madox81/Adema_ATTACK_DS huggingface dataset:
Input: APT33 has attempted to exploit a known vulnerability in WinRAR (CVE-2018-20250), and attempted to gain remote code execution via a security bypass vulnerability (CVE-2017-11774).

Tactics: TA0002
Techniques: T1203
Input: Silence has deleted artifacts, including scheduled tasks, communicates files from the C2 and other logs.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Cobalt Strike can start a VNC-based remote desktop server and tunnel the connection through the already established C2 channel.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Additional logging may need to be configured to gather the appropriate data.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.011, T1574
Input: Kwampirs uses a large list of C2 servers that it cycles through until a successful connection is established.

Tactics: TA0011
Techniques: T1008
Input: Adversaries can use stolen session cookies to authenticate to web applications and services.

Tactics: TA0005, TA0008
Techniques: T1550.004, T1550
Input: Asymmetric encryption algorithms are those that use different keys on each end of the channel.

Tactics: TA0010
Techniques: T1048.002, T1048
Input: For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files.

Tactics: TA0002
Techniques: T1204.002, T1204, T1204.001
Input: Local Machine Hive: reg query HKLM /f password /t REG_SZ /s

Tactics: TA0006
Techniques: T1552, T1552.002
Input: AuditCred can search through folders and files on the system.

Tactics: TA0007
Techniques: T1083
Input: 4H RAT sends an OS version identifier in its beacons.

Tactics: TA0007
Techniques: T1082
Input: Gazer stores configuration items in alternate data streams (ADSs) if the Registry is not accessible.

Tactics: TA0005
Techniques: T1564, T1564.004
Input: ROADTools can enumerate Azure AD users.

Tactics: TA0007
Techniques: T1087, T1087.004
Input: Adversaries may also conduct Change Default File Association and Masquerading to cause a similar effect.

Tactics: TA0040
Techniques: T1565.003, T1565
Input: InvisiMole InvisiMole can identify proxy servers used by the victim and use them for C2 communication.

Tactics: TA0011
Techniques: T1090, T1090.002
Input: Sowbug extracted documents and bundled them into a RAR archive.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: OilRig has used DNS for C2 including the publicly available requestbin.net tunneling service.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: PoisonIvy creates a Registry subkey that registers a new system device.

Tactics: TA0005
Techniques: T1112
Input: Disable Office add-ins.

Tactics: TA0003
Techniques: T1137, T1137.001
Input: Changes to a user's preference will occur under this entry's subkeys.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.001
Input: Compromised access tokens may be used as an initial step in compromising other services.

Tactics: TA0005, TA0008
Techniques: T1550.001, T1550
Input: A Network DoS will occur when the bandwidth capacity of the network connection to a system is exhausted due to the volume of malicious traffic directed at the resource or the network connections and network devices the resource relies on.

Tactics: TA0040
Techniques: T1498
Input: Monitor for malicious usage of system calls, such as ptrace and mmap, that can be used to attach to, manipulate memory, then redirect a processes' execution path.

Tactics: TA0004, TA0005
Techniques: T1055.014, T1055
Input: Adversaries may also use compromised websites to deliver a user to a malicious application designed to Steal Application Access Tokens, like OAuth tokens, to gain access to protected applications and information.

Tactics: TA0001
Techniques: T1189
Input: Train users to be aware of the existence of malicious images and how to avoid deploying instances and containers from them.

Tactics: TA0002
Techniques: T1204.003, T1204
Input: Monitor for file activity (creations, downloads, modifications, ), especially for file types that are not typical within an environment and may be indicative of adversary activity.

Tactics: TA0005
Techniques: T1218
Input: Dragonfly has gathered hashed user credentials over SMB using spearphishing attachments with external resource links and by modifying .LNK file icon resources to collect credentials from virtualized systems.

Tactics: TA0006
Techniques: T1187
Input: Some Felismus samples use a custom method for C2 traffic that utilizes Base64.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Malicious modifications to network devices to enable traffic redirection may be possible through ROMMONkit or Patch System Image.

Tactics: TA0010
Techniques: T1020.001, T1020
Input: Azorult can steal credentials from the victim's browser.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Code signing provides a level of authenticity for a program from the developer and a guarantee that the program has not been tampered with.

Tactics: TA0042
Techniques: T1587.002, T1588, T1587, T1588.003
Input: Orz can gather victim proxy information.

Tactics: TA0007
Techniques: T1016
Input: Adversaries may abuse VNC to perform malicious actions as the logged-on user such as opening documents, downloading files, and running arbitrary commands.

Tactics: TA0008
Techniques: T1021.005, T1021
Input: Babuk can use ChaCha8 and ECDH to encrypt data.

