madox81/Adema_ATTACK_DS huggingface dataset:
Input: 05 27 28 obj32.bin obj32.bin obj64.bin Shellcode template is used by Reinstaller/Injector (rsXX.dll) and AudioRecorder4MetroApp (meXX.dll) for injecting into running processes

Tactics: TA0004, TA0005
Techniques: T1055
Input: Related MD5s 62c4ce93050e48d623569c7dcc4d0278, 2537.ex_ a5d6ad8ad82c266fda96e076335a5080, drop1.ex_ 93176df76e351b3ea829e0e6c6832bdf, drop1.pd_ 7688be226b946e231e0cd36e6b708d20, 8.zip fd8e27f820bdbdf6cb80a46c67fd978a, doc853.ex_ 93176df76e351b3ea829e0e6c6832bdf, doc853.pdf 9ad55b83f2eec0c19873a770b0c86a2f, reader_sl.ex_ f16dff8ec8702518471f637eb5313ab2 1.ex_ 8670710bc9477431a01a576b6b5c1b2a 93176df76e351b3ea829e0e6c6832bdf, dropped\hppscan854.pdf f58a4369b8176edbde4396dc977c9008, dropped\reader_sl.ex_ 83f57f0116a3b3d69ef7b1dbe9943801 b5553645fe819a93aafe2894da13dae7 acffb2823fc655637657dcbd25f35af8 1a42acbdb285a7fba17f95068822ea4e d543904651b180fd5e4dc1584e639b5e d7af9a4010c75af6756a603fd6aef5a4 93176df76e351b3ea829e0e6c6832bdf, 3852.pdf f2b05e6b01be3b6cb14e9068e7a66fc1, dropped\reader_sl.ex_ 57a1f0658712ee7b3a724b6d07e97259, dropped\3852.ex_ 93176df76e351b3ea829e0e6c6832bdf, 5463.pdf eb22b99d44223866e24872d80a4ddefd, dropped\5463\reader_sl.ex_ 90bd910ee161b71c7a37ac642f910059, dropped\5463.ex_ 1a262a7bfecd981d7874633f41ea5de8 98a6484533fa12a9ba6b1bd9df1899dc 7f6bca4f08c63e597bed969f5b729c56 08709ef0e3d467ce843af4deb77d74d5 Related CozyDuke C&Cs: 121.193.130.170:443/wp-ajax.php 183.78.169.5:443/search.php 200.119.128.45:443/mobile.php 200.125.133.28:443/search.php 200.125.142.11:443/news.php 201.76.51.10:443/plugins/json.php 202.206.232.20:443/rss.php 202.76.237.216:443/search.php 203.156.161.49:443/plugins/twitter.php 208.75.241.246:443/msearch.php 209.40.72.2:443/plugins/fsearch.php 210.59.2.20:443/search.php 208.77.177.24:443/fsearch.php www.getiton.hants.org.uk:80/themes/front/img/ajax.php www.seccionpolitica.com.ar:80/galeria/index.php 209.200.83.43/ajax/links.php 209.200.83.43/ajax/api.php 209.200.83.43/ajax/index.php 209.200.83.43/ajax/error.php 209.200.83.43/ajax/profile.php 209.200.83.43/ajax/online.php 209.200.83.43/ajax/loader.php 209.200.83.43/ajax/search.php Appendix: Parallel and Previous Research The MiniDuke Mystery: PDF 0-day Government Spy Assembler 0x29A Micro Backdoor, Securelist, Feb 2013Miniduke is back: Nemesis Gemina and the Botgen Studio, Securelist, July 2014MiniDuke 2 (CosmicDuke), CrySyS, July 2014COSMICDUKE Cosmu with a twist of MiniDuke [pdf], F-Secure, September 2014THE CASE OF THE MODIFIED BINARIES, Leviathan Security, October 2014A word on CosmicDuke, Blaze’s Security Blog, September 2014OnionDuke: APT Attacks Via the Tor Network, F-Secure, November 2014The Connections Between MiniDuke, CosmicDuke and OnionDuke, F-Secure, January 2015 Kaspersky Lab products detect the malware used by the CozyDuke threat actor as: HEUR:Trojan.Win32.CozyDuke.gen Trojan.Win32.CozyBear.*

Tactics: TA0001, TA0006, TA0007, TA0011, TA0010
Techniques: T1110, T1518.001, T1090.003, T1566.003, T1048, T1566, T1083, T1566.002, T1518, T1571, T1090
Input: SeaDuke is capable of persisting via a .lnk file stored in the Startup directory.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Kimsuky has used FTP to download additional malware to the target machine.

