madox81/Adema_ATTACK_DS huggingface dataset:
Input: The information gathered is added to a string in the following structure: <IP address>|<computer name>|<domain>|<username>|<isAdmin flag>|<hasGarbage flag from config>|<hasStartup flag from config>|<“hybrid” mode flag from config>|<sleep interval from config>|<jitter value from config> The payload will base64 encode this string and use its DNS tunneling protocol to transmit the data to the C2

Tactics: TA0007
Techniques: T1033, T1016
Input: ZxShell can leverage native API including RegisterServiceCtrlHandler  to register a service.RegisterServiceCtrlHandler

Tactics: TA0002
Techniques: T1106
Input: menuPass has used a global service provider's IP as a proxy for C2 traffic from a victim.

Tactics: TA0011
Techniques: T1090, T1090.002
Input: Duqu can be configured to have commands relayed over a peer-to-peer network of infected hosts if some of the hosts do not have Internet access.

Tactics: TA0011
Techniques: T1090.001, T1090
Input: Dragonfly has added the registry value ntdll to the Registry Run key to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Aria-body has the ability to execute a process using runas.

Tactics: TA0004, TA0005
Techniques: T1134.002, T1134
Input: Monitor for an extracted list of available firewalls and/or their associated settings/rules (ex: Azure Network Firewall CLI Show commands)

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Adversaries may clear system logs to hide evidence of an intrusion.

Tactics: TA0005
Techniques: T1070, T1070.002
Input: SCT File Analysis The code of the Defender.sct file is an obfuscated JavaScript

Tactics: TA0002, TA0005
Techniques: T1027, T1059
Input: GoldMax has used filenames that matched the system name, and appeared as a scheduled task impersonating systems management software within the corresponding ProgramData subfolder.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: StrongPity can add directories used by the malware to the Windows Defender exclusions list to prevent detection.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Caterpillar WebShell can obtain a list of the services from a system.

Tactics: TA0007
Techniques: T1007
Input: Honeybee gathers a list of processes using the tasklist command and then is sent back to the control server.

Tactics: TA0007
Techniques: T1057
Input: Original File Name Translation Decoy Location Most Likely Target   1060315 本部發言參考.doc 1060315 Headquarters Speech Reference.doc Defense Industry Development Strategy TW Defense   轉給苦逼的網管兄弟.doc Passing to cool fellow network administrators.doc Network administration jokes TW High Tech Telecommunication     2.SC OAM Firewall Policy_0306.xls 2.SC OAM Firewall Policy_0306.xls Network topology diagrams TW High Tech Telecommunication       Figure 3 Decoy document discussing Taiwan’s defense industry development strategy  Figure 4 Network firewall configuration description for a telecommunication company in Taiwan    Figure 5 Decoy document providing network topology information   It is worth noting that in the attack that made use of the decoy document in Figure 4, the attacker also included related firewall logs and appears to have originated from a compromised an IT service vendor

Tactics: TA0005, TA0008
Techniques: T1021, T1021.002, T1562.001, T1562
Input: The OopsIE payload checks to see if the result of this query as more than 0 elements to determine if it is running on a virtual machine

Tactics: TA0005, TA0007
Techniques: T1497
Input: NotPetya searches for files ending with dozens of different file extensions prior to encryption.

Tactics: TA0007
Techniques: T1083
Input: PoisonIvy also creates a Registry entry modifying the Logical Disk Manager service to point to a malicious DLL dropped to disk.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Devices in a local network segment communicate with each other by using link layer addresses.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.002
Input: DHS and FBI recommend that network administrators review the IP addresses, file hashes, network signatures, and YARA rules provided, and add the IPs to their watchlist to determine whether malicious activity has been observed within their organization.When reviewing network perimeter logs for the IP addresses, organizations may find numerous instances of these IP addresses attempting to connect to their systems

Tactics: TA0007
Techniques: T1016
Input: Nerex drops a signed Microsoft DLL to disk.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Monitor for API calls associated with polling to intercept keystrokes.

