madox81/Adema_ATTACK_DS huggingface dataset:
Input: NDiskMonitor obtains the victim username and encrypts the information to send over its C2 channel.

Tactics: TA0007
Techniques: T1033
Input: POWERSOURCE is a PowerShell backdoor.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Operation Wocao has spawned a new cmd.exe process to execute commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Valak can execute tasks via OLE.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: P.A.S. Webshell can use encryption and base64 encoding to hide strings and to enforce access control once deployed.

Tactics: TA0005
Techniques: T1027
Input: Dust Storm has used Android backdoors capable of enumerating specific files on the infected devices.

Tactics: TA0007
Techniques: T1083
Input: An interesting note on these payloads is that all the Delphi payloads delivered in this campaign were packed with UPX, while none of the other payloads were packed

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Investigate usage of Kerberos Service Principal Names (SPNs), especially those associated with services (beginning with "GC/") by computers not present in the DC organizational unit (OU).

Tactics: TA0005
Techniques: T1207
Input: APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: MarkiRAT can search for different processes on a system.

Tactics: TA0007
Techniques: T1057
Input: AppleSeed has automatically collected data from USB drives, keystrokes, and screen images before exfiltration.

Tactics: TA0009
Techniques: T1119
Input: BendyBear has decrypted function blocks using a XOR key during runtime to evade detection.

Tactics: TA0005
Techniques: T1140
Input: Honeybee collects data from the local victim system.

Tactics: TA0009
Techniques: T1005
Input: Monitor executed commands and arguments to modify the authorized_keys or /etc/ssh/sshd_config files.

Tactics: TA0003
Techniques: T1098.004, T1098
Input: * RID 501 is the guest account.

Tactics: TA0006
Techniques: T1003, T1003.002
Input: Monitor file systems for moving, renaming, replacing, or modifying dylibs.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.004, T1574
Input: Pony has collected the Service Pack, language, and region information to send to the C2.

Tactics: TA0007
Techniques: T1082
Input: Lazarus Group has used WMIC for discovery as well as to execute payloads for persistence and lateral movement.

Tactics: TA0002
Techniques: T1047
Input: BLUELIGHT has exfiltrated data over its C2 channel.

Tactics: TA0010
Techniques: T1041
Input: One means, originally implemented by Cd00r , is to use the libpcap libraries to sniff for the packets in question.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205, T1205.001
Input: Adversaries may hijack domains and/or subdomains that can be used during targeting.

Tactics: TA0042
Techniques: T1584.001, T1584
Input: Adversaries may also install malicious IIS modules to observe and/or modify traffic.

Tactics: TA0003
Techniques: T1505.004, T1505
Input: (ex: locate all files with a specific extension, name, and/or age)

Tactics: TA0007
Techniques: T1083
Input: APT38 used a Trojan called KEYLIME to collect data from the clipboard.

Tactics: TA0009
Techniques: T1115
Input: GALLIUM dropped additional tools to victims during their operation, including portqry.exe, a renamed cmd.exe file, winrar, and HTRAN.

Tactics: TA0011
Techniques: T1105
Input: Adversaries may partially or completely overwrite the contents of a storage device rendering the data irrecoverable through the storage interface.

Tactics: TA0040
Techniques: T1561.001, T1561
Input: When the malicious ISAPI filter captures a username matching this variable, it knows to handle the incoming HTTP request as a command to the web shell

Tactics: TA0007
Techniques: T1033
Input: One example of this is powershell.exe -WindowStyle Hidden.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Chimera has used ipconfig, Ping, and tracert to enumerate the IP address and network environment and settings of the local host.

Tactics: TA0007
Techniques: T1016
Input: Common credential dumpers such as  Mimikatz access the LSA Subsystem Service (LSASS) process by opening the process, locating the LSA secrets key, and decrypting the sections in memory where credential details, including Kerberos tickets, are stored.

