Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT32 has enumerated DC servers using the command net group "Domain Controllers" /domain. The group has also used the ping command.

Output: Technique=T1018: Remote System Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Raccoon Stealer archives collected system information in a text f ile, `System info.txt`, prior to exfiltration.

Output: Technique=T1560: Archive Collected Data | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Prestige has attempted to stop the MSSQL Windows service to ensure successful encryption using `C:\Windows\System32\net.exe stop MSSQLSERVER`.

Output: Technique=T1489: Service Stop | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Wingbird exploits CVE-2016-4117 to allow an executable to gain escalated privileges.

Output: Technique=T1068: Exploitation for Privilege Escalation | Tactic=TA0004: Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TAINTEDSCRIBE can randomly pick one of five hard-coded IP addresses for C2 communication; if one of the IP fails, it will wait 60 seconds and then try another IP address.

Output: Technique=T1008: Fallback Channels | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Zeus Panda uses PowerShell to download and execute the payload.

Output: Technique=T1059.001: PowerShell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sliver can enumerate files on a target system.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: LunarWeb has the ability to run shell commands via PowerShell.

Output: Technique=T1059.001: PowerShell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: CreepySnail can connect to C2 for data exfiltration.

Output: Technique=T1041: Exfiltration Over C2 Channel | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Dragonfly dropped and executed Hydra, a password cracker.

Output: Technique=T1110: Brute Force | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cobalt Strike can steal access tokens from exiting processes.

Output: Technique=T1134.001: Token Impersonation/Theft | Tactic=TA0005 ; TA0004: Defense Evasion ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ccf32 can parse collected files to identify specific file extensions.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Earth Lusca used Python scripts for port scanning or building reverse shells.

Output: Technique=T1059.006: Python | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: WannaCry uses Tor for command and control traffic and routes a custom cryptographic protocol over the Tor circuit.

Output: Technique=T1573.002: Asymmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HEXANE has used WMI event subscriptions for persistence.

Output: Technique=T1546.003: Windows Management Instrumentation Event Subscription | Tactic=TA0004 ; TA0003: Privilege Escalation ; Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Koadic can use SSL and TLS for communications.

Output: Technique=T1573.002: Asymmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cobalt Strike can use known credentials to run commands and spawn processes as a local user account.

Output: Technique=T1078.003: Local Accounts | Tactic=TA0005 ; TA0003 ; TA0004 ; TA0001: Defense Evasion ; Persistence ; Privilege Escalation ; Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: KONNI has sent data and files to its C2 server.

Output: Technique=T1041: Exfiltration Over C2 Channel | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ZxShell can capture screenshots.

Output: Technique=T1113: Screen Capture | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: One variant of CloudDuke uses HTTP and HTTPS for C2.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: InvisiMole has used ListPlanting to inject code into a trusted process.

Output: Technique=T1055.015: ListPlanting | Tactic=TA0005 ; TA0004: Defense Evasion ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: QuietSieve can identify and search networked drives for specific file name extensions.

Output: Technique=T1135: Network Share Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Operation Wocao has deleted logs and executable files used during an intrusion.

Output: Technique=T1070.004: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Lokibot has decoded and decrypted its stages multiple times using hard-coded keys to deliver the final payload, and has decoded its server response hex string using XOR.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BBSRAT can query service configuration information.

Output: Technique=T1007: System Service Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: IcedID has used obfuscated VBA string expressions.

Output: Technique=T1059.005: Visual Basic | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RainyDay can use TCP in C2 communications.

Output: Technique=T1095: Non-Application Layer Protocol | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Calisto adds a .plist file to the <code>/Library/LaunchAgents</code> folder to maintain persistence.

Output: Technique=T1159: Launch Agent | Tactic=TA0003: Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FELIXROOT opens a remote shell to execute commands on the infected system.

Output: Technique=T1059: Command and Scripting Interpreter | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT28 attempted to get users to click on Microsoft Office attachments containing malicious macro scripts.

Output: Technique=T1204.002: Malicious File | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: QakBot can use net localgroup to enable discovery of local groups.

Output: Technique=T1069.001: Local Groups | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT29 has extracted files from compromised networks.

Output: Technique=T1005: Data from Local System | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ecipekac can download additional payloads to a compromised host.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: IndigoZebra has compromised legitimate email accounts to use in their spearphishing operations.

Output: Technique=T1586.002: Email Accounts | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Earth Lusca has used Tasklist to obtain information from a compromised host.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RDAT can use HTTP communications for C2, as well as using the WinHTTP library to make requests to the Exchange Web Services API.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Peirates can enumerate Kubernetes pods in a given namespace.

Output: Technique=T1613: Container and Resource Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Bisonal has used a dynamic DNS service for C2.

Output: Technique=T1568: Dynamic Resolution | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Netwalker can delete the infected system's Shadow Volumes to prevent recovery.

Output: Technique=T1490: Inhibit System Recovery | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BPFDoor sets the `MYSQL_HISTFILE` and `HISTFILE` to `/dev/null` preventing the shell and MySQL from logging history in `/proc/<PID>/environ`.

Output: Technique=T1562.003: Impair Command History Logging | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Naikon has used administrator credentials for lateral movement in compromised networks.

Output: Technique=T1078.002: Domain Accounts | Tactic=TA0005 ; TA0003 ; TA0004 ; TA0001: Defense Evasion ; Persistence ; Privilege Escalation ; Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Inception has maintained persistence by modifying Registry run key value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BADNEWS installs a registry Run key to establish persistence.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BlackEnergy attempts to bypass default User Access Control (UAC) settings by exploiting a backward-compatibility setting found in Windows 7 and later.

Output: Technique=T1548.002: Bypass User Account Control | Tactic=TA0004 ; TA0005: Privilege Escalation ; Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PcShare can collect files and information from a compromised host.

