madox81/Adema_ATTACK_DS huggingface dataset:
Input: Agent Tesla can collect account information from the victim’s machine.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Empire can use WMI to deliver a payload to a remote host.

Tactics: TA0002
Techniques: T1047
Input: When enabled, a user requesting access to a resource initiates communication with the Domain Controller (DC) by sending an Authentication Server Request (AS-REQ) message with a timestamp that is encrypted with the hash of their password.

Tactics: TA0006
Techniques: T1558, T1558.004
Input: Tool Type Internal Name Industry Name   Backdoor Poison Frog BONDUPDATER   Backdoor Glimpse Updated BONDUPDATER   Webshell HyperShell TwoFace loader   Webshell HighShell TwoFace payload   Webshell Minion TwoFace payload variant   DNS Hijacking Toolkit webmask Related to DNSpionage     Table 1

Tactics: TA0005
Techniques: T1027
Input: APT39 has used tools capable of stealing contents of the clipboard.

Tactics: TA0009
Techniques: T1115
Input: The plugin URL is stored in file in following format:  /plugin/index.php?plugin=<Plugin_Name>  The following plugins are found in the memory of the Zyklon malware:  /plugin/index.php?plugin=cuda /plugin/index.php?plugin=minerd /plugin/index.php?plugin=sgminer /plugin/index.php?plugin=socks /plugin/index.php?plugin=tor /plugin/index.php?plugin=games /plugin/index.php?plugin=software /plugin/index.php?plugin=ftp /plugin/index.php?plugin=email /plugin/index.php?plugin=browser  The downloaded plugins are injected into: Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe

Tactics: TA0004, TA0005
Techniques: T1027.002, T1027, T1068
Input: Inception has encrypted network communications with AES.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: XAgentOSX contains the getInfoOSX function to return the OS X version as well as the current user.

Tactics: TA0007
Techniques: T1033
Input: Stuxnet injects an entire DLL into an existing, newly created, or preselected trusted process.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: SILENTTRINITY can enumerate shares on a compromised host.

Tactics: TA0007
Techniques: T1135
Input: The optional HTTP data with king.jpg looks like a beacon to inform the control server that the malware is ready to accept new commands:  Commands received from the control server are encoded DWORDs After decoding, these DWORDs should be in the range 123459h to 123490h  Malware checking to make sure a received command is in the correct range

Tactics: TA0011
Techniques: T1132
Input: KeyBoy uses -w Hidden to conceal a PowerShell window that downloads a payload.

Tactics: TA0005
Techniques: T1564.003, T1564
Input: APT40 strongly favors web shells for maintaining presence, especially publicly available tools

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Chimera has used the NtdsAudit utility to collect information related to accounts and passwords.

Tactics: TA0007
Techniques: T1201
Input: Monitor executed commands and arguments that may take control of preexisting sessions with remote services to move laterally in an environment.

Tactics: TA0008
Techniques: T1563
Input: Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code.

Tactics: TA0004, TA0005, TA0006, TA0008
Techniques: T1210, T1211, T1212, T1068
Input: Since this technique may also be used through PowerShell, additional logging of PowerShell scripts is recommended.

Tactics: TA0005
Techniques: T1006
Input: CostaRicto has obtained open source tools to use in their operations.

Tactics: TA0042
Techniques: T1588, T1588.002
Input: Magic Hound malware has used base64-encoded commands and files, and has also encrypted embedded strings with AES.

Tactics: TA0005
Techniques: T1027
Input: This command will automatically set the DNS type to use for actual C2   $showconfig Uploads the current configuration of the payload to the C2   slpx:\d+ Sets the sleep interval between outbound DNS requests   $fileUpload Downloads contents from the C2 server and writes them to a specified file    Table 3 Commands available to payload Campaign Analysis The following domains are configured within the payload to be used as C2s

Tactics: TA0011
Techniques: T1071
Input: CHOPSTICK can switch to a new C2 channel if the current one is broken.

Tactics: TA0011
Techniques: T1008
Input: WinMM is usually configured with primary and backup domains for C2 communications.

Tactics: TA0011
Techniques: T1008
Input: Threat Group-3390 has used appcmd.exe to disable logging on a victim server.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: APT38 has collected browser bookmark information to learn more about compromised hosts, obtain personal information about users, and acquire details about internal network resources.

