madox81/Adema_ATTACK_DS huggingface dataset:
Input: A variation on this behavior takes advantage of differences in functionality across cloud regions.

Tactics: TA0005
Techniques: T1535
Input: Monitor for API calls associated with the use of device drivers and/or provided by SMART (Self-Monitoring, Analysis and Reporting Technology)   disk monitoring may reveal malicious manipulations of components.

Tactics: TA0003, TA0005
Techniques: T1542.002, T1542
Input: Information about victims may be available in online databases and repositories, such as registrations of domains/certificates as well as public collections of network data/artifacts gathered from traffic and/or scans.

Tactics: TA0043
Techniques: T1596
Input: For example, PowerShell versions 5+ includes Script Block Logging (SBL) which can record executed script content.

Tactics: TA0005
Techniques: T1562.010, T1562
Input: OopsIE uses WMI to perform discovery techniques.

Tactics: TA0002
Techniques: T1047
Input: The physical medium or device could be used as the final exfiltration point or to hop between otherwise disconnected systems.

Tactics: TA0010
Techniques: T1052
Input: menuPass has used and modified open-source tools like Impacket, Mimikatz, and pwdump.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Monitor for processes, such as certmgr.exe (macOS) or certutil.exe (Windows), that can be used to install root certificates.

Tactics: TA0005
Techniques: T1553, T1553.004
Input: Patchwork has created self-signed certificates from fictitious and spoofed legitimate software companies that were later used to sign malware.

Tactics: TA0042
Techniques: T1587.002, T1587
Input: Adversaries may breach or otherwise leverage organizations who have access to intended victims.

Tactics: TA0001
Techniques: T1199
Input: Run path dependent libraries can include LC_LOAD_DYLIB, LC_LOAD_WEAK_DYLIB, and LC_RPATH.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.004, T1574
Input: Emissary has the capability to download files from the C2 server.

Tactics: TA0011
Techniques: T1105
Input: jRAT can query and kill system processes.

Tactics: TA0007
Techniques: T1057
Input: QakBot has the ability to modify the Registry to add its binaries to the Windows Defender exclusion list.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: ZxShell has a command, ps, to obtain a listing of processes on the system.

Tactics: TA0007
Techniques: T1057
Input: The purchase of code signing certificates may be done using a front organization or using information stolen from a previously compromised entity that allows the adversary to validate to a certificate provider as that entity.

Tactics: TA0042
Techniques: T1588, T1588.003
Input: These payloads will need to be compiled before execution; typically via native utilities such as csc.exe or GCC/MinGW.

Tactics: TA0005
Techniques: T1027.004, T1027
Input: Executables tagged with the MOTW will be processed by Windows Defender SmartScreen that compares files with an allowlist of well-known executables.

Tactics: TA0005
Techniques: T1553, T1553.005
Input: Making the environment variables associated with command history read only may ensure that the history is preserved.

Tactics: TA0005
Techniques: T1070, T1070.003
Input: Gorgon Group malware can attempt to disable security features in Microsoft Office and Windows Defender using the taskkill command.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Adversaries may include the vulnerable driver with files delivered during Initial Access or download it to a compromised system via Ingress Tool Transfer or Lateral Tool Transfer.

Tactics: TA0004
Techniques: T1068
Input: Execution via PE injection may also evade detection from security products since the execution is masked under a legitimate process.

Tactics: TA0004, TA0005
Techniques: T1055.002, T1055
Input: Information about network security appliances may include a variety of details, such as the existence and specifics of deployed firewalls, content filters, and proxies/bastion hosts.

Tactics: TA0043
Techniques: T1590, T1590.006
Input: A version of XTunnel introduced in July 2015 obfuscated the binary using opaque predicates and other techniques in a likely attempt to obfuscate it and bypass security products.

Tactics: TA0005
Techniques: T1027
Input: BLUELIGHT has encoded data into a binary blob using XOR.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: CoinTicker downloads the following hidden files to evade detection and maintain persistence: /private/tmp/.info.enc, /private/tmp/.info.py, /private/tmp/.server.sh, ~/Library/LaunchAgents/.espl.plist, ~/Library/Containers/.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Victim Registration SpeakUp uses POST and GET requests over HTTP to communicate with its main C&C which is the compromised website of speakupomaha[.]com

Tactics: TA0011
Techniques: T1071
Input: Based on the application, this could result in privilege escalation and uninhibited network access.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.004, T1574
Input: Blue Mockingbird has used wmic.exe and Windows Registry modifications to set the COR_PROFILER environment variable to execute a malicious DLL whenever a process loads the .NET CLR.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.012, T1574
Input: Information about assigned IP addresses may also be exposed to adversaries via online or other accessible data sets (ex: Search Open Technical Databases).

