madox81/Adema_ATTACK_DS huggingface dataset:
Input: A variant of Zebrocy captures screenshots of the victim’s machine in JPEG and BMP format.

Tactics: TA0009
Techniques: T1113
Input: Tools such as Sysinternals Autoruns may also be used to detect system service changes that could be attempts at persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Dridex contains a module for VNC.

Tactics: TA0011
Techniques: T1219
Input: In versions of macOS prior to 10.14, an adversary can escalate an SSH session to an ARD session which enables an adversary to accept TCC (Transparency, Consent, and Control) prompts without user interaction and gain access to data.

Tactics: TA0008
Techniques: T1021
Input: APT3 has been known to remove indicators of compromise from tools.

Tactics: TA0005
Techniques: T1027, T1027.005
Input: This includes compression applications, such as those for zip files, that can be used to Deobfuscate/Decode Files or Information in payloads.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: WellMail has been observed using TCP port 25, without using SMTP, to leverage an open port for secure command and control communications.

Tactics: TA0011
Techniques: T1571
Input: Private cryptographic keys and certificates are used for authentication, encryption/decryption, and digital signatures.

Tactics: TA0006
Techniques: T1552.004, T1552
Input: In each iteration of the communications loop, the Trojan will check to see if the modification time of the first file changed, and if it is not updated the Trojan will update the second file by writing the string b<unique identifier>c<5 random lowercase characters>.<C2 domain> to the file by creating an HTTP POST request to a URL structured as follows: <Google Drive URL in ‘gdue’> + <second file identifier> + “?supportsTeamDrive=true&uploadType=resumable&fields=kind,id,name,mimeType,parents” In one RogueRobin sample (SHA256: f1b2bc0831…), the author did not use the Google Drive URL provided by the actor when issuing the x_mode command, and instead included a  hardcoded Google Drive URL, as seen in Figure 6

Tactics: TA0011
Techniques: T1105, T1102
Input: Usage of a resource fork is identifiable when displaying a file’s extended attributes, using ls -l@ or xattr -l commands.

Tactics: TA0005
Techniques: T1564, T1564.009
Input: Command monitoring may reveal malicious attempts to modify trust settings, such as the installation of root certificates or modifications to trust attributes/policies applied to files.

Tactics: TA0005
Techniques: T1553
Input: Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1134.004, T1134
Input: Sakula encodes C2 traffic with single-byte XOR keys.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: FIN6 has created Windows services to execute encoded PowerShell commands.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Monitor executed commands and arguments for actions that could be taken to collect internal data.

Tactics: TA0009
Techniques: T1119
Input: Ebury has used user mode rootkit techniques to remain hidden on the system.

Tactics: TA0005
Techniques: T1014
Input: APT29 has used spearphishing with a link to trick victims into clicking on a link to a zip file containing malicious files.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Monitor for changes to Registry keys associated with ServiceDll and other subkey values under HKLM\System\CurrentControlSet\services\TermService\Parameters\.

Tactics: TA0003
Techniques: T1505.005, T1505
Input: APT32 has conducted targeted surveillance against activists and bloggers.

Tactics: TA0043
Techniques: T1589
Input: In particular, the threat actors have exploited CVE-2011-3544, a vulnerability in the Java Runtime Environment, to deliver the HttpBrowser backdoor; and CVE-2010-0738, a vulnerability in JBoss, to compromise internally and externally accessible assets used to redirect users' web browsers to exploit code

Tactics: TA0002, TA0004
Techniques: T1203, T1068
Input: A Turla JavaScript backdoor has used Google Apps Script as its C2 server.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: BADCALL uses a FakeTLS method during C2.

Tactics: TA0011
Techniques: T1001, T1001.003
Input: SHOTPUT has a command to obtain a directory listing.

Tactics: TA0007
Techniques: T1083
Input: Operation Wocao has used a script to collect information about the infected system.

