madox81/Adema_ATTACK_DS huggingface dataset:
Input: XCSSET uses a shell script to execute Mach-o files and osacompile commands such as, osacompile -x -o xcode.app main.applescript.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: ROKRAT can steal credentials by leveraging the Windows Vault mechanism.

Tactics: TA0006
Techniques: T1555, T1555.004
Input: Xbash can use regsvr32 for executing scripts.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Figure 2 – The GitHub profile for F0R3X containing both legitimate forked code and the binaries created by the attacker

Tactics: TA0005
Techniques: T1140
Input: Similarly, this attribute can be recursively removed from all files in a folder using xattr, sudo xattr -d com.apple.quarantine /path/to/folder.

Tactics: TA0005
Techniques: T1553.001, T1553
Input: Emotet has sent Microsoft Word documents with embedded macros that will invoke scripts to download additional payloads.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: If web browser credential disclosure is a significant concern, technical controls, policy, and user training may be used to prevent storage of credentials in web browsers.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Systemd timers are unit files with file extension .timer that control services.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.006, T1053
Input: For example, in macOS you can review logs for "screensharingd" and "Authentication" event messages.

Tactics: TA0008
Techniques: T1021
Input: Gelsemium has the ability to store its components in the Registry.

Tactics: TA0005
Techniques: T1112
Input: BoomBox can download files from Dropbox using a hardcoded access token.

Tactics: TA0011
Techniques: T1102
Input: Monitor newly executed processes that may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

Tactics: TA0007
Techniques: T1083
Input: However, the system may require an administrative account to log in or to perform it's intended purpose.

Tactics: TA0002, TA0008
Techniques: T1072
Input: Internet scanners may be used to look for patterns associated with malicious content designed to collect host hardware information from visitors.Much of this activity may have a very high occurrence and associated false positive rate, as well as potentially taking place outside the visibility of the target organization, making detection difficult for defenders.

Tactics: TA0043
Techniques: T1592, T1592.001
Input: The net view \remotesystem and net share commands in Net can be used to find shared drives and directories on remote and local systems respectively.

Tactics: TA0007
Techniques: T1135
Input: EnvyScout has the ability to proxy execution of malicious files with Rundll32.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: ThreatNeedle can run in memory and register its payload as a Windows service.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: RainyDay has downloaded as a XOR-encrypted payload.

Tactics: TA0005
Techniques: T1027
Input: TEMP.Veles has used port-protocol mismatches on ports such as 443, 4444, 8531, and 50501 during C2.

Tactics: TA0011
Techniques: T1571
Input: Ajax Security Team has used FireMalv custom-developed malware, which collected passwords from the Firefox browser storage.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Also, this variant of OopsIE uses the output of the whoami command as the parameter within the URL when communicating with the C2 server, which differs from the previous OopsIE variant that used the hostname and username from the environment variables

Tactics: TA0007
Techniques: T1033
Input: TeamTNT has also encoded files using Base64.

Tactics: TA0005
Techniques: T1027
Input: certutil is a WIndows component that can download external content to the computer. In a typical attack, the criminals follow this paradigm

Tactics: TA0011
Techniques: T1105
Input: Users checking or changing their HISTCONTROL, HISTFILE, or HISTFILESIZE environment variables may be suspicious.

Tactics: TA0005
Techniques: T1562.003, T1562
Input: Placing a program within a startup folder will also cause that program to execute when a user logs in.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: gh0st RAT can download files to the victim’s machine.

Tactics: TA0011
Techniques: T1105
Input: If running with root permissions, OSX_OCEANLOTUS.D can create a persistence file in the folder /Library/LaunchDaemons.

Tactics: TA0003, TA0004
Techniques: T1543.004, T1543
Input: S-Type also runs tests to determine the privilege level of the compromised user.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: GrimAgent has used Rotate on Right (RoR) and Rotate on Left (RoL) functionality to encrypt strings.

Tactics: TA0005
Techniques: T1027
Input: APT29 has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Grandoreiro can collect the username from the victim's machine.

Tactics: TA0007
Techniques: T1033
Input: ThiefQuest uses AppleScript's osascript -e command to launch ThiefQuest's persistence via Launch Agent and Launch Daemon.

