Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RCSession has the ability to use TCP and UDP in C2 communications.

Output: Technique=T1095: Non-Application Layer Protocol | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FIN13 can identify user accounts associated with a Service Principal Name and query Service Principal Names within the domain by utilizing the following scripts: `GetUserSPNs.vbs` and `querySpn.vbs`.

Output: Technique=T1087.002: Domain Account | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Malteiro collects the machine information, system architecture, the OS version, computer name, and Windows product name.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PUNCHTRACK aggregates collected data in a tmp file.

Output: Technique=T1074.001: Local Data Staging | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Kwampirs uses a large list of C2 servers that it cycles through until a successful connection is established.

Output: Technique=T1008: Fallback Channels | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Tropic Trooper used pr and an openly available tool to scan for open ports on target systems.

Output: Technique=T1046: Network Service Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Turla has used a AMSI bypass, which patches the in-memory amsi.dll, in PowerShell scripts to bypass Windows antimalware products.

Output: Technique=T1562.001: Disable or Modify Tools | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: AppleSeed can take screenshots on a compromised host by calling a series of APIs.

Output: Technique=T1113: Screen Capture | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sidewinder has lured targets to click on malicious files to gain execution in the target environment.

Output: Technique=T1204.002: Malicious File | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ThreatNeedle can be loaded into the Startup folder (`%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\OneDrives.lnk`) as a Shortcut file for persistence.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Blue Mockingbird has executed custom-compiled XMRIG miner DLLs by configuring them to execute via the "wercplsupport" service.

Output: Technique=T1569.002: Service Execution | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: QakBot can encrypt and pack malicious payloads.

Output: Technique=T1027.002: Software Packing | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Inception has encrypted network communications with AES.

Output: Technique=T1573.001: Symmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Xbash can obtain a webpage hosted on Pastebin to update its C2 domain list.

Output: Technique=T1102.001: Dead Drop Resolver | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BRONZE BUTLER has made use of Python-based remote access tools.

Output: Technique=T1059.006: Python | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PowerDuke has commands to get the current directory name as well as the size of a file. It also has commands to obtain information about logical drives, drive type, and free space.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BLUELIGHT can enumerate files and collect associated metadata.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: EXOTIC LILY has gained execution through victims clicking on malicious LNK files contained within ISO files, which can execute hidden DLLs within the ISO.

Output: Technique=T1204.002: Malicious File | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HiddenWasp installs reboot persistence by adding itself to <code>/etc/rc.local</code>.

Output: Technique=T1037.004: RC Scripts | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Indrik Spider has developed malware for their operations, including ransomware such as BitPaymer and WastedLocker.

Output: Technique=T1587.001: Malware | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Hildegard has modified /etc/ld.so.preload to intercept shared library import functions.

Output: Technique=T1574.006: Dynamic Linker Hijacking | Tactic=TA0003 ; TA0004 ; TA0005: Persistence ; Privilege Escalation ; Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BlackEnergy has removed the watermark associated with enabling the TESTSIGNING boot configuration option by removing the relevant strings in the user32.dll.mui of the system.

Output: Technique=T1070: Indicator Removal | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Pisloader uses cmd.exe to set the Registry Run key value. It also has a command to spawn a command shell.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Chimera has obtained and used tools such as BloodHound, Cobalt Strike, Mimikatz, and PsExec.

Output: Technique=T1588.002: Tool | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Elise executes net start after initial communication is made to the remote server.

Output: Technique=T1007: System Service Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Snip3 can decode its second-stage PowerShell script prior to execution.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Indrik Spider has accessed and exported passwords from password managers.

Output: Technique=T1555.005: Password Managers | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TINYTYPHON searches through the drive containing the OS, then all drive letters C through to Z, for documents matching certain extensions.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Carbon can use HTTP in C2 communications.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Machete had a module in its malware to find, encrypt, and upload files from fixed and removable drives.

Output: Technique=T1025: Data from Removable Media | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Gazer communicates with its C2 servers over HTTP.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HAWKBALL has sent HTTP GET requests over port 443 for C2.

Output: Technique=T1043: Commonly Used Port | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Mafalda can create a named pipe to listen for and send data to a named pipe-based C2 server.

Output: Technique=T1090.001: Internal Proxy | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ramsay can use ipconfig and Arp to collect network configuration information, including routing information and ARP tables.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Remexi obfuscates its configuration data with XOR.

