madox81/Adema_ATTACK_DS huggingface dataset:
Input: DarkWatchman can execute PowerShell commands and has used PowerShell to execute a keylogger.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Threat Group-3390 actors use the Hunter tool to conduct network service discovery for vulnerable systems.

Tactics: TA0007
Techniques: T1046
Input: The group has also used embedded image tags (known as web bugs) with unique, per-recipient tracking links in their emails for the purpose of identifying which recipients opened messages.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: The payload has a function it calls early on that tests to see which DNS query types are able to successfully reach the C2 server.  It iterates through a list of types and the first DNS type to receive a response from the C2 server will be used for all communications between the payload and the C2 server, which are in the following order (editor’s note: AC is not a  DNS record type but is a mode where the trojan will perform a request for an A record requiring ac as a subdomain):  A AAAA AC – (see note above) CNAME MX TXT SRV SOA  The payload uses the built-in Windows nslookup application with specific parameters and specially crafted subdomains to communicate with the C2

Tactics: TA0009, TA0011, TA0010
Techniques: T1041, T1071, T1008, T1123
Input: Screen captures are taken at specified intervals based on the system.

Tactics: TA0009
Techniques: T1113
Input: Sandworm Team has used dedicated network connections from one victim organization to gain unauthorized access to a separate organization.

Tactics: TA0001
Techniques: T1199
Input: The adversaries can get detailed information about the victim's machine, as you can see in the screenshot below.Beside the system information, it steals passwords from common web browsers, Filezilla, Beyluxe Messenger, CoreFTP and the video game "Minecraft." It also starts a keylogger, steals clipboard content, takes screenshots from the desktop and pictures from the webcam

Tactics: TA0006, TA0007, TA0009
Techniques: T1125, T1003, T1082, T1113, T1018
Input: Log.php validates the sender by User-Agent, saves the data in the “UP” server directory and stores the metadata in the mssql database for later reference

Tactics: TA0009
Techniques: T1074
Input: In addition to management services, adversaries may "target single sign-on (SSO) and cloud-based applications utilizing federated authentication protocols," as well as externally facing email applications, such as Office 365.

Tactics: TA0006
Techniques: T1110.004, T1110, T1110.003
Input: Set directory access controls to prevent file writes to the search paths for applications, both in the folders where applications are run from and the standard library folders.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574
Input: SamSam has been seen deleting its own files and payloads to make analysis of the attack more difficult.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: APT41 used BITSAdmin to download and install payloads.

Tactics: TA0003, TA0005
Techniques: T1197
Input: Correlate other security systems with login information

Tactics: TA0007
Techniques: T1538
Input: POWERSOURCE has been observed being used to download TEXTMATE and the Cobalt Strike Beacon payload onto victims.

Tactics: TA0011
Techniques: T1105
Input: Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.

Tactics: TA0006
Techniques: T1528
Input: GrimAgent has the ability to add bytes to change the file hash.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: WhiskeyDelta can overwrite the first 132MB or 1.5MB of each drive with random data from heap memory.

Tactics: TA0040
Techniques: T1561.001, T1561
Input: Since browser pivoting requires a high integrity process to launch from, restricting user permissions and addressing Privilege Escalation and Bypass User Account Control opportunities can limit the exposure to this technique.

Tactics: TA0009
Techniques: T1185
Input: Cryptoistic has the ability to send and receive files.

Tactics: TA0011
Techniques: T1105
Input: This will commonly give an adversary access to systems on the internal network instead of external systems that may be in a DMZ.

Tactics: TA0001
Techniques: T1189
Input: Conficker exploited the MS08-067 Windows vulnerability for remote code execution through a crafted RPC request.

Tactics: TA0008
Techniques: T1210
Input: On Windows, enable the "Microsoft-Windows-TaskScheduler/Operational" setting within the event logging service where several events will then be logged on scheduled task activity, including:

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: CharmPower has the ability to use ipconfig to enumerate system network settings.

