madox81/Adema_ATTACK_DS huggingface dataset:
Input: New, benign system processes may be created during installation of new software.

Tactics: TA0003, TA0004
Techniques: T1543
Input: Nebulae has created a service named "Windows Update Agent1" to appear legitimate.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Monitor for command line invocations of tools capable of modifying services that doesn’t correspond to normal usage patterns and known software, patch cycles,

Tactics: TA0002
Techniques: T1569
Input: APT29 has used compromised local accounts to access victims' networks.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.003
Input: FinFisher hooks processes by modifying IAT pointers to CreateWindowEx.

Tactics: TA0006, TA0009
Techniques: T1056.004, T1056
Input: It should be noted that the Win32/KillDisk.NBB variant used against media companies is more focused on destroying various types of files and documents

Tactics: TA0007
Techniques: T1083
Input: Sykipot contains keylogging functionality to steal passwords.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Linux Rabbit sends the payload from the C2 server as an encoded URL parameter.

Tactics: TA0011
Techniques: T1132
Input: MuddyWater has run a tool that steals passwords saved in victim email.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: Monitor for newly constructed logon behavior within Microsoft's SharePoint can be configured to report access to certain pages and documents.

Tactics: TA0009
Techniques: T1213
Input: For example, this may be useful for when the target user has a non-network logon session on the system.

Tactics: TA0004, TA0005
Techniques: T1134, T1134.001
Input: McAfee detects these threats as:  RDN/Generic Exploit RDN/Generic.dx Generic PWS.y Generic.hbg Exploit-CVE2018-4878  McAfee customers are also covered by McAfee Global Threat Intelligence Web Reputation classification, which rate these URLs as High Risk

Tactics: TA0004
Techniques: T1068
Input: Limit access to network infrastructure and resources that can be used to reshape traffic or otherwise produce AiTM conditions.

Tactics: TA0006, TA0009
Techniques: T1557
Input: Rocke used scripts which killed processes and added firewall rules to block traffic related to other cryptominers.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: On Windows 10, enable Attack Surface Reduction (ASR) rules to block processes created by WMI commands from running.

Tactics: TA0002
Techniques: T1047
Input: Some Backdoor.Oldrea samples contain a publicly available Web browser password recovery tool.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Monitor for newly constructed processes and/or command-lines that execute from the svchost.exe in Windows 10 and the Windows Task Scheduler taskeng.exe for older versions of Windows.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: During the execution preparation phase of a program, the dynamic linker loads specified absolute paths of shared libraries from environment variables and files, such as LD_PRELOAD on Linux or DYLD_INSERT_LIBRARIES on macOS.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.006, T1574
Input: Dragonfly has acquired VPS infrastructure for use in malicious campaigns.

Tactics: TA0042
Techniques: T1583.003, T1583
Input: It may be possible to detect adversary use of credentials they have obtained such as in Valid Accounts.

Tactics: TA0006
Techniques: T1552, T1552.007
Input: EKANS uses standard encryption library functions to encrypt files.

Tactics: TA0040
Techniques: T1486
Input: Correlate use of login activity related to remote services with unusual behavior or other malicious or suspicious activity.

Tactics: TA0008
Techniques: T1021
Input: Gazer communicates with its C2 servers over HTTP.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Pupy can user PowerView to execute "net user" commands and create local system accounts.

Tactics: TA0003
Techniques: T1136, T1136.001
Input: Identify files with the com.apple.ResourceFork extended attribute and large data amounts stored in resource forks.

Tactics: TA0005
Techniques: T1564, T1564.009
Input: Monitor executed commands and arguments that may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.

Tactics: TA0006
Techniques: T1003, T1003.002
Input: APT28 has obtained and used open-source tools like Koadic, Mimikatz, and Responder.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Monitor executed commands and arguments for actions that may attempt to get information about running processes on a system.

