madox81/Adema_ATTACK_DS huggingface dataset:
Input: QakBot has the ability use TCP to send or receive C2 packets.

Tactics: TA0011
Techniques: T1095
Input: Darkhotel has used malware that is disguised as a Secure Shell (SSH) tool.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Monitor the execution and arguments of mavinject.exe.

Tactics: TA0005
Techniques: T1218, T1218.013
Input: PoetRAT has used a Python tool named Browdec.exe to steal browser credentials.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.

Tactics: TA0002
Techniques: T1106
Input: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Darkhotel has collected the hostname, OS version, service pack version, and the processor architecture from the victim’s machine.

Tactics: TA0007
Techniques: T1082
Input: APT32 has used email for C2 via an Office macro.

Tactics: TA0011
Techniques: T1071, T1071.003
Input: Adversaries may abuse verclsid.exe to execute malicious payloads.

Tactics: TA0005
Techniques: T1218, T1218.012
Input: netsh can be used to set up a proxy tunnel to allow remote host access to an infected host.

Tactics: TA0011
Techniques: T1090
Input: This task is executed every 25 minutes and will repeat the actions described above – recreating the JavaScript code which later will create and execute a PowerShell script (described below)

Tactics: TA0002
Techniques: T1059.001, T1059
Input: This document was alleged to have been written by the Ministry of Reunification as demonstrated by the logo in the top left.Similar to the "Golden Time" campaign, this document exploits an EPS vulnerability in order to download and execute shellcode located on a compromised website:hxxp://60chicken[.]co[.]kr/wysiwyg/PEG_temp/logo1.pngThe fake image usage is a common pattern for this group

Tactics: TA0011
Techniques: T1105
Input: Gamaredon Group malware has used rundll32 to launch additional malicious components.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: BlackEnergy2 was eventually seen downloading more crimeware plugins – a custom spam plugin and a banking information stealer custom plugin

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Adversaries may inject malicious code into suspended and hollowed processes in order to evade process-based defenses.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: Initially, the key is sent to the C2 server with the entire message and headers encrypted with the RSA key exchange algorithm

Tactics: TA0011
Techniques: T1573
Input: Through GPO: Computer Configuration > [Policies] > Administrative Templates > SCM: Pass the Hash Mitigations: Apply UAC restrictions to local accounts on network logons.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: Higaisa used cmd.exe for execution.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Reflective code injection is very similar to Process Injection except that the "injection" loads code into the processes’ own memory instead of that of a separate process.

Tactics: TA0005
Techniques: T1620
Input: For example, an executable file attachment named Evil.txt.exe may display as Evil.txt to a user.

Tactics: TA0005
Techniques: T1036, T1036.007
Input: CharmPower can retrieve C2 domain information from actor-controlled S3 buckets.

Tactics: TA0011
Techniques: T1102.001, T1102
Input: Pupy has a built-in utility command for netstat, can do net session through PowerView, and has an interactive shell which can be used to discover additional information.

Tactics: TA0007
Techniques: T1049
Input: Lazarus Group has performed brute force attacks against administrator accounts.

Tactics: TA0006
Techniques: T1110
Input: ROKRAT can steal credentials stored in Web browsers by querying the sqlite database.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Adversaries may acquire malware to support their operations, obtaining a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.

Tactics: TA0042
Techniques: T1588, T1588.001
Input: It is created as a separate process instead of child process of Office applications

Tactics: TA0007
Techniques: T1057
Input: Interestingly, we’ve seen recent samples embedding decoy documents that are screenshots of botnet C&C panels or dumps of credit card numbers

Tactics: TA0009
Techniques: T1113
Input: Operators deploying Netwalker have used psexec and certutil to retrieve the Netwalker payload.

Tactics: TA0002, TA0011
Techniques: T1569.002, T1105, T1569
Input: Diavol can spread throughout a network via SMB prior to encryption.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: ObliqueRAT has the ability to check for blocklisted computer names on infected endpoints.

