madox81/Adema_ATTACK_DS huggingface dataset:
Input: MURKYTOP has the capability to retrieve information about users on remote hosts.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Wizard Spider has identified domain admins through the use of "net group ‘Domain admins’" commands.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: APT32's backdoor has exfiltrated data using the already opened channel with its C&C server.

Tactics: TA0010
Techniques: T1041
Input: Rising Sun used dynamic API resolutions to various Windows APIs by leveraging LoadLibrary() and GetProcAddress().

Tactics: TA0002
Techniques: T1106
Input: The OwaAuth web shell enables a threat actor to upload and download files, launch processes, and execute SQL queries

Tactics: TA0011
Techniques: T1105
Input: APT37 has access to destructive malware that is capable of overwriting a machine's Master Boot Record (MBR).

Tactics: TA0040
Techniques: T1561, T1561.002
Input: Wizard Spider has injected malicious DLLs into memory with read, write, and execute permissions.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Cannon adds the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.004, T1547
Input: Fox Kitten has searched network shares to access sensitive documents.

Tactics: TA0009
Techniques: T1039
Input: The built-in history only tracks the commands used in the current session.

Tactics: TA0005
Techniques: T1070, T1070.003
Input: BloodHound can collect information on user sessions.

Tactics: TA0007
Techniques: T1033
Input: The White Company has the ability to delete its malware entirely from the target system.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Azorult can collect the username from the victim’s machine.

Tactics: TA0007
Techniques: T1033
Input: By using a compromised internal system as a proxy, adversaries may conceal the true destination of C2 traffic while reducing the need for numerous connections to external systems.

Tactics: TA0011
Techniques: T1090.001, T1090
Input: We found two obfuscation techniques applied to the script: the first one changing the representation of variables; the second one changing the representation of strings in the script

Tactics: TA0005
Techniques: T1027, T1562.001, T1562
Input: RTM tries to add a Registry Run key under the name "Windows Update" to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: The Ke3chang group has been known to compress data before exfiltration.

Tactics: TA0009
Techniques: T1560
Input: Koadic can use SSL and TLS for communications.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: SUNBURST masqueraded its network traffic as the Orion Improvement Program (OIP) protocol.

Tactics: TA0011
Techniques: T1001, T1001.003
Input: MURKYTOP has the capability to schedule remote AT jobs.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: Registering a rogue DC involves creating a new server and nTDSDSA objects in the Configuration partition of the AD schema, which requires Administrator privileges (either Domain or local to the DC) or the KRBTGT hash.

Tactics: TA0005
Techniques: T1207
Input: ChromeUpdate.exe starts the file with “rundll32 cache.dll,ADB_Setup” Cache.dll analysis  Cache.dll was written in C/C++ and built with a Microsoft compiler

Tactics: TA0004, TA0005
Techniques: T1218, T1218.011, T1055
Input: Monitor emond rules creation by checking for files created in /etc/emond.d/rules/ and /private/var/db/emondClients.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.014
Input: Pandora can use CVE-2017-15303 to disable Windows Driver Signature Enforcement (DSE) protection and load its driver.

Tactics: TA0005
Techniques: T1553, T1553.006
Input: Wiarp creates a backdoor through which remote attackers can inject files into running processes.

Tactics: TA0004, TA0005
Techniques: T1055
Input: APT32 has used scheduled tasks to persist on victim systems.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: TeamTNT has used the open-source rootkit Diamorphine to hide cryptocurrency mining activities on the machine.

Tactics: TA0005
Techniques: T1014
Input: Trojan.Karagany can base64 encode and AES-128-CBC encrypt data prior to transmission.

Tactics: TA0005
Techniques: T1027
Input: Silence has used JS scripts.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: Conficker variants spread through NetBIOS share propagation.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Sandworm Team has created new domain accounts on an ICS access server.

Tactics: TA0003
Techniques: T1136, T1136.002
Input: Final1stspy uses Python code to deobfuscate base64-encoded strings.

Tactics: TA0005
Techniques: T1140
Input: Astaroth has used malicious VBS e-mail attachments for execution.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Is the command and control server used by the Poseidon Group still active? Have you been able to sinkhole any of the command and controls? Poseidon Group has interesting practices when it comes to its use of command and control servers, including redundancies and quickly discarding command and control (C&Cs) servers after specific campaigns

Tactics: TA0011
Techniques: T1071, T1571, T1102
Input: USBferry can use net view to gather information about remote systems.

Tactics: TA0007
Techniques: T1018
Input: Xbash can use scripts to invoke PowerShell to download a malicious PE executable or PE DLL for execution.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053
Input: However, if the file is renamed to evil.txt  (note the space at the end), then when double clicked by a user, the true file type is determined by the OS and handled appropriately and the binary will be executed .

Tactics: TA0005
Techniques: T1036.006, T1036
Input: POWRUNER may use WMI when collecting information about a victim.

