madox81/Adema_ATTACK_DS huggingface dataset:
Input: During the installation process, it is common for installers to use a subdirectory within the %TEMP% directory to unpack binaries such as DLLs, EXEs, or other payloads.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.005, T1574
Input: If the string is present, the malware executes the command RunDll32.exe

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Pteranodon can download and execute additional files.

Tactics: TA0011
Techniques: T1105
Input: WindTail can invoke Apple APIs contentsOfDirectoryAtPath, pathExtension, and (string) compare.

Tactics: TA0002
Techniques: T1106
Input: The Trojan will convert these hexadecimal bytes to their binary values and write them to a file and will run the file using the “open” function using the ShellExecuteW API function

Tactics: TA0002, TA0005
Techniques: T1140, T1106
Input: A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.

Tactics: TA0002
Techniques: T1609
Input: Adversaries may forge credential materials that can be used to gain access to web applications or Internet services.

Tactics: TA0006
Techniques: T1606
Input: Windows Services that are run as a "generic" process (ex: svchost.exe) load the service's DLL file, the location of which is stored in a Registry entry named ServiceDll.

Tactics: TA0003
Techniques: T1505.005, T1505
Input: MiniDuke can download additional encrypted backdoors onto the victim via GIF files.

Tactics: TA0011
Techniques: T1105
Input: ShimRatReporter used the Windows function GetExtendedUdpTable to detect connected UDP endpoints.

Tactics: TA0007
Techniques: T1049
Input: PUNCHBUGGY can load a DLL using the LoadLibrary API.

Tactics: TA0002
Techniques: T1129
Input: Employee names be used to derive email addresses as well as to help guide other reconnaissance efforts and/or craft more-believable lures.

Tactics: TA0043
Techniques: T1589.003, T1589
Input: Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems.

Tactics: TA0001
Techniques: T1566.003, T1566
Input: APT39 has installed ANTAK and ASPXSPY web shells.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Mosquito's installer uses WMI to search for antivirus display names.

Tactics: TA0002
Techniques: T1047
Input: Monitor executed commands and arguments to detect token manipulation by auditing command-line activity.

Tactics: TA0004, TA0005
Techniques: T1134.002, T1134.003, T1134, T1134.001
Input: We include a list of observed hardcoded ip C2 addresses here, along with the address owner and geophysical location of the host:    C2 IP address Owner Country   184.22.205.194 hostnoc.net US   5.79.80.166 Leaseweb NL   46.165.222.28 Leaseweb NL   95.211.122.36 Leaseweb NL   46.165.222.101 Leaseweb NL   46.165.222.6 Leaseweb NL   89.149.223.205 Leaseweb NL   85.17.94.134 Leaseweb NL   46.4.28.218 Hetzner DE   78.46.40.239 Hetzner DE   95.143.193.182 Serverconnect SE   188.227.176.74 Redstation GB   93.170.127.100 Nadym RU   37.220.34.56 Yisp NL   194.28.172.58 Besthosting.ua UA   124.217.253.10 PIRADIUS MY   84.19.161.123 Keyweb DE   109.236.88.12 worldstream.nl NL   212.124.110.62 digitalone.com US   5.61.38.31 3nt.com DE   5.255.87.39 serverius.com NL    It’s interesting that one of these servers is a Tor exit node

Tactics: TA0007, TA0011
Techniques: T1008, T1016
Input: SILENTTRINITY has a module that can extract cached GPP passwords.

Tactics: TA0006
Techniques: T1552, T1552.006
Input: Install software in write-protected locations.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574
Input: RedLeaves can delete specified files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: P.A.S. Webshell can display the /etc/passwd file on a compromised host.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Metamorfo has digitally signed executables using AVAST Software certificates.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Some Daserf samples were signed with a stolen digital certificate.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: HARDRAIN uses the command cmd.exe /c netsh firewall add portopening TCP 443 "adp" and makes the victim machine function as a proxy server.