Tactics: TA0007
Techniques: T1217
Input: Adversaries may also execute commands to identify the exact version of the running Linux kernel and/or download multiple versions of the same .ko (kernel object) files to use the one appropriate for the running system.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: The Netwalker DLL has been injected reflectively into the memory of a legitimate running process.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: APT29 has exfiltrated collected data over a simple HTTPS request to a password-protected archive staged on a victim's OWA servers.

Tactics: TA0010
Techniques: T1048.002, T1048
Input: Monitor processes and command-line arguments for actions that could create or modify services.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: It also has a command to spawn a command shell.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Kerrdown has the ability to determine if the compromised host is running a 32 or 64 bit OS architecture.

Tactics: TA0007
Techniques: T1082
Input: By abusing features of common networking protocols that can determine the flow of network traffic ( ARP, DNS, LLMNR, ), adversaries may force a device to communicate through an adversary controlled system so they can collect information or perform additional actions.

Tactics: TA0006, TA0009
Techniques: T1557
Input: When the backdoor establishes a connection to the command and control server, it sets the request period time equal to the specified dwell time for the standby mode

Tactics: TA0007
Techniques: T1124
Input: Often, these devices are equipped with special, dedicated encryption hardware to greatly increase the speed of the encryption process as well as to prevent malicious tampering.

Tactics: TA0005
Techniques: T1600, T1600.002
Input: Kwampirs collects a list of available servers with the command net view.

Tactics: TA0007
Techniques: T1018
Input: Follow vendor prescribed best practices for hardening access control.

Tactics: TA0003, TA0005, TA0006
Techniques: T1601, T1556, T1556.004, T1601.001
Input: TEMP.Veles has used Mimikatz and a custom tool, SecHack, to harvest credentials.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Adversaries may extract credentials from memory via Exploitation for Credential Access.

Tactics: TA0006
Techniques: T1555.005, T1555
Input: Gamaredon Group has used mshta.exe to execute malicious HTA files.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: Security controls can include enforcement mechanisms to ensure that only valid, signed code can be run on an operating system.

Tactics: TA0005
Techniques: T1553, T1553.006
Input: Adversaries may abuse the at utility to perform task scheduling for initial or recurring execution of malicious code.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.002
Input: Adversaries may target LSASS drivers to obtain persistence.

Tactics: TA0003, TA0004
Techniques: T1547.008, T1547
Input: Remcos steals and modifies data from the clipboard.

Tactics: TA0009
Techniques: T1115
Input: For instance, when using this string we observed DNS queries for “apple-search.infoclose”, as the string “close” was supposed to be the next portion of the C2 URL

Tactics: TA0011
Techniques: T1071
Input: Unix shells can control every aspect of a system, with certain commands requiring elevated privileges.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: Siloscape is executed after the attacker gains initial access to a Windows container using a known vulnerability.

Tactics: TA0001
Techniques: T1190
Input: HotCroissant can perform dynamic DLL importing and API lookups using LoadLibrary and GetProcAddress on obfuscated strings.

Tactics: TA0002
Techniques: T1106
Input: APT28 has intentionally deleted computer files to cover their tracks, including with use of the program CCleaner.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: VBShower has the ability to execute VBScript files.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: BoxCaon can download files.

Tactics: TA0011
Techniques: T1105
Input: Consider limiting access to the BITS interface to specific users or groups.

Tactics: TA0003, TA0005
Techniques: T1197
Input: Display Switcher: C:\Windows\System32\DisplaySwitch.exe

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: APT28 has also obfuscated payloads with base64, XOR, and RC4.

Tactics: TA0005
Techniques: T1027
Input: Adversaries may abuse netbooting to load an unauthorized network device operating system from a Trivial File Transfer Protocol (TFTP) server.

Tactics: TA0003, TA0005
Techniques: T1542.005, T1542
Input: Magic Hound malware has used IRC for C2.

Tactics: TA0011
Techniques: T1071
Input: OSX/Shlayer uses the curl -fsL "$url" >$tmp_path command to download malicious payloads into a temporary directory.

Tactics: TA0002, TA0011
Techniques: T1059.004, T1105, T1059
Input: Trojan.Karagany can steal data and credentials from browsers.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: At minimum, access to information repositories performed by privileged users (for example, Active Directory Domain, Enterprise, or Schema Administrators) should be closely monitored and alerted upon, as these types of accounts should generally not be used to access information repositories.

