madox81/Adema_ATTACK_DS huggingface dataset:
Input: Monitoring for Linux specific calls such as the ptrace system call should not generate large amounts of data due to their specialized nature, and can be a very effective method to detect some of the common process injection methods.

Tactics: TA0004, TA0005
Techniques: T1055.008, T1055.014, T1055
Input: hcdLoader provides command-line access to the compromised system.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: By modifying hardware or firmware in the supply chain, adversaries can insert a backdoor into consumer networks that may be difficult to detect and give the adversary a high degree of control over the system.

Tactics: TA0001
Techniques: T1195, T1195.003
Input: Monitor for newly constructed files in order to manipulate external outcomes or hide activity

Tactics: TA0040
Techniques: T1565.001, T1565.003, T1565
Input: FIN7's Harpy backdoor malware can use DNS as a backup channel for C2 if HTTP fails.

Tactics: TA0011
Techniques: T1008
Input: Monitor for changes made to processes that may inject malicious code into suspended and hollowed processes in order to evade process-based defenses.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: Kazuar uses FTP and FTPS to communicate with the C2 server.

Tactics: TA0011
Techniques: T1071.002, T1071
Input: HAPPYWORK can collect the victim user name.

Tactics: TA0007
Techniques: T1033
Input: Known as DNS over HTTPS (DoH), queries to resolve C2 infrastructure may be encapsulated within encrypted HTTPS packets.

Tactics: TA0011
Techniques: T1572
Input: The script gathers system specific data, such as the domain the system belongs to and the current username, that it constructs in the following format:   <domain>\<username>:pass   The above string is encoded using a custom base64 encoder to strip out non-alphanumeric characters (=, / and +) from the data and replaces them with domain safe values (01, 02 and 03 respectively)

Tactics: TA0011
Techniques: T1132
Input: The malware then requests a connection to 192.184.60.229 on TCP port 81 using the command "05 01 00 01 c0 b8 3c e5 00 51" and verifies that the first two bytes from the server are "05 00" (c0 b8 3c e5 is the IP address and 00 51 is the port in network byte order)

Tactics: TA0007
Techniques: T1016
Input: PipeMon's first stage has been executed by a call to CreateProcess with the decryption password in an argument.

Tactics: TA0002
Techniques: T1106
Input: Collect and analyze signing certificate metadata on software that executes within the environment to look for unusual certificate characteristics and outliers.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Delivery document The delivery document contains a macro that downloads an executable from a remote server

Tactics: TA0011
Techniques: T1105
Input: This DLL serves three main functions: killing antimalware, unpacking and executing the main RAT DLL, and obtaining persistence

Tactics: TA0005
Techniques: T1140
Input: Adversaries may also directly read Login Keychain credentials from the ~/Library/Keychains/login.keychain file.

Tactics: TA0006
Techniques: T1555.001, T1555
Input: Mosquito runs tasklist to obtain running processes.

Tactics: TA0007
Techniques: T1057
Input: Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: CloudDuke downloads and executes additional malware from either a Web address or a Microsoft OneDrive account.

Tactics: TA0011
Techniques: T1105
Input: An APT28 loader Trojan adds the Registry key HKCU\Environment\UserInitMprLogonScript to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1037.001, T1037
Input: Forfiles can be used to subvert controls and possibly conceal command execution by not directly invoking cmd.

Tactics: TA0005
Techniques: T1202
Input: Cleaver has created customized tools and payloads for functions including ARP poisoning, encryption, credential dumping, ASP.NET shells, web backdoors, process enumeration, WMI querying, HTTP and SMB communications, network interface sniffing, and keystroke logging.

Tactics: TA0042
Techniques: T1587, T1587.001
Input: Adversaries may bridge network boundaries by compromising perimeter network devices or internal devices responsible for network segmentation.

