madox81/Adema_ATTACK_DS huggingface dataset:
Input: Industroyer’s 61850 payload component enumerates connected network adapters and their corresponding IP addresses.

Tactics: TA0007
Techniques: T1016
Input: Stormspotter is an open source tool for enumerating and constructing a graph for Azure resources and services, and Pacu is an open source AWS exploitation framework that supports several methods for discovering cloud services.

Tactics: TA0007
Techniques: T1526
Input: Torisma has encrypted its C2 communications using XOR and VEST-32.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Turla may attempt to connect to systems within a victim's network using net use commands and a predefined list or collection of passwords.

Tactics: TA0006
Techniques: T1110
Input: Enterprises can benefit from Trend Micro’s Smart Protection Suites with XGen security, which infuses high-fidelity machine learning into a blend of threat protection techniques to eliminate security gaps across any user activity and any endpoint

Tactics: TA0007
Techniques: T1518.001, T1518
Input: NanoCore can open a remote command-line interface and execute commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Additionally, a sudden loss of a log source may indicate that it has been disabled.

Tactics: TA0005
Techniques: T1562.008, T1562
Input: Monitor for newly constructed containers that may deploy a container into an environment to facilitate execution or evade defenses.

Tactics: TA0002, TA0005
Techniques: T1610
Input: SodaMaster can use a hardcoded RSA key to encrypt some of its C2 traffic.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Shamoon has an operational mode for encrypting data instead of overwriting it.

Tactics: TA0040
Techniques: T1486
Input: Victim systems would communicate directly with the external proxy on the Internet and then the proxy would forward communications to the C2 server.

Tactics: TA0011
Techniques: T1090, T1090.002
Input: Command Description   !Dir Lists the contents of a specified directory   !Drives Enumerates the storage drives attached to the system and their respective type

Tactics: TA0007
Techniques: T1083
Input: Gelsemium can use junk code to hide functions and evade detection.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: There are different types of add-ins that can be used by the various Office products; including Word/Excel add-in Libraries (WLL/XLL), VBA add-ins, Office Component Object Model (COM) add-ins, automation add-ins, VBA Editor (VBE), Visual Studio Tools for Office (VSTO) add-ins, and Outlook add-ins.

Tactics: TA0003
Techniques: T1137, T1137.006
Input: The ZLib backdoor compresses communications using the standard Zlib compression library.

Tactics: TA0009
Techniques: T1560.002, T1560
Input: Orz can download files onto the victim.

Tactics: TA0011
Techniques: T1105
Input: Lokibot has the ability to capture input on the compromised host via keylogging.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: APT29 has used SSH port forwarding capabilities on public-facing systems, and configured at least one instance of Cobalt Strike to use a network pipe over SMB during the 2020 SolarWinds intrusion.

Tactics: TA0011
Techniques: T1090.001, T1090
Input: BRONZE BUTLER has used various tools to download files, including DGet (a similar tool to wget).

Tactics: TA0011
Techniques: T1105
Input: Adversaries may compromise domain accounts, some with a high level of privileges, through various means such as OS Credential Dumping or password reuse, allowing access to privileged resources of the domain.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.002
Input: PLATINUM has transferred files using the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel.

Tactics: TA0011
Techniques: T1105
Input: Adversaries may make and impersonate tokens to escalate privileges and bypass access controls.

Tactics: TA0004, TA0005
Techniques: T1134.003, T1134
Input: Compare recent invocations of rundll32.exe with prior history of known good arguments and loaded DLLs to determine anomalous and potentially adversarial activity.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Command and control (C2) information can be encoded using a standard data encoding system that adheres to existing protocol specifications.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: The removal of the com.apple.quarantine flag by a user instead of the operating system is a suspicious action and should be examined further.

Tactics: TA0005
Techniques: T1553.001, T1553
Input: PoshC2 contains a module for exploiting SMB via EternalBlue.

Tactics: TA0008
Techniques: T1210
Input: PoetRAT has the ability to list files upon receiving the ls command from C2.

