madox81/Adema_ATTACK_DS huggingface dataset:
Input: An adversary is likely to hijack objects that are used frequently enough to maintain a consistent level of persistence, but are unlikely to break noticeable functionality within the system as to avoid system instability that could lead to detection.

Tactics: TA0003, TA0004
Techniques: T1546.015, T1546
Input: QakBot has the ability to use HTTP and HTTPS in communication with C2 servers.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: For example, the following code publishes a printer within the specified domain: cscript pubprn Printer1 LDAP://CN=Container1,DC=Domain1,DC=Com.

Tactics: TA0005
Techniques: T1216.001, T1216
Input: APT39 leveraged spearphishing emails with malicious links to initially compromise victims.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Regularly check installed IIS components to verify the integrity of the web server and identify if unexpected changes have been made.

Tactics: TA0003
Techniques: T1505.004, T1505
Input: PoetRAT has used Word documents with VBScripts to execute malicious activities.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Gamaredon Group's backdoor malware has also been written to a batch file.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Adversaries may backdoor web servers with web shells to establish persistent access to systems.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: After gaining access to a victim system, adversaries may create/modify event triggers to point to malicious content that will be executed whenever the event trigger is invoked.

Tactics: TA0003, TA0004
Techniques: T1546
Input: Zox can enumerate files on a compromised host.

Tactics: TA0007
Techniques: T1083
Input: An adversary may modify these Registry keys to add new SSPs, which will be loaded the next time the system boots, or when the AddSecurityPackage Windows API function is called.

Tactics: TA0003, TA0004, TA0006
Techniques: T1003, T1547.005, T1547, T1003.001
Input: Adversaries can compromise and manipulate devices that perform encryption of network traffic.

Tactics: TA0005
Techniques: T1600
Input: Okrum's loader can create a new service named NtmsSvc to execute the payload.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: FIVEHANDS can use an embedded NTRU public key to encrypt data for ransom.

Tactics: TA0040
Techniques: T1486
Input: TrickBot has used an email with an Excel sheet containing a malicious macro to deploy the malware

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Wizard Spider has used the icacls command to modify access control to backup servers, providing them with full control of all the system folders.

Tactics: TA0005
Techniques: T1222, T1222.001
Input: Daserf can execute shell commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Inception has used a reconnaissance module to identify active processes and other associated loaded modules.

Tactics: TA0007
Techniques: T1057
Input: Lazarus Group delivered RATANKBA and other malicious code to victims via a compromised legitimate website.

Tactics: TA0001
Techniques: T1189
Input: APT38 has attempted to get detailed information about a compromised host, including the operating system, version, patches, hotfixes, and service packs.

Tactics: TA0007
Techniques: T1082
Input: Other mitigation controls involve the deployment of security kernel modules that provide advanced access control and process restrictions such as SELinux, grsecurity, and AppArmor.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Emotet has been observed injecting in to Explorer.exe and other processes.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: xCaon has a command to download files to the victim's machine.

Tactics: TA0011
Techniques: T1105
Input: APT39 has utilized AutoIt and custom scripts to perform internal reconnaissance.

Tactics: TA0002
Techniques: T1059
Input: Operation Wocao's backdoors have been written in Python and compiled with py2exe.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: APT29 has used a compromised O365 administrator account to create a new Service Principal.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078.004, T1078
Input: Bandook can collect information about the drives available on the system.

Tactics: TA0007
Techniques: T1082
Input: Adversaries may also abuse Windows APIs such as CredEnumerateA to list credentials managed by the Credential Manager.

Tactics: TA0006
Techniques: T1555, T1555.004
Input: Confucius has sent malicious links to victims through email campaigns.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: PLATINUM has used several different keyloggers.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: HermeticWiper can load drivers by creating a new service using the CreateServiceW API.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: PLAINTEE collects general system enumeration data about the infected machine and checks the OS version.

Tactics: TA0007
Techniques: T1082
Input: This information can help adversaries determine which domain accounts exist to aid in follow-on behavior.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: QakBot can use GetProcAddress to help delete malicious strings from memory.

