madox81/Adema_ATTACK_DS huggingface dataset:
Input: ZxShell has a feature to create local user accounts.

Tactics: TA0003
Techniques: T1136, T1136.001
Input: As part of Credentials from Web Browsers, Internet Explorer and Microsoft Edge website credentials are managed by the Credential Manager and are stored in the Web Credentials locker.

Tactics: TA0006
Techniques: T1555, T1555.004
Input: ASPXTool web shell

Tactics: TA0003
Techniques: T1505.003, T1505
Input: BBK can extract a malicious Portable Executable (PE) from a photo.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: Octopus can capture screenshots of the victims’ machine.

Tactics: TA0009
Techniques: T1113
Input: An adversary can then use a token to authenticate to a remote system as the account for that token if the account has appropriate permissions on the remote system.

Tactics: TA0004, TA0005
Techniques: T1134
Input: There are opportunities to detect COM hijacking by searching for Registry references that have been replaced and through Registry operations (ex: Reg) replacing known binary paths with unknown paths or otherwise malicious content.

Tactics: TA0003, TA0004
Techniques: T1546.015, T1546
Input: Adversaries may also employ a keylogger to similarly target other hardware tokens, such as RSA SecurID.

Tactics: TA0006
Techniques: T1111
Input: Adversaries may take advantage of this behavior to gain access to user account hashes through forced SMB/WebDAV authentication.

Tactics: TA0006
Techniques: T1187
Input: WINERACK can enumerate files and directories.

Tactics: TA0007
Techniques: T1083
Input: The executable contains a side-loading weakness which is used to load a portion of the malware.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: Monitor PAM configuration and module paths (ex: /etc/pam.d/) for changes.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.003, T1556
Input: Monitor executed commands and arguments that may attempt to dump the contents of /etc/passwd and /etc/shadow to enable offline password cracking.

Tactics: TA0006
Techniques: T1003, T1003.008
Input: QakBot has the ability to download additional components and malware.

Tactics: TA0011
Techniques: T1105
Input: Sidewinder has used malware to collect information on network interfaces, including the MAC address.

Tactics: TA0007
Techniques: T1016
Input: Leviathan has staged data remotely prior to exfiltration.

Tactics: TA0009
Techniques: T1074.002, T1074
Input: POWERSTATS has used useless code blocks to counter analysis.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: TAINTEDSCRIBE can execute GetLocalTime for time discovery.

Tactics: TA0007
Techniques: T1124
Input: Explosive has encrypted communications with the RC4 method.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Download & execute Startup (with persistence) Collection of system information (OS, version, installed location, etc.) Self-update Uninstall  This project was created by a user called zettabithf which is linked to a user with the same name in Hack Forums

Tactics: TA0007
Techniques: T1082
Input: Adversaries may abuse Unix shell commands and scripts for execution.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: FoggyWeb can allow abuse of a compromised AD FS server's SAML token.

Tactics: TA0005, TA0008
Techniques: T1550
Input: Avaddon has decrypted encrypted strings.

Tactics: TA0005
Techniques: T1140
Input: DarkWatchman can collect files from a compromised host.

Tactics: TA0009
Techniques: T1005
Input: Kazuar uses cmd.exe to execute commands on the victim’s machine.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: APT39 has used WinRAR and 7-Zip to compress an archive stolen data.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Rather than developing their own exploits, an adversary may find/modify exploits from online or purchase them from exploit vendors.

Tactics: TA0042
Techniques: T1588, T1588.005
Input: Dok uses AppleScript to create a login item for persistence.

Tactics: TA0002
Techniques: T1059.002, T1059
Input: Javali can monitor processes for open browsers and custom banking applications.

Tactics: TA0007
Techniques: T1057
Input: zwShell has established persistence by adding itself as a new service.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Explosive has collected the computer name from the infected host.

Tactics: TA0007
Techniques: T1082
Input: TA505 has password-protected malicious Word documents and used base64 encoded PowerShell commands.

