madox81/Adema_ATTACK_DS huggingface dataset:
Input: KOCTOPUS has relied on victims clicking on a malicious link delivered via email.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Monitor executed commands and arguments that could be taken to add a new user and subsequently hide it from login screens.

Tactics: TA0005
Techniques: T1564.002, T1564
Input: Change GPOs to specify the maximum amount of time that a disconnected session stays active on the RD session host server.

Tactics: TA0008
Techniques: T1563.002, T1021.001, T1021, T1563
Input: Agent Tesla has routines for exfiltration over SMTP, FTP, and HTTP.

Tactics: TA0010
Techniques: T1048.003, T1048
Input: Taidoor can use encrypted string blocks for obfuscation.

Tactics: TA0005
Techniques: T1027
Input: Each event contains the corresponding UUID, timestamp, application, Gatekeeper score, and decision if it was allowed.

Tactics: TA0005
Techniques: T1553.001, T1553
Input: Pisloader has commands to list drives on the victim machine and to list file information for a given directory.

Tactics: TA0007
Techniques: T1083
Input: The PE compile time of loaders and the create time of droppers (Word documents) are plotted in the graph

Tactics: TA0007
Techniques: T1124
Input: Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: The Windows Component Object Model (COM) is a component of the native Windows application programming interface (API) that enables interaction between software objects, or executable code that implements one or more interfaces.

Tactics: TA0008
Techniques: T1021.003, T1021
Input: Winexe installs a service on the remote system, executes the command, then uninstalls the service.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: APT38 is characterized by long planning, extended periods of access to compromised victim environments preceding any attempts to steal money, fluency across mixed operating system environments, the use of custom developed tools, and a constant effort to thwart investigations capped with a willingness to completely destroy compromised machines afterwards

Tactics: TA0009
Techniques: T1005
Input: This account modification may immediately follow Create Account or other malicious account activity.

Tactics: TA0003
Techniques: T1098, T1098.003
Input: Looking at earlier attacks between 2013 and 2016, we believe Comnie was also used in targeted attacks against the following individuals or organizations:  Taiwan government IT service vendor in Asia Journalist of a Tibetan radio station   Figure 6 Email sent to Journalist of Tibetan radio station   Malicious Macros The malicious macro documents used to deliver Comnie initially hide the content inside and requests that the user enables macros prior to viewing the document

Tactics: TA0001
Techniques: T1566, T1566.001
Input: LockerGoga has been signed with stolen certificates in order to make it look more legitimate.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Common credential dumpers such as Mimikatz access LSASS.exe by opening the process, locating the LSA secrets key, and decrypting the sections in memory where credential details are stored.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: GreyEnergy uses PsExec locally in order to execute rundll32.exe at the highest privileges (NTAUTHORITY\SYSTEM).

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Next, the script triggered a PowerShell stager

Tactics: TA0002
Techniques: T1059.001, T1059
Input: TINYTYPHON has used XOR with 0x90 to obfuscate its configuration file.

Tactics: TA0005
Techniques: T1027
Input: Size Expansion of Configuration Information PlugX is designed to run based on its configuration information stored in itself

Tactics: TA0007
Techniques: T1082
Input: GOLD SOUTHFIELD has used publicly-accessible RDP and remote management and monitoring (RMM) servers to gain access to victim machines.

Tactics: TA0001, TA0003
Techniques: T1133
Input: Remexi executes received commands with wmic.exe (for WMI commands).

Tactics: TA0002
Techniques: T1047
Input: Adversaries may attempt to get a listing of domain accounts.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: PoshC2 contains modules, such as Get-LocAdm for enumerating permission groups.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: Information about business roles may reveal a variety of targetable details, including identifiable information for key personnel as well as what data/resources they have access to.

Tactics: TA0043
Techniques: T1591.004, T1591
Input: In such cases, an adversary may take control of a subdomain to conduct operations with the benefit of the trust associated with that domain.