Tactics: TA0002
Techniques: T1106
Input: Netwalker's PowerShell script has been obfuscated with multiple layers including base64 and hexadecimal encoding and XOR-encryption, as well as obfuscated PowerShell functions and variables.

Tactics: TA0005
Techniques: T1027
Input: GALLIUM has used stolen certificates to sign its tools including those from Whizzimo LLC.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: AADInternals can send phishing emails containing malicious links designed to collect users’ credentials.

Tactics: TA0043
Techniques: T1598, T1598.003
Input: Adversaries may gather information about the victim's network domain(s) that can be used during targeting.

Tactics: TA0043
Techniques: T1590, T1590.001
Input: If an adversary has a username and password but the user is not logged onto the system, the adversary can then create a logon session for the user using the LogonUser function.

Tactics: TA0004, TA0005
Techniques: T1134.003, T1134
Input: Keydnap uses Python for scripting to execute additional commands.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Cadelspy has the ability to log keystrokes on the compromised host.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Orz can execute commands with JavaScript.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: CopyKittens has used -w hidden and -windowstyle hidden to conceal PowerShell windows.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Waterbear can hook the ZwOpenProcess and GetExtendedTcpTable APIs called by the process of a security product to hide PIDs and TCP records from detection.

Tactics: TA0005
Techniques: T1562.006, T1562
Input: Modifying or disabling a cloud firewall may enable adversary C2 communications, lateral movement, and/or data exfiltration that would otherwise not be allowed.

Tactics: TA0005
Techniques: T1562.007, T1562
Input: Threat Group-3390 has used WinRM to enable remote execution.

Tactics: TA0008
Techniques: T1021, T1021.006
Input: Adversaries may delete files left behind by the actions of their intrusion activity.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: This DLL file creates a scheduled task named BaiduUpdateTask1, which attempts to run the malicious, spoofed MSBuild.exe every subsequent minute

Tactics: TA0002, TA0003, TA0004, TA0005
Techniques: T1053.005, T1053, T1036
Input: Typically, longer keys increase the cost of cryptanalysis, or decryption without the key.

Tactics: TA0005
Techniques: T1600
Input: Certificate authorities exist that allow adversaries to acquire SSL/TLS certificates, such as domain validation certificates, for free.

Tactics: TA0042
Techniques: T1588.004, T1588
Input: Remexi encrypts and adds all gathered browser data into files for upload to C2.

Tactics: TA0009
Techniques: T1560
Input: The user may also be required to input a password to open a password protected compressed/encrypted file that was provided by the adversary.

Tactics: TA0005
Techniques: T1140, T1027
Input: Monitor for unexpected deletion of a command history file, such as ConsoleHost_history.txt, ~/.zsh_history, or ~/.bash_history.

Tactics: TA0005
Techniques: T1070, T1070.003
Input: Scan code repositories for exposed credentials or other sensitive information.

Tactics: TA0009
Techniques: T1213, T1213.003
Input: Epic uses HTTP and HTTPS for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: StreamEx establishes persistence by installing a new service pointing to its DLL and setting the service to auto-start.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: DownPaper uses PowerShell to add a Registry Run key in order to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Ramsay can compress and archive collected files using WinRAR.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Kerrdown can use a VBS base64 decoder function published by Motobit.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: Consider analyzing malware for features that may be associated with malware providers, such as compiler used, debugging artifacts, code similarities, or even group identifiers associated with specific MaaS offerings.

Tactics: TA0042
Techniques: T1588, T1588.001
Input: QakBot can use signed loaders to evade detection.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: For example, there can be different profiles for PowerShell host programs such as the PowerShell console, PowerShell ISE or Visual Studio Code.

Tactics: TA0003, TA0004
Techniques: T1546.013, T1546
Input: 16 byte randomly-generated value (G$RADIUSCHAPKEY) also from userParameters

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.005
Input: GeminiDuke uses HTTP and HTTPS for command and control.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Stuxnet encrypts exfiltrated data via C2 with static 31-byte long XOR keys.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: Tools can be open or closed source, free or commercial.