Tactics: TA0007
Techniques: T1082
Input: Detection of compromised Valid Accounts in-use by adversaries may help as well.

Tactics: TA0006
Techniques: T1003, T1003.002
Input: Consider blocking the execution of known vulnerable drivers that adversaries may exploit to execute code in kernel mode.

Tactics: TA0004
Techniques: T1068
Input: Crutch can monitor removable drives and exfiltrate files matching a given extension list.

Tactics: TA0009
Techniques: T1025
Input: Carbon creates several tasks for later execution to continue persistence on the victim’s machine.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Pandora has the ability to compress stings with QuickLZ.

Tactics: TA0005
Techniques: T1027
Input: Kerrdown has been distributed via e-mails containing a malicious link.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: SA  Generates the following IRC client command that will be sent to the C2 server: PRIVMSG <username> : Hello ,my name is  <IRC USER name>, Im ready my Computer Name is:<computer name>    All of the commands, except for the VER command, must be issued by individuals in the IRC channel with nicknames that start with “AS_” or “AF_”

Tactics: TA0007
Techniques: T1033, T1082
Input: We would like to thank White-Hat, Tom Lancaster of Palo Alto Networks, Michael Yip of Stroz Friedberg, security researcher Marcus, and other security researchers and organizations who shared information and provided feedback

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Monitor for newly constructed processes and/or command-lines that will have a parent process of ‘systemd’, a parent process ID of 1, and will usually execute as the ‘root’ user.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.006, T1053
Input: Adversaries may modify the key size used and other encryption parameters using specialized commands in a Network Device CLI introduced to the system through Modify System Image to change the configuration of the device.

Tactics: TA0005
Techniques: T1600.001, T1600
Input: CMSTP.exe can also be abused to Bypass User Account Control and execute arbitrary commands from a malicious INF through an auto-elevated COM interface.

Tactics: TA0005
Techniques: T1218, T1218.003
Input: The module loader can load DLLs via an NTFS junction or symlink program.exe.local with the fully-qualified or relative pathname of a directory containing the DLLs specified in the IMPORT directory or forwarded EXPORTs;

Tactics: TA0002
Techniques: T1129
Input: APT17 has created profile pages in Microsoft TechNet that were used as C2 infrastructure.

Tactics: TA0042
Techniques: T1583.006, T1583
Input: Organizations may intentionally register similar domains to their own to deter adversaries from creating typosquatting domains.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: The command handler obtains a command identifier from the C2 server and adds 0xFFFFFF9B to this value and then uses a switch statement to determine the appropriate command to execute

Tactics: TA0002, TA0007
Techniques: T1016, T1059
Input: Various online services continuously publish the results of Internet scans/surveys, often harvesting information such as active IP addresses, hostnames, open ports, certificates, and even server banners.

Tactics: TA0043
Techniques: T1596, T1596.005
Input: Felismus uses command line for execution.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Sandworm Team conducted technical reconnaissance of the Parliament of Georgia's official internet domain prior to its 2019 attack.

Tactics: TA0043
Techniques: T1590, T1590.001
Input: Operating systems and security products may contain mechanisms to identify programs or websites as possessing some level of trust.

Tactics: TA0005
Techniques: T1553
Input: FruitFly will delete files on the system.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Use access control lists on storage systems and objects.

Tactics: TA0009
Techniques: T1530
Input: When an adversary takes control of such a device, they may disable the dedicated hardware, for example, through use of Modify System Image, forcing the use of software to perform encryption on general processors.

Tactics: TA0005
Techniques: T1600, T1600.002
Input: Lazarus Group has used a custom secure delete function to overwrite file contents with data from heap memory.

Tactics: TA0040
Techniques: T1485
Input: LKMs are typically loaded into /lib/modules and have had the extension .ko ("kernel object") since version 2.6 of the Linux kernel.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: H1N1 disable recovery options and deletes shadow copies from the victim.

