Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Gazer has commands to delete files and persistence mechanisms from the victim.

Output: Technique=T1070.004: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Agrius engaged in password spraying via SMB in victim environments.

Output: Technique=T1110.003: Password Spraying | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ThiefQuest invokes time call to check the system's time, executes a sleep command, invokes a second time call, and then compares the time difference between the two time calls and the amount of time the system slept to identify the sandbox.

Output: Technique=T1497.003: Time Based Evasion | Tactic=TA0005 ; TA0007: Defense Evasion ; Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RogueRobin uses a custom DNS tunneling protocol for C2.

Output: Technique=T1094: Custom Command and Control Protocol | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Blue Mockingbird has obfuscated the wallet address in the payload binary.

Output: Technique=T1027.013: Encrypted/Encoded File | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Nightdoor uses TCP and UDP communication for command and control traffic.

Output: Technique=T1071: Application Layer Protocol | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Mispadu creates a link in the startup folder for persistence. Mispadu adds persistence via the registry key `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RCSession can use an encrypted beacon to check in with C2.

Output: Technique=T1573: Encrypted Channel | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cobalt Strike has the ability to use an Excel Workbook to execute additional code by enabling Office to trust macros and execute code without user permission.

Output: Technique=T1137.001: Office Template Macros | Tactic=TA0003: Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Confucius has used a file stealer to steal documents and images with the following extensions: txt, pdf, png, jpg, doc, xls, xlm, odp, ods, odt, rtf, ppt, xlsx, xlsm, docx, pptx, and jpeg.

Output: Technique=T1119: Automated Collection | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HotCroissant can remotely open applications on the infected host with the ShellExecuteA command.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Frankenstein, the threat actors used Word documents that prompted the victim to enable macros and run a Visual Basic script.

Output: Technique=T1059.005: Visual Basic | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Turla surveys a system upon check-in to discover running processes using the tasklist /v command. Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: WhisperGate's downloader can reverse its third stage file bytes and reflectively load the file as a .NET assembly.

Output: Technique=T1620: Reflective Code Loading | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During C0018, the threat actors used AvosLocker ransomware to encrypt files on the compromised network.

Output: Technique=T1486: Data Encrypted for Impact | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Pasam creates a backdoor through which remote attackers can retrieve information such as hostname and free disk space.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Threat Group-3390 has extensively used strategic web compromises to target victims.

Output: Technique=T1189: Drive-by Compromise | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT29 drops a Windows shortcut file for execution.

Output: Technique=T1547.009: Shortcut Modification | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Depending on the Linux distribution and when executing with root permissions, RotaJakiro may install persistence using a `.service` file under the `/lib/systemd/system/` folder.

Output: Technique=T1543.002: Systemd Service | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Micropsia can perform a recursive directory listing for all volume drives available on the victim's machine and can also fetch specific files by their paths.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TrickBot utilizes EternalBlue and EternalRomance exploits for lateral movement in the modules wormwinDll, wormDll, mwormDll, nwormDll, tabDll.

Output: Technique=T1210: Exploitation of Remote Services | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During C0021, the threat actors deobfuscated encoded PowerShell commands including use of the specific string `'FromBase'+0x40+'String'`, in place of `FromBase64String` which is normally used to decode base64.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Kimsuky has used attempted to lure victims into opening malicious e-mail attachments.

Output: Technique=T1204.002: Malicious File | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BlackCat has the ability to add the following registry key on compromised networks to maintain persistence: `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services \LanmanServer\Paramenters`

Output: Technique=T1112: Modify Registry | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Kimsuky has created social media accounts to monitor news and security trends as well as potential targets.

Output: Technique=T1585.001: Social Media Accounts | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SharpDisco can use `cmd.exe` to execute plugins and to send command output to specified SMB shares.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Fox Kitten has used RDP to log in and move laterally in the target environment.

Output: Technique=T1021.001: Remote Desktop Protocol | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: LunarWeb can list installed software on compromised systems.

Output: Technique=T1518: Software Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Several Lazarus Group malware families use timestomping, including modifying the last write timestamp of a specified Registry key to a random date, as well as copying the timestamp for legitimate .exe files (such as calc.exe or mspaint.exe) to its dropped files.

Output: Technique=T1070.006: Timestomp | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SUNBURST removed IFEO registry values to clean up traces of persistence.

Output: Technique=T1070.009: Clear Persistence | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Molerats used various implants, including those built on .NET, on target machines.

Output: Technique=T1059: Command and Scripting Interpreter | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BoxCaon can upload files from a compromised host.

Output: Technique=T1005: Data from Local System | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Chimera has used scheduled tasks to invoke Cobalt Strike including through batch script schtasks /create /ru "SYSTEM" /tn "update" /tr "cmd /c c:\windows\temp\update.bat" /sc once /f /st and to maintain persistence.

Output: Technique=T1053.005: Scheduled Task | Tactic=TA0002 ; TA0003 ; TA0004: Execution ; Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PowerSploit contains a collection of Exfiltration modules that can harvest credentials from Group Policy Preferences.

Output: Technique=T1552.006: Group Policy Preferences | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SLOTHFULMEDIA has a keylogging capability.

Output: Technique=T1056.001: Keylogging | Tactic=TA0009 ; TA0006: Collection ; Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cobalt Strike can inject a variety of payloads into processes dynamically chosen by the adversary.

Output: Technique=T1055: Process Injection | Tactic=TA0005 ; TA0004: Defense Evasion ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT18 actors deleted tools and batch files from victim systems.

Output: Technique=T1070.004: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Gazer performs thread execution hijacking to inject its orchestrator into a running thread from a remote process.