Tactics: TA0011
Techniques: T1071.002, T1071
Input: Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments ( monitor anomalies in use of files that do not normally initiate network connections or unusual connections initiated

Tactics: TA0010
Techniques: T1030
Input: Gamaredon Group has used tools to delete files and folders from victims' desktops and profiles.

Tactics: TA0040
Techniques: T1485
Input: A print processor can be installed through the AddPrintProcessor API call with an account that has SeLoadDriverPrivilege enabled.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.012
Input: CharmPower can use HTTP to communicate with C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: netsh can be used to disable local firewall settings.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: An adversary could utilize regions which do not support advanced detection services in order to avoid detection of their activity.

Tactics: TA0005
Techniques: T1535
Input: Revenge RAT collects the IP address and MAC address from the system.

Tactics: TA0007
Techniques: T1016
Input: OSX_OCEANLOTUS.D deletes the app bundle and dropper after execution.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: BitPaymer compares file names and paths to a list of excluded names and directory names during encryption.

Tactics: TA0005
Techniques: T1480
Input: The Mimikatz credential dumper contains an implementation of an SSP.

Tactics: TA0003, TA0004
Techniques: T1547.005, T1547
Input: These services are more likely to have a less-strict security policy than an enterprise.

Tactics: TA0043, TA0001
Techniques: T1598.001, T1566.003, T1566, T1598
Input: Remsec contains a network loader to receive executable modules from remote attackers and run them on the local victim.

Tactics: TA0011
Techniques: T1105
Input: OilRig has used Putty to access compromised systems.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: Cuba has a packed payload when delivered.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Net commands used with the /domain flag can be used to gather information about and manipulate user accounts on the current domain.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: Table 3: FELIXROOT backdoor parameters  Cryptography All data is transferred to C2 servers using AES encryption and the IbindCtx COM interface using HTTP or HTTPS protocol

Tactics: TA0011
Techniques: T1071
Input: Adversaries may use exploits during various phases of the adversary lifecycle ( Exploit Public-Facing Application, Exploitation for Client Execution, Exploitation for Privilege Escalation, Exploitation for Defense Evasion, Exploitation for Credential Access, Exploitation of Remote Services, and Application or System Exploitation).

Tactics: TA0042
Techniques: T1588, T1587, T1587.004, T1588.005
Input: Be aware of the search order Windows uses for executing or loading binaries and use fully qualified paths wherever appropriate.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.007, T1574.008, T1574.009, T1574
Input: Comnie attempts to detect several anti-virus products.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Orz can gather the victim OS version and whether it is 64 or 32 bit.

Tactics: TA0007
Techniques: T1082
Input: PoetRAT checked the size of the hard drive to determine if it was being run in a sandbox environment.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: The configuration blob is encoded using a simple single-byte XOR scheme

Tactics: TA0005
Techniques: T1027
Input: If it finds one, it will copy the token and store it for later use.

Tactics: TA0004, TA0005
Techniques: T1134
Input: Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system.

Tactics: TA0005
Techniques: T1564
Input: Lucifer can exploit multiple vulnerabilities including EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0144).

Tactics: TA0008
Techniques: T1210
Input: Adversaries may use an existing, legitimate external Web service as a means for sending commands to and receiving output from a compromised system over the Web service channel.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: Ebury can list directory entries.

Tactics: TA0007
Techniques: T1083
Input: Upon authentication attempts, the inserted code will first check to see if the user input is the password.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.004
Input: QuasarRAT can download files to the victim’s machine and execute them.

Tactics: TA0011
Techniques: T1105
Input: Malware may possibly utilize this memory location in part of an attack chain that includes writing code to shared sections of the process’s memory, placing a pointer to the code in EWM, then invoking execution by returning execution control to the address in the process’s EWM.

Tactics: TA0004, TA0005
Techniques: T1055.011, T1055
Input: Ensure proper permissions are set for the Registry to prevent users from modifying keys related to code signing policies.