Tactics: TA0006
Techniques: T1111
Input: Carberp has removed various hooks before installing the trojan or bootkit to evade sandbox analysis or other analysis software.

Tactics: TA0005, TA0007
Techniques: T1497
Input: Proxysvc lists files in directories.

Tactics: TA0007
Techniques: T1083
Input: Are the attackers using any zero-day vulnerabilities? No zero-day vulnerabilities have been found in the analysis of the samples obtained regarding this campaign

Tactics: TA0004
Techniques: T1068
Input: POWRUNER may collect user account information by running net user /domain or a series of other commands on a victim.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: JavaScript for Automation (JXA) is a macOS scripting language based on JavaScript, included as part of Apple’s Open Scripting Architecture (OSA), that was introduced in OSX 10.10.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Continuing Malicious Activity and Manipulating Additional Security Products After the module loads with regsvr32.exe, the Irdsnhrxxxfery64 module injects another module Irdsnhrxxxfery98, which was downloaded by the script into regsvr32.exe using the LoadLibraryExW() function

Tactics: TA0004, TA0005
Techniques: T1218, T1055, T1218.010
Input: Monitor network traffic content for evidence of data exfiltration, such as gratuitous or anomalous outbound traffic containing collected data.

Tactics: TA0010
Techniques: T1020
Input: Then, adversaries may create custom consoles with the "Link to Web Address" snap-in that is linked to the malicious CLSID subkey.

Tactics: TA0005
Techniques: T1218, T1218.014
Input: TAINTEDSCRIBE can change the timestamp of specified filenames.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: SEASHARPEE is a Web shell.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Efforts may need to be tailored to specific domains of interest as benign registration and resolution changes are a common occurrence on the internet.

Tactics: TA0042
Techniques: T1584.001, T1584
Input: Kimsuky has downloaded additional scripts, tools, and malware onto victim systems.

Tactics: TA0011
Techniques: T1105
Input: Indrik Spider has used PowerView to enumerate all Windows Server, Windows Server 2003, and Windows 7 instances in the Active Directory database.

Tactics: TA0007
Techniques: T1018
Input: Adversaries can use this information to determine the potential value of databases and discover the requirements to access them.

Tactics: TA0007
Techniques: T1580
Input: If exploitation is successful, then it will give the adversary code execution on the user's system unless other protections are in place.In some cases a second visit to the website after the initial scan is required before exploit code is delivered.

Tactics: TA0001
Techniques: T1189
Input: Sandworm Team has researched software code to enable supply-chain operations, most notably for the 2017 NotPetya attack.

Tactics: TA0043
Techniques: T1592, T1592.002
Input: This will prompt for a password for installation and also log the attempt.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.010, T1574
Input: A Gamaredon Group file stealer can gather the victim's computer name and drive serial numbers to send to a C2 server.

Tactics: TA0007
Techniques: T1082
Input: There are many ways to perform UAC bypasses when a user is in the local administrator group on a system, so it may be difficult to target detection on all variations.

Tactics: TA0004, TA0005
Techniques: T1548
Input: Note: CTU researchers frequently observe threat actors renaming archiving tools and storing data for exfiltration in uncommon directories

Tactics: TA0011
Techniques: T1132
Input: One TYPEFRAME variant decrypts an archive using an RC4 key, then decompresses and installs the decrypted malicious DLL module.

Tactics: TA0005
Techniques: T1140
Input: Environment variables, aliases, characters, and other platform/language specific semantics can be used to evade signature based detections and application control mechanisms.

Tactics: TA0005
Techniques: T1027
Input: Patchwork has obtained and used open-source tools such as QuasarRAT.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Monitor executed commands and arguments that may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.010
Input: Gamaredon Group has deployed scripts on compromised systems that automatically scan for interesting documents.

Tactics: TA0009
Techniques: T1119
Input: RTM strings, network data, configuration, and modules are encrypted with a modified RC4 algorithm.