Tactics: TA0042
Techniques: T1584.001, T1584
Input: Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574
Input: APT28 registered domains imitating NATO, OSCE security websites, Caucasus information resources, and other organizations.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: For instance, audit reports enable admins to identify privilege escalation actions such as role creations or policy modifications, which could be actions performed after initial access.

Tactics: TA0005, TA0006, TA0008
Techniques: T1550.001, T1528, T1550
Input: Oracle (1521/TCP)

Tactics: TA0006
Techniques: T1110.004, T1110, T1110.001, T1110.003
Input: VMware DLL Check The Trojan checks to see if the files vmGuestLib.dll or vmbusres.dll exist in the system directory

Tactics: TA0005, TA0007
Techniques: T1497
Input: It has also used PowerShell to execute commands and move laterally through a victim network.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Lazarus Group keylogger KiloAlfa obtains user tokens from interactive sessions to execute itself with API call CreateProcessAsUserA under that user's context.

Tactics: TA0004, TA0005
Techniques: T1134.002, T1134
Input: Network prevention intrusion systems and systems designed to scan and remove malicious downloads can be used to block activity.

Tactics: TA0002
Techniques: T1204.003, T1204
Input: Gorgon Group malware can leverage the Windows API call, CreateProcessA(), for execution.

Tactics: TA0002
Techniques: T1106
Input: TeamTNT has scanned for vulnerabilities in IoT devices and other related resources such as the Docker API.

Tactics: TA0043
Techniques: T1595, T1595.002
Input: Cyclops Blink can rename its running process to [kworker:0/1] to masquerade as a Linux kernel thread.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: TinyTurla can use HTTPS in C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: BOOSTWRITE has used the DWriteCreateFactory() function to load additional modules.

Tactics: TA0002
Techniques: T1129
Input: OSX_OCEANLOTUS.D uses PowerShell scripts.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Indicators of Compromise (IoCs)    C&C servers    Ssl[.]arkouthrie[.]com   s3[.]hiahornber[.]com   widget[.]shoreoa[.]com       SHA256   Delivery document (W2KM_OCEANLOTUS.A): 2bb855dc5d845eb5f2466d7186f150c172da737bfd9c7f6bc1804e0b8d20f22a   Dropper (OSX_OCEANLOTUS.D): 4da8365241c6b028a13b82d852c4f0155eb3d902782c6a538ac007a44a7d61b4   Backdoor (OSX_OCEANLOTUS.D): 673ee7a57ba3c5a2384aeb17a66058e59f0a4d0cddc4f01fe32f369f6a845c8f   The post New MacOS Backdoor Linked to OceanLotus Found appeared first on

Tactics: TA0011
Techniques: T1008
Input: HTTP/S packets have many fields and headers in which data can be concealed.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Chrommme can collect data from a local system.

Tactics: TA0009
Techniques: T1005
Input: BloodHound can enumerate and collect the properties of domain computers, including domain controllers.

Tactics: TA0007
Techniques: T1018
Input: In principle, containerized resources should provide a clear separation of application functionality and be isolated from the host environment.

Tactics: TA0004
Techniques: T1611
Input: Forged web cookies may be associated with unknown accounts and could be the result of compromised secrets such as passwords or Private Keys.

Tactics: TA0006
Techniques: T1606, T1606.001
Input: Alerts for credential theft tools and privileged account lockouts should be investigated

Tactics: TA0006
Techniques: T1003
Input: Keylogging is likely to be used to acquire credentials for new access opportunities when OS Credential Dumping efforts are not effective, and may require an adversary to intercept keystrokes on a system for a substantial period of time before credentials can be successfully captured.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Monitor for API calls that may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.

Tactics: TA0009
Techniques: T1005
Input: Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage.

Tactics: TA0007
Techniques: T1120
Input: OopsIE uses HTTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Look for changes to tasks that do not correlate with known software, patch cycles,

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: Turla surveys a system upon check-in to discover running processes using the tasklist /v command.