Output: Technique=T1005: Data from Local System | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: DEATHRANSOM can download files to a compromised host.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Dok persists via a plist login item.

Output: Technique=T1547.011: Plist Modification | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cobian RAT uses DNS for C2.

Output: Technique=T1071.004: DNS | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PowerDuke uses rundll32.exe to load.

Output: Technique=T1218.011: Rundll32 | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: UNC2452 added credentials to OAuth Applications and Service Principals.

Output: Technique=T1098.001: Additional Cloud Credentials | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BLUELIGHT has encoded data into a binary blob using XOR.

Output: Technique=T1560.003: Archive via Custom Method | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TYPEFRAME can execute commands using a shell.

Output: Technique=T1059: Command and Scripting Interpreter | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT29 has used SSH port forwarding capabilities on public-facing systems, and configured at least one instance of Cobalt Strike to use a network pipe over SMB during the 2020 SolarWinds intrusion.

Output: Technique=T1090.001: Internal Proxy | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Operation Dream Job, Lazarus Group targeted Windows servers running Internet Information Systems (IIS) to install C2 components.

Output: Technique=T1505.004: IIS Components | Tactic=TA0003: Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Molerats has used msiexec.exe to execute an MSI payload.

Output: Technique=T1218.007: Msiexec | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Water Curupira Pikabot Distribution distributed a PDF attachment containing a malicious link to a Pikabot installer.

Output: Technique=T1204.001: Malicious Link | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sandworm Team has run the xp_cmdshell command in MS-SQL.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Saint Bot has conducted system locale checks to see if the compromised host is in Russia, Ukraine, Belarus, Armenia, Kazakhstan, or Moldova.

Output: Technique=T1614: System Location Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SharpDisco can load a plugin to exfiltrate stolen files to SMB shares also used in C2.

Output: Technique=T1041: Exfiltration Over C2 Channel | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During C0021, the threat actors used TCP for some C2 communications.

Output: Technique=T1095: Non-Application Layer Protocol | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Latrodectus can run `C:\Windows\System32\cmd.exe /c net group "Domain Admins" /domain` to identify domain administrator accounts.

Output: Technique=T1087.002: Domain Account | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: DarkGate creates a log file for capturing keylogging, clipboard, and related data using the victim host's current date for the filename. DarkGate queries victim system epoch time during execution. DarkGate captures system time information as part of automated profiling on initial installation.

Output: Technique=T1124: System Time Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT28 has obtained and used open-source tools like Koadic, Mimikatz, and Responder.

Output: Technique=T1588.002: Tool | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: MgBot includes modules for collecting information on local domain users and permissions.

Output: Technique=T1482: Domain Trust Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TYPEFRAME can delete services from the victim’s machine.

Output: Technique=T1031: Modify Existing Service | Tactic=TA0003: Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RedCurl added the “hidden” file attribute to original files, manipulating victims to click on malicious LNK files.

Output: Technique=T1564.001: Hidden Files and Directories | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: LuminousMoth has used a malicious DLL to collect the username from compromised hosts.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: QakBot can run nltest /domain_trusts /all_trusts for domain trust discovery.

Output: Technique=T1482: Domain Trust Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Wizard Spider has used AdFind.exe to collect information about Active Directory organizational units and trust objects.

Output: Technique=T1482: Domain Trust Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TA505 has used a variety of tools in their operations, including AdFind, BloodHound, Mimikatz, and PowerSploit.

Output: Technique=T1588.002: Tool | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: When a document is found matching one of the extensions in the configuration, TINYTYPHON uploads it to the C2 server.

Output: Technique=T1020: Automated Exfiltration | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SynAck enumerates Registry keys associated with event logs.

Output: Technique=T1012: Query Registry | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Snip3 has been delivered to victims through malicious e-mail attachments.

Output: Technique=T1566.001: Spearphishing Attachment | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BADNEWS establishes a backdoor over HTTP.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During the C0032 campaign, TEMP.Veles used Mimikatz and a custom tool, SecHack, to harvest credentials.

Output: Technique=T1003.001: LSASS Memory | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: CharmPower can collect data and files from a compromised host.

Output: Technique=T1005: Data from Local System | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Milan can use `cmd.exe` for discovery actions on a targeted system.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BackdoorDiplomacy has used an executable to detect removable media, such as USB flash drives.

Output: Technique=T1120: Peripheral Device Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Threat Group-3390 has registered domains for C2.

Output: Technique=T1583.001: Domains | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT38 has used cron to create pre-scheduled and periodic background jobs on a Linux system.

Output: Technique=T1053.003: Cron | Tactic=TA0002 ; TA0003 ; TA0004: Execution ; Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Moonstone Sleet has gathered information on victim organizations through email and social media interaction.

Output: Technique=T1591: Gather Victim Org Information | Tactic=TA0043: Reconnaissance


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: POWERSTATS encoded C2 traffic with base64.

Output: Technique=T1132.001: Standard Encoding | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Winnti for Windows has the ability to use encapsulated HTTP/S in C2 communications.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Metamorfo has encrypted payloads and strings.

Output: Technique=T1027.013: Encrypted/Encoded File | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Uroburos has the ability to move data between its kernel and user mode components, generally using named pipes.

Output: Technique=T1559: Inter-Process Communication | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Donut can generate code modules that enable in-memory execution of VBScript, JScript, EXE, DLL, and dotNET payloads.

Output: Technique=T1620: Reflective Code Loading | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Kivars has the ability to initiate keylogging on the infected host.

Output: Technique=T1056.001: Keylogging | Tactic=TA0009 ; TA0006: Collection ; Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sardonic has the ability to collect the computer name, CPU manufacturer name, and C:\ drive serial number from a compromised machine. Sardonic also has the ability to execute the `ver` and `systeminfo` commands.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BPFDoor clears the file location `/proc/<PID>/environ` removing all environment variables for the process.