Tactics: TA0005
Techniques: T1027
Input: OSX/Shlayer can use the chmod utility to set a file as executable, such as chmod 777 or chmod +x.

Tactics: TA0005
Techniques: T1222.002, T1222
Input: BLINDINGCAN has obfuscated code using Base64 encoding.

Tactics: TA0005
Techniques: T1027
Input: With SYSTEM access, the tools/utilities such as Mimikatz, Reg, and secretsdump.py can be used to extract the cached credentials.

Tactics: TA0006
Techniques: T1003, T1003.005
Input: NavRAT then creates a registry key in order to execute this file copy at the next reboot of the system, an initial method of persistence

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: POWERTON is written in PowerShell.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory, then compressed, encrypted, and uploaded to a C2 server.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Valak can determine if a compromised host has security products installed.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Many Office-related persistence mechanisms require changes to the Registry and for binaries, files, or scripts to be written to disk or existing files modified to include malicious scripts.

Tactics: TA0003
Techniques: T1137
Input: This may compromise the integrity of security solutions by causing notable events to go unreported.

Tactics: TA0005
Techniques: T1070
Input: Most embedded network devices support TACACS+ and/or RADIUS.

Tactics: TA0003, TA0005, TA0006
Techniques: T1601, T1556, T1556.004, T1601.001
Input: With access to the credential hash, an adversary can perform off-line Brute Force cracking to gain access to plaintext credentials.

Tactics: TA0006
Techniques: T1187
Input: PowerSploit modules are written in and executed via PowerShell.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Pupy can user PowerView to execute "net user" commands and create domain accounts.

Tactics: TA0003
Techniques: T1136, T1136.002
Input: Agent Tesla can gather credentials from a number of browsers.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Using policy settings to specify startup programs creates corresponding values in either of two Registry keys:

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Adversaries have been observed conducting network DoS attacks for political purposes and to support other malicious activities, including distraction, hacktivism, and extortion.

Tactics: TA0040
Techniques: T1498
Input: It uses Shortcut Modification of directory .LNK files that use Masquerading to look like the real directories, which are hidden through Hidden Files and Directories.

Tactics: TA0008
Techniques: T1080
Input: Mimikatz also utilizes SID-History Injection to expand the scope of other components such as generated Kerberos Golden Tickets and DCSync beyond a single domain.

Tactics: TA0004, TA0005
Techniques: T1134.005, T1134
Input: Anyone can query WHOIS servers for information about a registered domain, such as assigned IP blocks, contact information, and DNS nameservers.

Tactics: TA0043
Techniques: T1596.002, T1596
Input: MuddyWater has used tools to encode C2 communications including Base64 encoding.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: APT32 has stood up websites containing numerous articles and content scraped from the Internet to make them appear legitimate, but some of these pages include malicious JavaScript to profile the potential victim or infect them via a fake software update.

Tactics: TA0042
Techniques: T1608.004, T1608
Input: Adversaries can use scripts or manually run the commands launchctl load -w "%s/Library/LaunchAgents/%s" or /bin/launchctl load to execute Launch Agents or Launch Daemons.

Tactics: TA0002
Techniques: T1569.001, T1569
Input: Lucifer can check for existing stratum cryptomining information in HKLM\Software\Microsoft\Windows\CurrentVersion\spreadCpuXmr – %stratum info%.

Tactics: TA0007
Techniques: T1012
Input: SLOWDRIFT downloads additional payloads.

Tactics: TA0011
Techniques: T1105
Input: This use of guardrails is distinct from typical Virtualization/Sandbox Evasion.

Tactics: TA0005
Techniques: T1480
Input: Frankenstein has used WMI queries to check if various security applications were running, as well as the operating system version.

Tactics: TA0002
Techniques: T1047
Input: Hancitor  has added Registry Run keys to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: SILENTTRINITY's amsiPatch.py module can disable Antimalware Scan Interface (AMSI) functions.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Gelsemium can determine the operating system and whether a targeted machine has a 32 or 64 bit architecture.

