madox81/Adema_ATTACK_DS huggingface dataset:
Input: LoudMiner is typically bundled with pirated copies of Virtual Studio Technology (VST) for Windows and macOS.

Tactics: TA0001
Techniques: T1189
Input: Monitor newly executed processes that may abuse Microsoft Outlook forms to obtain persistence on a compromised system.

Tactics: TA0003
Techniques: T1137, T1137.003
Input: Stealth Falcon malware gathers the registered user and primary owner name via WMI.

Tactics: TA0007
Techniques: T1033
Input: Machete has the capability to exfiltrate stolen data to a hidden folder on a removable drive.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: OSX/Shlayer relies on users mounting and executing a malicious DMG file.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: An adversary may leverage permissions to create a snapshot in order to bypass restrictions that prevent access to existing compute service infrastructure, unlike in Revert Cloud Instance where an adversary may revert to a snapshot to evade detection and remove evidence of their presence.

Tactics: TA0005
Techniques: T1578, T1578.001
Input: This information can help adversaries determine which accounts exist to aid in follow-on behavior.

Tactics: TA0007
Techniques: T1087
Input: File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions.

Tactics: TA0005
Techniques: T1222.002, T1222, T1222.001
Input: Lazarus Group has renamed system utilities such as wscript.exe and mshta.exe.

Tactics: TA0005
Techniques: T1036.003, T1036
Input: ThiefQuest encrypts a set of file extensions on a host, deletes the original files, and provides a ransom note with no contact information.

Tactics: TA0040
Techniques: T1486
Input: Kasidet has the ability to initiate keylogging.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Implement more secure 2FA/MFA mechanisms in replacement of simple push or one-click 2FA/MFA options.

Tactics: TA0006
Techniques: T1621
Input: Use multi-factor authentication for remote logins.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Chimera has queried Registry keys using reg query \\HKU\\SOFTWARE\Microsoft\Terminal Server Client\Servers and reg query \\HKU\\Software\Microsoft\Windows\CurrentVersion\Internet Settings.

Tactics: TA0007
Techniques: T1012
Input: Similar to Indicator Blocking, adversaries may unhook or otherwise modify these features added by tools (especially those that exist in userland or are otherwise potentially accessible to adversaries) to avoid detection.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Inception has used malicious HTA files to drop and execute malware.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: For example, offline access and access to read emails should excite higher suspicions because adversaries can utilize SaaS APIs to discover credentials and other sensitive communications.

Tactics: TA0006
Techniques: T1528
Input: The Image File Execution Options Injection debugger method was likely discovered as a potential workaround because it does not require the corresponding accessibility feature binary to be replaced.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: SUNBURST encrypted C2 traffic using a single-byte-XOR cipher.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.007
Input: This provides adversaries with the means to update the ROMMON to gain persistence on a system in a way that may be difficult to detect.

Tactics: TA0003, TA0005
Techniques: T1542.004, T1542
Input: MuddyWater has sent targeted spearphishing e-mails with malicious links.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Personas may exist on a single site or across multiple sites (ex: Facebook, LinkedIn, Twitter, ).

Tactics: TA0042
Techniques: T1586.001, T1586
Input: Stuxnet calls LoadLibrary then executes exports from a DLL.

Tactics: TA0002
Techniques: T1129
Input: Compromised credentials or access may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access and remote desktop.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556
Input: Night Dragon has used HTTP for C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Information about an organization’s business tempo may include a variety of details, including operational hours/days of the week.

Tactics: TA0043
Techniques: T1591.003, T1591
Input: PoisonIvy creates a backdoor through which remote attackers can steal system information.

Tactics: TA0009
Techniques: T1005
Input: Adversaries may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls such as logging.

Tactics: TA0005
Techniques: T1562.010, T1562
Input: Virtualization drivers in order to gain kernel mode privileges.

Tactics: TA0004
Techniques: T1068
Input: BackConfig has used VBS to install its downloader component and malicious documents with VBA macro code.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: It also added additional permissions (such as Mail.Read and Mail.ReadWrite) to compromised Application or Service Principals.