Tactics: TA0006
Techniques: T1558
Input: Digital certificate data may also be available from artifacts signed by the organization (ex: certificates used from encrypted web traffic are served with content).

Tactics: TA0043
Techniques: T1596, T1596.003
Input: PoisonIvy uses the Camellia cipher to encrypt communications.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: InstallUtil may not be necessary within a given environment.

Tactics: TA0005
Techniques: T1218, T1218.004
Input: NOKKI uses Base64 encoding for strings.

Tactics: TA0005
Techniques: T1027
Input: Octopus achieved persistence by placing a malicious executable in the startup directory and has added the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run key to the Registry.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Duqu creates a new service that loads a malicious driver when the system starts.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: On occasions, the phishing emails contained links to external domains to download the first stage, and sometimes the first stage was attached to the email itself

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Disable Wake-on-LAN if it is not needed within an environment.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205
Input: VBA is an event-driven programming language built into Microsoft Office, as well as several third-party applications.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: For example, ChangeServiceConfigW may be used by an adversary to prevent services from starting.

Tactics: TA0040
Techniques: T1489
Input: Bazar has the ability to identify domain administrator accounts.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery.

Tactics: TA0040
Techniques: T1491.001, T1491.002, T1561.001, T1491, T1485, T1561, T1490, T1561.002, T1486
Input: Reflectively loading payloads directly into memory may also avoid creating files or other artifacts on disk, while also enabling malware to keep these payloads encrypted (or otherwise obfuscated) until execution.

Tactics: TA0005
Techniques: T1620
Input: DarkWatchman reports window names along with keylogger information to provide application context.

Tactics: TA0007
Techniques: T1010
Input: Valak has downloaded a variety of modules and payloads to the compromised host, including IcedID and NetSupport Manager RAT-based malware.

Tactics: TA0011
Techniques: T1105
Input: Later versions have hard-coded keys uniquely for each C2 address.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Each web shell instance is configured to contain SP, Key, and Log variables

Tactics: TA0003
Techniques: T1505.003, T1505
Input: SLOTHFULMEDIA has created a service on victim machines named "TaskFrame" to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: FIN10 has relied on publicly-available software to gain footholds and establish persistence in victim environments.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: FIN8 has used a malicious framework designed to impersonate the lsass.exe/vmtoolsd.exe token.

Tactics: TA0004, TA0005
Techniques: T1134, T1134.001
Input: POORAIM has been delivered through compromised sites acting as watering holes.

Tactics: TA0001
Techniques: T1189
Input: FrameworkPOS can XOR credit card information before exfiltration.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: Lazarus Group has used a compromised router to serve as a proxy between a victim network's corporate and restricted segments.

Tactics: TA0011
Techniques: T1090.001, T1090
Input: Figure 3: CVE-2017-11882 and POWRUNER attack sequence  The malicious .rtf file exploits CVE-2017-11882

Tactics: TA0002
Techniques: T1203
Input: An adversary may passively wait for an ARP request to poison the ARP cache of the requesting device.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.002
Input: The dynamic loader will try to find the dylibs based on the sequential order of the search paths.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.004, T1574
Input: Assuming the victim opens the attachment, the infection process begins as described in the following section.Many of the distribution servers that are being used to host the HawkEye keylogger binaries that are retrieved during the infection process are hosting large numbers of malicious binaries and, in many cases, contain open directory listings that can be used to identify the scope of the infections that they are being used to facilitate

Tactics: TA0006, TA0007, TA0009
Techniques: T1057, T1056
Input: Acquiring a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers.

Tactics: TA0042
Techniques: T1583.003, T1583
Input: Windows event logs record user and system activity such as login attempts, process creation, and much more.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: Monitor executed commands and arguments associated with modifications to variables and files associated with loading shared libraries such as LD_PRELOAD on Linux and DYLD_INSERT_LIBRARIES on macOS.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.006, T1574
Input: By leveraging Patch System Image, adversaries can add custom code to the affected network devices that will implement onion routing between those nodes.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: Adversaries may search for common password storage locations to obtain user credentials.

