify a Registry key.

Tactics: TA0005
Techniques: T1112
Input: For example, an adversary may be able to identify a sandbox accelerating time by sampling and calculating the expected value for an environment's timestamp before and after execution of a sleep function.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Monitor for newly assigned drive letters or mount points to a data storage device that may attempt to exfiltrate data via a physical medium, such as a removable drive.

Tactics: TA0010
Techniques: T1052
Input: APT39 has created accounts on multiple compromised hosts to perform actions within the network.

Tactics: TA0003
Techniques: T1136, T1136.001
Input: Adversaries may use bootkits to persist on systems.

Tactics: TA0003, TA0005
Techniques: T1542.003, T1542
Input: APT32 enumerated administrative users using the commands net localgroup administrators.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Kessel has decrypted the binary's configuration once the main function was launched.

Tactics: TA0005
Techniques: T1140
Input: FIN10 has moved laterally using the Local Administrator account.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.003
Input: Kimsuky has disguised services to appear as benign software or related to operating system functions.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: REvil can mark its binary code for deletion after reboot.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Machete detects the insertion of new devices by listening for the WM_DEVICECHANGE window message.

Tactics: TA0007
Techniques: T1120
Input: Misdat is capable of deleting Registry keys used for persistence.

Tactics: TA0005
Techniques: T1070
Input: Hydraq includes a component based on the code of VNC that can stream a live feed of the desktop of an infected host.

Tactics: TA0009
Techniques: T1113
Input: DarkWatchman can uninstall malicious components from the Registry, stop processes, and clear the browser history.

Tactics: TA0005
Techniques: T1070
Input: gh0st RAT has added a Registry Run key to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: A virtual machine is then called to run this code.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: SynAck abuses NTFS transactions to launch and conceal malicious processes.

Tactics: TA0004, TA0005
Techniques: T1055.013, T1055
Input: Adversaries may abuse Microsoft Outlook forms to obtain persistence on a compromised system.

Tactics: TA0003
Techniques: T1137, T1137.003
Input: BoomBox can enumerate the username on a compromised host.

Tactics: TA0007
Techniques: T1033
Input: Mustang Panda has encrypted documents with RC4 prior to exfiltration.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: Figure 1: Code from 29[.]html scheduling the first task to run a script from pastebin The second task (“MSOFFICEER”) in Figure 2 runs the script contents of a different page of the same blog, blog-page[.]html, every 100 minutes

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Adversaries may use such private WHOIS services to obscure information about who owns a purchased domain.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: Felismus uses HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: By default, only Administrators may remotely activate and launch COM objects through DCOM.

Tactics: TA0008
Techniques: T1021.003, T1021
Input: Stuxnet searches the Registry for indicators of security programs.

Tactics: TA0007
Techniques: T1012
Input: For example, adversaries may manipulate victim DNS settings to enable other malicious activities such as preventing/redirecting users from accessing legitimate sites and/or pushing additional malware.

Tactics: TA0006, TA0009
Techniques: T1557
Input: InvisiMole samples were timestomped by the authors by setting the PE timestamps to all zero values.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: Monitor executed atq command and ensure IP addresses stored in the SSH_CONNECTION and SSH_CLIENT variables, machines that created the jobs, are trusted hosts.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: Examples include the Start-Process cmdlet which can be used to run an executable and the Invoke-Command cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Other malware has obtained the OS version, UUID, and computer/host name to send to the C2 server.

Tactics: TA0007
Techniques: T1082
Input: LazyScripter has used dynamic DNS providers to create legitimate-looking subdomains for C2.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: Kwampirs collects a list of accounts with the command net users.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: PsExec can leverage Windows services to escalate privileges from administrator to SYSTEM with the -s argument.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Lucifer can decrypt its C2 address upon execution.

Tactics: TA0005
Techniques: T1140
Input: If the base image is pulled from a public registry, defenses will likely not detect the image as malicious since it’s a vanilla image.

