madox81/Adema_ATTACK_DS huggingface dataset:
Input: If Shamoon cannot access shares using current privileges, it attempts access using hard coded, domain-specific credentials gathered earlier in the intrusion.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.002
Input: BoomBox can upload data to dedicated per-victim folders in Dropbox.

Tactics: TA0010
Techniques: T1567.002, T1567
Input: Emissary injects its DLL file into a newly spawned Internet Explorer process.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: SysUpdate can create a service to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Odbcconf.exe may not be necessary within a given environment.

Tactics: TA0005
Techniques: T1218, T1218.008
Input: In cloud environments, ensure that only users who explicitly require the permissions to update instance metadata or configurations can do so.

Tactics: TA0003
Techniques: T1098.004, T1098
Input: To install the payload, the script will create a file %APPDATA%\OneDrive.bat and save the following string to it: powershell.exe -WindowStyle Hidden -exec bypass  -File “%APPDATA%\OneDrive.ps1” The script then writes a modified copy of itself to %APPDATA%\OneDrive.ps1, with the code that performs this installation omitted

Tactics: TA0002, TA0005
Techniques: T1036, T1059
Input: HotCroissant can retrieve a list of applications from the SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths registry key.

Tactics: TA0007
Techniques: T1518
Input: To perform Network DoS attacks several aspects apply to multiple methods, including IP address spoofing, and botnets.

Tactics: TA0040
Techniques: T1498
Input: Monitor for newly constructed drive letters or mount points to a data storage device for attempts to write to sensitive locations like the partition boot sector, master boot record, disk partition table, or BIOS parameter block/superblock.

Tactics: TA0040
Techniques: T1561.001, T1561, T1561.002
Input: Create Service

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Adversaries may use dynamic resolution for the purpose of Fallback Channels.

Tactics: TA0011
Techniques: T1568
Input: the PowerShell is executed using reflectively loaded ReflectivePicker from the Empire project

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Chimera has used side loading to place malicious DLLs in memory.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: DarkWatchman uses JavaScript to perform its core functionalities.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: HKEY_LOCAL_MACHINE\Software\Microsoft\Office test\Special\Perf

Tactics: TA0003
Techniques: T1137.002, T1137
Input: Agent Tesla can collect the IP address of the victim machine and spawn instances of netsh.exe to enumerate wireless settings.

Tactics: TA0007
Techniques: T1016
Input: A very common usage involves tricking a user into opening what they think is a benign file type but is actually executable code.

Tactics: TA0005
Techniques: T1036, T1036.007
Input: Adversaries may also target discovery of network infrastructure as well as leverage Network Device CLI commands on network devices to gather detailed information about systems within a network.

Tactics: TA0007
Techniques: T1018
Input: Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled and use of accounts is segmented, as this is often equivalent to having a local administrator account with the same password on all systems.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.002
Input: NanoCore uses DES to encrypt the C2 traffic.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: RCSession can identify processes based on PID.

Tactics: TA0007
Techniques: T1057
Input: DarkWatchman can use cmd.exe to execute commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Koadic has used HTTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: BabyShark has added a Registry key to ensure all future macros are enabled for Microsoft Word and Excel as well as for additional persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Traffic traversing the Tor network will be forwarded to multiple nodes before exiting the Tor network and continuing on to its intended destination.

Tactics: TA0011
Techniques: T1090.003, T1090
Input: FlawedAmmyy will attempt to detect if a usable smart card is current inserted into a card reader.

Tactics: TA0007
Techniques: T1120
Input: Both files require root access to read.

Tactics: TA0006
Techniques: T1558
Input: Monitor for logged domain name system (DNS) registry data that may hijack domains and/or subdomains that can be used during targeting.Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult.

Tactics: TA0042
Techniques: T1584.001, T1584
Input: BITS upload functionalities can also be used to perform Exfiltration Over Alternative Protocol.

Tactics: TA0003, TA0005
Techniques: T1197
Input: Usage of virtualization binaries or command-line arguments associated with running a silent installation may be especially suspect ( -silent, -ignore-reboot), as well as those associated with running a headless (in the background with no UI) virtual instance ( VBoxManage startvm $VM --type headless).