Output: Technique=T1027.013: Encrypted/Encoded File | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ursnif has used encoded data in HTTP URLs for C2.

Output: Technique=T1132: Data Encoding | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Magic Hound has attempted to get users to execute malware via social media and spearphishing emails.

Output: Technique=T1204: User Execution | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Operation Wocao, threat actors used a Visual Basic script that checked for internet connectivity.

Output: Technique=T1016.001: Internet Connection Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Comnie executes BAT scripts.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Royal can delete shadow copy backups with vssadmin.exe using the command `delete shadows /all /quiet`.

Output: Technique=T1490: Inhibit System Recovery | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FIN6 has sent stolen payment card data to remote servers via HTTP POSTs.

Output: Technique=T1048.003: Exfiltration Over Unencrypted Non-C2 Protocol | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TeamTNT has used rootkits such as the open-source Diamorphine rootkit and their custom bots to hide cryptocurrency mining activities on the machine.

Output: Technique=T1014: Rootkit | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Elise configures itself as a service.

Output: Technique=T1543.003: Windows Service | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Pandora can communicate over HTTP.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RedLeaves can obtain information about network parameters.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Operation CuckooBees, the threat actors stroed payloads in Windows CLFS (Common Log File System) transactional logs.

Output: Technique=T1027.011: Fileless Storage | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FatDuke can get user agent strings for the default browser from HKCU\Software\Classes\http\shell\open\command.

Output: Technique=T1012: Query Registry | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: xCaon has added persistence via the Registry key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\load which causes the malware to run each time any user logs in.

Output: Technique=T1547: Boot or Logon Autostart Execution | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Bazar can fingerprint architecture, computer name, and OS version on the compromised host. Bazar can also check if the Russian language is installed on the infected machine and terminate if it is found.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Agrius attempted to acquire valid credentials for victim environments through various means to enable follow-on lateral movement.

Output: Technique=T1078.002: Domain Accounts | Tactic=TA0005 ; TA0003 ; TA0004 ; TA0001: Defense Evasion ; Persistence ; Privilege Escalation ; Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PlugX can be added as a service to establish persistence. PlugX also has a module to change service configurations as well as start, control, and delete services.

Output: Technique=T1543.003: Windows Service | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: The Cobalt Strike System Profiler can discover applications through the browser and identify the version of Java the target has.

Output: Technique=T1518: Software Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ProLock can encrypt files on a compromised host with RC6, and encrypts the key with RSA-1024.

Output: Technique=T1486: Data Encrypted for Impact | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT-C-36 obtained and used a modified variant of Imminent Monitor.

Output: Technique=T1588.002: Tool | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT39 has created scheduled tasks for persistence.

Output: Technique=T1053.005: Scheduled Task | Tactic=TA0002 ; TA0003 ; TA0004: Execution ; Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SharpStage has the ability to capture the victim's screen.

Output: Technique=T1113: Screen Capture | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Play has used the information stealer Grixba to check for a list of security processes.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HermeticWiper can disable pop-up information about folders and desktop items and delete Registry keys to hide malicious services.

Output: Technique=T1070: Indicator Removal | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Maze has injected the malware DLL into a target process.

Output: Technique=T1055.001: Dynamic-link Library Injection | Tactic=TA0005 ; TA0004: Defense Evasion ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: MoleNet can collect information about the about the system.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Once inside a Virtual Private Cloud, Pacu can attempt to identify DirectConnect, VPN, or VPC Peering.

Output: Technique=T1049: System Network Connections Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT28 has deployed a bootkit along with Downdelph to ensure its persistence on the victim. The bootkit shares code with some variants of BlackEnergy.

Output: Technique=T1542.003: Bootkit | Tactic=TA0003 ; TA0005: Persistence ; Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sardonic can use a WMI event filter to invoke a command-line event consumer to gain persistence.

Output: Technique=T1546.003: Windows Management Instrumentation Event Subscription | Tactic=TA0004 ; TA0003: Privilege Escalation ; Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ZeroT has retrieved stage 2 payloads as Bitmap images that use Least Significant Bit (LSB) steganography.

Output: Technique=T1001.002: Steganography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Operation Wocao, threat actors used scripts to detect security software.

Output: Technique=T1518.001: Security Software Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Exaramel for Linux has a hardcoded location that it uses to achieve persistence if the startup system is Upstart or System V and it is running as root.

Output: Technique=T1543: Create or Modify System Process | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: GOLD SOUTHFIELD has used publicly-accessible RDP and remote management and monitoring (RMM) servers to gain access to victim machines.

