madox81/Adema_ATTACK_DS huggingface dataset:
Input: Adversaries may overwrite data in boot drivers or firmware such as BIOS (Basic Input/Output System) and The Unified Extensible Firmware Interface (UEFI) to persist on systems at a layer below the operating system.

Tactics: TA0003, TA0005
Techniques: T1542
Input: MarkiRAT can run the ShellExecuteW API via the Windows Command Shell.

Tactics: TA0002
Techniques: T1106
Input: HTTPBrowser has used HTTP and HTTPS for command and control.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: APT41 used HTTP to download payloads for CVE-2019-19781 and CVE-2020-10189 exploits.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: PUNCHBUGGY has used PowerShell scripts.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials.

Tactics: TA0006
Techniques: T1110, T1110.003
Input: Adversaries may execute their own malicious payloads by hijacking the binaries used by services.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.010, T1574
Input: The loader component is executed via RUNDLL32.EXE

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Malware is also increasingly incorporating seed values that can be unique for each instance, which would then need to be determined to extract future generated domains.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: There have been numerous incidents where cloud storage has been improperly secured (typically by unintentionally allowing public access by unauthenticated users or overly-broad access by all users), allowing open access to credit cards, personally identifiable information, medical records, and other sensitive information.

Tactics: TA0009
Techniques: T1530
Input: By default, XDG autostart entries are stored within the /etc/xdg/autostart or ~/.config/autostart directories and have a .desktop file extension.

Tactics: TA0003, TA0004
Techniques: T1547.013, T1547
Input: Ensure applications are using Apple's developer guidance which enables hardened runtime.

Tactics: TA0005
Techniques: T1647
Input: Monitor newly executed processes that may establish persistence by executing malicious content triggered by an interrupt signal.

Tactics: TA0003, TA0004
Techniques: T1546.005, T1546
Input: BOOSTWRITE has exploited the loading of the legitimate Dwrite.dll file by actually loading the gdi library, which then loads the gdiplus library and ultimately loads the local Dwrite dll.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Proxysvc executes a binary on the system and logs the results into a temp file by using: cmd.exe /c " > %temp%\PM* .tmp 2>&1".

Tactics: TA0002
Techniques: T1059.003, T1059
Input: CharmPower can decrypt downloaded modules prior to execution.

Tactics: TA0005
Techniques: T1140
Input: Otherwise, access is denied.

Tactics: TA0005
Techniques: T1222, T1222.001
Input: Ke3chang has used credential dumpers or stealers to obtain legitimate credentials, which they used to gain access to victim accounts.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: Industroyer collects the victim machine’s Windows GUID.

Tactics: TA0007
Techniques: T1082
Input: APT17 has created and cultivated profile pages in Microsoft TechNet.

Tactics: TA0042
Techniques: T1585
Input: In single flux cases only IP addresses change for static domain names.

Tactics: TA0011
Techniques: T1568.001, T1568
Input: Ixeshe uses custom Base64 encoding schemes to obfuscate command and control traffic in the message body of HTTP requests.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: ComRAT has the ability to use the Gmail web UI to receive commands and exfiltrate information.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: ZIRCONIUM has used the msiexec.exe command-line utility to download and execute malicious MSI files.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: Diavol has used CreateToolhelp32Snapshot, Process32First, and Process32Next API calls to enumerate the running processes in the system.

Tactics: TA0007
Techniques: T1057
Input: BITSAdmin can be used to create BITS Jobs to upload and/or download files.

Tactics: TA0011
Techniques: T1105
Input: Since GPOs can control so many user and machine settings in the AD environment, there are a great number of potential attacks that can stem from this GPO abuse.

Tactics: TA0004, TA0005
Techniques: T1484.001, T1484
Input: An alternative case occurs when a legitimate utility is copied or moved to a different directory and renamed to avoid detections based on system utilities executing from non-standard paths.

Tactics: TA0005
Techniques: T1036.003, T1036
Input: Carbanak used legitimate programs such as AmmyyAdmin and Team Viewer for remote interactive C2 to target systems.

Tactics: TA0011
Techniques: T1219
Input: APT32 has sent spearphishing emails with a malicious executable disguised as a document or spreadsheet.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: LitePower can send collected data, including screenshots, over its C2 channel.

Tactics: TA0010
Techniques: T1041
Input: Neoichor can identify the system language on a compromised host.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: Ensure that permissions disallow services that run at a higher permissions level from being created or interacted with by a user with a lower permission level.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Variants of WEBC2 achieve persistence by using DLL search order hijacking, usually by copying the DLL file to %SYSTEMROOT% (C:\WINDOWS\ntshrui.dll).

