madox81/Adema_ATTACK_DS huggingface dataset:
Input: Due to how the keys are generated, the sender encrypts data with the receiver’s public key and the receiver decrypts the data with their private key.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Kivars has the ability to initiate keylogging on the infected host.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Motherboard Check The Trojan will perform the following WMI query:   Select * from Win32_BaseBoard   The Trojan will check the Manufacturer and Product fields in the results for the strings VMware, Virtual, VBox, VM or Oracle

Tactics: TA0005, TA0007
Techniques: T1497
Input: Metamorfo had used AutoIt to load and execute the DLL payload.

Tactics: TA0002
Techniques: T1129
Input: Monitor for network data for uncommon data flows (, a client sending significantly more data than it receives from a server).

Tactics: TA0011
Techniques: T1132.001, T1132, T1132.002
Input: LookBack uses a custom binary protocol over sockets for C2 communications.

Tactics: TA0011
Techniques: T1095
Input: The ARP protocol is stateless and does not require authentication.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.002
Input: Zebrocy uses the tasklist and wmic process get Capture, ExecutablePath commands to gather the processes running on the system.

Tactics: TA0007
Techniques: T1057
Input: APT28 has stored captured credential information in a file named pi.log.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Empire can use PowerSploit's Invoke-TokenManipulation to manipulate access tokens.

Tactics: TA0004, TA0005
Techniques: T1134
Input: Monitor for new rows added in the kext_policy table.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: Monitor for newly constructed network connections that may use Valid Accounts to log into a service specifically designed to accept remote connections, such as RDP, telnet, SSH, and VNC.

Tactics: TA0008
Techniques: T1021
Input: Caterpillar WebShell can upload files over the C2 channel.

Tactics: TA0010
Techniques: T1041
Input: APT41 has enumerated IP addresses of network resources and used the netstat command as part of network reconnaissance.

Tactics: TA0007
Techniques: T1049
Input: Attor's dispatcher can be executed as a service.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: TrickBot gathers the OS version, machine name, CPU type, amount of RAM available, and UEFI/BIOS firmware information from the victim’s machine.

Tactics: TA0007
Techniques: T1082
Input: LiteDuke can wait 30 seconds before executing additional code if security software is detected.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: SILENTTRINITY can use WMI for lateral movement.

Tactics: TA0002
Techniques: T1047
Input: Xbash can attempt to exploit known vulnerabilities in Hadoop, Redis, or ActiveMQ when it finds those services running in order to conduct further execution.

Tactics: TA0002
Techniques: T1203
Input: CaddyWiper has the ability to dynamically resolve and use APIs, including SeTakeOwnershipPrivilege.

Tactics: TA0002
Techniques: T1106
Input: SILENTTRINITY can use PowerShell to execute commands.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Adversaries may employ various means to detect and avoid virtualization and analysis environments.

Tactics: TA0005, TA0007
Techniques: T1497
Input: TRITON disguised itself as the legitimate Triconex Trilog application.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Turian can retrieve system information including OS version, memory usage, local hostname, and system adapter information.

Tactics: TA0007
Techniques: T1082
Input: FIN5 has used legitimate VPN, RDP, Citrix, or VNC credentials to maintain access to a victim environment.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: The OsInfo function in Komplex collects the current running username.

Tactics: TA0007
Techniques: T1033
Input: Disable Hyper-V if not necessary within a given environment.

Tactics: TA0005
Techniques: T1564, T1564.006
Input: Bazar can inject into a target process using process doppelgänging.

Tactics: TA0004, TA0005
Techniques: T1055.013, T1055
Input: Monitor for newly constructed logon behavior across Microsoft's SharePoint which can be configured to report access to certain pages and documents.

Tactics: TA0009
Techniques: T1213, T1213.002
Input: CHOPSTICK is capable of performing remote command execution.

Tactics: TA0002
Techniques: T1059
Input: Lazarus Group has compromised servers to stage malicious tools.

Tactics: TA0042
Techniques: T1584.004, T1584
Input: Bazar has the ability to use an alternative C2 server if the primary server fails.

Tactics: TA0011
Techniques: T1008
Input: Bandook can support commands to execute Python-based payloads.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Monitor newly executed processes that may abuse Windows safe mode to disable endpoint defenses.

Tactics: TA0005
Techniques: T1562.009, T1562
Input: Leafminer scanned network services to search for vulnerabilities in the victim system.