Output: Technique=T1070: Indicator Removal | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: QakBot can use GetProcAddress to help delete malicious strings from memory.

Output: Technique=T1106: Native API | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Kimsuky has placed scripts in the startup folder for persistence and modified the `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce` Registry key.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BlackCat can delete shadow copies using `vssadmin.exe delete shadows /all /quiet` and `wmic.exe Shadowcopy Delete`; it can also modify the boot loader using `bcdedit /set {default} recoveryenabled No`.

Output: Technique=T1490: Inhibit System Recovery | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BRONZE BUTLER has used VBS and VBE scripts for execution.

Output: Technique=T1059.005: Visual Basic | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: AADInternals can send "consent phishing" emails containing malicious links designed to steal users’ access tokens.

Output: Technique=T1566.002: Spearphishing Link | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT32's backdoor possesses the capability to list files and directories on a machine.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: LAPSUS$ has accessed internet-facing identity providers such as Azure Active Directory and Okta to target specific organizations.

Output: Technique=T1199: Trusted Relationship | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT33 has used compromised Office 365 accounts in tandem with Ruler in an attempt to gain control of endpoints.

Output: Technique=T1078.004: Cloud Accounts | Tactic=TA0005 ; TA0003 ; TA0004 ; TA0001: Defense Evasion ; Persistence ; Privilege Escalation ; Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: OopsIE checks to see if the system is configured with "Daylight" time and checks for a specific region to be set for the timezone.

Output: Technique=T1124: System Time Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: CrackMapExec can collect DNS information from the targeted system.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sandworm Team has used port 6789 to accept connections on the group's SSH server.

Output: Technique=T1571: Non-Standard Port | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: 3PARA RAT has a command to set certain attributes such as creation/modification timestamps on files.

Output: Technique=T1070.006: Timestomp | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sykipot may gather a list of running processes by running tasklist /v.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: GoldMax has used filenames that matched the system name, and appeared as a scheduled task impersonating systems management software within the corresponding ProgramData subfolder.

Output: Technique=T1036.005: Match Legitimate Name or Location | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Night Dragon has used several remote administration tools as persistent infiltration channels.

Output: Technique=T1219: Remote Access Software | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Night Dragon, threat actors used HTTP for C2.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Clambling has the ability to capture screenshots.

Output: Technique=T1113: Screen Capture | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Shamoon obtains the system time and will only activate if it is greater than a preset date.

Output: Technique=T1124: System Time Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: OilRig has used custom DNS Tunneling protocols for C2.

Output: Technique=T1094: Custom Command and Control Protocol | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: For Operation Spalax, the threat actors staged malware and malicious files in legitimate hosting services such as OneDrive or MediaFire.

Output: Technique=T1608.001: Upload Malware | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Earth Lusca collected information on user accounts via the whoami command.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SpicyOmelette can enumerate running software on a targeted system.

Output: Technique=T1518: Software Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FIN6 has used malicious JavaScript to steal payment card data from e-commerce sites.

Output: Technique=T1059.007: JavaScript | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PoshC2 can use Inveigh to conduct name service poisoning for credential theft and associated relay attacks.

Output: Technique=T1557.001: LLMNR/NBT-NS Poisoning and SMB Relay | Tactic=TA0006 ; TA0009: Credential Access ; Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: NightClub can modify the Registry to set the ServiceDLL for a service created by the malware for persistence.

Output: Technique=T1112: Modify Registry | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT32 backdoor can use HTTP over an uncommon TCP port (e.g 14146) which is specified in the backdoor configuration.

Output: Technique=T1065: Uncommonly Used Port | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: CrackMapExec can gather the user accounts within domain groups.

Output: Technique=T1069.002: Domain Groups | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: CookieMiner has used Google Chrome's decryption and extraction operations.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BONDUPDATER can use DNS and TXT records within its DNS tunneling protocol for command and control.

Output: Technique=T1071.004: DNS | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Conficker variants spread through NetBIOS share propagation.

Output: Technique=T1021.002: SMB/Windows Admin Shares | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TEMP.Veles routinely deleted tools, logs, and other files after they were finished with them.

Output: Technique=T1070.004: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT5 has used the BLOODMINE utility to parse and extract information from Pulse Secure Connect logs.

Output: Technique=T1654: Log Enumeration | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TA459 has used PowerShell for execution of a payload.

Output: Technique=T1059.001: PowerShell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Olympic Destroyer attempts to copy itself to remote machines on the network.

Output: Technique=T1570: Lateral Tool Transfer | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Dragonfly has performed screen captures of victims, including by using a tool, scr.exe (which matched the hash of ScreenUtil).

Output: Technique=T1113: Screen Capture | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Bazar can collect the time on the compromised host.

Output: Technique=T1124: System Time Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Frankenstein has collected information via Empire, which is automatically sent the data back to the adversary's C2.

Output: Technique=T1020: Automated Exfiltration | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RTM encrypts C2 traffic with a custom RC4 variant.

Output: Technique=T1573.001: Symmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PoetRAT has used LZMA and base64 libraries to decode obfuscated scripts.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: OilRig has used HTTP for C2.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: WinMM sets a WH_CBT Windows hook to collect information on process creation.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TA459 has exploited Microsoft Word vulnerability CVE-2017-0199 for execution.

Output: Technique=T1203: Exploitation for Client Execution | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ServHelper may download additional files to execute.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Whitefly has obtained and used tools such as Mimikatz.

Output: Technique=T1588.002: Tool | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: AuTo Stealer can exfiltrate data over actor-controlled C2 servers via HTTP or TCP.