Tactics: TA0011
Techniques: T1090
Input: at can be used to schedule a task on a system to be executed at a specific date or time.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: If that fails, the payload will use DNS tunneling by first issuing a DNS query to resolve the following domain to notify the C2 that the payload will send data to it in subsequent DNS queries:   ns1.<random number between 100000 and 999999>.<c2 name>   The payload will then split the message up into 60-byte chunks (only 1 in this case), which it will send to the C2 via DNS queries to resolve domains structured as:   <encoded/encrypted data of message>.<same random number between 100000 and 999999>.<c2 name>   The payload will notify the C2 that it is done sending data by issuing a DNS query to resolve a domain structured as:   ns2.<same random number between 100000 and 999999>.<c2 name>   Package Comparison of the QUADAGENT Samples The bat2exe version (SHA256: 5f001f3387ddfc0314446d0c950da2cec4c786e2374d42beb3acce6883bb4e63)has a batch script, PowerShell script, and associated file names embedded within several resources that it will decrypt using RC4 and various MD5 hashes for keys

Tactics: TA0011, TA0010
Techniques: T1573, T1071, T1048, T1008
Input: These parameters install it as a service

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: APC injection is commonly performed by attaching malicious code to the APC Queue  of a process's thread.

Tactics: TA0004, TA0005
Techniques: T1055.004, T1055
Input: Fox Kitten has used cmd.exe likely as a password changing mechanism.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: ExecReload directive covers when a service restarts.

Tactics: TA0003, TA0004
Techniques: T1543.002, T1543
Input: Okrum has built-in commands for uploading, downloading, and executing files to the system.

Tactics: TA0011
Techniques: T1105
Input: Adversaries may use SNMP queries to collect MIB content directly from SNMP-managed devices in order to collect network information that allows the adversary to build network maps and facilitate future targeted exploitation.

Tactics: TA0009
Techniques: T1602.001, T1602
Input: Leafminer used Microsoft’s Sysinternals tools to gather detailed information about remote systems.

Tactics: TA0007
Techniques: T1018
Input: EnvyScout contains JavaScript code that can extract an encoded blob from its HTML body and write it to disk.

Tactics: TA0005
Techniques: T1027.006, T1027
Input: Conficker adds Registry Run keys to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: We were able to brute force the actor-provided key using the inverse arithmetic operations using the embedded salt and embedded ciphertext, so we were able to extract the embedded webshells with ease

Tactics: TA0006
Techniques: T1110
Input: Empire can use Inveigh to conduct name service poisoning for credential theft and associated relay attacks.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: This behavior also considers files that are overwritten.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.010, T1574
Input: In addition to purchasing malware, adversaries may steal and repurpose malware from third-party entities (including other adversaries).

Tactics: TA0042
Techniques: T1588, T1588.001
Input: Adversaries may abuse COR_PROFILER to establish persistence that executes a malicious DLL in the context of all .NET processes every time the CLR is invoked.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.012, T1574
Input: Monitor for newly constructed files to match an existing service executable, it could be detected and correlated with other suspicious behavior.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.005, T1574
Input: Many vendors of embedded network devices can provide advanced debugging support that will allow them to work with device owners to validate the integrity of the operating system running in memory.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: Darkhotel malware can obtain system time from a compromised host.

Tactics: TA0007
Techniques: T1124
Input: Linfo creates a backdoor through which remote attackers can list contents of drives and search for files.

Tactics: TA0007
Techniques: T1083
Input: The group has also set a Startup path to launch the PowerShell shell command and download Cobalt Strike.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Lazarus Group has exfiltrated stolen data to Dropbox using a customized version of dbxcli.

Tactics: TA0010
Techniques: T1567.002, T1567
Input: Ebury has installed a self-signed RPM package mimicking the original system package on RPM based systems.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Is this a Windows-only threat? Which versions of Windows are targeted? Poseidon is particularly focused on the Microsoft Windows operating system family, specifically customizing the infection method for each one so as to gather different information and hide its presence after the initial infection

Tactics: TA0007
Techniques: T1082
Input: Attor encrypts collected data with a custom implementation of Blowfish and RSA ciphers.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: Similar to Regsvr32, odbcconf.exe has a REGSVR flag that can be misused to execute DLLs (ex: odbcconf.exe /S /A &lbrace;REGSVR "C:\Users\Public\file.dll"&rbrace;).

Tactics: TA0005
Techniques: T1218, T1218.008
Input: Monitor executed commands and arguments for suspicious commands to modify accounts or account settings (including files such as the authorized_keys or /etc/ssh/sshd_config).