Tactics: TA0007
Techniques: T1046
Input: Dridex has encrypted traffic with RC4.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Turla surveys a system upon check-in to discover remote systems on a local network using the net view and net view /DOMAIN commands.

Tactics: TA0007
Techniques: T1018
Input: SILENTTRINITY can enumerate the active Window during keylogging through execution of GetActiveWindowTitle.

Tactics: TA0007
Techniques: T1010
Input: Bisonal's dropper creates VBS scripts on the victim’s machine.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Unlike DLL Search Order Hijacking, the search order differs depending on the method that is used to execute the program.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.008, T1574
Input: The Local Security Authority (LSA) is the main component responsible for local security policy and user authentication.

Tactics: TA0003, TA0004
Techniques: T1547.008, T1547
Input: Bisonal can check the system time set on the infected host.

Tactics: TA0007
Techniques: T1124
Input: Metamorfo has been delivered to victims via emails with malicious HTML attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: APT38 leveraged Sysmon to understand the processes, services in the organization.

Tactics: TA0007
Techniques: T1057
Input: This data is used by security tools and analysts to generate detections.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: BlackTech has obtained and used tools such as Putty, SNScan, and PsExec for its operations.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: They have also removed malware, tools, or other non-native files used during the intrusion to reduce their footprint or as part of the post-intrusion cleanup process.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: OwaAuth captures and DES-encrypts credentials before writing the username and password to a log file, C:\log.txt.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Catchamas stores the gathered data from the machine in .db files and .bmp files under four separate locations.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: SSL/TLS certificates are designed to instill trust.

Tactics: TA0042
Techniques: T1588.004, T1588, T1587, T1587.003
Input: APT41 has used search order hijacking to execute malicious payloads, such as Winnti RAT.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Metamorfo has deleted itself from the system after execution.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: APT39 has used different versions of Mimikatz to obtain credentials.

Tactics: TA0006
Techniques: T1003
Input: Denis enumerates and collects the username from the victim’s machine.

Tactics: TA0007
Techniques: T1033
Input: SILENTTRINITY can collect information related to a compromised host, including OS version and a list of drives.

Tactics: TA0007
Techniques: T1082
Input: CrackMapExec can discover active IP addresses, along with the machine name, within a targeted network.

Tactics: TA0007
Techniques: T1018
Input: KONNI has sent data and files to its C2 server.

Tactics: TA0010
Techniques: T1041
Input: FinFisher checks its parent process for indications that it is running in a sandbox setup.

Tactics: TA0007
Techniques: T1057
Input: 8 Making a copy of certutil and regsvr32 Certutil.exe (a copy is renamed to certis.exe by the trojan) is normally used in a windows environment to manage certificates, but in this case, it is used by the second stylesheet to download the malware payloads

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Command line invocation of tools capable of modifying the Registry for associated keys are also suspicious.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: ThreatNeedle can save its configuration data as the following RC4-encrypted Registry key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\GameCon.

Tactics: TA0005
Techniques: T1112
Input: Kasidet has the ability to search for a given process name in processes currently running in the system.

Tactics: TA0007
Techniques: T1057
Input: APIs in these environments, such as the Docker API and Kubernetes APIs, allow a user to remotely manage their container resources and cluster components.

Tactics: TA0006
Techniques: T1552, T1552.007
Input: Bundlore changes the permissions of a payload using the command chmod -R 755.

Tactics: TA0005
Techniques: T1222.002, T1222
Input: The module loader can load DLLs via specification of the (fully-qualified or relative) DLL pathname in the IMPORT directory;

Tactics: TA0002
Techniques: T1129
Input: Screen capture and audio recording  SpyNote RAT was able to take screen captures and, using the device’s microphone, listen to audio conversations

Tactics: TA0009
Techniques: T1113, T1123
Input: Windshift has used revoked certificates to sign malware.

Tactics: TA0005
Techniques: T1036, T1036.001
Input: One implementation would be to store a file system in reserved disk space unused by disk structures or standard file system partitions.