Tactics: TA0007
Techniques: T1057
Input: The executable will drop the packaged QUADAGENT PowerShell script using the filename Office365DCOMCheck.ps1 in addition to a VBScript file with the same filename which will assist in the execution of it

Tactics: TA0002, TA0005
Techniques: T1036, T1059
Input: Babuk has the ability to delete shadow volumes using vssadmin.exe delete shadows /all /quiet.

Tactics: TA0040
Techniques: T1490
Input: Once inside the network of a hospitality company, APT28 sought out machines that controlled both guest and internal Wi-Fi networks. No guest credentials were observed being stolen at the compromised hotels; however, in a separate incident that occurred in Fall 2016, APT28 gained initial access to a victim’s network via credentials likely stolen from a hotel Wi-Fi network.  Upon gaining access to the machines connected to corporate and guest Wi-Fi networks, APT28 deployed Responder

Tactics: TA0007
Techniques: T1018
Input: One version of Helminth consists of VBScript scripts.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password guessing attacks.

Tactics: TA0006
Techniques: T1110, T1110.001
Input: The hashes can then in turn be used to create a Golden Ticket for use in Pass the Ticket or change an account's password as noted in Account Manipulation.

Tactics: TA0006
Techniques: T1003.006, T1003
Input: NanoCore uses VBS files.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: InvisiMole has exploited CVE-2007-5633 vulnerability in the speedfan.sys driver to obtain kernel mode privileges.

Tactics: TA0004
Techniques: T1068
Input: Kimsuky has disguised its C2 addresses as the websites of shopping malls, governments, universities, and others.

Tactics: TA0005
Techniques: T1036
Input: TrickBot has retrieved PuTTY credentials by querying the Software\SimonTatham\Putty\Sessions registry key

Tactics: TA0006
Techniques: T1552, T1552.002
Input: Monitor for unusual kernel driver installation activity may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to system and network resources.

Tactics: TA0040
Techniques: T1561, T1561.002
Input: WindTail can instruct the OS to execute an application without a dock icon or menu.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: CozyCar has executed Mimikatz to harvest stored credentials from the victim and further victim penetration.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Audit ISAPI filters and search for web shells on Microsoft Exchange servers

Tactics: TA0003
Techniques: T1505.003, T1505
Input: A variation of the the technique, "domainless" fronting, utilizes a SNI field that is left blank; this may allow the fronting to work even when the CDN attempts to validate that the SNI and HTTP Host fields match (if the blank SNI fields are ignored).

Tactics: TA0011
Techniques: T1090.004, T1090
Input: Every New Technology File System (NTFS) formatted partition contains a Master File Table (MFT) that maintains a record for every file/directory on the partition.

Tactics: TA0005
Techniques: T1564, T1564.004
Input: Clambling can identify the username on a compromised host.

Tactics: TA0007
Techniques: T1033
Input: In some cases it may be possible to pivot on known pieces of certificate information to uncover other adversary infrastructure.

Tactics: TA0042
Techniques: T1588.004, T1588
Input: Gelsemium can open random files and Registry keys to obscure malware behavior from sandbox analysis.

Tactics: TA0007
Techniques: T1012
Input: WarzoneRAT can communicate with its C2 server via TCP over port 5200.

Tactics: TA0011
Techniques: T1095
Input: Modify System Image may include implanted code to the operating system for network devices to provide access for adversaries using a specific password.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.004
Input: ZxShell supports functionality for VNC sessions.

Tactics: TA0008
Techniques: T1021.005, T1021
Input: ELMER uses HTTP for command and control.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Stuxnet has the ability to generate new C2 domains.

Tactics: TA0011
Techniques: T1008
Input: Similar to Direct Network Floods, more than one system may be used to conduct the attack, or a botnet may be used.

Tactics: TA0040
Techniques: T1498, T1498.002
Input: Expand can be used to download or copy a file into an alternate data stream.

Tactics: TA0005
Techniques: T1564, T1564.004
Input: It can also steal tokens to acquire administrative privileges.