Output: Technique=T1133: External Remote Services | Tactic=TA0003 ; TA0001: Persistence ; Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FIN13 has used IISCrack.dll as a side-loading technique to load a malicious version of httpodbc.dll on old IIS Servers (CVE-2001-0507).

Output: Technique=T1574.002: DLL Side-Loading | Tactic=TA0003 ; TA0004 ; TA0005: Persistence ; Privilege Escalation ; Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Lokibot embedded the commands schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I inside a batch script.

Output: Technique=T1053.005: Scheduled Task | Tactic=TA0002 ; TA0003 ; TA0004: Execution ; Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: OSX_OCEANLOTUS.D uses a shell script as the main executable inside an app bundle and drops an embedded base64-encoded payload to the <code>/tmp</code> folder.

Output: Technique=T1059.004: Unix Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Anchor can determine the public IP and location of a compromised host.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Clop can use cmd.exe to help execute commands on the system.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Explosive has a function to download a file to the infected system.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TajMahal has the ability to identify the MAC address on an infected host.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Magic Hound has compromised email credentials in order to steal sensitive data.

Output: Technique=T1114: Email Collection | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FIN6 used RDP to move laterally in victim networks.

Output: Technique=T1021.001: Remote Desktop Protocol | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Latrodectus can use the Windows Component Object Model (COM) to set scheduled tasks.

Output: Technique=T1559.001: Component Object Model | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Operation Honeybee, the threat actors used Base64 to encode files with a custom key.

Output: Technique=T1027.013: Encrypted/Encoded File | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Operation CuckooBees, the threat actors used the `net time` command as part of their advanced reconnaissance.

Output: Technique=T1124: System Time Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: For Operation Honeybee, the threat actors used a Visual Basic script embedded within a Word document to download an implant.

Output: Technique=T1059.005: Visual Basic | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PUNCHBUGGY mimics filenames from %SYSTEM%\System32 to hide DLLs in %WINDIR% and/or %TEMP%.

Output: Technique=T1036.005: Match Legitimate Name or Location | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SysUpdate has named their unit configuration file similarly to other unit files residing in the same directory, `/usr/lib/systemd/system/`, to appear benign.

Output: Technique=T1036.004: Masquerade Task or Service | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Deep Panda has updated and modified its malware, resulting in different hash values that evade detection.

Output: Technique=T1027.005: Indicator Removal from Tools | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: KONNI has relied on a victim to enable malicious macros within an attachment delivered via email.

Output: Technique=T1204.002: Malicious File | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Kimsuky has used Google Chrome browser extensions to infect victims and to steal passwords and cookies.

Output: Technique=T1176: Browser Extensions | Tactic=TA0003: Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HotCroissant can retrieve a list of applications from the SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths registry key.

Output: Technique=T1518: Software Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BUSHWALK can modify the `DSUserAgentCap.pm` Perl module on Ivanti Connect Secure VPNs and either activate or deactivate depending on the value of the user agent in incoming HTTP requests.

Output: Technique=T1205: Traffic Signaling | Tactic=TA0005 ; TA0003 ; TA0011: Defense Evasion ; Persistence ; Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Hydraq creates new services to establish persistence.

Output: Technique=T1543.003: Windows Service | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: MuddyWater has stored a decoy PDF file within a victim's `%temp%` folder.

Output: Technique=T1074.001: Local Data Staging | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Inception has used decoy documents to load malicious remote payloads via HTTP.

Output: Technique=T1221: Template Injection | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PLEAD has been executed via malicious links in e-mails.

Output: Technique=T1204.001: Malicious Link | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cannon can collect the current time zone information from the victim’s machine.

Output: Technique=T1124: System Time Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FIN8 has deleted tmp and prefetch files during post compromise cleanup activities. FIN8 has also deleted PowerShell scripts to evade detection on compromised machines.

Output: Technique=T1070.004: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Bandook has used malicious VBA code against the target system.

Output: Technique=T1059.005: Visual Basic | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cinnamon Tempest has downloaded files, including Cobalt Strike, to compromised hosts.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ruler can be used to automate the abuse of Outlook Forms to establish persistence.

Output: Technique=T1137.003: Outlook Forms | Tactic=TA0003: Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PipeMon can iterate over the running processes to find a suitable injection target.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: LAPSUS$ has gained access to internet-facing systems and applications, including virtual private network (VPN), remote desktop protocol (RDP), and virtual desktop infrastructure (VDI) including Citrix.

