madox81/Adema_ATTACK_DS huggingface dataset:
Input: Winnti for Windows can run as a service using svchost.exe.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: KextPolicy stores a list of user approved (non Apple) kernel extensions and a partial history of loaded kernel modules in a SQLite database, /var/db/SystemPolicyConfiguration/KextPolicy.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: PoshC2 contains an implementation of netstat to enumerate TCP and UDP connections.

Tactics: TA0007
Techniques: T1049
Input: Login items installed using the Service Management Framework leverage launchd, are not visible in the System Preferences, and can only be removed by the application that created them.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.015
Input: For example, specific features in web applications may be highly resource intensive.

Tactics: TA0040
Techniques: T1499, T1499.003
Input: Aria-body has the ability to identify the titles of running windows on a compromised host.

Tactics: TA0007
Techniques: T1010
Input: BlackMould can run cmd.exe with parameters.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: This file is written to the following file path:  % TEMP%\Update.~tmp  After the file is written, it is then copied to a filename of ’winhelp.cpl’ in the directory that was initially chosen

Tactics: TA0005, TA0009
Techniques: T1070, T1070.006, T1036, T1074
Input: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: The Launch Agent name may be disguised by using a name from the related operating system or benign software.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: That malicious dll then loads encrypted shellcode from the binary, which is decrypted and runs the final BUGJUICE payload

Tactics: TA0005
Techniques: T1027
Input: Kwampirs uses rundll32.exe in a Registry value added to establish persistence.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Cobalt Strike can inject a variety of payloads into processes dynamically chosen by the adversary.

Tactics: TA0004, TA0005
Techniques: T1055
Input: S-Type uses Base64 encoding for C2 traffic.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Obfuscate/encrypt event files locally and in transit to avoid giving feedback to an adversary.

Tactics: TA0005
Techniques: T1070, T1070.002, T1070.001
Input: ZxShell has a command to transfer files from a remote host.

Tactics: TA0011
Techniques: T1105
Input: If a compromise of the operating system is suspected, contact the vendor technical support and seek such services for a more thorough inspection of the current running system.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: This abuse is often part of a "shell escape" or other actions to bypass an execution environment with restricted permissions.

Tactics: TA0004, TA0005
Techniques: T1548, T1548.001
Input: The KernelCallbackTable can be found in the Process Environment Block (PEB) and is initialized to an array of graphic functions available to a GUI process once user32.dll is loaded.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.013, T1574
Input: Siloscape impersonates the main thread of CExecSvc.exe by calling NtImpersonateThread.

Tactics: TA0004, TA0005
Techniques: T1134, T1134.001
Input: Carbanak can create a Windows account.

Tactics: TA0003
Techniques: T1136, T1136.001
Input: Monitor for newly constructed network connections that are sent or received by untrusted hosts or uncommon data flows.

Tactics: TA0009
Techniques: T1602.001, T1602, T1602.002
Input: SoreFang can collect the TCP/IP, DNS, DHCP, and network adapter configuration on a compromised host via ipconfig.exe /all.

Tactics: TA0007
Techniques: T1016
Input: Gold Dragon checks for anti-malware products and processes.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: It was pretending to be an Adobe flash player update installer on a compromised website to lure users to click for the execution

Tactics: TA0005
Techniques: T1036
Input: Cadelspy has the ability to capture screenshots and webcam photos.

Tactics: TA0009
Techniques: T1113
Input: Accounts may be created on the local system or within a domain or cloud tenant.

Tactics: TA0003
Techniques: T1136
Input: Clambling has the ability to use TCP and UDP for communication.

Tactics: TA0011
Techniques: T1095
Input: POWERSTATS can retrieve usernames from compromised hosts.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: XCSSET uses RC4 encryption over TCP to communicate with its C2 server.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: As with legitimate development efforts, different skill sets may be required for developing capabilities.

Tactics: TA0042
Techniques: T1587
Input: The downloaded document template contains the malicious macro codes, which executes a VBScript (VBS).

Tactics: TA0002
Techniques: T1059
Input: A process scope COR_PROFILER can also be created in-memory without modifying the Registry.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.012, T1574
Input: Monitor the status of services involved in system recovery.

Tactics: TA0040
Techniques: T1490
Input: Tool acquisition can involve the procurement of commercial software licenses, including for red teaming tools such as Cobalt Strike.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Adversaries may also compromise web servers to support watering hole operations, as in Drive-by Compromise.

Tactics: TA0042
Techniques: T1584.004, T1584
Input: httpclient encrypts C2 content with XOR using a single byte, 0x12.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Wizard Spider has used RDP for lateral movement.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Monitor for traffic on ports UDP 5355 and UDP 137 if LLMNR/NetBIOS is disabled by security policy.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Active Scanning or Phishing for Information), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).