Tactics: TA0005
Techniques: T1553, T1553.006
Input: Note that the username could be a small joke on the attackers’ part regarding the attribution to FIN7

Tactics: TA0007
Techniques: T1033
Input: FIN6 has used tools to exploit Windows vulnerabilities in order to escalate privileges.

Tactics: TA0004
Techniques: T1068
Input: The group also decrypted received information using the Triple DES algorithm and decompresses it using GZip.

Tactics: TA0005
Techniques: T1140
Input: Rancor has used HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: ThiefQuest also calls ptrace with the PTRACE_DENY_ATTACH flag to prevent debugging.

Tactics: TA0005, TA0007
Techniques: T1622
Input: Egregor has checked for the LogMein event log in an attempt to encrypt files in remote machines.

Tactics: TA0011
Techniques: T1219
Input: Adversaries may compromise third-party Virtual Private Servers (VPSs) that can be used during targeting.

Tactics: TA0042
Techniques: T1584.003, T1584
Input: In Kubernetes, if an adversary has sufficient permissions, they may gain remote execution in a container in the cluster via interaction with the Kubernetes API server, the kubelet, or by running a command such as kubectl exec.

Tactics: TA0002
Techniques: T1609
Input: RCSession can remove files from a targeted system.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: OpenSSL library functions are also used to encrypt each message using a randomly generated key and IV, which are then encrypted using a hard-coded RSA public key.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: TeamTNT has scanned specific lists of target IP addresses.

Tactics: TA0043
Techniques: T1595.001, T1595
Input: gh0st RAT operators have used dynamic DNS to mask the true location of their C2 behind rapidly changing IP addresses.

Tactics: TA0011
Techniques: T1568.001, T1568
Input: Particularly investigate irregular patterns of activity (ex: accounts making numerous requests, Event ID 4768 and 4769, within a small time frame, especially if they also request RC4 encryption [Type 0x17], pre-authentication not required [Type: 0x0]).

Tactics: TA0006
Techniques: T1558, T1558.004
Input: Shamoon can change the modified time for files to evade forensic detection.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: Access abuse over an API channel can be difficult to detect even from the service provider end, as the access can still align well with a legitimate workflow.

Tactics: TA0005, TA0008
Techniques: T1550.001, T1550
Input: Ferocious can use PowerShell scripts for execution.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Typosquatting may be used to aid in delivery of payloads via Drive-by Compromise.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: USBStealer monitors victims for insertion of removable drives.

Tactics: TA0007
Techniques: T1120
Input: KEYMARBLE has the capability to delete files off the victim’s machine.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Consider disabling or restricting NTLM.

Tactics: TA0006
Techniques: T1003, T1003.002, T1003.001
Input: The HyperShell and HighShell webshells are variants of what we track as TwoFace, with HyperShell being related to the TwoFace loader and HighShell being related to the TwoFace payload, as we reported in July 2017

Tactics: TA0005
Techniques: T1027
Input: APT28 regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: FIN5 has used the open source tool Essential NetTools to map the network and build a list of targets.

Tactics: TA0007
Techniques: T1018
Input: Doki has used the embedTLS library for network communications.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: BOOTRASH is a Volume Boot Record (VBR) bootkit that uses the VBR to maintain persistence.

Tactics: TA0003, TA0005
Techniques: T1542.003, T1542
Input: Adversaries may stop services or processes in order to conduct Data Destruction or Data Encrypted for Impact on the data stores of services like Exchange and SQL Server.

Tactics: TA0040
Techniques: T1489
Input: Additional tools were recovered during the incident, including a network scanning/enumeration tool, the archiving tool WinRAR and a bespoke Microsoft SharePoint enumeration and data dumping tool, known as 'spwebmember'

Tactics: TA0007
Techniques: T1018
Input: APT29 routinely removed their tools, including custom backdoors, once remote access was achieved.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: InnaputRAT gathers volume drive information and system information.

Tactics: TA0007
Techniques: T1082
Input: Revenge RAT collects the CPU information, OS information, and system language.

Tactics: TA0007
Techniques: T1082
Input: Industroyer uses a custom port scanner to map out a network.

Tactics: TA0007
Techniques: T1046
Input: Adversaries may buy, lease, or rent a network of compromised systems that can be used during targeting.

