madox81/Adema_ATTACK_DS huggingface dataset:
Input: TinyTurla has mimicked an existing Windows service by being installed as Windows Time Service.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Machete collects the MAC address of the target computer and other network configuration information.

Tactics: TA0007
Techniques: T1016
Input: FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on the local system.

Tactics: TA0009
Techniques: T1005
Input: On Windows, monitor Windows Task Scheduler stores in %systemroot%\System32\Tasks for change entries related to scheduled tasks, especially those that do not correlate with known software, patch cycles,  On Linux and macOS, all at jobs are stored in /var/spool/cron/atjobs/.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: Adversaries can use the autostart mechanism provided by LSA authentication packages for persistence by placing a reference to a binary in the Windows Registry location HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ with the key value of "Authentication Packages"=<target binary>.

Tactics: TA0003, TA0004
Techniques: T1547.002, T1547
Input: Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.

Tactics: TA0011
Techniques: T1090
Input: Taidoor has relied upon a victim to click on a malicious email attachment.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: It can continue tagging documents to collect with follow up scans.

Tactics: TA0009
Techniques: T1119
Input: FinFisher checks if the victim OS is 32 or 64-bit.

Tactics: TA0007
Techniques: T1082
Input: This may take the many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: This can be done without affecting the functionality or behavior of a binary, but can increase the size of the binary beyond what some security tools are capable of handling due to file size limitations.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: Administrators should audit all cloud and container accounts to ensure that they are necessary and that the permissions granted to them are appropriate.

Tactics: TA0005, TA0006, TA0008
Techniques: T1550.001, T1528, T1550
Input: If an adversary is able to obtain a set of valid domain credentials, they could login to many different machines using remote access protocols such as secure shell (SSH) or remote desktop protocol (RDP).

Tactics: TA0008
Techniques: T1021
Input: Monitor for commands, such as security add-trusted-cert (macOS) or certutil -addstore (Windows), that can be used to install root certificates.

Tactics: TA0005
Techniques: T1553, T1553.004
Input: Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting.

Tactics: TA0042
Techniques: T1608, T1608.002
Input: TLS callbacks are normally used by the OS to setup and/or cleanup data used by threads.

Tactics: TA0004, TA0005
Techniques: T1055.005, T1055
Input: PolyglotDuke can be executed using rundll32.exe.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: When used with frequently used network directories, the technique may result in frequent reinfections and broad access to systems and potentially to new and higher privileged accounts.

Tactics: TA0008
Techniques: T1080
Input: P8RAT can check for specific processes associated with virtual environments.

Tactics: TA0007
Techniques: T1057
Input: PlugX can be configured to use DNS for command and control.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Apply patch KB2871997 to Windows 7 and higher systems to limit the default access of accounts in the local administrator group.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: Darkhotel has used AES-256 and 3DES for C2 communications.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: jRAT can steal keys for VPNs and cryptocurrency wallets.

Tactics: TA0006
Techniques: T1552.004, T1552
Input: Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads.

Tactics: TA0005
Techniques: T1127
Input: Cryptoistic can gather data on the user of a compromised host.

Tactics: TA0007
Techniques: T1033
Input: Network DoS can be performed by exhausting the network bandwidth services rely on.

Tactics: TA0040
Techniques: T1498
Input: Carbon uses HTTP to send data to the C2 server.

Tactics: TA0010
Techniques: T1048.003, T1048
Input: Container administration service activities and executed commands can be captured through logging of process execution with command-line arguments on the container as well as within the underlying host.

Tactics: TA0002
Techniques: T1609
Input: Monitor executed commands and arguments containing indicators of obfuscation and known suspicious syntax such as uninterpreted escape characters like '''^''' and '''"'''.

Tactics: TA0005
Techniques: T1027
Input: SUPERNOVA had to receive an HTTP GET request containing a specific set of parameters in order to execute.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Adversaries may create a local account to maintain access to victim systems.