Tactics: TA0007
Techniques: T1016
Input: Odbcconf.exe is a Windows utility that allows you to configure Open Database Connectivity (ODBC) drivers and data source names.

Tactics: TA0005
Techniques: T1218, T1218.008
Input: Endpoint sensors may be able to detect the addition of hardware via USB, Thunderbolt, and other external device communication ports.

Tactics: TA0001
Techniques: T1200
Input: UPPERCUT has the capability to gather the victim's proxy information.

Tactics: TA0007
Techniques: T1016
Input: This means that, for example, the sudo timeout of one tty will not affect another tty (you will have to type the password again).

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: POWERSTATS can use VBScript (VBE) code for execution.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: FIN6 conducted internal reconnaissance with a Windows batch file leveraging Adfind to query Active Directory, then 7-zip to compress the results for exfiltration

Tactics: TA0007
Techniques: T1069
Input: Monitor executed commands and arguments that may achieve persistence by adding a Registry key to the Active Setup of the local machine.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.014
Input: Disable the SSH daemon on systems that do not require it.

Tactics: TA0008
Techniques: T1021, T1021.004
Input: APT19 used an HTTP malware variant and a Port 22 malware variant to collect the MAC address and IP address from the victim’s machine.

Tactics: TA0007
Techniques: T1016
Input: SoreFang can enumerate domain accounts via net.exe user /domain.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: Monitor for changes made to drive letters or mount points of data storage devices for unexpected modifications that may be used by rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components.

Tactics: TA0005
Techniques: T1014
Input: Backdoor.Oldrea adds Registry Run keys to achieve persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Gorgon Group sent emails to victims with malicious Microsoft Office documents attached.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: xCaon has leveraged native OS function calls to retrieve  victim's network adapter's  information using GetAdapterInfo() API.

Tactics: TA0002
Techniques: T1106
Input: GrimAgent can use an AES key to encrypt C2 communications.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: RTM has used Registry run keys to establish persistence for the RTM Trojan and other tools, such as a modified version of TeamViewer remote desktop software.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: JPIN can obtain system information such as OS version and disk space.

Tactics: TA0007
Techniques: T1082
Input: CrossRAT can list all files on a system.

Tactics: TA0007
Techniques: T1083
Input: HTTPBrowser is capable of writing a file to the compromised system from the C2 server.

Tactics: TA0011
Techniques: T1105
Input: ComRAT has checked the victim system's date and time to perform tasks during business hours (9 to 5, Monday to Friday).

Tactics: TA0007
Techniques: T1124
Input: Chaes has used cmd to execute tasks on the system.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Patchwork developed a file stealer to search C:\ and collect files with certain extensions.

Tactics: TA0009
Techniques: T1119
Input: The purpose of this API is to give application developers an easy way to perform operations with root privileges, such as for application installation or updating.

Tactics: TA0004, TA0005
Techniques: T1548.004, T1548
Input: SQLRat has used been observed deleting scripts once used.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Whitefly has obtained and used tools such as Mimikatz.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Before creating a window, graphical Windows-based processes must prescribe to or register a windows class, which stipulate appearance and behavior (via windows procedures, which are functions that handle input/output of data).

Tactics: TA0004, TA0005
Techniques: T1055.011, T1055
Input: Okrum can collect computer name, locale information, and information about the OS and architecture.

Tactics: TA0007
Techniques: T1082
Input: Rover also automatically sends keylogger files and screenshots to the C2 server on a regular timeframe.

Tactics: TA0010
Techniques: T1020
Input: Pysa has deleted batch files after execution.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: For example, this may be used to forge SAML Tokens, without the need to compromise the signing certificate to forge new credentials.

Tactics: TA0004, TA0005
Techniques: T1484, T1484.002
Input: InstallUtil may also be used to bypass application control through use of attributes within the binary that execute the class decorated with the attribute [System.ComponentModel.RunInstaller(true)].