Tactics: TA0007
Techniques: T1083
Input: Infrastructure solutions include physical or cloud servers, domains, and third-party web services.

Tactics: TA0042
Techniques: T1583
Input: InvisiMole has used ListPlanting to inject code into a trusted process.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.015
Input: The information discovered may help the adversary conduct SID-History Injection, Pass the Ticket, and Kerberoasting.

Tactics: TA0007
Techniques: T1482
Input: TrickBot collects email addresses from Outlook.

Tactics: TA0007
Techniques: T1087.003, T1087
Input: Cyclops Blink has the ability to download files to target systems.

Tactics: TA0011
Techniques: T1105
Input: System settings can prevent applications from running that haven't been downloaded through the Apple Store (or other legitimate repositories) which can help mitigate some of these issues.

Tactics: TA0005
Techniques: T1553
Input: Tropic Trooper can search for anti-virus software running on the system.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Monitor the execution of and command-line arguments for applications that may be used by an adversary to gain Initial Access that require user interaction.

Tactics: TA0002
Techniques: T1204
Input: By compromising a VPS to use as infrastructure, adversaries can make it difficult to physically tie back operations to themselves.

Tactics: TA0042
Techniques: T1584.003, T1584
Input: Also monitor for loading of modules associated with specific languages.

Tactics: TA0002
Techniques: T1059
Input: Train users to only accept valid push notifications and to report suspicious push notifications.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078.004, T1078, T1078.002
Input: Stuxnet can delete OLE Automation and SQL stored procedures used to store malicious payloads.

Tactics: TA0005
Techniques: T1070
Input: They also used AdFind to enumerate domains and to discover trust between federated domains.

Tactics: TA0007
Techniques: T1482
Input: APT28 has deployed malware that has copied itself to the startup directory for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: WannaCry uses Tor for command and control traffic.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: Employ network segmentation for sensitive domains..

Tactics: TA0007
Techniques: T1482
Input: Mustang Panda's custom ORat tool uses a WMI event consumer to maintain persistence.

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: PoisonIvy creates a Registry subkey that registers a new service.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Monitor for newly executed processes that may establish persistence by executing malicious content triggered by a file type association.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.001
Input: SILENTTRINITY can collect clear text web credentials for Internet Explorer/Edge.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Upgrade management services to the latest supported and compatible version.

Tactics: TA0006
Techniques: T1110, T1110.001
Input: Monitor for the loading of modules associated with scripting languages (ex: JScript.dll).

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Some data in Remsec is encrypted using RC5 in CBC mode, AES-CBC with a hardcoded key, RC4, or Salsa20.

Tactics: TA0005
Techniques: T1027
Input: Building a client    Build configuration Usage scenario Description     Debug configuration Testing The pre-defined Settings.cs will be used, so edit this file before compiling the client

Tactics: TA0005
Techniques: T1027, T1562.001, T1562
Input: APT12 closely monitors online media related to its tools and operations and reacts when its tools are publicly disclosed

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Frankenstein has harvested credentials from the victim's machine using Empire.

Tactics: TA0006
Techniques: T1003
Input: Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

Tactics: TA0004
Techniques: T1068
Input: Digital certificates can then be installed on adversary controlled infrastructure that may have been acquired (Acquire Infrastructure) or previously compromised (Compromise Infrastructure).

Tactics: TA0042
Techniques: T1608.003, T1608
Input: APT41 used VMProtected binaries in multiple intrusions.

Tactics: TA0005
Techniques: T1027
Input: LoudMiner deleted installation files after completion.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Monitor executed commands and arguments that may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events.

Tactics: TA0003, TA0004
Techniques: T1546
Input: When it first starts, BADNEWS spawns a new thread to log keystrokes.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Many of the commands used to modify DACLs and file/directory ownership are built-in system utilities and may generate a high false positive alert rate, so compare against baseline knowledge for how systems are typically used and correlate modification events with other indications of malicious activity where possible.

