madox81/Adema_ATTACK_DS huggingface dataset:
Input: LightNeuron can collect files from a local system.

Tactics: TA0009
Techniques: T1005
Input: When possible, include hash values in manifest files to help prevent side-loading of malicious libraries.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: TA551 has retrieved DLLs and installer binaries for malware execution from C2.

Tactics: TA0011
Techniques: T1105
Input: PlugX can be configured to use HTTP for command and control.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Many applications create these hidden files and folders to store information so that it doesn’t clutter up the user’s workspace.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: This is typically used in conjunction with attacks to weaken the strength of the cipher in software (, Reduce Key Space).

Tactics: TA0005
Techniques: T1600, T1600.002
Input: Hancitor has decoded Base64 encoded URLs to insert a recipient’s name into the filename of the Word document.

Tactics: TA0005
Techniques: T1140
Input: Epic heavily obfuscates its code to make analysis more difficult.

Tactics: TA0005
Techniques: T1027
Input: Testing / development credentials

Tactics: TA0009
Techniques: T1213, T1213.001, T1213.002
Input: Molerats has used msiexec.exe to execute an MSI payload.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: Although tagged as legacy with no planned future evolutions, VB is integrated and supported in the .NET Framework and cross-platform .NET Core.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Monitor for logging, messaging, and other artifacts highlighting the health of host sensors (ex: metrics, errors, and/or exceptions from logging applications) that may suggest the shutting down or rebooting of the system.

Tactics: TA0040
Techniques: T1529
Input: Grandoreiro can bypass UAC by registering as the default handler for .MSC files.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Several Lazarus Group has conducted word searches on compromised machines to identify specific documents of interest.

Tactics: TA0007
Techniques: T1083
Input: QakBot can use domain generation algorithms in C2 communication.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: Monitor for changes made to Windows Registry keys and/or values related to services and startup programs that correspond to security tools such as HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: SDBbot has the ability to identify the user on a compromised host.

Tactics: TA0007
Techniques: T1033
Input: Monitor for changes made to the .LNK, .SCF, or any other files on systems and within virtual environments that contain resources that point to external network resources

Tactics: TA0006
Techniques: T1187
Input: Fox Kitten has downloaded additional tools including PsExec directly to endpoints.

Tactics: TA0011
Techniques: T1105
Input: Mustang Panda has used DropBox URLs to deliver variants of PlugX.

Tactics: TA0011
Techniques: T1102
Input: If both domains are served from the same CDN, then the CDN may route to the address specified in the HTTP header after unwrapping the TLS header.

Tactics: TA0011
Techniques: T1090.004, T1090
Input: Bisonal has added itself to the Registry key HKEY_CURRENT_USER\Software\Microsoft\CurrentVersion\Run\ for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: PoisonIvy contains a keylogger.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: In particular, the memcache protocol showed itself to be a powerful protocol, with amplification sizes up to 51,200 times the requesting packet.

Tactics: TA0040
Techniques: T1498, T1498.002
Input: Inception lured victims into clicking malicious files for machine reconnaissance and to execute malware.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: APT12 has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities (CVE-2009-3129, CVE-2012-0158) and vulnerabilities in Adobe Reader and Flash (CVE-2009-4324, CVE-2009-0927, CVE-2011-0609, CVE-2011-0611).

Tactics: TA0002
Techniques: T1203
Input: TajMahal has the ability to identify hardware information, the computer name, and OS information on an infected host.

Tactics: TA0007
Techniques: T1082
Input: Valak has been executed via Microsoft Word documents containing malicious macros.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: They should also take the following steps to harden both web applications and the servers hosting them to reduce the risk of network intrusion via this vector.Use and configure available firewalls to block attacks.Take steps to secure Windows systems, such as installing and configuring Microsoft’s Enhanced Mitigation Experience Toolkit (EMET) and Microsoft AppLocker.Monitor and remove any unauthorized code present in any www directories.Disable, discontinue, or disallow the use of Internet Control Message Protocol (ICMP) and Simple Network Management Protocol (SNMP) as much as possible.Remove unnecessary HTTP verbs from web servers

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: In this particular case the PowerShell code downloaded another obfuscated script to gather intelligence from the victim's machine and communicate it back to the adversary.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: TajMahal has the ability to send collected files over its C2.