Tactics: TA0003
Techniques: T1136, T1136.001
Input: Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open attachments.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: GCMAN uses VNC for lateral movement.

Tactics: TA0008
Techniques: T1021.005, T1021
Input: DEATHRANSOM has the ability to use loop operations to enumerate network resources.

Tactics: TA0007
Techniques: T1135
Input: In many payment card data breaches, a point-of-sale (POS) system is infected with malware that searches for specific processes in memory known to store card data in plain text

Tactics: TA0009
Techniques: T1005
Input: Chimera has used net start and net use for system service discovery.

Tactics: TA0007
Techniques: T1007
Input: ZIRCONIUM targeted presidential campaign staffers with credential phishing e-mails.

Tactics: TA0043
Techniques: T1598
Input: The Trojan checks to see if the result of this query returned a class with more than 0 elements, which would most likely be true in a non-virtual environment

Tactics: TA0007
Techniques: T1018
Input: Cobalt Strike can perform pass the hash.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: Bandook is capable of taking an image of and uploading the current desktop.

Tactics: TA0009
Techniques: T1113
Input: Monitor access to Microsoft SharePoint repositories performed by privileged users (for example, Active Directory Domain, Enterprise, or Schema Administrators) should be closely monitored and alerted upon, as these types of accounts should generally not be used to access information repositories.

Tactics: TA0009
Techniques: T1213, T1213.002
Input: The QakBot payload has been disguised as a PNG file.

Tactics: TA0005
Techniques: T1036
Input: Machete is written in Python and is used in conjunction with additional Python scripts.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: TA551 has masked malware DLLs as dat and jpg files.

Tactics: TA0005
Techniques: T1036
Input: Adversaries may abuse Microsoft Outlook rules to obtain persistence on a compromised system.

Tactics: TA0003
Techniques: T1137, T1137.005
Input: Kerberos is an authentication protocol widely used in modern Windows domain environments.

Tactics: TA0006
Techniques: T1558
Input: KGH_SPY can execute PowerShell commands on the victim's machine.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows ( unauthorized, gratuitous, or anomalous traffic patterns attempting to access network configuration content)

Tactics: TA0009
Techniques: T1602, T1602.002
Input: Monitor for API calls that may attempt to hide artifacts associated with their behaviors to evade detection.

Tactics: TA0005
Techniques: T1564
Input: Detecting software exploitation may be difficult depending on the tools available.

Tactics: TA0001, TA0002, TA0004, TA0005, TA0006, TA0008
Techniques: T1210, T1203, T1211, T1212, T1190, T1068
Input: Each implant was given a "junk length" value when created, tracked by the controller software to allow seamless communication but prevent analysis of the command protocol on the wire.

Tactics: TA0011
Techniques: T1001.001, T1001
Input: ADVSTORESHELL has used rundll32.exe in a Registry value to establish persistence.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: For example, starting in MS Office 10, if a MS Office file has the MOTW, it will open in Protected View.

Tactics: TA0005
Techniques: T1553, T1553.005
Input: Lokibot has the ability to discover the username on the infected host.

Tactics: TA0007
Techniques: T1033
Input: Adversaries may modify and/or replace the Terminal Services DLL to enable persistent access to victimized hosts.

Tactics: TA0003
Techniques: T1505.005, T1505
Input: Monitor for suspicious account behavior across systems that share accounts, either user, admin, or service accounts.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.003, T1078.002
Input: Cobalt Strike can determine if the user on an infected machine is in the admin or domain admin group.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: Some rootkit protections may be built into anti-virus or operating system software.

Tactics: TA0005
Techniques: T1014
Input: Bandook has decoded its PowerShell script.

Tactics: TA0005
Techniques: T1140
Input: Ryuk has used vssadmin Delete Shadows /all /quiet to to delete volume shadow copies and vssadmin resize shadowstorage to force deletion of shadow copies created by third-party applications.

