madox81/Adema_ATTACK_DS huggingface dataset:
Input: OilRig has used macros to verify if a mouse is connected to a compromised machine.

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: By generating the decryption keys from target-specific environmental values, environmental keying can make sandbox detection, anti-virus detection, crowdsourcing of information, and reverse engineering difficult.

Tactics: TA0005
Techniques: T1480, T1480.001
Input: Carberp can download and execute new plugins from the C2 server.

Tactics: TA0011
Techniques: T1105
Input: Lurid can compress data before sending it.

Tactics: TA0009
Techniques: T1560
Input: APT39 has created scheduled tasks for persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: This makes it only possible to reliably detect the existence of a hidden auto-forwarding rule by examining message tracking logs or by using a MAPI editor to notice the modified rule property values.Auto-forwarded messages generally contain specific detectable artifacts that may be present in the header; such artifacts would be platform-specific.

Tactics: TA0009
Techniques: T1114, T1114.003
Input: Lazarus Group has downloaded files, malware, and tools from its C2 onto a compromised host.

Tactics: TA0011
Techniques: T1105
Input: InvisiMole can can remove all system restore points.

Tactics: TA0040
Techniques: T1490
Input: Ramsay can store collected documents in a custom container after encrypting and compressing them using RC4 and WinRAR.

Tactics: TA0009
Techniques: T1560.003, T1560
Input: Dark Caracal leveraged a compiled HTML file that contained a command to download and run an executable.

Tactics: TA0005
Techniques: T1218, T1218.001
Input: LightNeuron has a function to delete files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: On MacOS systems, monitor for modifications to the RulesActiveState.plist, SyncedRules.plist, UnsyncedRules.plist, and MessageRules.plist files.

Tactics: TA0005
Techniques: T1564, T1564.008
Input: UBoatRAT can upload and download files to the victim’s machine.

Tactics: TA0011
Techniques: T1105
Input: There are also open source frameworks such as Evilginx 2 and Muraena that can gather session cookies through a malicious proxy (ex: Adversary-in-the-Middle) that can be set up by an adversary and used in phishing campaigns.

Tactics: TA0006
Techniques: T1539
Input: ShadowPad has deleted arbitrary Registry values.

Tactics: TA0005
Techniques: T1070
Input: Procmon shows the malicious module loaded using the regsvr32.exe process.   Phase two: Payload Analysis    The only module the XSL script loads is Irdsnhrxxxfery64, which is packed using the UPX packer

Tactics: TA0005
Techniques: T1218, T1027.002, T1027, T1218.010
Input: Malware or scripts may be used to interact with the devices through an available API provided by the operating system or an application to capture video or images.

Tactics: TA0009
Techniques: T1125
Input: Developers without these privileges may still sign kexts but they will not load unless SIP is disabled.

Tactics: TA0003, TA0004
Techniques: T1547, T1547.006
Input: If both attempts fail and the payload is unable to obtain a session ID and pre-shared key via HTTP or HTTPS, it will try to use DNS tunneling

Tactics: TA0011
Techniques: T1071
Input: MuddyWater has used Daniel Bohannon’s Invoke-Obfuscation framework and obfuscated PowerShell scripts.

Tactics: TA0005
Techniques: T1027
Input: ZxShell has a feature to capture a remote computer's keystrokes using a keylogger.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Enumerates running processes for “Wireshark” and “Sysinternals”

Tactics: TA0007
Techniques: T1057
Input: What does it mean for everyone and how to defend against such attacks, including zero-day exploits? For CVE-2017-11292 and other similar vulnerabilities, one can use the killbit for Flash within their organizations to disable it in any applications that respect it.  Unfortunately, doing this system-wide is not easily done, as Flash objects can be loaded in applications that potentially do not follow the killbit

Tactics: TA0002
Techniques: T1203
Input: FIN6 has used scheduled tasks to establish persistence for various malware it uses, including downloaders known as HARDTACK and SHIPBREAD and FrameworkPOS.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: After reestablishing access, the adversaries download tools such as gsecudmp and WCE that are staged temporarily on websites that TG-3390 previously compromised but never used

Tactics: TA0011
Techniques: T1105
Input: Essentially, we are discussing ongoing activity revolving around several malware families:  KopiLuwak and IcedCoffeer Carbon Mosquito WhiteBear  Technical Rattle Turla’s Shifting to Scripting KopiLuwak and IcedCoffee, WhiteBear, and WhiteAtlas Since at least 2015 Turla has leveraged Javascript, powershell, and wsh in a number of ways, including in their malware dropper/installation operations as well as for implementing complete backdoors

Tactics: TA0002
Techniques: T1059
Input: Once the victim downloads and executes the email attachment, it runs silently with no additional decoy documents or decoy dialog boxes

Tactics: TA0011
Techniques: T1105
Input: Indrik Spider has used Cobalt Strike to empty log files.