Tactics: TA0042
Techniques: T1583.005, T1583
Input: Threat Group-3390 actors have used a modified version of Mimikatz called Wrapikatz to dump credentials.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Built-in system utilities may generate high false positive alerts, so compare against baseline knowledge for how systems are typically used and correlate modification events with other indications of malicious activity where possible.

Tactics: TA0005
Techniques: T1553.001, T1553
Input: HAWKBALL has the ability to delete files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: KillDisk also targets and deletes files with 35 different file extensions.

Tactics: TA0040
Techniques: T1485
Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: Supply Chain Compromise or External Remote Services).

Tactics: TA0043
Techniques: T1592, T1592.004
Input: APT32 also creates a Windows service to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: KeyBoy installs a service pointing to a malicious DLL dropped to disk.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: This hash does not allow pass-the-hash style attacks, and instead requires Password Cracking to recover the plaintext password.

Tactics: TA0006
Techniques: T1003, T1003.005
Input: vssadmin.exe can be used to delete all volume shadow copies on a system - vssadmin.exe delete shadows /all /quiet

Tactics: TA0040
Techniques: T1490
Input: Stolen code signing certificates used to sign malware

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Microsoft SQL Server can enable common language runtime (CLR) integration.

Tactics: TA0003
Techniques: T1505.001, T1505
Input: Conti can use compiler-based obfuscation for its code, encrypt DLLs, and hide Windows API calls.

Tactics: TA0005
Techniques: T1027
Input: Confucius has obtained cloud storage service accounts to host stolen data.

Tactics: TA0042
Techniques: T1583.006, T1583
Input: When the user's system accesses the untrusted resource it will attempt authentication and send information, including the user's hashed credentials, over SMB to the adversary controlled server.

Tactics: TA0006
Techniques: T1187
Input: By running malicious code inside of a virtual instance, adversaries can hide artifacts associated with their behavior from security tools that are unable to monitor activity inside the virtual instance.

Tactics: TA0005
Techniques: T1564, T1564.006
Input: This particular sample connected to the CnC domain accounts.serveftp[.]com, which resolved to an IP address previously used by the threat group, although the IP had not been used for some time prior to this most recent activity:  MD5      0beb957923df2c885d29a9c1743dd94b  accounts.serveftp.com  59.188.0.197   BUBBLEWRAP is a full-featured backdoor that is set to run when the system boots, and can communicate using HTTP, HTTPS, or a SOCKS proxy

Tactics: TA0007, TA0011
Techniques: T1071, T1016
Input: Ragnar Locker has used sc.exe to create a new service for the VirtualBox driver.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: FIN7 used SQL scripts to help perform tasks on the victim's machine.

Tactics: TA0002
Techniques: T1059
Input: Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Browser pivoting may also bypass security provided by 2-factor authentication.

Tactics: TA0009
Techniques: T1185
Input: The HISTCONTROL environment variable keeps track of what should be saved by the history command and eventually into the ~/.bash_history file when a user logs out.

Tactics: TA0005
Techniques: T1562.003, T1562
Input: The adversary will need to complete registration of their application with the authorization server, for example Microsoft Identity Platform using Azure Portal, the Visual Studio IDE, the command-line interface, PowerShell, or REST API calls.

Tactics: TA0006
Techniques: T1528
Input: Attor's has a plugin that captures screenshots of the target applications.

Tactics: TA0009
Techniques: T1113
Input: When an adversary gains control of a network boundary device, they can either leverage existing NAT configurations to send traffic between two separated networks, or they can implement NAT configurations of their own design.

Tactics: TA0005
Techniques: T1599, T1599.001
Input: Valak has the ability to enumerate running processes on a compromised host.

Tactics: TA0007
Techniques: T1057
Input: The victims Data from Cadelle’s C&C servers shows that a large number of Backdoor.Cadelspy infections affected individual users of Iranian internet service providers (ISPs) and hosting services

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Drovorub can transfer files from the victim machine.

Tactics: TA0009
Techniques: T1005
Input: Rules may be created or modified within email clients or through external features such as the New-InboxRule or Set-InboxRule PowerShell cmdlets on Windows systems.