Tactics: TA0005
Techniques: T1027
Input: FIN10 has executed malicious .bat files containing PowerShell commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Carberp can capture display screenshots with the screens_dll.dll plugin.

Tactics: TA0009
Techniques: T1113
Input: Kessel has maliciously altered the OpenSSH binary on targeted systems to create a backdoor.

Tactics: TA0003
Techniques: T1554
Input: Any application or user with write permissions to the file can change or strip the quarantine flag.

Tactics: TA0005
Techniques: T1553.001, T1553
Input: Windshift has used string encoding with floating point calculations.

Tactics: TA0005
Techniques: T1027
Input: The different components of Machete are executed by Windows Task Scheduler.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Dyre has been delivered with encrypted resources and must be unpacked for execution.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Unique User-Agents The unique User-Agents used in the HTTP communication between SpeakUp to the C&C are a possible path to the identity of the threat actor behind this campaign

Tactics: TA0007
Techniques: T1033
Input: Emotet has been delivered by phishing emails containing links.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Exfiltrate data using HTTP over HTTP over AES over XOR, or any combination of the available transports

Tactics: TA0011
Techniques: T1071
Input: ROKRAT can list the current running processes on the system.

Tactics: TA0007
Techniques: T1057
Input: Steganographic techniques can be used to hide data in digital messages that are transferred between systems.

Tactics: TA0011
Techniques: T1001, T1001.002
Input: Leviathan relies on web shells for an initial foothold as well as persistence into the victim's systems.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Astaroth collects data in a plaintext file named r1.log before exfiltration.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Adversaries may employ various time-based evasions, such as delaying malware functionality upon initial execution using programmatic sleep commands or native system scheduling functionality (ex: Scheduled Task/Job).

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: BLINDINGCAN has been delivered by phishing emails containing malicious Microsoft Office documents.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: Adversaries can use the network CLI to change how network devices behave and operate.

Tactics: TA0002
Techniques: T1059.008, T1059
Input: Turla has used PowerShell profiles to maintain persistence on an infected machine.

Tactics: TA0003, TA0004
Techniques: T1546.013, T1546
Input: Leafminer used a tool called Total SMB BruteForcer to perform internal password spraying.

Tactics: TA0006
Techniques: T1110, T1110.003
Input: After decrypting the strings, they must be further decompressed using LZNT1

Tactics: TA0005
Techniques: T1140
Input: Hikit has attempted to disable driver signing verification by tampering with several Registry keys prior to the loading of a rootkit driver component.

Tactics: TA0005
Techniques: T1553, T1553.006
Input: In MacOS, plist files are ASCII text files with a specific format, so they're relatively easy to parse.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: System and network discovery techniques normally occur throughout an operation as an adversary learns the environment, and also to an extent in normal network operations.

Tactics: TA0007
Techniques: T1087.002, T1087, T1087.004, T1087.001
Input: Once the tampered function is invoked, the malicious payload will be triggered.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.013, T1574
Input: Domains provide centralized identity management, allowing users to login using one set of credentials across the entire network.

Tactics: TA0008
Techniques: T1021
Input: Wizard Spider has used macros to execute PowerShell scripts to download malware on victim's machines.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Malicious modifications to NAT may enable an adversary to bypass restrictions on traffic routing that otherwise separate trusted and untrusted networks.

Tactics: TA0005
Techniques: T1599, T1599.001
Input: Monitor for an attempt by a user to gain access to a network or computing resource by providing web credentials (ex: Windows EID 1202) that may use alternate authentication material, such as password hashes, Kerberos tickets, and application access tokens, in order to move laterally within an environment and bypass normal system access controls.

Tactics: TA0005, TA0008
Techniques: T1550
Input: RTM can delete all Registry entries created during its execution.

Tactics: TA0005
Techniques: T1112
Input: Cuba has used several built-in API functions for discovery like GetIpNetTable and NetShareEnum.

