madox81/Adema_ATTACK_DS huggingface dataset:
Input: Metamorfo has configured persistence to the Registry ket HKCU\Software\Microsoft\Windows\CurrentVersion\Run, Spotify =% APPDATA%\Spotify\Spotify.exe and used .LNK files in the startup folder to achieve persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Turla surveys a system upon check-in to discover operating system configuration details using the systeminfo and set commands.

Tactics: TA0007
Techniques: T1082
Input: This document was a decoy aimed to entice the user to open malicious documents embedded further down the pageThe actor embedded two additional links and the document urged the user to click on these links for more information about New Year's activities in North Korea

Tactics: TA0002
Techniques: T1204
Input: Pupy can send screenshots files, keylogger data, files, and recorded audio back to the C2 server.

Tactics: TA0010
Techniques: T1041
Input: Turla has also retrieved PowerShell payloads hidden in Registry keys as well as checking keys associated with null session named pipes .

Tactics: TA0007
Techniques: T1012
Input: Common uses of shell scripts include long or repetitive tasks, or the need to run the same set of commands on multiple systems.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: Bankshot searches for files on the victim's machine.

Tactics: TA0007
Techniques: T1083
Input: Memory protections may prevent writing executable code to a process via Ptrace System Calls.

Tactics: TA0004, TA0005
Techniques: T1055.014, T1055
Input: Many cloud service providers offer solutions for online data storage such as Amazon S3, Azure Storage, and Google Cloud Storage.

Tactics: TA0009
Techniques: T1530
Input: First, we had not seen the CPU fan check used before, and upon testing the WMI query in a VMware Windows 7 virtual machine we saw no result, as seen in Figure 1  Figure 1 WMI query for the Win32_Fan class on a VM returning no statistics However, when we ran the same query in a physical system running Windows 7, we saw the contents of the Win32_Fan class, as seen in Figure 2

Tactics: TA0002, TA0005, TA0007
Techniques: T1497, T1047
Input: Periodically search for and correct or report path interception weaknesses on systems that may have been introduced using custom or available tools that report software using insecure path configurations.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.007, T1574.008, T1574.009, T1574
Input: Monitor for plist file modification, especially if immediately followed by other suspicious events such as code execution from \~/Library/Scripts or \~/Library/Preferences.

Tactics: TA0005
Techniques: T1647
Input: Cardinal RAT can download and execute additional payloads.

Tactics: TA0011
Techniques: T1105
Input: Monitor executed commands and arguments for actions that are associated with account creation, such as net user or useradd

Tactics: TA0003
Techniques: T1136
Input: HALFBAKED can use WMI queries to gather system information.

Tactics: TA0002
Techniques: T1047
Input: Magic Hound has compromised email credentials in order to steal sensitive data.

Tactics: TA0009
Techniques: T1114
Input: APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit.

Tactics: TA0002
Techniques: T1047
Input: Monitor process API calls to AddPrintProcessor and GetPrintProcessorDirectory.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.012
Input: Lazarus Group has routinely deleted log files on a compromised router, including automatic log deletion through the use of the logrotate utility.

Tactics: TA0005
Techniques: T1070, T1070.003
Input: PipeMon installer can use UAC bypass techniques to install the payload.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Kimsuky can gather a list of all processes running on a victim's machine.

Tactics: TA0007
Techniques: T1057
Input: This behavior may bypass signature validation restrictions and application control solutions that do not account for abuse of this script.

Tactics: TA0005
Techniques: T1216.001, T1216
Input: SSH (22/TCP)

Tactics: TA0006
Techniques: T1110.004, T1110, T1110.001, T1110.003
Input: LiteDuke has used image files to hide its loader component.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: BBSRAT uses GET and POST requests over HTTP or HTTPS for command and control to obtain commands and send ZLIB compressed data back to the C2 server.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: APT32 successfully gained remote access by using pass the ticket.

Tactics: TA0005, TA0008
Techniques: T1550.003, T1550
Input: Shamoon obtains the system time and will only activate if it is greater than a preset date.