Tactics: TA0040
Techniques: T1490
Input: SMOKEDHAM has modified registry keys for persistence, to enable credential caching for credential access, and to facilitate lateral movement via RDP.

Tactics: TA0005
Techniques: T1112
Input: Although sensitive details (such as customer names and other identifiers) may be redacted, this information may contain trends regarding breaches such as target industries, attribution claims, and successful TTPs/countermeasures.

Tactics: TA0043
Techniques: T1597, T1597.001
Input: Next, it will copy the first stage shellcode in memory and create a new thread with the shellcode running in it, the code responsible for this execution is shown in Figure 1

Tactics: TA0002
Techniques: T1059
Input: The code comparison specifically shows the HighShell code including a salt variable containing di2zag7wZHTK9YR0NGq, which is not present within the TwoFace code on the left

Tactics: TA0005
Techniques: T1140
Input: Maze has disrupted systems by encrypting files on targeted machines, claiming to decrypt files if a ransom payment is made.

Tactics: TA0040
Techniques: T1486
Input: Pony has used the NetUserEnum function to enumerate local accounts.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: After connecting to the IRC server, the MPK bot sends custom ping messages and provides an introduction via a “!Hello” message that contains the current logged in user of the infected host, if the user has administrator privileges, the hostname, the UUID of the system, and operating system version

Tactics: TA0007
Techniques: T1082
Input: Applying SID Filtering to domain trusts within a single forest is not recommended as it is an unsupported configuration and can cause breaking changes.

Tactics: TA0004, TA0005
Techniques: T1134.005, T1134
Input: Similar events may also occur at the boundary through network IDS, email scanning appliance,  The initial detection should be treated as an indication of a potentially more invasive intrusion.

Tactics: TA0005
Techniques: T1027, T1027.005
Input: To participate with the rest of the network, these devices can be directly addressable or transparent, but their mode of operation has no bearing on how the adversary can bypass them when compromised.

Tactics: TA0005
Techniques: T1599
Input: Helminth has checked the local administrators group.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: Malicious Component Object Model (COM) objects may also be registered and loaded in safe mode.

Tactics: TA0005
Techniques: T1562.009, T1562
Input: Silence has used HKCU\Software\Microsoft\Windows\CurrentVersion\Run, HKLM\Software\Microsoft\Windows\CurrentVersion\Run, and the Startup folder to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Monitor executed commands and arguments that may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

Tactics: TA0007
Techniques: T1083
Input: POWERSTATS uses PowerShell for obfuscation and execution.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Monitor for modifications of mechanisms that could be used to trigger autostart execution, such as relevant additions to the Registry.

Tactics: TA0003, TA0004
Techniques: T1547
Input: TYPEFRAME can install encrypted configuration data under the Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellCompatibility\Applications\laxhost.dll and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\PrintConfigs.

Tactics: TA0005
Techniques: T1112
Input: Sidewinder has used tools to enumerate software installed on an infected host.

Tactics: TA0007
Techniques: T1518
Input: SoreFang can gain persistence through use of scheduled tasks.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Changing UAC settings to "Always Notify" will give the user more visibility when UAC elevation is requested, however, this option will not be popular among users due to the constant UAC interruptions.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: Metamorfo has disguised an MSI file as the Adobe Acrobat Reader Installer and has masqueraded payloads as OneDrive, WhatsApp, or Spotify, for example.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: RegDuke can extract and execute PowerShell scripts from C2 communications.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Astaroth can check for Windows product ID's used by sandboxes and usernames and disk serial numbers associated with analyst environments.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: This information can help adversaries determine which user accounts and groups are available, the membership of users in particular groups, and which users and groups have elevated permissions.

Tactics: TA0007
Techniques: T1069
Input: TajMahal can set the KeepPrintedJobs attribute for configured printers in SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Printers to enable document stealing.

Tactics: TA0005
Techniques: T1112
Input: Monitor and analyze calls to CreateTransaction, CreateFileTransacted, RollbackTransaction, and other rarely used functions indicative of TxF activity.