Tactics: TA0002
Techniques: T1059.002, T1059
Input: Trojan.Karagany can use netstat to collect a list of network connections.

Tactics: TA0007
Techniques: T1049
Input: BackdoorDiplomacy has copied files of interest to the main drive's recycle bin.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: BitPaymer can enumerate the sessions for each user logged onto the infected host.

Tactics: TA0007
Techniques: T1087, T1087.001
Input: Additionally, adversaries may compromise numerous machines to form a botnet they can leverage.

Tactics: TA0042
Techniques: T1584
Input: If after the package has been decoded its size is bigger than 3 bytes, the Trojan decrypts its first 11 bytes with XOR using the method similar to the one described above

Tactics: TA0005
Techniques: T1140
Input: Assuming the lists of credentials are valid, the mass collection confirms our hypothesis that the OilRig group maintains a heavy emphasis on credential based attacks along with the other types of attacks they deploy

Tactics: TA0006
Techniques: T1003
Input: Adversaries may attempt to get a listing of open application windows.

Tactics: TA0007
Techniques: T1010
Input: Gazer has commands to delete files and persistence mechanisms from the victim.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Operation Wocao has gathered a recursive directory listing to find files and directories of interest.

Tactics: TA0007
Techniques: T1083
Input: Penquin can execute the command code do_upload to send files to C2.

Tactics: TA0010
Techniques: T1041
Input: ADVSTORESHELL can run Systeminfo to gather information about the victim.

Tactics: TA0007
Techniques: T1082
Input: Monitor for suspicious files ( .pdf, .docx, .jpg, ) viewed in isolation that may steal data by exfiltrating it over an existing command and control channel.

Tactics: TA0010
Techniques: T1041
Input: Dragonfly has copied and installed tools for operations once in the victim environment.

Tactics: TA0011
Techniques: T1105
Input: Various Lazarus Group malware modifies the Windows firewall to allow incoming connections or disable it entirely using netsh.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: MarkiRAT can upload data from the victim's machine to the C2 server.

Tactics: TA0009
Techniques: T1005
Input: OSInfo discovers information about the infected machine.

Tactics: TA0007
Techniques: T1082
Input: Adversaries may also acquire infrastructure from VPS service providers that are known for renting VPSs with minimal registration information, allowing for more anonymous acquisitions of infrastructure.

Tactics: TA0042
Techniques: T1583.003, T1583
Input: Launch Agents are created with user level privileges and execute with user level permissions.

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055.011, T1055
Input: The Trojan uses the access token to write the string above to the first file uploaded to Google drive whose filename is <process ID of Trojan>.txt

Tactics: TA0004, TA0005
Techniques: T1134
Input: Ensure that local administrator accounts have complex, unique passwords.

Tactics: TA0005, TA0008
Techniques: T1550.003, T1550
Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Phishing for Information or Search Open Technical Databases), establishing operational resources (ex: Establish Accounts or Compromise Accounts), and/or initial access (ex: Trusted Relationship or Phishing).

Tactics: TA0043
Techniques: T1594
Input: Turian can insert pseudo-random characters into its network encryption setup.

Tactics: TA0011
Techniques: T1001.001, T1001
Input: Use anti-spoofing and email authentication mechanisms to filter messages based on validity checks of the sender domain (using SPF) and integrity of messages (using DKIM).

Tactics: TA0043, TA0001
Techniques: T1598.002, T1566, T1566.002, T1566.001, T1598, T1598.003
Input: Often the website used by an adversary is one visited by a specific community, such as government, a particular industry, or region, where the goal is to compromise a specific user or set of users based on a shared interest.

Tactics: TA0001
Techniques: T1189
Input: RainyDay can use a file exfiltration tool to collect recently changed files with specific extensions.

Tactics: TA0007
Techniques: T1083
Input: Encrypted password (G$RADIUSCHAP) from the Active Directory user-structure userParameters

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.005
Input: TajMahal has the ability to index and compress files into a send queue for exfiltration.

Tactics: TA0009
Techniques: T1119
Input: REvil can identify the username, machine name, system language, keyboard layout, OS version, and system drive information on a compromised host.