Tactics: TA0007
Techniques: T1124
Input: Azorult can collect the machine information, system architecture, the OS version, computer name, Windows product name, the number of CPU cores, video card information, and the system language.

Tactics: TA0007
Techniques: T1082
Input: Keychains can be viewed and edited through the Keychain Access application or using the command-line utility security.

Tactics: TA0006
Techniques: T1555.001, T1555
Input: TA551 has prompted users to enable macros within spearphishing attachments to install malware.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Maze has used WMI to attempt to delete the shadow volumes on a machine, and to connect a virtual machine to the network domain of the victim organization's network.

Tactics: TA0002
Techniques: T1047
Input: Adversaries may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055.004, T1055
Input: Lazarus Group has changed memory protection permissions then overwritten in memory DLL function code with shellcode, which was later executed via KernelCallbackTable hijacking.

Tactics: TA0005
Techniques: T1620
Input: Gazer performs thread execution hijacking to inject its orchestrator into a running thread from a remote process.

Tactics: TA0004, TA0005
Techniques: T1055.003, T1055
Input: Monitor for newly constructed processes and/or command line execution that can be used to remove network share connections via the net.exe process.

Tactics: TA0005
Techniques: T1070, T1070.005
Input: Data could also be concealed within the email messages themselves.

Tactics: TA0011
Techniques: T1071, T1071.003
Input: Brave Prince terminates antimalware processes.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: In containerized environments, this may include an exposed Docker API, Kubernetes API server, kubelet, or web application such as the Kubernetes dashboard.

Tactics: TA0001, TA0003
Techniques: T1133
Input: We believe the actor used a cryptor on the payload, as it obtains a filename and script from within its resources and decodes these resources by multiplying each byte by negative one

Tactics: TA0005
Techniques: T1140
Input: RTM has been delivered via spearphishing attachments disguised as PDF documents.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Keydnap uses a copy of tor2web proxy for HTTPS communications.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: These files have the following metadata: doc.exe (x86): MD5           492a839a3bf9c61b7065589a18c5aa8d Size          12288 bytes Import Hash   9342d18e7d315117f23db7553d59a9d1 doc.exe (x64): MD5           744a17a3bc6dbd535f568ef1e87d8b9a Size          13824 bytes Compile Time  2014-11-19 08:25:45Z Import Hash   2fab77a3ff40e4f6d9b5b7e813c618e4 test.exe: MD5           5c08957f05377004376e6a622406f9aa Size          11264 bytes Compile Time  2014-11-18 10:49:23Z Import Hash   f34d5f2d4577ed6d9ceec516c1f5a744 These payload files also have interesting PDB debug strings

Tactics: TA0005, TA0007, TA0008, TA0011
Techniques: T1550.002, T1090.003, T1083, T1090, T1550
Input: After creating this scheduled task for persistence, the Trojan will begin communicating with its C2 server

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Ryuk has used cmd.exe to create a Registry entry to establish persistence.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: If the <flag> field of the message header is greater than one, the XOR key used to encrypt message bodies is iterated in reverse when encrypting and decrypting messages

Tactics: TA0011
Techniques: T1573
Input: BadPatch establishes a foothold by adding a link to the malware executable in the startup folder.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Dynamic-link libraries (DLLs) that are specified in the AppCertDLLs Registry key under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\ are loaded into every process that calls the ubiquitously used application programming interface (API) functions CreateProcess, CreateProcessAsUser, CreateProcessWithLoginW, CreateProcessWithTokenW, or WinExec.

Tactics: TA0003, TA0004
Techniques: T1546.009, T1546
Input: Bisonal dropped a decoy payload with a .jpg extension that contained a malicious Visual Basic script.

Tactics: TA0005
Techniques: T1036
Input: Maze has decrypted strings and other important information during the encryption process.

Tactics: TA0005
Techniques: T1027
Input: UBoatRAT has used GitHub and a public blog service in Hong Kong for C2 communications.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: CharmPower can send victim data via FTP with credentials hardcoded in the script.

Tactics: TA0010
Techniques: T1048.003, T1048
Input: While this technique employs similar methods to Brute Force, its goal is the identification of content and infrastructure rather than the discovery of valid credentials.