Tactics: TA0007
Techniques: T1057
Input: After the second DLL is loaded into memory, the first DLL overwrites the IP address for the control server, effectively changing the address the malware will communicate with

Tactics: TA0007
Techniques: T1016
Input: Collect file hashes; file names that do not match their expected hash are suspect.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: JCry has used VBS scripts.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Figure 12 and Figure 13 show the RSA keys used in FELIXROOT, and Figure 14 shows the AES encryption parameters

Tactics: TA0011
Techniques: T1573
Input: Duqu was an early example of malware that used steganography.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: Detection efforts may be focused on related stages of the adversary lifecycle, such as during Command and Control Web Service or Exfiltration Over Web Service .

Tactics: TA0042
Techniques: T1584, T1584.006
Input: Some variants of ADVSTORESHELL achieve persistence by registering the payload as a Shell Icon Overlay handler COM object.

Tactics: TA0003, TA0004
Techniques: T1546.015, T1546
Input: This is common behavior that can be used across different platforms and the network to evade defenses.

Tactics: TA0005
Techniques: T1027
Input: For example, consider monitoring for Windows event ID (EID) 400, which shows the version of PowerShell executing in the EngineVersion field (which may also be relevant to detecting a potential Downgrade Attack) as well as if PowerShell is running locally or remotely in the HostName field.

Tactics: TA0002
Techniques: T1059
Input: VERMIN can get a list of the processes and running tasks on the system.

Tactics: TA0007
Techniques: T1057
Input: Indrik Spider has used batch scripts on victim's machines.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: For example, in the previous variant of BADNEWS, the victim’s unique identifier was stored under a variable named ‘uid’, the username was stored in a variable named ‘u’, etc

Tactics: TA0007
Techniques: T1033
Input: Gamaredon Group has used hidcon to run batch files in a hidden console window.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Monitor for newly constructed instances that may attempt to take advantage of a weakness in an Internet-facing computer or program using software, data, or commands in order to cause unintended or unanticipated behavior.

Tactics: TA0002
Techniques: T1204.003, T1204
Input: Adversaries can use compromised email accounts to further their operations, such as leveraging them to conduct Phishing for Information or Phishing.

Tactics: TA0042
Techniques: T1586.002, T1586
Input: PLEAD has used HTTP for communications with command and control (C2) servers.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: The SP variable is a string containing the victim's username

Tactics: TA0007
Techniques: T1033
Input: Examples include creating a container configured to mount the host’s filesystem using the bind parameter, which allows the adversary to drop payloads and execute control utilities such as cron on the host, or utilizing a privileged container to run commands on the underlying host.

Tactics: TA0004
Techniques: T1611
Input: BlackEnergy gathers a list of installed apps from the uninstall program Registry.

Tactics: TA0007
Techniques: T1083
Input: Darkhotel malware has used a series of checks to determine if it's being analyzed; checks include the length of executable names, if a filename ends with .Md5.exe, and if the program is executed from the root of the C:\ drive, as well as checks for sandbox-related libraries.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: In Windows, Applications can access clipboard data by using the Windows API.

Tactics: TA0009
Techniques: T1115
Input: The POSHSPY backdoor is designed to download and execute additional PowerShell code and Windows binaries

Tactics: TA0011
Techniques: T1105
Input: Stolen data is encoded into the normal communications channel using the same protocol as command and control communications.

Tactics: TA0010
Techniques: T1041
Input: Bandook has a command to get the public IP address from a system.

Tactics: TA0007
Techniques: T1016
Input: This behavior may be abused by adversaries to execute malicious files that could bypass application control and signature validation on systems.

Tactics: TA0005
Techniques: T1216
Input: Browser bookmarks may reveal personal information about users (ex: banking sites, interests, social media, ) as well as details about internal network resources such as servers, tools/dashboards, or other related infrastructure.

Tactics: TA0007
Techniques: T1217
Input: SILENTTRINITY has several modules, such as ls.py, pwd.py, and recentFiles.py, to enumerate directories and files.

Tactics: TA0007
Techniques: T1083
Input: Implement where available, following vendor guidelines.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: Zeus Panda collects the current system time (UTC) and sends it back to the C2 server.