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Many of these protections depend on the architecture and target application binary for compatibility and may not work for software components targeted for privilege escalation.

Tactics: TA0004
Techniques: T1068
Input: WannaCry contains a thread that will attempt to scan for new attached drives every few seconds.

Tactics: TA0007
Techniques: T1120
Input: The series of commands, as seen in Table 2, include checks for virtualized environments, low memory, and processor counts, in addition to checks for common analysis tools running on the system

Tactics: TA0005, TA0007
Techniques: T1497, T1518.001, T1518
Input: Attor performs the injection by attaching its code into the APC queue using NtQueueApcThread API.

Tactics: TA0004, TA0005
Techniques: T1055.004, T1055
Input: Dok is packed with an UPX executable packer.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: EVILNUM can harvest cookies and upload them to the C2 server.

Tactics: TA0006
Techniques: T1539
Input: RobbinHood deletes shadow copies to ensure that all the data cannot be restored easily.

Tactics: TA0040
Techniques: T1490
Input: Monitor for user accounts logged into systems they would not normally access or access patterns to multiple systems over a relatively short period of time.

Tactics: TA0008
Techniques: T1563, T1563.001
Input: CharmPower has the ability to list running processes through the use of tasklist.

Tactics: TA0007
Techniques: T1057
Input: Matryoshka obfuscates API function names using a substitute cipher combined with Base64 encoding.

Tactics: TA0005
Techniques: T1027
Input: Similarly, adversaries may also utilize publicly disclosed or stolen Private Keys or credential materials to legitimately connect to remote environments via Remote Services.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.001
Input: Since it can be useful for developers to modify default signature enforcement policies during the development and testing of applications, disabling of these features may be possible with elevated permissions.

Tactics: TA0005
Techniques: T1553, T1553.006
Input: Monitor for newly constructed image that may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel.

Tactics: TA0002
Techniques: T1204
Input: DOGCALL is capable of capturing screenshots of the victim's machine.

Tactics: TA0009
Techniques: T1113
Input: SILENTTRINITY can obtain a list of local groups and members.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: GoldMax has impersonated systems management software to avoid detection.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: T9000 gathers and beacons the username of the logged in account during installation.

Tactics: TA0007
Techniques: T1033
Input: Adversaries may maliciously modify components of a victim environment in order to hinder or disable defensive mechanisms.

Tactics: TA0005
Techniques: T1562
Input: Aria-body has the ability to launch files using ShellExecute.

Tactics: TA0002
Techniques: T1106
Input: These payloads may be used during Initial Access or later to mitigate detection.

Tactics: TA0005
Techniques: T1027
Input: APT29 has compromised domains to use for C2.

Tactics: TA0042
Techniques: T1584.001, T1584
Input: Some FinFisher variants incorporate an MBR rootkit.

Tactics: TA0003, TA0005
Techniques: T1542.003, T1542
Input: OilRig has used netstat -an on a victim to get a listing of network connections.

Tactics: TA0007
Techniques: T1049
Input: Ke3chang has used implants capable of collecting the signed-in username.

Tactics: TA0007
Techniques: T1033
Input: Miner-C copies itself into the public folder of Network Attached Storage (NAS) devices and infects new victims who open the file.

Tactics: TA0008
Techniques: T1080
Input: An adversary may target the systems of those known to conduct exploit research and development in order to gain that knowledge for use during a subsequent operation.

Tactics: TA0042
Techniques: T1588, T1588.005
Input: Adversaries may perform different forms of active scanning depending on what information they seek to gather.

Tactics: TA0043
Techniques: T1595
Input: An adversary may exfiltrate data in fixed size chunks instead of whole files or limit packet sizes below certain thresholds.

Tactics: TA0010
Techniques: T1030
Input: APT1 used the commands net start and tasklist to get a listing of the services on the system.

Tactics: TA0007
Techniques: T1007
Input: The different stages will likely be hosted separately with no overlapping infrastructure.

Tactics: TA0011
Techniques: T1104
Input: Rocke has executed wget and curl commands to Pastebin over the HTTPS protocol.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Cobalt Strike can use known credentials to run commands and spawn processes as a local user account.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.003
Input: By impersonating legitimate protocols or web services, adversaries can make their command and control traffic blend in with legitimate network traffic.

Tactics: TA0011
Techniques: T1001, T1001.003
Input: They consist mainly of persistence mechanisms and simple instructions despite their different forms (VBS scripts, PowerShell scripts, known software with open source code that can be backdoored, and in-house built dotnet apps)

Tactics: TA0002, TA0003, TA0004
Techniques: T1547.001, T1547, T1059
Input: Lizar can collect the username from the system.

Tactics: TA0007
Techniques: T1033
Input: Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads.

