madox81/Adema_ATTACK_DS huggingface dataset:
Input: Dyre has the ability to identify network settings on a compromised host.

Tactics: TA0007
Techniques: T1016
Input: Dubbed ‘SpeakUp’, the new Trojan exploits known vulnerabilities in six different Linux distributions

Tactics: TA0004
Techniques: T1068
Input: Gelsemium has the ability to compress its components.

Tactics: TA0005
Techniques: T1027
Input: The OsInfo function in Komplex collects a running process list.

Tactics: TA0007
Techniques: T1057
Input: Kessel has exfiltrated data via hexadecimal-encoded subdomain fields of DNS queries.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Adversaries can obtain digital certificates (see Digital Certificates) or create self-signed certificates (see Digital Certificates).

Tactics: TA0042
Techniques: T1608.003, T1608
Input: Cobalt Group has used powershell.exe to download and execute scripts.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: On Windows hosts, PowerShell has two different command history providers: the built-in history and the command history managed by the PSReadLine module.

Tactics: TA0005
Techniques: T1070, T1070.003
Input: gh0st RAT has a keylogger.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Monitor files viewed in isolation that may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel.

Tactics: TA0010
Techniques: T1048.002, T1048.003, T1048
Input: This technique may incorporate use of other techniques such as File and Directory Discovery and Lateral Tool Transfer to identify and move files, as well as Cloud Service Dashboard and Cloud Storage Object Discovery to identify resources in cloud environments.

Tactics: TA0009
Techniques: T1119
Input: Leveraging data from Kaspersky Security Network, we identified two other similar exploit chains used by BlackOasis in June 2015 which were zero days at the time.  Those include CVE-2015-5119 and CVE-2016-0984, which were patched in July 2015 and February 2016 respectively.  These exploit chains also delivered FinSpy installation packages

Tactics: TA0004
Techniques: T1068
Input: Remsec has a package that collects documents from any inserted USB sticks.

Tactics: TA0009
Techniques: T1025
Input: Execution via APC injection may also evade detection from security products since the execution is masked under a legitimate process.

Tactics: TA0004, TA0005
Techniques: T1055.004, T1055
Input: Empire has a limited number of built-in modules for exploiting remote SMB, JBoss, and Jenkins servers.

Tactics: TA0008
Techniques: T1210
Input: EVILNUM can upload files over the C2 channel from the infected host.

Tactics: TA0010
Techniques: T1041
Input: Monitor for newly constructed files that may establish persistence through executing malicious commands triggered by a user’s shell.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: Scripts automatically execute, typically searching versions of the browser and plugins for a potentially vulnerable version. The user may be required to assist in this process by enabling scripting or active website components and ignoring warning dialog boxes.

Tactics: TA0001
Techniques: T1189
Input: BabyShark has executed the ver command.

Tactics: TA0007
Techniques: T1082
Input: Turla has developed its own unique malware for use in operations.

Tactics: TA0042
Techniques: T1587, T1587.001
Input: BackConfig has compromised victims via links to URLs hosting malicious content.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Kimsuky has created email accounts for phishing operations.

Tactics: TA0042
Techniques: T1585, T1585.002
Input: LitePower can identify installed AV software.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Bazar can enumerate remote systems using  Net View.

Tactics: TA0007
Techniques: T1018
Input: The Winnti for Windows dropper can decrypt and decompresses a data blob.

Tactics: TA0005
Techniques: T1140
Input: Unusual remote authentication events that correlate with other suspicious activity (such as writing and executing binaries) may indicate malicious activity.

Tactics: TA0005, TA0008
Techniques: T1550.003, T1550
Input: Wizard Spider has exfiltrated victim information using FTP.

Tactics: TA0010
Techniques: T1048.003, T1048
Input: Monitor for commands which enable hypervisors such as Hyper-V.

Tactics: TA0005
Techniques: T1564, T1564.006
Input: Hildegard was executed through the kubelet API run command and by executing commands on running containers.

Tactics: TA0002
Techniques: T1609
Input: Specific file and directory modifications may be a required step for many techniques, such as establishing Persistence via Unix Shell Configuration Modification or tainting/hijacking other instrumental binary/configuration files via Hijack Execution Flow.