Tactics: TA0004, TA0005
Techniques: T1134
Input: Stuxnet enumerates user accounts of the local host.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Limit privileges of user accounts and remediate Privilege Escalation vectors so only authorized administrators can create scheduled tasks on remote systems.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053, T1053.002
Input: The ptrace system call enables a debugging process to observe and control another process (and each individual thread), including changing memory and register values.

Tactics: TA0004, TA0005
Techniques: T1055.008, T1055
Input: Lazarus Group malware IndiaIndia obtains and sends to its C2 server information about the first network interface card’s configuration, including IP address, gateways, subnet mask, DHCP information, and whether WINS is available.

Tactics: TA0007
Techniques: T1016
Input: To avoid corruption, TxF performs an automatic rollback if the system or application fails during a write transaction.

Tactics: TA0004, TA0005
Techniques: T1055.013, T1055
Input: Monitor network traffic for unusual ARP traffic, gratuitous ARP replies may be suspicious.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.002
Input: This value causes Windows, at startup, to check the file-system integrity of the hard disks if the system has been shut down abnormally.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Sandworm Team has established social media accounts to disseminate victim internal-only documents and other sensitive data.

Tactics: TA0042
Techniques: T1585, T1585.001
Input: Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems.

Tactics: TA0007
Techniques: T1016
Input: Credential information may also be exposed to adversaries via leaks to online or other accessible data sets (ex: Search Engines, breach dumps, code repositories, ).

Tactics: TA0043
Techniques: T1589, T1589.001
Input: FIN4 has used Tor to log in to victims' email accounts.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: An adversary who can determine that the malware was quarantined because of its file signature may modify the file to explicitly avoid that signature, and then re-use the malware.

Tactics: TA0005
Techniques: T1027, T1027.005
Input: GrimAgent can identify the user id on a target machine.

Tactics: TA0007
Techniques: T1033
Input: If the permissions for users and groups are not properly set and allow access to the Registry keys for a service, adversaries may change the service's binPath/ImagePath to point to a different executable under their control.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.011, T1574
Input: ZIRCONIUM has used multi-stage packers for exploit code.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Administrators should perform an audit of all access lists and the permissions they have been granted to access web applications and services.

Tactics: TA0006
Techniques: T1606, T1606.001
Input: Pony has used a small dictionary of common passwords against a collected list of local accounts.

Tactics: TA0006
Techniques: T1110, T1110.001
Input: For newer operating systems, events.exe creates task.xml as follows:  Then it creates a Windows scheduled task using the following command:       schtasks.exe /create /TN \"Events\\CacheTask_<user_name_here>" /XML \"<event_cache_dir_path>t /F"     At the system registry level, modules achieve persistence by adding themselves into the key: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit when it finds possible add values to the Winlogon subkey, and in HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Activity Manager

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: The knowledge of cloud permission groups can help adversaries determine the particular roles of users and groups within an environment, as well as which users are associated with a particular group.

Tactics: TA0007
Techniques: T1069, T1069.003
Input: Restrict use of DHCP to registered devices to prevent unregistered devices from communicating with trusted systems.

Tactics: TA0001
Techniques: T1200
Input: Adversaries can abuse XPC services to execute malicious content.

Tactics: TA0002
Techniques: T1559, T1559.003
Input: 2 Successful payload download Astaroth’s initial payload is a malicious .lnk file, a common delivery method used by threat actors

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: There are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574
Input: KONNI can collect the IP address from the victim’s machine.

Tactics: TA0007
Techniques: T1016
Input: APT28 has used Tor and a variety of commercial VPN services to route brute force authentication attempts.

Tactics: TA0001, TA0003
Techniques: T1133
Input: BabyShark has used mshta.exe to download and execute applications from a remote server.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: Ke3chang gathered information and files from local directories for exfiltration.

Tactics: TA0009
Techniques: T1005
Input: Table 4: URL parameters Additionally, the command string is hashed using the same RGPH hashing algorithm as before

Tactics: TA0007
Techniques: T1016
Input: Darkhotel has been known to establish persistence by adding programs to the Run Registry key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.