Tactics: TA0005
Techniques: T1612
Input: Using this example, Comnie will then request data to supply to the BAT script, via the following decrypted request: h=HOSTNAME-PC&f=gethostinfo.bat&c=& Based on network traffic witnessed, the remote C2 server was found to respond with the following information:       netstat -ano > %TEMP%\info.datipconfig /all >> %TEMP%\info.datroute PRINT >> %TEMP%\info.datnet view >> %TEMP%\info.dattasklist >> %TEMP%\info.datnet user >> %TEMP%\info.datnet start >> %TEMP%\info.dat       This script is written to a temporary file prior to be executed

Tactics: TA0007
Techniques: T1007
Input: Bandook has a command to delete a file.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: FIN6 has collected schemas and user accounts from systems running SQL Server.

Tactics: TA0009
Techniques: T1213
Input: Adversaries may use this technique in conjunction with administrator-level Valid Accounts to remotely access a networked system over SMB, to interact with systems using remote procedure calls (RPCs), transfer files, and run transferred binaries through remote Execution.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: GoldMax has set an execution trigger date and time, stored as an ASCII Unix/Epoch time value.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Look for changes to binaries and service executables that may normally occur during software updates.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574
Input: WarzoneRAT can collect data from a compromised host.

Tactics: TA0009
Techniques: T1005
Input: Shamoon will reboot the infected system once the wiping functionality has been completed.

Tactics: TA0040
Techniques: T1529
Input: Specific common information repositories include web-based platforms such as Sharepoint and Confluence, specific services such as Code Repositories, IaaS databases, enterprise databases, and other storage infrastructure such as SQL Server.

Tactics: TA0009
Techniques: T1213
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may use email rules to hide inbound emails in a compromised user's mailbox.

Tactics: TA0005
Techniques: T1564, T1564.008
Input: Operation Wocao has staged archived files in a temporary directory prior to exfiltration.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Monitor changes to screensaver configuration changes in the Registry that may not correlate with typical user behavior.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.002
Input: Truvasys adds a Registry Run key to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Monitor for processes making abnormal calls to higher privileged processes, such as a user application connecting to a VPN service.

Tactics: TA0002
Techniques: T1559, T1559.003
Input: Also, the use of the  mimikatz and pwdump tools suggests the adversary attempts to dump credentials on compromised systems

Tactics: TA0006
Techniques: T1003
Input: Threat Group-3390 has exfiltrated stolen data to Dropbox.

Tactics: TA0010
Techniques: T1567.002, T1567
Input: LOWBALL command and control occurs via HTTPS over port 443.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: WinMM sets a WH_CBT Windows hook to collect information on process creation.

Tactics: TA0007
Techniques: T1057
Input: Imminent Monitor has a "Process Watcher" feature to monitor processes in case the client ever crashes or gets closed.

Tactics: TA0007
Techniques: T1057
Input: CosmicDuke searches for Microsoft Outlook data files with extensions .pst and .ost for collection and exfiltration.

Tactics: TA0009
Techniques: T1114, T1114.001
Input: CostaRicto has set up remote SSH tunneling into the victim's environment from a malicious domain.

Tactics: TA0011
Techniques: T1572
Input: There are many Windows API calls a payload can take advantage of to manipulate access tokens (, LogonUser , DuplicateTokenEx, and ImpersonateLoggedOnUser).

Tactics: TA0004, TA0005
Techniques: T1134
Input: Adversaries may use crafted packets to attempt to connect to one or more (open or closed) ports, but may also attempt to connect to a router interface, broadcast, and network address IP on the same port in order to achieve their goals and objectives.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205
Input: LNK files have been valuable during Mandiant incident response investigations as they include volume serial number, NetBIOS name, and MAC address

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: PipeMon can establish persistence by registering a malicious DLL as an alternative Print Processor which is loaded when the print spooler service starts.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Stuxnet infects remote servers via network shares and by infecting WinCC database views with malicious code.

Tactics: TA0008
Techniques: T1080
Input: SUNBURST used Base64 encoding in its C2 traffic.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Monitor executed commands and arguments that may gather information about the victim's hosts that can be used during targeting.

Tactics: TA0005
Techniques: T1218, T1218.003
Input: Several tools exist that can be used to poison name services within local networks such as NBNSpoof, Metasploit, and Responder.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: GravityRAT can obtain the date and time of a system.