Tactics: TA0043
Techniques: T1596.002, T1596
Input: InvisiMole can use winapiexec tool for indirect execution of  ShellExecuteW and CreateProcessA.

Tactics: TA0002
Techniques: T1106
Input: Monitor for newly executed processes that may abuse PowerShell commands and scripts for execution.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Monitor executed commands and arguments that may attempt to manipulate the name of a task or service to make it appear legitimate or benign.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Adversaries will likely use Credential Access techniques to acquire credentials to use with RDP.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: An adversary may revert changes made to a cloud instance after they have performed malicious activities in attempt to evade detection and remove evidence of their presence.

Tactics: TA0005
Techniques: T1578, T1578.004
Input: Lucifer can infect victims by brute forcing SMB.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Registry run key entries can reference programs directly or list them as a dependency.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: A module in Prikormka collects passwords stored in applications installed on the victim.

Tactics: TA0006
Techniques: T1555
Input: Restrict file shares to specific directories with access only to necessary users.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: Astaroth spawns a CMD process to execute commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Sowbug has used keylogging tools.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Hancitor has relied upon users clicking on a malicious link delivered through phishing.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Writing executables to a randomly-selected directory under Program Files, and naming the EXE to match the chosen directory name, or, if that fails, writing the executable to a system-generated temporary file name, using the EXE extension   3

Tactics: TA0005
Techniques: T1036
Input: The System LaunchDaemons are protected by SIP.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: GCMAN uses Putty for lateral movement.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: Since some boot or logon autostart programs run with higher privileges, an adversary may leverage these to elevate privileges.

Tactics: TA0003, TA0004
Techniques: T1547
Input: These group policies are stored in SYSVOL on a domain controller.

Tactics: TA0006
Techniques: T1552, T1552.006
Input: System file associations are listed under HKEY_CLASSES_ROOT.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.001
Input: GravityRAT steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.

Tactics: TA0009
Techniques: T1005
Input: Helminth has used a scheduled task for persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: menuPass has used native APIs including GetModuleFileName, lstrcat, CreateFile, and ReadFile.

Tactics: TA0002
Techniques: T1106
Input: LoudMiner harvested system resources to mine cryptocurrency, using XMRig to mine Monero.

Tactics: TA0040
Techniques: T1496
Input: Gamaredon Group has compiled the source code for a downloader directly on the infected system using the built-in Microsoft.CSharp.CSharpCodeProvider class.

Tactics: TA0005
Techniques: T1027.004, T1027
Input: Adversaries may compromise a network device’s encryption capability in order to bypass encryption that would otherwise protect data communications.

Tactics: TA0005
Techniques: T1600
Input: SoreFang can collect the hostname, operating system configuration, product ID, and disk space on victim machines by executing Systeminfo.

Tactics: TA0007
Techniques: T1082
Input: Chimera has used HTTPS for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Adversaries may attempt to find cloud groups and permission settings.

Tactics: TA0007
Techniques: T1069, T1069.003
Input: JHUHUGIT has used COM hijacking to establish persistence by hijacking a class named MMDeviceEnumerator and also by registering the payload as a Shell Icon Overlay handler COM object ({3543619C-D563-43f7-95EA-4DA7E1CC396A}).

Tactics: TA0003, TA0004
Techniques: T1546.015, T1546
Input: Adversaries may erase the contents of storage devices on specific systems or in large numbers in a network to interrupt availability to system and network resources.

Tactics: TA0040
Techniques: T1561.001, T1561
Input: POORAIM can identify system information, including battery status.

Tactics: TA0007
Techniques: T1082
Input: yty packs a plugin with UPX.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Disable LLMNR and NetBIOS in local computer security settings or by group policy if they are not needed within an environment.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: Adversaries may leverage the SharePoint repository as a source to mine valuable information.

Tactics: TA0009
Techniques: T1213, T1213.002
Input: JPIN can use the command-line utility cacls.exe to change file permissions.

Tactics: TA0002, TA0005
Techniques: T1059.003, T1222, T1222.001, T1059
Input: If the requested host belongs to a resource that requires identification/authentication, the username and NTLMv2 hash will then be sent to the adversary controlled system.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: ShadowPad has sent data back to C2 every 8 hours.

Tactics: TA0010
Techniques: T1029
Input: Fox Kitten has used protocol tunneling for communication and RDP activity on compromised hosts through the use of open source tools such as Ngrok and custom tool SSHMinion.