Tactics: TA0042
Techniques: T1588, T1608, T1588.002, T1608.002
Input: Azure AD Administrators apply limitations upon the ability for users to grant consent to unfamiliar or unverified third-party applications.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Hildegard has used masscan to search for kubelets and the kubelet API for additional running containers.

Tactics: TA0007
Techniques: T1613
Input: Monitor for changes made to files that may use hidden users to mask the presence of user accounts they create or modify.

Tactics: TA0005
Techniques: T1564.002, T1564
Input: Common uses of batch files include long or repetitive tasks, or the need to run the same set of commands on multiple systems.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Ursnif has gathered information about running services.

Tactics: TA0007
Techniques: T1007
Input: TG-3390 actors have deployed the OwaAuth web shell to Exchange servers, disguising it as an ISAPI filter

Tactics: TA0003
Techniques: T1505.003, T1505
Input: WindTail has the ability to automatically exfiltrate files using the macOS built-in utility /usr/bin/curl.

Tactics: TA0010
Techniques: T1048.003, T1048
Input: With CLR integration enabled, application developers can write stored procedures using any .NET framework language ( VB .NET, C#, ).

Tactics: TA0003
Techniques: T1505.001, T1505
Input: Ensure that unnecessary ports and services are closed to prevent risk of discovery and potential exploitation.

Tactics: TA0007
Techniques: T1046
Input: WINERACK can create a reverse shell that utilizes statically-linked Wine cmd.exe code to emulate Windows command prompt commands.

Tactics: TA0002
Techniques: T1059
Input: Monitor for changes made to processes that may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055.004, T1055
Input: Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers.

Tactics: TA0003
Techniques: T1176
Input: An APT19 Port 22 malware variant registers itself as a service.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: HermeticWiper has used the name postgressql.exe to mask a malicious payload.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Animate – Create a process from the tainted section of memory and initiate execution.

Tactics: TA0004, TA0005
Techniques: T1055.013, T1055
Input: The ensuing connection is a plaintext C2 channel in which commands are specified by DWORDs.

Tactics: TA0011
Techniques: T1095
Input: Goopy has impersonated the legitimate goopdate.dll, which was dropped on the target system with a legitimate GoogleUpdate.exe.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: AppleJeus has added a leading . to plist filenames, unlisting them from the Finder app and default Terminal directory listings.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: PS1 is distributed as a set of encrypted files and scripts.

Tactics: TA0005
Techniques: T1027
Input: Pteranodon can use a dynamic Windows hashing algorithm to map API components.

Tactics: TA0005
Techniques: T1027
Input: Operators deploying Netwalker have used psexec to copy the Netwalker payload across accessible systems.

Tactics: TA0008
Techniques: T1570
Input: QuietSieve has the ability to execute payloads in a hidden window.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: InvisiMole can collect data from the system, and can monitor changes in specified directories.

Tactics: TA0009
Techniques: T1005
Input: Information about the client configurations may also be exposed to adversaries via online or other accessible data sets (ex: job postings, network maps, assessment reports, resumes, or purchase invoices).

Tactics: TA0043
Techniques: T1592, T1592.004
Input: Some hash dumpers will open the local file system as a device and parse to the SAM table to avoid file access defenses.

Tactics: TA0006, TA0007
Techniques: T1033, T1003, T1003.002
Input: For Windows Vista or higher, the path would appear as C:\Users\Public.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Turla RPC backdoors have included local UPnP RPC proxies.

Tactics: TA0011
Techniques: T1090
Input: Bazar has been signed with fake certificates including those appearing to be from VB CORPORATE PTY. LTD.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: In the cases where a border device separates two separate organizations, the adversary can also facilitate lateral movement into new victim environments.

Tactics: TA0005
Techniques: T1599
Input: WhisperGate can download and execute AdvancedRun.exe to disable Windows Defender Theat Protection via sc.exe.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: BlackEnergy has removed the watermark associated with enabling the TESTSIGNING boot configuration option by removing the relevant strings in the user32.dll.mui of the system.