Tactics: TA0004, TA0005
Techniques: T1055.013, T1055
Input: SILENTTRINITY can gather a list of logged on users.

Tactics: TA0007
Techniques: T1033
Input: HDoor scans to identify open ports on the victim.

Tactics: TA0007
Techniques: T1046
Input: Sandworm Team has sent system information to its C2 server using HTTP.

Tactics: TA0010
Techniques: T1041
Input: With direct write access to a disk, adversaries may attempt to overwrite portions of disk data.

Tactics: TA0040
Techniques: T1561
Input: Based on comparison of Gazer versions, Turla made an effort to obfuscate strings in the malware that could be used as IoCs, including the mutex name and named pipe.

Tactics: TA0005
Techniques: T1027, T1027.005
Input: RCSession can collect data from a compromised host.

Tactics: TA0009
Techniques: T1005
Input: One common purpose for Resource Hijacking is to validate transactions of cryptocurrency networks and earn virtual currency.

Tactics: TA0040
Techniques: T1496
Input: Kazuar captures screenshots of the victim’s screen.

Tactics: TA0009
Techniques: T1113
Input: GrimAgent has the ability to use HTTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Regularly audit user accounts for activity and deactivate or remove any that are no longer needed.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: Web applications and services (hosted in cloud SaaS environments or on-premise servers) often use session cookies to authenticate and authorize user access.

Tactics: TA0006
Techniques: T1606, T1606.001
Input: APT29 has used HTTP for C2 and data exfiltration.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Kimsuky has renamed malware to legitimate names such as ESTCommon.dll or patch.dll.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Use strong passphrases for private keys to make cracking difficult.

Tactics: TA0006
Techniques: T1552.004, T1552
Input: A Dipsind variant registers as a Winlogon Event Notify DLL to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.004, T1547
Input: AdFind can gather information about organizational units (OUs) and domain trusts from Active Directory.

Tactics: TA0007
Techniques: T1482
Input: FALLCHILL collects MAC address and local IP address information from the victim.

Tactics: TA0007
Techniques: T1016
Input: Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure.

Tactics: TA0011
Techniques: T1102.001, T1102
Input: Amazon Web Services (AWS) Amazon Machine Images (AMIs), Google Cloud Platform (GCP) Images, and Azure Images as well as popular container runtimes such as Docker can be backdoored.

Tactics: TA0002
Techniques: T1204.003, T1204
Input: Monitor newly executed processes that may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: PLAINTEE uses reg add to add a Registry Run key for persistence.

Tactics: TA0005
Techniques: T1112
Input: Spark has encoded communications with the C2 server with base64.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: APT41 has used hashdump, Mimikatz, and the Windows Credential Editor to dump password hashes from memory and authenticate to other user accounts.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: An adversary may use Windows Task Scheduler to execute programs at system startup or on a scheduled basis for persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: WinRM  can be used as a method of remotely interacting with Windows Management Instrumentation.

Tactics: TA0008
Techniques: T1021, T1021.006
Input: Such media could be an external hard drive, USB drive, cellular phone, MP3 player, or other removable storage and processing device.

Tactics: TA0010
Techniques: T1052
Input: Monitor newly executed processes, such as the W32tm.exe utility.

Tactics: TA0003, TA0004
Techniques: T1547.003, T1547
Input: APT29 used different compromised credentials for remote access and to move laterally.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: Manipulation of development tools

Tactics: TA0001
Techniques: T1195
Input: AppleSeed can decode its payload prior to execution.

Tactics: TA0005
Techniques: T1140
Input: If any directories are listed in the PATH environment variable before the Windows directory, %SystemRoot%\system32 (, C:\Windows\system32), a program may be placed in the preceding directory that is named the same as a Windows program (such as cmd, PowerShell, or Python), which will be executed when that command is executed from a script or command-line.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.007, T1574
Input: ROKRAT can request to delete files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: RDAT can use email attachments for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.003
Input: For example, they can filter for apps that are authorized by a small number of users, apps requesting high risk permissions, permissions incongruous with the app’s purpose, or apps with old "Last authorized" fields.