Output: Technique=T1133: External Remote Services | Tactic=TA0003 ; TA0001: Persistence ; Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Spark has used HTTP POST requests to communicate with its C2 server to receive commands.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ZxShell can disable the firewall by modifying the registry key HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile.

Output: Technique=T1562.004: Disable or Modify System Firewall | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Silence has weaponized CHM files in their phishing campaigns.

Output: Technique=T1218.001: Compiled HTML File | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: QakBot can identify the user name on a compromised system.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Proton modifies the tty_tickets line in the sudoers file.

Output: Technique=T1548.003: Sudo and Sudo Caching | Tactic=TA0004 ; TA0005: Privilege Escalation ; Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Kazuar gathers information on local groups and members on the victim’s machine.

Output: Technique=T1087.001: Local Account | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Moonstone Sleet used intermediate loader malware such as YouieLoader and SplitLoader that create malicious services.

Output: Technique=T1569.002: Service Execution | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Dragonfly 2.0 identified and browsed file servers in the victim network, sometimes , viewing files pertaining to ICS or Supervisory Control and Data Acquisition (SCADA) systems.

Output: Technique=T1135: Network Share Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: A dropper used by Putter Panda installs itself into the ASEP Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run with a value named McUpdate.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Dragonfly has sent emails with malicious attachments to gain initial access.

Output: Technique=T1566.001: Spearphishing Attachment | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sliver can collect network connection information.

Output: Technique=T1049: System Network Connections Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cobalt Strike can perform browser pivoting and inject into a user's browser to inherit cookies, authenticated HTTP sessions, and client SSL certificates.

Output: Technique=T1185: Browser Session Hijacking | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: REvil has used obfuscated VBA macros for execution.

Output: Technique=T1059.005: Visual Basic | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Misdat network traffic is Base64-encoded plaintext.

Output: Technique=T1132.001: Standard Encoding | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Grandoreiro has the ability to use HTTP in C2 communications.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: OceanSalt can extract drive information from the endpoint and search files on the system.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ZIRCONIUM has used a tool to enumerate proxy settings in the target environment.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HOPLIGHT has been observed loading several APIs associated with Pass the Hash.

Output: Technique=T1550.002: Pass the Hash | Tactic=TA0005 ; TA0008: Defense Evasion ; Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT3 has been known to stage files for exfiltration in a single location.

Output: Technique=T1074.001: Local Data Staging | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Chrommme can enumerate the IP address of a compromised host.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Nightdoor stores network configuration data in a file XOR encoded with the key value of `0x7A`.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Stuxnet attempts to impersonate an anonymous token to enumerate bindings in the service control manager.

Output: Technique=T1134.001: Token Impersonation/Theft | Tactic=TA0005 ; TA0004: Defense Evasion ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: DarkTortilla can use a variety of API calls for persistence and defense evasion.

Output: Technique=T1106: Native API | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ZxShell can collect the local hostname, operating system details, CPU speed, and total physical memory.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ServHelper has used port 80 and 443 for C2.

Output: Technique=T1043: Commonly Used Port | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: NETWIRE has been executed through luring victims into opening malicious documents.

Output: Technique=T1204.002: Malicious File | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: WIRTE has named a first stage dropper `Kaspersky Update Agent` in order to appear legitimate.

Output: Technique=T1036.005: Match Legitimate Name or Location | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PowerDuke hides many of its backdoor payloads in an alternate data stream (ADS).

Output: Technique=T1564.004: NTFS File Attributes | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: esentutl can be used to read and write alternate data streams.

Output: Technique=T1564.004: NTFS File Attributes | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ToddyCat has used scheduled tasks to execute discovery commands and scripts for collection.

Output: Technique=T1053.005: Scheduled Task | Tactic=TA0002 ; TA0003 ; TA0004: Execution ; Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Zebrocy uses port 465 for C2.

Output: Technique=T1065: Uncommonly Used Port | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ursnif has used HTTP POSTs to exfil gathered information.

Output: Technique=T1041: Exfiltration Over C2 Channel | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: GALLIUM used reg commands to dump specific hives from the Windows Registry, such as the SAM hive, and obtain password hashes.

Output: Technique=T1003.002: Security Account Manager | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TinyZBot can install as a Windows service for persistence.

Output: Technique=T1543.003: Windows Service | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ZLib creates Registry keys to allow itself to run as various services.