Tactics: TA0002
Techniques: T1106
Input: If the mutex does not exist and a Windows Startup Registry key with name “System Update” does not exist, the malware performs its initialization routine by:  Copying itself to the path %PROGRAMDATA%\svchost.exe Sets the Windows Startup Registry key with the name “System Update” which points to the above dropped payload

Tactics: TA0003, TA0004, TA0005
Techniques: T1547.001, T1547, T1112
Input: Wordlists used in these scans may contain generic, commonly used names and file extensions or terms specific to a particular software.

Tactics: TA0043
Techniques: T1595.003, T1595
Input: Windows Management Instrumentation can be used to delete volume shadow copies - wmic shadowcopy delete

Tactics: TA0040
Techniques: T1490
Input: Monitor for changes made to firewall rules that might allow remote communication over protocols such as SMD and RDP.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: MiniDuke uses HTTP and HTTPS for command and control.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Cuba can retrieve the ARP cache from the local system by using GetIpNetTable.

Tactics: TA0007
Techniques: T1016
Input: Monitor for newly constructed processes and/or command-lines that may abuse mechanisms to evade defenses, such as those blocking processes spawning directly from Office documents, and analysis targeting unusual/potentially malicious parent-child process relationships, such as spoofing the PPID of PowerShell/Rundll32 to be explorer.exe

Tactics: TA0004, TA0005
Techniques: T1134.004, T1134
Input: RDAT can use HTTP communications for C2, as well as using the WinHTTP library to make requests to the Exchange Web Services API.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: MirageFox has a function for decrypting data containing C2 configuration information.

Tactics: TA0005
Techniques: T1140
Input: TEMP.Veles has planted Web shells on Outlook Exchange servers.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: This is consistent with most espionage-motivated adversaries, as once the adversary gains access via legitimate credentials, they are able to masquerade as a legitimate user and essentially become an insider threat

Tactics: TA0005
Techniques: T1036
Input: BRONZE BUTLER has used a tool to capture screenshots.

Tactics: TA0009
Techniques: T1113
Input: It will:  Download and execute the backdoor component Replace the content of the downloader Mach-O executable with a decoy, either using a base64-encoded embedded file or by downloading it from the internet Open a decoy document (described later) Close the Terminal window that just opened  The decoy document replaces the downloader Mach-O file, which means the malicious executable is only present in the ZIP file now

Tactics: TA0011
Techniques: T1105
Input: Conficker downloads an HTTP server to the infected machine.

Tactics: TA0011
Techniques: T1105
Input: Grandoreiro has infected victims via malicious attachments.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Chimera has encapsulated Cobalt Strike's C2 protocol in DNS and HTTPS.

Tactics: TA0011
Techniques: T1572
Input: Diavol will terminate services using the Service Control Manager (SCM) API.

Tactics: TA0040
Techniques: T1489
Input: TEMP.Veles has used compromised VPN accounts.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: Monitor for suspicious network traffic that could be indicative of probing for email addresses and/or usernames, such as large/iterative quantities of authentication requests originating from a single source (especially if the source is known to be associated with an adversary/botnet).

Tactics: TA0043
Techniques: T1589.002, T1589
Input: Empire is capable of capturing screenshots on Windows and macOS systems.

Tactics: TA0009
Techniques: T1113
Input: USBStealer drops commands for a second victim onto a removable media drive inserted into the first victim, and commands are executed when the drive is inserted into the second victim.

Tactics: TA0011
Techniques: T1092
Input: A Lazarus Group malware sample performs reflective DLL injection.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Monitor for changes made to the checksum of the operating system file and verifying the image of the operating system in memory.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.004
Input: Kessel can download additional modules from the C2 server.

Tactics: TA0011
Techniques: T1105
Input: XAgentOSX contains the showBackupIosFolder function to check for IOS device backups by running ls -la ~/Library/Application\ Support/MobileSync/Backup/.