Tactics: TA0005
Techniques: T1564, T1564.006
Input: Adversaries may use information acquired via Vulnerabilities to focus exploit development efforts.

Tactics: TA0042
Techniques: T1587, T1587.004
Input: Adversaries may use these scripts to maintain persistence on a network.

Tactics: TA0003, TA0004
Techniques: T1037.003, T1037
Input: Monitor executed commands and arguments used before and after the InstallUtil.exe invocation may also be useful in determining the origin and purpose of the binary being executed.

Tactics: TA0005
Techniques: T1218, T1218.004
Input: Ensure all application component binaries are signed by the correct application developers.

Tactics: TA0003
Techniques: T1554, T1505.002, T1505.001, T1505
Input: Root certificates are used in public key cryptography to identify a root certificate authority (CA).

Tactics: TA0005
Techniques: T1553, T1553.004
Input: Monitor executed commands and arguments that may attempt to block indicators or events typically captured by sensors from being gathered and analyzed.

Tactics: TA0005
Techniques: T1562.006, T1562
Input: There have also been instances of botnets using a persistent backdoor through malicious Chrome extensions.

Tactics: TA0003
Techniques: T1176
Input: APT12 has attempted to get victims to open malicious Microsoft Word and PDF attachment sent via spearphishing.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: In addition to purchasing exploits, adversaries may steal and repurpose exploits from third-party entities (including other adversaries).

Tactics: TA0042
Techniques: T1588, T1588.005
Input: APT29 has exploited CVE-2021-36934 to escalate privileges on a compromised host.

Tactics: TA0004
Techniques: T1068
Input: PoetRAT has the ability to hide and unhide files.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: Monitor for executed commands and arguments that may attempt to find local system groups and permission settings.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: By staging data on one system prior to Exfiltration, adversaries can minimize the number of connections made to their C2 server and better evade detection.

Tactics: TA0009
Techniques: T1074.002, T1074
Input: Some malware targets the termination of a program to trigger execution, adversaries can use the ~/.bash_logout file to execute malicious commands at the end of a session.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.004
Input: DOGCALL can download and execute additional payloads.

Tactics: TA0011
Techniques: T1105
Input: Imminent Monitor has deleted files related to its dynamic debugger feature.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: APT29 has used PowerShell to discover domain accounts by executing Get-ADUser and Get-DGroupMember.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: Check for running applications from login items that also have abnormal behavior, such as establishing network connections.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.015
Input: Ruler can be used to automate the abuse of Outlook Forms to establish persistence.

Tactics: TA0003
Techniques: T1137, T1137.003
Input: Unlike Keylogging,  this technique focuses specifically on API functions that include parameters that reveal user credentials.

Tactics: TA0006, TA0009
Techniques: T1056.004, T1056
Input: BLINDINGCAN has collected from a victim machine the system name, processor information, OS version, and disk information, including type and free space available.

Tactics: TA0007
Techniques: T1082
Input: A system not typically used to push software to clients that suddenly is used for such a task outside of a known admin function may be suspicious.

Tactics: TA0002, TA0008
Techniques: T1072
Input: Tropic Trooper has monitored files' modified time.

Tactics: TA0007
Techniques: T1083
Input: Ensure that applications do not store sensitive data or credentials insecurely.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: GET /<string>/<5 digit number>/<4 character string>.php?<first 3 characters of last string>_id=<43 character string>= HTTP/1.1 Accept: image/jpeg, application/x-ms-application, image/gif, application/xaml+xml, image/pjpeg, application/x-ms-xbap, */* User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E) Host: <C2 Location> Cache-Control: no-cache    Figure 6: Sample GET request for WATERSPOUT backdoor Although there are no current infrastructure ties to link this backdoor to APT12, there are several data points that show a possible tie to the same actors:  Same initial delivery method (spear phishing email) with a Microsoft Word Document exploiting CVE-2012-0158

Tactics: TA0007, TA0011
Techniques: T1008, T1010
Input: Checks could include generic system properties such as host/domain name and samples of network traffic.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: This decision may be employed by malware developers and operators to reduce their risk of attracting the attention of specific law enforcement agencies or prosecution/scrutiny from other entities.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: If running with privileged access, a breakdown of system data can be gathered through the systemsetup configuration tool on macOS.

