madox81/Adema_ATTACK_DS huggingface dataset:
Input: The config files within BE2 contained the settings of the company’s internal web proxy:  BE2 config file contains victim’s internal proxy As the APT-specific BE2 now stores the downloaded plugins in encrypted files on the system (not seen in older versions – all plugins were only in-memory), the administrators were able to collect BE2 files from the infected machines

Tactics: TA0005, TA0009, TA0011
Techniques: T1070, T1005, T1105, T1090, T1070.004, T1074
Input: For efficiency, many protocols (including SSL/TLS) use symmetric cryptography once a connection is established, but use asymmetric cryptography to establish or transmit a key.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Adversaries may enumerate browser bookmarks to learn more about compromised hosts.

Tactics: TA0007
Techniques: T1217
Input: Systemd service unit files may be detected by auditing file creation and modification events within the /etc/systemd/system, /usr/lib/systemd/system/, and /home//.config/systemd/user/ directories, as well as associated symbolic links

Tactics: TA0003, TA0004
Techniques: T1543.002, T1543
Input: In an enterprise environment, servers and workstations can be organized into domains.

Tactics: TA0008
Techniques: T1021
Input: One of these domains, facebook-apps[.]com, was identified in one of the malware samples associated with this IP address

Tactics: TA0007
Techniques: T1016
Input: Rocke installed a cron job that downloaded and executed files from the C2.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: Tomiris can upload files matching a hardcoded set of extensions, such as .doc, .docx, .pdf, and .rar, to its C2 server.

Tactics: TA0010
Techniques: T1041
Input: Rocke has used Pastebin to check the version of beaconing malware and redirect to another Pastebin hosting updated malware.

Tactics: TA0011
Techniques: T1102.001, T1102
Input: The emond service will not launch if there is no file present in the QueueDirectories path /private/var/db/emondClients, specified in the Launch Daemon configuration file at/System/Library/LaunchDaemons/com.apple.emond.plist.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.014
Input: Enforce authentication and role-based access control on the container service to restrict users to the least privileges required.

Tactics: TA0002
Techniques: T1609
Input: APT29 has added credentials to OAuth Applications and Service Principals.

Tactics: TA0003
Techniques: T1098.001, T1098
Input: Adversaries may gather this information in various ways, such as direct collection actions via Active Scanning (ex: listening ports, server banners, user agent strings) or Phishing for Information.

Tactics: TA0043
Techniques: T1592, T1592.002, T1592.004
Input: More generally, adversaries can conduct non-targeted phishing, such as in mass malware spam campaigns.

Tactics: TA0001
Techniques: T1566
Input: After initial installation, Raindrop runs a computation to delay execution.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: RDAT can also delete itself from the infected system.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: ECCENTRICBANDWAGON can capture screenshots and store them locally.

Tactics: TA0009
Techniques: T1113
Input: Since v13.52, Autoruns can detect tasks set up using the Office Test Registry key.

Tactics: TA0003
Techniques: T1137.002, T1137
Input: Lucifer has attempted to brute force TCP ports 135 (RPC) and 1433 (MSSQL) with the default username or list of usernames and passwords.

Tactics: TA0006
Techniques: T1110, T1110.001
Input: WhisperGate can download additional stages of malware from a Discord CDN channel.

Tactics: TA0011
Techniques: T1105
Input: Monitor executed commands and arguments to bypass security restrictions that limit the use of command-line interpreters.

Tactics: TA0005
Techniques: T1202
Input: APT38 used a backdoor, QUICKRIDE, to communicate to the C2 server over HTTP and HTTPS.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: This spawns the hidden embedded malicious LNK file in the document

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Gamaredon Group has used obfuscated PowerShell scripts for staging.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Monitor for unexpected/abnormal file accesses to removable media (optical disk drive, USB memory, ) connected to the compromised system.