Tactics: TA0003
Techniques: T1098
Input: 63 64 ku64.dll ku32.dll Keylogger & clipboard monitor

Tactics: TA0006, TA0009
Techniques: T1056
Input: The macro contains a PowerShell script to persist in the "Run" registry key, "KCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemTextEncoding".

Tactics: TA0002
Techniques: T1059.001, T1059
Input: ICMP communication between hosts is one example.

Tactics: TA0011
Techniques: T1095
Input: CallMe exfiltrates data to its C2 server over the same protocol as C2 communications.

Tactics: TA0010
Techniques: T1041
Input: Also ensure hosts are only provisioned to communicate over authorized interfaces.

Tactics: TA0011
Techniques: T1095
Input: Kerrdown can download specific payloads to a compromised host based on OS architecture.

Tactics: TA0011
Techniques: T1105
Input: WellMess can execute PowerShell scripts received from C2.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: An exploit takes advantage of a bug or vulnerability in order to cause unintended or unanticipated behavior to occur on computer hardware or software.

Tactics: TA0042
Techniques: T1588, T1587, T1587.004, T1588.005
Input: Adversaries may modify file time attributes to hide new or changes to existing files.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: Use least privilege and protect administrative access to the Domain Controller and Active Directory Federation Services (AD FS) server.

Tactics: TA0004, TA0005
Techniques: T1484
Input: Firstly, the reason this has been named MirageFox instead of just Mirage, is because in the Export directory for the modules, the name field is filled with a string MirageFox_Server.dat

Tactics: TA0005
Techniques: T1036
Input: Magic Hound has used the command-line interface.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Monitor for changes made to files in user directories.

Tactics: TA0040
Techniques: T1486
Input: Also consider comparing components, including hashes of component firmware and behavior, against known good images.

Tactics: TA0003, TA0005
Techniques: T1542.002, T1542
Input: This screenshot is via an RDP session as indicated by the tab located at the top of the screen and is located at 164.132.67[.]216 which is hosted by OVH

Tactics: TA0009
Techniques: T1113
Input: Indrik Spider has served fake updates via legitimate websites that have been compromised.

Tactics: TA0042
Techniques: T1584.004, T1584
Input: Chrommme can retrieve the username from a targeted system.

Tactics: TA0007
Techniques: T1033
Input: GPOs are containers for group policy settings made up of files stored within a predicable network path \<DOMAIN>\SYSVOL\<DOMAIN>\Policies\.

Tactics: TA0004, TA0005
Techniques: T1484.001, T1484
Input: SombRAT can use a custom DGA to generate a subdomain for C2.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: Bazar can create a task named to appear benign.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Common malicious usage includes automating execution of behaviors with VBScript or embedding VBA content into Spearphishing Attachment payloads (which may also involve Mark-of-the-Web Bypass to enable execution).

Tactics: TA0002
Techniques: T1059.005, T1059
Input: StreamEx obfuscates some commands by using statically programmed fragments of strings when starting a DLL.

Tactics: TA0005
Techniques: T1027
Input: jRAT has the capability to capture video from a webcam.

Tactics: TA0009
Techniques: T1125
Input: BISCUIT malware contains a secondary fallback command and control server that is contacted after the primary command and control server.

Tactics: TA0011
Techniques: T1008
Input: The command prompt can be invoked remotely via Remote Services such as SSH.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: QuietSieve can download and execute payloads on a target host.

Tactics: TA0011
Techniques: T1105
Input: BlackEnergy has conducted port scans on a host.

Tactics: TA0007
Techniques: T1046
Input: Sliver has the ability to gather network configuration information.

Tactics: TA0007
Techniques: T1016
Input: Regin stage 1 modules for 64-bit systems have been found to be signed with fake certificates masquerading as originating from Microsoft Corporation and Broadcom Corporation.

Tactics: TA0005
Techniques: T1036, T1036.001
Input: Mustang Panda has communicated with its C2 via HTTP POST requests.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Turla used net use commands to connect to lateral systems within a network.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: SynAck encrypts the victims machine followed by asking the victim to pay a ransom.