Tactics: TA0007
Techniques: T1120
Input: InvisiMole can decrypt, unpack and load a DLL from its resources, or from blobs encrypted with Data Protection API, two-key triple DES, and variations of the XOR cipher.

Tactics: TA0005
Techniques: T1140
Input: Nidiran can download and execute files.

Tactics: TA0011
Techniques: T1105
Input: Lazarus Group has created new email accounts for spearphishing operations.

Tactics: TA0042
Techniques: T1585, T1585.002
Input: Empire includes various modules for finding files of interest on hosts and network shares.

Tactics: TA0007
Techniques: T1083
Input: Launchctl interfaces with launchd, the service management framework for macOS.

Tactics: TA0002
Techniques: T1569.001, T1569
Input: Kazuar can sleep for a specific time and be set to communicate at specific intervals.

Tactics: TA0010
Techniques: T1029
Input: IcedID has used web injection attacks to redirect victims to spoofed sites designed to harvest banking and other credentials.

Tactics: TA0009
Techniques: T1185
Input: A JHUHUGIT variant gathers network interface card information.

Tactics: TA0007
Techniques: T1016
Input: BackConfig has the ability to remove files and folders related to previous infections.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Dtrack has used cmd.exe to add a persistent service.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: iKitten lists the current processes running.

Tactics: TA0007
Techniques: T1057
Input: REvil has been distributed via malicious e-mail attachments including MS Word Documents.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Naid collects a unique identifier (UID) from a compromised host.

Tactics: TA0007
Techniques: T1082
Input: Within an XDG autostart entry file, the Type key specifies if the entry is an application (type 1), link (type 2) or directory (type 3).

Tactics: TA0003, TA0004
Techniques: T1547.013, T1547
Input: certutil can be used to download files from a given URL.

Tactics: TA0011
Techniques: T1105
Input: APT1 used a batch script to perform a series of discovery techniques and saves it to a text file.

Tactics: TA0009
Techniques: T1119
Input: The malware proceeds to decrypt and embedded configuration of 128 bytes using a simple XOR routine

Tactics: TA0005
Techniques: T1140
Input: ComRAT has also injected its communications module into the victim's default browser to make C2 connections appear less suspicious as all network connections will be initiated by the browser process.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: Monitor for newly constructed files that may establish persistence by executing malicious content triggered by an interrupt signal.

Tactics: TA0003, TA0004
Techniques: T1546.005, T1546
Input: PoshC2 can use Inveigh to conduct name service poisoning for credential theft and associated relay attacks.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: Adversaries may abuse the KernelCallbackTable of a process to hijack its execution flow in order to run their own payloads.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.013, T1574
Input: Among them, we found variations on the    EternalDarkness SMBv3 exploit (CVE-2020-0796)  , a , the privilege escalation exploit published on the Google Security Github account, and the privilege escalation exploit.

Tactics: TA0004
Techniques: T1068
Input: Monitor executed commands and arguments that may attempt to gather information about attached peripheral devices and components connected to a computer system.

Tactics: TA0007
Techniques: T1120
Input: Adversaries may attempt to shutdown/reboot a system after impacting it in other ways, such as Disk Structure Wipe or Inhibit System Recovery, to hasten the intended effects on system availability.

Tactics: TA0040
Techniques: T1529
Input: Most of the PowerShell commands would call Windows Management Instrumentation (WMI)

Tactics: TA0002
Techniques: T1047
Input: This time, weaponized lure documents claiming to contain seminar information on environmental protection were observed exploiting known Microsoft Office vulnerabilities CVE-2017-0199 and CVE-2017-11882 to drop and execute the backdoor binary on the victim’s machine

Tactics: TA0002
Techniques: T1203
Input: Lokibot has reflectively loaded the decoded DLL into memory.

Tactics: TA0005
Techniques: T1620
Input: Turla RPC backdoors can upload files from victim machines.

Tactics: TA0009
Techniques: T1005