Tactics: TA0005
Techniques: T1564, T1564.005
Input: Probably full and active window screenshot quality   captureActiveQC 40   CaptureSites VPN*0,0 Login*0,0 mail*0,0 Security*0,0 Window titles of interest for screenshots, using left mouse button and Enter keypress hook   important upLog.txt upSCRLog.txt upSpecial.txt upFile.txt upMSLog.txt List of files to send to C2 using bitsadmin.exe from the dedicated thread   maxUpFileSizeKByte 1000000 Maximum size of file uploaded to C2   Servers http://108.61.189.174 Control server HTTP URL   ZipPass KtJvOXulgibfiHk Password for uploaded zip archives   browserPasswordCheckTimeout 300000 Milliseconds to wait between gathering key3.db, cookies.sqlite and other browser files in dedicated thread    Most of the parameters are self-explanatory

Tactics: TA0011, TA0010
Techniques: T1041, T1071
Input: POORAIM can enumerate processes.

Tactics: TA0007
Techniques: T1057
Input: Adversaries may abuse mavinject.exe to proxy execution of malicious code.

Tactics: TA0005
Techniques: T1218, T1218.013
Input: RDAT can process steganographic images attached to email messages to send and receive C2 commands.

Tactics: TA0011
Techniques: T1001, T1001.002
Input: POWERSTATS can retrieve IP, network adapter configuration information, and domain from compromised hosts.

Tactics: TA0007
Techniques: T1016
Input: FIN7 has created a scheduled task named "AdobeFlashSync" to establish persistence.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: During post-compromise activity, adversaries may utilize DNS traffic for various tasks, including for Command and Control (ex: Application Layer Protocol).

Tactics: TA0042
Techniques: T1584.002, T1584, T1583, T1583.002
Input: eventvwr.exe can auto-elevate and execute a specified binary or script.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Chimera has exfiltrated stolen data to OneDrive accounts.

Tactics: TA0010
Techniques: T1567.002, T1567
Input: Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as network connections made for Command and Control, learning details about the environment through Discovery, and Lateral Movement.

Tactics: TA0002, TA0003, TA0004, TA0005
Techniques: T1036.004, T1543.003, T1547.004, T1053, T1036, T1547, T1053.003, T1543
Input: DLL side loading has been used to maintain persistence on the compromised system

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: CARROTBALL has the ability to download and install a remote payload.

Tactics: TA0011
Techniques: T1105
Input: SLOTHFULMEDIA can enumerate files and directories.

Tactics: TA0007
Techniques: T1083
Input: By default, these unit files are stored in the /etc/systemd/system and /usr/lib/systemd/system directories and have the file extension .service.

Tactics: TA0003, TA0004
Techniques: T1543.002, T1543
Input: The primary delivered mechaism for Agent Tesla is through email phishing messages.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Kobalos can exfiltrate credentials over the network via UDP.

Tactics: TA0010
Techniques: T1048
Input: Chimera has used Cobalt Strike C2 beacons for data exfiltration.

Tactics: TA0010
Techniques: T1041
Input: Additional information For more information about the attacks and the indicators of compromise, please contact: intelreports@kaspersky.com Alternatively, please visit: https://www.kaspersky.com/enterprise-security/apt-intelligence-reporting To find more information about cybersecurity awareness training for enterprise or government staff, go to Kaspersky Security Awareness

Tactics: TA0007
Techniques: T1082
Input: Internet scanners may be used to look for patterns associated with malicious content designed to collect host information from visitors.Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Tactics: TA0043
Techniques: T1592
Input: Cuba can enumerate local drives, disk type, and disk free space.

Tactics: TA0007
Techniques: T1082
Input: These digital certificates are often issued in the name of rogue and legitimate companies to avoid arousing suspicion from researchers and incident responders

Tactics: TA0005
Techniques: T1036
Input: PipeMon can check for the presence of ESET and Kaspersky security software.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: LazyScripter has used several different security software icons to disguise executables.

Tactics: TA0005
Techniques: T1036
Input: Dragonfly has added newly created accounts to the administrators group to maintain elevated access.

Tactics: TA0003
Techniques: T1098
Input: Octopus can collect system drive information, the computer name, the size of the disk, OS version, and OS architecture information.