Output: Technique=T1041: Exfiltration Over C2 Channel | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TrickBot obtains the IP address, location, and other relevant network information from the victim’s machine.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BISCUIT has a command to launch a command shell on the system.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Fox Kitten has used the PuTTY and Plink tools for lateral movement.

Output: Technique=T1021.004: SSH | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Pteranodon can delete files that may interfere with it executing. It also can delete temporary files and itself after the initial script executes.

Output: Technique=T1070.004: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Nidiran can create a new service named msamger (Microsoft Security Accounts Manager).

Output: Technique=T1543.003: Windows Service | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ursnif has gathered information about running services.

Output: Technique=T1007: System Service Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During C0017, APT41 used its Cloudflare services C2 channels for data exfiltration.

Output: Technique=T1041: Exfiltration Over C2 Channel | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT41 uses multiple built-in commands such as systeminfo and `net config Workstation` to enumerate victim system basic configuration information.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FIN7 used legitimate services like Google Docs, Google Scripts, and Pastebin for C2.

Output: Technique=T1102.002: Bidirectional Communication | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: NETWIRE can use launch agents for persistence.

Output: Technique=T1543.001: Launch Agent | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cinnamon Tempest has used open-source tools including customized versions of the Iox proxy tool, NPS tunneling tool, Meterpreter, and a keylogger that uploads data to Alibaba cloud storage.

Output: Technique=T1588.002: Tool | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ursnif has copied itself to and infected files in network drives for propagation.

Output: Technique=T1080: Taint Shared Content | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: DarkGate queries system resources on an infected machine to identify if it is executing in a sandbox or virtualized environment.

Output: Technique=T1497.001: System Checks | Tactic=TA0005 ; TA0007: Defense Evasion ; Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Maze has used WMI to attempt to delete the shadow volumes on a machine, and to connect a virtual machine to the network domain of the victim organization's network.

Output: Technique=T1047: Windows Management Instrumentation | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ftp may be abused by adversaries to transfer tools or files from an external system into a compromised environment.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT38 has attempted to lure victims into enabling malicious macros within email attachments.

Output: Technique=T1204.002: Malicious File | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SLOTHFULMEDIA has sent system information to a C2 server via HTTP and HTTPS POST requests.

Output: Technique=T1041: Exfiltration Over C2 Channel | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Nebulae can achieve persistence through a Registry Run key.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: For C0015, the threat actors used DLL files that had invalid certificates.

Output: Technique=T1553.002: Code Signing | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RARSTONE uses SSL to encrypt its communication with its C2 server.

Output: Technique=T1095: Non-Application Layer Protocol | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Milan can use hardcoded domains as an input for domain generation algorithms.

Output: Technique=T1568.002: Domain Generation Algorithms | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Machete is written in Python and is used in conjunction with additional Python scripts.

Output: Technique=T1059.006: Python | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During C0021, the threat actors used `rundll32.exe` to execute the Cobalt Strike Beacon loader DLL.

Output: Technique=T1218.011: Rundll32 | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BendyBear has decrypted function blocks using a XOR key during runtime to evade detection.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: LockerGoga installation has been immediately preceded by a "task kill" command in order to disable anti-virus.

Output: Technique=T1562.001: Disable or Modify Tools | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cobalt Strike conducts peer-to-peer communication over Windows named pipes encapsulated in the SMB protocol. All protocols use their standard assigned ports.

Output: Technique=T1071: Application Layer Protocol | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SVCReady has named a task `RecoveryExTask` as part of its persistence activity.

Output: Technique=T1036.004: Masquerade Task or Service | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT28 has used a UEFI (Unified Extensible Firmware Interface) rootkit known as LoJax.

Output: Technique=T1014: Rootkit | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Operation Wocao has used scheduled tasks to execute malicious PowerShell code on remote systems.

Output: Technique=T1053.005: Scheduled Task | Tactic=TA0002 ; TA0003 ; TA0004: Execution ; Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: NightClub can load a module to leverage the LAME encoder and `mciSendStringW` to control and capture audio.

Output: Technique=T1123: Audio Capture | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BADNEWS collects C2 information via a dead drop resolver.

Output: Technique=T1102.001: Dead Drop Resolver | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: A TYPEFRAME variant can use port 127 for communications.

Output: Technique=T1065: Uncommonly Used Port | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Kimsuky has enumerated drives, OS type, OS version, and other information using a script or the "systeminfo" command.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: 4H RAT has the capability to obtain file and directory listings.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PlugX can enumerate and query for information contained within the Windows Registry.

Output: Technique=T1012: Query Registry | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Indrik Spider has used RDP for lateral movement.

Output: Technique=T1021.001: Remote Desktop Protocol | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Octopus has used HTTP GET and POST requests for C2 communications.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SharpDisco has dropped a plugin to monitor external drives to `C:\Users\Public\It3.exe`.

Output: Technique=T1120: Peripheral Device Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT-C-36 has used spearphishing emails with password protected RAR attachment to avoid being detected by the email gateway.

Output: Technique=T1566.001: Spearphishing Attachment | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Hydraq creates a backdoor through which remote attackers can download files and additional malware components.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Smoke Loader searches for credentials stored from web browsers.

Output: Technique=T1555.003: Credentials from Web Browsers | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Operation Wocao has created services on remote systems for execution purposes.

Output: Technique=T1569.002: Service Execution | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ToddyCat has exploited the ProxyLogon vulnerability (CVE-2021-26855) to compromise Exchange Servers at multiple organizations.

Output: Technique=T1190: Exploit Public-Facing Application | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Mongall can identify drives on compromised hosts and retrieve the hostname via `gethostbyname`.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Backdoor.Oldrea can use a network scanning module to identify ICS-related ports.