Tactics: TA0043
Techniques: T1590, T1590.005
Input: BoomBox can encrypt data using AES prior to exfiltration.

Tactics: TA0005
Techniques: T1027
Input: Aria-body has the ability to identify the hostname, computer name, Windows version, processor speed, machine GUID, and disk information on a compromised host.

Tactics: TA0007
Techniques: T1082
Input: They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key.

Tactics: TA0040
Techniques: T1486
Input: Activity originating from unexpected sources may indicate improper permissions are set and are allowing access to data.

Tactics: TA0009
Techniques: T1530
Input: APT1 has sent spearphishing emails containing malicious attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: msxsl.exe customers[.]xml script[.]xsl

Tactics: TA0005
Techniques: T1220
Input: This simply acts as cleanup to ensure original file artifacts no longer reside on the infected machine

Tactics: TA0005
Techniques: T1070
Input: Firstly, the Trojan will use the following regular expression to determine if the C2 server wishes to cancel the C2 communications:       216.58.192.174|2a00:1450:4001:81a::200e|2200::|download.microsoft.com|ntservicepack.microsoft.com|windowsupdate.microsoft.com|update.microsoft.com     Additionally, the RogueRobin Trojan uses the regular expressions in Table 3 to confirm that the DNS response contains the appropriate data for it to extract information from

Tactics: TA0011
Techniques: T1102
Input: Depending on the technique for gathering target-specific values, reverse engineering of the encrypted payload can be exceptionally difficult.

Tactics: TA0005
Techniques: T1480, T1480.001
Input: If a search order-vulnerable program is configured to run at a higher privilege level, then the adversary-controlled DLL that is loaded will also be executed at the higher level.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574
Input: Dyre decrypts resources needed for targeting the victim.

Tactics: TA0005
Techniques: T1140
Input: msxsl.exe script[.]xsl script[.]xsl

Tactics: TA0005
Techniques: T1220
Input: The malware component, test.exe, uses the Windows command "cmd.exe" /C whoami” to verify it is running with the elevated privileges of “System” and creates persistence by creating the following scheduled task:     schtasks /create /tn "mysc" /tr C:\Users\Public\test.exe /sc ONLOGON     /ru "System" When executed, the malware first establishes a SOCKS5 connection to 192.157.198.103 using TCP port 1913

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Remsec has a plugin that can perform ARP scanning as well as port scanning.

Tactics: TA0007
Techniques: T1046
Input: EnvyScout can use cmd.exe to execute malicious files on compromised hosts.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Monitor use of HTA files.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: Bazar can fingerprint architecture, computer name, and OS version on the compromised host.

Tactics: TA0007
Techniques: T1082
Input: -list /Groups on macOS, and groups on Linux can list local groups.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: We are unsure of the shellcode hosted at this URL, but it is possible that additional shellcode-based payloads like Meterpreter could have been served by this shellcode

Tactics: TA0002, TA0011
Techniques: T1105, T1059
Input: Catchamas captures screenshots based on specific keywords in the window’s title.

Tactics: TA0009
Techniques: T1113
Input: Grandoreiro can decrypt its encrypted internal strings.

Tactics: TA0005
Techniques: T1140
Input: SombRAT can use a legitimate process name to hide itself.

Tactics: TA0005
Techniques: T1036
Input: InvisiMole has a command to disable routing and the Firewall on the victim’s machine.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: Types of attacks possibly averted include Structured Query Language (SQL) injection, cross-site scripting, and command injection.Use stringent file reputation settings – Tune the file reputation systems of your anti-virus software to the most aggressive setting possible

Tactics: TA0007
Techniques: T1518.001, T1518
Input: The libraries can be linked against when compiling, while the utilities require spawning a subshell, or a similar execution mechanism.

Tactics: TA0009
Techniques: T1560.002, T1560
Input: Operation Wocao has used the time command to retrieve the current time of a compromised system.