Tactics: TA0040
Techniques: T1490
Input: Furthermore, this group has routinely identified and exploited vulnerable web servers of targeted organizations to install web shells, such as ANTAK and ASPXSPY, and used stolen legitimate credentials to compromise externally facing Outlook Web Access (OWA) resources

Tactics: TA0003
Techniques: T1505.003, T1505
Input: An adversary must already be in a privileged user context ( administrator) to steal a token.

Tactics: TA0004, TA0005
Techniques: T1134
Input: RDAT can also download data from the C2 which is split into 81,920-byte portions.

Tactics: TA0010
Techniques: T1030
Input: Orz can perform Registry operations.

Tactics: TA0005
Techniques: T1112
Input: Monitoring the creation of (sub)keys within the Windows Registry may reveal malicious attempts to modify trust settings, such as the installation of root certificates.

Tactics: TA0005
Techniques: T1553
Input: CDNs may also allow organizations to customize content delivery based on the requestor’s geographical region.

Tactics: TA0043
Techniques: T1596, T1596.004
Input: MuddyWater has used malware to obtain a list of running processes on the system.

Tactics: TA0007
Techniques: T1057
Input: The first stage may have automated capabilities to collect basic host information, update tools, and upload additional files.

Tactics: TA0011
Techniques: T1104
Input: Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups.

Tactics: TA0003
Techniques: T1098
Input: pngdowner uses HTTP for command and control.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Monitor newly constructed processes that assist in lateral tool transfers.

Tactics: TA0008
Techniques: T1570
Input: APT41 used a compromised account to create a scheduled task on a system.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: The Bazar loader has used dual-extension executable files such as PreviewReport.DOC.exe.

Tactics: TA0005
Techniques: T1036, T1036.007
Input: APT3 has a tool that can obtain information about the local system.

Tactics: TA0007
Techniques: T1082
Input: Operation Wocao has discovered the local network configuration with ipconfig.

Tactics: TA0007
Techniques: T1016
Input: Patchwork used Visual Basic Scripts (VBS) on victim machines.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: APT32 established persistence using Registry Run keys, both to execute PowerShell and VBS scripts as well as to execute their backdoor directly.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: After encrypting C2 data, BADNEWS converts it into a hexadecimal representation and then encodes it into base64.

Tactics: TA0011
Techniques: T1132
Input: OwaAuth uses the filename owaauth.dll, which is a legitimate file that normally resides in %ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\Auth\; the malicious file by the same name is saved in %ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\bin\.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Depending on the implementation, adversaries may use infrastructure that makes it difficult to physically tie back to them as well as utilize infrastructure that can be rapidly provisioned, modified, and shut down.

Tactics: TA0042
Techniques: T1583
Input: Monitor for user accounts logged into systems that may use Valid Accounts to remotely control machines using Virtual Network Computing (VNC).

Tactics: TA0008
Techniques: T1021.005, T1021
Input: APT38 has used cron to create pre-scheduled and periodic background jobs on a Linux system.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: It was heavily modified, with almost all original code stripped out aside from its sekurlsa::logonpasswords credential stealing feature

Tactics: TA0006
Techniques: T1003
Input: Remote Service Session Hijacking differs from use of Remote Services because it hijacks an existing session rather than creating a new session using Valid Accounts.

Tactics: TA0008
Techniques: T1563
Input: Adversaries may establish persistence by executing malicious content triggered by the execution of tainted binaries.

Tactics: TA0003, TA0004
Techniques: T1546.006, T1546
Input: APT-C-36 has used spearphishing emails with password protected RAR attachment to avoid being detected by the email gateway.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Configure user permissions groups and roles for access to cloud storage.

Tactics: TA0009
Techniques: T1530
Input: Avoid PowerShell profiles if not needed.

Tactics: TA0003, TA0004
Techniques: T1546.013, T1546
Input: IronNetInjector can obfuscate variable names, encrypt strings, as well as base64 encode and Rijndael encrypt payloads.