Tactics: TA0005
Techniques: T1070, T1070.001
Input: Process hollowing is a method of executing arbitrary code in the address space of a separate live process.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: Monitor executed commands and arguments that may establish persistence by executing malicious content triggered by the execution of tainted binaries.

Tactics: TA0003, TA0004
Techniques: T1546.006, T1546
Input: Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used.

Tactics: TA0011
Techniques: T1132.001, T1132, T1571, T1132.002
Input: Any standard user can use the runas command, and the Windows API functions, to create impersonation tokens; it does not require access to an administrator account.

Tactics: TA0004, TA0005
Techniques: T1134
Input: Encryption consists of XOR with a hardcoded key for its configuration and RC4 with a predefined password for encrypting the victim’s data

Tactics: TA0005
Techniques: T1027
Input: Various command interpreters keep track of the commands users type in their terminal so that users can retrace what they've done.

Tactics: TA0005
Techniques: T1070, T1070.003, T1562.003, T1562
Input: Monitor for changes made to AD settings that may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls.

Tactics: TA0004, TA0005
Techniques: T1134
Input: Kimsuky has used a PowerShell-based keylogger as well as a tool called MECHANICAL to log keystrokes.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: RATANKBA uses WMI to perform process monitoring.

Tactics: TA0002
Techniques: T1047
Input: Explosive has collected the MAC address from the victim's machine.

Tactics: TA0007
Techniques: T1016
Input: BRONZE BUTLER has used net user /domain to identify account information.

Tactics: TA0007
Techniques: T1087.002, T1087
Input: TeamTNT has used shell scripts for execution.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: Monitor for changes made to files that may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053
Input: Adversaries may use the Windows Component Object Model (COM) for local code execution.

Tactics: TA0002
Techniques: T1559, T1559.001
Input: APT40 relies heavily on web shells for an initial foothold into an organization

Tactics: TA0003
Techniques: T1505.003, T1505
Input: Encoded Payload   Decoded Payload     MD5   Size   Import Hash   Exported Function   Version    aa3f303c3319b14b4829fe2faa5999c1  322164  182ee99b4f0803628c30411b1faa9992  l7MF25T96n45qOGWX  5.3.2    126067d634d94c45084cbe1d9873d895  330804  5f45532f947501cf024d84c36e3a19a1  hJvTJcdAU3mNkuvGGq7L  5.4.1    fce54b4886cac5c61eda1e7605483ca3  345812  c1942a0ca397b627019dace26eca78d8  WcuH  5.4.1    Table 2: Static characteristics of UPPERCUT Another new feature in the latest UPPERCUT sample is that the malware sends an error code in the Cookie header if it fails to receive the HTTP response from the command and control (C2) server

Tactics: TA0011
Techniques: T1132
Input: Consider enabling DHCP Snooping and Dynamic ARP Inspection on switches to create mappings between IP addresses requested via DHCP and ARP tables and tie the values to a port on the switch that may block bogus traffic.

Tactics: TA0006, TA0009
Techniques: T1557, T1557.002
Input: Goopy has had null characters padded in its malicious DLL payload.

Tactics: TA0005
Techniques: T1027, T1027.001
Input: Hildegard has encrypted an ELF file.

Tactics: TA0005
Techniques: T1027
Input: Conclusion CVE-2017-0199 and CVE-2017-11882 are two of the more commonly exploited vulnerabilities that we are currently seeing

Tactics: TA0002
Techniques: T1203
Input: The r1.log file stores information for exfiltration

Tactics: TA0009
Techniques: T1074
Input: Rocke used shell scripts to run commands which would obtain persistence and execute the cryptocurrency mining malware.

Tactics: TA0002
Techniques: T1059.004, T1059
Input: By default, the multistring BootExecute value of the registry key HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager is set to autocheck autochk *.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Adversaries may manipulate software dependencies and development tools prior to receipt by a final consumer for the purpose of data or system compromise.