Output: Technique=T1046: Network Service Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Rover automatically searches for files on local drives based on a predefined list of file extensions.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PingPull can retrieve the hostname of a compromised host.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Empire can enumerate the username on targeted hosts.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Chaes has been delivered by sending victims a phishing email containing a malicious .docx file.

Output: Technique=T1566.001: Spearphishing Attachment | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Cutting Edge, threat actors used a Python reverse shell and the PySoxy SOCKS5 proxy tool.

Output: Technique=T1059.006: Python | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Heyoka Backdoor can encrypt its payload.

Output: Technique=T1027.013: Encrypted/Encoded File | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: DUSTPAN decrypts and executes an embedded payload.

Output: Technique=T1027.009: Embedded Payloads | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During the SolarWinds Compromise, APT29 used RDP sessions from public-facing systems to internal servers.

Output: Technique=T1021.001: Remote Desktop Protocol | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Rising Sun has used HTTP and HTTPS for command and control.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cobalt Strike can enumerate services on compromised hosts.

Output: Technique=T1007: System Service Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: For C0018, the threat actors acquired a variety of open source tools, including Mimikatz, Sliver, SoftPerfect Network Scanner, AnyDesk, and PDQ Deploy.

Output: Technique=T1588.002: Tool | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TeamTNT has encrypted its binaries via AES and encoded files using Base64.

Output: Technique=T1027.013: Encrypted/Encoded File | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.

Output: Technique=T1203: Exploitation for Client Execution | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Wiarp creates a backdoor through which remote attackers can create a service.

Output: Technique=T1543.003: Windows Service | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Hikit is a Rootkit that has been used by Axiom.

Output: Technique=T1014: Rootkit | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Moses Staff has collected the domain name of a compromised network.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT29 has collected emails from targeted mailboxes within a compromised Azure AD tenant and compromised Exchange servers, including via Exchange Web Services (EWS) API requests.

Output: Technique=T1114.002: Remote Email Collection | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT37 has used malware that will issue the command shutdown /r /t 1 to reboot a system after wiping its MBR.

Output: Technique=T1529: System Shutdown/Reboot | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: LAPSUS$ has searched a victim's network for code repositories like GitLab and GitHub to discover further high-privilege account credentials.

Output: Technique=T1213.003: Code Repositories | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: LITTLELAMB.WOOLTEA can communicate over SSL using the private key from the Ivanti Connect Secure web server.

Output: Technique=T1573.002: Asymmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BRONZE BUTLER has used tools to enumerate software installed on an infected host.

Output: Technique=T1518: Software Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Crutch has established persistence with a scheduled task impersonating the Outlook item finder.

Output: Technique=T1036.004: Masquerade Task or Service | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sliver can encode binary data into a .PNG file for C2 communication.

Output: Technique=T1001.002: Steganography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FinFisher has used the KernelCallbackTable to hijack the execution flow of a process by replacing the __fnDWORD function with the address of a created Asynchronous Procedure Call stub routine.

Output: Technique=T1574.013: KernelCallbackTable | Tactic=TA0003 ; TA0004 ; TA0005: Persistence ; Privilege Escalation ; Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BadPatch has a keylogging capability.

Output: Technique=T1056.001: Keylogging | Tactic=TA0009 ; TA0006: Collection ; Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Grandoreiro can determine the time on the victim machine via IPinfo.

Output: Technique=T1124: System Time Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Mafalda can enumerate Registry keys with all subkeys and values.

Output: Technique=T1012: Query Registry | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Spica has created a scheduled task named `CalendarChecker` for persistence on compromised hosts.

Output: Technique=T1036.004: Masquerade Task or Service | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Wizard Spider has sent phishing emails containing a link to an actor-controlled Google Drive document or other free online file hosting services.

Output: Technique=T1566.002: Spearphishing Link | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Chinoxy has encrypted its configuration file.

Output: Technique=T1027.013: Encrypted/Encoded File | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TA578 has used Google Firebase to host malicious scripts.

Output: Technique=T1583.006: Web Services | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Zebrocy gets the username from the system.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FIN13 has used HTTP requests to chain multiple web shells and to contact actor-controlled C2 servers prior to exfiltrating stolen data.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Magic Hound has created fake LinkedIn and other social media accounts to contact targets and convince them--through messages and voice communications--to open malicious links.

Output: Technique=T1585.001: Social Media Accounts | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FALLCHILL encrypts C2 data with RC4 encryption.

Output: Technique=T1573.001: Symmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Misdat has attempted to detect if a compromised host had a Japanese keyboard via the Windows API call `GetKeyboardType`.

Output: Technique=T1614.001: System Language Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ke3chang performs operating system information discovery using systeminfo and has used implants to identify the system language and computer name.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Proton kills security tools like Wireshark that are running.

Output: Technique=T1562.001: Disable or Modify Tools | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: CosmicDuke searches for Microsoft Outlook data files with extensions .pst and .ost for collection and exfiltration.

Output: Technique=T1114.001: Local Email Collection | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During the SolarWinds Compromise, APT29 registered devices in order to enable mailbox syncing via the `Set-CASMailbox` command.

Output: Technique=T1098.005: Device Registration | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Agent Tesla has used ProcessWindowStyle.Hidden to hide windows.

Output: Technique=T1564.003: Hidden Window | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Lucifer can download and execute a replica of itself using certutil.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Mis-Type network traffic can communicate over HTTP.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ke3chang gathered information and files from local directories for exfiltration.

Output: Technique=T1005: Data from Local System | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Rising Sun variants can use SSL for encrypting C2 communications.

Output: Technique=T1573.002: Asymmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: DarkGate executes a Windows Batch script during installation that creases a randomly-named directory in the C:\\ root directory that copies and renames the legitimate Windows <curl>curl command to this new location.