Tactics: TA0005
Techniques: T1222, T1222.001
Input: Attor's dispatcher has used CreateProcessW API for execution.

Tactics: TA0002
Techniques: T1106
Input: Toolkits like the PowerSploit framework contain PowerUp modules that can be used to explore systems for DLL hijacking weaknesses.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Empire can enumerate the current network connections of a host.

Tactics: TA0007
Techniques: T1049
Input: Bandook can upload files from a victim's machine over the C2 channel.

Tactics: TA0010
Techniques: T1041
Input: This technique differs from Screen Capture due to use of specific devices or applications for video recording rather than capturing the victim's screen.

Tactics: TA0009
Techniques: T1125
Input: When we converted the dates in the file strings from the Solar Hijri calendar to the Gregorian one, we found that they were close to the compilation times of the executables and also close to when Cadelle’s targets were initially compromised

Tactics: TA0005
Techniques: T1027
Input: Ixeshe can list running processes.

Tactics: TA0007
Techniques: T1057
Input: The discovery modules used with Duqu can collect information on process details.

Tactics: TA0007
Techniques: T1057
Input: To defend against SYN floods, enable SYN Cookies.

Tactics: TA0040
Techniques: T1499
Input: Bisonal has launched cmd.exe and used the ShellExecuteW() API function to execute commands on the system.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: KillDisk overwrites the first sector of the Master Boot Record with "0x00".

Tactics: TA0040
Techniques: T1561, T1561.002
Input: Typically, management services over commonly used ports are used when password spraying.

Tactics: TA0006
Techniques: T1110, T1110.003
Input: These files can be parsed with lnk-parser to extract all contents

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: This differs from Steal Web Session Cookie and other similar behaviors in that the cookies are new and forged by the adversary, rather than stolen or intercepted from legitimate users.

Tactics: TA0006
Techniques: T1606, T1606.001
Input: Get-GPPPassword

Tactics: TA0006
Techniques: T1552, T1552.006
Input: Transport agents can be written by application developers and then compiled to .NET assemblies that are subsequently registered with the Exchange server.

Tactics: TA0003
Techniques: T1505.002, T1505
Input: Adversaries may choose to do this if they have sufficient access or proximity, and the connection might not be secured or defended as well as the primary Internet-connected channel because it is not routed through the same enterprise network.

Tactics: TA0010
Techniques: T1011
Input: For example, one of these FIN7 LNK files contained the following properties:  Version: 0 NetBIOS name: andy-pc Droid volume identifier: e2c10c40-6f7d-4442-bcec-470c96730bca Droid file identifier: a6eea972-0e2f-11e7-8b2d-0800273d5268 Birth droid volume identifier: e2c10c40-6f7d-4442-bcec-470c96730bca Birth droid file identifier: a6eea972-0e2f-11e7-8b2d-0800273d5268 MAC address: 08:00:27:3d:52:68 UUID timestamp: 03/21/2017 (12:12:28.500) [UTC] UUID sequence number: 2861  From this LNK file, we can see not only what the shortcut launched within the string data, but that the attacker likely generated this file on a VirtualBox system with hostname “andy-pc” on March 21, 2017

Tactics: TA0003, TA0004, TA0005, TA0007
Techniques: T1547.009, T1070, T1070.006, T1547, T1082
Input: In some cases, the encoded PowerShell commands were used to download and execute content hosted on the paste site hxxps://pastebin[.]com

Tactics: TA0011
Techniques: T1102
Input: Adversaries may use the information from System Service Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Tactics: TA0007
Techniques: T1007
Input: Consider enabling file/directory permission change auditing on folders containing key binary/configuration files.

Tactics: TA0005
Techniques: T1222.002, T1222, T1222.001
Input: Kimsuky has developed its own unique malware such as MailFetch.py for use in operations.

Tactics: TA0042
Techniques: T1587, T1587.001
Input: InvisiMole has used scheduled tasks named MSST and \Microsoft\Windows\Autochk\Scheduled to establish persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: By responding to LLMNR/NBT-NS network traffic, adversaries may spoof an authoritative source for name resolution to force communication with an adversary controlled system.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: PoshC2 can perform port scans from an infected host.

