madox81/Adema_ATTACK_DS huggingface dataset:
Input: Users may be subjected to social engineering to get them to click on a link that will lead to code execution.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: LoudMiner has used QEMU and VirtualBox to run a Tiny Core Linux virtual machine, which runs XMRig and makes connections to the C2 server for updates.

Tactics: TA0005
Techniques: T1564, T1564.006
Input: Bisonal has used commands and API calls to gather system information.

Tactics: TA0007
Techniques: T1082
Input: Sandworm Team has obtained valid emails addresses while conducting research against target organizations that were subsequently used in spearphishing campaigns.

Tactics: TA0043
Techniques: T1589.002, T1589
Input: These documents can be delivered via other techniques such as Phishing and/or Taint Shared Content and may evade static detections since no typical indicators (VBA macro, script, ) are present until after the malicious payload is fetched.

Tactics: TA0005
Techniques: T1221
Input: FoggyWeb can use a dynamic XOR key and a custom XOR methodology to encode data before exfiltration.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: For C2 over HTTP, Helminth encodes data with base64 and sends it via the "Cookie" field of HTTP requests.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: GoldMax has used decoy traffic to surround its malicious network traffic to avoid detection.

Tactics: TA0011
Techniques: T1001.001, T1001
Input: Monitor for changes to and suspicious processes modifiying /etc/ssh/sshd_config.

Tactics: TA0003
Techniques: T1098.004, T1098
Input: Higaisa collected the system volume serial number, GUID, and computer name.

Tactics: TA0007
Techniques: T1082
Input: BabyShark has a PowerShell-based remote administration ability that can implement a PowerShell or C# based keylogger.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Remsec can obtain the OS version information, computer name, processor architecture, machine role, and OS edition.

Tactics: TA0007
Techniques: T1082
Input: Torisma has been packed with Iz4 compression.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: BlackTech has used e-mails with malicious documents to lure victims into installing malware.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Agent Tesla can inject into known, vulnerable binaries on targeted hosts.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Monitor executed commands and arguments that may abuse Python commands and scripts for execution.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: Micropsia uses HTTP and HTTPS for C2 network communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Valak can use the Registry for code updates and to collect credentials.

Tactics: TA0007
Techniques: T1012
Input: Ursnif has used a 30 minute delay after execution to evade sandbox monitoring tools.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.003
Input: Darkhotel has exploited Adobe Flash vulnerability CVE-2015-8651 for execution.

Tactics: TA0002
Techniques: T1203
Input: Calisto uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration.

Tactics: TA0005, TA0009
Techniques: T1564, T1074.001, T1074, T1564.001
Input: APT32 has lured targets to download a Cobalt Strike beacon by including a malicious link within spearphishing emails.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: GreyEnergy enumerates all Windows services.

Tactics: TA0007
Techniques: T1007
Input: Indrik Spider has used WMIC to execute commands on remote computers.

Tactics: TA0002
Techniques: T1047
Input: Organizations often grant elevated access to second or third-party external providers in order to allow them to manage internal systems as well as cloud-based environments.

Tactics: TA0001
Techniques: T1199
Input: xCaon has decoded strings from the C2 server before executing commands.

Tactics: TA0005
Techniques: T1140
Input: Figure 1 XAgent macOS HTTP POST request  Figure 2 XAgent mscOS HTTP GET request The C2 URLs generated by XAgentOSX are very similar to those created by its Windows-based counterpart

Tactics: TA0011
Techniques: T1071
Input: Monitor for newly executed processes that could be used to abuse internet browser extensions to establish persistence.

Tactics: TA0003
Techniques: T1176
Input: The adversary can then collect the hash information sent over the wire through tools that monitor the ports for traffic or through Network Sniffing and crack the hashes offline through Brute Force to obtain the plaintext passwords.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: TrickBot can identify the groups the user on a compromised host belongs to.

Tactics: TA0007
Techniques: T1069
Input: Okrum has used base64 to encode C2 communication.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: ObliqueRAT can capture images from webcams on compromised hosts.

Tactics: TA0009
Techniques: T1125
Input: Doki’s container was configured to bind the host root directory.