Tactics: TA0007
Techniques: T1082
Input: Others incorporate a seed value as well to make predicting future domains more difficult for defenders.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: An example of the content retrieved from Pastebin is given below:       ---- BEGIN SSH2 PUBLIC KEY ----Comment: "rsa-key"AAAAB3NzaC1yc2EAAAABJQAAAQEAhLxZe4Qli9xt/WknQK9CDLWubpgknZ0HIHSd8uV/TJvLsRkjpV+U/tMiMxjDwLAHVtNcww2h8bXTtw387M2Iv/mJjQ9Lv3BdNiM3/KvmlpeJZrrFu2n5UC9=DZKSDAAADOECEDFDOCCDEDIDOCIDEDOCHDDZJS=oT+Ps8wD4f0NBUtDdEdXhWp3nxv/mJjQ9Lv3BCFDBd09UZzLrfBO1S0nxrHsxlJ+bPaJE2Q/oxLXTrpeJ6AHyLyeUaBha3q9niJ=---- END SSH2 PUBLIC KEY ----     At first glanced we missed it, but the paste uses the same technique discussed in this Airbus post

Tactics: TA0006, TA0009, TA0011
Techniques: T1102, T1056
Input: Mivast has the capability to gather NTLM password information.

Tactics: TA0006
Techniques: T1003, T1003.002
Input: Monitor for newly executed processes that are associated with COM objects, especially those invoked by a user different than the one currently logged on.

Tactics: TA0002
Techniques: T1559, T1559.001
Input: Chimera has used direct Windows system calls by leveraging Dumpert.

Tactics: TA0002
Techniques: T1106
Input: A properly configured Web Application Firewall (WAF) may help prevent external adversaries from exploiting Server-side Request Forgery (SSRF) attacks that allow access to the Cloud Instance Metadata API.

Tactics: TA0006
Techniques: T1552, T1552.005
Input: Trojan.Karagany can monitor the titles of open windows to identify specific keywords.

Tactics: TA0007
Techniques: T1010
Input: PROMETHIUM has created admin accounts on a compromised host.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.003
Input: RDAT can also embed data within a BMP image prior to exfiltration.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: Adversaries may stage data collected from multiple systems in a central location or directory on one system prior to Exfiltration.

Tactics: TA0009
Techniques: T1074.002, T1074
Input: Bundlore prompts the user for their credentials.

Tactics: TA0006, TA0009
Techniques: T1056.002, T1056
Input: Anchor has come with a packed payload.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: ProLock can use vssadmin.exe to remove volume shadow copies.

Tactics: TA0040
Techniques: T1490
Input: Penquin can use the command code do_vslist to send file names, size, and status to C2.

Tactics: TA0007
Techniques: T1083
Input: Third-party entities can include technology companies that specialize in exploit development, criminal marketplaces (including exploit kits), or from individuals.

Tactics: TA0042
Techniques: T1588, T1588.005
Input: Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.

Tactics: TA0011
Techniques: T1008
Input: PowerSploit contains a collection of Exfiltration modules that can harvest credentials from Group Policy Preferences.

Tactics: TA0006
Techniques: T1552, T1552.006
Input: Valak has the ability to take screenshots on a compromised host.

Tactics: TA0009
Techniques: T1113
Input: RDAT can download files via DNS.

Tactics: TA0011
Techniques: T1105
Input: PowerSploit's Get-Keystrokes Exfiltration module can log keystrokes.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Tasklist can be used to discover processes running on a system.

Tactics: TA0007
Techniques: T1057
Input: Rifdoor has the ability to identify the IP address of the compromised host.

Tactics: TA0007
Techniques: T1016
Input: Remsec can dump the SAM database.

Tactics: TA0006
Techniques: T1003, T1003.002
Input: PlugX decompresses and decrypts itself using the Microsoft API call RtlDecompressBuffer.

Tactics: TA0005
Techniques: T1140
Input: HAFNIUM has used open-source C2 frameworks, including Covenant.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Leafminer has infected victims using watering holes.

Tactics: TA0001
Techniques: T1189
Input: Waterbear has deleted certain values from the Registry to load a malicious DLL.

Tactics: TA0005
Techniques: T1112
Input: One of the discovered config files contained a URL with an as yet unidentified md5: hxxps://46.165.222(dot)28/upgrade/bf0dac805798cc1f633f19ce8ed6382f/upgrade.php Victim set #4 A set of victims discovered installed Siemens SCADA software in their ICS environment was responsible for downloading and executing BlackEnergy

Tactics: TA0011
Techniques: T1105
Input: In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system.