Tactics: TA0003, TA0005
Techniques: T1197
Input: Information about victims may also be exposed to adversaries via online or other accessible data sets (ex: Social Media or Search Victim-Owned Websites).

Tactics: TA0043
Techniques: T1589
Input: Adversaries may also leverage shell scripts to deliver and execute multiple commands on victims or as part of payloads used for persistence.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: ChChes samples were digitally signed with a certificate originally used by Hacking Team that was later leaked and subsequently revoked.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Mustang Panda has used RAR to create password-protected archives of collected documents prior to exfiltration.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Variants of Anchor can use DNS tunneling to communicate with C2.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Monitor logs for API calls to disable logging.

Tactics: TA0005
Techniques: T1562.008, T1562
Input: Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning or Phishing for Information.

Tactics: TA0043
Techniques: T1592, T1590, T1590.004, T1590.006, T1590.005, T1590.001
Input: Elderwood has used exploitation of endpoint software, including Microsoft Internet Explorer Adobe Flash vulnerabilities, to gain execution.

Tactics: TA0002
Techniques: T1203
Input: Monitor for user authentication attempts.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: This technique allows them to map network resources and make lateral movements inside the network, landing in the perfect machine to match the attacker’s interest

Tactics: TA0007
Techniques: T1018
Input: Adversaries may modify client software binaries to establish persistent access to systems.

Tactics: TA0003
Techniques: T1554
Input: A Word document delivering TYPEFRAME prompts the user to enable macro execution.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: The Windows command prompt can be used to control almost any aspect of a system, with various permission levels required for different subsets of commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Suckfly has used stolen certificates to sign its malware.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Use the principle of least privilege for privileged accounts such as the service account in Kubernetes.

Tactics: TA0006
Techniques: T1552, T1552.007
Input: Wizard Spider has exploited or attempted to exploit Zerologon (CVE-2020-1472) and EternalBlue (MS17-010) vulnerabilities.

Tactics: TA0008
Techniques: T1210
Input: A new child process is created as “ tg ​ yt ​ ut ​ rc ​ ( ID) ​ .e ​ xe - i SM- tgytutrc ”, which is used to encrypt a single file on the drive

Tactics: TA0009, TA0040
Techniques: T1560, T1486
Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Technical Databases, Search Open Websites/Domains, or Active Scanning), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services).

Tactics: TA0043
Techniques: T1590.002, T1590
Input: Lazarus Group has used GitHub as C2, pulling hosted image payloads then committing command execution output to files in specific directories.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: Linux malware detection and prevention is not prevalent at this time, but Palo Alto Networks customers are protected through our next-generation security platform:  IPS signature 14917 deployed to identify and prevent command and control activity The C2 domains and files mentioned in this report are blocked in our Threat Prevention product

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Threat actors may use search engines to harvest general information about victims, as well as use specialized queries to look for spillages/leaks of sensitive information such as network details or credentials.

Tactics: TA0043
Techniques: T1593, T1593.002
Input: APT41 created user accounts and adds them to the User and Admin groups.

Tactics: TA0003
Techniques: T1136, T1136.001
Input: Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: Monitor processes that appear to be reading files from disparate locations and writing them to the same directory or file may be an indication of data being staged, especially if they are suspected of performing encryption or compression on the files, such as 7zip, RAR, ZIP, or zlib.

Tactics: TA0009
Techniques: T1074.002, T1074.001, T1074
Input: Mosquito executes cmd.exe and uses a pipe to read the results and send back the output to the C2 server.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Rising Sun can send data gathered from the infected machine via HTTP POST request to the C2.

Tactics: TA0010
Techniques: T1041
Input: Monitor for changes to /etc/profile and /etc/profile.d, these files should only be modified by system administrators.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: Monitor for creation of access tokens using SAML tokens which do not have corresponding 4769 and 1200 events in the domain.

Tactics: TA0006
Techniques: T1606, T1606.002
Input: Windigo has used a script to detect which Linux distribution and version is currently installed on the system.

Tactics: TA0007
Techniques: T1082
Input: HermeticWiper can disable pop-up information about folders and desktop items and delete Registry keys to hide malicious services.

Tactics: TA0005
Techniques: T1070
Input: The main purpose of the IGT tool is to make an inventory of the system, saving information from the network interfaces and addresses, credentials belonging to the Domain and database server, services being run from the OS and everything that could help the Poseidon Group make its attack more customized to its victim

Tactics: TA0007
Techniques: T1082
Input: Windows operating system also creates a registry key specifically associated with the creation of a scheduled task on the destination host at: Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\At1.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: As with legitimate development efforts, different skill sets may be required for developing malware.

