madox81/Adema_ATTACK_DS huggingface dataset:
Input: Monitor for newly constructed network connections that are sent or received by untrusted hosts.

Tactics: TA0001, TA0003, TA0005, TA0009, TA0011, TA0010, TA0040
Techniques: T1189, T1219, T1041, T1572, T1218.005, T1568, T1218, T1102.002, T1114, T1104, T1048.002, T1176, T1205, T1048.003, T1090.001, T1090.003, T1048, T1102.003, T1029, T1218.007, T1205.001, T1114.002, T1090, T1090.002, T1102, T1218.010, T1048.001, T1496, T1221
Input: After unpacking the module, it is packed with an additional inner packer Pe123\RPolyCryptor

Tactics: TA0005
Techniques: T1027.002, T1027
Input: FIN8's malicious spearphishing payloads use WMI to launch malware and spawn cmd.exe execution.

Tactics: TA0002
Techniques: T1047
Input: Rising Sun can delete files specified by the C2.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Obfuscation While the downloader module is not packed, the backdoor is packed with a modified version of UPX

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Empire can use modules that extract passwords from common web browsers such as Firefox and Chrome.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: After selecting a payload URL, the script will create copies of certutil and regsvr32 to the temp directory for later use

Tactics: TA0005
Techniques: T1218, T1218.010
Input: For more information see "README-FOR-DECRYPT.txt".

Tactics: TA0040
Techniques: T1491.001, T1491
Input: CosmicDuke collects Windows account hashes.

Tactics: TA0006
Techniques: T1003, T1003.002
Input: For example, tech support scams can be facilitated through Phishing, vishing, or various forms of user interaction.

Tactics: TA0002
Techniques: T1204
Input: These AppleEvent messages can be sent independently or easily scripted with AppleScript.

Tactics: TA0002
Techniques: T1059.002, T1059
Input: POORAIM has used AOL Instant Messenger for C2.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: Adversaries may gain access to an email account for the person listed as the owner of the domain.

Tactics: TA0042
Techniques: T1584.001, T1584
Input: This can lead to the execution of malicious code, such as code that executes cryptocurrency mining, in the instance or container.

Tactics: TA0002
Techniques: T1204.003, T1204
Input: Monitor for changes made to windows registry keys and/or values that may abuse system services or daemons to execute commands or programs.

Tactics: TA0002
Techniques: T1569
Input: Adversaries may disable or delete system recovery features to augment the effects of Data Destruction and Data Encrypted for Impact.

Tactics: TA0040
Techniques: T1490
Input: To maximize impact on the target organization, malware designed for destroying disk structures may have worm-like features to propagate across a network by leveraging other techniques like Valid Accounts, OS Credential Dumping, and SMB/Windows Admin Shares.

Tactics: TA0040
Techniques: T1561, T1561.002
Input: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation.

Tactics: TA0009
Techniques: T1113
Input: menuPass has used InstallUtil.exe to execute malicious software.

Tactics: TA0005
Techniques: T1218, T1218.004
Input: The malware utilizes several persistence mechanisms including scheduled tasks, Userinit and Run registry keys in the HKLM hive

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1547.001, T1053, T1547
Input: LazyScripter has hosted open-source remote access Trojans used in its operations in GitHub.

Tactics: TA0042
Techniques: T1608.001, T1608
Input: Nebulae can use TCP in C2 communications.

Tactics: TA0011
Techniques: T1095
Input: Adversaries may use a Login Hook to establish persistence executed upon user logon.

Tactics: TA0003, TA0004
Techniques: T1037.002, T1037
Input: In cloud environments, adversaries may leverage access to delete cloud storage, cloud storage accounts, machine images, and other infrastructure crucial to operations to damage an organization or their customers.

