madox81/Adema_ATTACK_DS huggingface dataset:
Input: Figure 2 Code that issues DNS query to gogle.co if a debugger is detected All DNS requests issued by RogueRobin use the built in nslookup.exe application to communicate to the C2 server and the Trojan will use a variety of regular expressions to extract data from the DNS response

Tactics: TA0011
Techniques: T1071
Input: Whitefly frequently delivers Vcrodat as a malicious DLL that has the same name as DLLs belonging to legitimate software from various security vendors.

Tactics: TA0005
Techniques: T1036
Input: The infection process is rather interesting, as it involves multiple layers of .NET assemblies that will eventually download the NanoCore remote administration tool (RAT) from a remote server and inject it into another process

Tactics: TA0004, TA0005, TA0011
Techniques: T1105, T1055
Input: Debugger related system checks will likely occur in the first steps of an operation but may also occur throughout as an adversary learns the environment.

Tactics: TA0005, TA0007
Techniques: T1622
Input: Terminal Services allows servers to transmit a full, interactive, graphical user interface to clients via RDP.

Tactics: TA0003
Techniques: T1505.005, T1505
Input: Regularly scan the internal network for available services to identify new and potentially vulnerable services.

Tactics: TA0008
Techniques: T1210
Input: WarzoneRAT has the capability to install a live and offline keylogger, including through the use of the GetAsyncKeyState Windows API.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Bundlore uses the mktemp utility to make unique file and directory names for payloads, such as TMP_DIR=`mktemp -d -t x.

Tactics: TA0005
Techniques: T1564
Input: On Windows, diantz or  makecab may be used to package collected files into a cabinet (.cab) file.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: SILENTTRINITY can collect start time information from a compromised host.

Tactics: TA0007
Techniques: T1124
Input: build_downer has the ability to use the WinExec API to execute malware on a compromised host.

Tactics: TA0002
Techniques: T1106
Input: Anchor has been signed with valid certificates to evade detection by security tools.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Monitor for changes made to files for unexpected modifications to access permissions and attributes

Tactics: TA0002, TA0003, TA0004, TA0005, TA0006, TA0009
Techniques: T1053, T1574.002, T1053.003, T1574, T1056
Input: Prevent credential overlap across systems of administrator and privileged accounts.

Tactics: TA0002, TA0003, TA0004
Techniques: T1047, T1546.003, T1546
Input: Information from these sources may reveal opportunities for other forms of reconnaissance (ex: Search Victim-Owned Websites or Search Open Websites/Domains), establishing operational resources (ex: Acquire Infrastructure or Compromise Infrastructure), and/or initial access (ex: External Remote Services or Trusted Relationship).

Tactics: TA0043
Techniques: T1596, T1596.001
Input: Mythic can leverage a peer-to-peer C2 profile between agents.

Tactics: TA0011
Techniques: T1090.001, T1090
Input: LazyScripter had downloaded additional tools to a compromised host.

Tactics: TA0011
Techniques: T1105
Input: Remcos uses Python scripts.

Tactics: TA0002
Techniques: T1059.006, T1059
Input: The sensor data may need to be correlated with other events to identify malicious activity, depending on the legitimacy of this behavior within a given network environment.

Tactics: TA0009
Techniques: T1113
Input: KOCTOPUS has used cmd.exe and batch files for execution.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Monitor for access or copy of the NTDS.dit.

Tactics: TA0006
Techniques: T1003.003, T1003
Input: FELIXROOT collects information about the network including the IP address and DHCP server.

Tactics: TA0007
Techniques: T1016
Input: Applications often depend on external software to function properly.

Tactics: TA0001
Techniques: T1195.001, T1195
Input: NETWIRE can use crontabs to establish persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: PowerDuke uses rundll32.exe to load.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: Also consider using Group Managed Service Accounts or another third party product such as password vaulting.

Tactics: TA0006
Techniques: T1558.003, T1558.002, T1558
Input: TEMP.Veles routinely deleted tools, logs, and other files after they were finished with them.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Pysa has executed a malicious executable by naming it svchost.exe.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.

Tactics: TA0004, TA0005
Techniques: T1548
Input: QuietSieve can check C2 connectivity with a ping to 8.8.8.8 (Google public DNS).