Tactics: TA0009
Techniques: T1119
Input: Derusbi injects itself into the secure shell (SSH) process.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Derusbi obfuscates C2 traffic with variable 4-byte XOR keys.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Similar to debuggers, silent exit monitoring can be enabled through GFlags and/or by directly modifying IFEO and silent process exit Registry values in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SilentProcessExit\.

Tactics: TA0003, TA0004
Techniques: T1546.012, T1546
Input: “Knock” also appears in several strings inside the code of SpeakUp

Tactics: TA0005
Techniques: T1140
Input: Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing a link to malicious content hosted on an uncommon Web server.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Note that IP addresses can be reallocated

Tactics: TA0007
Techniques: T1016
Input: Bisonal has encoded binary data with Base64 and ASCII.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Nomadic Octopus used cmd.exe /c within a malicious macro.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: CosmicDuke copies and exfiltrates the clipboard contents every 30 seconds.

Tactics: TA0009
Techniques: T1115
Input: It is likely that these utilities will be used by software developers or for other software development related tasks, so if it exists and is used outside of that context, then the event may be suspicious.

Tactics: TA0005
Techniques: T1127
Input: BADFLICK can decode shellcode using a custom rotating XOR cipher.

Tactics: TA0005
Techniques: T1140
Input: Windshift has also attempted to hide executables by changing the file extension to ".scr" to mimic Windows screensavers.

Tactics: TA0005
Techniques: T1036
Input: DarkWatchman has been observed deleting its original launcher after installation.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: and the Windows command-line use of attrib.exe to add the hidden attribute.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Lokibot has performed a time-based anti-debug check before downloading its third stage.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Wizard Spider has collected and staged credentials and network enumeration information, using  the networkdll and psfin TrickBot modules.

Tactics: TA0009
Techniques: T1074
Input: QakBot can conduct brute force attacks to capture credentials.

Tactics: TA0006
Techniques: T1110
Input: Turla has used legitimate web services including Pastebin, Dropbox, and GitHub for C2 communications.

Tactics: TA0011
Techniques: T1102
Input: Infected computers become part of a P2P botnet that can relay C2 traffic to other infected peers.

Tactics: TA0011
Techniques: T1090
Input: Bundlore has used openssl to decrypt AES encrypted payload data.

Tactics: TA0005
Techniques: T1140
Input: Monitor for changes made to files that may establish persistence and/or elevate privileges by executing malicious content triggered by application shims.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.011
Input: Sandworm Team's BCS-server tool can create an internal proxy server to redirect traffic from the adversary-controlled C2 to internal servers which may not be connected to the internet, but are interconnected locally.

Tactics: TA0011
Techniques: T1090
Input: Mosquito’s installer is obfuscated with a custom crypter to obfuscate the installer.

Tactics: TA0005
Techniques: T1027
Input: System settings can prevent applications from running that haven't been downloaded through the Apple Store which can help mitigate some of these issues.

Tactics: TA0005
Techniques: T1553.001, T1553
Input: SILENTTRINITY can conduct an image hijack of an .msc file extension as part of its UAC bypass process.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.001
Input: Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.

Tactics: TA0011
Techniques: T1571
Input: Monitor for events associated with scripting execution, such as the loading of modules associated with scripting languages (ex: JScript.dll or vbscript.dll).

Tactics: TA0002
Techniques: T1059
Input: Comnie uses blogs and third-party sites (GitHub, tumbler, and BlogSpot) to avoid DNS-based blocking of their communication to the command and control server.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: APT28 has retrieved internal documents from machines inside victim environments, including by using Forfiles to stage documents before exfiltration.

Tactics: TA0009
Techniques: T1005
Input: Empire can ZIP directories on the target system.

Tactics: TA0009
Techniques: T1560
Input: Monitor for changes made to the firmware for unexpected modifications to settings and/or data.

Tactics: TA0040
Techniques: T1495
Input: Monitor for unexpected processes interacting with LSASS.exe.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Machete used the startup folder for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Detection methods could include collecting information from unusual processes using API calls used to obtain image data, and monitoring for image files written to disk, such as CopyFromScreen, xwd, or screencapture..