Tactics: TA0040
Techniques: T1485
Input: Figure 1: Malicious FIN7 lure asking victim to double click to unlock contents The malicious LNK launches “mshta.exe” with the following arguments passed to it: vbscript:Execute("On Error Resume Next:set w=GetObject(,""Word.Application""):execute w.ActiveDocument.Shapes(2).TextFrame.TextRange.Text:close") The script in the argument combines all the textbox contents in the document and executes them, as seen in Figure 2

Tactics: TA0002
Techniques: T1204
Input: Gelsemium can use a batch script to delete itself.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Skidmap has the ability to install several loadable kernel modules (LKMs) on infected machines.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: The group clearly shows a preference for using a simple downloader like Zebrocy as first-stage payloads in these attacks

Tactics: TA0005
Techniques: T1027
Input: Seasalt has masqueraded as a service called "SaSaut" with a display name of "System Authorization Service" in an apparent attempt to masquerade as a legitimate service.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Signatures are often for unique indicators within protocols and may be based on the specific obfuscation technique used by a particular adversary or tool, and will likely be different across various malware families and versions.

Tactics: TA0008, TA0011, TA0010
Techniques: T1041, T1132.001, T1132, T1029, T1105, T1570, T1132.002
Input: RedLeaves can receive and execute commands with cmd.exe.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: The command log show --info --predicate 'process = "ssh" or eventMessage contains "ssh"' can be used to review outgoing SSH connection activity.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: The RIPTIDE exploit document drops its executable file into the C:\Documents and Settings\{user}\Application Data\Location folder while the HIGHTIDE exploit document drops its executable file into the C:\DOCUMENTS and SETTINGS\{user}\LOCAL SETTINGS\Temp\ folder

Tactics: TA0009
Techniques: T1005
Input: AppleSeed has the ability to Base64 encode its payload and custom encrypt API calls.

Tactics: TA0005
Techniques: T1027
Input: TrickBot has used Nt* Native API functions to inject code into legitimate processes such as wermgr.exe.

Tactics: TA0004, TA0005
Techniques: T1055
Input: A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Gelsemium has the ability to inject DLLs into specific processes.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Cobalt Group used a JavaScript backdoor that is capable of collecting a list of the security solutions installed on the victim's machine.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Upon execution, this Trojan checks to see if it was configured with “BINDERON” to determine if it should extract an embedded payload from a resource named “B”, save it to %TEMP%\%BIND1%, and create a new process with the embedded payload

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: Consider packet inspection for Wake-on-LAN magic packet consists of 6 bytes of FF followed by sixteen repetitions of the target system's IEEE address.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205
Input: HyperStack can enumerate all account names on a remote share.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: In some of the worst cases for distributed DoS (DDoS), so many systems are used to generate the flood that each one only needs to send out a small amount of traffic to produce enough volume to saturate the target network.

Tactics: TA0040
Techniques: T1498, T1498.001
Input: Kazuar has used compromised WordPress blogs as C2 servers.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: There are various sources of data an adversary could use to infer system language, such as system defaults and keyboard layouts.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: Threat Group-3390 has used e-mail to deliver malicious attachments to victims.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: JHUHUGIT is executed using rundll32.exe.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Monitor newly constructed files that may establish persistence by executing malicious content triggered by user inactivity.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.002
Input: Bisonal has been modified to be used as a Windows service.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: CoinTicker executes a bash script to establish a reverse shell.

Tactics: TA0002
Techniques: T1059.003, T1059.004, T1059
Input: The code will gather the information and format the list using the following HTML to create a table: <table> <tr><td>Type</td><td>Owner</td><td>Permissions</td><td>Created</td><td>Modificated</td><td>Size</td><td>Path</td></tr> <tr><td>[fileType]</td><td>[fileOwnerAccountName]</td><td>[number filePosixPermissions]</td><td>[fileCreationDate]</td><td>[fileModificationDate]</td><td>[fileSize]</td><td>[file path?]</td></tr> … </table>    Table 1 Commands available within XAgent OSX The ‘showBackupIosFolder’ command is rather interesting, as it allows the threat actors to determine if a compromised system was used to backup an IOS device, such as an iPhone or iPad

Tactics: TA0007
Techniques: T1016
Input: Trojan.Karagany can gather information on the network configuration of a compromised host.

Tactics: TA0007
Techniques: T1016
Input: Chrommme has the ability to capture screenshots.