Tactics: TA0005
Techniques: T1070
Input: The usage of LinkedIn to deliver malicious documents,

Tactics: TA0001
Techniques: T1566.003, T1566
Input: Technical system documentation

Tactics: TA0009
Techniques: T1213, T1213.001, T1213.002
Input: Created email accounts can also be used in the acquisition of infrastructure (ex: Domains).

Tactics: TA0042
Techniques: T1585, T1585.002
Input: Patchwork bypassed User Access Control (UAC).

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Common tools for detecting Linux rootkits include: rkhunter , chrootkit , although rootkits may be designed to evade certain detection tools.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: Monitor for newly executed processes that may use Windows Dynamic Data Exchange (DDE) to execute arbitrary commands.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: Adversaries may attempt to find unsecured credentials in Group Policy Preferences (GPP).

Tactics: TA0006
Techniques: T1552, T1552.006
Input: SHIPSHAPE targets removable drives to spread to other systems by modifying the drive to use Autorun to execute or by hiding legitimate document files and copying an executable to the folder with the same name as the legitimate document.

Tactics: TA0001, TA0008
Techniques: T1091
Input: Application control and software restriction tools, such as SELinux, KSPP, grsecurity MODHARDEN, and Linux kernel tuning can aid in restricting kernel module loading.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: APT41 has used rundll32.exe to execute a loader.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: In Docker, logs may leak information about the environment, such as the environment’s configuration, which services are available, and what cloud provider the victim may be utilizing.

Tactics: TA0007
Techniques: T1613
Input: Stuxnet used WMI with an explorer.exe token to execute on a remote share.

Tactics: TA0002
Techniques: T1047
Input: H1N1 bypasses user access control by using a DLL hijacking vulnerability in the Windows Update Standalone Installer (wusa.exe).

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Netwalker can encrypt files on infected machines to extort victims.

Tactics: TA0040
Techniques: T1486
Input: Systems may suddenly stop reporting all data or only certain kinds of data.

Tactics: TA0005
Techniques: T1562.006, T1562
Input: Adversaries may bypass application control and obscure execution of code by embedding scripts inside XSL files.

Tactics: TA0005
Techniques: T1220
Input: APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.

Tactics: TA0002
Techniques: T1203
Input: For example, Process Hollowing can be abused to spawn a process in a suspended state with benign arguments.

Tactics: TA0005
Techniques: T1564.010, T1564
Input: Evilnum has used PowerShell to bypass UAC.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Cobalt Strike can enumerate services on compromised hosts.

Tactics: TA0007
Techniques: T1007
Input: TeamTNT has modified the permissions on binaries with chattr.

Tactics: TA0005
Techniques: T1222.002, T1222
Input: Raindrop was built to include a modified version of 7-Zip source code (including associated export names) and Far Manager source code.

Tactics: TA0005
Techniques: T1036
Input: Similar to Code Signing, adversaries may abuse this architecture to subvert trust controls and bypass security policies that allow only legitimately signed code to execute on a system.

Tactics: TA0005
Techniques: T1553, T1553.003
Input: Scripts should be captured from the file system when possible to determine their actions and intent.

Tactics: TA0002, TA0005, TA0006, TA0007, TA0009, TA0010
Techniques: T1559, T1059.007, T1059.003, T1140, T1005, T1564.003, T1056.002, T1560.002, T1119, T1562.002, T1560.003, T1482, T1059.006, T1020, T1059.004, T1560, T1564, T1059.001, T1059.005, T1016, T1562, T1216.001, T1059, T1056, T1615, T1216
Input: Indrik Spider has stored collected date in a .tmp file.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Campaign Code and Compile Time Correlation In some cases, there is a close proximity of the compile time of a CARBANAK sample to the month specified in a particular campaign code

Tactics: TA0007
Techniques: T1124
Input: While we have not been able to obtain a secondary payload from the Unicorn generated PowerShell script, we believe that this group uses the script to deliver Metasploit’s Meterpreter as a potential payload as well

Tactics: TA0002
Techniques: T1059
Input: FoggyWeb can receive additional malicious components from an actor controlled C2 server and execute them on a compromised AD FS server.