Tactics: TA0010
Techniques: T1041
Input: Gazer versions are signed with various valid certificates; one was likely faked and issued by Comodo for "Solid Loop Ltd," and another was issued for "Ultimate Computer Support Ltd."

Tactics: TA0005
Techniques: T1553, T1553.002
Input: ROKRAT can capture screenshots of the infected system using the gdi32 library.

Tactics: TA0009
Techniques: T1113
Input: Dark Caracal leveraged a watering hole to serve up malicious code.

Tactics: TA0001
Techniques: T1189
Input: SILENTTRINITY can load additional files and tools, including Mimikatz.

Tactics: TA0011
Techniques: T1105
Input: Monitor executed commands and arguments that may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.

Tactics: TA0007
Techniques: T1049
Input: The QakBot dropper can delay dropping the payload to evade detection.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: ShadowPad has injected an install module into a newly created process.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Umbrella, our secure internet gateway (SIG), blocks users from connecting to malicious domains, IPs, and URLs, whether users are on or off the corporate network

Tactics: TA0007
Techniques: T1087
Input: They have also used IP addresses originating from the same country as the victim for their VPN infrastructure.

Tactics: TA0005
Techniques: T1036
Input: In applications like VMWare, adversaries can also use a special I/O port to send commands and receive output.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Monitor for web traffic to/from known-bad or suspicious domains and analyze traffic flows that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, or gratuitous or anomalous traffic patterns).

Tactics: TA0011
Techniques: T1071, T1071.001
Input: MoonWind obtains the number of removable drives from the victim.

Tactics: TA0007
Techniques: T1120
Input: When a user logs off a system, this information is flushed to a file in the user's home directory called ~/.bash_history.

Tactics: TA0005
Techniques: T1070, T1070.003, T1562.003, T1562
Input: Fox Kitten has accessed files to gain valid credentials.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: Monitor executed commands and arguments that may search for common password storage locations to obtain user credentials.

Tactics: TA0006
Techniques: T1555
Input: APT29 has obtained and used a variety of tools including Mimikatz, SDelete, Tor, meek, and Cobalt Strike.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: PowerStallion uses PowerShell loops to iteratively check for available commands in its OneDrive C2 server.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: This approach may be used to avoid triggering network data transfer threshold alerts.

Tactics: TA0010
Techniques: T1030
Input: ComRAT has also embedded an XOR encrypted communications module inside the orchestrator module.

Tactics: TA0005
Techniques: T1027
Input: One of the group's backdoors can also query the Windows Registry to gather system information, and another macOS backdoor performs a fingerprint of the machine on its first connection to the C&C server.

Tactics: TA0007
Techniques: T1082
Input: Bisonal has collected information from a compromised host.

Tactics: TA0009
Techniques: T1005
Input: DCOM can be used as a method of remotely interacting with Windows Management Instrumentation.

Tactics: TA0008
Techniques: T1021.003, T1021
Input: Unlike in Cloud Service Discovery, this technique focuses on the discovery of components of the provided services rather than the services themselves.

Tactics: TA0007
Techniques: T1580
Input: RDAT has used encoded data within subdomains as AES ciphertext to communicate from the host to the C2.

Tactics: TA0011
Techniques: T1001
Input: APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: Configure browsers or tasks to regularly delete persistent cookies.

Tactics: TA0005, TA0006, TA0008
Techniques: T1550.004, T1539, T1550
Input: ShadowPad has collected the username of the victim system.