Tactics: TA0009
Techniques: T1113
Input: Sandworm Team has collected the username from a compromised host.

Tactics: TA0007
Techniques: T1033
Input: jRAT can browse file systems.

Tactics: TA0007
Techniques: T1083
Input: Dragonfly has used spearphishing with Microsoft Office attachments to enable harvesting of user credentials.

Tactics: TA0043
Techniques: T1598.002, T1598
Input: APT32 has attempted to lure users to execute a malicious dropper delivered via a spearphishing attachment.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: WellMess can execute command line scripts received from C2.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Monitor for newly constructed processes and/or command-lines that can interact with the DACLs using built-in Windows commands, such as icacls, cacls, takeown, and attrib, which can grant adversaries higher permissions on specific files and folders.

Tactics: TA0005
Techniques: T1222, T1222.001
Input: WellMail can identify the current username on the victim system.

Tactics: TA0007
Techniques: T1033
Input: Active Setup is a Windows mechanism that is used to execute programs when a user logs in.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.014
Input: Monitor for unexpected processes interacting with lsass.exe.

Tactics: TA0006, TA0007
Techniques: T1033, T1003, T1558
Input: Night Dragon has dumped account hashes with Carbanak and cracked them with Cain & Abel.

Tactics: TA0006
Techniques: T1003, T1003.002
Input: menuPass has used dynamic DNS service providers to host malicious domains.

Tactics: TA0011
Techniques: T1568.001, T1568
Input: Patchwork payloads download additional files from the C2 server.

Tactics: TA0011
Techniques: T1105
Input: VERMIN is obfuscated using the obfuscation tool called ConfuserEx.

Tactics: TA0005
Techniques: T1027
Input: cron permissions are controlled by /etc/cron.allow and /etc/cron.deny.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may abuse Microsoft Outlook forms to obtain persistence on a compromised system.

Tactics: TA0003
Techniques: T1137, T1137.003
Input: The Sysinternals Sigcheck utility can also be used (sigcheck.exe -tuv) to dump the contents of the certificate store and list valid certificates not rooted to the Microsoft Certificate Trust List.

Tactics: TA0005
Techniques: T1553, T1553.004
Input: More_eggs can obtain information on installed anti-malware programs.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.003
Input: It also uses AES128-CBC encrypted blobs for SUNBURST source code and data extracted from the SolarWinds Orion <MsBuild.exe process.

Tactics: TA0005
Techniques: T1027
Input: The net user username \password commands in Net can be used to create a local account.

Tactics: TA0003
Techniques: T1136, T1136.001
Input: SLOTHFULMEDIA has the capability to start services.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: It then calls the subfunction with the argument of 2 to get the string that it will use as the HTTP POST request

Tactics: TA0011
Techniques: T1071
Input: Azorult can collect host IP information from the victim’s machine.

Tactics: TA0007
Techniques: T1016
Input: Night Dragon is known to use software packing in its tools.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: ZIRCONIUM has used malicious links in e-mails to lure victims into downloading malware.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Consider enforcing multi-factor authentication for the CreateKeyPair and ImportKeyPair API calls through IAM policies.

Tactics: TA0003
Techniques: T1098.001, T1098
Input: Cobalt Strike can download a hosted "beacon" payload using BITSAdmin.

Tactics: TA0003, TA0005
Techniques: T1197
Input: QakBot has gained execution through users opening malicious links.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: After encrypting its own log files, the log encryption module in Prikormka deletes the original, unencrypted files from the host.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: An APT3 downloader creates persistence by creating the following scheduled task: schtasks /create /tn "mysc" /tr C:\Users\Public\test.exe /sc ONLOGON /ru "System".

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: MechaFlounder has the ability to use base16 encoded strings in C2.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: OceanSalt can collect the computer name from the system.

Tactics: TA0007
Techniques: T1082
Input: WarzoneRAT  can perform COM hijacking by setting the path to itself to the HKCU\Software\Classes\Folder\shell\open\command key with a DelegateExecute parameter.

Tactics: TA0003, TA0004
Techniques: T1546.015, T1546
Input: Autostart entry files not associated with legitimate packages may be considered suspicious.