Tactics: TA0007
Techniques: T1082
Input: Monitor for contextual data about a service/daemon, which may include information such as name, service executable, start type,

Tactics: TA0005
Techniques: T1036
Input: BLUELIGHT can collect passwords stored in web browers, including Internet Explorer, Edge, Chrome, and Naver Whale.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service.

Tactics: TA0006
Techniques: T1555.001, T1555
Input: Gold Dragon deletes one of its files, 2.hwp, from the endpoint after establishing persistence.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: KillDisk has called GetCurrentProcess.

Tactics: TA0007
Techniques: T1057
Input: Use strong two-factor or multi-factor authentication for remote service accounts to mitigate an adversary's ability to leverage stolen credentials, but be aware of Multi-Factor Authentication Interception techniques for some two-factor authentication implementations.

Tactics: TA0001, TA0003
Techniques: T1133
Input: This is done for the sake of evading defenses and observation.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Subfolders in this directory categorize logs by their related functions, such as:

Tactics: TA0005
Techniques: T1070, T1070.002
Input: FinFisher takes a screenshot of the screen and displays it on top of all other windows for few seconds in an apparent attempt to hide some messages showed by the system during the setup process.

Tactics: TA0009
Techniques: T1113
Input: Tonto Team has used PowerShell to download additional payloads.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: NetTraveler reports window names along with keylogger information to provide application context.

Tactics: TA0007
Techniques: T1010
Input: Monitor for newly constructed services/daemons to execute commands or programs.

Tactics: TA0002
Techniques: T1569.001, T1569
Input: FinFisher establishes persistence by creating the Registry key HKCU\Software\Microsoft\Windows\Run.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Command arguments used before and after the invocation of verclsid.exe may also be useful in determining the origin and purpose of the payload being executed.

Tactics: TA0005
Techniques: T1218, T1218.012
Input: Every user has a userID associated with it.

Tactics: TA0005
Techniques: T1564.002, T1564
Input: Solutions may help adversary operations blend in with traffic that is seen as normal, such as contact to third-party web services.

Tactics: TA0042
Techniques: T1583
Input: TEARDROP was decoded using a custom rolling XOR algorithm to execute a customized Cobalt Strike payload.

Tactics: TA0005
Techniques: T1140
Input: Magic Hound has created fake LinkedIn and other social media accounts to contact targets and convince them--through messages and voice communications--to open malicious links.

Tactics: TA0042
Techniques: T1585, T1585.001
Input: Chimera has used WinRM for lateral movement.

Tactics: TA0008
Techniques: T1021, T1021.006
Input: The subscription was configured to run a PowerShell command that read, decrypted, and executed the backdoor code directly from the new WMI property

Tactics: TA0002, TA0005
Techniques: T1140, T1059.001, T1059
Input: Higaisa added a spoofed binary to the start-up folder for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Monitor for unusual processes access of local system email files for Exfiltration, unusual processes connecting to an email server within a network, or unusual access patterns or authentication attempts on a public-facing webmail server may all be indicators of malicious activity.

Tactics: TA0009
Techniques: T1114
Input: Because the cryptographic renegotiation has a meaningful cost in computation cycles, this can cause an impact to the availability of the service when done in volume.