Tactics: TA0042
Techniques: T1587, T1587.001
Input: Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

Tactics: TA0005
Techniques: T1070, T1070.005
Input: Adversaries may use at to execute programs at system startup or on a scheduled basis for Persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: Validate driver block rules in audit mode to ensure stability prior to production deployment.

Tactics: TA0004
Techniques: T1068
Input: Epic compresses the collected data with bzip2 before sending it to the C2 server.

Tactics: TA0009
Techniques: T1560.002, T1560
Input: A number of PowerShell-based offensive testing tools are available, including Empire,  PowerSploit, PoshC2, and PSAttack.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.

Tactics: TA0008
Techniques: T1210
Input: Sys10 uses an XOR 0x1 loop to encrypt its C2 domain.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Lazarus Group malware SHARPKNOT overwrites and deletes the Master Boot Record (MBR) on the victim's machine and has possessed MBR wiper malware since at least 2009.

Tactics: TA0040
Techniques: T1561, T1561.002
Input: Monitor for third-party application logging, messaging, and/or other artifacts provided by third-party services that may disable Windows event logging to limit data that can be leveraged for detections and audits.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: EvilBunny has executed C2 commands directly via HTTP.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: When each file is encrypted, registry keys are created under HKU\{SID}\Software\Microsoft\ RestartManager \ which are used to track metadata pertaining to the file being encrypted, such as owner, sequence, session and file hash

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: menuPass has collected data from remote systems by mounting network shares with net use and using Robocopy to transfer data.

Tactics: TA0009
Techniques: T1039
Input: TrickBot searches the system for all of the following file extensions: .avi, .mov, .mkv, .mpeg, .mpeg4, .mp4, .mp3, .wav, .ogg, .jpeg, .jpg, .png, .bmp, .gif, .tiff, .ico, .xlsx, and .zip.

Tactics: TA0007
Techniques: T1083
Input: The user may then view it as a benign text file and open it, inadvertently executing the hidden malware.

Tactics: TA0005
Techniques: T1036, T1036.007
Input: Monitor for unusual processes accessing secrets.ldb and .secrets.mkey located in /var/lib/sss/secrets/.

Tactics: TA0006
Techniques: T1558
Input: Wizard Spider has also used AdFind and nltest/dclist to enumerate domain computers, including the domain controller.

Tactics: TA0007
Techniques: T1018
Input: BADFLICK has been distributed via spearphishing campaigns containing malicious Microsoft Word documents.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Windshift has used malware to identify installed AV and commonly used forensic and malware analysis tools.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Bazar can gain execution after a user clicks on a malicious link to decoy landing pages hosted on Google Docs.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Neoichor can download additional files onto a compromised host.

Tactics: TA0011
Techniques: T1105
Input: A second scheduled task named “Scheduled Defrags” was created by loading the raw task XML with a backdated task creation timestamp of June 2, 2016

Tactics: TA0002, TA0003, TA0004, TA0005
Techniques: T1053.005, T1053, T1036
Input: Lazarus Group malware SierraAlfa accesses the ADMIN$ share via SMB to conduct lateral movement.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: OilRig has used VBSscipt macros for execution on compromised hosts.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: As security controls have improved, DLL side loading has evolved to load a payload stored in a different directory or from a registry value

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: Limit access to the Instance Metadata API using a host-based firewall such as iptables.

Tactics: TA0006
Techniques: T1552, T1552.005
Input: In AWS, CloudTrail logs capture the deletion of an instance in the TerminateInstances event, and in Azure the deletion of a VM may be captured in Azure activity logs.

Tactics: TA0005
Techniques: T1578.003, T1578
Input: FinFisher has used the KernelCallbackTable to hijack the execution flow of a process by replacing the __fnDWORD function with the address of a created Asynchronous Procedure Call stub routine.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.013, T1574
Input: Both “%APPDATA%\\Microsoft\Windows\Cookies.txt” and “%APPDATA%\\Microsoft\Windows\Cookies.exe” are then deleted

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Monitor executed commands and arguments that may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system

Tactics: TA0007
Techniques: T1018
Input: This variation on input capture may be conducted post-compromise using legitimate administrative access as a backup measure to maintain network access through External Remote Services and Valid Accounts or as part of the initial compromise by exploitation of the externally facing web service.

Tactics: TA0006, TA0009
Techniques: T1056.003, T1056
Input: Flagpro can execute malicious VBA macros embedded in .xlsm files.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: One archive sample analyzed by CTU researchers contained a legitimate PDF file, a benign image of interest to targets (see Figure 8), and an HttpBrowser installer disguised as an image file

Tactics: TA0005
Techniques: T1036
Input: Often this location is the current working directory of the program.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574