Tactics: TA0011
Techniques: T1572
Input: Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

Tactics: TA0002
Techniques: T1569.001, T1569
Input: The image is downloaded directly, and the shellcode is loaded and executed in memory

Tactics: TA0002
Techniques: T1059
Input: Some data encoding systems may also result in data compression, such as gzip.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: BONDUPDATER persists using a scheduled task that executes every minute.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: The setting can be configured through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > Security Options: Domain Controller: Allow server operators to schedule tasks, set to disabled.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053, T1053.002
Input: EVILNUM can run a remote scriptlet that drops a file and executes it via regsvr32.exe.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.

Tactics: TA0007
Techniques: T1018
Input: An adversary may place a program called "net.exe" within the same directory as example.exe, "net.exe" will be run instead of the Windows system utility net.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.008, T1574
Input: Adversaries may also leverage a Network Device CLI on network devices to disable historical command logging.

Tactics: TA0005
Techniques: T1562.003, T1562
Input: ChChes collects the victim hostname, window resolution, and Microsoft Windows version.

Tactics: TA0007
Techniques: T1082
Input: Talos continues to monitor this threat as it changes to ensure that customers remain protected from this and other threats as they continue to emerge and evolve.CoverageAdditional ways our customers can detect and block this threat are listed below.Advanced Malware Protection (AMP) is ideally suited to prevent the execution of the malware used by these threat actors.Cisco Cloud Web Security (CWS) or Web Security Appliance (WSA) web scanning prevents access to malicious websites and detects malware used in these attacks.Email Security can block malicious emails sent by threat actors as part of their campaign.Network Security appliances such as Next-Generation Firewall (NGFW), Next-Generation Intrusion Prevention System (NGIPS), and Meraki MX can detect malicious activity associated with this threat.AMP Threat Grid helps identify malicious binaries and build protection into all Cisco Security products.Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network.Open Source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.Indicators of compromiseThe following IOCs are associated with various malware distribution campaigns that were observed during the analysis of Hawkeye Reborn v9 activity.Attachment hashes (SHA256)A list of hashes observed to be associated with malicious email attachments can be found here.PE32 hashes (SHA256)A list of hashes observed to be associated with malicious PE32 executables can be found here.DomainsThe following domains have been observed to be associated with malware campaigns

Tactics: TA0001, TA0002, TA0003, TA0004, TA0005, TA0007
Techniques: T1518.001, T1566.003, T1566, T1574.002, T1566.002, T1562.001, T1518, T1566.001, T1204, T1574, T1562
Input: PowerSploit's Invoke-WmiCommand CodeExecution module uses WMI to execute and retrieve the output from a PowerShell payload.

Tactics: TA0002
Techniques: T1047
Input: One computer that was infected with both Cadelspy and Remexi was a system that ran a SIM card editing application

Tactics: TA0007
Techniques: T1082
Input: If access requires high privileges, look for non-admin objects (such as users or processes) attempting to access restricted file resources.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Duqu has used msiexec to execute malicious Windows Installer packages.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: iKitten prompts the user for their credentials.

Tactics: TA0006, TA0009
Techniques: T1056.002, T1056
Input: FinFisher clears the system event logs using  OpenEventLog/ClearEventLog APIs .

Tactics: TA0005
Techniques: T1070, T1070.001
Input: Monitor for changes made to files that may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events.

Tactics: TA0003, TA0004
Techniques: T1546
Input: Linux:Scraping the passwords from memory requires root privileges.

Tactics: TA0006
Techniques: T1003
Input: AppleSeed can stage files in a central location prior to exfiltration.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: HAFNIUM has used procdump to dump the LSASS process memory.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Ensure that third-party application logs are on-boarded to the enterprise logging system and the logs are regularly reviewed.

Tactics: TA0002, TA0008
Techniques: T1072
Input: TajMahal has the ability to identify running processes and associated plugins on an infected host.

Tactics: TA0007
Techniques: T1057
Input: Many of these events within a short period of time may indicate malicious activity.

Tactics: TA0040
Techniques: T1485
Input: Replacement of legitimate software with modified versions

Tactics: TA0001
Techniques: T1195
Input: Cobalt Strike can use Window admin shares (C$ and ADMIN$) for lateral movement.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Proton uses a keylogger to capture keystrokes.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: MailSniper can be used to obtain account names from Exchange and Office 365 using the Get-GlobalAddressList cmdlet.

Tactics: TA0007
Techniques: T1087.003, T1087
Input: Wiarp creates a backdoor through which remote attackers can open a command line interface.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Fox Kitten has accessed ntuser.dat and UserClass.dat on compromised hosts.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Adversaries may also use stolen password hashes to "overpass the hash."

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: FlawedAmmyy will attempt to detect anti-virus products during the initial infection.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Denis also used the Wow64SetThreadContext API as part of a process hollowing process.