Tactics: TA0040
Techniques: T1486
Input: Events should then not be viewed in isolation, but as part of a chain of behavior that could lead to other activities.

Tactics: TA0005
Techniques: T1578.002, T1578.003, T1578
Input: can collect system information, including computer name, system manufacturer, IsDebuggerPresent state, and execution path.

Tactics: TA0007
Techniques: T1082
Input: Adversaries may rent Virtual Private Servers (VPSs) that can be used during targeting.

Tactics: TA0042
Techniques: T1583.003, T1583
Input: Empire also contains the ability to conduct PowerShell remoting with the Invoke-PSRemoting module.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Ngrok can be used to proxy connections to machines located behind NAT or firewalls.

Tactics: TA0011
Techniques: T1090
Input: Attor has a plugin that collects data stored in the Windows clipboard by using the OpenClipboard and GetClipboardData APIs.

Tactics: TA0009
Techniques: T1115
Input: Credential Harvesting Attack On June 24, 2018, Unit 42 observed DarkHydrus carrying out a credential harvesting attack on an educational institution in the Middle East

Tactics: TA0006
Techniques: T1003
Input: Gazer can establish persistence by creating a .lnk file in the Start menu or by modifying existing .lnk files to execute the malware through cmd.exe.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: The macro uses PowerShell to download a shellcode-based payload from a remote server using one of two available techniques

Tactics: TA0002
Techniques: T1059.001, T1059
Input: A list of all shims currently installed by the default Windows installer (sdbinst.exe) is kept in:

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: Bankshot modifies the time of a file as specified by the control server.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: For example, in Azure AD environments, an adversary with the Application Administrator role can add Additional Cloud Credentials to their application's service principal.

Tactics: TA0003
Techniques: T1098, T1098.003
Input: These private keys can be used to authenticate to Remote Services like SSH or for use in decrypting other collected files such as email.

Tactics: TA0006
Techniques: T1552.004, T1552
Input: It has used a different AES-256 encryption key per file with a bundled RAS-4096 public encryption key that is unique for each victim.

Tactics: TA0040
Techniques: T1486
Input: Felismus collects the victim LAN IP address and sends it to the C2 server.

Tactics: TA0007
Techniques: T1016
Input: Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes.

Tactics: TA0003, TA0004
Techniques: T1546.009, T1546
Input: NavRAT can download files remotely.

Tactics: TA0011
Techniques: T1105
Input: WarzoneRAT can masquerade the Process Environment Block on a compromised host to hide it's attempts to elevate privileges through IFileOperation.

Tactics: TA0005
Techniques: T1564
Input: Nebulae can list files and directories on a compromised host.

Tactics: TA0007
Techniques: T1083
Input: Collect data on account creation within a network or Windows Event ID 4720 (for when a user account is created on a Windows system and domain controller).

Tactics: TA0003
Techniques: T1136, T1136.001, T1136.002
Input: CPL files can be executed directly via the CPL API function with just the latter Rundll32 command, which may bypass detections and/or execution filters for control.exe.

Tactics: TA0005
Techniques: T1218, T1218.002
Input: An adversary may take advantage of that build API to build a custom image on the host that includes malware downloaded from their C2 server, and then they then may utilize Deploy Container using that custom image.

Tactics: TA0005
Techniques: T1612
Input: JPIN's installer/uninstaller component deletes itself if it encounters a version of Windows earlier than Windows XP or identifies security-related processes running.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: When documents, applications, or programs are downloaded an extended attribute (xattr) called com.apple.quarantine can be set on the file by the application performing the download.

Tactics: TA0005
Techniques: T1553.001, T1553
Input: To support complex operations, the XSL standard includes support for embedded scripting in various languages.

Tactics: TA0005
Techniques: T1220
Input: Manipulating the domain trusts may allow an adversary to escalate privileges and/or evade defenses by modifying settings to add objects which they control.

Tactics: TA0004, TA0005
Techniques: T1484, T1484.002
Input: Lazarus Group has rebooted systems after destroying files and wiping the MBR on infected systems.

Tactics: TA0040
Techniques: T1529
Input: Adversaries may also escape via Exploitation for Privilege Escalation, such as exploiting vulnerabilities in global symbolic links in order to access the root directory of a host machine.