Tactics: TA0003
Techniques: T1098.002, T1098
Input: RTM can use the FindNextUrlCacheEntryA and FindFirstUrlCacheEntryA functions to search for specific strings within browser history.

Tactics: TA0002
Techniques: T1106
Input: Carberp has hooked several Windows API functions to steal credentials.

Tactics: TA0006, TA0009
Techniques: T1056.004, T1056
Input: FIN7 sent spearphishing emails with either malicious Microsoft Documents or RTF files attached.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: POWRUNER may collect domain group information by running net group /domain or a series of other commands on a victim.

Tactics: TA0007
Techniques: T1069.002, T1069
Input: Adversaries may use network logon scripts automatically executed at logon initialization to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1037.003, T1037
Input: Disallow loading of remote DLLs.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: A Lazarus Group malware sample encodes data with base64.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: The Github readme page for UACME contains an extensive list of methods that have been discovered and implemented, but may not be a comprehensive list of bypasses.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: CHOPSTICK can use a DGA for Fallback Channels, domains are generated by concatenating words from lists.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: Carberp's passw.plug plugin can gather passwords saved in Opera, Internet Explorer, Safari, Firefox, and Chrome.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Cobian RAT has a feature to perform screen capture.

Tactics: TA0009
Techniques: T1113
Input: Indrik Spider has attempted to get users to click on a malicious zipped file.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Use Trusted Platform Module technology and a secure or trusted boot process to prevent system integrity from being compromised.

Tactics: TA0003, TA0005
Techniques: T1542.003, T1542
Input: Tonto Team has routed their traffic through an external server in order to obfuscate their location.

Tactics: TA0011
Techniques: T1090, T1090.002
Input: Adversaries may find vulnerability information by searching open databases or gaining access to closed vulnerability databases.

Tactics: TA0042
Techniques: T1588.006, T1588
Input: BLUELIGHT has a XOR-encoded payload.

Tactics: TA0005
Techniques: T1027
Input: Similarly, an adversary with existing access to a network may register a device to Azure AD and/or its device management system, Microsoft Intune, in order to access sensitive data or resources while bypassing conditional access policies.

Tactics: TA0003
Techniques: T1098.005, T1098
Input: Consider periodic review of accounts and privileges for critical and sensitive SharePoint repositories.

Tactics: TA0009
Techniques: T1213, T1213.002
Input: Bad Rabbit can enumerate all running processes to compare hashes.

Tactics: TA0007
Techniques: T1057
Input: URL inspection within email (including expanding shortened links) can also help detect links leading to known malicious sites.

Tactics: TA0043
Techniques: T1598, T1598.003
Input: Adversaries can also use internationalized domain names (IDNs) to create visually similar lookalike domains for use in operations.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: APT29 used the Get-ManagementRoleAssignment PowerShell cmdlet to enumerate Exchange management role assignments through an Exchange Management Shell.

Tactics: TA0007
Techniques: T1069
Input: EnvyScout has been distributed via spearphishing as an email attachment.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: SILENTTRINITY can use System namespace methods to execute lateral movement using DCOM.

Tactics: TA0008
Techniques: T1021.003, T1021
Input: KARAE was distributed through torrent file-sharing websites to South Korean victims, using a YouTube video downloader application as a lure.

Tactics: TA0001
Techniques: T1189
Input: If the Trojan receives this echo, it will create the following file that the Trojan uses as a signal that it was able to successfully communicate with its C2 server: %APPDATA%\Windows\ShwDoc.srv If the Trojan determines the C2 server wishes to send a command, it sends an HTTP request to the following URL: hxxp://www.windowspatch[.]com/tahw?<hex(STDOUT of whoami command)> The Trojan will first check the response to this request for the string spoo, which signifies the C2 does not wish to issue a command

Tactics: TA0011
Techniques: T1071, T1008
Input: Monitor executed commands and arguments that can be used to register WMI persistence, such as the  Register-WmiEvent PowerShell cmdlet

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: HermeticWiper can overwrite the C:\Windows\System32\winevt\Logs file on a targeted system.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: Adversaries may also install user level timers to achieve user level persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.006, T1053
Input: Scans may range from simple pings (ICMP requests and responses) to more nuanced scans that may reveal host software/versions via server banners or other network artifacts.