Tactics: TA0002
Techniques: T1106
Input: When HawkEye is executed, in line 34, byte[] byte_ = gclass.method_0()["0", GClass30.GEnum3.RCDATA].Byte_0;it reads the encrypted configuration from the RCDATA resource and in line 33,byte[] byte_2 = GClass29.smethod_12(byte_, GClass12.string_0);and then decrypts this data with the Rijndael algorithm you can see below in the RijndaelManaged function to initialize the HawkEye configuration settings.The decrypted configuration shows us the account used for exfiltration:The main loop of HawkEye has the following functions:This shows the rich feature set of HawkEye

Tactics: TA0005
Techniques: T1140, T1562.001, T1562
Input: SideTwist has the ability to upload files from a compromised host.

Tactics: TA0009
Techniques: T1005
Input: ftp may be used to exfiltrate data separate from the main command and control protocol.

Tactics: TA0010
Techniques: T1048.003, T1048
Input: The daemon name may be disguised by using a name from a related operating system or benign software ( Masquerading).

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: Avaddon has used the Windows Crypto API to generate an AES key.

Tactics: TA0002
Techniques: T1106
Input: navlu.dll is also the name of a legitimate Symantec DLL.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Adversaries may create or modify references in user document templates to conceal malicious code or force authentication attempts.

Tactics: TA0005
Techniques: T1221
Input: Wizard Spider has used the Invoke-Inveigh PowerShell cmdlets, likely for name service poisoning.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: Dipsind can spawn remote shells.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Password filters will also show up as an autorun and loaded DLL in lsass.exe.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.002, T1556
Input: Ferocious Kitten has used right-to-left override to reverse executables’ names to make them appear to have different file extensions, rather than their real ones.

Tactics: TA0005
Techniques: T1036, T1036.002
Input: Adversaries may use Valid Accounts to log into remote machines using Secure Shell (SSH).

Tactics: TA0008
Techniques: T1021, T1021.004
Input: TeamTNT looks for the host machine’s IP address.

Tactics: TA0007
Techniques: T1016
Input: Prikormka adds itself to a Registry Run key with the name guidVGA or guidVSA.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Empire contains modules that can discover and exploit unquoted path vulnerabilities.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.009, T1574
Input: Adversaries may also craft malicious web advertisements and purchase ad space on a website through legitimate ad providers.

Tactics: TA0042
Techniques: T1608.004, T1608
Input: Ke3chang has used compromised credentials to sign into victims’ Microsoft 365 accounts.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078.004, T1078
Input: TrickBot has also used Nt* API functions to perform Process Injection.

Tactics: TA0002
Techniques: T1106
Input: This may take the form of modifications to internal websites, or directly to user systems with the replacement of the desktop wallpaper.

Tactics: TA0040
Techniques: T1491.001, T1491
Input: For instance, some Flash exploits have been delivered as objects within Microsoft Office documents.

Tactics: TA0002
Techniques: T1203
Input: Molerats used various implants, including those built with VBScript, on target machines.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: APT29 used stolen cookies to access cloud resources, and a forged duo-sid cookie to bypass MFA set on an email account.

Tactics: TA0005, TA0008
Techniques: T1550.004, T1550
Input: Extensions and filters are deployed as DLL files that export three functions: Get{Extension/Filter}Version, Http{Extension/Filter}Proc, and (optionally) Terminate{Extension/Filter}.

Tactics: TA0003
Techniques: T1505.004, T1505
Input: Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities.

Tactics: TA0005
Techniques: T1036.003, T1036
Input: Reaver collects the victim's username.

Tactics: TA0007
Techniques: T1033
Input: BRONZE BUTLER used spearphishing emails with malicious Microsoft Word attachments to infect victims.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: The Regin malware platform supports many standard protocols, including HTTP and HTTPS.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Empire contains some modules that leverage API hooking to carry out tasks, such as netripper.

Tactics: TA0006, TA0009
Techniques: T1056.004, T1056
Input: Empire leverages PowerShell for the majority of its client-side agent tasks.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Common operating system file deletion commands such as del and rm often only remove pointers to files without wiping the contents of the files themselves, making the files recoverable by proper forensic methodology.

Tactics: TA0040
Techniques: T1485
Input: TrailBlazer can masquerade its C2 traffic as legitimate Google Notifications HTTP requests.

Tactics: TA0011
Techniques: T1001
Input: AppleSeed can identify the OS version of a targeted system.

Tactics: TA0007
Techniques: T1082
Input: By compromising DNS servers, adversaries can alter DNS records.

Tactics: TA0042
Techniques: T1584.002, T1584