Tactics: TA0005
Techniques: T1599
Input: Wingbird side loads a malicious file, sspisrv.dll, in part of a spoofed lssas.exe service.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: RedLeaves can gather browser usernames and passwords.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Monitor for changes made to windows registry keys and/or values that may attempt to hide artifacts associated with their behaviors to evade detection.

Tactics: TA0005
Techniques: T1564
Input: Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.

Tactics: TA0002
Techniques: T1059
Input: DRATzarus can deploy additional tools onto an infected machine.

Tactics: TA0011
Techniques: T1105
Input: ZIRCONIUM has created a run key named Dropbox Update Setup to mask a persistence mechanism for a malicious binary.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: SeaDuke has been packed with the UPX packer.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Users should not have permission to modify these in most cases.

Tactics: TA0004, TA0005
Techniques: T1055.009, T1055
Input: APT39 has used the Smartftp Password Decryptor tool to decrypt FTP passwords.

Tactics: TA0006
Techniques: T1555
Input: They use At.exe to schedule tasks to run self-extracting RAR archives, which install either HttpBrowser or PlugX

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: More_eggs has the capability to gather the username from the victim's machine.

Tactics: TA0007
Techniques: T1033
Input: Astaroth uses ActiveX objects for file execution and manipulation.

Tactics: TA0005
Techniques: T1218, T1218.001
Input: Skidmap has monitored critical processes to ensure resiliency.

Tactics: TA0007
Techniques: T1057
Input: TeamTNT has removed system logs from /var/log/syslog.

Tactics: TA0005
Techniques: T1070, T1070.002
Input: Maze has created a file named "startup_vrun.bat" in the Startup folder of a virtual machine to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Enable Audit Application Generated events on the AD FS farm via Group Policy Object.

Tactics: TA0006
Techniques: T1606, T1606.002
Input: Higaisa used a function to gather the current time.

Tactics: TA0007
Techniques: T1124
Input: The subdomain 676f6f646c75636b is a hex encoded string which decodes to goodluck

Tactics: TA0005
Techniques: T1140
Input: (Source: Dell SecureWorks) Further research revealed additional tools containing the same username (see Figure 21)

Tactics: TA0007
Techniques: T1033
Input: Turla has used valid digital certificates from Sysprint AG to sign its Epic dropper.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Changes in the set of DLLs that are loaded by a process (compared with past behavior) that do not correlate with known software, patches, , are suspicious.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Orz can gather a process list from the victim.

Tactics: TA0007
Techniques: T1057
Input: On a macOS or Linux system, adversaries may query locale to retrieve the value of the $LANG environment variable.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: When comparing the provided timestamps of the delivery documents to the timestamps for the remote template documents from Table 2, we find that the time to attack is directly correlated to the last time the templates are modified

Tactics: TA0005, TA0007
Techniques: T1070, T1070.006, T1124
Input: KONNI has used Rundll32 to execute its loader for privilege escalation purposes.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: BLINDINGCAN has attempted to hide its payload by using legitimate file names such as "iconcache.db".

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Conficker adds keys to the Registry at HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services and various other Registry locations.

Tactics: TA0005
Techniques: T1112
Input: Green Lambert can use shell scripts for execution, such as /bin/sh -c.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: The following commands are supported by the malware:  Command ID  Description  00 00 00  Content after command ID is written to: C:\Users\[Username]\AppData\Local\Temp\notepad1.exe  00 00 01  Deletes the files: C:\Users\[Username]\AppData\Local\Temp\notepad.exe C:\Users\[Username]\AppData\Local\Temp\newnotepad.exe  00 00 02  Malware exits  00 00 03  Malware downloads the URL that follows the command ID

Tactics: TA0002, TA0007
Techniques: T1033, T1204
Input: Honeybee removes batch files to reduce fingerprint on the system as well as deletes the CAB file that gets encoded upon infection.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: The Bonjour mDNSResponder daemon automatically registers and advertises a host’s registered services on the network.