Tactics: TA0007
Techniques: T1124
Input: Monitor executed commands and arguments for modifications to domain trust settings, such as when a user or application modifies the federation settings on the domain or updates domain authentication from Managed to Federated via ActionTypes Set federation settings on domain and Set domain authentication.

Tactics: TA0004, TA0005
Techniques: T1484
Input: Cadelspy’s main payload contains its back door functionality, allowing the threat to carry out the following activities:  Log keystrokes and the titles of open windows Gather clipboard data and system information Steal printer information and any documents that were sent to be printed Record audio Capture screenshots and webcam photos  Cadelspy compresses all of the stolen data into a .cab file and uploads it to the attacker’s C&C servers

Tactics: TA0009
Techniques: T1115
Input: Remcos can search for files on the infected machine.

Tactics: TA0007
Techniques: T1083
Input: Similar to Obfuscated Files or Information, adversaries may use environmental keying to help protect their TTPs and evade detection.

Tactics: TA0005
Techniques: T1480, T1480.001
Input: RainyDay can enumerate processes on a target system.

Tactics: TA0007
Techniques: T1057
Input: Grandoreiro can modify the binary ACL to prevent security tools from running.

Tactics: TA0005
Techniques: T1222, T1222.001
Input: Processes utilizing the network that do not normally have network communication or have never been seen before may be suspicious.

Tactics: TA0011
Techniques: T1008
Input: The Exaramel for Windows dropper creates and starts a Windows service named wsmprovav with the description "Windows Check AV."

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: MoleNet can use PowerShell to set persistence.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Making these files immutable and only changeable by certain administrators will limit the ability for adversaries to easily create user level persistence.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: Limit access to remote services through centrally managed concentrators such as VPNs and other managed remote access systems.

Tactics: TA0001, TA0003
Techniques: T1133
Input: A variety of methods exist for compromising accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, or by brute forcing credentials (ex: password reuse from breach credential dumps).

Tactics: TA0042
Techniques: T1586
Input: Starloader has masqueraded as legitimate software update packages such as Adobe Acrobat Reader and Intel.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: BBK has the ability to decrypt AES encrypted payloads.

Tactics: TA0005
Techniques: T1140
Input: Properly manage accounts and permissions used by parties in trusted relationships to minimize potential abuse by the party and if the party is compromised by an adversary.

Tactics: TA0001
Techniques: T1199
Input: SHOTPUT is obscured using XOR encoding and appended to a valid GIF file.

Tactics: TA0005
Techniques: T1027
Input: AppleJeus has created a scheduled SYSTEM task that runs when a user logs in.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Import address table (IAT) hooking, which use modifications to a process’s IAT, where pointers to imported API functions are stored.

Tactics: TA0006, TA0009
Techniques: T1056.004, T1056
Input: Mythic supports custom chunk sizes used to upload/download files.

Tactics: TA0010
Techniques: T1030
Input: KONNI has modified ComSysApp service to load the malicious DLL payload.

Tactics: TA0003, TA0004
Techniques: T1546.015, T1546
Input: Adversaries may use Valid Accounts to remotely control machines using Virtual Network Computing (VNC).

Tactics: TA0008
Techniques: T1021.005, T1021
Input: Remexi utilizes scheduled tasks as a persistence mechanism.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: A bootkit is a malware variant that modifies the boot sectors of a hard drive, including the Master Boot Record (MBR) and Volume Boot Record (VBR).

Tactics: TA0003, TA0005
Techniques: T1542.003, T1542
Input: To maximize impact on the target organization in operations where network-wide availability interruption is the goal, malware used for wiping disks may have worm-like features to propagate across a network by leveraging additional techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.

Tactics: TA0040
Techniques: T1561
Input: Machete has scanned and looked for cryptographic keys and certificate file extensions.

Tactics: TA0006
Techniques: T1552.004, T1552
Input: Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.

Tactics: TA0005
Techniques: T1036
Input: Adversaries may set up their own Domain Name System (DNS) servers that can be used during targeting.

Tactics: TA0042
Techniques: T1583, T1583.002
Input: HyperBro has the ability to take screenshots.