Tactics: TA0007
Techniques: T1046
Input: These databases can be stored as files on disk.

Tactics: TA0006
Techniques: T1555.005, T1555
Input: Detection of steganography is difficult unless artifacts are left behind by the obfuscation process that are detectable with a known signature.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: Monitor executed commands and arguments that may abuse Microsoft Office add-ins to obtain persistence on a compromised system.

Tactics: TA0003
Techniques: T1137, T1137.006
Input: RGDoor decodes Base64 strings and decrypts strings using a custom XOR algorithm.

Tactics: TA0005
Techniques: T1140
Input: Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Tactics: TA0007
Techniques: T1057
Input: KGH_SPY has been spread through Word documents containing malicious macros.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Calisto collects Keychain storage data and copies those passwords/tokens to a file.

Tactics: TA0006
Techniques: T1555.001, T1555
Input: SDBbot has used a packed installer file.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Commands such as net view can be used in Net to gather information about available remote systems.

Tactics: TA0007
Techniques: T1018
Input: SILENTTRINITY can create a backdoor in KeePass using a malicious config file and in TortoiseSVN using a registry hook.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556
Input: Log changes to boot records, BIOS, and EFI

Tactics: TA0003, TA0005
Techniques: T1542
Input: Monitor DLLs that are loaded by spoolsv.exe for DLLs that are abnormal.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.010
Input: Monitor executed commands and arguments that may delete or alter generated artifacts on a host system, including logs or captured files such as quarantined malware.

Tactics: TA0005
Techniques: T1070
Input: Dtrack can list files on available disk volumes.

Tactics: TA0007
Techniques: T1083
Input: Adversaries can execute malicious content by interacting with or creating services either locally or remotely.

Tactics: TA0002
Techniques: T1569
Input: Lucifer can clear and remove event logs.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: In macOS, the Ay MaMi malware uses /usr/bin/security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain /path/to/malicious/cert to install a malicious certificate as a trusted root certificate into the system keychain.

Tactics: TA0005
Techniques: T1553, T1553.004
Input: WarzoneRAT has been install via template injection through a malicious DLL embedded within a template RTF in a Word document.

Tactics: TA0005
Techniques: T1221
Input: [random_name].plist in the /Library/LaunchDaemons folder with the RunAtLoad and KeepAlive keys set to true.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: OopsIE creates and uses a VBScript as part of its persistent execution.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Bisonal has been delivered as malicious email attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Leviathan has targeted RDP credentials and used it to move through the victim environment.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Ixeshe sets its own executable file's attributes to hidden.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Gelsemium can drop itself in C:\Windows\System32\spool\prtprocs\x64\winprint.dll to be loaded automatically by the spoolsv Windows service.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.012
Input: Monitor for an attempt by a user to gain access to a network or computing resource, often by the use of domain authentication services, such as the System Security Services Daemon (sssd) on Linux

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.003, T1078.002
Input: OilRig has used tools to identify if a mouse is connected to a targeted system.

Tactics: TA0007
Techniques: T1120
Input: Other methods of MFA may be intercepted and used by an adversary to authenticate.

Tactics: TA0006
Techniques: T1111
Input: Adversaries may exploit known or zero-day vulnerabilities to crash applications and/or systems, which may also lead to dependent applications and/or systems to be in a DoS condition.

Tactics: TA0040
Techniques: T1499, T1499.004
Input: Janicab used a cron job for persistence on Mac devices.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: Sidewinder has used DLL side-loading to drop and execute malicious payloads including the hijacking of the legitimate Windows application file rekeywiz.exe.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: It has changed the proxy configuration of a victim system by modifying the HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap registry.

Tactics: TA0005
Techniques: T1112
Input: ShimRat can uninstall itself from compromised hosts, as well create and modify directories, delete, move, copy, and rename files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: ShadowPad has used DNS tunneling for C2 communications.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Aquatic Panda has downloaded additional scripts and executed Base64 encoded commands in PowerShell.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Monitor changes to client software that do not correlate with known software or patch cycles.