Tactics: TA0009
Techniques: T1025
Input: The C2 communications begins with a beacon to the following URL: hxxp://www.windowspatch[.]com/khc?<hex(STDOUT of whoami command)> If the C2 server wishes to send a command, it will respond to the beacon above by echoing the whoami command results sent by the Trojan to the C2 in the URL

Tactics: TA0007, TA0011
Techniques: T1033, T1571, T1008
Input: BitPaymer has used RC4-encrypted strings and string hashes to avoid identifiable strings within the binary.

Tactics: TA0005
Techniques: T1027
Input: Vasport creates a backdoor by making a connection using a HTTP POST.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: WastedLocker has performed DLL hijacking before execution.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: For example, APT32 installed one backdoor as a persistent service with a legitimate service name that had a Unicode no-break space character appended to it

Tactics: TA0005
Techniques: T1036
Input: SDBbot has the ability to determine the domain name and whether a proxy is configured on a compromised host.

Tactics: TA0007
Techniques: T1016
Input: Otherwise, the Server will respond with a command followed by a set of parameters, split up by the delimiter <>:[command]<>[parameters for command in hexadecimal format] The available commands are: Command Description 1 Run command 2 Upload a file 3 Download a specified file   The parameters for each command are issued in hexadecimal format

Tactics: TA0002, TA0005, TA0007, TA0011
Techniques: T1070, T1070.006, T1105, T1016, T1059
Input: Carbon has used RSA encryption for C2 communications.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Lazarus Group used SSH and the PuTTy PSCP utility to gain access to a restricted segment of a compromised network.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: XTunnel is capable of accessing locally stored passwords on victims.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: When the shell exits or terminates, additional shell scripts are executed to ensure the shell exits appropriately.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: KGH_SPY has the ability to set the HKCU\Environment\UserInitMprLogonScript Registry key to execute logon scripts.

Tactics: TA0003, TA0004
Techniques: T1037.001, T1037
Input: Machete has used TLS-encrypted FTP to exfiltrate data.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: The method an adversary may use depends on which Display Manager the distribution is currently using.

Tactics: TA0005
Techniques: T1564.002, T1564
Input: GoldenSpy has used the Ryeol HTTP Client to facilitate HTTP internet communication.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: PowerDuke has commands to get the time the machine was built, the time, and the time zone.

Tactics: TA0007
Techniques: T1124
Input: LitePower can determine if the current user has admin privileges.

Tactics: TA0007
Techniques: T1033
Input: FIN6 has collected and exfiltrated payment card data from compromised systems.

Tactics: TA0009
Techniques: T1005
Input: APT29 has accessed victims’ internal knowledge repositories (wikis) to view sensitive corporate information on products, services, and internal business operations.

Tactics: TA0009
Techniques: T1213
Input: Prikormka contains a module that collects documents with certain extensions from removable media or fixed drives connected via USB.

Tactics: TA0009
Techniques: T1025
Input: Rover automatically searches for files on local drives based on a predefined list of file extensions and sends them to the command and control server every 60 minutes.

Tactics: TA0010
Techniques: T1020
Input: Helminth establishes persistence by creating a shortcut in the Start Menu folder.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: WarzoneRAT can add itself to the HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UIF2IS20VK Registry keys.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Denis used the IsDebuggerPresent, OutputDebugString, and SetLastError APIs to avoid debugging.

Tactics: TA0002
Techniques: T1106
Input: BlackTech has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities CVE-2012-0158, CVE-2014-6352, CVE-2017-0199, and Adobe Flash CVE-2015-5119.

Tactics: TA0002
Techniques: T1203
Input: Mimikatz's kerberos module can create silver tickets.

Tactics: TA0006
Techniques: T1558.002, T1558
Input: Enable AES Kerberos encryption (or another stronger encryption algorithm), rather than RC4, where possible.

Tactics: TA0006
Techniques: T1558.003, T1558.002, T1558
Input: Example packers are MPRESS and UPX.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface.

Tactics: TA0007
Techniques: T1012
Input: Ensure proper process and file permissions are in place to prevent adversaries from disabling or interfering with security/logging services.