Tactics: TA0009
Techniques: T1113
Input: The APT1 group is known to have used RDP during operations.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Look for changes to service Registry entries that do not correlate with known software, patch cycles,  Service information is stored in the Registry at HKLM\SYSTEM\CurrentControlSet\Services.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Orangeworm has copied its backdoor across open network shares, including ADMIN$, C$WINDOWS, D$WINDOWS, and E$WINDOWS.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: Bisonal's DLL file and non-malicious decoy file are encrypted with RC4 and some function name strings are obfuscated.

Tactics: TA0005
Techniques: T1027
Input: Configuration data used by Rising Sun is encrypted using RC4.

Tactics: TA0005
Techniques: T1027
Input: Unknown Logger has functionality to disable security tools, including Kaspersky, BitDefender, and MalwareBytes.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Also, monitor for significant changes to any path pointers in a modified plist.

Tactics: TA0005
Techniques: T1647
Input: down_new has the ability to list running processes on a compromised host.

Tactics: TA0007
Techniques: T1057
Input: Operation Wocao has collected a list of running processes on the infected system.

Tactics: TA0007
Techniques: T1057
Input: In some cases a local DNS sinkhole may be used to help prevent DGA-based command and control at a reduced cost.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: Threat Group-3390 actors look for and use VPN profiles during an operation to access the network using external VPN services.

Tactics: TA0001, TA0003
Techniques: T1133
Input: Several Ke3chang backdoors achieved persistence by adding a Run key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Gazer injects its communication module into an Internet accessible process through which it performs C2.

Tactics: TA0004, TA0005
Techniques: T1055
Input: For example, having users enter a one-time code provided by the login screen into the 2FA/MFA application or utilizing other out-of-band 2FA/MFA mechanisms (such as rotating code-based hardware tokens providing rotating codes that need an accompanying user pin) may be more secure.

Tactics: TA0006
Techniques: T1621
Input: 11 bytes of this buffer are encrypted with the XOR algorithm as follows: i = 0 while ( 1 ) {   crypted_buffer = (_BYTE *)this_->crypted_buffer;   if ( i gt;= this-gt;crypted_buffer_size - 4 ) // this-gt;crypted_buffer_size == 15     break;   ++i;   crypted_buffer[i + 4] ^= crypted_buffer[i & 3];  The generated buffer in encoded using the BASE64 alphabet, where the last two characters are replaced with “-” and “_”

Tactics: TA0005
Techniques: T1027
Input: menuPass has attempted to get victims to open malicious files such as Windows Shortcuts (.lnk) and/or Microsoft Office documents, sent via email as part of spearphishing campaigns.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: After execution of every task, the malware sleeps for one minute before executing the next task

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Manipulation of source code in open-source dependencies

Tactics: TA0001
Techniques: T1195
Input: Winnti for Windows can use Native API to create a new process and to start services.

Tactics: TA0002
Techniques: T1106
Input: Monitor for changes made to files that may abuse Microsoft Office templates to obtain persistence on a compromised system.

Tactics: TA0003
Techniques: T1137, T1137.001
Input: SpicyOmelette has been executed through malicious links within spearphishing emails.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Disable legacy network protocols that may be used   to intercept network traffic if applicable, especially those that are not needed within an environment.

Tactics: TA0006, TA0009
Techniques: T1557
Input: IndigoZebra has established domains, some of which were designed to look like official government domains, for their operations.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: Once Shamoon has access to a network share, it enables the RemoteRegistry service on the target system.

Tactics: TA0005
Techniques: T1112
Input: Anchor can create a scheduled task for persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Use read-only containers, read-only file systems, and minimal images when possible to prevent the running of commands.

Tactics: TA0004
Techniques: T1611
Input: Goopy's decrypter have been inflated with junk code in between legitimate API functions, and also included infinite loops to avoid analysis.