Output: Technique=T1543.003: Windows Service | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Zebrocy's Delphi variant was packed with UPX.

Output: Technique=T1027.002: Software Packing | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Bazar has a variant with a packed payload.

Output: Technique=T1027.002: Software Packing | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: certutil can be used to download files from a given URL.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ROKRAT has been delivered via spearphishing emails that contain a malicious Hangul Office or Microsoft Word document.

Output: Technique=T1566.001: Spearphishing Attachment | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Dridex has used POST requests and HTTPS for C2 communications.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: DarkComet adds several Registry entries to enable automatic execution at every system startup.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RDAT has used DNS to communicate with the C2.

Output: Technique=T1071.004: DNS | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Naid creates a new service to establish.

Output: Technique=T1543.003: Windows Service | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: One variant of CloudDuke uses a Microsoft OneDrive account to exchange commands and stolen data with its operators.

Output: Technique=T1102.002: Bidirectional Communication | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Wizard Spider has leveraged ProtonMail email addresses in ransom notes when delivering Ryuk ransomware.

Output: Technique=T1585.002: Email Accounts | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ryuk has used the Windows command line to create a Registry entry under HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run to establish persistence.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Turla has compromised internal network systems to act as a proxy to forward traffic to C2.

Output: Technique=T1090.001: Internal Proxy | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: OilRig has used net group /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to find domain group permission settings.

Output: Technique=T1069.002: Domain Groups | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT41 sent spearphishing emails with attachments such as compiled HTML (.chm) files to initially compromise their victims.

Output: Technique=T1566.001: Spearphishing Attachment | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: InvisiMole can enumerate windows and child windows on a compromised host.

Output: Technique=T1010: Application Window Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: CHIMNEYSWEEP has included the victim's computer name and username in C2 messages sent to actor-owned infrastructure.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: A Helminth VBScript receives a batch script to execute a set of commands in a command prompt.

Output: Technique=T1119: Automated Collection | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: H1N1 has functionality to copy itself to network shares.

Output: Technique=T1080: Taint Shared Content | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Operation Wocao has enabled Wdigest by changing the registry value from 0 to 1.

Output: Technique=T1112: Modify Registry | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Gamaredon Group has tested connectivity between a compromised machine and a C2 server using Ping with commands such as `CSIDL_SYSTEM\cmd.exe /c ping -n 1`.

Output: Technique=T1016.001: Internet Connection Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: AppleSeed can achieve execution through users running malicious file attachments distributed via email.

Output: Technique=T1204.002: Malicious File | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Revenge RAT gathers the username from the system.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Emotet uses obfuscated URLs to download a ZIP file.

Output: Technique=T1027.013: Encrypted/Encoded File | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SLOWDRIFT collects and sends system information to its C2.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TA505 has deployed payloads that use Windows API calls on a compromised host.

Output: Technique=T1106: Native API | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Stolen Pencil sent spearphishing emails containing links to domains controlled by the threat actor.

Output: Technique=T1566.002: Spearphishing Link | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT32 has used the WindowStyle parameter to conceal PowerShell windows.

Output: Technique=T1564.003: Hidden Window | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: CharmPower has the ability to list running processes through the use of `tasklist`.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: MuddyWater has used CMSTP.exe and a malicious INF to execute its POWERSTATS payload.

Output: Technique=T1218.003: CMSTP | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Silence has used environment variable string substitution for obfuscation.

Output: Technique=T1027.010: Command Obfuscation | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: menuPass has used and modified open-source tools like Impacket, Mimikatz, and pwdump.

Output: Technique=T1588.002: Tool | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: WhisperGate can download and execute AdvancedRun.exe via `sc.exe`.

Output: Technique=T1569.002: Service Execution | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ZxxZ can collect the username from a compromised host.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BADNEWS creates a scheduled task to establish by executing a malicious payload every subsequent minute.

Output: Technique=T1053.005: Scheduled Task | Tactic=TA0002 ; TA0003 ; TA0004: Execution ; Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Chaes has used Base64 to encode C2 communications.

Output: Technique=T1132.001: Standard Encoding | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Exaramel uses RC4 for encrypting the configuration.

Output: Technique=T1027: Obfuscated Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Winnti for Linux has decoded XOR encoded strings holding its configuration upon execution.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: AppleSeed has the ability to create the Registry key name EstsoftAutoUpdate at HKCU\Software\Microsoft/Windows\CurrentVersion\RunOnce to establish persistence.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ThreatNeedle chooses its payload creation path from a randomly selected service name from netsvc.