Tactics: TA0004
Techniques: T1611
Input: SMOKEDHAM has encrypted its C2 traffic with RC4.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Remsec is capable of listing contents of folders on the victim.

Tactics: TA0007
Techniques: T1083
Input: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: BLUELIGHT can check to see if the infected machine has VM tools running.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Pteranodon identifies files matching certain file extension and copies them to subdirectories it created.

Tactics: TA0007
Techniques: T1083
Input: There are often remote service gateways that manage connections and credential authentication for these services.

Tactics: TA0001, TA0003
Techniques: T1133
Input: APT28 has used compromised Office 365 service accounts with Global Administrator privileges to collect email from user inboxes.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078.004, T1078
Input: Changes could be disabling the entire mechanism as well as adding, deleting, or modifying particular rules.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: Messages are encrypted using AES with a static key

Tactics: TA0005
Techniques: T1027
Input: Operation Wocao has used local account credentials found during the intrusion for lateral movement and privilege escalation.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.003
Input: These mechanisms may include automatically executing programs that are placed in specially designated directories or are referenced by repositories that store configuration information, such as the Windows Registry.

Tactics: TA0003, TA0004
Techniques: T1547
Input: Network Indicators​     Hostname IP Address Notes   mailcenter.support 221.121.138.139 Domain used to for sending spear phishes and user tracking

Tactics: TA0007
Techniques: T1016
Input: APT37 collects the computer name, the BIOS model, and execution path.

Tactics: TA0007
Techniques: T1082
Input: Figure 2: Excerpt of an APT33 malicious .hta file We assess APT33 used a built-in phishing module within the publicly available ALFA TEaM Shell (aka ALFASHELL) to send hundreds of spear phishing emails to targeted individuals in 2016

Tactics: TA0001
Techniques: T1566, T1566.001
Input: REvil has used HTTP and HTTPS in communication with C2.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: SynAck parses the export tables of system DLLs to locate and call various Windows API functions.

Tactics: TA0002
Techniques: T1106
Input: Detection of Network DoS can sometimes be achieved before the traffic volume is sufficient to cause impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness or services provided by an upstream network service provider.

Tactics: TA0040
Techniques: T1498, T1498.002, T1498.001
Input: Some endpoint security solutions can be configured to block some types of behaviors related to process injection/memory tampering based on common sequences of indicators (ex: execution of specific API functions).

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.013, T1574
Input: Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using rundll32.exe.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: System and network discovery techniques normally occur throughout an operation as an adversary learns the environment.

Tactics: TA0007
Techniques: T1007, T1619, T1069, T1010
Input: EVILNUM has a function called "DeleteLeftovers" to remove certain artifacts of the attack.

Tactics: TA0005
Techniques: T1070
Input: NotPetya uses wevtutil to clear the Windows event logs.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: Domain trusts can be enumerated using the DSEnumerateDomainTrusts() Win32 API call, .NET methods, and LDAP.

Tactics: TA0007
Techniques: T1482
Input: The net time command can be used in Net to determine the local or remote system time.

Tactics: TA0007
Techniques: T1124
Input: The write can be performed with native Windows API calls such as VirtualAllocEx and WriteProcessMemory, then invoked with CreateRemoteThread or additional code (ex: shellcode).

Tactics: TA0004, TA0005
Techniques: T1055.002, T1055
Input: (Source: Dell SecureWorks) In SWCs analyzed by CTU researchers, the threat actors added the Dean Edwards packed JavaScript code shown in Figure 9 to the end of a legitimate website's menu page

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Figure 3: FIN7 phishing lure persistence mechanisms Examining Attacker Shortcut Files In many cases, attacker-created LNK files can reveal valuable information about the attacker’s development environment

Tactics: TA0003, TA0004
Techniques: T1547.009, T1547
Input: Windows Credential Editor can dump credentials.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: The wormDll32 module attempts to identify servers and domain controllers in the network using NetServerEnum and LDAP queries.

Tactics: TA0007
Techniques: T1482
Input: If so, NETEAGLE will send beacons via an HTTP POST request; otherwise it will send beacons via UDP/6000.