Output: Technique=T1055.003: Thread Execution Hijacking | Tactic=TA0005 ; TA0004: Defense Evasion ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Uroburos has used a combination of a Diffie-Hellman key exchange mixed with a pre-shared key (PSK) to encrypt its top layer of C2 communications.

Output: Technique=T1573.002: Asymmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Valak has the ability to enumerate domain admin accounts.

Output: Technique=T1087.002: Domain Account | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Turian has the ability to use Python to spawn a Unix shell.

Output: Technique=T1059.006: Python | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: INC Ransomware can receive command line arguments to encrypt specific files and directories.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Astaroth uses certutil and BITSAdmin to download additional malware.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ursnif has used crypto key information stored in the Registry to decrypt Tor clients dropped to disk.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ember Bear deletes files related to lateral movement to avoid detection.

Output: Technique=T1070.004: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During the SolarWinds Compromise, APT29 used privileged accounts to replicate directory service data with domain controllers.

Output: Technique=T1003.006: DCSync | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: KOPILUWAK has gained execution through malicious attachments.

Output: Technique=T1204.002: Malicious File | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sandworm Team masqueraded malicious installers as Windows update packages to evade defense and entice users to execute binaries.

Output: Technique=T1036: Masquerading | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ryuk has called GetLogicalDrives to emumerate all mounted drives, and GetDriveTypeW to determine the drive type.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: njRAT can collect data from a local system.

Output: Technique=T1005: Data from Local System | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During the SolarWinds Compromise, APT29 used WinRM via PowerShell to execute commands and payloads on remote hosts.

Output: Technique=T1021.006: Windows Remote Management | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Earth Lusca has dropped an SSH-authorized key in the `/root/.ssh` folder in order to access a compromised server with SSH.

Output: Technique=T1098.004: SSH Authorized Keys | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: CURIUM has established a network of fictitious social media accounts, including on Facebook and LinkedIn, to establish relationships with victims, often posing as an attractive woman.

Output: Technique=T1585.001: Social Media Accounts | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Astaroth uses WMIC to execute payloads.

Output: Technique=T1047: Windows Management Instrumentation | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Tonto Team has used a first stage web shell after compromising a vulnerable Exchange server.

Output: Technique=T1505.003: Web Shell | Tactic=TA0003: Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PittyTiger has obtained and used tools such as Mimikatz and gsecdump.

Output: Technique=T1588.002: Tool | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BoxCaon can collect the victim's MAC address by using the GetAdaptersInfo API.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: MuddyWater has used malware that checked if the ProgramData folder had folders or files with the keywords "Kasper," "Panda," or "ESET."

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HAWKBALL can collect the OS version, architecture information, and computer name.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: dsquery has the ability to enumerate various information, such as the operating system and host name, for systems within a domain.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Fox Kitten has brute forced RDP credentials.

Output: Technique=T1110: Brute Force | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: AppleSeed has the ability to rename its payload to ESTCommon.dll to masquerade as a DLL belonging to ESTsecurity.

Output: Technique=T1036.005: Match Legitimate Name or Location | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Pony has attempted to lure targets into downloading an attached executable (ZIP, RAR, or CAB archives) or document (PDF or other MS Office format).

Output: Technique=T1204.002: Malicious File | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Lazarus Group has used LinkedIn to identify and target specific employees within a chosen organization.

Output: Technique=T1593.001: Social Media | Tactic=TA0043: Reconnaissance


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ember Bear uses socket-based tunneling utilities for command and control purposes such as NetCat and Go Simple Tunnel (GOST). These tunnels are used to push interactive command prompts over the created sockets. Ember Bear has also used reverse TCP connections from Meterpreter installations to communicate back with C2 infrastructure.

Output: Technique=T1095: Non-Application Layer Protocol | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Gelsemium can use a batch script to delete itself.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During C0027, Scattered Spider impersonated legitimate IT personnel in phone calls and text messages either to direct victims to a credential harvesting site or getting victims to run commercial remote monitoring and management (RMM) tools. Scattered Spider utilized social engineering to compel IT help desk personnel to reset passwords and MFA tokens.

Output: Technique=T1656: Impersonation | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Volt Typhoon has used webshells, including ones named AuditReport.jspx and iisstart.aspx, in compromised environments.

Output: Technique=T1505.003: Web Shell | Tactic=TA0003: Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cyclops Blink can use DNS over HTTPS (DoH) to resolve C2 nodes.

Output: Technique=T1572: Protocol Tunneling | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT32 used GetPassword_x64 to harvest credentials.

Output: Technique=T1003: OS Credential Dumping | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Operation Honeybee, the threat actors modified the MaoCheng dropper so its icon appeared as a Word document.

Output: Technique=T1036: Masquerading | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Fox Kitten has used a Twitter account to communicate with ransomware victims.

Output: Technique=T1585.001: Social Media Accounts | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: KeyBoy uses custom SSL libraries to impersonate SSL in C2 traffic.

Output: Technique=T1001.003: Protocol or Service Impersonation | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: KGH_SPY has been spread through Word documents containing malicious macros.

Output: Technique=T1204.002: Malicious File | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TA2541 has used malicious links to cloud and web services to gain execution on victim machines.

Output: Technique=T1204.001: Malicious Link | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT3 has a tool that can delete files.

Output: Technique=T1070.004: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: IPsec Helper can run arbitrary Visual Basic scripts and commands passed to it.

Output: Technique=T1059.005: Visual Basic | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Kobalos is triggered by an incoming TCP connection to a legitimate service from a specific source port.