Tactics: TA0006
Techniques: T1555
Input: MegaCortex has used the open-source library, Mbed Crypto, and generated AES keys to carry out the file encryption process.

Tactics: TA0040
Techniques: T1486
Input: Additional custom tools likely exist as well.

Tactics: TA0006
Techniques: T1003
Input: Monitor for newly executed processes that attempt to hide artifacts of an intrusion, such as common archive file applications and extensions (ex: Zip and RAR archive tools), and correlate with other suspicious behavior to reduce false positives from normal user and administrator behavior.

Tactics: TA0005
Techniques: T1140
Input: PoetRAT used voStro.exe, a compiled pypykatz (Python version of Mimikatz), to steal credentials.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Adversaries may also opt to encrypt and/or obfuscate these alternate channels.

Tactics: TA0010
Techniques: T1048
Input: APT32 has used Web shells to maintain access to victim websites.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: ZxShell can collect the local hostname, operating system details, CPU speed, and total physical memory.

Tactics: TA0007
Techniques: T1082
Input: MacSpy stores itself in ~/Library/.DS_Stores/

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may backdoor web servers with web shells to establish persistent access to systems.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: As part of Windows compatibility support for various character sets, rundll32.exe will first check for wide/Unicode then ANSI character-supported functions before loading the specified function (, given the command rundll32.exe ExampleDLL.dll, ExampleFunction, rundll32.exe would first attempt to execute ExampleFunctionW, or failing that ExampleFunctionA, before loading ExampleFunction).

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Commands under net user can be used in Net to gather information about and manipulate user accounts.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Olympic Destroyer overwrites files locally and on remote shares.

Tactics: TA0040
Techniques: T1485
Input: njRAT has used a fast flux DNS for C2 IP resolution.

Tactics: TA0011
Techniques: T1568.001, T1568
Input: Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: 4H RAT has the capability to obtain file and directory listings.

Tactics: TA0007
Techniques: T1083
Input: Fox Kitten has used a Perl reverse shell to communicate with C2.

Tactics: TA0002
Techniques: T1059
Input: Epic uses the tasklist /svc command to list the services on the system.

Tactics: TA0007
Techniques: T1007
Input: Gamaredon Group has used various batch scripts to establish C2 and download additional files.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Cardinal RAT establishes Persistence by setting the  HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load Registry key to point to its executable.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Ryuk has called GetIpNetTable in attempt to identify all mounted drives and hosts that have Address Resolution Protocol (ARP) entries.

Tactics: TA0007
Techniques: T1016
Input: Brave Prince gathers file and directory information from the victim’s machine.

Tactics: TA0007
Techniques: T1083
Input: Adversaries may attempt to gather information about the system language of a victim in order to infer the geographical location of that host.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: Dragonfly has used various forms of spearphishing in attempts to get users to open malicious attachments.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Okrum was seen using a RAR archiver tool to compress/decompress data.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: PoshC2 can utilize multiple methods to bypass UAC.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: In macOS, there are a few different malware samples that record the user's webcam such as FruitFly and Proton.

Tactics: TA0009
Techniques: T1125
Input: Sensitive data can be collected from remote systems via shared network drives (host shared directory, network file server, ) that are accessible from the current system prior to Exfiltration.

Tactics: TA0009
Techniques: T1039
Input: Kwampirs collects a list of active and listening connections by using the command netstat -nao as well as a list of available network mappings with net use.

Tactics: TA0007
Techniques: T1049
Input: RTM can attempt to run the program as admin, then show a fake error message and a legitimate UAC bypass prompt to the user in an attempt to socially engineer the user into escalating privileges.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Patchwork has used BITS jobs to download malicious payloads.

Tactics: TA0003, TA0005
Techniques: T1197
Input: It can also use GetDriveType to determine if a new drive is a CD-ROM drive.

Tactics: TA0007
Techniques: T1082
Input: QuietSieve can identify and search networked drives for specific file name extensions.