Tactics: TA0007
Techniques: T1082
Input: Lazarus Group has replaced win_fw.dll, an internal component that is executed during IDA Pro installation, with a malicious DLL to download and execute a payload.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: text=  from=  ai= ags=  oe= aq= btnG=  oprnd=  ai= utm=  channel=  The page address in the domain of the command and control server is chosen randomly from the list

Tactics: TA0007
Techniques: T1016
Input: The malware can exfiltrate keystrokes, screenshots, browser-related data like cookies and history, decrypted when possible

Tactics: TA0009
Techniques: T1113
Input: Proactively search for credentials within the Registry and attempt to remediate the risk.

Tactics: TA0006
Techniques: T1552, T1552.002
Input: In another case the attackers use another code snippet borrowed from the SubTee GitHub project, this time filling in a fully templated .NET application whitelist bypass file: SHA256: 3e9136f95fa55852993cd15b82fe6ec54f78f34584f7689b512a46f0a22907f2: This time the attacker didn’t have to write any of their own code, instead they were simply able to paste their shellcode directly into a template, in order to launch PlugX as a child process of a trusted application

Tactics: TA0007
Techniques: T1124
Input: Consider blocking download/transfer and execution of potentially uncommon file types known to be used in adversary campaigns, such as CHM files

Tactics: TA0005
Techniques: T1218, T1218.001
Input: Dragonfly has performed screen captures of victims, including by using a tool, scr.exe (which matched the hash of ScreenUtil).

Tactics: TA0009
Techniques: T1113
Input: Proton gathers credentials for Google Chrome.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: DarkHydrus has obtained and used tools such as Mimikatz, Empire, and Cobalt Strike.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Monitor contextual data about a service/daemon, which may include information such as name, service executable, start type that that may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms.

Tactics: TA0005
Techniques: T1562
Input: Cuba can discover shared resources using the NetShareEnum API call.

Tactics: TA0007
Techniques: T1135
Input: Pillowmint has used the NtQueueApcThread syscall to inject code into svchost.exe.

Tactics: TA0004, TA0005
Techniques: T1055.004, T1055
Input: At a high-level, their targeting of financial organizations and subsequent heists have followed the same general pattern:   Information Gathering: Conducted research into an organization’s personnel and targeted third party vendors with likely access to SWIFT transaction systems to understand the mechanics of SWIFT transactions on victim networks (Please note: The systems in question are those used by the victim to conduct SWIFT transactions

Tactics: TA0007
Techniques: T1018
Input: LLMNR is based upon the Domain Name System (DNS) format and allows hosts on the same local link to perform name resolution for other hosts.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: These attacks do not need to exhaust the actual resources on a system; the attacks may simply exhaust the limits and available resources that an OS self-imposes.

Tactics: TA0040
Techniques: T1499, T1499.001
Input: The Streams tool of Sysinternals can be used to uncover files with ADSs.

Tactics: TA0005
Techniques: T1564, T1564.004
Input: More_eggs can remove itself from a system.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Monitor for API calls that may attempt to gather information about domain accounts such as type of user, privileges and groups.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: Crimson contains a command to collect and exfiltrate emails from Outlook.

Tactics: TA0009
Techniques: T1114, T1114.001
Input: Pandora can load additional drivers and files onto a victim machine.

Tactics: TA0011
Techniques: T1105
Input: Access to Valid Accounts to use the service is often a requirement, which could be obtained through credential pharming or by obtaining the credentials from users after compromising the enterprise network.

Tactics: TA0001, TA0003
Techniques: T1133
Input: Industroyer’s data wiper module writes zeros into the registry keys in SYSTEM\CurrentControlSet\Services to render a system inoperable.

Tactics: TA0040
Techniques: T1489
Input: XCSSET uses a hidden folder named .xcassets and .git to embed itself in Xcode.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Keylogging is the most prevalent type of input capture, with many different ways of intercepting keystrokes.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Lizar has a plugin that can retrieve credentials from Internet Explorer and Microsoft Edge using vaultcmd.exe and another that can collect RDP access credentials using the CredEnumerateW function.