Output: Technique=T1205: Traffic Signaling | Tactic=TA0005 ; TA0003 ; TA0011: Defense Evasion ; Persistence ; Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Gootloader can inspect the User-Agent string in GET request header information to determine the operating system of targeted systems.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SMOKEDHAM has modified registry keys for persistence, to enable credential caching for credential access, and to facilitate lateral movement via RDP.

Output: Technique=T1112: Modify Registry | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RCSession has the ability to capture keystrokes on a compromised host.

Output: Technique=T1056.001: Keylogging | Tactic=TA0009 ; TA0006: Collection ; Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Dragonfly used the command query user on victim hosts.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Epic compresses the collected data with bzip2 before sending it to the C2 server.

Output: Technique=T1560.002: Archive via Library | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: WIREFIRE can AES encrypt process output sent from compromised devices to C2.

Output: Technique=T1573.001: Symmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: The Komplex C2 channel uses an 11-byte XOR algorithm to hide data.

Output: Technique=T1573.001: Symmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: NDiskMonitor uses AES to encrypt certain information sent over its C2 channel.

Output: Technique=T1573.001: Symmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Operation Wocao, the threat actors used `tasklist` to collect a list of running processes on an infected system.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Saint Bot has used PowerShell for execution.

Output: Technique=T1059.001: PowerShell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: LunarMail can search its staging directory for output files it has produced.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RTM has relied on users opening malicious email attachments, decompressing the attached archive, and double-clicking the executable within.

Output: Technique=T1204.002: Malicious File | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: REvil can use the Windows command line to delete volume shadow copies and disable recovery.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FIN13 has leveraged SMB to move laterally within a compromised network via application servers and SQL servers.

Output: Technique=T1021.002: SMB/Windows Admin Shares | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RogueRobin base64 encodes strings that are sent to the C2 over its DNS tunnel.

Output: Technique=T1132.001: Standard Encoding | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Nightdoor can self-delete.

Output: Technique=T1070.004: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Briba connects to external C2 infrastructure over port 443.

Output: Technique=T1043: Commonly Used Port | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cuba can modify services by using the OpenService and ChangeServiceConfig functions.

Output: Technique=T1543.003: Windows Service | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Empire can find shared drives on the local system.

Output: Technique=T1135: Network Share Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Mofang delivered spearphishing emails with malicious links included.

Output: Technique=T1566.002: Spearphishing Link | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RogueRobin checks the running processes for evidence it may be running in a sandbox environment. It specifically enumerates processes for Wireshark and Sysinternals.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: EvilBunny has deleted the initial dropper after running through the environment checks.

Output: Technique=T1070.004: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sandworm Team had gathered user, IP address, and server data related to RDP sessions on a compromised host. It has also accessed network diagram files useful for understanding how a host's network was configured.

Output: Technique=T1049: System Network Connections Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Dtrack can retrieve browser history.

Output: Technique=T1217: Browser Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT1 has sent spearphishing emails containing malicious attachments.

Output: Technique=T1566.001: Spearphishing Attachment | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Pikabot will gather information concerning the Windows Domain the victim machine is a member of during execution.

Output: Technique=T1482: Domain Trust Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Pikabot decrypts command and control URIs using ADVobfuscator, and decrypts IP addresses and port numbers with a custom algorithm. Other versions of Pikabot decode chunks of stored stage 2 payload content in the initial payload <code>.text</code> section before consolidating them for further execution. Overall LunarMail is associated with multiple encoding and encryption mechanisms to obfuscate the malware's presence and avoid analysis or detection.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: The BlackEnergy 3 variant drops its main DLL component and then creates a .lnk shortcut to that file in the startup folder.

Output: Technique=T1547.009: Shortcut Modification | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FunnyDream can upload files from victims' machines.

Output: Technique=T1005: Data from Local System | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Mispadu has the ability to capture screenshots on compromised hosts.

Output: Technique=T1113: Screen Capture | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FatDuke can AES encrypt C2 communications.

Output: Technique=T1573.001: Symmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: The Winnti for Windows dropper can decrypt and decompresses a data blob.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.

Output: Technique=T1027.005: Indicator Removal from Tools | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: WinMM uses NetUser-GetInfo to identify that it is running under an “Admin” account on the local system.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Most Sakula samples maintain persistence by setting the Registry Run key SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ in the HKLM or HKCU hive, with the Registry value and file name varying by sample.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: AvosLocker can restart a compromised machine in safe mode.

Output: Technique=T1562.009: Safe Mode Boot | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: QuasarRAT uses AES with a hardcoded pre-shared key to encrypt network communication.

Output: Technique=T1573.001: Symmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Grandoreiro can monitor browser activity for online banking actions and display full-screen overlay images to block user access to the intended site or present additional data fields.

Output: Technique=T1185: Browser Session Hijacking | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Dragonfly 2.0 used the command query user on victim hosts.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Lazarus Group has compromised legitimate domains, including those hosted in the US and Italy, for C2.

Output: Technique=T1584.001: Domains | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Raspberry Robin uses newly-registered domains containing only a few characters for command and controll purposes, such as "v0[.]cx".

Output: Technique=T1583.001: Domains | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: GrimAgent has sent data related to a compromise host over its C2 channel.

Output: Technique=T1041: Exfiltration Over C2 Channel | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BONDUPDATER is written in PowerShell.

Output: Technique=T1059.001: PowerShell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PlugX can use RC4 encryption in C2 communications.

Output: Technique=T1573.001: Symmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Octopus can download additional files and tools onto the victim’s machine.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: The original variant of FakeM encrypts C2 traffic using a custom encryption cipher that uses an XOR key of “YHCRA” and bit rotation between each XOR operation. Some variants of FakeM use RC4 to encrypt C2 traffic.