Output: Technique=T1036.003: Rename System Utilities | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SUGARDUMP has created scheduled tasks called `MicrosoftInternetExplorerCrashRepoeterTaskMachineUA` and `MicrosoftEdgeCrashRepoeterTaskMachineUA`, which were configured to execute `CrashReporter.exe` during user logon.

Output: Technique=T1053.005: Scheduled Task | Tactic=TA0002 ; TA0003 ; TA0004: Execution ; Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sandworm Team has obtained valid emails addresses while conducting research against target organizations that were subsequently used in spearphishing campaigns.

Output: Technique=T1589.002: Email Addresses | Tactic=TA0043: Reconnaissance


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Flagpro can close specific Windows Security and Internet Explorer dialog boxes to mask external connections.

Output: Technique=T1070: Indicator Removal | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Wizard Spider has lured victims to execute malware with spearphishing attachments containing macros to download either Emotet, Bokbot, TrickBot, or Bazar.

Output: Technique=T1204.002: Malicious File | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Turla surveys a system upon check-in to discover active local network connections using the netstat -an, net use, net file, and net session commands. Turla RPC backdoors have also enumerated the IPv4 TCP connection table via the GetTcpTable2 API call.

Output: Technique=T1049: System Network Connections Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TrailBlazer has the ability to use WMI for persistence.

Output: Technique=T1546.003: Windows Management Instrumentation Event Subscription | Tactic=TA0004 ; TA0003: Privilege Escalation ; Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HyperStack can use Windows API's ConnectNamedPipe and WNetAddConnection2 to detect incoming connections and connect to remote shares.

Output: Technique=T1106: Native API | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: KOCTOPUS has deployed a modified version of Invoke-Ngrok to expose open local ports to the Internet.

Output: Technique=T1090: Proxy | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PowerSploit contains a collection of Privesc-PowerUp modules that can discover and replace/modify service binaries, paths, and configs.

Output: Technique=T1543.003: Windows Service | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Daggerfly used a renamed version of rundll32.exe, such as "dbengin.exe" located in the `ProgramData\Microsoft\PlayReady` directory, to proxy malicious DLL execution.

Output: Technique=T1036.003: Rename System Utilities | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PoshC2 contains a module for compressing data using ZIP.

Output: Technique=T1560.001: Archive via Utility | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FIN8 has exploited the CVE-2016-0167 local vulnerability.

Output: Technique=T1068: Exploitation for Privilege Escalation | Tactic=TA0004: Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: DarkGate creates a local user account, SafeMode, via net user commands.

Output: Technique=T1136.001: Local Account | Tactic=TA0003: Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: WastedLocker has performed DLL hijacking before execution.

Output: Technique=T1574.001: DLL Search Order Hijacking | Tactic=TA0003 ; TA0004 ; TA0005: Persistence ; Privilege Escalation ; Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: POWRUNER may collect information about the system by running hostname and systeminfo on a victim.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about usernames listed in AD.

Output: Technique=T1087.002: Domain Account | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BlackEnergy has the capability to communicate over a backup channel via plus.google.com.

Output: Technique=T1008: Fallback Channels | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Volt Typhoon has used the Ultimate Packer for Executables (UPX) to obfuscate the FRP client files BrightmetricAgent.exe and SMSvcService.ex) and the port scanning utility ScanLine.

Output: Technique=T1027.002: Software Packing | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Volgmer can download remote files and additional payloads to the victim's machine.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Volt Typhoon has run `net localgroup administrators` in compromised environments to enumerate accounts.

Output: Technique=T1069.001: Local Groups | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Pupy uses PowerView and Pywerview to perform discovery commands such as net user, net group, net local group, etc.

Output: Technique=T1087.001: Local Account | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Machete has scanned and looked for cryptographic keys and certificate file extensions.

Output: Technique=T1552.004: Private Keys | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Blue Mockingbird has used FRP, ssf, and Venom to establish SOCKS proxy connections.

Output: Technique=T1090: Proxy | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TrickBot can Base64-encode C2 commands.

Output: Technique=T1132.001: Standard Encoding | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ebury has implemented a fallback mechanism to begin using a DGA when the attacker hasn't connected to the infected system for three days.

Output: Technique=T1008: Fallback Channels | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Operation Dream Job, Lazarus Group placed LNK files into the victims' startup folder for persistence.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: KOCTOPUS has deobfuscated itself before executing its commands.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BlackCat can execute commands on a compromised network with the use of `cmd.exe`.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ZxShell can use ports 1985 and 1986 in HTTP/S communication.

Output: Technique=T1571: Non-Standard Port | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Operation Wocao has gathered a recursive directory listing to find files and directories of interest.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: route can be used to discover routing configuration information.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Skidmap has the ability to check whether the infected system’s OS is Debian or RHEL/CentOS to determine which cryptocurrency miner it should use.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: The SocGholish JavaScript payload has been delivered within a compressed ZIP archive. SocGholish has also single or double Base-64 encoded references to its second-stage server URLs.

Output: Technique=T1027.013: Encrypted/Encoded File | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: KV Botnet Activity final payload installation includes mounting and binding to the <code>\/proc\/</code> filepath on the victim system to enable subsequent operation in memory while also removing on-disk artifacts.

Output: Technique=T1055.009: Proc Memory | Tactic=TA0005 ; TA0004: Defense Evasion ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Moses Staff collected information about the infected host, including the machine names and OS architecture.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PingPull can use `cmd.exe` to run various commands as a reverse shell.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BADNEWS identifies files with certain extensions from USB devices, then copies them to a predefined directory.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Operation Dream Job, Lazarus Group acquired servers to host their malicious tools.

Output: Technique=T1583.004: Server | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SMOKEDHAM has used reg.exe to create a Registry Run key.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cobalt Strike uses a command-line interface to interact with systems.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Exaramel for Windows stores the backdoor's configuration in the Registry in XML format.