Tactics: TA0007
Techniques: T1016.001, T1016
Input: Through DCOM, adversaries operating in the context of an appropriately privileged user can remotely obtain arbitrary and even direct shellcode execution through Office applications as well as other Windows objects that contain insecure methods.

Tactics: TA0008
Techniques: T1021.003, T1021
Input: Hidden Content The primary command and control location used in this campaign is hosted on a blog on blogspot[.]com, which enables the threat actors to hide their malicious content behind a legitimate service

Tactics: TA0011
Techniques: T1102
Input: GrimAgent can set persistence with a Registry run key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Tropic Trooper's backdoor has communicated to the C2 over the DNS protocol.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: SUNBURST removed IFEO and HTTP proxy registry values to clean up traces of execution.

Tactics: TA0005
Techniques: T1070
Input: In addition to detecting a DGA domain based on the name, another more general approach for detecting a suspicious domain is to check for recently registered names or for rarely visited domains.Machine learning approaches to detecting DGA domains have been developed and have seen success in applications.

Tactics: TA0011
Techniques: T1568, T1568.002
Input: APT33 has used base64 to encode command and control traffic.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: The discovery of these resources may inform an adversary’s next steps in the environment, such as how to perform lateral movement and which methods to utilize for execution.

Tactics: TA0007
Techniques: T1613
Input: Property list with persistence settings launchctl load /Library/LaunchDaemons/filename.plist > /dev/nul or launchctl load ~/Library/LaunchAgents/ filename.plist > /dev/nul will then command the operating system to start the dropped backdoor file at login

Tactics: TA0003, TA0004
Techniques: T1543.001, T1543
Input: MURKYTOP has the capability to retrieve information about the OS.

Tactics: TA0007
Techniques: T1082
Input: Ensure proper Registry permissions are in place to prevent adversaries from disabling or interfering logging.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: If the permissions on the file system directory containing a target binary, or permissions on the binary itself are improperly set, then the target binary may be overwritten with another binary using user-level permissions and executed by the original process.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.010, T1574
Input: Smoke Loader adds a Registry Run key for persistence and adds a script in the Startup folder to deploy the payload.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Compare recent invocations of mshta.exe with prior history of known good arguments and executed .hta files to determine anomalous and potentially adversarial activity.

Tactics: TA0005
Techniques: T1218.005, T1218
Input: In this case, the malicious emails contain links.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: Revenge RAT used blogpost.com as its primary command and control server during a campaign.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: Adversaries may disable or modify a firewall within a cloud environment to bypass controls that limit access to cloud resources.

Tactics: TA0005
Techniques: T1562.007, T1562
Input: TAINTEDSCRIBE has used FakeTLS for session authentication.

Tactics: TA0011
Techniques: T1001, T1001.003
Input: Typically, management services over commonly used ports are used when stuffing credentials.

Tactics: TA0006
Techniques: T1110.004, T1110
Input: Golden tickets enable adversaries to generate authentication material for any account in Active Directory.

Tactics: TA0006
Techniques: T1558, T1558.001
Input: TrickBot module "Trickboot" can write or erase the UEFI/BIOS firmware of a compromised device.

Tactics: TA0040
Techniques: T1495
Input: Turla has compromised internal network systems to act as a proxy to forward traffic to C2.

Tactics: TA0011
Techniques: T1090.001, T1090
Input: PLEAD can use ShellExecute to execute applications.

Tactics: TA0002
Techniques: T1106
Input: DHS and FBI are distributing these IP addresses to enable network defense activities and reduce exposure to the DDoS command-and-control network

Tactics: TA0007
Techniques: T1016
Input: Prikormka contains a module that captures screenshots of the victim's desktop.

Tactics: TA0009
Techniques: T1113
Input: The NETWIRE payload has been injected into benign Microsoft executables via process hollowing.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: RawPOS dumps memory from specific processes on a victim system, parses the dumped files, and scrapes them for credit card data.

Tactics: TA0009
Techniques: T1005
Input: Adversaries can spoof an authoritative source for name resolution on a victim network by responding to LLMNR (UDP 5355)/NBT-NS (UDP 137) traffic as if they know the identity of the requested host, effectively poisoning the service so that the victims will communicate with the adversary controlled system.