Tactics: TA0007
Techniques: T1124
Input: Monitor for changes made to files that may execute their own malicious payloads by hijacking vulnerable file path references.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.009, T1574
Input: CrackMapExec can pass the hash to authenticate via SMB.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: BRONZE BUTLER has used schtasks to register a scheduled task to execute malware during lateral movement.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Dragonfly has cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: SensePost, whose tool Ruler can be used to carry out malicious rules, forms, and Home Page attacks, has released a tool to detect Ruler usage.

Tactics: TA0003
Techniques: T1137, T1137.004, T1137.003, T1137.005
Input: Consider looking for identifiable patterns such as services listening, certificates in use, SSL/TLS negotiation features, or other response artifacts associated with adversary C2 software.

Tactics: TA0042
Techniques: T1584.003, T1584.004, T1583.004, T1583.003, T1584, T1583
Input: Clambling can determine the current time.

Tactics: TA0007
Techniques: T1124
Input: Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems.

Tactics: TA0006
Techniques: T1003.006, T1003.003, T1003, T1003.002, T1003.001, T1003.005
Input: APT29 has leveraged numerous pieces of malware that appear to be unique to APT29 and were likely developed for or by the group.

Tactics: TA0042
Techniques: T1587, T1587.001
Input: CharmPower can change its C2 channel once every 360 loops by retrieving a new domain from the actors’ S3 bucket.

Tactics: TA0011
Techniques: T1008
Input: The executable version of Helminth has a module to log clipboard contents.

Tactics: TA0009
Techniques: T1115
Input: Establishing a persona  on social media may require development of additional documentation to make them seem real.

Tactics: TA0042
Techniques: T1585, T1585.001
Input: yty collects files with the following extensions: .ppt, .pptx, .pdf, .doc, .docx, .xls, .xlsx, .docm, .rtf, .inp, .xlsm, .csv, .odt, .pps, .vcf and sends them back to the C2 server.

Tactics: TA0009
Techniques: T1005
Input: Files and folders that start with a period, ‘.’, are by default hidden from being viewed in the Finder application and standard command-line utilities like "ls".

Tactics: TA0005
Techniques: T1564, T1564.001
Input: FIN8 has used environment variables and standard input (stdin) to obfuscate command-line arguments.

Tactics: TA0005
Techniques: T1027
Input: Cuba has executed hidden PowerShell windows.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Ensure that developers and system administrators are aware of the risk associated with having plaintext passwords in software configuration files that may be left on endpoint systems or servers.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: An adversary therefore may utilize a CronJob to schedule deployment of a Job that executes malicious code in various nodes within a cluster.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.007, T1053
Input: Clicking on the shortcut ultimately leads to Backdoor.Pirpi being downloaded and executed on the affected computer

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion.

Tactics: TA0011
Techniques: T1090
Input: WarzoneRAT has the ability to control an infected PC using RDP.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: CHM execution may also bypass application application control on older and/or unpatched systems that do not account for execution of binaries through hh.exe.

Tactics: TA0005
Techniques: T1218, T1218.001
Input: NETWIRE has the ability to use /bin/bash and /bin/sh to execute commands.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: Pupy can bypass Windows UAC through either DLL hijacking, eventvwr, or appPaths.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: If neither file exists (which is often the baseline) only the superuser is allowed to use at.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: %WINDIR%\AppPatch\sysmain.sdb and

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: The PipeMon communication module can use a custom protocol based on TLS over TCP.

Tactics: TA0011
Techniques: T1095
Input: T9000 gathers and beacons the operating system build number and CPU Architecture (32-bit/64-bit) during installation.

Tactics: TA0007
Techniques: T1082
Input: The Regin malware platform supports many standard protocols, including SMB.

Tactics: TA0011
Techniques: T1071
Input: Some embedded network devices are capable of storing passwords for local accounts in either plain-text or encrypted formats.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: Kimsuky has used the Nirsoft SniffPass network sniffer to obtain passwords sent over non-secure protocols.

Tactics: TA0006, TA0007
Techniques: T1040
Input: Monitor for changes in the status of the system firewall such as Windows Security Auditing events 5025 (The Windows firewall service has been stopped) and 5034 (The Windows firewall driver was stopped).