Tactics: TA0005
Techniques: T1027
Input: FIN4 has used legitimate credentials to hijack email communications.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: Monitor for API calls to SetWindowsHook, GetKeyState, and GetAsyncKeyState

Tactics: TA0006, TA0009
Techniques: T1056
Input: The Eye Pyramid campaign used phishing emails with malicious attachments for lateral movement between victims, compromising nearly 18,000 email accounts in the process.

Tactics: TA0008
Techniques: T1534
Input: Rover has keylogging functionality.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: APT18 uses cmd.exe to execute commands on the victim’s machine.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Turla has used net localgroup and net localgroup Administrators to enumerate group information, including members of the local administrators group.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: Windows Security events such as 4768 (A Kerberos authentication ticket (TGT) was requested) and 4769 (A Kerberos service ticket was requested) combined with logon session creation information may be indicative of an overpass the hash attempt.

Tactics: TA0005, TA0008
Techniques: T1550.002, T1550
Input: Bazar can execute a WMI query to gather information about the installed antivirus engine.

Tactics: TA0002
Techniques: T1047
Input: Cobalt Strike has the ability to use AES-256 symmetric encryption in CBC mode with HMAC-SHA-256 to encrypt task commands and XOR to encrypt shell code and configuration data.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: In some cases, windows that would typically be displayed when an application carries out an operation can be hidden.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: Once a removable media device is inserted back into the first victim, USBStealer collects data from it that was exfiltrated from a second victim.

Tactics: TA0009
Techniques: T1025
Input: IP addresses may also enable an adversary to derive other details about a victim, such as organizational size, physical location(s), Internet service provider, and or where/how their publicly-facing infrastructure is hosted.

Tactics: TA0043
Techniques: T1590, T1590.005
Input: NBTscan can be used to scan IP networks.

Tactics: TA0007
Techniques: T1046
Input: wevtutil cl security

Tactics: TA0005
Techniques: T1070, T1070.001
Input: It is likely unusual for netsh.exe to have any child processes in most environments.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.007
Input: Tunneling involves explicitly encapsulating a protocol within another.

Tactics: TA0011
Techniques: T1572
Input: BBSRAT uses a custom encryption algorithm on data sent back to the C2 server over HTTP.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Micropsia obfuscates the configuration with a custom Base64 and XOR.

Tactics: TA0005
Techniques: T1027
Input: Drovorub can use kernel modules to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: TinyZBot contains functionality to collect information from the clipboard.

Tactics: TA0009
Techniques: T1115
Input: Private WHOIS services display alternative information, such as their own company data, rather than the owner of the domain.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may send spearphishing messages via third-party services in an attempt to gain access to victim systems.

Tactics: TA0001
Techniques: T1566.003, T1566
Input: Hancitor has also extracted executables from ZIP files.

Tactics: TA0005
Techniques: T1140
Input: APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious link.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: QakBot can collect system information including the OS version and domain on a compromised host.

Tactics: TA0007
Techniques: T1082
Input: Monitor executed commands and arguments that updates domain authentication from Managed to Federated via ActionTypes Set federation settings on domain and Set domain authentication.

Tactics: TA0004, TA0005
Techniques: T1484, T1484.002
Input: Network segmentation can be used to isolate infrastructure components that do not require broad network access.

Tactics: TA0001, TA0006, TA0009
Techniques: T1557.001, T1557, T1199
Input: Ensure there are regular reviews of accounts provisioned to these systems to verify continued business need, and ensure there is governance to trace de-provisioning of access that is no longer required.

Tactics: TA0002, TA0008
Techniques: T1072
Input: Various implementations of CHOPSTICK communicate with C2 over HTTP.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: TinyZBot contains screen capture functionality.

Tactics: TA0009
Techniques: T1113
Input: Lazarus Group has acquired servers to host their malicious tools.

Tactics: TA0042
Techniques: T1583.004, T1583
Input: Empire has modules for executing scripts.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: By running their own DNS servers, adversaries can have more control over how they administer server-side DNS C2 traffic (DNS).