Tactics: TA0007
Techniques: T1033
Input: FoggyWeb can be decrypted in memory using a Lightweight Encryption Algorithm (LEA)-128 key and decoded using a XOR key.

Tactics: TA0005
Techniques: T1140
Input: PowerShower has used 7Zip to compress .txt, .pdf, .xls or .doc files prior to exfiltration.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Many PowerShell commands (such as Get-Item, Set-Item, Remove-Item, and Get-ChildItem) can also accept a -stream parameter to interact with ADSs.

Tactics: TA0005
Techniques: T1564, T1564.004
Input: Exfiltration to a code repository can also provide a significant amount of cover to the adversary if it is a popular service already used by hosts within the network.

Tactics: TA0010
Techniques: T1567.001, T1567
Input: If PowerShell is not used in an environment, then simply looking for PowerShell execution may detect malicious activity.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: The list of possible protocols is extensive.

Tactics: TA0011
Techniques: T1095
Input: FIN6 has targeted victims with e-mails containing malicious attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: An adversary can modify the way these programs are launched to get a command prompt or backdoor without logging in to the system.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: The main function performed by the SCT file is to Base64 decode the contents of WindowsDefender.ini file and execute the decoded PowerShell Script using the following command line: powershell.exe -exec Bypass -c iex([System.Text.Encoding]::Unicode.GetString([System.Convert]::FromBase64String((get-content C:\\ProgramData\\WindowsDefender.ini) The rest of the malicious activities are performed by the PowerShell Script

Tactics: TA0002
Techniques: T1059.001, T1059
Input: The malware queries the Windows API to get the computer name, user name, volume serial number, Windows version, processor architecture and two additional values, which are “1.3” and “KdfrJKN”

Tactics: TA0007
Techniques: T1082
Input: Kimsuky has used RC4 encryption before exfil.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: Okrum's loader can detect presence of an emulator by using two calls to GetTickCount API, and checking whether the time has been accelerated.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Operation Wocao has encrypted IP addresses used for "Agent" proxy hops with RC4.

Tactics: TA0011
Techniques: T1001
Input: Adversaries may encode data to make the content of command and control traffic more difficult to detect.

Tactics: TA0011
Techniques: T1132
Input: Monitor the activity of cloud accounts to detect abnormal or malicious behavior, such as accessing information outside of the normal function of the account or account usage at atypical hours.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078.004, T1078
Input: Adversaries may abuse these functionalities to hide otherwise visible windows from users so as not to alert the user to adversary activity on the system.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Phishing may also be conducted via third-party services, like social media platforms.

Tactics: TA0001
Techniques: T1566
Input: This API does not validate that the program requesting root privileges comes from a reputable source or has been maliciously modified.

Tactics: TA0004, TA0005
Techniques: T1548.004, T1548
Input: InvisiMole has used Windows services as a way to execute its malicious payload.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: RogueRobin base64 encodes strings that are sent to the C2 over its DNS tunnel.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: FatDuke can enumerate directories on target machines.

Tactics: TA0007
Techniques: T1083
Input: Also, monitor file creation for programs that are named after Windows system programs or programs commonly executed without a path (such as "findstr," "net," and "python").

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.007, T1574.008, T1574.009, T1574
Input: Consider analyzing malware for features that may be associated with malware providers, such as compiler used, debugging artifacts, code similarities, or even group identifiers associated with specific Malware-as-a-Service (MaaS) offerings.

Tactics: TA0042
Techniques: T1588
Input: InvisiMole has a command to list account information on the victim’s machine.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Monitor executed commands and arguments that may obtain root access (allowing them to read securityd’s memory), then they can scan through memory to find the correct sequence of keys in relatively few tries to decrypt the user’s logon keychain.

Tactics: TA0006
Techniques: T1555.002, T1555
Input: Maze has communicated to hard-coded IP addresses via HTTP.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: TeamTNT relies on users to download and execute malicious Docker images.