Tactics: TA0006, TA0009
Techniques: T1557.001, T1557
Input: Avaddon uses wmic.exe to delete shadow copies.

Tactics: TA0002
Techniques: T1047
Input: Maze has used the "Wow64RevertWow64FsRedirection" function following attempts to delete the shadow volumes, in order to leave the system in the same state as it was prior to redirection.

Tactics: TA0005
Techniques: T1070
Input: Dragonfly has used batch scripts to enumerate users on a victim domain controller.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: Compare recent invocations of CMSTP.exe with prior history of known good arguments and loaded files to determine anomalous and potentially adversarial activity.

Tactics: TA0005
Techniques: T1218, T1218.003
Input: GrimAgent  can pad C2 messages with random generated values.

Tactics: TA0011
Techniques: T1001.001, T1001
Input: Pasam creates a backdoor through which remote attackers can upload files.

Tactics: TA0011
Techniques: T1105
Input: Azorult can collect a list of running processes by calling CreateToolhelp32Snapshot.

Tactics: TA0007
Techniques: T1057
Input: Monitor for unexpected browser bookmarks viewed in isolation, this showcases part of a chain of behavior that could lead to other activities, such as Collection and Exfiltration, based on the information obtained.

Tactics: TA0007
Techniques: T1217
Input: Conti has used API calls during execution.

Tactics: TA0002
Techniques: T1106
Input: Machete has a feature to copy files from every drive onto a removable drive in a hidden folder.

Tactics: TA0010
Techniques: T1052, T1052.001
Input: Lazarus Group has renamed malicious code to disguise it as Microsoft's narrator and other legitimate files.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Carbon encrypts configuration files and tasks for the malware to complete using CAST-128 algorithm.

Tactics: TA0005
Techniques: T1027
Input: For some add-ins types (WLL, VBA) additional mitigation is likely required as disabling add-ins in the Office Trust Center does not disable WLL nor does it prevent VBA code from executing.

Tactics: TA0003
Techniques: T1137, T1137.001
Input: Detection efforts may be focused on related stages of the adversary lifecycle, such as initial access and post-compromise behaviors.

Tactics: TA0042
Techniques: T1608
Input: The access may be used to laterally move to other systems, gather information, or cause a specific effect, such as wiping the hard drives on all endpoints.

Tactics: TA0002, TA0008
Techniques: T1072
Input: Later variants upload the file to a web server via an HTTP post command

Tactics: TA0011
Techniques: T1071
Input: BBSRAT has been seen loaded into msiexec.exe through process hollowing to hide its execution.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: The Msiexec.exe binary may also be digitally signed by Microsoft.

Tactics: TA0005
Techniques: T1218, T1218.007
Input: Adversaries may gain access to and use third-party software suites installed within an enterprise network, such as administration, monitoring, and deployment systems, to move laterally through the network.

Tactics: TA0002, TA0008
Techniques: T1072
Input: Threat Group-1314 actors spawned shells on remote systems on a victim network to execute commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Adversaries may disable Windows event logging to limit data that can be leveraged for detections and audits.

Tactics: TA0005
Techniques: T1562.002, T1562
Input: POWERTON can install a Registry Run key for persistence.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to use the Web server as a gateway into a network.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: dsquery can be used to gather information on permission groups within a domain.

Tactics: TA0007
Techniques: T1069.002, T1069
Input: Modifications to domain settings may include altering domain Group Policy Objects (GPOs) or changing trust settings for domains, including federation trusts.

Tactics: TA0004, TA0005
Techniques: T1484
Input: Use of servers allows an adversary to stage, launch, and execute an operation.

Tactics: TA0042
Techniques: T1584.004, T1583.004, T1584, T1583
Input: ZIRCONIUM has used AES encrypted communications in C2.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Wizard Spider has used Window Remote Management to move laterally through a victim network.

Tactics: TA0008
Techniques: T1021, T1021.006
Input: OLDBAIT collects credentials from Internet Explorer, Mozilla Firefox, and Eudora.

Tactics: TA0006
Techniques: T1555.003, T1555
Input: dsquery can be used to gather information on domain trusts with dsquery * -filter "(objectClass=trustedDomain)" -attr *.