Output: Technique=T1027.011: Fileless Storage | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT32 includes garbage code to mislead anti-malware software and researchers.

Output: Technique=T1027.001: Binary Padding | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Mustang Panda have acquired C2 domains prior to operations.

Output: Technique=T1583.001: Domains | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Tropic Trooper has used a delivered trojan to download additional files.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: LuminousMoth has created scheduled tasks to establish persistence for their tools.

Output: Technique=T1053.005: Scheduled Task | Tactic=TA0002 ; TA0003 ; TA0004: Execution ; Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cardinal RAT contains watchdog functionality that periodically ensures HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows\Load is set to point to its executable.

Output: Technique=T1012: Query Registry | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ROADSWEEP has been placed in the start up folder to trigger execution upon user login.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Bazar can execute a WMI query to gather information about the installed antivirus engine.

Output: Technique=T1047: Windows Management Instrumentation | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Dragonfly has deleted many of its files used during operations as part of cleanup, including removing applications and deleting screenshots.

Output: Technique=T1070.004: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: CaddyWiper can use `DsRoleGetPrimaryDomainInformation` to determine the role of the infected machine. CaddyWiper can also halt execution if the compromised host is identified as a domain controller.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PinchDuke collects user files from the compromised host based on predefined file extensions.

Output: Technique=T1005: Data from Local System | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FIN8 has used sslip.io, a free IP to domain mapping service that also makes SSL certificate generation easier for traffic encryption, as part of their command and control.

Output: Technique=T1102: Web Service | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: KV Botnet Activity involves changing process filename to pr_set_mm_exe_file and process name to pr_set_name during later infection stages.

Output: Technique=T1036: Masquerading | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TeamTNT has modified the permissions on binaries with chattr.

Output: Technique=T1222.002: Linux and Mac File and Directory Permissions Modification | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: CaddyWiper can work alphabetically through drives on a compromised system to take ownership of and overwrite all files.

Output: Technique=T1485: Data Destruction | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BADHATCH can use HTTP and HTTPS over port 443 to communicate with actor-controlled C2 servers.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: NGLite will run the whoami command to gather system information and return this to the command and control server.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: WannaCry uses a custom cryptographic protocol over the Tor circuit.

Output: Technique=T1024: Custom Cryptographic Protocol | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ember Bear has used an open source batch script to modify Windows Defender registry keys.

Output: Technique=T1112: Modify Registry | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: A Linux version of Derusbi checks if the victim user ID is anything other than zero (normally used for root), and the malware will not execute if it does not have root privileges. Derusbi also gathers the username of the victim.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Zebrocy has a command to create a scheduled task for persistence.

Output: Technique=T1053.005: Scheduled Task | Tactic=TA0002 ; TA0003 ; TA0004: Execution ; Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Carberp has captured credentials when a user performs login through a SSL session.

Output: Technique=T1185: Browser Session Hijacking | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: USBStealer has several commands to delete files associated with the malware from the victim.

Output: Technique=T1070.004: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Operation Dust Storm, the threat actors encoded some payloads with a single-byte XOR, both skipping the key itself and zeroing in an attempt to avoid exposing the key; other payloads were Base64-encoded.

Output: Technique=T1027.013: Encrypted/Encoded File | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Nebulae can discover logical drive information including the drive type, free space, and volume information.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: GALLIUM compressed and staged files in multi-part archives in the Recycle Bin prior to exfiltration.

Output: Technique=T1074.001: Local Data Staging | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Lokibot has stolen credentials from multiple applications and data sources including Windows OS credentials, email clients, FTP, and SFTP clients.

Output: Technique=T1555: Credentials from Password Stores | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Volgmer deobfuscates its strings and APIs once its executed.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: AADInternals can inject a malicious DLL (`PTASpy`) into the `AzureADConnectAuthenticationAgentService` to backdoor Azure AD Pass-Through Authentication.

Output: Technique=T1556.007: Hybrid Identity | Tactic=TA0006 ; TA0005 ; TA0003: Credential Access ; Defense Evasion ; Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: POWRUNER may enumerate user directories on a victim.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Torisma has used various Windows API calls.

Output: Technique=T1106: Native API | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BabyShark has added a Registry key to ensure all future macros are enabled for Microsoft Word and Excel as well as for additional persistence.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: macOS.OSAMiner has used run-only Applescripts, a compiled and stripped version of AppleScript, to remove human readable indicators to evade detection.

Output: Technique=T1027.008: Stripped Payloads | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: StrongPity can automatically exfiltrate collected documents to the C2 server.

Output: Technique=T1020: Automated Exfiltration | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Dipsind encrypts C2 data with AES256 in ECB mode.

Output: Technique=T1573.001: Symmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Turla has obtained and customized publicly-available tools like Mimikatz.

Output: Technique=T1588.002: Tool | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: CHOPSTICK provides access to the Windows Registry, which can be used to gather information.

Output: Technique=T1012: Query Registry | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ursnif droppers have used COM properties to execute malware in hidden windows.

Output: Technique=T1564.003: Hidden Window | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Proton removes all files in the /tmp directory.

Output: Technique=T1070.004: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Taidoor can use DeleteFileA to remove files from infected hosts.

Output: Technique=T1070.004: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Wevtutil can be used to export events from a specific log.

Output: Technique=T1005: Data from Local System | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT29 has stolen data from compromised hosts.

Output: Technique=T1005: Data from Local System | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Trojan.Karagany can perform reconnaissance commands on a victim machine via a cmd.exe process.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SQLRat relies on users clicking on an embedded image to execute the scripts.

Output: Technique=T1204.002: Malicious File | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During C0017, APT41 used the DUSTPAN loader to decrypt embedded payloads.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cobalt Strike can use sudo to run a command.