Tactics: TA0005
Techniques: T1218, T1218.004
Input: StoneDrill has looked in the registry to find the default browser path.

Tactics: TA0007
Techniques: T1012
Input: Examples include ListObjectsV2 in AWS  and List Blobs in Azure .

Tactics: TA0007
Techniques: T1619
Input: Monitor for DNS traffic to/from known-bad or suspicious domains and analyze traffic flows that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, or gratuitous or anomalous traffic patterns).

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Kinsing was executed in an Ubuntu container deployed via an open Docker daemon API.

Tactics: TA0001, TA0003
Techniques: T1133
Input: StrongPity can use HTTP and HTTPS in C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: SLOTHFULMEDIA can inject into running processes on a compromised host.

Tactics: TA0004, TA0005
Techniques: T1055
Input: CrackMapExec can enumerate the shared folders and associated permissions for a targeted network.

Tactics: TA0007
Techniques: T1135
Input: Suspicious accounts/credentials should be investigated and removed.

Tactics: TA0006
Techniques: T1606, T1606.001
Input: (Source: SecureWorks) Some payloads leveraged DLL side loading, a technique that involves running a legitimate, typically digitally signed, program that loads a malicious DLL

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: This can be done numerous ways depending on the operating system, including via command-line, editing Windows Registry keys, and Windows Control Panel.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: Monitor for newly executed processes that may use Valid Accounts to log into a service specifically designed to accept remote connections, such as RDP, telnet, SSH, and VNC.

Tactics: TA0008
Techniques: T1021
Input: TA505 has leveraged rundll32.exe to execute malicious DLLs.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Okrum can collect network information, including the host IP address, DNS, and proxy information.

Tactics: TA0007
Techniques: T1016
Input: Using the in-built Windows tool, ntdsutil.exe

Tactics: TA0006
Techniques: T1003.003, T1003
Input: Monitor command-line usage for -AllowReversiblePasswordEncryption $true or other actions that could be related to malicious tampering of user settings ( Group Policy Modification).

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.005
Input: SUNBURST collected hostname, OS version, and device uptime.

Tactics: TA0007
Techniques: T1082
Input: WarzoneRAT can use PowerShell to download files and execute commands.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Adversaries may craft various search engine queries depending on what information they seek to gather.

Tactics: TA0043
Techniques: T1593, T1593.002
Input: GuLoader can delete its executable from the AppData\Local\Temp directory on the compromised host.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: On macOS the dscl . list /Users command can be used to enumerate local accounts.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Attor's dispatcher can modify the Run registry key.

Tactics: TA0005
Techniques: T1112
Input: Adversaries may create a cloud account to maintain access to victim systems.

Tactics: TA0003
Techniques: T1136, T1136.003
Input: Adversaries may craft or modify CLR assemblies that are linked to stored procedures since these CLR assemblies can be made to execute arbitrary commands.

Tactics: TA0003
Techniques: T1505.001, T1505
Input: It may be called with the winrm command or by any number of programs such as PowerShell.

Tactics: TA0008
Techniques: T1021, T1021.006
Input: Gold Dragon terminates anti-malware processes if they’re found running on the system.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: ZxShell can create Registry entries to enable services to run.

Tactics: TA0005
Techniques: T1112
Input: InvisiMole can be launched by using DLL search order hijacking in which the wrapper DLL is placed in the same folder as explorer.exe and loaded during startup into the Windows Explorer process instead of the legitimate library.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: The user should pay particular attention to the redirect URL: if the URL is a misspelled or convoluted sequence of words related to an expected service or SaaS application, the website is likely trying to spoof a legitimate service.

Tactics: TA0006
Techniques: T1528
Input: Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Azure AD,

Tactics: TA0007
Techniques: T1526
Input: Adversaries may gather information about the victim's business relationships that can be used during targeting.