Tactics: TA0005
Techniques: T1222.002, T1222
Input: Less than a week after Microsoft issued a patch for CVE-2017-11882 on Nov

Tactics: TA0002
Techniques: T1203
Input: Monitor executed commands and arguments that may gather credentials from information stored in the Proc filesystem or /proc.

Tactics: TA0006
Techniques: T1003, T1003.007
Input: InvisiMole can scan the network for open ports and vulnerable instances of RDP and SMB protocols.

Tactics: TA0007
Techniques: T1046
Input: Denis compressed collected data using zlib.

Tactics: TA0009
Techniques: T1560.002, T1560
Input: BRONZE BUTLER has used batch scripts and the command-line interface for execution.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: admin@338 has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Naikon has convinced victims to open malicious attachments to execute malware.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Adversaries may put in place resources that are referenced by a link that can be used during targeting.

Tactics: TA0042
Techniques: T1608.005, T1608
Input: Stuxnet collects system information including computer and domain names, OS version, and S7P paths.

Tactics: TA0007
Techniques: T1082
Input: Gelsemium can delete its dropper component from the targeted system.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: APT39 has utilized tools to aggregate data prior to exfiltration.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Several Lazarus Group malware families install themselves as new services.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: If infrastructure or patterns in malicious web content have been previously identified, internet scanning may uncover when an adversary has staged web content to make it accessible for targeting.Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult.

Tactics: TA0042
Techniques: T1608.005, T1608
Input: To set up persistence, the loader creates a folder named “c:\temp”, sets its attributes to be a hidden and system folder to hide the folder from view in Windows Explorer

Tactics: TA0003, TA0004, TA0005, TA0011
Techniques: T1547.001, T1090.003, T1547, T1564, T1090, T1564.001
Input: APT-C-36 has used ConfuserEx to obfuscate its variant of Imminent Monitor, compressed payload and RAT packages, and password protected encrypted email attachments to avoid detection.

Tactics: TA0005
Techniques: T1027
Input: Tools such as Sysinternals Autoruns may also be used to detect WMI changes that could be attempts at persistence.

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: An adversary can add a new directory or list of directories before other locations where programs can be executed from.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.007, T1574
Input: The Komplex trojan supports file deletion.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: The Name key indicates an arbitrary name assigned by the creator and the Exec key indicates the application and command line arguments to execute.

Tactics: TA0003, TA0004
Techniques: T1547.013, T1547
Input: BoxCaon established persistence by setting the HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load registry key to point to its executable.

Tactics: TA0003, TA0004
Techniques: T1547
Input: PsExec can also be used to execute commands or payloads via a temporary Windows service created through the service control manager API.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Cobalt Strike can perform browser pivoting and inject into a user's browser to inherit cookies, authenticated HTTP sessions, and client SSL certificates.

Tactics: TA0009
Techniques: T1185
Input: Turla has obtained information on security software, including security logging information that may indicate whether their malware has been detected.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Mythic supports SMB-based peer-to-peer C2 profiles.

Tactics: TA0011
Techniques: T1071.002, T1071
Input: ComRAT can use email attachments for command and control.

Tactics: TA0011
Techniques: T1071, T1071.003
Input: Adversary abuse of RC scripts is especially effective for lightweight Unix-like distributions using the root user as default, such as IoT or embedded systems.

Tactics: TA0003, TA0004
Techniques: T1037.004, T1037
Input: Adversaries may change where these logs are saved using Set-PSReadLineOption -HistorySavePath {File Path}.

Tactics: TA0005
Techniques: T1562.003, T1562
Input: MuddyWater has used malware that can collect the victim’s OS version and machine name.

Tactics: TA0007
Techniques: T1082
Input: RogueRobin uses Windows Script Components.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Other special keywords are recognized by the macOS loader are @rpath, @loader_path, and @executable_path.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.004, T1574
Input: APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.

Tactics: TA0002
Techniques: T1106
Input: Higher level software frameworks, such as Microsoft .NET and macOS Cocoa, are also available to interact with native APIs.