Tactics: TA0009
Techniques: T1213
Input: Turn off UAC's privilege elevation for standard users [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System] to automatically deny elevation requests, add: "ConsentPromptBehaviorUser"=dword:00000000.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574
Input: Kimsuky has used tools that are capable of obtaining credentials from saved mail.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: For example, Sysmon will log when its configuration state has changed (Event ID 16) and Windows Management Instrumentation (WMI) may be used to subscribe ETW providers that log any provider removal from a specific trace session.

Tactics: TA0005
Techniques: T1562.006, T1562
Input: Lazarus Group malware WhiskeyAlfa-Three modifies sector 0 of the Master Boot Record (MBR) to ensure that the malware will persist even if a victim machine shuts down.

Tactics: TA0003, TA0005
Techniques: T1542.003, T1542
Input: Print processors are DLLs that are loaded by the print spooler service, spoolsv.exe, during boot.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.012
Input: Users may be subjected to social engineering to get them to open a file that will lead to code execution.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Lazarus Group malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, potentially evading SSL traffic inspection/decryption.

Tactics: TA0011
Techniques: T1001, T1001.003
Input: Ramsay has included a rootkit to evade defenses.

Tactics: TA0005
Techniques: T1014
Input: Magic Hound malware can take a screenshot and upload the file to its C2 server.

Tactics: TA0009
Techniques: T1113
Input: It also uses launchctl to unload all Launch Daemons when updating to a newer version of LoudMiner.

Tactics: TA0002
Techniques: T1569.001, T1569
Input: In Windows, Net utility, Set-LocalUser and Set-ADAccountPassword PowerShell cmdlets may be used by adversaries to modify user accounts.

Tactics: TA0040
Techniques: T1531
Input: Orz can overwrite Registry settings to reduce its visibility on the victim.

Tactics: TA0005
Techniques: T1070
Input: njRAT has used port 1177 for HTTP C2 communications.

Tactics: TA0011
Techniques: T1571
Input: LaZagne can obtain credentials from databases, mail, and WiFi across multiple platforms.

Tactics: TA0006
Techniques: T1555
Input: Peirates can enumerate Kubernetes pods in a given namespace.

Tactics: TA0007
Techniques: T1613
Input: In later versions of Windows (10+), PubPrn.vbs has been updated to prevent proxying execution from a remote site.

Tactics: TA0005
Techniques: T1216.001, T1216
Input: SombRAT has the ability to use TCP sockets to send data and ICMP to ping the C2 server.

Tactics: TA0011
Techniques: T1095
Input: This can be done using a syntax similar to this: rundll32.exe javascript:"..\mshtml,RunHTMLApplication ";document.write();GetObject("script:https[:]//www[.]example[.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: An adversary may utilize Private Keys to compromise an organization's token-signing certificate to create forged SAML tokens.

Tactics: TA0006
Techniques: T1606, T1606.002
Input: Cluster A Case 1: Delivery via document property macro – a789a282e0d65a050cccae66c56632245af1c8a589ace2ca5ca79572289fd483  In our research we found at least one attack against a company leveraging a Microsoft Office Excel document with an embedded macro to launch the malware

Tactics: TA0002
Techniques: T1204
Input: Adversaries may attempt to list ACLs for objects to determine the owner and other accounts with access to the object, for example, via the AWS GetBucketAcl API .

Tactics: TA0007
Techniques: T1069, T1069.003
Input: Examples have been found in the wild, and there are some relevant open source projects as well.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: Control Panel items are registered executable (.exe) or Control Panel (.cpl) files, the latter are actually renamed dynamic-link library (.dll) files that export a CPlApplet function.

Tactics: TA0005
Techniques: T1218, T1218.002
Input: WMI permanent event subscriptions can be used to trigger actions when specified conditions are met

Tactics: TA0002
Techniques: T1047
Input: Monitor executed commands and arguments that may corrupt or wipe the disk data structures on a hard drive necessary to boot a system; targeting specific critical systems or in large numbers in a network to interrupt availability to system and network resources.

Tactics: TA0040
Techniques: T1561, T1561.002
Input: Monitor for access to windows registry keys that may attempt to gather information about the system language of a victim in order to infer the geographical location of that host.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: RDAT can communicate with the C2 via base32-encoded subdomains.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Naikon renamed a malicious service taskmgr to appear to be a legitimate version of Task Manager.