Tactics: TA0007
Techniques: T1482
Input: Adversary tools have been discovered that search compromised systems for file extensions relating to cryptographic keys and certificates.

Tactics: TA0006
Techniques: T1552.004, T1552
Input: Tomiris has the ability to collect recent files matching a hardcoded list of extensions prior to exfiltration.

Tactics: TA0009
Techniques: T1005
Input: SUPERNOVA is a Web shell.

Tactics: TA0003
Techniques: T1505.003, T1505
Input: LoJax has loaded an embedded NTFS DXE driver to be able to access and write to NTFS partitions.

Tactics: TA0005
Techniques: T1564, T1564.004
Input: Adversaries may run the PowerShell command Clear-History to flush the entire command history from a current PowerShell session.

Tactics: TA0005
Techniques: T1070, T1070.003
Input: Machete retrieves the user profile data (, browsers) from Chrome and Firefox browsers.

Tactics: TA0007
Techniques: T1217
Input: Threat Group-3390 has downloaded additional malware and tools, including through the use of certutil, onto a compromised host .

Tactics: TA0011
Techniques: T1105
Input: This can be achieved by modifying the Registry values related to the Windows Explorer file associations in order to disable the automatic Explorer "Mount and Burn" dialog for these file extensions.

Tactics: TA0005
Techniques: T1553, T1553.005
Input: QUADAGENT creates a scheduled task to maintain persistence on the victim’s machine.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Egregor has communicated with its C2 servers via HTTPS protocol.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: jRAT can capture clipboard data.

Tactics: TA0009
Techniques: T1115
Input: ShimRatReporter sent collected system and network information compiled into a report to an adversary-controlled C2.

Tactics: TA0010
Techniques: T1020
Input: Adversaries may abuse Regsvr32.exe to proxy execution of malicious code.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Monitor for changes and the existence of unrecognized DLLs, drivers, devices, services, and to the MBR.

Tactics: TA0005
Techniques: T1014
Input: MCMD has the ability to remove set Registry Keys.

Tactics: TA0005
Techniques: T1070
Input: Metamorfo has embedded a "vmdetect.exe" executable to identify virtual machines at the beginning of execution.

Tactics: TA0005, TA0007
Techniques: T1497
Input: Kinsing has used valid SSH credentials to access remote hosts.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078
Input: It contains functionality to acquire information about credentials in many ways, including from the LSASS Memory.

Tactics: TA0006
Techniques: T1003, T1003.001
Input: Adversaries may search websites owned by the victim for information that can be used during targeting.

Tactics: TA0043
Techniques: T1594
Input: Utilities and commands that acquire this information include netstat, "net use," and "net session" with Net.

Tactics: TA0007
Techniques: T1049
Input: InvisiMole has been configured with several servers available for alternate C2 communications.

Tactics: TA0011
Techniques: T1008
Input: GreyEnergy encrypts its configuration files with AES-256 and also encrypts its strings.

Tactics: TA0005
Techniques: T1027
Input: Adversaries have also may use infrastructure discovery APIs such as DescribeDBInstances to determine size, owner, permissions, and network ACLs of database resources.

Tactics: TA0007
Techniques: T1580
Input: Lazarus Group has used rgsvr32 to execute custom malware.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Imminent Monitor has decoded malware components that are then dropped to the system.

Tactics: TA0005
Techniques: T1140
Input: Sandworm Team has avoided detection by naming a malicious binary explorer.exe.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: Dragonfly has used VPNs and Outlook Web Access (OWA) to maintain access to victim networks.

Tactics: TA0001, TA0003
Techniques: T1133
Input: The code with the registration and unregistration attributes will be executed even if the process is run under insufficient privileges and fails to execute.

Tactics: TA0005
Techniques: T1218.009, T1218
Input: Lack of expected log events may be suspicious.

Tactics: TA0005
Techniques: T1562.001, T1562
Input: Sliver can support C2 communications over DNS.

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Monitor for activation or invocation of a container that may deploy a container into an environment to facilitate execution or evade defenses.

Tactics: TA0002, TA0005
Techniques: T1610
Input: CharmPower can send additional modules over C2 encoded with base64.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: HAWKBALL can collect the user name of the system.