Tactics: TA0001
Techniques: T1195.001, T1195
Input: PowerSploit's New-UserPersistenceOption Persistence argument can be used to establish via the HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Registry key.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: DarkVishnya used network sniffing to obtain login data.

Tactics: TA0006, TA0007
Techniques: T1040
Input: A Patchwork file stealer can run a TaskScheduler DLL to add persistence.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: Restrict software installation to trusted repositories only and be cautious of orphaned software packages.

Tactics: TA0003, TA0004
Techniques: T1547.013, T1547, T1543.002, T1543
Input: Adversaries can leverage OAuth authorization by constructing a malicious application designed to be granted access to resources with the target user's OAuth token.

Tactics: TA0006
Techniques: T1528
Input: FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.

Tactics: TA0002, TA0009
Techniques: T1119, T1059
Input: Adversaries may abuse double extensions to attempt to conceal dangerous file types of payloads.

Tactics: TA0005
Techniques: T1036, T1036.007
Input: Smart, optimized, and connected, XGen security powers Trend Micro’s suite of security solutions: Hybrid Cloud Security, User Protection, and Network Defense

Tactics: TA0007
Techniques: T1518.001, T1518
Input: We are also highly confident that BlackOasis was also responsible for another zero day exploit (CVE-2017-8759) discovered by FireEye in September 2017.  The FinSpy payload used in the current attacks (CVE-2017-11292) shares the same command and control (C2) server as the payload used with CVE-2017-8759 uncovered by FireEye

Tactics: TA0002
Techniques: T1203
Input: Rootkits have been seen for Windows, Linux, and Mac OS X systems.

Tactics: TA0005
Techniques: T1014
Input: Monitor for processes being viewed that may inject malicious code into processes via the asynchronous procedure call (APC) queue in order to evade process-based defenses as well as possibly elevate privileges.

Tactics: TA0004, TA0005
Techniques: T1055.004, T1055
Input: From the fake website, information is gathered in web forms and sent to the adversary.

Tactics: TA0043
Techniques: T1598, T1598.003
Input: AppleJeus has XOR-encrypted collected system information prior to sending to a C2.

Tactics: TA0005
Techniques: T1027
Input: Where possible, the ability to request temporary account tokens on behalf of another accounts should be disabled.

Tactics: TA0005, TA0008
Techniques: T1550.001, T1550
Input: Attor monitors the free disk space on the system.

Tactics: TA0007
Techniques: T1082
Input: Ensure operating systems and browsers are using the most current version.

Tactics: TA0003
Techniques: T1176
Input: Astaroth uses a fromCharCode() deobfuscation method to avoid explicitly writing execution commands and to hide its code.

Tactics: TA0005
Techniques: T1140
Input: Azure tools and APIs, such as the Azure AD Graph API and Azure Resource Manager API, can enumerate resources and services, including applications, management groups, resources and policy definitions, and their relationships that are accessible by an identity.

Tactics: TA0007
Techniques: T1526
Input: Dark Caracal has obfuscated strings in Bandook by base64 encoding, and then encrypting them.

Tactics: TA0005
Techniques: T1027
Input: DEATHRANSOM can use HTTPS to download files.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: Chimera has remotely copied tools and malware onto targeted systems.

Tactics: TA0011
Techniques: T1105
Input: Although primarily focused on by cyber criminals, these authentication mechanisms have been targeted by advanced actors.

Tactics: TA0006
Techniques: T1111
Input: Microsoft's Enhanced Mitigation Experience Toolkit (EMET) Attack Surface Reduction (ASR) feature can be used to block methods of using rundll32.exe to bypass application control.

Tactics: TA0005
Techniques: T1218, T1218.011
Input: It has been observed loading a Linux Kernel Module (LKM) and then deleting it from the hard disk as well as overwriting the data with null bytes.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: down_new has the ability to use HTTP in C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: OSX_OCEANLOTUS.D has used the ioreg command to gather some of this information.

Tactics: TA0007
Techniques: T1082
Input: PUNCHBUGGY has hashed most its code's functions and encrypted payloads with base64 and XOR.

Tactics: TA0005
Techniques: T1027
Input: PoshC2 contains a module for taking packet captures on compromised hosts.

Tactics: TA0006, TA0007
Techniques: T1040
Input: It is enabled by default on Windows Vista and later.