Tactics: TA0040
Techniques: T1486
Input: For example, on a Windows system adversaries may attempt to infer the language of a system by querying the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language or parsing the outputs of Windows API functions GetUserDefaultUILanguage, GetSystemDefaultUILanguage, GetKeyboardLayoutList and GetUserDefaultLangID.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: Audit all Kerberos authentication and credential use events and review for discrepancies.

Tactics: TA0005, TA0008
Techniques: T1550.003, T1550
Input: NativeZone can check for the presence of KM.EkeyAlmaz1C.dll and will halt execution unless it is in the same directory as the rest of the malware's components.

Tactics: TA0005
Techniques: T1480
Input: Monitor for newly constructed windows registry keys that may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence.

Tactics: TA0003, TA0004
Techniques: T1543
Input: Malicious software may also be injected into a trusted process to gain elevated privileges without prompting a user.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: GoldenSpy has established persistence by running in the background as an autostart service.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: The Citrix executable was dropped along with BBSRAT by the dropper.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: Monitor processes for abnormal behavior indicative of DDE abuse, such as Microsoft Office applications loading DLLs and other modules not typically associated with the application or these applications spawning unusual processes (such as cmd.exe).

Tactics: TA0002
Techniques: T1559, T1559.002
Input: Monitor and analyze network traffic associated with data replication (such as calls to DrsAddEntry, DrsReplicaAdd, and especially GetNCChanges) between DCs as well as to/from non DC hosts.

Tactics: TA0005
Techniques: T1207
Input: Hildegard has disguised itself as a known Linux process.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: BADCALL modifies the firewall Registry key SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfileGloballyOpenPorts\List.

Tactics: TA0005
Techniques: T1112
Input: PLATINUM is capable of using Windows hook interfaces for information gathering such as credential access.

Tactics: TA0006, TA0009
Techniques: T1056.004, T1056
Input: They extend the functionality of the kernel without the need to reboot the system.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: This activity is distinct from typical Virtualization/Sandbox Evasion.

Tactics: TA0005
Techniques: T1480, T1480.001
Input: FIN6 has used Registry Run keys to establish persistence for its downloader tools known as HARDTACK and SHIPBREAD.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: The SAM is a database file that contains local accounts for the host, typically those found with the net user command.

Tactics: TA0006
Techniques: T1003, T1003.002
Input: APT32 has deployed tools after moving laterally using administrative accounts.

Tactics: TA0008
Techniques: T1570
Input: TA505 has used stolen domain admin accounts to compromise additional hosts.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.002
Input: NetTraveler contains a keylogger.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: TSCookie has the ability to upload and download files to and from the infected host.

Tactics: TA0011
Techniques: T1105
Input: Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise.

Tactics: TA0011
Techniques: T1102.001, T1102.002, T1102.003, T1102
Input: APT29 can create new users through Azure AD.

Tactics: TA0003
Techniques: T1136, T1136.003
Input: Rocke can detect a running process's PID on the infected machine.

Tactics: TA0007
Techniques: T1057
Input: Monitor for contextual data about a file, which may include information such as name, the content (ex: signature, headers, or data/media), user/ower, permissions may set files and directories to be hidden to evade detection mechanisms.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: APT28 has downloaded additional files, including by using a first-stage downloader to contact the C2 server to obtain the second-stage implant.

Tactics: TA0011
Techniques: T1105
Input: The following are the three files:   Defender.sct – The malicious JavaScript based scriptlet file

Tactics: TA0002
Techniques: T1059
Input: We have observed the following capabilities of this payload:  Get drive information Read files Write files Delete files Move files Spawn processes Create directories   Reaver TCP Payload The malicious CPL payload of Reaver has the following three exported functions:  ServiceMain CPlApplet DllEntryPoint  When the malware is initially loaded, DllEntryPoint will be called, which in turn will call a function that is responsible for decompressing a blob of data

Tactics: TA0005, TA0007, TA0009, TA0011
Techniques: T1070, T1005, T1090.003, T1083, T1090, T1070.004
Input: Auditing the execution and command-line arguments of the 'systemctl' utility, as well related utilities such as /usr/sbin/service may reveal malicious systemd service execution.

Tactics: TA0003, TA0004
Techniques: T1543.002, T1543
Input: GrimAgent can collect the OS, and build version on a compromised host.

Tactics: TA0007
Techniques: T1082
Input: SLOTHFULMEDIA can open a command line to execute commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: ListPlanting (a form of message-passing "shatter attack") may be performed by copying code into the virtual address space of a process that uses a list-view control then using that code as a custom callback for sorting the listed items.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.015
Input: Using this information, they can decide to explore further or instruct the compromised computer to download additional malware

Tactics: TA0011
Techniques: T1105
Input: Monitor for creation and use of .msc files.

Tactics: TA0005
Techniques: T1218, T1218.014
Input: MoonWind has a command to return a list of running processes.