Tactics: TA0043
Techniques: T1591.002, T1591
Input: NanoCore has the capability to edit the Registry.

Tactics: TA0005
Techniques: T1112
Input: Netwalker can terminate system processes and services, some of which relate to backup software.

Tactics: TA0040
Techniques: T1489
Input: In addition to a server-side script, a Web shell may have a client interface program that is used to talk to the Web server (ex: China Chopper Web shell client).

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Cardinal RAT injects into a newly spawned process created from a native Windows executable.

Tactics: TA0004, TA0005
Techniques: T1055
Input: HTTPBrowser has used DLL side-loading.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: menuPass has used malicious macros embedded inside Office documents to execute files.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Higaisa has used VBScript code on the victim's machine.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: It also gathers network information such as the MAC address, IP address, WINS, DHCP server, and gateway

Tactics: TA0007
Techniques: T1016
Input: Cobalt Strike can deliver Beacon payloads for lateral movement by leveraging remote COM execution.

Tactics: TA0008
Techniques: T1021.003, T1021
Input: QakBot has stored stolen emails and other data into new folders prior to exfiltration.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: The function invokes sysctl checking the returned value of P_TRACED.

Tactics: TA0005, TA0007
Techniques: T1622
Input: Pay2Key can stop the MS SQL service at the end of the encryption process to release files locked by the service.

Tactics: TA0040
Techniques: T1489
Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Websites/Domains), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Supply Chain Compromise, Drive-by Compromise, or Trusted Relationship).

Tactics: TA0043
Techniques: T1591.002, T1591
Input: Daserf leverages Mimikatz and Windows Credential Editor to steal credentials.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Agent Tesla has used ProcessWindowStyle.Hidden to hide windows.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: HAFNIUM has used web shells to export mailbox data.

Tactics: TA0009
Techniques: T1114, T1114.002
Input: Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as making network connections for Command and Control, learning details about the environment through Discovery, and conducting Lateral Movement.

Tactics: TA0003, TA0004
Techniques: T1546
Input: Pay2Key has sent its public key to the C2 server over TCP.

Tactics: TA0011
Techniques: T1095
Input: Cobalt Group has sent emails containing malicious links that require users to execute a file or macro to infect the victim machine.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: System file associations are listed under HKEY_CLASSES_ROOT.[extension], for example HKEY_CLASSES_ROOT.txt.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.001
Input: This location data gives the attacker a unique edge, as they can specify a target country or city to attack and maximize their accuracy when choosing a particular target.    The .txt file contains information about the C2 domain and infected machine, as detected in a Cybereason Lab environment

Tactics: TA0010
Techniques: T1041
Input: GALLIUM exploited a publicly-facing servers including Wildfly/JBoss servers to gain access to the network.

Tactics: TA0001
Techniques: T1190
Input: Helminth can use HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Make sure that the HISTCONTROL environment variable is set to "ignoredups" instead of "ignoreboth" or "ignorespace".

Tactics: TA0005
Techniques: T1562.003, T1562
Input: Since mshta.exe executes outside of the Internet Explorer's security context, it also bypasses browser security settings.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: MacSpy deletes any temporary files it creates

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Mustang Panda has used a customized PlugX variant which could exfiltrate documents from air-gapped networks.

Tactics: TA0010
Techniques: T1052, T1052.001
Input: CALENDAR has a command to run cmd.exe to execute commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: The CLI and scripting interpreter are accessible through a direct console connection, or through remote means, such as telnet or SSH.

Tactics: TA0002
Techniques: T1059.008, T1059
Input: WastedLocker checks for specific registry keys related to the UCOMIEnumConnections and IActiveScriptParseProcedure32 interfaces.

Tactics: TA0007
Techniques: T1012
Input: It supports searching for directories, creating directories, listing directory contents, reading and writing to files, retrieving file attributes, and retrieving volume information.