Tactics: TA0003, TA0004
Techniques: T1547.013, T1547
Input: These scripts can vary based on operating system and whether applied locally or remotely.

Tactics: TA0003, TA0004
Techniques: T1037
Input: Bazar can identify administrator accounts on an infected host.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Koadic has used PowerShell to establish persistence.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Aria-body has the ability to capture screenshots on compromised hosts.

Tactics: TA0009
Techniques: T1113
Input: Kimsuky has lured victims into clicking malicious links.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Adversaries may steal data by exfiltrating it over an existing command and control channel.

Tactics: TA0010
Techniques: T1041
Input: Lazarus Group has used administrator credentials to gain access to restricted network segments.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: ZxShell has a command called RunAs, which creates a new process as another user or process context.

Tactics: TA0004, TA0005
Techniques: T1134.002, T1134
Input: Operation Wocao has used valid VPN credentials to gain initial access.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: GALLIUM used a modified version of HTRAN to redirect connections between networks.

Tactics: TA0011
Techniques: T1090, T1090.002
Input: Umbreon provides access to the system via SSH or any other protocol that uses PAM to authenticate.

Tactics: TA0011
Techniques: T1095
Input: ZIRCONIUM has used GitHub to host malware linked in spearphishing e-mails.

Tactics: TA0042
Techniques: T1583.006, T1583
Input: The systemd service manager is commonly used for managing background daemon processes (also known as services) and other system resources.

Tactics: TA0003, TA0004
Techniques: T1543.002, T1543
Input: HOPLIGHT has connected outbound over TCP port 443 with a FakeTLS method.

Tactics: TA0011
Techniques: T1571
Input: The sethc.exe program is often referred to as "sticky keys", and has been used by adversaries for unauthenticated access through a remote desktop login screen.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding events.

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: Magic Hound malware has used HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: These solutions differ from other storage solutions (such as SQL or Elasticsearch) in that there is no overarching application.

Tactics: TA0009
Techniques: T1530
Input: Adversaries with no prior knowledge of legitimate credentials within the system or environment may guess passwords to attempt access to accounts.

Tactics: TA0006
Techniques: T1110, T1110.001
Input: Monitor API calls that could collect data stored in the clipboard from users copying information within or between applications.

Tactics: TA0009
Techniques: T1115
Input: Janicab used a valid AppleDeveloperID to sign the code to get past security restrictions.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: APT29 used fsutil to check available free space before executing actions that might create large files on disk.

Tactics: TA0007
Techniques: T1082
Input: Winlogon\Userinit - points to userinit.exe, the user initialization program executed when a user logs on

Tactics: TA0003, TA0004
Techniques: T1547.004, T1547
Input: Tropic Trooper has used base64 encoding to hide command strings delivered from the C2.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: KGH_SPY has used encrypted strings in its installer.

Tactics: TA0005
Techniques: T1027
Input: Sample(s) f1b2bc0831445903c0d51b390b1987597009cc0fade009e07d792e8d455f6db0 5cc62ad6baf572dbae925f701526310778f032bb4a54b205bada78b1eb8c479c   DNS tbs1/tbs2.microsoftonline.services   Domains 0ffice365[.]agency    0ffice365[.]life    0ffice365[.]services    0nedrive[.]agency    corewindows[.]agency    microsoftonline[.]agency    onedrive[.]agency    sharepoint[.]agency    skydrive[.]agency    skydrive[.]services   Sample eb33a96726a34dd60b053d3d1048137dffb1bba68a1ad6f56d33f5d6efb12b97   DNS tvs1/tvs2.trafficmanager.live   Domains akamaiedge[.]live     akamaized[.]live     akdns[.]live     edgekey[.]live    Table 7: Sample and Domain Associations The third cluster of domains had six different nameservers associated with them, but unlike the other two clusters, were all directly tied to each other

Tactics: TA0003, TA0004, TA0007
Techniques: T1007, T1543.003, T1543
Input: Astaroth can be loaded through regsvr32.exe.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Kimsuky has checked for the presence of antivirus software with powershell Get-CimInstance -Namespace root/securityCenter2 – classname antivirusproduct.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: The plist file is located in the /Library/Preferences/com.apple.loginwindow.plist file and can be modified using the defaults command-line utility.