Output: Technique=T1573.001: Symmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: NativeZone has, upon execution, displayed a message box that appears to be related to a Ukrainian electronic document management system.

Output: Technique=T1036: Masquerading | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: jRAT payloads have been packed.

Output: Technique=T1027.002: Software Packing | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Elise executes net user after initial communication is made to the remote server.

Output: Technique=T1087.001: Local Account | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TrickBot has used macros in Excel documents to download and deploy the malware on the user’s machine.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Pikabot Distribution February 2024 utilized emails with hyperlinks leading to malicious ZIP archive files containing scripts to download and install Pikabot.

Output: Technique=T1566.002: Spearphishing Link | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Bisonal has used the RegQueryValueExA function to retrieve proxy information in the Registry.

Output: Technique=T1012: Query Registry | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Calisto collects Keychain storage data and copies those passwords/tokens to a file.

Output: Technique=T1555.001: Keychain | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: For FunnyDream, the threat actors used a new backdoor named FunnyDream.

Output: Technique=T1588.001: Malware | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SideCopy has sent Microsoft Office Publisher documents to victims that have embedded malicious macros that execute an hta file via calling `mshta.exe`.

Output: Technique=T1059.005: Visual Basic | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: IPsec Helper can delete various service traces related to persistent execution when commanded.

Output: Technique=T1070.009: Clear Persistence | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: UNC2452 set the hostnames of its C2 infrastructure to match legitimate hostnames in the victim environment. They also primarily used IP addresses originating from the same country as the victim for their VPN infrastructure.

Output: Technique=T1036: Masquerading | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Azorult uses an XOR key to decrypt content and uses Base64 to decode the C2 address.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: CORESHELL can communicate over SMTP and POP3 for C2.

Output: Technique=T1071.003: Mail Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Empire has a module for creating a new domain user if permissions allow.

Output: Technique=T1136.002: Domain Account | Tactic=TA0003: Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: MechaFlounder has the ability to identify the username and hostname on a compromised host.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: USBStealer collects files matching certain criteria from the victim and stores them in a local directory for later exfiltration.

Output: Technique=T1074.001: Local Data Staging | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Dragonfly 2.0 used scheduled tasks to automatically log out of created accounts every 8 hours as well as to execute malicious files.

Output: Technique=T1053.005: Scheduled Task | Tactic=TA0002 ; TA0003 ; TA0004: Execution ; Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SombRAT has collected data and files from a compromised host.

Output: Technique=T1005: Data from Local System | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: WastedLocker has copied a random file from the Windows System32 folder to the <code>%APPDATA%</code> location under a different hidden filename.

Output: Technique=T1564.001: Hidden Files and Directories | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HEXANE has established fraudulent LinkedIn accounts impersonating HR department employees to target potential victims with fake job offers.

Output: Technique=T1585.001: Social Media Accounts | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BLUELIGHT has collected the computer name and OS version from victim machines.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Operation CuckooBees, the threat actors used the `systeminfo` command to gather details about a compromised system.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Nebulae can list files and directories on a compromised host.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: KONNI can steal profiles (containing credential information) from Firefox, Chrome, and Opera.

Output: Technique=T1003: OS Credential Dumping | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: The APT1 group is known to have used pass the hash.

Output: Technique=T1550.002: Pass the Hash | Tactic=TA0005 ; TA0008: Defense Evasion ; Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT28 has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.

Output: Technique=T1204.001: Malicious Link | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Gamaredon Group tools have contained an application to check performance of USB flash drives. Gamaredon Group has also used malware to scan for removable drives.

Output: Technique=T1120: Peripheral Device Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: MoonWind obtains the number of removable drives from the victim.

Output: Technique=T1120: Peripheral Device Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT41 DUST deleted various artifacts from victim systems following use.

Output: Technique=T1070.004: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Silent Librarian has cloned victim organization login pages and staged them for later use in credential harvesting campaigns. Silent Librarian has also made use of a variety of URL shorteners for these staged websites.

Output: Technique=T1608.005: Link Target | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Leviathan has conducted internal spearphishing within the victim's environment for lateral movement.

Output: Technique=T1534: Internal Spearphishing | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: WarzoneRAT can access the webcam on a victim's machine.

Output: Technique=T1125: Video Capture | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ChChes steals credentials stored inside Internet Explorer.

Output: Technique=T1555.003: Credentials from Web Browsers | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious link.

Output: Technique=T1204.001: Malicious Link | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Dark Caracal spearphished victims via Facebook and Whatsapp.

Output: Technique=T1566.003: Spearphishing via Service | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Crimson contains a command to collect the victim MAC address and LAN IP.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FruitFly persists via a Launch Agent.

Output: Technique=T1159: Launch Agent | Tactic=TA0003: Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BBSRAT has been loaded through DLL side-loading of a legitimate Citrix executable that is set to persist through the Registry Run key location HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ssonsvr.exe.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Bazar can retrieve information from the infected machine.

Output: Technique=T1005: Data from Local System | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Earth Lusca used a VBA script to execute WMI.

Output: Technique=T1047: Windows Management Instrumentation | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: IMAPLoader uses WMI queries to gather information about the victim machine.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT41 collected MAC addresses from victim machines.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: The Bazar loader has named malicious shortcuts "adobe" and mimicked communications software.

Output: Technique=T1036.005: Match Legitimate Name or Location | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: MegaCortex has used <code>.cmd</code> scripts on the victim's system.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Okrum was seen using MimikatzLite to perform credential dumping.

Output: Technique=T1003.001: LSASS Memory | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Heyoka Backdoor can check if it is running as a service on a compromised host.