Tactics: TA0043
Techniques: T1595.001, T1595
Input: KillDisk deletes Application, Security, Setup, and System Windows Event Logs.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: Egregor has used regsvr32.exe to execute malicious DLLs.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Octopus has been disguised as legitimate programs, such as Java and Telegram Messenger.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: MuddyWater has used malware that can collect the victim’s username.

Tactics: TA0007
Techniques: T1033
Input: Finally, Reaver.v1 will execute the ‘~WUpdate.lnk’ file in a new process, thus loading the recently dropped malicious CPL file

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Adversaries may also utilize cloud APIs to discover the configurations of firewall rules within an environment.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: Operation Wocao has archived collected files with WinRAR, prior to exfiltration.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: The prior example decrypts to the following: mailto:121.126.211[.]94:8080;80;80   The following Python script may be used to decode the C2 data used by the newest Comnie variant:      12345678910111213141516171819202122232425262728293031323334353637383940  import base64import sysimport refrom string import maketransfrom struct import *import requestsdef rc4_crypt(data, key):  S = range(256)  j = 0  out = []  for i in range(256):    j = (j + S[i] + ord( key[i % len(key)] )) % 256    S[i] , S[j] = S[j] , S[i]  i = j = 0  for char in data:    i = ( i + 1 ) % 256    j = ( j + S[i] ) % 256    S[i] , S[j] = S[j] , S[i]    out.append(chr(ord(char) ^ S[(S[j] + S[i]) % 256]))  return ''.join(out)def decode(data):  o = ""  for d in data:    od = ord(d)    o += chr((4 * (16 * od | od & 0xC) | (((od >> 4 | od & 0x30) >> 2))) & 0xFF)  return obase64fixTable = maketrans("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[::-1], "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/");def trans(string):  return str(string).translate(base64fixTable)def altdecode(string):  return base64.b64decode(trans(string))req = requests.get(sys.argv[1])fd = req.textoriginal_data = re.search("magnet:/\?([^\?]+)\?", fd).group(1)parsed_data = altdecode(original_data)dataLength = unpack("<I", parsed_data[64:68])[0]key = decode(parsed_data[0:64])data = parsed_data[dataLength*-1:]d = rc4_crypt(data, key)print(d)       Comnie will make attempts at connecting to the IP address above using the various ports specified

Tactics: TA0009, TA0011, TA0010
Techniques: T1573, T1048, T1560
Input: Egregor has used DLL side-loading to execute its payload.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: TeamTNT has deployed privileged containers that mount the filesystem of victim machine.

Tactics: TA0004
Techniques: T1611
Input: Group policy objects (GPOs) are containers for group policy settings made up of files stored within a predicable network path \\SYSVOL\\Policies\.

Tactics: TA0007
Techniques: T1615
Input: The specific sandbox checks include:  Using WMI to check BIOS version (SMBIOSBIOSVERSION) for VBOX, bochs, qemu, virtualbox and vm

Tactics: TA0005, TA0007
Techniques: T1497
Input: Network Security appliances such as NGFW, NGIPS, and Meraki MX can detect malicious activity associated with this threat

Tactics: TA0007
Techniques: T1518.001, T1518
Input: MSBuild.exe (Microsoft Build Engine) is a software build platform used by Visual Studio.

Tactics: TA0005
Techniques: T1127.001, T1127
Input: Monitor for newly constructed network connections that may use Valid Accounts to interact with remote machines using Distributed Component Object Model (DCOM).

Tactics: TA0008
Techniques: T1021.003, T1021
Input: CozyCar uses Twitter as a backup C2 channel to Twitter accounts specified in its configuration file.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: APT38 has used DYEPACK to create, delete, and alter records in databases used for SWIFT transactions.