Tactics: TA0005
Techniques: T1562
Input: If Irdsnhrxxxfery64 is loaded using regsvr32.exe, it will target three processes:   It will target unins000.exe if it is available

Tactics: TA0005
Techniques: T1218, T1218.010
Input: VERMIN can download and upload files to the victim's machine.

Tactics: TA0011
Techniques: T1105
Input: Sys10 collects the local IP address of the victim and sends it to the C2.

Tactics: TA0007
Techniques: T1016
Input: Bisonal can execute ipconfig on the victim’s machine.

Tactics: TA0007
Techniques: T1016
Input: PowerShell scripts that perform system reconnaissance and credential theft from Windows Credential Manager and then send this information back to Waterbug C& Cs.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: pngdowner deletes content from C2 communications that was saved to the user's temporary directory.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Donut can erase file references to payloads in-memory after being reflectively loaded and executed.

Tactics: TA0005
Techniques: T1070
Input: One persistence mechanism used by CozyCar is to register itself as a scheduled task.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Table 2 Sandbox evasion checks in the C# variant of RogueRobin Like the original version, the C# variant of RogueRobin uses DNS tunneling to communicate with its C2 server using a variety of different DNS query types

Tactics: TA0011
Techniques: T1071
Input: HotCroissant has the ability to download files from the infected host to the command and control (C2) server.

Tactics: TA0010
Techniques: T1041
Input: References to various COM objects are stored in the Registry.

Tactics: TA0003, TA0004
Techniques: T1546.015, T1546
Input: Limit the usage of local administrator and domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries.

Tactics: TA0005
Techniques: T1553, T1553.006
Input: It allows a user to log into an interactive session with a system desktop graphical user interface on a remote system.

Tactics: TA0008
Techniques: T1563.002, T1021.001, T1021, T1563
Input: BITS runs as a service and its status can be checked with the Sc query utility (sc query bits).

Tactics: TA0003, TA0005
Techniques: T1197
Input: APT39 has communicated with C2 through files uploaded to and downloaded from DropBox.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: Consider disabling the AlwaysInstallElevated policy to prevent elevated execution of Windows Installer packages.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: 4H RAT uses HTTP for command and control.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Monitor for processes being viewed that may inject portable executables (PE) into processes in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055.002, T1055
Input: A Night Dragon DLL included an XOR-encoded section.

Tactics: TA0005
Techniques: T1027
Input: Code repositories are tools/services that store source code and automate software builds.

Tactics: TA0009
Techniques: T1213, T1213.003
Input: Gamaredon Group has obfuscated .NET executables by inserting junk code.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes.

Tactics: TA0001, TA0008
Techniques: T1091
Input: Shamoon scans the C-class subnet of the IPs on the victim's interfaces.

Tactics: TA0007
Techniques: T1018
Input: HotCroissant has the ability to list running processes on the infected host.

Tactics: TA0007
Techniques: T1057
Input: MuddyWater has stored obfuscated JavaScript code in an image file named temp.jpg.

Tactics: TA0005
Techniques: T1027.003, T1027
Input: Ability to disable Microsoft Office Protected View (as shown in Figure 15) by setting the following keys in the Windows Registry: DisableAttachmentsInPV DisableInternetFilesInPV DisableUnsafeLocationsInPV       Figure 15: Disabling Microsoft Office Protected View  Ability to remotely reboot or shut down or clean the system based on the command received from the C2 server, as shown in Figure 16

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Tools can be used for malicious purposes by an adversary, but (unlike malware) were not intended to be used for those purposes (ex: PsExec).

Tactics: TA0042
Techniques: T1608, T1608.002
Input: Manipulation of software update/distribution mechanisms

Tactics: TA0001
Techniques: T1195
Input: Final1stspy creates a Registry Run key to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: PoetRAT has the ability to copy files and download/upload files into C2 channels using FTP and HTTPS.

Tactics: TA0011
Techniques: T1105
Input: Monitor the AppInit_DLLs Registry values for modifications that do not correlate with known software, patch cycles,

Tactics: TA0003, TA0004
Techniques: T1546, T1546.010
Input: It specifically enumerates processes for Wireshark and Sysinternals.