Tactics: TA0043
Techniques: T1595.003, T1595
Input: CosmicDuke searches attached and mounted drives for file extensions and keywords that match a predefined list.

Tactics: TA0007
Techniques: T1083
Input: Flame can record audio using any existing hardware recording devices.

Tactics: TA0009
Techniques: T1123
Input: FakeM C2 traffic attempts to evade detection by resembling data generated by legitimate messenger applications, such as MSN and Yahoo! messengers.

Tactics: TA0011
Techniques: T1001, T1001.003
Input: Winnti for Linux has used ICMP, custom TCP, and UDP in outbound communications.

Tactics: TA0011
Techniques: T1095
Input: A physical second factor key that uses the target login domain as part of the negotiation protocol will prevent session cookie theft through proxy methods.

Tactics: TA0006
Techniques: T1539
Input: HARDRAIN opens the Windows Firewall to modify incoming connections.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: The following run keys are created by default on Windows systems:

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: APT38 has prepended a space to all of their terminal commands to operate without leaving traces in the HISTCONTROL environment.

Tactics: TA0005
Techniques: T1562.003, T1562
Input: Adversaries may acquire credentials from the Windows Credential Manager.

Tactics: TA0006
Techniques: T1555, T1555.004
Input: In this authentication scenario, the user’s public key must be in a special file on the computer running the server that lists which keypairs are allowed to login as that user.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: Monitor for changes made to Windows Registry keys and/or values that may be the result of using a virtual instance to avoid detection.

Tactics: TA0005
Techniques: T1564, T1564.006
Input: Monitor user accounts for new and suspicious device associations, such as those originating from unusual sources, occurring at unusual times, or following a suspicious login.

Tactics: TA0003
Techniques: T1098.005, T1098
Input: A code comparison of hash 12c786c490366727cf7279fc141921d8 with hash 6de6a0df263ecd2d71a92597b2362f2c (from November 28, 2017).  Conclusion We have found what may be an early data-gathering stage for future possible heists from financial organizations in Turkey (and possibly other countries)

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: AppleScripts do not need to call osascript to execute, however.

Tactics: TA0002
Techniques: T1059.002, T1059
Input: Not allowing unsigned applications from being run may also mitigate some risk.

Tactics: TA0004, TA0005
Techniques: T1548.004, T1548
Input: The inline task capability of MSBuild that was introduced in .NET version 4 allows for C# or Visual Basic code to be inserted into an XML project file.

Tactics: TA0005
Techniques: T1127.001, T1127
Input: SHARPSTATS has the ability to identify the domain of the compromised host.

Tactics: TA0007
Techniques: T1016
Input: One of Dtrack can replace the normal flow of a program execution with malicious code.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574
Input: Octopus can collect the username from the victim’s machine.

Tactics: TA0007
Techniques: T1033
Input: Threat Group-3390 actors have split RAR files for exfiltration into parts.

Tactics: TA0010
Techniques: T1030
Input: Adversaries may abuse mavinject.exe to inject malicious DLLs into running processes ( Dynamic-link Library Injection), allowing for arbitrary code execution ( C:\Windows\system32\mavinject.exe PID /INJECTRUNNING PATH_DLL).

Tactics: TA0005
Techniques: T1218, T1218.013
Input: Threat Group-3390 has locally staged encrypted archives for later exfiltration efforts.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Monitor executed commands and arguments that may exfiltrate data, such as sensitive documents, through the use of automated processing after being gathered during Collection

Tactics: TA0010
Techniques: T1020
Input: If the size is 7 bytes or more, the backdoor verifies that the command and control server sent an encoded package

Tactics: TA0011
Techniques: T1132
Input: SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.

Tactics: TA0006
Techniques: T1003, T1003.002, T1003.004, T1003.001
Input: Some variations of ListPlanting may allocate memory in the target process but then use window messages to copy the payload, to avoid the use of the highly monitored WriteProcessMemory function.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.015
Input: In some cases it may be possible to pivot on known pieces of certificate information to uncover other adversary infrastructure.Detection efforts may be focused on related behaviors, such as /techniques/T1071/001 or /techniques/T1573/002.