Tactics: TA0007
Techniques: T1033
Input: WarzoneRAT can collect compromised host information, including OS version, PC name, RAM size, and CPU details.

Tactics: TA0007
Techniques: T1082
Input: Windows:Do not put user or admin domain accounts in the local administrator groups across systems unless they are tightly controlled, as this is often equivalent to having a local administrator account with the same password on all systems.

Tactics: TA0006
Techniques: T1003
Input: Cobalt Group has sent emails with URLs pointing to malicious documents.

Tactics: TA0001
Techniques: T1566, T1566.002
Input: The frequent checking ensures that any changes made will be quickly followed, and the repeated attempts to run the Revenge RAT binary make it almost certain that even if the process is terminated, the RAT will be running again soon

Tactics: TA0007, TA0011
Techniques: T1057, T1571
Input: Other applications that are commonly seen or are part of the software deployed in a target network may also be used for exploitation.

Tactics: TA0002
Techniques: T1203
Input: OSX_OCEANLOTUS.D sets the main loader file’s attributes to hidden.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: This EWM is intended to store data specific to that window and has specific application programming interface (API) functions to set and get its value.

Tactics: TA0004, TA0005
Techniques: T1055.011, T1055
Input: Meteor can use bcdedit to delete different boot identifiers on a compromised host; it can also use vssadmin.exe delete shadows /all /quiet and C:\\Windows\\system32\\wbem\\wmic.exe shadowcopy delete.

Tactics: TA0040
Techniques: T1490
Input: MiniDuke can gather the hostname on a compromised machine.

Tactics: TA0007
Techniques: T1082
Input: SMOKEDHAM has encoded its C2 traffic with Base64.

Tactics: TA0011
Techniques: T1132.001, T1132
Input: Waterbear has the ability to decrypt its RC4 encrypted payload for execution.

Tactics: TA0005
Techniques: T1140
Input: After we decrypted the additional shellcode, we determined that the functional shellcode is part of the Metasploit Framework, specifically using the block_api.asm code to resolve API function names and the block_reverse_http.asm code to obtain additional shellcode to execute on the system

Tactics: TA0005, TA0011
Techniques: T1140, T1105
Input: Tropic Trooper has injected a DLL backdoor into dllhost.exe and svchost.exe.

Tactics: TA0004, TA0005
Techniques: T1055, T1055.001
Input: The permissions required for this action vary by system configuration; local credentials may be sufficient with direct access to the third-party system, or specific domain credentials may be required.

Tactics: TA0002, TA0008
Techniques: T1072
Input: NavRAT logs the keystrokes on the targeted system.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: FinFisher enumerates directories and scans for certain files.

Tactics: TA0007
Techniques: T1083
Input: The purpose is to download and execute an additional payload hosted on a compromised website: NavRAT

Tactics: TA0011
Techniques: T1105
Input: This behavior is related to Bypass User Account Control.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.005, T1574
Input: Monitor executed commands and arguments of suspicious commands (such as Add-MailboxPermission) that may be indicative of modifying the permissions of Exchange and other related service settings.

Tactics: TA0003
Techniques: T1098
Input: jRAT payloads have been packed.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Gamaredon Group has embedded malicious macros in document templates, which executed VBScript.

Tactics: TA0002
Techniques: T1059.005, T1059
Input: Other malware can list a directory's contents.

Tactics: TA0007
Techniques: T1083
Input: If an initial connectivity check fails, pngdowner attempts to extract proxy details and credentials from Windows Protected Storage and from the IE Credentials Store.

Tactics: TA0006
Techniques: T1552.001, T1552
Input: Monitor for newly executed processes that does not correlate to known good software.

Tactics: TA0002, TA0008
Techniques: T1072
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may attempt to hide artifacts associated with their behaviors to evade detection.

Tactics: TA0005
Techniques: T1564
Input: Daserf can use steganography to hide malicious code downloaded to the victim.

Tactics: TA0011
Techniques: T1001, T1001.002
Input: Adversaries may search freely available technical databases for information about victims that can be used during targeting.

Tactics: TA0043
Techniques: T1596
Input: Password stealer and NTLM stealer modules in CozyCar harvest stored credentials from the victim, including credentials used as part of Windows NTLM user authentication.

Tactics: TA0006
Techniques: T1003, T1003.002