Output: Technique=T1007: System Service Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SodaMaster can identify the username on a compromised host.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: POORAIM can identify system information, including battery status.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Clambling can browse directories on a compromised host.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SynAck enumerates all running processes.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TrickBot establishes persistence by creating an autostart service that allows it to run whenever the machine boots.

Output: Technique=T1543.003: Windows Service | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Threat Group-3390 has detached network shares after exfiltrating files, likely to evade detection.

Output: Technique=T1070.005: Network Share Connection Removal | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Micropsia can download and execute an executable from the C2 server.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: OSInfo performs a connection test to discover remote systems in the network

Output: Technique=T1018: Remote System Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Threat Group-3390 has exploited CVE-2018-0798 in Equation Editor.

Output: Technique=T1203: Exploitation for Client Execution | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Deep Panda has used PowerShell scripts to download and execute programs in memory, without writing to disk.

Output: Technique=T1064: Scripting | Tactic=TA0005 ; TA0002: Defense Evasion ; Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Carberp has maintained persistence by placing itself inside the current user's startup folder.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Patchwork has added the path of its second-stage malware to the startup folder to achieve persistence. One of its file stealers has also persisted by adding a Registry Run key.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Exaramel for Linux has a hardcoded location under systemd that it uses to achieve persistence if it is running as root.

Output: Technique=T1501: Systemd Service | Tactic=TA0003: Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Agent Tesla can collect the system's computer name and also has the capability to collect information on the processor, memory, OS, and video card from the system.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: CharmPower can send victim data via FTP with credentials hardcoded in the script.

Output: Technique=T1048.003: Exfiltration Over Unencrypted Non-C2 Protocol | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During C0010, UNC3890 actors likely established a watering hole that was hosted on a login page of a legitimate Israeli shipping company that was active until at least November 2021.

Output: Technique=T1189: Drive-by Compromise | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RTM has attempted to lure victims into opening e-mail attachments to execute malicious code.

Output: Technique=T1204.002: Malicious File | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT28 has collected emails from victim Microsoft Exchange servers.

Output: Technique=T1114.002: Remote Email Collection | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Magic Hound has used compromised domains to host links targeted to specific phishing victims.

Output: Technique=T1584.001: Domains | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: InvisiMole has a command to disable routing and the Firewall on the victim’s machine.

Output: Technique=T1562.004: Disable or Modify System Firewall | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Crimson can collect information from a compromised host.

Output: Technique=T1005: Data from Local System | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: NOKKI has established persistence by writing the payload to the Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Agent Tesla has used HTTP for C2 communications.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BlackCat can utilize `net use` commands to identify domain users.

Output: Technique=T1087.002: Domain Account | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Derusbi is capable of obtaining directory, file, and drive listings.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TA505 has used malware such as Azorult and Cobalt Strike in their operations.

Output: Technique=T1588.001: Malware | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SLOWPULSE is applied in compromised environments through modifications to legitimate Pulse Secure files.

Output: Technique=T1554: Compromise Host Software Binary | Tactic=TA0003: Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Skidmap has encrypted it's main payload using 3DES.

Output: Technique=T1027.013: Encrypted/Encoded File | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Turla has modified variables in kernel memory to turn off Driver Signature Enforcement after exploiting vulnerabilities that obtained kernel mode privileges.

Output: Technique=T1553.006: Code Signing Policy Modification | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: OopsIE encodes data in hexadecimal format over the C2 channel.

Output: Technique=T1132.001: Standard Encoding | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Raspberry Robin second stage payloads can be hosted as RAR files, containing a malicious EXE and DLL, on Discord servers.

Output: Technique=T1102: Web Service | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT19 used an HTTP malware variant and a Port 22 malware variant to collect the MAC address and IP address from the victim’s machine.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ebury disables OpenSSH, system (`systemd`), and audit logs (`/sbin/auditd`) when the backdoor is active.

Output: Technique=T1562.012: Disable or Modify Linux Audit System | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Akira encrypts files in victim environments as part of ransomware operations.

Output: Technique=T1486: Data Encrypted for Impact | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Aquatic Panda has downloaded additional scripts and executed Base64 encoded commands in PowerShell.

Output: Technique=T1059.001: PowerShell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sibot has queried the registry for proxy server information.

Output: Technique=T1012: Query Registry | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: QakBot has spread through emails with malicious links.

Output: Technique=T1566.002: Spearphishing Link | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RTM can obtain the victim username and permissions.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Smoke Loader injects into the Internet Explorer process.

Output: Technique=T1055: Process Injection | Tactic=TA0005 ; TA0004: Defense Evasion ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TrickBot can identify the user and groups the user belongs to on a compromised host.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Valak has the ability to enumerate running processes on a compromised host.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FELIXROOT uses Rundll32 for executing the dropper program.

Output: Technique=T1218.011: Rundll32 | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: EnvyScout can write files to disk with JavaScript using a modified version of the open-source tool FileSaver.

Output: Technique=T1059.007: JavaScript | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RAPIDPULSE retrieves files from the victim system via encrypted commands sent to the web shell.

Output: Technique=T1005: Data from Local System | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT37 has downloaded second stage malware from compromised websites.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Crutch can exfiltrate data over the primary C2 channel (Dropbox HTTP API).

Output: Technique=T1041: Exfiltration Over C2 Channel | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT38 has installed a new Windows service to establish persistence.

Output: Technique=T1543.003: Windows Service | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT39 has used malware to set LoadAppInit_DLLs in the Registry key SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows in order to establish persistence.