Tactics: TA0007
Techniques: T1083
Input: PAM components, such as pam_unix.so, can be patched to accept arbitrary adversary supplied values as legitimate credentials.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.003, T1556
Input: TEMP.Veles utilized RDP throughout an operation.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: With the exception of the ‘Speed’ method previously mentioned, the names of the methods called in this chain appear to be fairly random, as seen in the following list:    ETransaksi.Speed ETransaksi.diomadnfagaghagh ETransaksi.fjcsERIfjfiojsGHIsdifjksi ETransaksi.gsgjIDJIGJIGJIGJIFDOSpl ETransaksi.FJaioefgkaoeK    The last two methods in the chain carry out a majority of the first payload’s functionality

Tactics: TA0007
Techniques: T1083
Input: WarzoneRAT can use a variety of API calls on a compromised host.

Tactics: TA0002
Techniques: T1106
Input: Monitor executed commands and arguments that may search the Registry on compromised systems for insecurely stored credentials.

Tactics: TA0006
Techniques: T1552, T1552.002
Input: Bandook is capable of spawning a Windows command shell.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Aria-body has established persistence via the Startup folder or Run Registry key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Conficker scans for other machines to infect.

Tactics: TA0007
Techniques: T1046
Input: TrailBlazer has used random identifier strings to obscure its C2 operations and result codes.

Tactics: TA0011
Techniques: T1001.001, T1001
Input: S-Type primarily uses port 80 for C2, but falls back to ports 443 or 8080 if initial communication fails.

Tactics: TA0011
Techniques: T1008
Input: The Clambling dropper can use PowerShell to download the malware.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: After a container file is extracted and/or mounted, the files contained within them may be treated as local files on disk and run without protections.

Tactics: TA0005
Techniques: T1553, T1553.005
Input: PowerShell scripts also exist that contain credential dumping functionality, such as PowerSploit's Invoke-Mimikatz module, which may require additional logging features to be configured in the operating system to collect necessary information for analysis.Detection of compromised /techniques/T1078 in-use by adversaries may help as well.

Tactics: TA0006
Techniques: T1003, T1003.005
Input: Figure 3: The first step of decryption will perform XOR on one byte using the previous adjacent byte, starting from the last byte and excluding the first byte  Figure 4: The second step uses RC4, using the first 0x20 bytes from the result of the first step as the RC4 key  Figure 5: Encrypted (Top) and decrypted (bottom) configuration file It is also important to note that while the loader component and the configuration file are located in the same directory (%windows%\system32), the encrypted backdoor is located in a different directory (%Program Files%\Common Files\System\ado)

Tactics: TA0005
Techniques: T1027
Input: Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

Tactics: TA0003, TA0004
Techniques: T1547.008, T1547
Input: Identify and block potentially malicious software executed through regsvr32 functionality by using application control  tools, like Windows Defender Application Control, AppLocker,   or Software Restriction Policies  where appropriate.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: SYSCON has been executed by luring victims to open malicious e-mail attachments.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Externally-facing websites are a common victim of defacement; often targeted by adversary and hacktivist groups in order to push a political message or spread propaganda.

Tactics: TA0040
Techniques: T1491.002, T1491
Input: WhisperGate can corrupt files by overwriting the first 1 MB with 0xcc and appending random extensions.

Tactics: TA0040
Techniques: T1485
Input: Monitor executed commands and arguments that may execute their own malicious payloads by hijacking the way operating systems run programs.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574
Input: LoudMiner has set the attributes of the VirtualBox directory and VBoxVmService parent directory to "hidden".

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Update software regularly by employing patch management for externally exposed applications.

Tactics: TA0001
Techniques: T1190
Input: Adversaries may attempt to bypass multi-factor authentication (MFA) mechanisms and gain access to accounts by generating MFA requests sent to users.

Tactics: TA0006
Techniques: T1621
Input: Adversaries may use task scheduling to execute programs at system startup or on a scheduled basis for persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053
Input: TURNEDUP is capable of injecting code into the APC queue of a created Rundll32 process as part of an "Early Bird injection."

Tactics: TA0004, TA0005
Techniques: T1055.004, T1055