Tactics: TA0007
Techniques: T1082
Input: Externally monitor the availability of services that may be targeted by an Endpoint DoS.

Tactics: TA0040
Techniques: T1499.002, T1499, T1499.003, T1499.004
Input: Chimera has encoded PowerShell commands.

Tactics: TA0005
Techniques: T1027
Input: Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.

Tactics: TA0001
Techniques: T1189
Input: This type of capability was previously used for the purposes of web censorship where client HTTP traffic was modified to include a reference to JavaScript that generated the DDoS code to overwhelm target web servers.

Tactics: TA0040
Techniques: T1499
Input: Adversaries may make use of Domain Generation Algorithms (DGAs) to dynamically identify a destination domain for command and control traffic rather than relying on a list of static IP addresses or domains.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: Linux systems on Active Directory domains store Kerberos credentials locally in the credential cache file referred to as the "ccache".

Tactics: TA0006
Techniques: T1558
Input: NanoCore’s plugins were obfuscated with Eazfuscater.NET 3.3.

Tactics: TA0005
Techniques: T1027
Input: Operation Wocao has collected a list of installed software on the infected system.

Tactics: TA0007
Techniques: T1518
Input: Command arguments used before and after the regsvr32.exe invocation may also be useful in determining the origin and purpose of the script or DLL being loaded.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Software packing is a method of compressing or encrypting an executable.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Industroyer can enumerate remote computers in the compromised network.

Tactics: TA0007
Techniques: T1018
Input: The Trojan compares the TimeZone.CurrentTimeZone.DaylightName property to strings Iran, Arab, Arabia and Middle East, which will match the following time zones in Windows:   Arabic Daylight Time (UTC+3) Arab Daylight Time (UTC+3) Arabian Daylight Time (UTC+4) Middle East Daylight Time (UTC+2) Iran Daylight Time (UTC+3.5) According to MSDN, these five time zones encompass 10 countries that fall within UTC+2, +3, +3.5 or +4 as seen in Figure 3

Tactics: TA0005, TA0007
Techniques: T1070, T1070.006, T1124
Input: Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network.

Tactics: TA0011
Techniques: T1095
Input: In doing so the adversary would be able to gain the service principal’s roles and permissions, which may be different from those of the Application Administrator.

Tactics: TA0003
Techniques: T1098, T1098.003
Input: Detection of compromised /techniques/T1078 in-use by adversaries may help as well.

Tactics: TA0006
Techniques: T1003, T1003.002
Input: The CAB file contains the following files and functions:  dll: A malicious DLL used to launch batch files (used with cliconfg.exe for UAC bypass)

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: KONNI has used certutil to download and decode base64 encoded strings and has also devoted a custom section to performing all the components of the deobfuscation process.

Tactics: TA0005
Techniques: T1140
Input: More_eggs has used regsvr32.exe to execute the malicious DLL.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: ZxShell hooks several API functions to spawn system threads.

Tactics: TA0006, TA0009
Techniques: T1056.004, T1056
Input: Monitor for unexpected processes interacting with authentication mechanisms and processes to access user credentials or enable otherwise unwarranted access to accounts.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556
Input: POWERSTATS can use DCOM (targeting the 127.0.0.1 loopback address) to execute additional payloads on compromised hosts.

Tactics: TA0002
Techniques: T1559, T1559.001
Input: Screenshot in leak of administrative panel for an account at DeltaHost If we use the filename of this screenshot and assume that it was taken on March 29, 2019 and subtract 194 days from this date, it is possible that this server had been operational since at least September 16, 2018

Tactics: TA0009
Techniques: T1113
Input: Exaramel for Linux uses RC4 for encrypting the configuration.

Tactics: TA0005
Techniques: T1027
Input: APT28 can perform brute force attacks to obtain credentials.

Tactics: TA0006
Techniques: T1110
Input: Avaddon bypasses UAC using the CMSTPLUA COM interface.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: APT39 has used the BITS protocol to exfiltrate stolen data from a compromised host.