Tactics: TA0040
Techniques: T1565.001, T1565
Input: Adversaries may use the information from System Network Configuration Discovery during automated discovery to shape follow-on behaviors, including determining certain access within the target network and what actions to do next.

Tactics: TA0007
Techniques: T1016
Input: Flagpro can close specific Windows Security and Internet Explorer dialog boxes to mask external connections.

Tactics: TA0005
Techniques: T1070
Input: For example, if there is a Mach-O executable file called evil.bin, when it is double clicked by a user, it will launch Terminal.app and execute.

Tactics: TA0005
Techniques: T1036.006, T1036
Input: Skidmap has the ability to replace the pam_unix.so file on an infected machine with its own malicious version that accepts a specific backdoor password for all users.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556.003, T1556
Input: TrickBot collects local files and information from the victim’s local machine.

Tactics: TA0009
Techniques: T1005
Input: Data Exfiltration The second module Irdsnhrxxxfery98.~ is responsible for a vast amount of information stealing, and is able to collect information through hooking, clipboard usage, and monitoring the keystate

Tactics: TA0009
Techniques: T1115
Input: SideTwist has the ability to collect the domain name on a compromised host.

Tactics: TA0007
Techniques: T1016
Input: BADNEWS is capable of downloading additional files through C2 channels, including a new version of itself.

Tactics: TA0011
Techniques: T1105
Input: Limit access to the root account and prevent users from modifying protected components through proper privilege separation (ex SELinux, grsecurity, AppArmor, ) and limiting Privilege Escalation opportunities.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556
Input: RDP / Terminal Services (3389/TCP)

Tactics: TA0006
Techniques: T1110.004, T1110, T1110.001, T1110.003
Input: Skidmap has the ability to download, unpack, and decrypt tar.gz files .

Tactics: TA0005
Techniques: T1140
Input: Supply chain compromise can take place at any stage of the supply chain including:

Tactics: TA0001
Techniques: T1195
Input: Sandworm Team has created email accounts that mimic legitimate organizations for its spearphishing operations.

Tactics: TA0042
Techniques: T1585, T1585.002
Input: CARROTBALL has used a custom base64 alphabet to decode files.

Tactics: TA0005
Techniques: T1027
Input: Adversaries may target the Management Information Base (MIB) to collect and/or mine valuable information in a network managed using Simple Network Management Protocol (SNMP).

Tactics: TA0009
Techniques: T1602.001, T1602
Input: Dacls can encrypt its configuration file with AES CBC.

Tactics: TA0005
Techniques: T1027
Input: Lucifer can use WMI to log into remote machines for propagation.

Tactics: TA0002
Techniques: T1047
Input: Sykipot has been known to establish persistence by adding programs to the Run Registry key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Grandoreiro can use malicious browser extensions to steal cookies and other user information.

Tactics: TA0003
Techniques: T1176
Input: A Gamaredon Group file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.

Tactics: TA0009
Techniques: T1025
Input: ZxShell can disable the firewall by modifying the registry key HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: SHA256  a77f9e441415dbc8a20ad66d4d00ae606faab370ffaee5604e93ed484983d3ff   MD5 1ff40e79d673461cd33bd8b68f8bb5b8   Compiled 2017.08.06 11:32:36 (GMT), 2.22   Type I386 Windows Console EXE   Size 101 888    Instead of implementing this auxiliary module in the form of a dynamic linked library with its corresponding exported functions, the developers decided to use a standalone executable started by events.exe with the following parameters:    Parameter Description   -scr Screenshot file name to save in Cache006 subdirectory, zipped with password from configuration

Tactics: TA0005
Techniques: T1036
Input: Gamaredon Group has also decoded base64-encoded source code of a downloader.

Tactics: TA0005
Techniques: T1140
Input: Later variants of jRAT also incorporated AV evasion methods such as Java bytecode obfuscation via the commercial Allatori obfuscation tool.