Tactics: TA0002
Techniques: T1047
Input: Tropic Trooper has created a hidden directory under C:\ProgramData\Apple\Updates\ and C:\Users\Public\Documents\Flash\.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: OSX/Shlayer can escalate privileges to root by asking the user for credentials.

Tactics: TA0004, TA0005
Techniques: T1548.004, T1548
Input: For example, SSH utilities create a .ssh folder that’s hidden and contains the user’s known hosts and keys.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Figure 6 shows the Glimpse server responding to an inbound beacon from the Glimpse agent and sending a command whoami

Tactics: TA0007
Techniques: T1033
Input: This allows an adversary to bypass some email restrictions on the work account, and the target is more likely to open the file since it's something they were expecting.

Tactics: TA0001
Techniques: T1566.003, T1566
Input: Lateral movement can be done with Net through net use commands to connect to the on remote systems.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Indrik Spider used Cobalt Strike to carry out credential dumping using ProcDump.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Pupy can obtain a list of SIDs and provide the option for selecting process tokens to impersonate.

Tactics: TA0004, TA0005
Techniques: T1134, T1134.001
Input: NETWIRE stores its configuration file within the Registry.

Tactics: TA0005
Techniques: T1112
Input: Frankenstein has enumerated hosts, looking for the public IP address of the system.

Tactics: TA0007
Techniques: T1016
Input: Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574
Input: Before writing to disk, Kwampirs inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: Fox Kitten has used the PuTTY and Plink tools for lateral movement.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: Strider has used local servers with both local network and Internet access to act as internal proxy nodes to exfiltrate data from other parts of the network without direct Internet access.

Tactics: TA0011
Techniques: T1090.001, T1090
Input: Clop can use code signing to evade detection.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Ke3chang has dropped their malware into legitimate installed software paths including: C:\ProgramFiles\Realtek\Audio\HDA\AERTSr.exe, C:\Program Files (x86)\Foxit Software\Foxit Reader\FoxitRdr64.exe, C:\Program Files (x86)\Adobe\Flash Player\AddIns\airappinstaller\airappinstall.exe, and C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd64.exe.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: This command adds the path of the malicious executable to the login item file list located in ~/Library/Application Support/com.apple.backgroundtaskmanagementagent/backgrounditems.btm.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.015
Input: Adversaries may destroy data and files on specific systems or in large numbers on a network to interrupt availability to systems, services, and network resources.

Tactics: TA0040
Techniques: T1485
Input: Pillowmint has been decompressed by included shellcode prior to being launched.

Tactics: TA0005
Techniques: T1140
Input: Monitoring for SMB traffic between systems may also be captured and decoded to look for related network share session and file transfer activity.

Tactics: TA0005
Techniques: T1070, T1070.005
Input: Additionally, there is a tty_tickets variable that treats each new tty (terminal session) in isolation.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: BACKSPACE will attempt to establish a C2 channel, then will examine open windows to identify a pop-up from the firewall software and will simulate a mouse-click to allow the connection to proceed.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: Monitor network data for uncommon data flows., such as the usage of abnormal/unexpected protocols.

Tactics: TA0010
Techniques: T1011.001, T1011
Input: Adversaries may compromise VPSs purchased by third-party entities.

Tactics: TA0042
Techniques: T1584.003, T1584
Input: This ticket can then be used to perform Pass the Ticket attacks.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: POSHSPY's use of WMI to both store and persist the backdoor code makes it nearly invisible to anyone not familiar with the intricacies of WMI

Tactics: TA0002
Techniques: T1047
Input: PowerSploit has several modules that search the Windows Registry for stored credentials: Get-UnattendedInstallFile, Get-Webconfig, Get-ApplicationHost, Get-SiteListPassword, Get-CachedGPPPassword, and Get-RegistryAutoLogon.

Tactics: TA0006
Techniques: T1552, T1552.002
Input: ServHelper can execute shell commands against cmd.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Bazar can launch cmd.exe to perform reconnaissance commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Cardinal RAT decodes many of its artifacts and is decrypted (AES-128) after being downloaded.

Tactics: TA0005
Techniques: T1140
Input: Peppy can take screenshots on targeted systems.

Tactics: TA0009
Techniques: T1113
Input: A module in Prikormka collects information about the paths, size, and creation time of files with specific file extensions, but not the actual content of the file.

Tactics: TA0007
Techniques: T1083
Input: Anyconnect[.]stream Bigip[.]stream Fortiweb[.]download Kaspersky[.]science microtik[.]stream owa365[.]bid symanteclive[.]download windowsdefender[.]win  The listed C2 servers all resolved to IPs belonging to a service provider in China at 1.2.9.0/24, which is the IP address used by the C2 server to send a cancel communications message to the end system

Tactics: TA0011
Techniques: T1105
Input: FIN7 has used fragmented strings, environment variables, standard input (stdin), and native character-replacement functionalities to obfuscate commands.