Tactics: TA0005
Techniques: T1027
Input: Koadic can retrieve the current content of the user clipboard.

Tactics: TA0009
Techniques: T1115
Input: Credential Lockers store credentials in encrypted .vcrd files, located under %Systemdrive%\Users\[Username]\AppData\Local\Microsoft\[Vault/Credentials]\.

Tactics: TA0006
Techniques: T1555, T1555.004
Input: LockerGoga has been observed moving around the victim network via SMB, indicating the actors behind this ransomware are manually copying files form computer to computer instead of self-propagating.

Tactics: TA0008
Techniques: T1570
Input: MirageFox can collect CPU and architecture information from the victim’s machine.

Tactics: TA0007
Techniques: T1082
Input: APT32 used Mimikatz and customized versions of Windows Credential Dumper to harvest credentials.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Maze operators have created scheduled tasks masquerading as "Windows Update Security", "Windows Update Security Patches", and "Google Chrome Security Update" designed to launch the ransomware.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Lucifer can download and execute a replica of itself using certutil.

Tactics: TA0011
Techniques: T1105
Input: Night Dragon has used several remote administration tools as persistent infiltration channels.

Tactics: TA0011
Techniques: T1219
Input: Adversaries can take advantage of paths that lack surrounding quotations by placing an executable in a higher level directory within the path, so that Windows will choose the adversary's executable to launch.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.009, T1574
Input: BitPaymer can use the RegEnumKeyW to iterate through Registry keys.

Tactics: TA0007
Techniques: T1012
Input: Dtrack can collect the host's IP addresses using the ipconfig command.

Tactics: TA0007
Techniques: T1016
Input: HermeticWiper can create system services to aid in executing the payload.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: The .NET method GetAllTrustRelationships() can be an indicator of Domain Trust Discovery.

Tactics: TA0007
Techniques: T1482
Input: Turla has used the Registry to store encrypted payloads.

Tactics: TA0005
Techniques: T1112
Input: SUNBURST collected a list of process names that were hashed using a FNV-1a + XOR algorithm to check against similarly-hashed hardcoded blocklists.

Tactics: TA0007
Techniques: T1057
Input: In cloud environments, storage objects within compromised accounts may also be encrypted.

Tactics: TA0040
Techniques: T1486
Input: APT29 used 7-Zip to decode its Raindrop malware.

Tactics: TA0005
Techniques: T1140
Input: Restrict administrator accounts to as few individuals as possible, following least privilege principles.

Tactics: TA0003, TA0005, TA0006
Techniques: T1601, T1556, T1556.004, T1601.001
Input: Figure 2: Process chain for the first part of the campaign Although the actual VBS script changed from sample to sample, with different levels of obfuscation and different ways of invoking the next stage of process tree, its final purpose remained same: invoking PowerShell to decode the Base64 encoded PowerShell command in the INI file that was dropped earlier by the macro, and executing it

Tactics: TA0007
Techniques: T1057
Input: Bazar can execute a PowerShell script received from C2.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Look for mshta.exe executing raw or obfuscated script within the command-line.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: DDKONG downloads and uploads files on the victim’s machine.

Tactics: TA0011
Techniques: T1105
Input: Opening document starts a template injection technique for loading the document template from the internet.

Tactics: TA0005
Techniques: T1221
Input: wbadmin.exe can be used to delete the Windows Backup Catalog - wbadmin.exe delete catalog -quiet

Tactics: TA0040
Techniques: T1490
Input: APT19 configured its payload to inject into the rundll32.exe.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Monitor interactions with images and containers by users to identify ones that are added anomalously.

Tactics: TA0003
Techniques: T1525
Input: REvil can launch an instance of itself with administrative rights using runas.

Tactics: TA0004, TA0005
Techniques: T1134.002, T1134
Input: Vasport can download files.

Tactics: TA0011
Techniques: T1105
Input: MuddyWater has performed credential dumping with LaZagne and other tools, including by dumping passwords saved in victim email.