Tactics: TA0042
Techniques: T1583, T1583.002
Input: 13 14 ams_api64.dll ams_api32.dll Handy wrapper around API of exXX.dll, pdXX.dll, sgXX.dll

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.001, T1574.002, T1055, T1574
Input: This may include enumerating time-based properties, such as uptime or the system clock, as well as the use of timers or other triggers to avoid a virtual machine environment (VME) or sandbox, specifically those that are automated or only operate for a limited amount of time.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Sandworm Team has developed malware for its operations, including malicious mobile applications and destructive malware such as NotPetya and Olympic Destroyer.

Tactics: TA0042
Techniques: T1587, T1587.001
Input: Chimera has used the quser command to show currently logged on users.

Tactics: TA0007
Techniques: T1033
Input: HermeticWizard can use OpenRemoteServiceManager to create a service.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: CoinTicker decodes the initially-downloaded hidden encoded file using OpenSSL.

Tactics: TA0005
Techniques: T1140
Input: Monitor for API calls, loaded by a payload, for token manipulation only through careful analysis of user network activity, examination of running processes, and correlation with other endpoint and network behavior.

Tactics: TA0004, TA0005
Techniques: T1134
Input: Chimera has used the Windows Command Shell and batch scripts for execution on compromised hosts.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Kazuar has used internal nodes on the compromised network for C2 communications.

Tactics: TA0011
Techniques: T1090.001, T1090
Input: Regsvcs and Regasm may not be necessary within a given environment.

Tactics: TA0005
Techniques: T1218.009, T1218
Input: Rising Sun has used HTTP for command and control.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Wizard Spider has gained access to credentials via exported copies of the ntds.dit Active Directory database.

Tactics: TA0006
Techniques: T1003.003, T1003
Input: Monitor for newly constructed files written to disk to gain access to a system through a user visiting a website over the normal course of browsing.

Tactics: TA0001
Techniques: T1189
Input: The KDC is responsible for both authentication and ticket granting.

Tactics: TA0006
Techniques: T1558
Input: Kwampirs collects a list of running services with the command tasklist /v.

Tactics: TA0007
Techniques: T1057
Input: Machete renamed payloads to masquerade as legitimate Google Chrome, Java, Dropbox, Adobe Reader and Python executables.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Monitor use of WinRM within an environment by tracking service execution.

Tactics: TA0008
Techniques: T1021, T1021.006
Input: Techniques for Analysis When I was analyzing this sample, the malware was unable to connect to its C2.  However, I was still able to analyze the network traffic of the sample.  How, you might ask?  Using a hex editor and a script I wrote to encrypt text using the algorithm that this sample uses, I encrypted my own C2 address (192.168.1.108:7721) and replaced the hardcoded C2 address with my own encrypted address.  I then opened a listener on my own IP on the respective port.    [Screenshot 3] comparison of My IP (Left) vs C2 IP (Right) Next, using a debugger, I set a couple breakpoints in the Internet Communications function and ran the malware.  The malware sample then connected to my IP and sent information to me, which I was able to observe using Wireshark.  After I’d captured the traffic, I was able to write another script to decrypt and decompress the traffic in order to view the data being sent.  Additionally, I then wrote a socket script that detects the Gh0stRAT variant traffic, automatically decrypts the traffic, and then extracts the Implant_Opcodes for the sample.  A second version of the script allows commands to be sent back to the malware, after I enumerated the exact command format for the sample.   [Screenshot 4] Output of Version 1 of the script So far, the 2 opcodes that the sample has sent are 0x65 and 0x66, or Implant_Heartbeat and Implant_Login, respectively.  “Hitting between the heartbeats” When sending commands, first the sample must login in with 0x65, then you can send commands to it.  However, you have to move fast as the sample will send an Implant_Heartbeat followed by an Implant_Login every 10 seconds or so, and if you try to send a command to the sample as it is responding with either opcode, it will ignore the command.  A proof of concept of the command script can be found here , while the Implant extraction script and the Command Script will be included in the Appendix

Tactics: TA0011
Techniques: T1132, T1573