Tactics: TA0007
Techniques: T1083
Input: Newer versions create the "MaintenaceSrv" and "hdv_725x" services.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Then, they are using the process hollowing technique to hide the execution of these tools inside of the original Microsoft vbc.exe (VisualBasic Compiler) process

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: APT1 used publicly available malware for privilege escalation.

Tactics: TA0042
Techniques: T1588, T1588.001
Input: Other facets of this technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: The group often uses the trial version of Cobalt Strike, a publicly available commercial software for “Adversary Simulations and Red Team Operations.” Other public tools used by the group are Metasploit, a well-known free and open source framework for developing and executing exploit code against a remote target machine; Mimikatz, a post-exploitation tool that performs credential dumping; and Empire, “a PowerShell and Python post-exploitation agent.” For detection and exploitation of internet-facing web servers, CopyKittens use Havij, Acunetix and sqlmap

Tactics: TA0002
Techniques: T1059
Input: PipeMon can install additional modules via C2 commands.

Tactics: TA0011
Techniques: T1105
Input: Ramsay can spread itself by infecting other portable executable files on networks shared drives.

Tactics: TA0008
Techniques: T1080
Input: The number of default cached credentials varies and can be altered per system.

Tactics: TA0006
Techniques: T1003, T1003.005
Input: Use application control configured to block execution of these scripts if they are not required for a given system or network to prevent potential misuse by adversaries.

Tactics: TA0005
Techniques: T1216.001, T1216
Input: Pupy adds itself to the startup folder or adds itself to the Registry key SOFTWARE\Microsoft\Windows\CurrentVersion\Run for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: SHUTTERSPEED can capture screenshots.

Tactics: TA0009
Techniques: T1113
Input: Monitor newly constructed files that may establish persistence and/or elevate privileges by executing malicious content triggered by accessibility features.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: Process injection helps the malware avoid detection; however, review of active network connections show notepad.exe communicating to 185

Tactics: TA0004, TA0005
Techniques: T1055
Input: RCSession can gather system owner information, including user and administrator privileges.

Tactics: TA0007
Techniques: T1033
Input: Malicious ads are paid for and served through legitimate ad providers.

Tactics: TA0001
Techniques: T1189
Input: Information from these scans may reveal opportunities for other forms of reconnaissance (ex: Search Open Websites/Domains or Search Open Technical Databases), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services or Exploit Public-Facing Application).

Tactics: TA0043
Techniques: T1595
Input: Flame contains modules to infect USB sticks and spread laterally to other Windows systems the stick is plugged into using Autorun functionality.

Tactics: TA0001, TA0008
Techniques: T1091
Input: Manipulation of a development environment

Tactics: TA0001
Techniques: T1195
Input: Also, after retrieving a C2 IP address and Port Number, NETEAGLE will initiate a TCP connection to this socket.

Tactics: TA0011
Techniques: T1095
Input: XCSSET will upload a private key file to the server to remotely access the host without a password.

Tactics: TA0003
Techniques: T1098.004, T1098
Input: In others, an adversary may deploy a new container configured without network rules, user limitations,  to bypass existing defenses within the environment.

Tactics: TA0002, TA0005
Techniques: T1610
Input: Monitor executed commands and arguments that may abuse features of Winlogon to execute DLLs and/or executables when a user logs in.

Tactics: TA0003, TA0004
Techniques: T1547.004, T1547
Input: Caterpillar WebShell can search for files in directories.

Tactics: TA0007
Techniques: T1083
Input: TeamTNT has the curl command and batch scripts to download new tools.

Tactics: TA0011
Techniques: T1105
Input: This can increase the difficulty defenders have in defending against the attack by reducing or eliminating the effectiveness of filtering by the source address on network defense devices.

Tactics: TA0040
Techniques: T1499, T1498
Input: TDTESS creates then deletes log files during installation of itself as a service.

Tactics: TA0005
Techniques: T1070, T1070.004