Tactics: TA0007
Techniques: T1124
Input: Gathering this information may reveal opportunities for other forms of reconnaissance (ex: Search Open Technical Databases or Search Open Websites/Domains), establishing operational resources (ex: Develop Capabilities or Obtain Capabilities), and/or initial access (ex: External Remote Services).

Tactics: TA0043
Techniques: T1590, T1590.006
Input: The loader may also have backup first-stage callbacks or Fallback Channels in case the original first-stage communication path is discovered and blocked.

Tactics: TA0011
Techniques: T1104
Input: Adversaries may employ various system checks to detect and avoid virtualization and analysis environments.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: It is difficult to detect when hashes are cracked, since this is generally done outside the scope of the target network. (ex: Windows EID 4625 or 5379)

Tactics: TA0006
Techniques: T1110, T1110.001
Input: APT41 compromised an online billing/payment service using VPN access between a third-party service provider and the targeted payment service.

Tactics: TA0001, TA0003
Techniques: T1133
Input: Tropic Trooper delivered malicious documents with the XLSX extension, typically used by OpenXML documents, but the file itself was actually an OLE (XLS) document.

Tactics: TA0005
Techniques: T1221
Input: Penquin can execute the command code do_download to retrieve remote files from C2.

Tactics: TA0011
Techniques: T1105
Input: Monitor the file system and shell commands for files being created with a leading "."

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Kerrdown can encrypt, encode, and compress multiple layers of shellcode.

Tactics: TA0005
Techniques: T1027
Input: FIN8 has distributed targeted emails containing Word documents with embedded malicious macros.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Monitor contextual data about a running process, which may include information such as environment variables, image name, user/owner that may bypass UAC mechanisms to elevate process privileges on system.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: Command   Description    0x31  Fingerprint System via WMI and Registry    0x32  Drop File and execute    0x33  Remote Shell    0x34  Terminate connection with C2    0x35  Download and run batch script    0x36  Download file on machine    0x37  Upload File    Table 2: FELIXROOT backdoor commands Figure 9 shows the log message decrypted from memory using the same mechanism shown in Figure 6 and Figure 7 for every command executed

Tactics: TA0002, TA0011
Techniques: T1105, T1059
Input: FIN4 has used spearphishing emails containing attachments (which are often stolen, legitimate documents sent from compromised accounts) with embedded malicious macros.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Modifying the DLL and Function Registry values in HKLM\SOFTWARE[WOW6432Node]Microsoft\Cryptography\Providers\Trust\FinalPolicy{trust provider GUID} that point to the DLL providing a trust provider’s FinalPolicy function, which is where the decoded and parsed signature is checked and the majority of trust decisions are made. Similar to hijacking SIP’s CryptSIPDllVerifyIndirectData function, this value can be redirected to a suitable exported function from an already present DLL or a maliciously-crafted DLL (though the implementation of a trust provider is complex).

Tactics: TA0005
Techniques: T1553, T1553.003
Input: SysUpdate can manage services and processes.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Gallmaker obfuscated shellcode used during execution.

Tactics: TA0005
Techniques: T1027
Input: One variant of CloudDuke uses a Microsoft OneDrive account to exchange commands and stolen data with its operators.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: Gamaredon Group tools have contained an application to check performance of USB flash drives.

Tactics: TA0007
Techniques: T1120
Input: In this latest campaign, APT34 leveraged the recent Microsoft Office vulnerability CVE-2017-11882 to deploy POWRUNER and BONDUPDATER

Tactics: TA0002
Techniques: T1203
Input: Ixeshe can achieve persistence by adding itself to the HKCU\Software\Microsoft\Windows\CurrentVersion\Run Registry key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: QakBot can use net share to identify network shares for use in lateral movement.

Tactics: TA0007
Techniques: T1135
Input: SombRAT can execute loadfromfile, loadfromstorage, and loadfrommem to inject a DLL  from disk, storage, or memory respectively.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Monitor for newly executed processes with arguments that may try to get information about registered services.

Tactics: TA0007
Techniques: T1007
Input: pwdump can be used to dump credentials from the SAM.

Tactics: TA0006
Techniques: T1003, T1003.002
Input: Dtrack contains a function that calls LoadLibrary and GetProcAddress.