Tactics: TA0007
Techniques: T1135
Input: Most Sakula samples maintain persistence by setting the Registry Run key SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ in the HKLM or HKCU hive, with the Registry value and file name varying by sample.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Naikon has used administrator credentials for lateral movement in compromised networks.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.002
Input: TURNEDUP is capable of gathering system information.

Tactics: TA0007
Techniques: T1082
Input: Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi).

Tactics: TA0005
Techniques: T1218, T1218.007
Input: Egregor has used batch files for execution and can launch Internet Explorer from cmd.exe.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Sandworm Team have used previously acquired legitimate credentials prior to attacks.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: This is encrypted by RC4, using the key {0xb5, 0x78, 0x62, 0x52, 0x98, 0x3e, 0x24, 0xd7, 0x3b, 0xc6, 0xee, 0x7c, 0xb9, 0xed, 0x91, 0x62}

Tactics: TA0005
Techniques: T1027
Input: APT-C-36 has disguised its scheduled tasks as those used by Google.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: In Docker, adversaries may specify an entrypoint during container deployment that executes a script or command, or they may use a command such as docker exec to execute a command within a running container.

Tactics: TA0002
Techniques: T1609
Input: By using compromised infrastructure, adversaries may make it difficult to tie their actions back to them.

Tactics: TA0042
Techniques: T1584
Input: Filename  Part-I.doc    File Size  11349102 bytes    MD5  92942c54224cd462dd201ae11a560bb8    SHA1  85a21624df2211af3daf05c86a3fbea8271059d3    Notes Malicious RTF document that exploits CVE-2017-8570 and drops QuasarRAT file qrat.exe

Tactics: TA0005
Techniques: T1036
Input: Monitor changes made to cloud services for unexpected modifications to settings and/or data

Tactics: TA0005
Techniques: T1562.008, T1562
Input: These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely.

Tactics: TA0002
Techniques: T1059.002, T1059
Input: IronNetInjector has the ability to decrypt embedded .NET and PE payloads.

Tactics: TA0005
Techniques: T1140
Input: Identifying overlaps in malware use by different adversaries may indicate malware was obtained by the adversary rather than developed by them.

Tactics: TA0042
Techniques: T1588, T1588.001
Input: Monitor executed commands and arguments that may gather the victim's physical location(s) that can be used during targeting.

Tactics: TA0005
Techniques: T1480, T1480.001
Input: Monitor for newly executed processes of MSBuild.exe.

Tactics: TA0005
Techniques: T1127.001, T1127
Input: Kerrdown has gained execution through victims opening malicious files.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: In doing so, adversaries can hide the presence of malicious components and file input/output from security tools.

Tactics: TA0005
Techniques: T1564, T1564.005
Input: QUADAGENT uses HTTPS and HTTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Adversaries may manipulate products or product delivery mechanisms prior to receipt by a final consumer for the purpose of data or system compromise.

Tactics: TA0001
Techniques: T1195
Input: The group was observed installing Python 2.7 on a victim.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Tasks or services contain other fields, such as a description, that adversaries may attempt to make appear legitimate.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Gallmaker sent victims a lure document with a warning that asked victims to "enable content" for execution.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Events should then not be viewed in isolation, but as part of a chain of behavior that could lead to other activities such as the creation of one or more snapshots and the restoration of these snapshots by a new user account.In AWS, CloudTrail logs capture the creation of snapshots and all API calls for AWS Backup as events.

Tactics: TA0005
Techniques: T1578, T1578.001
Input: The locations:  For root user  path: /Library/CoreMediaIO/Plug-Ins/FCP-DAL/iOSScreenCapture.plugin/Contents/Resources/ processname: screenassistantd  For regular user  path: ~/Library/Spelling/ processname: spellagentd Subsequently, it implements the Loader::installLoader method, reading the hardcoded 64-bit Mach-O executable (magic value 0xFEEDFACF), and writing to the previously determined path and file

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Similar to Reaver as posted by Palo Alto, it gets the IP or domain of the C&C server, the port, name of the binary, a sleep timer, and what Palo Alto calls a “campaign identifier.” Technical Details At this moment, we were unable to retrieve the original infection vector and other information regarding what other tools the APT15 group is using to attack their targets

Tactics: TA0007
Techniques: T1016
Input: In Google Workspace this can be accomplished through the Google Admin console.