Tactics: TA0002
Techniques: T1106
Input: Monitor for API calls that may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

Tactics: TA0007
Techniques: T1083
Input: HermeticWizard has the ability to use wevtutil cl system to clear event logs.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: XCSSET searches firewall configuration files located in /Library/Preferences/ and uses csrutil status to determine if System Integrity Protection is enabled.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Once Shellex is called, it first passes each of the items in the config buffer to their own strings.  Next, it creates a mutex using the filename and checks to see if the Service key for the service name exists.  If so, it opens it using service manager.  If not, it first saves a copy of itself to %Program Files (x86)%/DIFXE/svchost.exe.  Next, it creates the service and runs it.  Once the service is running, it creates a new mutex using [C2URL]:[PORT] and connects to the C2 server.  It then sends the Implant_Heartbeat opcode, and then calls its payload function to grab  Version Information (x86 and x64) Host information SystemInfo Processor Count and Write Speed Global Memory Status  before formatting it, altering the InstallTime subkey, and sending all of the information back to its C2 in the Implant_Login buffer

Tactics: TA0002, TA0003, TA0004, TA0007
Techniques: T1569.002, T1543.003, T1082, T1543, T1569
Input: The Poseidon Group's Information Gathering Tool (IGT) includes PowerShell components.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: FELIXROOT gathers the time zone information from the victim’s machine.

Tactics: TA0007
Techniques: T1124
Input: This information may also reveal times/dates of purchases and shipments of the victim’s hardware and software resources.

Tactics: TA0043
Techniques: T1591.003, T1591
Input: Plist files are located in the root, system, and users /Library/LaunchAgents or /Library/LaunchDaemons folders.

Tactics: TA0002
Techniques: T1569.001, T1569
Input: BadPatch collects files from the local system that have the following extensions, then prepares them for exfiltration: .xls, .xlsx, .pdf, .mdb, .rar, .zip, .doc, .docx.

Tactics: TA0009
Techniques: T1005
Input: Operation Wocao has used a VBScript to conduct reconnaissance on targeted systems.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: PoetRAT was delivered with documents using DDE to execute malicious code.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: System firmware like BIOS and (U)EFI underly the functionality of a computer and may be modified by an adversary to perform or assist in malicious activity.

Tactics: TA0003, TA0005
Techniques: T1542.001, T1542
Input: MoonWind obtains the victim username.

Tactics: TA0007
Techniques: T1033
Input: Leviathan has used BITSAdmin to download additional tools.

Tactics: TA0003, TA0005
Techniques: T1197
Input: It encrypted the gathered information from a victim's system and hid it within an image before exfiltrating the image to a C2 server.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: Adversaries may modify systems in order to manipulate the data as it is accessed and displayed to an end user, thus threatening the integrity of the data.

Tactics: TA0040
Techniques: T1565.003, T1565
Input: Night Dragon enticed users to click on links in spearphishing emails to download malware.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Adversaries may gather information about the victim's host firmware that can be used during targeting.

Tactics: TA0043
Techniques: T1592, T1592.003
Input: XAgent C2 Communications The macOS variant of XAgent has ability to receive commands from threat actors via its command and control channel, but is also capable of logging key strokes via its keylogger functionality

Tactics: TA0006, TA0009
Techniques: T1056
Input: BabyShark has downloaded additional files from the C2.

Tactics: TA0011
Techniques: T1105
Input: Wevtutil can be used to export events from a specific log.