Tactics: TA0011
Techniques: T1008
Input: The Komplex payload is stored in a hidden directory at /Users/Shared/.local/kextd.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: APT29 has used compromised identities to access networks via SSH,  VPNs, and other remote access tools.

Tactics: TA0001, TA0003
Techniques: T1133
Input: An adversary can leverage a computer's peripheral devices (, microphones and webcams) or applications (, voice and video call services) to capture audio recordings for the purpose of listening into sensitive conversations to gather information.

Tactics: TA0009
Techniques: T1123
Input: When it first starts, BADNEWS crawls the victim's local drives and collects documents with the following extensions: .doc, .docx, .pdf, .ppt, .pptx, and .txt.

Tactics: TA0009
Techniques: T1005
Input: MuddyWater has used malware to check running processes against a hard-coded list of security tools often used by malware researchers.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: The user access logging within Atlassian's Confluence can also be configured to report access to certain pages and documents through AccessLogFilter.

Tactics: TA0009
Techniques: T1213
Input: Organizations should limit the number of users within the organization with an IAM role that has administrative privileges, strive to reduce all permanent privileged role assignments, and conduct periodic entitlement reviews on IAM users, roles and policies.

Tactics: TA0007
Techniques: T1087, T1087.004
Input: POWERTON can use WMI for persistence.

Tactics: TA0003, TA0004
Techniques: T1546.003, T1546
Input: Tonto Team has delivered payloads via spearphishing attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Kivars has the ability to list drives on the infected host.

Tactics: TA0007
Techniques: T1083
Input: SYNful Knock has the capability to add its own custom backdoor password when it modifies the operating system of the affected network device.

Tactics: TA0003, TA0005, TA0006
Techniques: T1556, T1556.004
Input: The first shellcode decrypts a further shellcode block

Tactics: TA0005
Techniques: T1140
Input: Tropic Trooper has used known administrator account credentials to execute the backdoor directly.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.003
Input: Donut can generate encrypted, compressed/encoded, or otherwise obfuscated code modules.

Tactics: TA0005
Techniques: T1027
Input: There are several examples of malware targeting cookies from web browsers on the local system.

Tactics: TA0006
Techniques: T1539
Input: Exaramel for Linux can execute commands with high privileges via a specific binary with setuid functionality.

Tactics: TA0004, TA0005
Techniques: T1548, T1548.001
Input: Monitor executed commands and arguments for actions that could be taken to remove or overwrite system logs.

Tactics: TA0005
Techniques: T1070, T1070.002
Input: Naikon has used a netbios scanner for remote machine identification.

Tactics: TA0007
Techniques: T1018
Input: APT3 has used tools to compress data before exfilling it.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: GOLD SOUTHFIELD has distributed ransomware by backdooring software installers via a strategic web compromise of the site hosting Italian WinRAR.

Tactics: TA0001
Techniques: T1195, T1195.002
Input: Adversaries may install SSL/TLS certificates that can be used during targeting.

Tactics: TA0042
Techniques: T1608.003, T1608
Input: ThreatNeedle has been compressed and obfuscated using RC4, AES, or XOR.

Tactics: TA0005
Techniques: T1027
Input: P.A.S. Webshell has the ability to list files and file characteristics including extension, size, ownership, and permissions.

Tactics: TA0007
Techniques: T1083
Input: SideTwist can execute shell commands on a compromised host.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Stuxnet enumerates the currently running processes related to a variety of security products.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: If the quarantine flag is set in macOS 10.15+, Gatekeeper also checks for a notarization ticket and sends a cryptographic hash to Apple's servers to check for validity for all unsigned executables.

Tactics: TA0005
Techniques: T1553.001, T1553
Input: Detection efforts may be focused on post-compromise phases of the adversary lifecycle, such as /techniques/T1105.

Tactics: TA0042
Techniques: T1608, T1608.002
Input: KONNI has used parent PID spoofing to spawn a new cmd process using CreateProcessW and a handle to Taskmgr.exe.