Output: Technique=T1036.005: Match Legitimate Name or Location | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Attor's dispatcher can be executed as a service.

Output: Technique=T1569.002: Service Execution | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Empire can persist by modifying a .LNK file to include a backdoor.

Output: Technique=T1547.009: Shortcut Modification | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: NETEAGLE can use HTTP to download resources that contain an IP address and port number pair to connect to for C2.

Output: Technique=T1568: Dynamic Resolution | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Daggerfly used Reg to dump the Security Account Manager (SAM), System, and Security Windows registry hives from victim machines.

Output: Technique=T1012: Query Registry | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Royal can use SMB to connect to move laterally.

Output: Technique=T1021.002: SMB/Windows Admin Shares | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: QakBot can deobfuscate and re-assemble code strings for execution.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Kobalos can record the IP address of the target machine.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TinyTurla can set its configuration parameters in the Registry.

Output: Technique=T1112: Modify Registry | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Hikit can upload files from compromised machines.

Output: Technique=T1005: Data from Local System | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SharpStage has used a legitimate web service for evading detection.

Output: Technique=T1102: Web Service | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Kimsuky has used the Invoke-Mimikatz PowerShell script to reflectively load a Mimikatz credential stealing DLL into memory.

Output: Technique=T1620: Reflective Code Loading | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Frankenstein, the threat actors used WMI queries to check if various security applications were running as well as to determine the operating system version.

Output: Technique=T1047: Windows Management Instrumentation | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Drovorub can use a port forwarding rule on its agent module to relay network traffic through the client module to a remote host on the same network.

Output: Technique=T1090.001: Internal Proxy | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Bazar can inject code through calling VirtualAllocExNuma.

Output: Technique=T1055: Process Injection | Tactic=TA0005 ; TA0004: Defense Evasion ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: A variant of ADVSTORESHELL encrypts some C2 with RSA.

Output: Technique=T1573.002: Asymmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Out1 can copy files and Registry data from compromised hosts.

Output: Technique=T1005: Data from Local System | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Earth Lusca has performed watering hole attacks.

Output: Technique=T1189: Drive-by Compromise | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During the C0032 campaign, TEMP.Veles used timestomping to modify the <code>$STANDARD_INFORMATION</code> attribute on tools.

Output: Technique=T1070.006: Timestomp | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sidewinder has sent e-mails with malicious links to credential harvesting websites.

Output: Technique=T1598.003: Spearphishing Link | Tactic=TA0043: Reconnaissance


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SMOKEDHAM has added user accounts to local Admin groups.

Output: Technique=T1098.007: Additional Local or Domain Groups | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TeamTNT has obtained domains to host their payloads.

Output: Technique=T1583.001: Domains | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Turla surveys a system upon check-in to discover running services and associated processes using the tasklist /svc command.

Output: Technique=T1007: System Service Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: The DEADEYE.EMBED variant of DEADEYE can embed its payload in an alternate data stream of a local file.

Output: Technique=T1564.004: NTFS File Attributes | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Stolen Pencil utilized RDP for direct remote point-and-click access.

Output: Technique=T1021.001: Remote Desktop Protocol | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Flame can record audio using any existing hardware recording devices.

Output: Technique=T1123: Audio Capture | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: menuPass executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands. menuPass has used malicious macros embedded inside Office documents to execute files.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: menuPass has searched compromised systems for folders of interest including those related to HR, audit and expense, and meeting memos.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HEXANE has relied on victim's executing malicious file attachments delivered via email or embedded within actor-controlled websites to deliver malware.

Output: Technique=T1204.002: Malicious File | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RDAT can process steganographic images attached to email messages to send and receive C2 commands. RDAT can also embed additional messages within BMP images to communicate with the RDAT operator.

Output: Technique=T1001.002: Steganography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Lazarus Group has studied publicly available information about a targeted organization to tailor spearphishing efforts against specific departments and/or individuals.

Output: Technique=T1591: Gather Victim Org Information | Tactic=TA0043: Reconnaissance


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Kimsuky has used links in e-mail to steal account information including web beacons for target profiling.

Output: Technique=T1598.003: Spearphishing Link | Tactic=TA0043: Reconnaissance


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FinFisher extracts and decrypts stage 3 malware, which is stored in encrypted resources.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Gazer can establish persistence through the system screensaver by configuring it to execute the malware.