Tactics: TA0001, TA0008
Techniques: T1091
Input: For example, publicly available scripts such as New-GPOImmediateTask can be leveraged to automate the creation of a malicious Scheduled Task/Job by modifying GPO settings, in this case modifying <GPO_PATH>\Machine\Preferences\ScheduledTasks\ScheduledTasks.xml.

Tactics: TA0004, TA0005
Techniques: T1484.001, T1484
Input: Ramsay can conduct an initial scan for Microsoft Word documents on the local system, removable media, and connected network drives, before tagging and collecting them.

Tactics: TA0009
Techniques: T1119
Input: Valak has returned C2 data as encoded ASCII.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: The configuration data used by the backdoor has the following structure: #pragma pack(push, 1) struct st_cncconfig {   _WORD id;   _BYTE byte2;   _BYTE byte3;   _QWORD pCnCBeg;   _QWORD pCnCEnd;   _QWORD pLastElement; }; #pragma pack(pop) To be able to enter the data into the database, Linux.BackDoor.Fysbis.1 converts the configuration data into the following structure: #pragma pack(push, 1) struct st_crypted_config_data {   _WORD id;   _BYTE byte2;   _BYTE byte3;   char* pCnC;  }; #pragma pack(pop) Before the configuration data is encrypted with the RC4 algorithm, 11 signature bytes are added to the end of the data (11 bytes are stored in the backdoor's body)

Tactics: TA0005, TA0009, TA0010
Techniques: T1140, T1041, T1005, T1027.002, T1027, T1560
Input: (Source: Dell SecureWorks) Appendix D — Domain name parking example CTU researchers have observed TG-3390 parking domains by pointing their A record to a non-routable IP space, including the 127.0.0.[x] loopback address

Tactics: TA0007
Techniques: T1016
Input: ZIRCONIUM has used a tool to query the Registry for proxy settings.

Tactics: TA0007
Techniques: T1012
Input: KOCTOPUS has deployed a modified version of Invoke-Ngrok to expose open local ports to the Internet.

Tactics: TA0011
Techniques: T1090
Input: HiddenWasp installs reboot persistence by adding itself to /etc/rc.local.

Tactics: TA0003, TA0004
Techniques: T1037.004, T1037
Input: Do not reuse local administrator account passwords across systems.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Network protocols that use asymmetric encryption (such as HTTPS/TLS/SSL) often utilize symmetric encryption once keys are exchanged.

Tactics: TA0010
Techniques: T1048.002, T1048
Input: Kobalos has used a compromised SSH client to capture the hostname, port, username and password used to establish an SSH connection from the compromised host.

Tactics: TA0006, TA0009
Techniques: T1056
Input: SideTwist can decode and decrypt messages received from C2.

Tactics: TA0005
Techniques: T1140
Input: Patchwork also executed a script to enumerate all drives, store them as a list, and upload generated files to the C2 server.

Tactics: TA0009
Techniques: T1119
Input: Adversaries may launch a denial of service (DoS) attack targeting an endpoint's operating system (OS).

Tactics: TA0040
Techniques: T1499, T1499.001
Input: Python is a very popular scripting/programming language, with capabilities to perform many functions.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Grandoreiro has named malicious browser extensions and update files to appear legitimate.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Adversaries may exfiltrate data to a code repository rather than over their primary command and control channel.

Tactics: TA0010
Techniques: T1567.001, T1567
Input: ProLock can use WMIC to execute scripts on targeted hosts.

Tactics: TA0002
Techniques: T1047
Input: Amongst the downloaded files,  the fake .gif and .jpg files appear to be dependencies for the malware

Tactics: TA0007, TA0011
Techniques: T1090.003, T1083, T1105, T1090
Input: SLOTHFULMEDIA has sent system information to a C2 server via HTTP and HTTPS POST requests.

Tactics: TA0010
Techniques: T1041
Input: Emissary has the capability to execute the command net start to interact with services.

Tactics: TA0007
Techniques: T1007
Input: Winlogon\Shell - points to explorer.exe, the system shell executed when a user logs on

Tactics: TA0003, TA0004
Techniques: T1547.004, T1547
Input: Maze has used the ChaCha algorithm, based on Salsa20, and an RSA algorithm to encrypt files.

Tactics: TA0040
Techniques: T1486
Input: In addition to this, a MAPI Editor can be utilized to examine the underlying database structure and discover any modifications/tampering of the properties of auto-forwarding rules.

Tactics: TA0009
Techniques: T1114, T1114.003