Tactics: TA0007
Techniques: T1057
Input: Monitor for newly constructed network connections (typically port 22) that may use Valid Accounts to log into remote machines using Secure Shell (SSH).

Tactics: TA0008
Techniques: T1021, T1021.004
Input: The following SSPs can be used to access credentials:

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Rover has functionality to remove Registry Run key persistence as a cleanup procedure.

Tactics: TA0005
Techniques: T1112
Input: MOTW is a NTFS feature and many container files do not support NTFS alternative data streams.

Tactics: TA0005
Techniques: T1553, T1553.005
Input: Based on the McAfee Advanced Threat Research team’s analysis, we find multiple components from this operation are unique from a code perspective, even though the code is loosely based on previous versions of the SYSCON backdoor

Tactics: TA0005
Techniques: T1140, T1027, T1027.001
Input: Ensure that Driver Signature Enforcement is enabled to restrict unsigned drivers from being installed.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Correlate activity with other suspicious behavior to reduce false positives that may be due to normal benign use by users and administrators.

Tactics: TA0005
Techniques: T1218
Input: PinchDuke gathers system configuration information.

Tactics: TA0007
Techniques: T1082
Input: The code will gather some information about the system, specifically the local IP address, MAC address, and the external IP address of the system

Tactics: TA0007
Techniques: T1016
Input: Denis has used DNS tunneling for C2 communications.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: If there is a cron.allow file, then the user or users that need to use cron will need to be listed in the file.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: Prior to version 10.5 on macOS, adversaries can add login items by using AppleScript to send an Apple events to the "System Events" process, which has an AppleScript dictionary for manipulating login items.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.015
Input: Suspicious activity may include personas claiming to work for your organization or recently modified accounts making numerous connection requests to accounts affiliated with your organization.Detection efforts may be focused on related stages of the adversary lifecycle, such as during Initial Access (ex: Spearphishing via Service).

Tactics: TA0042
Techniques: T1586.001, T1586
Input: Adversaries may attempt to cause a denial of service (DoS) by directly sending a high-volume of network traffic to a target.

Tactics: TA0040
Techniques: T1498, T1498.001
Input: Kubernetes system component logs may also detect activities running in and out of containers in the cluster.

Tactics: TA0002
Techniques: T1609
Input: The signature validation process is handled via the WinVerifyTrust application programming interface (API) function,   which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature.

Tactics: TA0005
Techniques: T1553, T1553.003
Input: ThiefQuest uses the CGEventTap functions to perform keylogging.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: MuddyWater has used web services including OneHub to distribute remote access tools.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: Mustang Panda has used malicious PowerShell scripts to enable execution.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Bankshot exfiltrates data over its C2 channel.

Tactics: TA0010
Techniques: T1041
Input: Nebulae can use CMD to execute a process.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: TajMahal has the ability to steal written CD images and files of interest from previously connected removable drives when they become available again.

Tactics: TA0009
Techniques: T1025
Input: The OopsIE Trojan is configured to use a C2 server hosted at:www.msoffice365cdn[.]com The Trojan will construct specific URLs to communicate with the C2 server and parses the C2 server’s response looking for content within the tags <pre> and </pre>

Tactics: TA0011, TA0010
Techniques: T1041, T1573, T1071, T1008, T1102
Input: DC replication will naturally take place every 15 minutes but can be triggered by an adversary or by legitimate urgent changes (ex: passwords).

Tactics: TA0005
Techniques: T1207
Input: An APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.

Tactics: TA0007
Techniques: T1057
Input: Monitor for unexpected deletion of a snapshot (ex: AWS delete-snapshot)

Tactics: TA0040
Techniques: T1485
Input: APT29 used forged SAML tokens that allowed the actors to impersonate users and bypass MFA, enabling APT29 to access enterprise cloud applications and services.

Tactics: TA0005, TA0008
Techniques: T1550
Input: SQLRat has created scheduled tasks in %appdata%\Roaming\Microsoft\Templates\.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Turla has encrypted files stolen from connected USB drives into a RAR file before exfiltration.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: SeaDuke uses HTTP and HTTPS for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Rover copies files from removable drives to C:\system.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Higaisa dropped and added officeupdate.exe to scheduled tasks.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Cobalt Strike can mimic the HTTP protocol for C2 communication, while hiding the actual data in either an HTTP header, URI parameter, the transaction body, or appending it to the URI.

Tactics: TA0011
Techniques: T1001, T1001.003
Input: Additional, if tty_tickets is disabled, adversaries can do this from any tty for that user.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: SamSam has been seen using AES or DES to encrypt payloads and payload components.

Tactics: TA0005
Techniques: T1027
Input: Stuxnet enumerates removable drives for infection.