Tactics: TA0005
Techniques: T1027
Input: Grandoreiro can log keystrokes on the victim's machine.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Higaisa has sent spearphishing emails containing malicious attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Limit credential overlap across accounts and systems by training users and administrators not to use the same password for multiple accounts.

Tactics: TA0006
Techniques: T1003.003, T1003, T1003.002, T1003.004, T1003.001, T1003.005
Input: APT28 has used legitimate credentials to gain initial access, maintain access, and exfiltrate data from a victim network.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: TA459 has a VBScript for execution.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: This can be done by either executing a new or modified service.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: The ASPXTool version used by Threat Group-3390 has been deployed to accessible servers running Internet Information Services (IIS).

Tactics: TA0003
Techniques: T1505.003, T1505
Input: APT28 downloads and executes PowerShell scripts and performs PowerShell commands.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Crimson has the ability to discover pluggable/removable drives to extract files from.

Tactics: TA0007
Techniques: T1120
Input: PowerPunch can use the volume serial number from a target host to generate a unique XOR key for the next stage payload.

Tactics: TA0005
Techniques: T1480, T1480.001
Input: Files containing email data can be acquired from a user’s local system, such as Outlook storage or cache files.

Tactics: TA0009
Techniques: T1114, T1114.001
Input: S-Type may create a .lnk file to itself that is saved in the Start menu folder.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: DEATHRANSOM can use loop operations to enumerate directories on a compromised host.

Tactics: TA0007
Techniques: T1083
Input: Stealth Falcon malware creates a scheduled task entitled "IE Web Cache" to execute a malicious file hourly.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Anchor can determine the hostname and linux version on a compromised host.

Tactics: TA0007
Techniques: T1082
Input: Anchor can determine the public IP and location of a compromised host.

Tactics: TA0007
Techniques: T1016
Input: Azorult uses an XOR key to decrypt content and uses Base64 to decode the C2 address.

Tactics: TA0005
Techniques: T1140
Input: Rancor launched a scheduled task to gain persistence using the schtasks /create /sc command.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: FoggyWeb's loader can enumerate all Common Language Runtimes (CLRs) and running Application Domains in the compromised AD FS server's Microsoft.IdentityServer.ServiceHost.exe process.

Tactics: TA0007
Techniques: T1057
Input: APT28 has used the ntdsutil.exe utility to export the Active Directory database for credential access.

Tactics: TA0006
Techniques: T1003.003, T1003
Input: Monitor for newly constructed user accounts through the collection of usage logs from cloud user and administrator accounts to identify unusual activity in the creation of new accounts and assignment of roles to those accounts.

Tactics: TA0003
Techniques: T1136, T1136.003
Input: APT29 collected emails from specific individuals, such as executives and IT staff, using New-MailboxExportRequest followed by Get-MailboxExportRequest.

Tactics: TA0009
Techniques: T1114, T1114.002
Input: In Linux environments, users account-level access to at can be managed using at.allow and at.deny files.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: This may include information about the currently logged in user, the hostname, network configuration data, active connections, process information, local and domain administrator accounts, an enumeration of user directories, and other data

Tactics: TA0007
Techniques: T1087
Input: LitePower can use a PowerShell script to execute commands.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Operation Wocao has used ProcDump to dump credentials from memory.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: KONNI has used the command cmd /c tasklist to get a snapshot of the current processes on the target machine.

Tactics: TA0007
Techniques: T1057
Input: Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads.

Tactics: TA0005
Techniques: T1620
Input: APT3 has used a keylogging tool that records keystrokes in encrypted files.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Gamaredon Group has used GitHub repositories for downloaders which will be obtained by the group's .NET executable on the compromised system.

Tactics: TA0011
Techniques: T1102
Input: Threat Group-1314 actors mapped network drives using net use.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Cobalt Strike can use known credentials to run commands and spawn processes as a domain user account.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.002
Input: HyperStack has used RSA encryption for C2 communications.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Rising Sun executed commands using cmd.exe.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: QakBot has a module that can proxy C2 communications.

Tactics: TA0011
Techniques: T1090, T1090.002
Input: Ensure proper user permissions are in place to prevent adversaries from disabling or interfering with logging.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: Adversaries may gather information on Group Policy settings to identify paths for privilege escalation, security measures applied within a domain, and to discover patterns in domain objects that can be manipulated or used to blend in the environment.

Tactics: TA0007
Techniques: T1615
Input: Session cookies can be used to bypasses some multi-factor authentication protocols.

Tactics: TA0006
Techniques: T1539
Input: POWERSOURCE achieves persistence by setting a Registry Run key, with the path depending on whether the victim account has user or administrator access.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Do not leave RDP accessible from the internet.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Chimera has renamed malware to GoogleUpdate.exe and WinRAR to jucheck.exe, RecordedTV.ms, teredo.tmp, update.exe, and msadcs1.exe.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: InvisiMole can use the ITaskService, ITaskDefinition and ITaskSettings COM interfaces to schedule a task.

Tactics: TA0002
Techniques: T1559, T1559.001
Input: For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011