Tactics: TA0009
Techniques: T1113
Input: Lastly, if the HTTP request is not successful, the downloader will fallback to using DNS tunneling to establish communications

Tactics: TA0011
Techniques: T1071
Input: APT39 has been seen using RDP for lateral movement and persistence, in some cases employing the rdpwinst tool for mangement of multiple sessions.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Metamorfo has collected the hostname and operating system version from the compromised host.

Tactics: TA0007
Techniques: T1082
Input: In Linux environments, adversaries may also abuse at to break out of restricted environments by using a task to spawn an interactive system shell or to run system commands.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: WastedLocker can modify registry values within the Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap registry key.

Tactics: TA0005
Techniques: T1112
Input: Adversaries may also delete the ConsoleHost_history.txt file or edit its contents to hide PowerShell commands they have run.

Tactics: TA0005
Techniques: T1070, T1070.003
Input: Remcos has full control of the Registry, including the ability to modify it.

Tactics: TA0005
Techniques: T1112
Input: Monitor executed commands and arguments that may modify Group Policy Objects (GPOs) to subvert the intended discretionary access controls for a domain, usually with the intention of escalating privileges on the domain.

Tactics: TA0004, TA0005
Techniques: T1484.001, T1484
Input: Monitor network data for uncommon data flows, such as unexpected surges or other abnormal inbound/outbound patterns.

Tactics: TA0011
Techniques: T1008
Input: yty collects screenshots of the victim machine.

Tactics: TA0009
Techniques: T1113
Input: Web server software can be attacked through a variety of means, some of which apply generally while others are specific to the software being used to provide the service.

Tactics: TA0040
Techniques: T1499.002, T1499
Input: HARDRAIN binds and listens on port 443 with a FakeTLS method.

Tactics: TA0011
Techniques: T1571
Input: ADVSTORESHELL can create a remote shell and run a given command.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Egregor has used multiple anti-analysis and anti-sandbox techniques to prevent automated analysis by sandboxes.

Tactics: TA0005, TA0007
Techniques: T1497
Input: Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.

Tactics: TA0005
Techniques: T1564
Input: Shipment interdiction

Tactics: TA0001
Techniques: T1195
Input: Linfo creates a backdoor through which remote attackers can download files onto compromised hosts.

Tactics: TA0011
Techniques: T1105
Input: Ebury can hook logging functions so that nothing from the backdoor gets sent to the logging facility.

Tactics: TA0005
Techniques: T1562.006, T1562
Input: Suspicious program execution as autostart programs may show up as outlier processes that have not been seen before when compared against historical data to increase confidence of malicious activity, data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.

Tactics: TA0003, TA0004
Techniques: T1547
Input: Phishing emails with political themes were used in the majority of the observed attack emails

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Adversaries may use commands such as gpresult or various publicly available PowerShell functions, such as Get-DomainGPO and Get-DomainGPOLocalGroup, to gather information on Group Policy settings.

Tactics: TA0007
Techniques: T1615
Input: If the randomness score is high, and the domains are not whitelisted (CDN, etc), then it may be determined if a domain is related to a legitimate host or DGA.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: GreyEnergy has used Tor relays for Command and Control servers.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: Clambling has the ability to capture screenshots.

Tactics: TA0009
Techniques: T1113
Input: APT37 has collected data from victims' local systems.

Tactics: TA0009
Techniques: T1005
Input: Object Linking and Embedding (OLE), or the ability to link data between documents, was originally implemented through DDE.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: Ensure updated virus definitions and create custom signatures for observed malware.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Sliver can use standard encoding techniques like gzip and hex to ASCII to encode the C2 communication payload.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: It contains functionality to add helper DLLs for extending functionality of the utility.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.007
Input: FIN6 used RDP to move laterally in victim networks.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Monitor for newly created processes that may modify the kernel to automatically execute programs on system boot.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: Denis used GetProcAddress and LoadLibrary to dynamically resolve APIs.

Tactics: TA0002
Techniques: T1106
Input: Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.001
Input: Gamaredon Group has delivered spearphishing emails with malicious attachments to targets.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Revenge RAT has a plugin to perform RDP access.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Bisonal will delete its dropper and VBS scripts from the victim’s machine.

Tactics: TA0005
Techniques: T1070, T1070.004