Tactics: TA0003, TA0005
Techniques: T1197
Input: SMOKEDHAM has relied upon users clicking on a malicious link delivered through phishing.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: ROKRAT can use VirtualAlloc, WriteProcessMemory, and then CreateRemoteThread to execute shellcode within the address space of Notepad.exe.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Kwampirs decrypts and extracts a copy of its main DLL payload when executing.

Tactics: TA0005
Techniques: T1140
Input: Cardinal RAT can collect the username from a victim machine.

Tactics: TA0007
Techniques: T1033
Input: Patchwork collected and exfiltrated files from the infected system.

Tactics: TA0009
Techniques: T1005
Input: Linux distributions and macOS commonly use key-based authentication to secure the authentication process of SSH sessions for remote management.

Tactics: TA0003
Techniques: T1098.004, T1098
Input: APT32 used the net view command to show all shares available, including the administrative shares such as C$ and ADMIN$.

Tactics: TA0007
Techniques: T1135
Input: APT32 has also impersonated the legitimate Flash installer file name "install_flashplayer.exe".

Tactics: TA0005
Techniques: T1036.004, T1036
Input: Adversaries may perform Network Denial of Service (DoS) attacks to degrade or block the availability of targeted resources to users.

Tactics: TA0040
Techniques: T1498
Input: BRONZE BUTLER has used legitimate applications to side-load malicious DLLs.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.002, T1574
Input: Patchwork uses malicious documents to deliver remote execution exploits as part of.

Tactics: TA0002
Techniques: T1203
Input: On Linux systems, adversaries may hide user accounts from the login screen, also referred to as the greeter.

Tactics: TA0005
Techniques: T1564.002, T1564
Input: Adversaries may abuse these pseudo-hidden keys to conceal payloads/commands used to maintain persistence.

Tactics: TA0005
Techniques: T1112
Input: Reaver will then install itself as a service in the event it is running with SeDebugPrivilege privileges.  The service is configured with a name, description, and display name that is provided within the configuration

Tactics: TA0003, TA0004, TA0007
Techniques: T1007, T1543.003, T1543
Input: NativeZone can decrypt and decode embedded  Cobalt Strike beacon stage shellcode.

Tactics: TA0005
Techniques: T1140
Input: GuLoader has the ability to inject shellcode into a donor processes that is started in a suspended state.

Tactics: TA0004, TA0005
Techniques: T1055
Input: The C2 server sends back Base64 encoded response

Tactics: TA0011
Techniques: T1132
Input: Hancitor has used PowerShell to execute commands.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: IIS modules may also be installed to extend IIS web servers.

Tactics: TA0003
Techniques: T1505.004, T1505
Input: Monitor executed commands and arguments that may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.

Tactics: TA0007
Techniques: T1135
Input: wmic.exe is a powerful, native Windows command line utility used to interact with Windows Management Instrumentation (WMI)

Tactics: TA0002
Techniques: T1047
Input: Bankshot identifies processes and collects the process ids.

Tactics: TA0007
Techniques: T1057
Input: Leviathan has collected compromised credentials to use for targeting efforts.

Tactics: TA0043
Techniques: T1589, T1589.001
Input: Once loaded into the LSA, SSP DLLs have access to encrypted and plaintext passwords that are stored in Windows, such as any logged-on user's Domain password or smart card PINs.

Tactics: TA0003, TA0004, TA0006
Techniques: T1003, T1547.005, T1547, T1003.001
Input: Monitor for changes made to files that may establish persistence by executing malicious content triggered by an interrupt signal.

Tactics: TA0003, TA0004
Techniques: T1546.005, T1546
Input: WebDAV is an extension of HTTP and will typically operate over TCP ports 80 and 443.

Tactics: TA0006
Techniques: T1187
Input: QUADAGENT modifies an HKCU Registry key to store a session identifier unique to the compromised system as well as a pre-shared key used for encrypting and decrypting C2 communications.

Tactics: TA0005
Techniques: T1112
Input: Fox Kitten has accessed victim security and IT environments and Microsoft Teams to mine valuable information.

Tactics: TA0009
Techniques: T1213
Input: This Network DoS attack may also reduce the availability and functionality of the targeted system(s) and network.

Tactics: TA0040
Techniques: T1498, T1498.002
Input: gh0st RAT can load DLLs into memory.