Tactics: TA0004, TA0005
Techniques: T1134.004, T1134
Input: This could include maliciously redirecting  or even disabling host-based sensors, such as Event Tracing for Windows (ETW), by tampering settings that control the collection and flow of event telemetry.

Tactics: TA0005
Techniques: T1562.006, T1562
Input: Bundlore has obfuscated data with base64, AES, RC4, and bz2.

Tactics: TA0005
Techniques: T1027
Input: APT29 used netsh to configure firewall rules that limited certain UDP outbound packets.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files.

Tactics: TA0008
Techniques: T1080
Input: As shown in Figure 11, after compromising an initial victim's system (patient 0), the threat actors use the Baidu search engine to search for the victim's organization name

Tactics: TA0007, TA0011
Techniques: T1090.003, T1083, T1082, T1090
Input: Adversaries may abuse a double extension in the filename as a means of masquerading the true file type.

Tactics: TA0005
Techniques: T1036, T1036.007
Input: Conficker copies itself into the %systemroot%\system32 directory and registers as a service.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Consider re-locking password managers after a short timeout to limit the time plaintext credentials live in memory from decrypted databases.

Tactics: TA0006
Techniques: T1555.005, T1555
Input: The recovered encrypted data may be vulnerable to offline Password Cracking attacks similarly to Kerberoasting and expose plaintext credentials.

Tactics: TA0006
Techniques: T1558, T1558.004
Input: Most cloud service providers support a Cloud Instance Metadata API which is a service provided to running virtual instances that allows applications to access information about the running virtual instance.

Tactics: TA0006
Techniques: T1552, T1552.005
Input: It is a preferred platform within data centers and the cloud for businesses, as well as an ongoing favorite when it comes to a majority of Internet-facing web and application servers

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Carbon can collect the IP address of the victims and other computers on the network using the commands: ipconfig -all nbtstat -n, and nbtstat -s.

Tactics: TA0007
Techniques: T1016
Input: When an adversary takes control of such a boundary device, they can bypass its policy enforcement to pass normally prohibited traffic across the trust boundary between the two separated networks without hinderance.

Tactics: TA0005
Techniques: T1599
Input: Adversaries may purchase domains similar to legitimate domains (ex: homoglyphs, typosquatting, different top-level domain, ) during acquisition of infrastructure (Domains) to help facilitate Malicious Link.

Tactics: TA0042
Techniques: T1608.005, T1608
Input: Adversaries may create or modify systemd services to repeatedly execute malicious payloads as part of persistence.

Tactics: TA0003, TA0004
Techniques: T1543.002, T1543
Input: Monitor executed commands and arguments for actions that could be taken to gather system and network information, such as nltest /domain_trusts.

Tactics: TA0007
Techniques: T1482
Input: WindTail has used icons mimicking MS Office files to mask payloads.

Tactics: TA0005
Techniques: T1036
Input: StrongPity has used HTTPS over port 1402 in C2 communication.

Tactics: TA0011
Techniques: T1571
Input: Mofang's malicious spearphishing attachments required a user to open the file after receiving.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Epic uses the net time command  to get the system time from the machine and collect the current date and time zone information.

Tactics: TA0007
Techniques: T1124
Input: This method typically requires administrative level access to the device.

Tactics: TA0005
Techniques: T1601, T1601.001
Input: ServHelper contains a module for downloading and executing DLLs that leverages rundll32.exe.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: HermeticWizard has the ability to scan ports on a compromised network.

Tactics: TA0007
Techniques: T1046
Input: USBferry can copy its installer to attached USB storage devices.

Tactics: TA0001, TA0008
Techniques: T1091
Input: We are still analyzing this Trojan to determine the specific structure of the data sent between the Trojan and the C2 server; however, it does appear that the Trojan is using the RC4 algorithm to encrypt data sent to the C2 server within HTTP POST requests

Tactics: TA0011, TA0010
Techniques: T1041, T1573
Input: Monitor executed commands and arguments that may attempt to get a listing of services running on remote hosts, including those that may be vulnerable to remote software exploitation.