Tactics: TA0006
Techniques: T1528
Input: XTunnel relays traffic between a C2 server and a victim.

Tactics: TA0011
Techniques: T1090
Input: APT3 leverages valid accounts after gaining credentials for use within the victim domain.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.002
Input: TeamTNT has leveraged iplogger.org to send collected data back to C2.

Tactics: TA0011
Techniques: T1102
Input: In the case of ransomware, it is typical that common user files like Office documents, PDFs, images, videos, audio, text, and source code files will be encrypted (and often renamed and/or tagged with specific file markers).

Tactics: TA0040
Techniques: T1486
Input: Use process monitoring to monitor the execution and arguments of msiexec.exe.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: PlugX has a module to enumerate network shares.

Tactics: TA0007
Techniques: T1135
Input: Adversaries may buy, steal, or download software tools that can be used during targeting.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Locally, mimikatz can be run using:

Tactics: TA0006
Techniques: T1003, T1003.001
Input: This means that any domain user can view the SYSVOL share and decrypt the password (using the AES key that has been made public).

Tactics: TA0006
Techniques: T1552, T1552.006
Input: Users should also be cautious about the permissions they are granting to apps.

Tactics: TA0006
Techniques: T1528
Input: QakBot can use MSIExec to spawn multiple cmd.exe processes.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: QUADAGENT encodes C2 communications with base64.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Adversaries may execute their own malicious payloads by hijacking the binaries used by an installer.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.005, T1574
Input: Avaddon has enumerated shared folders and mapped volumes.

Tactics: TA0007
Techniques: T1135
Input: Leviathan has used stolen code signing certificates to sign malware.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Gamaredon Group tools decrypted additional payloads from the C2.

Tactics: TA0005
Techniques: T1140
Input: Remote access tools with built-in features may interact directly with the Windows API to gather and copy to a location.

Tactics: TA0009
Techniques: T1039, T1074.002, T1074.001, T1074
Input: Consider monitoring process resource usage to determine anomalous activity associated with malicious hijacking of computer resources such as CPU, memory, and graphics processing resources.

Tactics: TA0040
Techniques: T1496
Input: NavRAT is able to download and execute files located in the attachment of a received email

Tactics: TA0011
Techniques: T1105
Input: Gazer can establish persistence by creating a .lnk file in the Start menu.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: The Credential Manager stores credentials for signing into websites, applications, and/or devices that request authentication through NTLM or Kerberos in Credential Lockers (previously known as Windows Vaults).

Tactics: TA0006
Techniques: T1555, T1555.004
Input: Conti can enumerate through all open processes to search for any that have the string "sql" in their process name.

Tactics: TA0007
Techniques: T1057
Input: RCSession can compress and obfuscate its strings to evade detection on a compromised host.

Tactics: TA0005
Techniques: T1027
Input: LoudMiner started the cryptomining virtual machine as a service on the infected machine.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: The Server Message Block (SMB) protocol is commonly used in Windows networks for authentication and communication between systems for access to resources and file sharing.

Tactics: TA0006
Techniques: T1187
Input: Ensure permissions are properly set on folders containing sensitive private keys to prevent unintended access.

Tactics: TA0006
Techniques: T1552.004, T1552
Input: Link analysis of infrastructure and tools also revealed a potential relationship between Magic Hound and the adversary group called “Rocket Kitten” (AKA Operation Saffron Rose, Ajax Security Team, Operation Woolen-Goldfish) as well as an older attack campaign called Newscasters

Tactics: TA0007
Techniques: T1518.001, T1518
Input: BLINDINGCAN has executed commands via cmd.exe.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Root certificates (and their associated chains) can also be cloned and reinstalled.

Tactics: TA0005
Techniques: T1553, T1553.004