Tactics: TA0009
Techniques: T1005
Input: SHA-1FilenameFirst seen on VirusTotalBackdoor download URLDecoy description or URL     07cd177f5baf8c1bdbbae22f1e8f03f22dfdb148"info_list.txt "2016-05-09hxxp://dev.aneros.com/media/icloudsyncd"Most Common Interview Questions"   78ba1152ef3883e63f10c3a85cbf00f2bb305a6a"screenshot_2016-06-28-01.jpg "2016-06-28hxxp://freesafesoft.com/icloudsyncdBlackHat-TDS Panel screenshot   773a82343367b3d09965f6f09cc9887e7f8f01bf"screenshot.jpg "2016-05-07hxxp://dev.aneros.com/media/icloudsyncdFirefox 20 about screenshot   dfdb38f1e3ca88cfc8e9a2828599a8ce94eb958c"CVdetails.doc "2016-05-03hxxp://lovefromscratch.ca/wp-admin/css/icloudsyncdhxxp://lovefromscratch.ca/wp-admin/CVdetails.doc   2739170ed195ff1b9f00c44502a21b5613d08a58"CVdetails.doc "2016-05-03hxxp://lovefromscratch.ca/wp-admin/css/icloudsyncdhxxp://lovefromscratch.ca/wp-admin/CVdetails.doc   e9d4523d9116b3190f2068b1be10229e96f21729"logo.jpg "2016-06-02hxxp://dev.aneros.com/media/icloudsyncdsanelite logo   7472102922f91a78268430510eced1059eef1770"screenshot_9324 2.jpg "2016-06-28hxxp://freesafesoft.com/icloudsyncdSome C&C panel    Backdoor    SHA-1ESET Detection nameC&CVersion     a4bc56f5ddbe006c9a68422a7132ad782c1aeb7bOSX/Keydnap.Ahxxps://g5wcesdfjzne7255.onion.to1.3.1   abf99129e0682d2fa40c30a1a1ad9e0c701e14a4OSX/Keydnap.Ahxxps://r2elajikcosf7zee.onion.to1.3.5    Backdoor C&C servers  hxxps://g5wcesdfjzne7255.onion.to/ hxxps://r2elajikcosf7zee.onion.to/  Keydnap’s IoCs are also available and updated on ESET’s malware-ioc Github repository

Tactics: TA0004, TA0008, TA0009
Techniques: T1021, T1021.002, T1113, T1068
Input: OLDBAIT collects credentials from several email clients.

Tactics: TA0006
Techniques: T1555
Input: The Exaramel for Windows dropper creates and starts a Windows service named wsmprovav with the description "Windows Check AV" in an apparent attempt to masquerade as a legitimate service.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Figure 2: APT39 attack lifecycle There are some indications that APT39 demonstrated a penchant for operational security to bypass detection efforts by network defenders, including the use of a modified version of Mimikatz that was repacked to thwart anti-virus detection in one case, as well as another instance when after gaining initial access APT39 performed credential harvesting outside of a compromised entity's environment to avoid detection

Tactics: TA0005
Techniques: T1070, T1027.002, T1027, T1070.004
Input: Function for scrambling AES256 key in the outgoing packet  Some screenshots taken during scrambling and encryption process:   Figure 21. The highlighted bytes represent the scrambled computer info   Figure 22. Randomly generated AES256 key   Figure 23. Scrambled AES256 key (0xC1 XOR 0x13 = 0xD2, 0xD2 ROL 6 = 0xB4) etc.)   Figure 24. Computer info encrypted with AES256 key   Figure 25. Screenshot of the final payload to be sent to C&C server

Tactics: TA0009, TA0011
Techniques: T1573, T1113
Input: GoldMax has been packed for obfuscation.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Adversaries may environmentally key payloads or other features of malware to evade defenses and constraint execution to a specific target environment.

Tactics: TA0005
Techniques: T1480, T1480.001
Input: Another interesting characteristic of the malicious documents is that the metadata associated with the document files themselves also matches that found in many of the malicious documents that were previously being used to spread Remcos.Figure 3: Document metadataAdditionally, the creation and modification dates associated with these documents are shortly after we released a detailed analysis of Remcos distribution campaigns that were being observed throughout 2018

Tactics: TA0001
Techniques: T1566, T1566.001
Input: FInally , the newest sample uses dynamic API lookups to attempt to make static disassembly harder to understand.

Tactics: TA0002
Techniques: T1106
Input: Monitor for contextual data about an account, which may include a username, user ID, environmental data that may attempt to hide artifacts associated with their behaviors to evade detection.

Tactics: TA0005
Techniques: T1564
Input: Cobalt Strike will break large data sets into smaller chunks for exfiltration.

Tactics: TA0010
Techniques: T1030
Input: If the device and/or service is not secured, then it may be vulnerable to interception.

Tactics: TA0006
Techniques: T1111
Input: An adversary with sufficient permissions, such as via a pod's service account, may also use the Kubernetes API to retrieve credentials from the Kubernetes API server.