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Monitor Registry for changes to run keys that do not correlate with known software, patch cycles,  Tools such as Sysinternals Autoruns may also be used to detect system changes that could be attempts at persistence, including listing the run keys' Registry locations.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Adversaries may also execute commands through interactive terminals/shells, as well as utilize various Remote Services in order to achieve remote Execution.

Tactics: TA0002
Techniques: T1059
Input: Rifdoor has the ability to identify the Windows version on the compromised host.

Tactics: TA0007
Techniques: T1082
Input: With elevated permission (sudo), this attribute can be removed from any file.

Tactics: TA0005
Techniques: T1553.001, T1553
Input: This subjects AppleScript code to the same scrutiny as other .app files passing through Gatekeeper.

Tactics: TA0002
Techniques: T1059.002, T1059
Input: But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.

Tactics: TA0001
Techniques: T1190
Input: Sharpshooter's first-stage downloader installed Rising Sun to the startup folder %Startup%\mssync.exe.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Ryuk can launch icacls  /grant Everyone:F /T /C /Q to delete every access-based restrictions on files and directories.

Tactics: TA0005
Techniques: T1222, T1222.001
Input: Cobalt Strike uses the native Windows Network Enumeration APIs to interrogate and discover targets in a Windows Active Directory network.

Tactics: TA0007
Techniques: T1018
Input: Monitor for changes made to files that may abuse system services or daemons to execute commands or programs.

Tactics: TA0002
Techniques: T1569
Input: In 2016, CTU researchers observed the group using native system functionality to disable logging processes and delete logs within a compromised environment

Tactics: TA0005
Techniques: T1070, T1562.001, T1070.004, T1562
Input: BADFLICK has relied upon users clicking on a malicious attachment delivered through spearphishing.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Follow best practices for detecting adversary use of Valid Accounts for authenticating to remote services.

Tactics: TA0001, TA0003
Techniques: T1133
Input: Avaddon checks for specific keyboard layouts and OS languages to avoid targeting Commonwealth of Independent States (CIS) entities.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: Zeus Panda modifies several Registry keys under HKCU\Software\Microsoft\Internet Explorer\ PhishingFilter\ to disable phishing filters.

Tactics: TA0005
Techniques: T1112
Input: Chaos provides a reverse shell is triggered upon receipt of a packet with a special string, sent to any port.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205
Input: The Winnti for Windows HTTP/S C2 mode can make use of a local proxy.

Tactics: TA0011
Techniques: T1090.001, T1090
Input: Monitor for newly constructed files that may modify the kernel to automatically execute programs on system boot.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: There exist a variety of cloud service providers that will sell virtual machines/containers as a service.

Tactics: TA0042
Techniques: T1584.003, T1583.003, T1584, T1583
Input: Carbanak exfiltrates data in compressed chunks if a message is larger than 4096 bytes .

Tactics: TA0010
Techniques: T1030
Input: Adversaries may acquire information about vulnerabilities that can be used during targeting.

Tactics: TA0042
Techniques: T1588.006, T1588
Input: Egregor has the ability to download files from its C2 server.