Tactics: TA0007
Techniques: T1046
Input: Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by Replication Through Removable Media.

Tactics: TA0011
Techniques: T1092
Input: 69 70 rn64.dll rn32.dll Daily “ClientRecon” (ComputerName, OS information, MacAddress, WirelessNetwork keys, connected Apple devices, Apple mobile devices backups list, IE version, SecurityCenterInfo (AV, Firewalls and AntiSpyware products), Hardware info, Installed soft including Metro Apps, Users, Autoruns)

Tactics: TA0007
Techniques: T1120, T1082
Input: Windigo has delivered a generic Windows proxy Win32/Glubteta.M.

Tactics: TA0011
Techniques: T1090
Input: The code is obfuscated in order to hide any malicious activity on the remote server

Tactics: TA0005
Techniques: T1027
Input: In some cases where an adversary has access to a system that is in the authentication path between systems or when automated scans that use credentials attempt to authenticate to an adversary controlled system, the NTLMv2 hashes can be intercepted and relayed to access and execute code against a target system.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: Software exploits may not always succeed or may cause the exploited process to become unstable or crash.

Tactics: TA0001, TA0002, TA0004, TA0005, TA0006, TA0008
Techniques: T1210, T1203, T1211, T1212, T1190, T1068
Input: APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.

Tactics: TA0002
Techniques: T1203
Input: MESSAGETAP stored targeted SMS messages that matched its target list in CSV files on the compromised system.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: External Defacement may ultimately cause users to distrust the systems and to question/discredit the system’s integrity.

Tactics: TA0040
Techniques: T1491.002, T1491
Input: Monitor network data flows for unexpected patterns and metadata that may be indicative of a mismatch between protocol and utilized port.

Tactics: TA0011
Techniques: T1571
Input: Pteranodon can capture screenshots at a configurable interval.

Tactics: TA0009
Techniques: T1113
Input: SILENTTRINITY can establish persistence by creating a new service.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: HOPLIGHT has modified Managed Object Format (MOF) files within the Registry to run specific commands and create persistence on the system.

Tactics: TA0005
Techniques: T1112
Input: Credentials can then be used to perform Lateral Movement and access restricted information.

Tactics: TA0006
Techniques: T1003
Input: Adversaries may gather email addresses that can be used during targeting.

Tactics: TA0043
Techniques: T1589.002, T1589
Input: Kimsuky has a HWP document stealer module which changes the default program association in the registry to open HWP documents.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.001
Input: Olympic Destroyer uses PsExec to interact with the ADMIN$ network share to execute commands on remote systems.

Tactics: TA0008
Techniques: T1021, T1021.002
Input: SMOKEDHAM has created user accounts and added them to local Admin groups.

Tactics: TA0003
Techniques: T1136, T1136.001
Input: The following function written in Python may be used to decode this file:def decode(data): 	out = "" 	c = 0 	for d in data: 		out += chr(ord(d)^c) 		c+=1 	return outOnce decoded it is discovered that this instance of OceanSalt attempts to communicate with 61.14.210[.]72 on port 7117

Tactics: TA0005
Techniques: T1140
Input: An adversary may need to determine if the remote system is in a vulnerable state, which may be done through Network Service Discovery or other Discovery methods looking for common, vulnerable software that may be deployed in the network, the lack of certain patches that may indicate vulnerabilities,  or security software that may be used to detect or contain remote exploitation.

Tactics: TA0008
Techniques: T1210
Input: More sophisticated malware samples may also potentially bypass protection mechanisms such as data execution prevention (DEP) by triggering a combination of windows procedures and other system functions that will rewrite the malicious payload inside an executable portion of the target process.

Tactics: TA0004, TA0005
Techniques: T1055.011, T1055
Input: Alternate authentication material is legitimately generated by systems after a user or application successfully authenticates by providing a valid identity and the required authentication factor(s).

Tactics: TA0005, TA0008
Techniques: T1550
Input: Detonation chambers can be used to detect these links and either automatically go to these sites to determine if they're potentially malicious, or wait and capture the content if a user visits the link.

Tactics: TA0001
Techniques: T1566, T1566.002