Output: Technique=T1546.010: AppInit DLLs | Tactic=TA0004 ; TA0003: Privilege Escalation ; Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cobalt Strike can timestomp any files or payloads placed on a target machine to help them blend in.

Output: Technique=T1070.006: Timestomp | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: IcedID used the following command to check the country/language of the active console: ` cmd.exe /c chcp >&2`.

Output: Technique=T1614.001: System Language Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PoshC2 contains multiple modules for injecting into processes, such as Invoke-PSInject.

Output: Technique=T1055: Process Injection | Tactic=TA0005 ; TA0004: Defense Evasion ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Honeybee uses FTP for command and control.

Output: Technique=T1071.002: File Transfer Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PcShare has the ability to capture keystrokes.

Output: Technique=T1056.001: Keylogging | Tactic=TA0009 ; TA0006: Collection ; Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.

Output: Technique=T1059.005: Visual Basic | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Carbon has used RSA encryption for C2 communications.

Output: Technique=T1573.002: Asymmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Higaisa used a function to gather the current time.

Output: Technique=T1124: System Time Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: jRAT can steal keys for VPNs and cryptocurrency wallets.

Output: Technique=T1552.004: Private Keys | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Windshift has used e-mail attachments to lure victims into executing malicious code.

Output: Technique=T1204.002: Malicious File | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Anchor has used cmd.exe to run its self deletion routine.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SombRAT can execute loadfromfile, loadfromstorage, and loadfrommem to inject a DLL from disk, storage, or memory respectively.

Output: Technique=T1055.001: Dynamic-link Library Injection | Tactic=TA0005 ; TA0004: Defense Evasion ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: JSS Loader has been executed through malicious attachments contained in spearphishing emails.

Output: Technique=T1204.002: Malicious File | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: WellMess can collect the username on the victim machine to send to C2.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Mivast creates the following Registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Micromedia.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ShadowPad has collected the PID of a malicious process.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Daggerfly used Reg to dump the Security Account Manager (SAM) hive from victim machines for follow-on credential extraction.

Output: Technique=T1003.002: Security Account Manager | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Comnie executes VBS scripts.

Output: Technique=T1059.005: Visual Basic | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT33 has used AES for encryption of command and control traffic.

Output: Technique=T1573.001: Symmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Raccoon Stealer uses RC4-encrypted, base64-encoded strings to obfuscate functionality and command and control servers.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Goopy has the ability to enumerate the infected system's user name.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT41 used svchost.exe and Net to execute a system service installed to launch a Cobalt Strike BEACON loader.

Output: Technique=T1569.002: Service Execution | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: If establishing persistence by installation as a new service fails, one variant of Elise establishes persistence for the created .exe file by setting the following Registry key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\svchost : %APPDATA%\Microsoft\Network\svchost.exe. Other variants have set the following Registry keys for persistence: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\imejp : [self] and HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IAStorD.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: LazyScripter has used a variety of open-source remote access Trojans for its operations.

Output: Technique=T1588.001: Malware | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cuba can use the function GetIpNetTable to recover the last connections to the victim's machine.

Output: Technique=T1049: System Network Connections Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SideTwist has the ability to search for specific files.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT41 used the storescyncsvc.dll BEACON backdoor to download a secondary backdoor.

Output: Technique=T1104: Multi-Stage Channels | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT32 has used macros, PowerShell scripts, COM scriptlets, and VBS scripts.

Output: Technique=T1064: Scripting | Tactic=TA0005 ; TA0002: Defense Evasion ; Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Operation Dream Job, Lazarus Group lured victims into executing malicious documents that contained "dream job" descriptions from defense, aerospace, and other sectors.

Output: Technique=T1204.002: Malicious File | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Magic Hound enabled and used the default system managed account, DefaultAccount, via `"powershell.exe" /c net user DefaultAccount /active:yes` to connect to a targeted Exchange server over RDP.

Output: Technique=T1078.001: Default Accounts | Tactic=TA0005 ; TA0003 ; TA0004 ; TA0001: Defense Evasion ; Persistence ; Privilege Escalation ; Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: OSInfo enumerates the current network connections similar to <code> net use </code>.

Output: Technique=T1049: System Network Connections Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During the SolarWinds Compromise, APT29 used dynamic DNS resolution to construct and resolve to randomly-generated subdomains for C2.

Output: Technique=T1568: Dynamic Resolution | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Grandoreiro can collect the computer name and OS version from a compromised host.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sandworm Team has collected the username from a compromised host.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Grandoreiro can write or modify browser shortcuts to enable launching of malicious browser extensions.

Output: Technique=T1547.009: Shortcut Modification | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Rubeus can forge a ticket-granting ticket.

Output: Technique=T1558.001: Golden Ticket | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: AutoIt backdoor is capable of identifying documents on the victim with the following extensions: .doc; .pdf, .csv, .ppt, .docx, .pst, .xls, .xlsx, .pptx, and .jpeg.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ramsay can scan for systems that are vulnerable to the EternalBlue exploit.

Output: Technique=T1046: Network Service Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SombRAT can execute getinfo to enumerate the computer name and OS version of a compromised system.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PowerSploit's New-UserPersistenceOption Persistence argument can be used to establish via a Scheduled Task/Job.

Output: Technique=T1053.005: Scheduled Task | Tactic=TA0002 ; TA0003 ; TA0004: Execution ; Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Diavol can collect the computer name and OS version from the system.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BoomBox can search for specific files and directories on a machine.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Manjusaka data exfiltration takes place over HTTP channels.

Output: Technique=T1041: Exfiltration Over C2 Channel | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: The QakBot web inject module can inject Java Script into web banking pages visited by the victim.