Tactics: TA0006
Techniques: T1555
Input: After the process is spawned and the PEB is initialized (and process information is potentially logged by tools/sensors), adversaries may override the PEB to modify the command-line arguments (ex: using the Native API WriteProcessMemory() function) then resume process execution with malicious arguments.

Tactics: TA0005
Techniques: T1564.010, T1564
Input: The CHIPSEC framework can be used for analysis to determine if firmware modifications have been performed.

Tactics: TA0003, TA0005
Techniques: T1542.001, T1542
Input: EvilGrab has the capability to capture keystrokes.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Gorgon Group malware can use process hollowing to inject one of its trojans into another process.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: Turla has used WebDAV to upload stolen USB files to a cloud drive.

Tactics: TA0010
Techniques: T1567.002, T1567
Input: Clambling has the ability to capture and store clipboard data.

Tactics: TA0009
Techniques: T1115
Input: BLUELIGHT can collect process filenames and SID authority level.

Tactics: TA0007
Techniques: T1057
Input: Windshift has used tools that communicate with C2 over HTTP.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: POWERSTATS can disable Microsoft Office Protected View by changing Registry keys.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Those assignments were not likely arbitrary, as this group had developed BlackEnergy2 for several years in a professional and organized style:  Config with a similar set of plugins for different architectures Here is the list of retrieved files and related functionality:    weap DDoS Attack (various types)   ps password stealer handling a variety of network protocols (SMTP, POP3, IMAP, HTTP, FTP, Telnet)   nm scans ports, stores banners   snif logs IP source and destination, TCP/UDP ports   hook main module: CnC communication, config parser, plugins loader   uper rewrites hook module with a new version and launches it     Weap, Snif, Nm plugin grammar mistakes and mis-spellings The developers’ coding style differed across the ‘Hook’ main module, the plugins, and the Windows main.dll

Tactics: TA0007
Techniques: T1046
Input: Rising Sun can archive data using RC4 encryption and Base64 encoding prior to exfiltration.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: After decrypting and decompressing the strings, we can trivially identify aspects of the PlugX configuration

Tactics: TA0005
Techniques: T1140, T1027
Input: A Cloud Access Security Broker can also be used to ban applications.

Tactics: TA0006
Techniques: T1528
Input: H1N1 has functionality to copy itself to removable media.

Tactics: TA0001, TA0008
Techniques: T1091
Input: Within macOS environments, adversaries may use the native Bonjour application to discover services running on other macOS hosts within a network.

Tactics: TA0007
Techniques: T1046
Input: Restrict access to the authorized_keys file.

Tactics: TA0003
Techniques: T1098.004, T1098
Input: PowerSploit contains a collection of Exfiltration modules that can access data from local files, volumes, and processes.

Tactics: TA0009
Techniques: T1005
Input: Another variation, commonly referred to as API hammering, involves making various calls to Native API functions in order to delay execution (while also potentially overloading analysis environments with junk data).

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Sliver can use mutual TLS and RSA  cryptography to exchange a session key.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: APT33 has used VBScript to initiate the delivery of payloads.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Monitor for files being accessed that could be related to exfiltration, such as file reads by a process that also has an active network connection.

Tactics: TA0010
Techniques: T1011.001, T1011
Input: Okrum establishes persistence by creating a .lnk shortcut to itself in the Startup folder.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Leviathan has created new email accounts for targeting efforts.

Tactics: TA0042
Techniques: T1585, T1585.002
Input: TSCookie can use ICMP to receive information on the destination server.

Tactics: TA0011
Techniques: T1095
Input: MoleNet can achieve persitence on the infected machine by setting the Registry run key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: By applying two specific obfuscation techniques within Invoke-Obfuscation, we were able to create an obfuscated PowerShell script that was very similar to the QUADAGENT payloads delivered in the attacks discussed in this blog

Tactics: TA0005
Techniques: T1027