Tactics: TA0004
Techniques: T1611
Input: TrickBot can implant malicious code into a compromised device's firmware.

Tactics: TA0003, TA0005
Techniques: T1542.003, T1542
Input: Grandoreiro has added BMP images to the resources section of its Portable Executable (PE) file increasing each binary to at least 300MB in size.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: Upon opening the malicious DOC attachment, an additional download is triggered from a stored URL within an embedded OLE Object (seen in Figure 4)

Tactics: TA0011
Techniques: T1105
Input: In some cases, these files can be copied and reused on another machine or the contents can be read and then used to authenticate without needing to copy any files.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: Consider utilizing seccomp, seccomp-bpf, or a similar solution that restricts certain system calls such as mount.

Tactics: TA0004
Techniques: T1611
Input: Adversaries may attempt to exfiltrate data over a USB connected physical device.

Tactics: TA0010
Techniques: T1052, T1052.001
Input: Cobalt Group used the Ammyy Admin tool as well as TeamViewer for remote access, including to preserve remote access if a Cobalt Strike module was lost.

Tactics: TA0011
Techniques: T1219
Input: Tomiris can use HTTP to establish C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: MuddyWater has used a series of compromised websites that victims connected to randomly to relay information to command and control (C2).

Tactics: TA0011
Techniques: T1090, T1090.002
Input: Ke3chang has used Base64-encoded shellcode strings.

Tactics: TA0005
Techniques: T1027
Input: Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen.

Tactics: TA0011
Techniques: T1001
Input: HTML documents can store large binary objects known as JavaScript Blobs (immutable data that represents raw bytes) that can later be constructed into file-like objects.

Tactics: TA0005
Techniques: T1027.006, T1027
Input: Specifically, analysts should look for use of the runas command.

Tactics: TA0004, TA0005
Techniques: T1134, T1134.001
Input: In user mode, Windows Authenticode  digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code (ex: a driver with a valid Microsoft signature may be handled as safe).

Tactics: TA0005
Techniques: T1553, T1553.003
Input: TeamTNT has executed PowerShell commands in batch scripts.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Identify and block potentially malicious unmanaged COR_PROFILER profiling DLLs  by using application control solutions like AppLocker that are capable of auditing and/or blocking unapproved DLLs.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.012, T1574
Input: APT38 has collected data from a compromised host.

Tactics: TA0009
Techniques: T1005
Input: PowerSploit contains a collection of Privesc-PowerUp modules that can query Registry keys for potential opportunities.

Tactics: TA0007
Techniques: T1012
Input: ChChes can alter the victim's proxy configuration.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Mimikatz's kerberos module can create golden tickets.

Tactics: TA0006
Techniques: T1558, T1558.001
Input: Note that the libraries are different from the utilities.

Tactics: TA0009
Techniques: T1560.002, T1560
Input: On Windows 10 and Server 2016, enable Windows Defender Credential Guard  to run lsass.exe in an isolated virtualized environment without any device drivers.

Tactics: TA0003, TA0004
Techniques: T1547.008, T1547
Input: Crutch can use Dropbox to receive commands and upload stolen data.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: Gelsemium can use the IARPUinstallerStringLauncher COM interface are part of its UAC bypass process.

Tactics: TA0002
Techniques: T1559, T1559.001
Input: APT29 obtained information about the configured Exchange virtual directory using Get-WebServicesVirtualDirectory.

Tactics: TA0007
Techniques: T1083
Input: Monitor executed commands and arguments that may gather information about the victim's DNS that can be used during targeting.

Tactics: TA0005
Techniques: T1218, T1218.014
Input: Refer to NIST guidelines when creating password policies.

Tactics: TA0005, TA0006
Techniques: T1601, T1110.004, T1110, T1110.002, T1601.001, T1110.001, T1110.003
Input: Operation Wocao has collected clipboard data in plaintext.

Tactics: TA0009
Techniques: T1115
Input: Mustang Panda has also stored documents for exfiltration in a hidden folder on USB drives.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: On Windows systems, monitor for creation of suspicious inbox rules through the use of the New-InboxRule and Set-InboxRule PowerShell cmdlets.

Tactics: TA0005
Techniques: T1564, T1564.008