Tactics: TA0003, TA0004
Techniques: T1546.008, T1546
Input: Once malicious forms have been added to the user’s mailbox, they will be loaded when Outlook is started.

Tactics: TA0003
Techniques: T1137, T1137.003
Input: When the trojan starts up it will attempt to install a scheduled task with the name of “Java Maintenance64” to keep itself running.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: DarkWatchman uses HTTPS for command and control.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: PolyglotDuke can custom encrypt strings.

Tactics: TA0005
Techniques: T1027
Input: Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing malicious attachments.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: HTTPBrowser has established persistence by setting the HKCU\Software\Microsoft\Windows\CurrentVersion\Run key value for wdm to the path of the executable.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: SideTwist has exfiltrated data over its C2 channel.

Tactics: TA0010
Techniques: T1041
Input: RDAT has created a service when it is installed on the victim machine.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: ShadowPad has encoded data as readable Latin characters.

Tactics: TA0011
Techniques: T1132, T1132.002
Input: Monitor account activity for attempts to create and share data, such as snapshots or backups, with untrusted or unusual accounts.

Tactics: TA0010
Techniques: T1537
Input: Agent Tesla has he ability to perform anti-sandboxing and anti-virtualization checks.

Tactics: TA0005, TA0007
Techniques: T1497
Input: Netwalker can add the following registry entry: HKEY_CURRENT_USER\SOFTWARE{8 random characters}.

Tactics: TA0005
Techniques: T1112
Input: Empire can acquire network configuration information like DNS servers and network proxies used by a host.

Tactics: TA0007
Techniques: T1016
Input: Monitor newly executed processes that may attempt to hide artifacts associated with their behaviors to evade detection.

Tactics: TA0005
Techniques: T1564
Input: Monitor processes and arguments for malicious attempts to modify trust settings, such as the installation of root certificates or modifications to trust attributes/policies applied to files.

Tactics: TA0005
Techniques: T1553
Input: Blue Mockingbird has made their XMRIG payloads persistent as a Windows Service.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: DustySky contains a keylogger.

Tactics: TA0006, TA0009
Techniques: T1056.001, T1056
Input: Monitor for newly executed processes  for process executable paths that are named for partial directories.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.008, T1574
Input: Naikon has used malicious e-mail attachments to deliver malware.

Tactics: TA0001
Techniques: T1566, T1566.001
Input: Adversaries may leverage the AuthorizationExecuteWithPrivileges API to escalate privileges by prompting the user for credentials.

Tactics: TA0004, TA0005
Techniques: T1548.004, T1548
Input: Gamaredon Group has used HTTP and HTTPS for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: APT38 has enumerated network shares on a compromised host.

Tactics: TA0007
Techniques: T1135
Input: The group has also used regsvr32 to run their backdoor.

Tactics: TA0005
Techniques: T1218, T1218.010
Input: Mythic supports WebSocket and TCP-based C2 profiles.

Tactics: TA0011
Techniques: T1095
Input: BoxCaon has used Windows API calls to obtain information about the compromised host.

Tactics: TA0002
Techniques: T1106
Input: Gamaredon Group can also inject malicious macros or remote templates into documents already present on compromised systems.

Tactics: TA0005
Techniques: T1221
Input: Adversaries may manipulate hardware components in products prior to receipt by a final consumer for the purpose of data or system compromise.

Tactics: TA0001
Techniques: T1195, T1195.003
Input: Lucifer can identify the IP and port numbers for all remote connections from the compromised host.

Tactics: TA0007
Techniques: T1049
Input: Revenge RAT creates a Registry key at HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell to survive a system reboot.

Tactics: TA0003, TA0004
Techniques: T1547.001, T1547
Input: Blue Mockingbird has used PowerShell reverse TCP shells to issue interactive commands over a network connection.

Tactics: TA0002
Techniques: T1059.001, T1059
Input: Once encrypted, the system information is sent in the body of an HTTP POST

Tactics: TA0009
Techniques: T1560
Input: “win32_remote“,”win64_remote64“,”ollydbg“,”ProcessHacker“,”tcpview“,”autoruns“,”autorunsc“,”filemon“,”procmon“,”regmon“,”procexp“,”idaq“,”idaq64“,”ImmunityDebugger“,”Wireshark“,”dumpcap“,”HookExplorer“,”ImportREC“,”PETools“,”LordPE“,”dumpcap“,”SysInspector“,”proc_analyzer“,”sysAnalyzer“,”sniff_hit“,”windbg“,”joeboxcontrol“,”joeboxserver“  Blacklisted process names in the malware In some cases, it calculates the checksum of each running process name, and if it matches any hard-coded checksums, it causes a BSOD via the ntdll.dll “NtRaiseHardError” function

Tactics: TA0007
Techniques: T1057
Input: Detecting the use of a hidden file system may be exceptionally difficult depending on the implementation.