Tactics: TA0002
Techniques: T1204.003, T1204
Input: BendyBear communicates to a C2 server over port 443 using modified RC4 and XOR-encrypted chunks.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Drovorub can use a port forwarding rule on its agent module to relay network traffic through the client module to a remote host on the same network.

Tactics: TA0011
Techniques: T1090.001, T1090
Input: Silent Librarian has exfiltrated entire mailboxes from compromised accounts.

Tactics: TA0009
Techniques: T1114
Input: Ensure proper permissions are in place to help prevent adversary access to privileged accounts necessary to install a bootkit.

Tactics: TA0003, TA0005
Techniques: T1542.003, T1542
Input: PinchDuke transfers files from the compromised host via HTTP or HTTPS to a C2 server.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Comnie will make requests to these URLs, looking for base64-encoded data after an identifier of ‘magnet:/’, as seen in the example below: Figure 14 GitHub storing Comnie C2 information In the example above, the C2 information is being stored within the user’s URL parameter within GitHub

Tactics: TA0011, TA0010
Techniques: T1041, T1102
Input: PowerShell 5.0 introduced enhanced logging capabilities, and some of those features have since been added to PowerShell 4.0.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Monitor for changes made to windows registry keys and/or values that may stop or disable services on a system to render those services unavailable to legitimate users.

Tactics: TA0040
Techniques: T1489
Input: Figure 26. Communication with the C&C server after the exchange of OS packet info Meanwhile, the runHandle method of the main backdoor loop will call for the requestServer method with the following backdoor commands (each command has one byte long code and is extracted by Packet::getCommand):   Figure 27. The getCommand method The figure below shows the example of two of several possible command codes

Tactics: TA0005, TA0011
Techniques: T1140, T1008
Input: Consider monitoring for modifications made to Registry keys associated with code signing policies, such as HKCU\Software\Policies\Microsoft\Windows NT\Driver Signing.

Tactics: TA0005
Techniques: T1553, T1553.006
Input: An adversary may Create Cloud Instance, mount one or more created snapshots to that instance, and then apply a policy that allows the adversary access to the created instance, such as a firewall policy that allows them inbound and outbound SSH access.

Tactics: TA0005
Techniques: T1578, T1578.001
Input: Signatures are often for unique indicators within protocols and may be based on the specific C2 protocol used by a particular adversary or tool, and will likely be different across various malware families and versions.

Tactics: TA0011
Techniques: T1090.001, T1090, T1090.002
Input: adbupd contains a copy of the OpenSSL library to encrypt C2 traffic.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Patchwork also enumerated all available drives on the victim's machine.

Tactics: TA0007
Techniques: T1082
Input: Chimera has performed file deletion to evade detection.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Unlike Upload Malware, this technique focuses on adversaries implanting an image in a registry within a victim’s environment.

Tactics: TA0003
Techniques: T1525
Input: Most of these actions are under the control of the operating system, but you can also add custom actions here.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: These loader instructions can be examined for individual binaries or frameworks using the otool -l command.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.004, T1574
Input: Monitor for LNK files created with a Zone Identifier value greater than 1, which may indicate that the LNK file originated from outside of the network.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Kazuar can overwrite files with random data before deleting them.

Tactics: TA0040
Techniques: T1485
Input: TrickBot can enumerate computers and network devices.

Tactics: TA0007
Techniques: T1018
Input: adbupd can run a copy of cmd.exe.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Mimikatz to obtain credentials.

Tactics: TA0006
Techniques: T1003
Input: SodaMaster can use "stackstrings" for obfuscation.

Tactics: TA0005
Techniques: T1027
Input: SUNSPOT created a copy of the SolarWinds Orion software source file with a .bk extension to backup the original content, wrote SUNBURST using the same filename but with a .tmp extension, and then moved SUNBURST using MoveFileEx to the original filename with a .cs extension so it could be compiled within Orion software.

Tactics: TA0040
Techniques: T1565.001, T1565
Input: For each domain, change the KRBTGT account password once, force replication, and then change the password a second time.