Tactics: TA0003
Techniques: T1098.002, T1098
Input: We mentioned earlier that due to the nature of the IE injection technique used by the HTTP-based backdoors, a number of C2 commands were cached to disk

Tactics: TA0011
Techniques: T1071
Input: SILENTTRINITY can inject shellcode directly into Excel.exe or a specific process.

Tactics: TA0004, TA0005
Techniques: T1055
Input: MirageFox can gather the username from the victim’s machine.

Tactics: TA0007
Techniques: T1033
Input: Cobalt Strike has the ability to use Smart Applet attacks to disable the Java SecurityManager sandbox.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: BADNEWS is sometimes signed with an invalid Authenticode certificate in an apparent effort to make it look more legitimate.

Tactics: TA0005
Techniques: T1036, T1036.001
Input: Bandook has used PowerShell loaders as part of execution.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Flagpro has been used to execute the net localgroup administrators command on a targeted system.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: DarkComet can use HTTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Bandook can detect USB devices.

Tactics: TA0007
Techniques: T1120
Input: HOPLIGHT has the ability to connect to a remote host in order to upload and download files.

Tactics: TA0011
Techniques: T1105
Input: SharePoint will often contain useful information for an adversary to learn about the structure and functionality of the internal network and systems.

Tactics: TA0009
Techniques: T1213, T1213.002
Input: The group has used an exploit toolkit known as Threadkit that launches .bat files.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: It contains functionality to acquire information about credentials in many ways, including from DPAPI.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Hydraq creates a backdoor through which remote attackers can monitor processes.

Tactics: TA0007
Techniques: T1057
Input: When preforming PtT, valid Kerberos tickets for Valid Accounts are captured by OS Credential Dumping.

Tactics: TA0005, TA0008
Techniques: T1550.003, T1550
Input: An adversary can use built-in Windows API functions to copy access tokens from existing processes; this is known as token stealing.

Tactics: TA0004, TA0005
Techniques: T1134
Input: Malware used by Group5 is capable of watching the victim's screen.

Tactics: TA0009
Techniques: T1113
Input: The script is used to decode and execute the following payloads:Appach01.jpg (renamed: Windows-KB275122-x86.exe) is a Freenki sample.Appach01.jpg (renamed: Windows-KB271854-x86.exe) is a PoohMilk sample.PoohMilk AnalysisThe PoohMilk sample is designed to perform two actions:Create persistence to execute the Freenki sample at the next reboot.Check specific files on the infected machine.The first action is to create a registry key in order to execute the Windows-KB275122-x86.exe file previously downloaded

Tactics: TA0002
Techniques: T1106
Input: Zebrocy scans the system and automatically collects files with the following extensions: .doc, .docx, ,.xls, .xlsx, .pdf, .pptx, .rar, .zip, .jpg, .jpeg, .bmp, .tiff, .kum, .tlg, .sbx, .cr, .hse, .hsf, and .lhz.

Tactics: TA0009
Techniques: T1119
Input: Andariel has exploited numerous ActiveX vulnerabilities, including zero-days.

Tactics: TA0002
Techniques: T1203
Input: SILENTTRINITY can modify registry keys, including to enable or disable Remote Desktop Protocol (RDP).

Tactics: TA0005
Techniques: T1112
Input: RedLeaves can enumerate and search for files and directories.

Tactics: TA0007
Techniques: T1083
Input: Enumeration of COM objects, via Query Registry or PowerShell, may also proceed malicious use.

Tactics: TA0002
Techniques: T1559, T1559.001