Output: Technique=T1059.007: JavaScript | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SUNSPOT monitored running processes for instances of MsBuild.exe by hashing the name of each running process and comparing it to the corresponding value 0x53D525. It also extracted command-line arguments and individual arguments from the running MsBuild.exe process to identify the directory path of the Orion software Visual Studio solution.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: NETWIRE has the ability to steal credentials from web browsers including Internet Explorer, Opera, Yandex, and Chrome.

Output: Technique=T1555.003: Credentials from Web Browsers | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Operation Dream Job, Lazarus Group uses HTTP and HTTPS to contact actor-controlled C2 servers.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: LookBack removes itself after execution and can delete files on the system.

Output: Technique=T1070.004: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FIN6 has used Windows Credential Editor for credential dumping.

Output: Technique=T1003.001: LSASS Memory | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: LAPSUS$ has replayed stolen session token and passwords to trigger simple-approval MFA prompts in hope of the legitimate user will grant necessary approval.

Output: Technique=T1111: Multi-Factor Authentication Interception | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Dragonfly has manipulated .lnk files to gather user credentials in conjunction with Forced Authentication.

Output: Technique=T1547.009: Shortcut Modification | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Flame identifies security software such as antivirus through the Security module.

Output: Technique=T1518.001: Security Software Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Clambling can deobfuscate its payload prior to execution.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Hikit has been spread through spear phishing.

Output: Technique=T1566: Phishing | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HotCroissant has the ability to stop services on the infected host.

Output: Technique=T1489: Service Stop | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Kwampirs collects password policy information with the command net accounts.

Output: Technique=T1201: Password Policy Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.

Output: Technique=T1053.005: Scheduled Task | Tactic=TA0002 ; TA0003 ; TA0004: Execution ; Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PoshC2 can utilize multiple methods to bypass UAC.

Output: Technique=T1548.002: Bypass User Account Control | Tactic=TA0004 ; TA0005: Privilege Escalation ; Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ProLock can use BITS jobs to download its malicious payload.

Output: Technique=T1197: BITS Jobs | Tactic=TA0005 ; TA0003: Defense Evasion ; Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: LitePower can determine if the current user has admin privileges.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Bazar has used XOR, RSA2, and RC4 encrypted files.

Output: Technique=T1027.013: Encrypted/Encoded File | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: The Ritsol backdoor trojan used by Elderwood can download files onto a compromised host from a remote location.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Leviathan has used steganography to hide stolen data inside other files stored on Github.

Output: Technique=T1027.003: Steganography | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Most of the strings in ADVSTORESHELL are encrypted with an XOR-based algorithm; some strings are also encrypted with 3DES and reversed. API function names are also reversed, presumably to avoid detection in memory.

Output: Technique=T1027: Obfuscated Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: MobileOrder exfiltrates data to its C2 server over the same protocol as C2 communications.

Output: Technique=T1041: Exfiltration Over C2 Channel | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Gamaredon Group has incorporated dynamic DNS domains in its infrastructure.

Output: Technique=T1568: Dynamic Resolution | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Waterbear can query the Registry key <code>"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MSDTC\MTxOCI"</code> to see if the value `OracleOcilib` exists.

Output: Technique=T1012: Query Registry | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Scattered Spider has exfiltrated victim data to the MEGA file sharing site.

Output: Technique=T1567.002: Exfiltration to Cloud Storage | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: MURKYTOP has the capability to schedule remote AT jobs.

Output: Technique=T1053.002: At | Tactic=TA0002 ; TA0003 ; TA0004: Execution ; Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: WarzoneRAT can collect data from a compromised host.

Output: Technique=T1005: Data from Local System | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: menuPass has leveraged vulnerabilities in Pulse Secure VPNs to hijack sessions.

Output: Technique=T1190: Exploit Public-Facing Application | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: CURIUM has been linked to web shells following likely server compromise as an initial access vector into victim networks.

Output: Technique=T1505.003: Web Shell | Tactic=TA0003: Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cleaver has created customized tools and payloads for functions including ARP poisoning, encryption, credential dumping, ASP.NET shells, web backdoors, process enumeration, WMI querying, HTTP and SMB communications, network interface sniffing, and keystroke logging.

Output: Technique=T1587.001: Malware | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FIN13 has masqueraded staged data by using the Windows certutil utility to generate fake Base64 encoded certificates with the input file.

Output: Technique=T1036: Masquerading | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Avaddon looks for and attempts to stop database processes.

Output: Technique=T1489: Service Stop | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Orangeworm has copied its backdoor across open network shares, including ADMIN$, C$WINDOWS, D$WINDOWS, and E$WINDOWS.

Output: Technique=T1021.002: SMB/Windows Admin Shares | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During the 2022 Ukraine Electric Power Attack, Sandworm Team configured Systemd to maintain persistence of GOGETTER, specifying the `WantedBy=multi-user.target` configuration to run GOGETTER when the system begins accepting user logins.

Output: Technique=T1543.002: Systemd Service | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sandworm Team has used the BlackEnergy KillDisk component to corrupt the infected system's master boot record.

Output: Technique=T1561.002: Disk Structure Wipe | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ShimRat can be issued a command shell function from the C2.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cannon adds the Registry key HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon to establish persistence.

Output: Technique=T1547.004: Winlogon Helper DLL | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TEMP.Veles has used scheduled task XML triggers.

Output: Technique=T1053.005: Scheduled Task | Tactic=TA0002 ; TA0003 ; TA0004: Execution ; Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: EXOTIC LILY conducted an e-mail thread-hijacking campaign with malicious ISO attachments.