Tactics: TA0006
Techniques: T1552, T1552.007
Input: More_eggs has used an RC4-based encryption method for its C2 communications.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Adversaries may modify plist files to automatically run an application when a user logs in.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.007
Input: MoleNet can use WMI commands to check the system for firewall and antivirus software.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Alerting on these Event IDs may generate a high degree of false positives, so compare against baseline knowledge for how systems are typically used and correlate modification events with other indications of malicious activity where possible.

Tactics: TA0040
Techniques: T1531
Input: Monitor for the unexpected changes to cloud block storage volumes .

Tactics: TA0005
Techniques: T1578
Input: JHUHUGIT has a command to download files to the victim’s machine.

Tactics: TA0011
Techniques: T1105
Input: JHUHUGIT has registered itself as a scheduled task to run each time the current user logs in.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Exaramel for Linux has a hardcoded location under systemd that it uses to achieve persistence if it is running as root.

Tactics: TA0003, TA0004
Techniques: T1543.002, T1543
Input: Monitor for contextual data about an Internet-facing resource gathered from a scan, such as running services or ports that may compromise third-party infrastructure that can be used during targeting.

Tactics: TA0042
Techniques: T1584
Input: Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.

Tactics: TA0040
Techniques: T1531
Input: RedLeaves is launched through use of DLL search order hijacking to load a malicious dll.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Detection of this behavior may be difficult, detection efforts may be focused on closely related adversary behaviors, such as Modify System Image.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.004
Input: Collect and analyze changes to Registry keys that associate file extensions to default applications for execution and correlate with unknown process launch activity or unusual file types for that process.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.001
Input: Ngrok can tunnel RDP and other services securely over internet connections.

Tactics: TA0011
Techniques: T1572
Input: TSCookie has the ability to list processes on the infected host.

Tactics: TA0007
Techniques: T1057
Input: Monitor for newly constructed drives or other related events associated with computer hardware and other accessories (especially new or unknown) being connected to systems.

Tactics: TA0001
Techniques: T1200
Input: Bazar has used XOR, RSA2, and RC4 encrypted files.

Tactics: TA0005
Techniques: T1027
Input: Machete's collected data is exfiltrated over the same channel used for C2.

Tactics: TA0010
Techniques: T1041
Input: This custom onion routing network will transport the encrypted C2 traffic through the compromised population, allowing adversaries to communicate with any device within the onion routing network.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: Consider correlation with process monitoring and command lines associated with collection and exfiltration.

Tactics: TA0010
Techniques: T1020
Input: BLINDINGCAN has used HTTPS over port 443 for command and control.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: LookBack has a function that decrypts malicious data.

Tactics: TA0005
Techniques: T1140
Input: Stuxnet collects the time and date of a system when it is infected.

Tactics: TA0007
Techniques: T1124
Input: Revenge RAT gathers the username from the system.

Tactics: TA0007
Techniques: T1033
Input: ThreatNeedle can decrypt its payload using RC4, AES, or one-byte XORing.

Tactics: TA0005
Techniques: T1140
Input: After the sequence is completed, opening a port is often accomplished by the host based firewall, but could also be implemented by custom software.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205, T1205.001
Input: ROKRAT can decrypt strings using the victim's hostname as the key.

Tactics: TA0005
Techniques: T1140
Input: QakBot can use obfuscated and encoded scripts; it has also hidden code within Excel spreadsheets by turning the font color to white and splitting it across multiple cells.

Tactics: TA0005
Techniques: T1027
Input: Cobalt Strike can use WMI to deliver a payload to a remote host.

Tactics: TA0002
Techniques: T1047
Input: Metamorfo has downloaded a zip file for execution on the system.

Tactics: TA0011
Techniques: T1102.003, T1102
Input: Green Lambert can establish persistence on a compromised host through modifying the profile, login, and run command (rc) files associated with the bash, csh, and tcsh shells.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: InvisiMole uses a variation of the XOR cipher to encrypt files before exfiltration.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: ZxShell has been dropped through exploitation of CVE-2011-2462, CVE-2013-3163, and CVE-2014-0322.

Tactics: TA0001
Techniques: T1190
Input: Physical locations may also indicate what legal jurisdiction and/or authorities the victim operates within.

Tactics: TA0043
Techniques: T1591, T1591.001
Input: Turla has used compromised servers as infrastructure.

Tactics: TA0042
Techniques: T1584.004, T1584