Tactics: TA0003
Techniques: T1554
Input: Adversaries may gather information about the victim's hosts that can be used during targeting.

Tactics: TA0043
Techniques: T1592
Input: MarkiRAT can masquerade as update.exe and svehost.exe; it has also mimicked legitimate Telegram and Chrome files.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: In general, detecting usage of fast flux DNS is difficult due to web traffic load balancing that services client requests quickly.

Tactics: TA0011
Techniques: T1568.001, T1568
Input: APT1 uses two utilities, GETMAIL and MAPIGET, to steal email.

Tactics: TA0009
Techniques: T1114, T1114.002, T1114.001
Input: It does this by creating the following Registry keys: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs – %APPDATA%\Intel\ResN32.dll and HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\LoadAppInit_DLLs – 0x1.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.010
Input: As a result, adversaries dramatically reduce the amount of effort needed to decrypt the protected information without the key.

Tactics: TA0005
Techniques: T1600.001, T1600
Input: The payload of CozyCar is encrypted with simple XOR with a rotating key.

Tactics: TA0005
Techniques: T1027
Input: Empire can use PsExec to execute a payload on a remote host.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Astaroth obfuscates its JScript code, and has used an XOR-based algorithm to encrypt payloads twice with different keys.

Tactics: TA0005
Techniques: T1027
Input: LockerGoga has been observed changing account passwords and logging off current users.

Tactics: TA0040
Techniques: T1531
Input: Analysis of their configurations show that the C2 servers used both fully-qualified domain names and IP addresses

Tactics: TA0007
Techniques: T1016
Input: Monitor Registry values associated with IFEOs, as well as silent process exit monitoring, for modifications that do not correlate with known software, patch cycles,

Tactics: TA0003, TA0004
Techniques: T1546.012, T1546
Input: Adversaries may modify components of the PAM system to create backdoors.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.003, T1556
Input: menuPass has used key loggers to steal usernames and passwords.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: The SMOKEDHAM source code is embedded in the dropper as an encrypted string.

Tactics: TA0005
Techniques: T1027
Input: Filename qrat.exe   File Size 1093120 bytes   MD5 c05e5131b196f43e1d02ca5ccc48ec0e   SHA1 f28c592833f234c619917b5c7d8974840a810247   Notes Dropper that installs QuasarRAT file microsoft_network.exe and scheduled task wrapper file Microsoft.Win32.TaskScheduler.dll

Tactics: TA0005
Techniques: T1036
Input: Stuxnet enumerates the directories of a network resource.

Tactics: TA0007
Techniques: T1135
Input: RCSession has the ability to use TCP and UDP in C2 communications.

Tactics: TA0011
Techniques: T1095
Input: WhisperGate has the ability to enumerate fixed logical drives on a targeted system.

Tactics: TA0007
Techniques: T1082
Input: APT29 has bypassed UAC.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Since StartupItems are deprecated, preventing all users from writing to the /Library/StartupItems directory would prevent any startup items from getting registered.

Tactics: TA0003, TA0004
Techniques: T1037, T1037.005
Input: MechaFlounder has the ability to upload and download files to and from a compromised host.

Tactics: TA0011
Techniques: T1105
Input: CDN domains may trigger these detections due to the format of their domain names.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: SUNBURST checked the domain name of the compromised host to verify it was running in a real environment.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Turian can download additional files and tools from its C2.

Tactics: TA0011
Techniques: T1105
Input: Sysmon events can also be used to identify potential abuses of CMSTP.exe.

Tactics: TA0005
Techniques: T1218, T1218.003
Input: Taidoor has collected the MAC address of a compromised host; it can also use GetAdaptersInfo to identify network adapters.

Tactics: TA0007
Techniques: T1016
Input: ObliqueRAT has the ability to extract data from removable devices connected to the endpoint.

Tactics: TA0009
Techniques: T1025