Tactics: TA0007
Techniques: T1046
Input: These entries may include information such as a GUID, path to the local file, and a canonical name used to launch the file programmatically ( WinExec("c:\windows\system32\control.exe {Canonical_Name}", SW_NORMAL);) or from a command line (control.exe /name {Canonical_Name}).

Tactics: TA0005
Techniques: T1218, T1218.002
Input: They combine reconnaissance of GPO (Group Policy Object management for execution) with digitally-signed malware to avoid detection or blocking during their infection phases

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Proton zips up files before exfiltrating them.

Tactics: TA0009
Techniques: T1560
Input: Gold Dragon checks the running processes on the victim’s machine.

Tactics: TA0007
Techniques: T1057
Input: When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in /System/Library/LaunchAgents, /Library/LaunchAgents, and ~/Library/LaunchAgents.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: SysUpdate can write its configuration file to Software\Classes\scConfig in either HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER.

Tactics: TA0005
Techniques: T1112
Input: DustySky collects information about running processes from victims.

Tactics: TA0007
Techniques: T1057
Input: XCSSET will create an ssh key if necessary with the ssh-keygen -t rsa -f $HOME/.ssh/id_rsa -P command.

Tactics: TA0003
Techniques: T1098.004, T1098
Input: Chimera has cleared event logs on compromised hosts.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: Applications can modify the file association for a given file extension to call an arbitrary program when a file with the given extension is opened.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.001
Input: The link provided in the malicious email led to a fake VPN Web Portal:  Upon logging in with the credentials provided in the email, the victim is presented with the following page:  The victim is asked to install the “VPN Client” (an .exe file), or, if download fails, to download a password protected zip (with the same .exe file inside)

Tactics: TA0011
Techniques: T1105
Input: Adversaries may search for user activity on the host based on variables such as the speed/frequency of mouse movements and clicks  , browser history, cache, bookmarks, or number of files in common directories such as home or the desktop.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.002
Input: For example, on macOS systems log show --predicate 'process = "sshd"' can be used to review incoming SSH connection attempts for suspicious activity.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: Changes in the set of dylibs that are loaded by a process (compared to past behavior) that do not correlate with known software, patches, , are suspicious.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.004, T1574
Input: While public references of usage by threat actors are scarce, many red teams/penetration testers leverage hardware additions for initial access.

Tactics: TA0001
Techniques: T1200
Input: AppleSeed can call regsvr32.exe for execution.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: it operates over DNS traffic, but can also switch to encrypted channels such as HTTPS or SSL

Tactics: TA0011
Techniques: T1071
Input: Trojan.Karagany can dump passwords and save them into \ProgramData\Mail\MailAg\pwds.txt.

Tactics: TA0006
Techniques: T1003
Input: Because the ACK packets are for connections that do not exist, the OS will have to search the entire state table to confirm that no match exists.

Tactics: TA0040
Techniques: T1499, T1499.001
Input: The Get-MsolRoleMember PowerShell cmdlet can be used to obtain account names given a role or permissions group in Office 365.

Tactics: TA0007
Techniques: T1087, T1087.004
Input: TEMP.Veles has used a VPN to persist in the victim environment.

Tactics: TA0001, TA0003
Techniques: T1133
Input: Examples of existing defenses that can be impeded include encryption, via Weaken Encryption, authentication, via Network Device Authentication, and perimeter defenses, via Network Boundary Bridging.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: XCSSET adds malicious file paths to the DYLD_FRAMEWORK_PATH and DYLD_LIBRARY_PATH environment variables to execute malicious code.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.006, T1574
Input: The malware operates on victims’ systems as a svchost-based service and is capable of downloading executables, changing its own configuration, updating its own binaries, terminating its own processes, and activating and terminating denial-of-service attacks

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Okrum can establish persistence by adding a new service NtmsSvc with the display name Removable Storage to masquerade as a legitimate Removable Storage Manager.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Network/Host intrusion prevention systems, antivirus, and detonation chambers can be employed to prevent documents from fetching and/or executing malicious payloads.