Tactics: TA0006
Techniques: T1555, T1555.004
Input: Gelsemium has the ability to use TCP and UDP in C2 communications.

Tactics: TA0011
Techniques: T1095
Input: Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries.

Tactics: TA0009
Techniques: T1114
Input: Bad Rabbit used the EternalRomance SMB exploit to spread through victim networks.

Tactics: TA0008
Techniques: T1210
Input: Remsec has a plugin to drop and execute vulnerable Outpost Sandbox or avast!

Tactics: TA0004
Techniques: T1068
Input: Dyre registers itself as a service by adding several Registry keys.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Bad Rabbit has been executed through user installation of an executable disguised as a flash installer.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords.

Tactics: TA0006
Techniques: T1110, T1110.003
Input: Okrum has used DriveLetterView to enumerate drive information.

Tactics: TA0007
Techniques: T1083
Input: WIRTE has used PowerShell for script execution.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Lokibot has the ability to initiate contact with command and control (C2) to exfiltrate stolen data.

Tactics: TA0010
Techniques: T1041
Input: Perform file monitoring; files with known names but in unusual locations are suspect.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like ctrl+c and ctrl+d.

Tactics: TA0003, TA0004
Techniques: T1546.005, T1546
Input: For example, one type of module is the device driver, which allows the kernel to access hardware connected to the system.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: Character  Digit   h 0   i 1   j 2   k 3   l 4   m 5   n 6   o 7   p 8   q 9    Table 4 Character substitution used in RogueRobin The Trojan will use future DNS requests to retrieve jobs from the C2 server, which the Trojan will handle as commands

Tactics: TA0011
Techniques: T1071
Input: The TrickBot downloader has used an icon to appear as a Microsoft Word document.

Tactics: TA0005
Techniques: T1036
Input: Dok proxies web traffic to potentially monitor and alter victim HTTP(S) traffic.

Tactics: TA0006, TA0009
Techniques: T1557
Input: If adversaries have a presence on the running virtual instance, they may query the Instance Metadata API directly to identify credentials that grant access to additional resources.

Tactics: TA0006
Techniques: T1552, T1552.005
Input: WinMM collects the system name, OS version including service pack, and system install date and sends the information to the C2 server.

Tactics: TA0007
Techniques: T1082
Input: BADNEWS installs a registry Run key to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Bonadan can create bind and reverse shells on the infected system.

Tactics: TA0002
Techniques: T1059
Input: NETEAGLE allows adversaries to execute shell commands on the infected host.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: RTM monitors browsing activity and automatically captures screenshots if a victim browses to a URL matching one of a list of strings.

Tactics: TA0009
Techniques: T1119
Input: CopyKittens has used PowerShell Empire.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Malicious .lnk files contain a link to a URL (instead of the expected local URI) to grab the next payload

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Rocke has used shell scripts which download mining executables and saves them with the filename "java".

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Monitor for newly constructed services/daemons through Windows event logs for event IDs 4697 and 7045.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: On Windows 8.1 and Windows Server 2012 R2, monitor Windows Logs for LSASS.exe creation to verify that LSASS started as a protected process.

Tactics: TA0006, TA0007
Techniques: T1033, T1003, T1003.001
Input: XAgentOSX contains the getFirefoxPassword function to attempt to locate Firefox passwords.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Operation Wocao has used PowerSploit's Invoke-Kerberoast module to request encrypted service tickets and bruteforce the passwords of Windows service accounts offline.

Tactics: TA0006
Techniques: T1558.003, T1558
Input: Threat Group-3390 actors use at to schedule tasks to run self-extracting RAR archives, which install HTTPBrowser or PlugX on other victims on a network.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: JHUHUGIT has registered a Windows shell script under the Registry key HKCU\Environment\UserInitMprLogonScript to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1037.001, T1037
Input: After running a virtual instance, adversaries may create a shared folder between the guest and host with permissions that enable the virtual instance to interact with the host file system.

Tactics: TA0005
Techniques: T1564, T1564.006
Input: Many native binaries may not be necessary within a given environment.