Output: Technique=T1546.002: Screensaver | Tactic=TA0004 ; TA0003: Privilege Escalation ; Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT29 has created self-signed digital certificates to enable mutual TLS authentication for malware.

Output: Technique=T1587.003: Digital Certificates | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cyclops Blink has maintained persistence by patching legitimate device firmware when it is downloaded, including that of WatchGuard devices.

Output: Technique=T1542.002: Component Firmware | Tactic=TA0003 ; TA0005: Persistence ; Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ember Bear has acquired malware and related tools from dark web forums.

Output: Technique=T1588.001: Malware | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SLOWPULSE can log credentials on compromised Pulse Secure VPNs during the `DSAuth::AceAuthServer::checkUsernamePassword`ACE-2FA authentication procedure.

Output: Technique=T1111: Multi-Factor Authentication Interception | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Woody RAT has been delivered via malicious Word documents and archive files.

Output: Technique=T1566.001: Spearphishing Attachment | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Bazar has been signed with fake certificates including those appearing to be from VB CORPORATE PTY. LTD.

Output: Technique=T1553.002: Code Signing | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During HomeLand Justice, threat actors executed the Advanced Port Scanner tool on compromised systems.

Output: Technique=T1046: Network Service Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TeamTNT has used SSH to connect back to victim machines. TeamTNT has also used SSH to transfer tools and payloads onto victim hosts and execute them.

Output: Technique=T1021.004: SSH | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: AsyncRAT can be configured to use dynamic DNS.

Output: Technique=T1568: Dynamic Resolution | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ZxShell hooks several API functions to spawn system threads.

Output: Technique=T1056.004: Credential API Hooking | Tactic=TA0009 ; TA0006: Collection ; Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Netwalker's DLL has been embedded within the PowerShell script in hex format.

Output: Technique=T1027.009: Embedded Payloads | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ZeroCleare has used a vulnerable signed VBoxDrv driver to bypass Microsoft Driver Signature Enforcement (DSE) protections and subsequently load the unsigned RawDisk driver.

Output: Technique=T1068: Exploitation for Privilege Escalation | Tactic=TA0004: Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Raccoon Stealer uses RC4 encryption for strings and command and control addresses to evade static detection.

Output: Technique=T1027.013: Encrypted/Encoded File | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Emotet has installed itself as a new service with the service name `Windows Defender System Service` and display name `WinDefService`.

Output: Technique=T1036.004: Masquerade Task or Service | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During C0015, the threat actors used a DLL named `D8B3.dll` that was injected into the Winlogon process.

Output: Technique=T1055.001: Dynamic-link Library Injection | Tactic=TA0005 ; TA0004: Defense Evasion ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.

Output: Technique=T1003.002: Security Account Manager | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cardinal RAT is downloaded using HTTP over port 443.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Diavol has used HTTP GET and POST requests for C2.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During the SolarWinds Compromise, APT29 used stolen cookies to access cloud resources and a forged `duo-sid` cookie to bypass MFA set on an email account.

Output: Technique=T1550.004: Web Session Cookie | Tactic=TA0005 ; TA0008: Defense Evasion ; Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Operation Dust Storm, the threat actors used Visual Basic scripts.

Output: Technique=T1059.005: Visual Basic | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Kobalos's authentication and key exchange is performed using RSA-512.

Output: Technique=T1573.002: Asymmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Operation CuckooBees, the threat actors used `dir c:\\` to search for files.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT28 has collected files from network shared drives.

Output: Technique=T1039: Data from Network Shared Drive | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Hancitor has been delivered via phishing emails with malicious attachments.

Output: Technique=T1566.001: Spearphishing Attachment | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SVCReady can communicate with its C2 servers via HTTP.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Turian has the ability to take screenshots.

Output: Technique=T1113: Screen Capture | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: NightClub can use multiple native APIs including `GetKeyState`, `GetForegroundWindow`, `GetWindowThreadProcessId`, and `GetKeyboardLayout`.

Output: Technique=T1106: Native API | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sandworm Team staged compromised versions of legitimate software installers on forums to achieve initial, untargetetd access in victim environments.

Output: Technique=T1195: Supply Chain Compromise | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During C0018, the threat actors opened a variety of ports, including ports 28035, 32467, 41578, and 46892, to establish RDP connections.