Tactics: TA0042
Techniques: T1608.003, T1608
Input: Rocke has installed an "init.d" startup script to maintain persistence.

Tactics: TA0003, TA0004
Techniques: T1037
Input: The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (, domain or enterprise administrator) to bypass access controls set within the enterprise.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: Adversaries who steal account API tokens in cloud and containerized environments may be able to access data and perform actions with the permissions of these accounts, which can lead to privilege escalation and further compromise of the environment.

Tactics: TA0006
Techniques: T1528
Input: Micropsia takes screenshots every 90 seconds by calling the Gdi32.BitBlt API.

Tactics: TA0009
Techniques: T1113
Input: Adversaries may also use Masquerading to make XDG autostart entries look as if they are associated with legitimate programs.

Tactics: TA0003, TA0004
Techniques: T1547.013, T1547
Input: Threat intelligence vendors may offer paid feeds or portals that offer more data than what is publicly reported.

Tactics: TA0043
Techniques: T1597, T1597.001
Input: Users may use valid credentials to log into a service specifically designed to accept remote connections, such as telnet, SSH, and RDP.

Tactics: TA0008
Techniques: T1563
Input: Many services are set to run at boot, which can aid in achieving persistence (Create or Modify System Process), but adversaries can also abuse services for one-time or temporary execution.

Tactics: TA0002
Techniques: T1569
Input: Gamaredon Group has tested connectivity between a compromised machine and a C2 server using  Ping with commands such as CSIDL_SYSTEM\cmd.exe /c ping -n 1.

Tactics: TA0007
Techniques: T1016.001, T1016
Input: DarkComet can collect the computer name, RAM used, and operating system version from the victim’s machine.

Tactics: TA0007
Techniques: T1082
Input: Adversaries may abuse time providers to execute DLLs when the system boots.

Tactics: TA0003, TA0004
Techniques: T1547.003, T1547
Input: ZeroT has encrypted its payload with RC4.

Tactics: TA0005
Techniques: T1027
Input: Exaramel for Windows specifies a path to store files scheduled for exfiltration.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: VERMIN can delete files on the victim’s machine.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: NOKKI uses a unique, custom de-obfuscation technique.

Tactics: TA0005
Techniques: T1140
Input: CaddyWiper can modify ACL entries to take ownership of files.

Tactics: TA0005
Techniques: T1222, T1222.001
Input: BlackMould has the ability to download files to the victim's machine.

Tactics: TA0011
Techniques: T1105
Input: If so, access is granted.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.004
Input: PLAINTEE performs the tasklist command to list running processes.

Tactics: TA0007
Techniques: T1057
Input: Additionally, if the cloud environment is connected to a on-premises environment, adversaries may be able to identify services running on non-cloud systems as well.

Tactics: TA0007
Techniques: T1046
Input: SLOWDRIFT collects and sends system information to its C2.

Tactics: TA0007
Techniques: T1082
Input: Octopus can exfiltrate files from the system using a documents collector tool.

Tactics: TA0009
Techniques: T1005
Input: Andariel has attempted to lure victims into enabling malicious macros within email attachments.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Stealth Falcon malware gathers passwords from multiple sources, including Internet Explorer, Firefox, and Chrome.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: The webshell will iterate through the IP list and perform a series of commands for each IP, starting off with using the following command to connect to the remote system: net use [IP address] /user:[domain admin username] [domain admin password] 2>&1 After connecting to the remote system with net use, the webshell will run the following command to obtain a list of user folders: dir /b [IP address]\c$\Users 2>&1 With a list of user folders, the webshell will iterate through the list of users and enumerate all of the files in the following folders: [IP address]\c$\Users\[username]\Desktop [IP address]\c$\Users\[username]\Documents [IP address]\c$\Users\[username]\Downloads The Network Downloader function will gather all the files in these folders and use 7-Zip to compress and archive the files

Tactics: TA0002, TA0007
Techniques: T1033, T1087, T1204, T1016
Input: For example, /var/db/sudo's timestamp can be monitored to see if it falls within the timestamp_timeout range.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: ProLock can use CVE-2019-0859 to escalate privileges on a compromised host.