Tactics: TA0003, TA0004
Techniques: T1037.002, T1037
Input: Torisma has used various Windows API calls.

Tactics: TA0002
Techniques: T1106
Input: The group also searched a compromised DCCC computer for specific terms.

Tactics: TA0007
Techniques: T1083
Input: The dropper installs 2 files:netwf.bat : executes netwf.dllnetwf.dll : the payloadThe dropper implements 2 persistence mechanisms:HKCU\Environment\UserInitMprLogonScript to execute the netwf.bat fileCOM Object hijack of the following CLSID: {BCDE0395-E52F-467C-8E3D-C4579291692E}, the CLSID of the class MMDeviceEnumerator.These 2 techniques have also been previously used by this actor.Finally the payload is executed by rundll32.exe (and the ordinal #1 in argument) or by explorer.exe if the COM Object hijack is performed

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Dtrack can retrieve browser history.

Tactics: TA0007
Techniques: T1217
Input: Flame can take regular screenshots when certain applications are open that are sent to the command and control server.

Tactics: TA0009
Techniques: T1113
Input: Check the integrity of the existing BIOS and device firmware to determine if it is vulnerable to modification.

Tactics: TA0040
Techniques: T1495
Input: TYPEFRAME can delete files off the system.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Monitor modifications to Registry data associated with enabling safe mode.

Tactics: TA0005
Techniques: T1562.009, T1562
Input: Bundlore has also used base64 and RC4 with a hardcoded key to deobfuscate data.

Tactics: TA0005
Techniques: T1140
Input: PLEAD has the ability to execute shell commands on the compromised host.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: APT38 has identified primary users, currently logged in users, sets of users that commonly use a system, or inactive users.

Tactics: TA0007
Techniques: T1033
Input: Carbanak installs VNC server software that executes through rundll32.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Adversaries may also steal certificate materials directly from a compromised third-party, including from certificate authorities.

Tactics: TA0042
Techniques: T1588.004, T1588
Input: As a result of all these steps, the last-stage Trojan is injected into svchost.exe’s process memory

Tactics: TA0004, TA0005
Techniques: T1055
Input: Night Dragon has used compromised VPN accounts to gain access to victim systems.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1133
Input: Access to these APIs are often over HTTPS, which gives the adversary an additional level of protection.

Tactics: TA0010
Techniques: T1567.001, T1567
Input: Emissary has the capability to create a remote shell and execute specified commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: All protocols use their standard assigned ports.

Tactics: TA0011
Techniques: T1572, T1071.004, T1071, T1071.001
Input: DEL-TEMP Deletes all files in the “AppData/Local/Temp” path

Tactics: TA0005
Techniques: T1070, T1070.004
Input: HKEY_CLASSES_ROOT\txtfile\shell\printto\command

Tactics: TA0003, TA0004
Techniques: T1546, T1546.001
Input: Comnie runs the command: net start >> %TEMP%\info.dat on a victim.

Tactics: TA0007
Techniques: T1007
Input: Ryuk has been observed to query the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language and the value InstallLanguage.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: TeamTNT has used batch scripts to download tools and executing cryptocurrency miners.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: FIVEHANDS has the ability to enumerate files on a compromised host in order to encrypt files with specific extensions.

Tactics: TA0007
Techniques: T1083
Input: LoJax has modified the Registry key ‘HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\BootExecute’ from ‘autocheck autochk ’ to ‘autocheck autoche ’.

Tactics: TA0005
Techniques: T1112
Input: This activity may be used to collect and/or relay data such as credentials, especially those sent over an insecure, unencrypted protocol.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.002
Input: Kimsuky has used a modified TeamViewer client as a command and control channel.

Tactics: TA0011
Techniques: T1219
Input: Shamoon can also spread via PsExec.

Tactics: TA0002
Techniques: T1569.002, T1569