Tactics: TA0005
Techniques: T1562.004, T1562.007, T1562
Input: RCSession can use an encrypted beacon to check in with C2.

Tactics: TA0011
Techniques: T1573
Input: HermeticWiper has the ability to corrupt disk partitions and obtain raw disk access to destroy data.

Tactics: TA0040
Techniques: T1561.001, T1561
Input: The device with the associated IP address directly replies with its MAC address.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.002
Input: Zeus Panda checks for running processes on the victim’s machine.

Tactics: TA0007
Techniques: T1057
Input: Siloscape connects to an IRC server for C2.

Tactics: TA0011
Techniques: T1071
Input: The benefit of this is that it allows users to go back to commands they've used before in different sessions.

Tactics: TA0005
Techniques: T1070, T1070.003
Input: Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.

Tactics: TA0002, TA0011
Techniques: T1071, T1071.003, T1059.005, T1059
Input: Require multi-factor authentication for SSH connections wherever possible, such as password protected SSH keys.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: Many LKMs require Linux headers (specific to the target kernel) in order to compile properly.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: IndigoZebra sent spearphishing emails containing malicious password-protected RAR attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: RogueRobin has used Google Drive as a Command and Control channel.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: This attribute, also known as a quarantine flag, is read by Apple's Gatekeeper defense program when the file is run and provides a prompt to the user to allow or deny execution.

Tactics: TA0005
Techniques: T1553.001, T1553
Input: Figure 3 – A list of file extensions targeted for destruction by new variant of KillDisk component As well as being able to delete system files to make the system unbootable – functionality typical for such destructive trojans – the KillDisk variant detected in the electricity distribution companies also appears to contain some additional functionality specifically intended to sabotage industrial systems

Tactics: TA0007
Techniques: T1083
Input: Cardinal RAT uses a secret key with a series of XOR and addition operations to encrypt C2 traffic.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Pupy's default encryption for its C2 communication channel is SSL, but it also has transport options for RSA and AES.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Cobalt Strike can exploit vulnerabilities such as MS14-058.

Tactics: TA0004
Techniques: T1068
Input: Clambling can deobfuscate its payload prior to execution.

Tactics: TA0005
Techniques: T1140
Input: OilRig has used .doc file extensions to mask malicious executables.

Tactics: TA0005
Techniques: T1036
Input: CopyKittens uses rundll32 to load various tools on victims, including a lateral movement tool named Vminst, Cobalt Strike, and shellcode.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Appendix I – Main historical checkpoints and politicized decoys Gaza Cybergang Group1 2016-2019    MD5 Hash First seen Filename/Decoy Translation/Explanation C2 server   B3a472f81f800b32fe6595f44c9bf63b Feb 2016 برقية وزارة الخارجية التركية لسيادتكم حول موضوع هام.exe  Translation: Letter for you from the Turkish Ministry of Foreign Affairs on Russian military operations in Syria en.gameoolines.com (185.117.72.190)   Df3f3ad279ca98f947214ffb3c91c514 e8a29c7a6f6c0140152ca8a01e336b37 March 2016 president abu mazen meetings with khaled meshaal.lha   dw.downloadtesting.com (185.117.75.105)   f9bcc21fbb40247167c8c85ed6ef56e3 March 2016 دراسة.lha   Dl.topgamse.com (45.63.97.44)   D9dbb65a42ffe0575f0e99f7498a593e April 2016 برقية الخارجية السعودية لسيادتكم يرجي الإطلاع – مهم.exe  Translation: Saudi Foreign Affairs telegram for you, please see – important.exe en.gameoolines.com (185.117.72.190)   221EEF8511169C0496BBC79F96E84A4A April 2016 تقرير السعودية والمعلومات المتوفر – ونستكمل عند التوفر.exe  Translation: Report on Saudi available information, to be updated with new info upon availability dw.downloadtesting.com (185.117.75.105)   62DF4BC3738BE5AD4892200A1DC6B59A Inside: 55d33d9da371fdfe7871f2479621444a May 2016 معلومات عن هجوم محتمل من الحوثيين على مواقع سعودية – خاص.exe  Translation: Information on possible attack by Houthis on Saudi sites – private dw.downloadtesting.com (185.117.75.105)   838696872F924D28B08AAAA67388202E May 2016 عاجل المخابرات المصرية.exe  Translation: Urgent Egyptian Intelligence dw.downloadtesting.com (185.117.75.105)   e8be9843c372d280a506ac260567bf91 May 2016 برقية وزارة الخارجية السعودية.exe  Translation: Saudi Foreign Affairs telegram.exe Message on the 34th GCC for Interior Ministers