Tactics: TA0002
Techniques: T1129
Input: powershell.exe -exec Bypass -c $s=(get-content C:\\ProgramData\\WindowsDefenderService.ini);$d = @();$v = 0;$c = 0;while($c -ne $s.length){$v=($v*52)+([Int32][char]$s[$c]-40);if((($c+1)%3) -eq 0){while($v -ne 0){$vv=$v%256;if($vv -gt 0){$d+=[char][Int32]$vv}$v=[Int32]($v/256)}}$c+=1;};[array]::Reverse($d);iex([String]::Join(”,$d));  PowerShell one-liner Encoded text file Execution flow:  Case 2: VBS and text files dropped by the macro The VBS file decodes itself and calls mshta.exe, passing on one line of VBScript code to it, which in turn spawns a PowerShell one-liner which finally consumes the text file (usually Base64-encoded text)

Tactics: TA0002, TA0005
Techniques: T1140, T1036, T1059.001, T1059
Input: Cookies are often valid for an extended period of time, even if the web application is not actively used.

Tactics: TA0005, TA0006, TA0008
Techniques: T1550.004, T1539, T1550
Input: Installed root certificates are located in the Registry under HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\ and [HKLM or HKCU]\Software[\Policies]\Microsoft\SystemCertificates\Root\Certificates\.

Tactics: TA0005
Techniques: T1553, T1553.004
Input: Exaramel for Windows automatically encrypts files before sending them to the C2 server.

Tactics: TA0009
Techniques: T1560
Input: In total, nearly 13,000 sets of credentials are included in the data dump

Tactics: TA0006
Techniques: T1003
Input: Cadelspy initially arrives on the computer as a dropper, which downloads two installer components catering to whether the victim is running a 32-bit or 64-bit system

Tactics: TA0007
Techniques: T1082
Input: Silent Librarian has set up auto forwarding rules on compromised e-mail accounts.

Tactics: TA0009
Techniques: T1114, T1114.003
Input: Ursnif droppers have used PowerShell in download cradles to download and execute the malware's full executable payload.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Pupy uses PowerView and Pywerview to perform discovery commands such as net user, net group, net local group,

Tactics: TA0007
Techniques: T1087, T1087.001
Input: StrongPity has been signed with self-signed certificates.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: If it does, then malware can execute sudo commands without needing to supply the user's password.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: Kwampirs downloads additional files from C2 servers.

Tactics: TA0011
Techniques: T1105
Input: Adversaries can interact with the DACLs using built-in Windows commands, such as icacls, cacls, takeown, and attrib, which can grant adversaries higher permissions on specific files and folders.

Tactics: TA0005
Techniques: T1222, T1222.001
Input: Aria-body has the ability to gather metadata from a file and to search for file and directory names.

Tactics: TA0007
Techniques: T1083
Input: ComRAT has been programmed to sleep outside local business hours (9 to 5, Monday to Friday).

Tactics: TA0010
Techniques: T1029
Input: When entered, these credentials are then sent to the C2 server, which allows DarkHydrus to collect the user account credentials

Tactics: TA0006
Techniques: T1003
Input: SPACESHIP identifies files and directories for collection by searching for specific file extensions or file modification time.

Tactics: TA0007
Techniques: T1083
Input: Depending on the method used to pad files, a file-based signature may be capable of detecting padding using a scanning or on-access based tool.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: Kobalos can record the hostname and kernel version of the target machine.

Tactics: TA0007
Techniques: T1082
Input: A typical example of this is environments where internal networks make use of non-Internet routable addresses.

Tactics: TA0005
Techniques: T1599, T1599.001
Input: The group also used GitHub as a repository for tools that it downloaded post-compromise.

Tactics: TA0011
Techniques: T1102
Input: Adversaries may search DNS data for information about victims that can be used during targeting.

Tactics: TA0043
Techniques: T1596, T1596.001
Input: Cardinal RAT can collect the hostname, Microsoft Windows version, and processor architecture from a victim machine.

Tactics: TA0007
Techniques: T1082
Input: Monitor for PowerShell commands such as: Update-MSOLFederatedDomain –DomainName: "Federated Domain Name", or Update-MSOLFederatedDomain –DomainName: "Federated Domain Name" –supportmultipledomain.

Tactics: TA0004, TA0005
Techniques: T1484, T1484.002
Input: An adversary may also be able to escalate privileges if a script in a PowerShell profile is loaded and executed by an account with higher privileges, such as a domain administrator.