Tactics: TA0005
Techniques: T1221
Input: Lazarus Group has acquired domains related to their campaigns to act as distribution points and C2 channels.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: Utilize the Sysinternals Autoruns/Autorunsc utility  to examine loaded drivers associated with the LSA.

Tactics: TA0003, TA0004
Techniques: T1547.008, T1547
Input: njRAT has used HTTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Carbon uses TCP and UDP for C2.

Tactics: TA0011
Techniques: T1095
Input: The main function of the Trojan interacts with its configured C2 server to obtain additional code to execute

Tactics: TA0005
Techniques: T1140
Input: Attack Overview The attack starts with Microsoft Word documents containing a malicious VBA macro being attached to spear phishing emails

Tactics: TA0001
Techniques: T1566, T1566.001
Input: FLASHFLOOD will scan the My Recent Documents, Desktop, Temporary Internet Files, and TEMP directories.

Tactics: TA0009
Techniques: T1005
Input: Monitor for processes that can be used to enumerate domain accounts and groups, such as net.exe and net1.exe, especially when executed in quick succession.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: CharmPower can enumerate the OS version and computer name on a targeted system.

Tactics: TA0007
Techniques: T1082
Input: CrackMapExec can set a scheduled task on the target system to execute commands remotely using at.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: OwaAuth has a command to timestop a file or directory.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: Adversaries may modify these profiles to include arbitrary commands, functions, modules, and/or PowerShell drives to gain persistence.

Tactics: TA0003, TA0004
Techniques: T1546.013, T1546
Input: Bankshot decodes embedded XOR strings.

Tactics: TA0005
Techniques: T1140
Input: When a document is found matching one of the extensions in the configuration, TINYTYPHON uploads it to the C2 server.

Tactics: TA0010
Techniques: T1020
Input: Javali has achieved execution through victims opening malicious attachments, including MSI files with embedded VBScript.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: MCMD can use HTTPS in communication with C2 web servers.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: HermeticWiper has the ability to use scheduled tasks for execution.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Zox has the ability to leverage local and remote exploits to escalate privileges.

Tactics: TA0004
Techniques: T1068
Input: KGH_SPY has masqueraded as a legitimate Windows tool.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: They may create a new shortcut as a means of indirection that may use Masquerading to look like a legitimate program.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: In the case of network-based reporting of indicators, an adversary may block traffic associated with reporting to prevent central analysis.

Tactics: TA0005
Techniques: T1562.006, T1562
Input: Follow best practices in restricting access to privileged accounts to avoid hostile programs from accessing sensitive information.

Tactics: TA0006
Techniques: T1003, T1003.007
Input: POWERSTATS can deobfuscate the main backdoor code.

Tactics: TA0005
Techniques: T1140
Input: Bisonal has used the Windows API to communicate with the Service Control Manager to execute a thread.

Tactics: TA0002
Techniques: T1106
Input: MarkiRAT can obtain the computer name from a compromised host.

Tactics: TA0007
Techniques: T1082
Input: FIN8 also obfuscates malicious macros delivered as payloads.

Tactics: TA0005
Techniques: T1027
Input: SDBbot has the ability to add a value to the Registry Run key to establish persistence if it detects it is running with regular user privilege.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: This legitimate control word value is intended to be a file destination of a template file resource that is retrieved and loaded when an .rtf file is opened.

Tactics: TA0005
Techniques: T1221
Input: Remcos has a command for keylogging.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: The type of modification and the impact it will have depends on the target application and process as well as the goals and objectives of the adversary.

Tactics: TA0040
Techniques: T1565.003, T1565
Input: For example, adversaries may perform SSH tunneling (also known as SSH port forwarding), which involves forwarding arbitrary data over an encrypted SSH tunnel.

Tactics: TA0011
Techniques: T1572
Input: hklm\software\microsoft\windows nt\currentversion\appcompatflags\installedsdb

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: Sandworm Team has crafted spearphishing emails with hyperlinks designed to trick unwitting recipients into revealing their account credentials.