Tactics: TA0011
Techniques: T1105
Input: IOCs  Filename / Domain / IP Address  MD5 Hash or Description  CVE-2017-11882 exploit document  A0E6933F4E0497269620F44A083B2ED4  b.txt  9267D057C065EA7448ACA1511C6F29C7  v.txt/v.vbs  B2D13A336A3EB7BD27612BE7D4E334DF  dUpdateCheckers.base  4A7290A279E6F2329EDD0615178A11FF  hUpdateCheckers.base  841CE6475F271F86D0B5188E4F8BC6DB  cUpdateCheckers.bat  52CA9A7424B3CC34099AD218623A0979  dUpdateCheckers.ps1  BBDE33F5709CB1452AB941C08ACC775E  hUpdateCheckers.ps1  247B2A9FCBA6E9EC29ED818948939702  GoogleUpdateschecker.vbs  C87B0B711F60132235D7440ADD0360B0  hxxp://mumbai-m[.]site  POWRUNER C2  hxxp://dns-update[.]club  Malware Staging Server  CVE-2017-0199 exploit document  63D66D99E46FB93676A4F475A65566D8  94.23.172.164:80  Malware Staging Server  dupdatechecker.doc  D85818E82A6E64CA185EDFDDBA2D1B76  dupdatechecker.exe  C9F16F0BE8C77F0170B9B6CE876ED7FB  proxycheker[.]pro  C2  46.105.221.247  Has resolved mumbai-m[.]site & hpserver[.]online  148.251.55.110  Has resolved mumbai-m[.]site and dns-update[.]club  185.15.247.147  Has resolved dns-update[.]club  145.239.33.100  Has resolved dns-update[.]club  82.102.14.219  Has resolved ns2.dns-update[.]club & hpserver[.]online & anyportals[.]com  v7-hpserver.online.hta  E6AC6F18256C4DDE5BF06A9191562F82  dUpdateCheckers.base  3C63BFF9EC0A340E0727E5683466F435  hUpdateCheckers.base  EEB0FF0D8841C2EBE643FE328B6D9EF5  cUpdateCheckers.bat  FB464C365B94B03826E67EABE4BF9165  dUpdateCheckers.ps1  635ED85BFCAAB7208A8B5C730D3D0A8C  hUpdateCheckers.ps1  13B338C47C52DE3ED0B68E1CB7876AD2  googleupdateschecker.vbs  DBFEA6154D4F9D7209C1875B2D5D70D5  hpserver[.]online  C2  v7-anyportals.hta  EAF3448808481FB1FDBB675BC5EA24DE  dUpdateCheckers.base  42449DD79EA7D2B5B6482B6F0D493498  hUpdateCheckers.base  A3FCB4D23C3153DD42AC124B112F1BAE  dUpdateCheckers.ps1  EE1C482C41738AAA5964730DCBAB5DFF  hUpdateCheckers.ps1  E516C3A3247AF2F2323291A670086A8F  anyportals[.]com  C2

Tactics: TA0002, TA0005, TA0011
Techniques: T1203, T1071, T1036, T1102
Input: Epic encrypts commands from the C2 server using a hardcoded key.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Commands such as net group and net localgroup can be used in Net to gather information about and manipulate groups.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: Explosive has commonly set file and path attributes to hidden.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection.

Tactics: TA0006, TA0007
Techniques: T1040
Input: Command and control (C2) information can be encoded using a non-standard data encoding system that diverges from existing protocol specifications.

Tactics: TA0011
Techniques: T1132, T1132.002
Input: Consider enabling installer detection for all users by adding: "EnableInstallerDetection"=dword:00000001.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.010, T1574
Input: Hooking involves redirecting calls to these functions and can be implemented via:

Tactics: TA0006, TA0009
Techniques: T1056.004, T1056
Input: Process monitoring may be used to detect Web servers that perform suspicious actions such as spawning cmd.exe or accessing files that are not in the Web directory.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: XAgentOSX contains the getProcessList function to run ps aux to get running processes.

Tactics: TA0007
Techniques: T1057
Input: LazyScripter has used batch files to deploy open-source and multi-stage RATs.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Monitor new certificates installed on a system that could be due to malicious activity.

Tactics: TA0005
Techniques: T1553, T1553.004
Input: Part of the AS-REP message is signed with the user’s password.

Tactics: TA0006
Techniques: T1558, T1558.004
Input: Magic Hound malware can list running processes.

Tactics: TA0007
Techniques: T1057
Input: ChChes collects the victim's %TEMP% directory path and version of Internet Explorer.

Tactics: TA0007
Techniques: T1083
Input: Emotet has been seen exploiting SMB via a vulnerability exploit like EternalBlue (MS17-010) to achieve lateral movement and propagation.

Tactics: TA0008
Techniques: T1210
Input: It also contains additional modules that can check software AutoRun values and use the Win32 namespace to get values from HKCU, HKLM, HKCR, and HKCC hives.

Tactics: TA0007
Techniques: T1012
Input: Binary padding effectively changes the checksum of the file and can also be used to avoid hash-based blocklists and static anti-virus signatures.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: Leviathan has used WMI for execution.

Tactics: TA0002
Techniques: T1047
Input: The time of the observed attacker activity coincides with Iran’s Daylight Time, which is +0430 UTC

Tactics: TA0007
Techniques: T1124
Input: Emotet has relied upon users clicking on a malicious attachment delivered through spearphishing.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Remcos can access a system’s webcam and take pictures.

Tactics: TA0009
Techniques: T1125