Tactics: TA0040
Techniques: T1499.002, T1499
Input: APT3 places scripts in the startup folder for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Domains The RoyalCli backdoor was attempting to communicate to the following domains:  News.memozilla[.]org video.memozilla[.]org  The BS2005 backdoor utilised the following domains for C2:  Run.linodepower[.]com Singa.linodepower[.]com log.autocount[.]org  RoyalDNS backdoor was seen communicating to the domain:  andspurs[.]com  Possible linked APT15 domains include:  Micakiz.wikaba[.]org cavanic9[.]net ridingduck[.]com zipcodeterm[.]com dnsapp[.]info   Published date:  10 March 2018   Written by:  Rob Smallridge

Tactics: TA0011
Techniques: T1008
Input: ZeroT has used RC4 to encrypt C2 traffic.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: A version of XTunnel introduced in July 2015 inserted junk code into the binary in a likely attempt to obfuscate it and bypass security products.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: MSBuild.exe may not be necessary within an environment and should be removed if not being used.

Tactics: TA0005
Techniques: T1127.001, T1127
Input: RTM can add a certificate to the Windows store.

Tactics: TA0005
Techniques: T1553, T1553.004
Input: Denis replaces the nonexistent Windows DLL "msfte.dll" with its own malicious version, which is loaded by the SearchIndexer.exe and SearchProtocolHost.exe.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574
Input: NativeZone has used rundll32 to execute a malicious DLL.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Identify and block potentially malicious and unknown .cpl files by using application control  tools, like Windows Defender Application Control, AppLocker,   or Software Restriction Policies  where appropriate.

Tactics: TA0005
Techniques: T1218, T1218.002
Input: The toolset used by the Magic Hound campaign was an assortment of custom tools, as well as open sourced tools available to the general public

Tactics: TA0007
Techniques: T1518.001, T1518
Input: ShimRatReporter gathered the local privileges for the infected host.

Tactics: TA0007
Techniques: T1069
Input: Monitor for user accounts logging into the system via Valid Accounts to interact with remote systems using Windows Remote Management (WinRM).

Tactics: TA0008
Techniques: T1021, T1021.006
Input: Trojan.Mebromi performs BIOS modification and can download and execute a file as well as protect itself from removal.

Tactics: TA0003, TA0005
Techniques: T1542.001, T1542
Input: GRIFFON has used PowerShell to execute the Meterpreter downloader TinyMet.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Monitor for abnormal process call trees from typical processes and services and for execution of other commands that could relate to Discovery or other adversary techniques.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.005, T1574
Input: Dyre has the ability to send information staged on a compromised host externally to C2.

Tactics: TA0010
Techniques: T1041
Input: In practice this is nearly every program, since user32.dll is a very common library.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.010
Input: Reaver continues to collect various information from the victim machine, including the following:  Computer name Volume serial number Microsoft Windows version CPU speed ANSI code page OEM code page identifier for the operating system Physical and virtual memory information  Reaver encrypts this data using an incremental XOR key and uploads it to the configured remote server on the port specified

Tactics: TA0007
Techniques: T1082
Input: PinchDuke collects user files from the compromised host based on predefined file extensions.

Tactics: TA0009
Techniques: T1005
Input: Sometimes a user's action may be required to open and Deobfuscate/Decode Files or Information for User Execution.

Tactics: TA0005
Techniques: T1027
Input: The initial beacon packet for Mis-Type contains the operating system version and file system of the victim.

Tactics: TA0007
Techniques: T1082
Input: When possible, store keys on separate cryptographic hardware instead of on the local system.

Tactics: TA0006
Techniques: T1552.004, T1552
Input: On Windows, adversaries may use various utilities to download tools, such as copy, finger, and PowerShell commands such as IEX(New-Object Net.WebClient).downloadString() and Invoke-WebRequest.

Tactics: TA0011
Techniques: T1105
Input: However, if the PROJECT stream, which specifies the project properties, is modified in a specific way the decompiled VBA code will not be displayed.

Tactics: TA0005
Techniques: T1564, T1564.007
Input: SUNSPOT malware was designed and used to insert SUNBURST into software builds of the SolarWinds Orion IT management product.

Tactics: TA0001
Techniques: T1195, T1195.002
Input: Turla has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or PowerShell Profile, to decode encrypted PowerShell payloads.

Tactics: TA0005
Techniques: T1140
Input: Malicious AppInit DLLs may also provide persistence by continuously being triggered by API activity.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.010
Input: Dipsind encodes C2 traffic with base64.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Enforce the principle of least privilege by limiting container dashboard access to only the necessary users.