Output: Technique=T1548.003: Sudo and Sudo Caching | Tactic=TA0004 ; TA0005: Privilege Escalation ; Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: NETWIRE can persist via startup options for Login items.

Output: Technique=T1547.015: Login Items | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Rifdoor has been distributed in e-mails with malicious Excel or Word documents.

Output: Technique=T1566.001: Spearphishing Attachment | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Mimikatz’s LSADUMP::DCSync and KERBEROS::PTT modules implement the three steps required to extract the krbtgt account hash and create/use Kerberos tickets.

Output: Technique=T1550.003: Pass the Ticket | Tactic=TA0005 ; TA0008: Defense Evasion ; Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Gelsemium has the ability to compress its components.

Output: Technique=T1027.013: Encrypted/Encoded File | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Gamaredon Group has used GitHub repositories for downloaders which will be obtained by the group's .NET executable on the compromised system.

Output: Technique=T1102: Web Service | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Crimson can decode its encoded PE file prior to execution.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Duqu uses a custom command and control protocol that communicates over commonly used ports, and is frequently encapsulated by application layer protocols.

Output: Technique=T1043: Commonly Used Port | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During C0017, APT41 used VMProtect to slow the reverse engineering of malicious binaries.

Output: Technique=T1027.002: Software Packing | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cobalt Strike uses a custom command and control protocol that can encapsulated in DNS. All protocols use their standard assigned ports.

Output: Technique=T1071.004: DNS | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FrameworkPOS can collect elements related to credit card data from process memory.

Output: Technique=T1005: Data from Local System | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SLOTHFULMEDIA can open a command line to execute commands.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RDFSNIFFER hooks several Win32 API functions to hijack elements of the remote system management user-interface.

Output: Technique=T1056.004: Credential API Hooking | Tactic=TA0009 ; TA0006: Collection ; Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Wizard Spider has used WMIC and vssadmin to manually delete volume shadow copies. Wizard Spider has also used Conti ransomware to delete volume shadow copies automatically with the use of vssadmin.

Output: Technique=T1490: Inhibit System Recovery | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Magic Hound has created local accounts named `help` and `DefaultAccount` on compromised machines.

Output: Technique=T1136.001: Local Account | Tactic=TA0003: Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PolyglotDuke can use LoadLibraryW and CreateProcess to load and execute code.

Output: Technique=T1106: Native API | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Pikabot performs a variety of system checks to determine if it is running in an analysis environment or sandbox, such as checking the number of processors (must be greater than two), and the amount of RAM (must be greater than 2GB).

Output: Technique=T1497.001: System Checks | Tactic=TA0005 ; TA0007: Defense Evasion ; Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Squirrelwaffle has been distributed via malicious Microsoft Office documents within spam emails.

Output: Technique=T1566.001: Spearphishing Attachment | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SecretsDump and Mimikatz modules within Impacket can perform credential dumping to obtain account and password information.

Output: Technique=T1003.004: LSA Secrets | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: KillDisk has a ransomware component that encrypts files with an AES key that is also RSA-1028 encrypted.

Output: Technique=T1486: Data Encrypted for Impact | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Kimsuky has exploited various vulnerabilities for initial access, including Microsoft Exchange vulnerability CVE-2020-0688.

Output: Technique=T1190: Exploit Public-Facing Application | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During the 2016 Ukraine Electric Power Attack, Sandworm Team used Mimikatz to capture and use legitimate credentials.

Output: Technique=T1003.001: LSASS Memory | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sandworm Team has registered domain names and created URLs that are often designed to mimic or spoof legitimate websites, such as email login pages, online file sharing and storage websites, and password reset pages, while also hosting these items on legitimate, compromised network infrastructure.

Output: Technique=T1583.001: Domains | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: POWERSTATS has connected to C2 servers through proxies.

Output: Technique=T1090.002: External Proxy | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Astaroth encodes data using Base64 before sending it to the C2 server.

Output: Technique=T1132.001: Standard Encoding | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Brute Ratel C4 can use DNS over HTTPS for C2.

Output: Technique=T1071.004: DNS | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sidewinder has used LNK files to download remote files to the victim's network.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Metamorfo uses JavaScript to get the system time.

Output: Technique=T1124: System Time Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Spark has used a custom XOR algorithm to decrypt the payload.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Diavol has used `CreateToolhelp32Snapshot`, `Process32First`, and `Process32Next` API calls to enumerate the running processes in the system.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: LuminousMoth has used unique malware for information theft and exfiltration.

Output: Technique=T1587.001: Malware | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Bad Rabbit has encrypted files and disks using AES-128-CBC and RSA-2048.

Output: Technique=T1486: Data Encrypted for Impact | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: OilRig has a tool called CANDYKING to capture a screenshot of user's desktop.

Output: Technique=T1113: Screen Capture | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: WARPWIRE can embed itself into a legitimate file on compromised Ivanti Connect Secure VPNs.

Output: Technique=T1554: Compromise Host Software Binary | Tactic=TA0003: Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FlawedAmmyy will attempt to detect anti-virus products during the initial infection.

Output: Technique=T1518.001: Security Software Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Earth Lusca has used compromised web servers as part of their operational infrastructure.

Output: Technique=T1584.004: Server | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Keydnap uses a copy of tor2web proxy for HTTPS communications.

Output: Technique=T1090.003: Multi-hop Proxy | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: CostaBricks has used a number of API calls, including `VirtualAlloc`, `VirtualFree`, `LoadLibraryA`, `GetProcAddress`, and `ExitProcess`.

Output: Technique=T1106: Native API | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: LightNeuron gathers information about network adapters using the Win32 API call GetAdaptersInfo.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TrailBlazer has used filenames that match the name of the compromised system in attempt to avoid detection.

Output: Technique=T1036: Masquerading | Tactic=TA0005: Defense Evasion