Tactics: TA0002
Techniques: T1129
Input: Adversaries may connect to a remote system over RDP/RDS to expand access if the service is enabled and allows access to accounts with known credentials.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: Confucius has exfiltrated stolen files to its C2 server.

Tactics: TA0010
Techniques: T1041
Input: Use of PowerShell to download additional tools

Tactics: TA0011
Techniques: T1105
Input: Zox has the ability to list processes.

Tactics: TA0007
Techniques: T1057
Input: cron execution can be reviewed within the /var/log directory.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: Bad Rabbit has used Mimikatz to harvest credentials from the victim's machine.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Grandoreiro can capture clipboard data from a compromised host.

Tactics: TA0009
Techniques: T1115
Input: QakBot has gained execution through users opening malicious attachments.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Windows 8.1 and Windows Server 2012 R2 may generate events when unsigned DLLs try to load into the LSA by setting the Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe with AuditLevel = 8.

Tactics: TA0003, TA0004
Techniques: T1547.002, T1547
Input: LookBack uses a modified version of RC4 for data transfer.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: The COR_PROFILER environment variable can be set at various scopes (system, user, or process) resulting in different levels of influence.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.012, T1574
Input: WhisperGate has the ability to inject its fourth stage into a suspended process created by the legitimate Windows utility InstallUtil.exe.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Chrommme can encrypt sections of its code to evade detection.

Tactics: TA0005
Techniques: T1027
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may target resource intensive features of web applications to cause a denial of service (DoS).

Tactics: TA0040
Techniques: T1499, T1499.003
Input: It has the capability to find files, enumerate drives, exfiltrate data, take screenshots and provide a reverse shell

Tactics: TA0007, TA0009, TA0011
Techniques: T1090.003, T1083, T1113, T1090
Input: FatDuke has used HKLM\SOFTWARE\Microsoft\CurrentVersion\Run to establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Threat Group-3390 has used the net view command.

Tactics: TA0007
Techniques: T1018
Input: WarzoneRAT can include a rootkit to hide processes, files, and startup.

Tactics: TA0005
Techniques: T1014
Input: Exploited Vulnerabilities: Frequent exploitation of vulnerabilities in Hangul Word Processor (HWP), as well as Adobe Flash

Tactics: TA0004
Techniques: T1068
Input: Establish centralized logging of instance activity, which can be used to monitor and review system events even after reverting to a snapshot, rolling back changes, or changing persistence/type of storage.

Tactics: TA0005
Techniques: T1578, T1578.004
Input: PowerDuke has commands to get the current user's name and SID.

Tactics: TA0007
Techniques: T1033
Input: One example of this type of attack is known as a simple HTTP flood, where an adversary sends a large number of HTTP requests to a web server to overwhelm it and/or an application that runs on top of it.

Tactics: TA0040
Techniques: T1499.002, T1499
Input: Lazarus Group collected email addresses belonging to various departments of a targeted organization which were used in follow-on phishing campaigns.

Tactics: TA0043
Techniques: T1589.002, T1589
Input: Lazarus Group malware TangoDelta attempts to terminate various processes associated with McAfee.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Agent Tesla has used wmi queries to gather information from the system.

Tactics: TA0002
Techniques: T1047
Input: The domain names differed but the script adheres to the same logic (including the logic function).” The DNSMessenger malware is an obfuscated and customized version of the popular DNS_TXT_PWNAGE.ps1 script available on GitHub and is also referred to by FireEye as POWERSOURCE

Tactics: TA0005
Techniques: T1027
Input: The decrypted contents of the log file adhere to the format in Figure 22

Tactics: TA0005
Techniques: T1140
Input: itwm= ags= oe= aq= btnG= oprnd= itwm= utm= channel= The XAgent OSX Trojan generates a system specific value that it refers to as an “agent_id”, which is a unique identifier for each compromised host

Tactics: TA0007
Techniques: T1082
Input: Remsec contains a module to move data from airgapped networks to Internet-connected systems by using a removable USB device.

Tactics: TA0010
Techniques: T1052, T1052.001
Input: Elise communicates over HTTP or HTTPS for C2.

Tactics: TA0011
Techniques: T1071, T1071.001