Output: Technique=T1566.001: Spearphishing Attachment | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: KGH_SPY has the ability to steal data from the Chrome, Edge, Firefox, Thunderbird, and Opera browsers.

Output: Technique=T1555.003: Credentials from Web Browsers | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: IcedID used the `ipconfig /all` command and a batch script to gather network information.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: CrackMapExec can brute force supplied user credentials across a network range.

Output: Technique=T1110: Brute Force | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Poseidon Group searches for administrator accounts on both the local victim machine and the network.

Output: Technique=T1087.001: Local Account | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Magic Hound has used KPortScan 3.0 to perform SMB, RDP, and LDAP scanning.

Output: Technique=T1046: Network Service Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Metamorfo's C2 communication has been encrypted using OpenSSL.

Output: Technique=T1573.002: Asymmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Chaes has collected system information, including the machine name and OS version.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Wingbird checks the victim OS version after executing to determine where to drop files based on whether the victim is 32-bit or 64-bit.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: OilRig has sent spearphising emails with malicious attachments to potential victims using compromised and/or spoofed email accounts.

Output: Technique=T1566.001: Spearphishing Attachment | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sandworm Team conducted technical reconnaissance of the Parliament of Georgia's official internet domain prior to its 2019 attack.

Output: Technique=T1590.001: Domain Properties | Tactic=TA0043: Reconnaissance


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During CostaRicto, the threat actors obtained open source tools to use in their operations.

Output: Technique=T1588.002: Tool | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Mis-Type has created registry keys for persistence, including `HKCU\Software\bkfouerioyou`, `HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{6afa8072-b2b1-31a8-b5c1-{Unique Identifier}`, and `HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{3BF41072-B2B1-31A8-B5C1-{Unique Identifier}`.

Output: Technique=T1547: Boot or Logon Autostart Execution | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PLAINTEE uses a custom UDP protocol to communicate.

Output: Technique=T1094: Custom Command and Control Protocol | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Mustang Panda has searched the entire target system for DOC, DOCX, PPT, PPTX, XLS, XLSX, and PDF files.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PoisonIvy creates a mutex using either a custom or default value.

Output: Technique=T1480.002: Mutual Exclusion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT29 has leveraged the Microsoft Graph API to perform various actions across Azure and M365 environments. They have also utilized AADInternals PowerShell Modules to access the API

Output: Technique=T1059.009: Cloud API | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SILENTTRINITY can enumerate and collect the properties of domain computers.

Output: Technique=T1018: Remote System Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Bandook is delivered via a malicious Word document inside a zip file.

Output: Technique=T1566.001: Spearphishing Attachment | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cuba has the ability to encrypt system data and add the ".cuba" extension to encrypted files.

Output: Technique=T1486: Data Encrypted for Impact | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Raspberry Robin variants have been delivered via malicious advertising items that, when interacted with, download a malicious archive file containing the initial payload, hosted on services such as Discord.

Output: Technique=T1583.008: Malvertising | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: UNC2452 changed domain federation trust settings using Azure AD administrative permissions to configure the domain to accept authorization tokens signed by their own SAML signing certificate.

Output: Technique=T1484.002: Trust Modification | Tactic=TA0005 ; TA0004: Defense Evasion ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Gazer uses custom encryption for C2 that uses 3DES.

Output: Technique=T1573.001: Symmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Micropsia searches for anti-virus software and firewall products installed on the victim’s machine using WMI.

Output: Technique=T1047: Windows Management Instrumentation | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Kimsuky has searched for information on the target company's website.

Output: Technique=T1594: Search Victim-Owned Websites | Tactic=TA0043: Reconnaissance


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Dragonfly dropped and executed SecretsDump, a tool that dumps password hashes.

Output: Technique=T1003: OS Credential Dumping | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Metamorfo has searched the compromised system for banking applications.

Output: Technique=T1518: Software Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Winter Vivern delivered malicious JavaScript payloads capable of exfiltrating email messages from exploited email servers.

Output: Technique=T1114.001: Local Email Collection | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Goopy has the ability to use a Microsoft Outlook backdoor macro to communicate with its C2.

Output: Technique=T1059.005: Visual Basic | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT32 has cleared select event log entries.

Output: Technique=T1107: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: OceanSalt uses Port Number 8080 for C2.

Output: Technique=T1043: Commonly Used Port | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: AcidRain identifies specific files and directories in the Linux operating system associated with storage devices.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: AADInternals can collect files from a user’s OneDrive.

Output: Technique=T1530: Data from Cloud Storage | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Axiom actors have been known to use the Sticky Keys replacement within RDP sessions to obtain persistence.

Output: Technique=T1546.008: Accessibility Features | Tactic=TA0004 ; TA0003: Privilege Escalation ; Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sandworm Team has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.

Output: Technique=T1204.001: Malicious Link | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Hildegard has packed ELF files into other binaries.

Output: Technique=T1027.002: Software Packing | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HELLOKITTY can use WMI to delete volume shadow copies.

Output: Technique=T1047: Windows Management Instrumentation | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cuckoo Stealer strings are deobfuscated prior to execution.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Maze has used the “Wow64RevertWow64FsRedirection” function following attempts to delete the shadow volumes, in order to leave the system in the same state as it was prior to redirection.

Output: Technique=T1070: Indicator Removal | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BlackCat can change the desktop wallpaper on compromised hosts.

Output: Technique=T1491.001: Internal Defacement | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ShimRat can use pre-configured HTTP proxies.

Output: Technique=T1090.002: External Proxy | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ZIRCONIUM has used AES encrypted communications in C2.

Output: Technique=T1573.001: Symmetric Cryptography | Tactic=TA0011: Command and Control