Tactics: TA0004
Techniques: T1068
Input: Both compression and encryption are done prior to exfiltration, and can be performed using a utility, 3rd party library, or custom method.

Tactics: TA0009
Techniques: T1560
Input: Snapshot of code we used to decrypt TClient’s configuration   Figure 11

Tactics: TA0005
Techniques: T1140
Input: This system configuration file (in.sys) will drop a backdoor installer (UserInstall.exe) then delete itself

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Depending on the environment, it may be unusual for verclsid.exe to have a parent process of a Microsoft Office product.

Tactics: TA0005
Techniques: T1218, T1218.012
Input: APT41 has created services to appear as benign system tools.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: As part of the data reconnaissance phase, Proxysvc grabs the system time to send back to the control server.

Tactics: TA0007
Techniques: T1124
Input: Monitor for SMB traffic on TCP ports 139, 445 and UDP port 137 and WebDAV traffic attempting to exit the network to unknown external systems.If attempts are detected, then investigate endpoint data sources to find the root cause.

Tactics: TA0006
Techniques: T1187
Input: Adversaries can use LKMs and kexts to conduct Persistence and/or Privilege Escalation on a system.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: To support their operations, an adversary may need to take capabilities they developed (Develop Capabilities) or obtained (Obtain Capabilities) and stage them on infrastructure under their control.

Tactics: TA0042
Techniques: T1608
Input: HermeticWiper has the ability to overwrite its own file with random bites.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: APT28 has exfiltrated archives of collected data previously staged on a target's OWA server via HTTPS.

Tactics: TA0010
Techniques: T1048.002, T1048
Input: Monitor for dynamic libraries being loaded.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.004, T1574
Input: HotCroissant has the ability to list the names of all open windows on the infected host.

Tactics: TA0007
Techniques: T1010
Input: Dragonfly has registered domains for targeting intended victims.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: Leviathan has created new social media accounts for targeting efforts.

Tactics: TA0042
Techniques: T1585, T1585.001
Input: Deep Panda has updated and modified its malware, resulting in different hash values that evade detection.

Tactics: TA0005
Techniques: T1027, T1027.005
Input: Ensure containers are not running as root by default.

Tactics: TA0002, TA0004
Techniques: T1609, T1611
Input: This behavior is related to and may take advantage of DLL Search Order Hijacking.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.005, T1574
Input: When this method is used in conjunction with Downgrade System Image, one example of a compromised system command may include changing the output of the command that shows the version of the currently running operating system.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: SID Filtering ensures that any authentication requests over a trust only contain SIDs of security principals from the trusted domain (i.e preventing the trusted domain from claiming a user has membership in groups outside of the domain).

Tactics: TA0004, TA0005
Techniques: T1134.005, T1134
Input: Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp.

Tactics: TA0011
Techniques: T1105
Input: (Source: Dell SecureWorks) Appendix C — OwaAuth web shell analysis OwaAuth is a web shell that is installed as an ISAPI filter on Exchange servers and shares characteristics with the ChinaChopper web shell

Tactics: TA0002, TA0003
Techniques: T1505.003, T1505, T1059
Input: Wizard Spider has used services.exe to execute scripts and executables during lateral movement within a victim network.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: In order to decide which domain xparis() holds, a variable pingadori() uses the radador() function to randomize the domain

Tactics: TA0007
Techniques: T1016
Input: HOPLIGHT has utilized Zlib compression to obfuscate the communications payload.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Threat actors may gather various technical details from purchased data, including but not limited to employee contact information, credentials, or specifics regarding a victim’s infrastructure.

Tactics: TA0043
Techniques: T1597.002, T1597
Input: Pandora can monitor processes on a compromised host.

Tactics: TA0007
Techniques: T1057
Input: Adversaries may gather credentials from information stored in the Proc filesystem or /proc.

Tactics: TA0006
Techniques: T1003, T1003.007