Tactics: TA0005, TA0006, TA0008
Techniques: T1550.003, T1558, T1558.001, T1550
Input: macOS uses XPC services for basic inter-process communication between various processes, such as between the XPC Service daemon and third-party application privileged helper tools.

Tactics: TA0002
Techniques: T1559, T1559.003
Input: Fox Kitten has installed TightVNC server and client on compromised servers and endpoints for lateral movement.

Tactics: TA0008
Techniques: T1021.005, T1021
Input: Most libraries include functionality to encrypt and/or compress data.

Tactics: TA0009
Techniques: T1560.002, T1560
Input: Adversaries may execute their own malicious payloads by hijacking the search order used to load other programs.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.008, T1574
Input: WastedLocker contains junk code to increase its entropy and hide the actual code.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.

Tactics: TA0040
Techniques: T1529
Input: TEARDROP checked that HKU\SOFTWARE\Microsoft\CTF existed before decoding its embedded payload.

Tactics: TA0007
Techniques: T1012
Input: IcedID has utilzed encrypted binaries and base64 encoded strings.

Tactics: TA0005
Techniques: T1027
Input: Sandworm Team's research of potential victim organizations included the identification and collection of employee information.

Tactics: TA0043
Techniques: T1589.003, T1589
Input: DustySky created folders in temp directories to host collected files before exfiltration.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: The attack involved a spear-phishing email with a subject of “Project Offer” and a malicious Word document (SHA256: d393349a4ad00902e3d415b622cf27987a0170a786ca3a1f991a521bff645318) as an attachment

Tactics: TA0001
Techniques: T1566, T1566.001
Input: This not only involves impairing preventative defenses, such as firewalls and anti-virus, but also detection capabilities that defenders can use to audit activity and identify malicious behavior.

Tactics: TA0005
Techniques: T1562
Input: WhisperGate has used the ExitWindowsEx API to flush file buffers to disk and stop running processes.

Tactics: TA0002
Techniques: T1106
Input: These logs may also be cleared through other mechanisms, such as the event viewer GUI or PowerShell.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: This could also enable an adversary to move from a virtualized environment, such as within a virtual machine or container, onto the underlying host.

Tactics: TA0004
Techniques: T1068
Input: SUNSPOT was identified on disk with a filename of taskhostsvc.exe and it created an encrypted log file at C:\Windows\Temp\vmware-vmdmp.log.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: StrongPity has used encrypted strings in its dropper component.

Tactics: TA0005
Techniques: T1027
Input: API calls alone are not an indicator of keylogging, but may provide behavioral data that is useful when combined with other information such as new files written to disk and unusual processes.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: RainyDay has named services and scheduled tasks to appear benign including "ChromeCheck" and "googleupdate."

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Fox Kitten has used a Twitter account to communicate with ransomware victims.

Tactics: TA0042
Techniques: T1585, T1585.001
Input: Monitor for unexpected deletion of windows registry keys that that may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms.

Tactics: TA0005
Techniques: T1562
Input: WannaCry uses Tor for command and control traffic and routes a custom cryptographic protocol over the Tor circuit.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Encrypt data stored at rest in cloud storage.

Tactics: TA0009
Techniques: T1530
Input: Figure 11: XML configuration file to schedule the task The Zyklon malware first retrieves the external IP address of the infected machine using the following:  api.ipify[.]org ip.anysrc[.]net myexternalip[.]com whatsmyip[.]com  The Zyklon executable contains another encrypted file in its .Net resource section named tor

Tactics: TA0005
Techniques: T1036, T1027
Input: ADVSTORESHELL encrypts with the 3DES algorithm and a hardcoded key prior to exfiltration.

Tactics: TA0009
Techniques: T1560
Input: Application control may be able to prevent the running of executables masquerading as other files.

Tactics: TA0002
Techniques: T1204.002, T1204