Tactics: TA0011
Techniques: T1105
Input: Taidoor can copy cmd.exe into the system temp folder.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Exaramel for Linux can uninstall its persistence mechanism and delete its configuration file.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services.

Tactics: TA0007
Techniques: T1580
Input: The login shell configures the system environment using /etc/profile, /etc/zshenv, /etc/zprofile, and /etc/zlogin.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: Most strings in USBStealer are encrypted using 3DES and XOR and reversed.

Tactics: TA0005
Techniques: T1027
Input: Various Remsec .exe files mimic legitimate file names used by Microsoft, Symantec, Kaspersky, Hewlett-Packard, and VMWare.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Andariel has used tasklist to enumerate processes and find a specific string.

Tactics: TA0007
Techniques: T1057
Input: Common methods used by adversaries include replacing accessibility feature binaries or pointers/references to these binaries in the Registry.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: In AWS, monitor for: StopLogging and DeleteTrail.

Tactics: TA0005
Techniques: T1562.008, T1562
Input: 2.     The macro decodes the dropped files using Windows certutil.exe with the following commands (certutil.exe is a legitimate built-in command-line program to manage certificates in Windows):    C:\Windows\System32\cmd.exe" /c certutil -decode C:\ProgramData\padre1.txt C:\ProgramData\\GUP.txt    C:\Windows\System32\cmd.exe" /c certutil -decode C:\ProgramData\padre2.txt C:\ProgramData\\libcurl.txt    C:\Windows\System32\cmd.exe" /c certutil -decode C:\ProgramData\padre3.txt C:\ProgramData\\3F2E3AB9    3.     The macro creates a copy of the files with their proper extensions using Extensible Storage Engine Utilities (esentutil.exe) with the following commands (esentutil.exe is also a legitimate program that is pre-installed in Windows):    C:\Windows\System32\esentutl.exe" /y C:\ProgramData\\GUP.txt /d C:\ProgramData\GUP.exe /o    C:\Windows\System32\esentutl.exe" /y C:\ProgramData\\libcurl.txt /d C:\ProgramData\libcurl.dll /o   The dropped files include the following:  GUP.exe : GUP, a free (LGPL) Generic Updater. GUP is an open source binary used by Notepad++ for software updates

Tactics: TA0002, TA0004, TA0005, TA0007
Techniques: T1036, T1106, T1055.012, T1055, T1010
Input: Non-standard data encoding schemes may be based on or related to standard data encoding schemes, such as a modified Base64 encoding for the message body of an HTTP request.

Tactics: TA0011
Techniques: T1132, T1132.002
Input: RainyDay can use TCP in C2 communications.

Tactics: TA0011
Techniques: T1095
Input: Rocke issued wget requests from infected systems to the C2.

Tactics: TA0011
Techniques: T1071
Input: Users and/or security tools may trust a signed piece of code more than an unsigned piece of code even if they don't know who issued the certificate or who the author is.

Tactics: TA0042
Techniques: T1587.002, T1588, T1587, T1588.003
Input: Gamaredon Group has registered multiple domains to facilitate payload staging and C2.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: UBoatRAT takes advantage of the /SetNotifyCmdLine option in BITSAdmin to ensure it stays running on a system to maintain persistence.

Tactics: TA0003, TA0005
Techniques: T1197
Input: Volgmer can gather the IP address from the victim's machine.

Tactics: TA0007
Techniques: T1016
Input: Information can easily be queried using the Reg utility, though other means to access the Registry exist.

Tactics: TA0007
Techniques: T1012
Input: Monitor contextual data about a running process, which may include information such as environment variables, image name, user/owner, or other information that may reveal use of a version of system features that may be outdated, vulnerable, and/or does not support updated security controls such as logging.

Tactics: TA0005
Techniques: T1562.010, T1562