Tactics: TA0004, TA0005
Techniques: T1036, T1055.012, T1068, T1055
Input: For example, the permitted IP ranges, ports or user accounts for the inbound/outbound rules of security groups, virtual firewalls established within AWS for EC2 and/or VPC instances, can be revealed by the DescribeSecurityGroups action with various request parameters.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: To circumvent this, adversaries may abuse the automatic generation of push notifications to MFA services such as Duo Push, Microsoft Authenticator, Okta, or similar services to have the user grant access to their account.

Tactics: TA0006
Techniques: T1621
Input: P.A.S. Webshell can issue commands via HTTP POST.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Cloud service providers often provide infrastructure throughout the world in order to improve performance, provide redundancy, and allow customers to meet compliance requirements.

Tactics: TA0005
Techniques: T1535
Input: Cardinal RAT and its watchdog component are compiled and executed after being delivered to victims as embedded, uncompiled source code.

Tactics: TA0005
Techniques: T1027.004, T1027
Input: The text of the spearphishing email usually tries to give a plausible reason why the file should be opened, and may explain how to bypass system protections in order to do so.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: APT3 has sent spearphishing emails containing malicious links.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Interestingly, the attacker has used the >> method to append to the file so there can be multiple outputs written to their single TMP file: "C:\Windows\system32\cmd.exe" /C systeminfo >> "C:\Ahnlab\$$$A24F.TMP"  "C:\WINDOWS\system32\cmd.exe" /C tasklist /v >> "C:\Ahnlab\$$$A24F.TMP"   NavRAT   Capabilities  NavRAT is a remote access trojan (RAT) designed to upload, download and execute files

Tactics: TA0009, TA0011
Techniques: T1105, T1074
Input: CSPY Downloader can download additional tools to a compromised host.

Tactics: TA0011
Techniques: T1105
Input: Many Linux and macOS versions come with SSH installed by default, although typically disabled until the user enables it.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: Leafminer obfuscated scripts that were used on victim machines.

Tactics: TA0005
Techniques: T1027
Input: Similar to Process Injection, this value can be abused to obtain elevated privileges by causing a malicious DLL to be loaded and run in the context of separate processes on the computer.

Tactics: TA0003, TA0004
Techniques: T1546.009, T1546
Input: This can be implemented in a variety of forms ( hardware, virtual, SMS), and can also be audited using administrative reporting features.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078.004, T1078
Input: Some ZeroT DLL files have been packed with UPX.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Bankshot uses HTTP for command and control communication.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Ramsay can collect directory and file lists.

Tactics: TA0007
Techniques: T1083
Input: Lazarus Group has used LinkedIn to identify and target specific employees within a chosen organization.

Tactics: TA0043
Techniques: T1593, T1593.001
Input: Note: cloud-delivered protection must be enabled for certain rules.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Axiom has used VPS hosting providers in targeting of intended victims.

Tactics: TA0042
Techniques: T1583.003, T1583
Input: Monitor for logging, messaging, and other artifacts highlighting the health of host sensors (ex: metrics, errors, and/or exceptions from logging applications)

Tactics: TA0040
Techniques: T1499.002, T1499, T1498, T1499.003, T1498.002, T1499.001, T1498.001, T1499.004
Input: Exploitation for defense evasion may happen shortly after the system has been compromised to prevent detection during later actions for for additional tools that may be brought in and used.

Tactics: TA0005
Techniques: T1211