Tactics: TA0005
Techniques: T1218
Input: Imminent Monitor has a remote webcam monitoring capability.

Tactics: TA0009
Techniques: T1125
Input: BlackOasis's first stage shellcode contains a NOP sled with alternative instructions that was likely designed to bypass antivirus tools.

Tactics: TA0005
Techniques: T1027
Input: Data destruction is likely to render stored data irrecoverable by forensic techniques through overwriting files or data on local and remote drives.

Tactics: TA0040
Techniques: T1485
Input: InvisiMole can spread within a network via the BlueKeep (CVE-2019-0708) and EternalBlue (CVE-2017-0144) vulnerabilities in RDP and SMB respectively.

Tactics: TA0008
Techniques: T1210
Input: Though noisy, this data can be combined with other indicators to identify adversary activity.

Tactics: TA0002
Techniques: T1106
Input: Downdelph inserts pseudo-random characters between each original character during encoding of C2 network requests, making it difficult to write signatures on them.

Tactics: TA0011
Techniques: T1001.001, T1001
Input: Strings in the backdoor are encrypted using a custom algorithm that uses XOR with a 4-byte key

Tactics: TA0005, TA0011
Techniques: T1573, T1027
Input: Monitor for executed commands and arguments that may attempt to find domain-level groups and permission settings.

Tactics: TA0007
Techniques: T1069.002, T1069
Input: Next, it checks the running processes against a list of hard-coded process names; if any are found, the machine is forcefully rebooted

Tactics: TA0007
Techniques: T1057
Input: KRBTGT is the Kerberos Key Distribution Center (KDC) service account and is responsible for encrypting and signing all Kerberos tickets.

Tactics: TA0006
Techniques: T1558, T1558.001
Input: Comnie collects the hostname of the victim machine.

Tactics: TA0007
Techniques: T1082
Input: Hancitor has used CallWindowProc and EnumResourceTypesA to interpret and execute shellcode.

Tactics: TA0002
Techniques: T1106
Input: Ensure only authorized keys are allowed access to critical resources and audit access lists regularly.

Tactics: TA0006
Techniques: T1552.004, T1552
Input: Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing current scheduled tasks.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: BendyBear can load and execute modules and Windows Application Programming (API) calls using standard shellcode API hashing.

Tactics: TA0002
Techniques: T1106
Input: Filename  Part-II.doc    File Size  10156713 bytes    MD5  e32668e569362c96cc56db368b7e821e    SHA1  dadc493abbe3e21610539e1d5a42f523626a6132    Notes Malicious RTF document that exploits CVE-2017-8570 and drops QuasarRAT file mico-audio.exe

Tactics: TA0005
Techniques: T1036
Input: Xbash can obtain a webpage hosted on Pastebin to update its C2 domain list.

Tactics: TA0011
Techniques: T1102.001, T1102
Input: Monitor executed commands and arguments that may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: FruitFly saves itself with a leading "." to make it a hidden file.,TA0005,T1564.001
iKitten saves itself with a leading ""."" so that it's hidden from users by default.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Bazar can identify the installed antivirus engine.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Adversaries could also edit the target path or entirely replace an existing shortcut so their tools will be executed instead of the intended legitimate program.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Any crontab files are stored in operating system-specific file paths.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: The first detection of a malicious tool may trigger an anti-virus or other security tool alert.

Tactics: TA0005
Techniques: T1027, T1027.005
Input: The key differences in this variant:  Two CAB files are encoded into the Word document in text boxes instead of being appended in the DOC file There is one CAB file for an x86 system and another for an x64 system This malware sample uses uacme.exe with dummy.dll to implement the UAC bypass  exe is the program vulnerable to the UAC bypass attack dll runs install.bat to set up the service (same as NTWDBLIB.dll)   exe and dummy.dll may be either 64-bit or 32-bit binaries based on the OS

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Two prominent protocols that have enabled Reflection Amplification Floods are DNS and NTP, though the use of several others in the wild have been documented.

Tactics: TA0040
Techniques: T1498, T1498.002