Tactics: TA0005
Techniques: T1027
Input: Kwampirs establishes persistence by adding a new service with the display name "WMI Performance Adapter Extension" in an attempt to masquerade as a legitimate WMI service.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: The backdoors they are deploying are difficult to detect and a significant threat to the privacy and security of enterprises, allowing attackers to steal information, delete files, install malware, and more

Tactics: TA0005, TA0007
Techniques: T1070, T1518.001, T1518, T1070.004
Input: Launch Daemons require elevated privileges to install, are executed for every user on a system prior to login, and run in the background without the need for user interaction.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: BitPaymer can suppress UAC prompts by setting the HKCU\Software\Classes\ms-settings\shell\open\command registry key on Windows 10 or HKCU\Software\Classes\mscfile\shell\open\command on Windows 7 and launching the eventvwr.msc process, which launches BitPaymer with elevated privileges.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: If a domain within a forest is untrustworthy then it should not be a member of the forest.

Tactics: TA0004, TA0005
Techniques: T1134.005, T1134
Input: Psylo exfiltrates data to its C2 server over the same protocol as C2 communications.

Tactics: TA0010
Techniques: T1041
Input: Zebrocy gets the username from the system.

Tactics: TA0007
Techniques: T1033
Input: With authenticated access there are several tools that can be used to find permissions groups.

Tactics: TA0007
Techniques: T1069, T1069.003
Input: Equation is known to have the capability to overwrite the firmware on hard drives from some manufacturers.

Tactics: TA0003, TA0005
Techniques: T1542.002, T1542
Input: An adversary can send an attachment to a user through spearphishing that contains a resource link to an external server controlled by the adversary ( Template Injection), or place a specially crafted file on navigation path for privileged accounts ( .SCF file placed on desktop) or on a publicly accessible share to be accessed by victim(s).

Tactics: TA0006
Techniques: T1187
Input: These files allow system administrators to map and start custom services at startup for different run levels.

Tactics: TA0003, TA0004
Techniques: T1037.004, T1037
Input: IIS 7.0 introduced modules that provide the same unrestricted access to HTTP requests and responses as ISAPI extensions and filters.

Tactics: TA0003
Techniques: T1505.004, T1505
Input: Utility arguments and the binaries themselves should be monitored for changes.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: APT32's backdoor can exfiltrate data by encoding it in the subdomain field of DNS packets.

Tactics: TA0010
Techniques: T1048.003, T1048
Input: BISCUIT has a command to gather the username from the system.

Tactics: TA0007
Techniques: T1033
Input: It will terminate execution if it detects LANG_RUSSIAN, LANG_BELARUSIAN, LANG_KAZAK, or LANG_UKRAINIAN.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: Azorult can recursively search for files in folders and collects files from the desktop with certain extensions.

Tactics: TA0007
Techniques: T1083
Input: A Threat Group-3390 tool has created new Registry keys under HKEY_CURRENT_USER\Software\Classes\ and HKLM\SYSTEM\CurrentControlSet\services.

Tactics: TA0005
Techniques: T1112
Input: Patchwork has used watering holes to deliver files with exploits to initial victims.

Tactics: TA0001
Techniques: T1189
Input: APT28 has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Another difference in the network traffic generated from the malware is that the encoded proxy information has been added in the URL query values during the C2 communication

Tactics: TA0011
Techniques: T1132
Input: Koadic can enable remote desktop on the victim's machine.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Higaisa used an XSL file to run VBScript code.

Tactics: TA0005
Techniques: T1220
Input: FIN7 created new Windows services and added them to the startup directories for persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Process hollowing is commonly performed by creating a process in a suspended state then unmapping/hollowing its memory, which can then be replaced with malicious code.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: Adversaries may need to first employ other behaviors, such as File and Directory Permissions Modification or System Shutdown/Reboot, in order to unlock and/or gain access to manipulate these files.

Tactics: TA0040
Techniques: T1486
Input: GoldenSpy has used HTTP over ports 9005 and 9006 for network traffic, 9002 for C2 requests, 33666 as a WebSocket, and 8090 to download files.

Tactics: TA0011
Techniques: T1571