Tactics: TA0003, TA0004
Techniques: T1546.013, T1546
Input: FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Spearphishing via service is a specific variant of spearphishing.

Tactics: TA0001
Techniques: T1566.003, T1566
Input: njRAT can read specific registry values.

Tactics: TA0007
Techniques: T1012
Input: HELLOKITTY can delete volume shadow copies on compromised hosts.

Tactics: TA0040
Techniques: T1490
Input: BackConfig has hidden malicious payloads in %USERPROFILE%\Adobe\Driver\dwg\ and mimicked the legitimate DHCP service binary.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: These infections may target both binary and non-binary formats that end with extensions including, but not limited to, .EXE, .DLL, .SCR, .BAT, and/or .VBS.

Tactics: TA0008
Techniques: T1080
Input: MarkiRAT can modify the shortcut that launches Telegram by replacing its path with the malicious payload to launch with the legitimate executable.

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Dyre uses HTTPS for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Monitor files (especially those downloaded from untrusted locations) for MOTW attributes.

Tactics: TA0005
Techniques: T1553, T1553.005
Input: Aquatic Panda has used WinRAR to compress memory dumps prior to exfiltration.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Dok prompts the user for credentials.

Tactics: TA0006, TA0009
Techniques: T1056.002, T1056
Input: WellMess can collect the username on the victim machine to send to C2.

Tactics: TA0007
Techniques: T1033
Input: Some data is also base64-encoded.

Tactics: TA0005
Techniques: T1027
Input: Use of encryption provides an added layer of security to sensitive information sent over email.

Tactics: TA0009
Techniques: T1114, T1114.002, T1114.001, T1114.003
Input: The typical server-client interaction is as follows:

Tactics: TA0006, TA0009
Techniques: T1557, T1557.003
Input: Ramsay can insert itself into the address space of other applications using the AppInit DLL Registry key.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.010
Input: Neoichor can collect the OS version and computer name from a compromised host.

Tactics: TA0007
Techniques: T1082
Input: It may be possible to detect or prevent the installation of these tools with host-based solutions.

Tactics: TA0011
Techniques: T1219
Input: Lazarus Group has compromised legitimate domains, including those hosted in the US and Italy, for C2.

Tactics: TA0042
Techniques: T1584.001, T1584
Input: The SHA256 hash is then base64 encoded, which results in an encoded string of EfZrVfPSQwNiHl75VlsCpXbMWLxfh4nK6Ww9QABkuQ4=, of which the first 24 characters are used as the 3DES key

Tactics: TA0005, TA0011
Techniques: T1132, T1027
Input: Use the -No Profile flag with when executing PowerShell scripts remotely to prevent local profiles and scripts from being executed.

Tactics: TA0003, TA0004
Techniques: T1546.013, T1546
Input: Adversaries may buy, lease, or rent physical servers that can be used during targeting.

Tactics: TA0042
Techniques: T1583.004, T1583
Input: PoshC2 contains multiple modules for injecting into processes, such as Invoke-PSInject.

Tactics: TA0004, TA0005
Techniques: T1055
Input: PlugX can be configured to use raw TCP or UDP for command and control.

Tactics: TA0011
Techniques: T1095
Input: Kwampirs collects a list of network shares with the command net share.

Tactics: TA0007
Techniques: T1135
Input: This file contains information about the infected system and activity logs.

Tactics: TA0010
Techniques: T1052, T1052.001
Input: Threat Group-3390 has used whoami to collect system user information.

Tactics: TA0007
Techniques: T1033
Input: JHUHUGIT uses a .bat file to execute a .dll.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Alternate authentication material may also be generated during the identity creation process.

Tactics: TA0005, TA0008
Techniques: T1550
Input: Adversaries may use their own certificates in an attempt to intercept HTTPS traffic.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.002
Input: Use multi-factor authentication.

Tactics: TA0006
Techniques: T1110.004, T1110, T1110.002, T1110.001, T1110.003
Input: Caterpillar WebShell can gather a list of processes running on the machine.

Tactics: TA0007
Techniques: T1057
Input: Diavol can delete specified files from a targeted system.

Tactics: TA0040
Techniques: T1485
Input: Threat Group-3390 has exploited MS17-010 to move laterally to other systems on the network.

Tactics: TA0008
Techniques: T1210