Tactics: TA0002, TA0005
Techniques: T1610
Input: SpeakUp uses the cat /proc/cpuinfo | grep -c "cpu family" 2>&1 command to gather system information.

Tactics: TA0007
Techniques: T1082
Input: PowerDuke has a command to download a file.

Tactics: TA0011
Techniques: T1105
Input: Sliver can take screenshots of the victim’s active display.

Tactics: TA0009
Techniques: T1113
Input: One technique the group has used was to perform a WMI query SELECT * FROM MSAcpi_ThermalZoneTemperature to check the temperature to see if it’s running in a virtual environment.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Ragnar Locker can delete volume shadow copies using vssadmin delete shadows /all /quiet.

Tactics: TA0040
Techniques: T1490
Input: LightNeuron encrypts its configuration files with AES-256.

Tactics: TA0005
Techniques: T1027
Input: Adversaries may use PubPrn to proxy execution of malicious remote files.

Tactics: TA0005
Techniques: T1216.001, T1216
Input: Thread Execution Hijacking is a method of executing arbitrary code in the address space of a separate live process.

Tactics: TA0004, TA0005
Techniques: T1055.003, T1055
Input: The macro performs all of these activities with the following command:cmd /c taskkill /f /im winword.exe&taskkill /f /im Excel.exe&taskkill  /f /im MSPUB.exe&taskkill /f /im POWERPNT.EXE&taskkill /f /im  MSASCuiL.exe&taskkill /f /im MpCmdRun.exe&cd ""%ProgramFiles%\Windows  Defender"" & MpCmdRun.exe -removedefinitions -dynamicsignatures & exitThe macro also attempts to deactivate security mechanisms within Microsoft Office products by modifying the registry

Tactics: TA0004, TA0005
Techniques: T1036, T1112, T1055.012, T1055
Input: APT32 has enumerated DC servers using the command net group "Domain Controllers" /domain.

Tactics: TA0007
Techniques: T1018
Input: Rising Sun can enumerate the compilation timestamp of Windows executable files.

Tactics: TA0007
Techniques: T1083
Input: Since sudo was made for the system administrator, it has some useful configuration features such as a timestamp_timeout, which is the amount of time in minutes between instances of sudo before it will re-prompt for a password.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: Frankenstein has used MSbuild to execute an actor-created file.

Tactics: TA0005
Techniques: T1127.001, T1127
Input: Emotet has been seen exfiltrating system information stored within cookies sent within an HTTP GET request back to its C2 servers.

Tactics: TA0010
Techniques: T1041
Input: There is a startup folder location for individual user accounts as well as a system-wide startup folder that will be checked regardless of which user account logs in.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Elise encrypts several of its files, including configuration files.

Tactics: TA0005
Techniques: T1027
Input: APT29 has developed malware variants written in Python.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Monitor application logs for suspicious events including repeated MFA failures that may indicate user's primary credentials have been compromised.

Tactics: TA0006
Techniques: T1621
Input: Kimsuky has purchased hosting servers with virtual currency and prepaid cards.

Tactics: TA0042
Techniques: T1583.004, T1583
Input: Adversaries may use hidden users to hide the presence of user accounts they create or modify.

Tactics: TA0005
Techniques: T1564.002, T1564
Input: LightNeuron has used a malicious Microsoft Exchange transport agent for persistence.

Tactics: TA0003
Techniques: T1505.002, T1505
Input: SHARPSTATS has used base64 encoding and XOR to obfuscate PowerShell scripts.

Tactics: TA0005
Techniques: T1027
Input: Machete has used batch files to initiate additional downloads of malicious files.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Pay2Key has used RSA encrypted communications with C2.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: WannaCry uses attrib +h and icacls .

Tactics: TA0005
Techniques: T1222, T1222.001
Input: Adversaries may search connected removable media on computers they have compromised to find files of interest.

Tactics: TA0009
Techniques: T1025