Tactics: TA0007
Techniques: T1120
Input: Wingbird performs multiple process injections to hijack system processes and execute malicious code.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Monitor executed commands and arguments that may abuse Unix shell commands and scripts for execution.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: Linux desktop environments that are XDG compliant implement functionality for XDG autostart entries.

Tactics: TA0003, TA0004
Techniques: T1547.013, T1547
Input: CharmPower has the ability to download additional modules to a compromised host.

Tactics: TA0011
Techniques: T1105
Input: The malicious .LNK-based directories have an embedded command that executes the hidden malware file in the directory and then opens the real intended directory so that the user's expected action still occurs.

Tactics: TA0008
Techniques: T1080
Input: When that system component is executed through normal system operation the adversary's code will be executed instead.

Tactics: TA0003, TA0004
Techniques: T1546.015, T1546
Input: If a network device is suspected of being compromised, contact the vendor to assist in further investigation.

Tactics: TA0003, TA0005
Techniques: T1542.004, T1542
Input: SLOTHFULMEDIA has used HTTP and HTTPS for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Cardinal RAT sets HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load to point to its executable.

Tactics: TA0005
Techniques: T1112
Input: TA551 has used obfuscated variable names in a JavaScript configuration file.

Tactics: TA0005
Techniques: T1027
Input: Ensuring that the tty_tickets setting is enabled will prevent this leakage across tty sessions.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: Valak can use a .NET compiled module named exchgrabber to enumerate credentials from the Credential Manager.

Tactics: TA0006
Techniques: T1555, T1555.004
Input: Backup restoration events can also be detected through Azure Monitor Log Data by creating a custom alert for completed restore jobs.Google's Admin Activity audit logs within their Cloud Audit logs can be used to detect the usage of the gcloud compute instances create command to create a new VM disk from a snapshot.

Tactics: TA0005
Techniques: T1578, T1578.001
Input: Kimsuky has added accounts to specific groups with net localgroup.

Tactics: TA0003
Techniques: T1098
Input: Taidoor can use DeleteFileA to remove files from infected hosts.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: CosmicDuke uses a keylogger.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: BlackEnergy can gather very specific information about attached USB devices, to include device instance ID and drive geometry.

Tactics: TA0007
Techniques: T1120
Input: Adversaries have also leveraged the ~/.bashrc file which is additionally executed if the connection is established remotely or an additional interactive shell is opened, such as a new tab in the command-line interface.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: Adversaries may list credentials managed by the Windows Credential Manager through several mechanisms.

Tactics: TA0006
Techniques: T1555, T1555.004
Input: The mericcs.org domain was used as the sender address, as well as the hosting location of the malicious RTF document

Tactics: TA0007
Techniques: T1016
Input: Modify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\\SOFTWARE\\Classes\\AppID\\{AppID_GUID} associated with the process-wide security of individual COM applications.

Tactics: TA0002
Techniques: T1559, T1559.001
Input: Chimera's malware has altered the NTLM authentication program on domain controllers to allow Chimera to login without a valid credential.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.001
Input: Mustang Panda has created a scheduled task to execute additional malicious software, as well as maintain persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: More sophisticated samples may perform multiple process injections to segment modules and further evade detection, utilizing named pipes or other inter-process communication (IPC) mechanisms as a communication channel.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Monitor for API calls that may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.

Tactics: TA0007
Techniques: T1135
Input: Monitor newly executed processes that may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.010
Input: ROKRAT can send collected files back over same C2 channel.

Tactics: TA0010
Techniques: T1041
Input: CharmPower can use netsh wlan show profiles to list specific Wi-Fi profile details.

Tactics: TA0007
Techniques: T1049
Input: The spoolsv.exe process also runs under SYSTEM level permissions.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.010
Input: Waterbear has used DLL side loading to import and load a malicious DLL loader.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: JCry has achieved execution by luring users to click on a file that appeared to be an Adobe Flash Player update installer.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Sowbug obtained OS version and hardware configuration from a victim.

Tactics: TA0007
Techniques: T1082
Input: This requires an exchange or pre-arranged agreement/possession of the value used to encrypt and decrypt data.

Tactics: TA0010
Techniques: T1048, T1048.001
Input: Consider adjusting read and write permissions for NTFS EA, though this should be tested to ensure routine OS operations are not impeded.

Tactics: TA0005
Techniques: T1564, T1564.004
Input: Clambling has the ability to set its file attributes to hidden.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Identify and block potentially malicious software executed through hijacking by using application control solutions also capable of blocking libraries loaded by legitimate software.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.006, T1574
Input: Modifying callback functions can be achieved in various ways involving related behaviors such as Reflective Code Loading or Process Injection into another process.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.013, T1574
Input: !DWN  Downloads a file from a specified URL

Tactics: TA0011
Techniques: T1105