Tactics: TA0005
Techniques: T1564, T1564.008
Input: Gelsemium can drop itself in C:\Windows\System32\spool\prtprocs\x64\winprint.dll as an alternative Print Processor to be loaded automatically when the spoolsv Windows service starts.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Properly configure firewalls, application firewalls, and proxies to limit outgoing traffic to sites and services used by remote access tools.

Tactics: TA0011
Techniques: T1219
Input: MuddyWater has used VBScript files to execute its POWERSTATS payload, as well as macros.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Dark Caracal's version of Bandook communicates with their server over a TCP port using HTTP payloads Base64 encoded and suffixed with the string "&&&".

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Monitor for changes made to systemd timer unit files for unexpected modification events within the /etc/systemd/system, /usr/lib/systemd/system/, and ~/.config/systemd/user/ directories, as well as associated symbolic links

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.006, T1053
Input: For example, mmc wbadmin.msc delete catalog -quiet deletes the backup catalog on the system ( Inhibit System Recovery) without prompts to the user (Note: wbadmin.msc may only be present by default on Windows Server operating systems).

Tactics: TA0005
Techniques: T1218, T1218.014
Input: Monitor for newly constructed dylibs

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.004, T1574
Input: BendyBear has the ability to determine local time on a compromised host.

Tactics: TA0007
Techniques: T1124
Input: This indicates that the attackers stole and modified a legitimate document from the compromised user account, crafted a malicious decoy Word macro document using this stolen document and sent it to the target recipient who might be expecting the email from the original account user before the real sender had time to send it

Tactics: TA0001, TA0002, TA0007
Techniques: T1087, T1566.003, T1566, T1566.001, T1204
Input: Briba creates run key Registry entries pointing to malicious DLLs dropped to disk.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Sidewinder has lured targets to click on malicious links to gain execution in the target environment.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: BADCALL functions as a proxy server between the victim and C2 server.

Tactics: TA0011
Techniques: T1090
Input: GOLD SOUTHFIELD has used the remote monitoring and management tool ConnectWise to obtain screen captures from victim's machines.

Tactics: TA0009
Techniques: T1113
Input: Operation Wocao has used a custom collection method to intercept two-factor authentication soft tokens.

Tactics: TA0006
Techniques: T1111
Input: The CozyCar configuration file has been encrypted with RC4 keys.

Tactics: TA0005
Techniques: T1027
Input: CostaBricks has the ability to use bytecode to decrypt embedded payloads.

Tactics: TA0005
Techniques: T1140
Input: This backdoor collects system information, including the operating system version and hostname, and includes functionality to check, upload, and register plugins that can further enhance its capabilities

Tactics: TA0007
Techniques: T1082
Input: After loading the keyword and phone data files, MESSAGETAP begins monitoring all network connections to and from the victim server.

Tactics: TA0007
Techniques: T1049
Input: APT38 has used a custom MBR wiper named BOOTWRECK to render systems inoperable.

Tactics: TA0040
Techniques: T1561, T1561.002
Input: Mustang Panda has used junk code within their DLL files to hinder analysis.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: HiddenWasp uses a script to automate tasks on the victim's machine and to assist in execution.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Turn off UAC's privilege elevation for standard users [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System]to automatically deny elevation requests, add: "ConsentPromptBehaviorUser"=dword:00000000.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.010, T1574
Input: EKANS looks for processes from a hard-coded list.

Tactics: TA0007
Techniques: T1057
Input: On such devices, the operating systems are typically monolithic and most of the device functionality and capabilities are contained within a single file.

Tactics: TA0005
Techniques: T1601
Input: BlackMould can copy files on a compromised host.

Tactics: TA0009
Techniques: T1005
Input: Nerex creates a Registry subkey that registers a new service.

Tactics: TA0003, TA0004, TA0005
Techniques: T1543.003, T1112, T1543
Input: Kazuar can install itself as a new service.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Cachedump can extract cached password hashes from cache entry information.

Tactics: TA0006
Techniques: T1003, T1003.005
Input: APT33 has downloaded additional files and programs from its C2 server.

Tactics: TA0011
Techniques: T1105
Input: Despite being superseded by Component Object Model, DDE may be enabled in Windows 10 and most of Microsoft Office 2016 via Registry keys.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: BADNEWS copies documents under 15MB found on the victim system to is the user's %temp%\SMB\ folder.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Adversaries may log user keystrokes to intercept credentials as the user types them.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056