Tactics: TA0007
Techniques: T1057
Input: Smoke Loader searches for files named logins.json to parse for credentials.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: Monitor for newly executed processes that may attempt to get a listing of open application windows.

Tactics: TA0007
Techniques: T1010
Input: Adversaries may also seek and target DNS misconfigurations/leaks that reveal information about internal networks.

Tactics: TA0043
Techniques: T1596, T1596.001
Input: Rocke used malware to download additional malicious files to the target system.

Tactics: TA0011
Techniques: T1105
Input: Lazarus Group has used VBA and embedded macros in Word documents to execute malicious code.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: RTM can detect if it is running within a sandbox or other virtualized analysis environment.

Tactics: TA0005, TA0007
Techniques: T1497
Input: POSHSPY appends a file signature header (randomly selected from six file types) to encrypted data prior to upload or download.

Tactics: TA0005
Techniques: T1027
Input: Monitor newly executed processs for sdbinst.exe for potential indications of application shim abuse.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: Kivars has the ability to download and execute files.

Tactics: TA0011
Techniques: T1105
Input: KOCTOPUS can delete created registry keys as part of its cleanup procedure.

Tactics: TA0005
Techniques: T1070
Input: SMOKEDHAM has used the systeminfo command on a compromised host.

Tactics: TA0007
Techniques: T1082
Input: Displayed below are these new, xml formatted plugin names “weap_hwi”, “ps”, and “vsnet” in a BlackEnergy configuration file download from a c2 server

Tactics: TA0011
Techniques: T1105
Input: Adversaries may abuse PowerShell commands and scripts for execution.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: MuddyWater has used the .NET csc.exe tool to compile executables from downloaded C# code.

Tactics: TA0005
Techniques: T1027.004, T1027
Input: For ease of use, Control Panel items typically include graphical menus available to users after being registered and loaded into the Control Panel.

Tactics: TA0005
Techniques: T1218, T1218.002
Input: However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.

Tactics: TA0003
Techniques: T1098
Input: Additionally, it searches for the ".vnc.lnk" affix to steal VNC credentials.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: Administrators may also create forwarding rules for user accounts with the same considerations and outcomes.

Tactics: TA0009
Techniques: T1114, T1114.003
Input: Processes can be created with the token and resulting security context of another user using features such as CreateProcessWithTokenW and runas.

Tactics: TA0004, TA0005
Techniques: T1134.002, T1134
Input: Enforce the principle of least privilege by limiting privileges of user accounts so only authorized accounts can modify the web directory.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Adversaries may abuse the right-to-left override (RTLO or RLO) character (U+202E) to disguise a string and/or file name to make it appear benign.

Tactics: TA0005
Techniques: T1036, T1036.002
Input: Wizard Spider has exfiltrated domain credentials and network enumeration information over command and control (C2) channels.

Tactics: TA0010
Techniques: T1041
Input: Files have been encrypted with their own AES key and given a file extension of .RYK.

Tactics: TA0040
Techniques: T1486
Input: AppleSeed has been distributed to victims through malicious e-mail attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: BRONZE BUTLER has given malware the same name as an existing file on the file share server to cause users to unwittingly launch and install the malware on additional systems.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Gazer can establish persistence by creating a scheduled task.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: In response, if the status is OK, then a TOKEN is received from the C2 server that is used to synchronize the activities between the victim’s machine and the C2 server

Tactics: TA0010
Techniques: T1041
Input: It first grabs an encrypted blob stored away in a global variable and pulls out 381 bytes of this encrypted data:  The standard win32 api CryptDecrypt uses rc4 to decrypt this blob into a hardcoded c2, url path, and url parameters listed below with a simple 140-bit key “\x8B\xFF\x55\x8B\xEC\x83\xEC\x50\xA1\x84\x18\x03\x68\x33\xC9\x66\xF7\x45\x10\xE8\x1F\x89\x45\xFC\x8B\x45\x14\x56″

Tactics: TA0011
Techniques: T1573
Input: On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent an application from writing a signed vulnerable driver to the system.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: jRAT has been distributed as HTA files with JScript.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Other tools may also be used, such as a remote access tool, which may contain functionality to interact with the Registry through the Windows API.