Tactics: TA0005
Techniques: T1564, T1564.005
Input: Zebrocy's Delphi variant was packed with UPX.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: The payload delivered in these November 2017 attacks using DDE enabled documents was SofacyCarberp, which differs from the Zebrocy downloader delivered in the February 2018 attacks

Tactics: TA0001
Techniques: T1189
Input: WindTail has the ability to use HTTP for C2 communications.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: KillDisk terminates various processes to get the user to reboot the victim machine.

Tactics: TA0040
Techniques: T1489
Input: ELMER is capable of performing directory listings.

Tactics: TA0007
Techniques: T1083
Input: Monitor for changes made to a large quantity of files for unexpected modifications in user directories and under C:\Windows\System32.

Tactics: TA0040
Techniques: T1485
Input: Lokibot has decoded and decrypted its stages multiple times using hard-coded keys to deliver the final payload, and has decoded its server response hex string using XOR.

Tactics: TA0005
Techniques: T1140
Input: Threat Group-3390 has also obtained OWA account credentials during intrusions that it subsequently used to attempt to regain access when evicted from a victim network.

Tactics: TA0001, TA0003
Techniques: T1133
Input: Restrict write access to XDG autostart entries to only select privileged users.

Tactics: TA0003, TA0004
Techniques: T1547.013, T1547
Input: TYPEFRAME can open the Windows Firewall on the victim’s machine to allow incoming connections.

Tactics: TA0005
Techniques: T1562.004, T1562
Input: Hildegard has used the BOtB tool which exploits CVE-2019-5736.

Tactics: TA0004
Techniques: T1068
Input: jRAT can download and execute files.

Tactics: TA0011
Techniques: T1105
Input: A Cloud Access Security Broker (CASB) can be used to set usage policies and manage user permissions on cloud applications to prevent access to application access tokens.

Tactics: TA0006
Techniques: T1528
Input: BlackEnergy attempts to bypass default User Access Control (UAC) settings by exploiting a backward-compatibility setting found in Windows 7 and later.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: yty gathers the computer name, the serial number of the main disk volume, CPU information, Microsoft Windows version, and runs the command systeminfo.

Tactics: TA0007
Techniques: T1082
Input: Okrum's loader can decrypt the backdoor code, embedded within the loader or within a legitimate PNG file.

Tactics: TA0005
Techniques: T1140
Input: The Duqu command and control protocol's data stream can be encrypted with AES-CBC.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: APT41 has uploaded files and data from a compromised host.

Tactics: TA0009
Techniques: T1005
Input: Leviathan has used publicly available tools to dump password hashes, including HOMEFRY.

Tactics: TA0006
Techniques: T1003
Input: Patchwork embedded a malicious macro in a Word document and lured the victim to click on an icon to execute the malware.

Tactics: TA0002
Techniques: T1204.002, T1204
Input: Endpoint DoS can be performed by exhausting the system resources those services are hosted on or exploiting the system to cause a persistent crash condition.

Tactics: TA0040
Techniques: T1499
Input: Monitor and analyze traffic patterns and packet inspection associated to protocol(s), leveraging SSL/TLS inspection for DNSSEC traffic, that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure).

Tactics: TA0011
Techniques: T1071.004, T1071
Input: Utilities, such as NinjaCopy, exist to perform these actions in PowerShell.

Tactics: TA0005
Techniques: T1006
Input: Monitor executed commands and arguments for actions that could be taken to collect files from a network share.

Tactics: TA0009
Techniques: T1039
Input: Empire has the ability to collect emails on a target system.

Tactics: TA0009
Techniques: T1114, T1114.001
Input: With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.

Tactics: TA0003
Techniques: T1136
Input: xCaon has used the GetAdaptersInfo() API call to get the victim's MAC address.

Tactics: TA0007
Techniques: T1016
Input: CrackMapExec can enumerate the system drives and associated system name.

Tactics: TA0007
Techniques: T1082