Tactics: TA0043
Techniques: T1598, T1598.003
Input: Bazar can create or add files to Registry Run Keys to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Empire can conduct command and control over protocols like HTTP and HTTPS.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: If the Performance key is not already present and if an adversary-controlled user has the Create Subkey permission, adversaries may create the Performance key in the service’s Registry tree to point to a malicious DLL.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.011, T1574
Input: CSPY Downloader has the ability to remove values it writes to the Registry.

Tactics: TA0005
Techniques: T1070
Input: Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.

Tactics: TA0011
Techniques: T1092
Input: Ensure proper network segmentation is followed to protect critical servers and devices.

Tactics: TA0007
Techniques: T1046
Input: Examples: one account logged into multiple systems simultaneously; multiple accounts logged into the same machine simultaneously; accounts logged in at odd times (ex: when the user is not present) or outside of business hours.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.003, T1556, T1556.001
Input: In addition to Dynamic-link Library Injection, Mavinject.exe can also be abused to perform import descriptor injection via its  /HMODULE command-line parameter ( mavinject.exe PID /HMODULE=BASE_ADDRESS PATH_DLL ORDINAL_NUMBER).

Tactics: TA0005
Techniques: T1218, T1218.013
Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Valid Accounts or Phishing).

Tactics: TA0043
Techniques: T1593, T1593.002
Input: TEMP.Veles has modified and added entries within HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options to maintain persistence.

Tactics: TA0003, TA0004
Techniques: T1546.012, T1546
Input: TrickBot module shareDll/mshareDll discovers network shares via the WNetOpenEnumA API.

Tactics: TA0007
Techniques: T1135
Input: Additional mitigations that could help to prevent attacks like these from succeeding in your environment include:  Changing the default handler for “.hta” files in your environment so that they cannot be directly executed.hta” files in your environment so that they cannot be directly executed

Tactics: TA0005, TA0011
Techniques: T1070, T1105, T1070.004
Input: Monitor for attempts by programs to inject into or dump browser process memory.

Tactics: TA0006
Techniques: T1539
Input: Login items are applications, documents, folders, or server connections that are automatically launched when a user logs in.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.015
Input: Once all the tasks have been executed completely, the malware breaks the loop, sends the termination buffer back, and clears all the footprints from the targeted machine:  Deletes the LNK file from the startup directory

Tactics: TA0003, TA0004, TA0005
Techniques: T1547.009, T1070, T1547, T1070.004
Input: DarkComet can listen in to victims' conversations through the system’s microphone.

Tactics: TA0009
Techniques: T1123
Input: China Chopper's server component can download remote files.

Tactics: TA0011
Techniques: T1105
Input: Dyre has a command to download and executes additional files.

Tactics: TA0011
Techniques: T1105
Input: Grandoreiro can parse Outlook .pst files to extract e-mail addresses.

Tactics: TA0007
Techniques: T1087.003, T1087
Input: Ke3chang used a SharePoint enumeration and data dumping tool known as spwebmember.

Tactics: TA0009
Techniques: T1213, T1213.002
Input: EVILNUM can execute commands and scripts through rundll32.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: HermeticWizard can find machines on the local network by gathering known local IP addresses through DNSGetCacheDataTable, GetIpNetTable,WNetOpenEnumW(RESOURCE_GLOBALNET, RESOURCETYPE_ANY),NetServerEnum,GetTcpTable, and GetAdaptersAddresses.

Tactics: TA0007
Techniques: T1018
Input: The initial beacon packet for S-Type contains the operating system version and file system of the victim.

Tactics: TA0007
Techniques: T1082
Input: menuPass has used certutil in a macro to decode base64-encoded content contained in a dropper document attached to an email.

Tactics: TA0005
Techniques: T1140
Input: CORALDECK searches for specified files.

Tactics: TA0007
Techniques: T1083