Tactics: TA0005
Techniques: T1112
Input: njRAT will attempt to detect if the victim system has a camera during the initial infection.

Tactics: TA0007
Techniques: T1120
Input: Information about domains and their properties may include a variety of details, including what domain(s) the victim owns as well as administrative data (ex: name, registrar, ) and more directly actionable information such as contacts (email addresses and phone numbers), business addresses, and name servers.

Tactics: TA0043
Techniques: T1590, T1590.001
Input: Winnti Group has downloaded an auxiliary program named ff.exe to infected machines.

Tactics: TA0011
Techniques: T1105
Input: Lsadump also includes NetSync, which performs DCSync over a legacy replication protocol.

Tactics: TA0006
Techniques: T1003.006, T1003
Input: They temporarily replaced legitimate utilities with their own, executed their payload, and then restored the original file.

Tactics: TA0005
Techniques: T1070
Input: Taidoor has been delivered through spearphishing emails.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Monitor for the activation or invocation of an instance (ex: instance.start within GCP Audit Logs)

Tactics: TA0002
Techniques: T1204.003, T1204
Input: Monitor for changes made to files that may establish persistence by executing malicious content triggered by user inactivity.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.002
Input: When executed, the resulting process from padded files may also exhibit other behavior characteristics of being used to conduct an intrusion such as system and network information Discovery or Lateral Movement, which could be used as event indicators that point to the source file.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: Processes executed from binaries containing non-standard extensions in the filename are suspicious.

Tactics: TA0005
Techniques: T1036.006, T1036
Input: It uses the Dropbox API with a hardcoded bearer access token and has the ability to download, upload, and execute files

Tactics: TA0011
Techniques: T1105
Input: Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Detection efforts may be focused on other phases of the adversary lifecycle, such as during Spearphishing Link , Spearphishing Link , or Malicious Link .

Tactics: TA0042
Techniques: T1608.005, T1608
Input: Clop has used the sleep command to avoid sandbox detection.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Filtering based on DKIM+SPF or header analysis can help detect when the email sender is spoofed.Monitor for references to uncategorized or known-bad sites.

Tactics: TA0043
Techniques: T1598, T1598.003
Input: GravityRAT lists the running processes on the system.

Tactics: TA0007
Techniques: T1057
Input: Adversaries may install code on externally facing portals, such as a VPN login page, to capture and transmit credentials of users who attempt to log into the service.

Tactics: TA0006, TA0009
Techniques: T1056.003, T1056
Input: GravityRAT collects the victim IP address, MAC address, as well as the victim account domain name.

Tactics: TA0007
Techniques: T1016
Input: SDBbot has the ability to communicate with C2 with TCP over port 443.

Tactics: TA0011
Techniques: T1095
Input: Ensure event tracers/forwarders , firewall policies, and other associated mechanisms are secured with appropriate permissions and access controls.

Tactics: TA0005
Techniques: T1562.006, T1562
Input: An adversary can create a new access token that duplicates an existing token using DuplicateToken(Ex).

Tactics: TA0004, TA0005
Techniques: T1134, T1134.001
Input: BendyBear has encrypted payloads using RC4 and XOR.

Tactics: TA0005
Techniques: T1027
Input: GRIFFON has used a screenshot module that can be used to take a screenshot of the remote system.

Tactics: TA0009
Techniques: T1113
Input: The attackers typically distribute Netwalker ransomware with the use of a reflective PowerShell loader script that has been protected from casual analysis with several layers of obfuscation.

Tactics: TA0002
Techniques: T1059
Input: On Windows 10, enable Attack Surface Reduction (ASR) rules to prevent Visual Basic scripts from executing potentially malicious downloaded content .

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Adversaries may abuse specific file formats to subvert Mark-of-the-Web (MOTW) controls.

Tactics: TA0005
Techniques: T1553, T1553.005
Input: WinMM uses HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001