Output: Technique=T1571: Non-Standard Port | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: NETEAGLE can send process listings over the C2 channel.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FatDuke has the ability to create a process.

Output: Technique=T1543: Create or Modify System Process | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT28 sent spearphishing emails containing malicious Microsoft Office and RAR attachments.

Output: Technique=T1566.001: Spearphishing Attachment | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PowerShower has added a registry key so future powershell.exe instances are spawned off-screen by default, and has removed all registry entries that are left behind during the dropper process.

Output: Technique=T1112: Modify Registry | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: WhisperGate has the ability to inject its fourth stage into a suspended process created by the legitimate Windows utility `InstallUtil.exe`.

Output: Technique=T1055.012: Process Hollowing | Tactic=TA0005 ; TA0004: Defense Evasion ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ELMER is capable of performing process listings.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT33 has used HTTP for command and control.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Stuxnet attempts to access network resources with a domain account’s credentials.

Output: Technique=T1078.002: Domain Accounts | Tactic=TA0005 ; TA0003 ; TA0004 ; TA0001: Defense Evasion ; Persistence ; Privilege Escalation ; Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Mustang Panda has exploited CVE-2017-0199 in Microsoft Word to execute code.

Output: Technique=T1203: Exploitation for Client Execution | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: AdFind has the ability to query Active Directory for computers.

Output: Technique=T1018: Remote System Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: It is believed that a patch management system for an anti-virus product commonly installed among targeted companies was used to distribute the Wiper malware.

Output: Technique=T1072: Software Deployment Tools | Tactic=TA0002 ; TA0008: Execution ; Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Egregor can perform a long sleep (greater than or equal to 3 minutes) to evade detection.

Output: Technique=T1497.003: Time Based Evasion | Tactic=TA0005 ; TA0007: Defense Evasion ; Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Dragonfly has used batch scripts to enumerate users on a victim domain controller.

Output: Technique=T1087.002: Domain Account | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT37 uses steganography to send images to users that are embedded with shellcode.

Output: Technique=T1027.003: Steganography | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: QakBot has the ability to modify the Registry to add its binaries to the Windows Defender exclusion list.

Output: Technique=T1562.001: Disable or Modify Tools | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SDBbot has the ability to clean up and remove data structures from a compromised host.

Output: Technique=T1070: Indicator Removal | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT5 has used malware with keylogging capabilities to monitor the communications of targeted entities.

Output: Technique=T1056.001: Keylogging | Tactic=TA0009 ; TA0006: Collection ; Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Kimsuky has executed Windows commands by using `cmd` and running batch scripts.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Empire can be used to conduct packet captures on target hosts.

Output: Technique=T1040: Network Sniffing | Tactic=TA0006 ; TA0007: Credential Access ; Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Skidmap has created a fake rm binary to replace the legitimate Linux binary.

Output: Technique=T1036.005: Match Legitimate Name or Location | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: POWERSTATS uses PowerShell for obfuscation and execution.

Output: Technique=T1059.001: PowerShell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Okrum has used base64 to encode C2 communication.

Output: Technique=T1132.001: Standard Encoding | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Fox Kitten has used Volume Shadow Copy to access credential information from NTDS.

Output: Technique=T1003.003: NTDS | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Seasalt creates a Registry entry to ensure infection after reboot under HKLM\Software\Microsoft\Windows\currentVersion\Run.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Raccoon Stealer gathers information from repositories associated with cryptocurrency wallets and the Telegram messaging service.

Output: Technique=T1213: Data from Information Repositories | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: VersaMem deleted files related to initial installation such as temporary files related to the PID of the main web process.

Output: Technique=T1070.004: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sandworm Team has scanned network infrastructure for vulnerabilities as part of its operational planning.

Output: Technique=T1595.002: Vulnerability Scanning | Tactic=TA0043: Reconnaissance


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: KEYMARBLE has the capability to collect the computer name, language settings, the OS version, CPU information, disk devices, and time elapsed since system start.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: JHUHUGIT obtains a build identifier as well as victim hard drive information from Windows registry key HKLM\SYSTEM\CurrentControlSet\Services\Disk\Enum. Another JHUHUGIT variant gathers the victim storage volume serial number and the storage device name.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Metamorfo has used native WINAPI calls.

Output: Technique=T1106: Native API | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Metamorfo has a function that can watch the contents of the system clipboard for valid bitcoin addresses, which it then overwrites with the attacker's address.

Output: Technique=T1565.002: Transmitted Data Manipulation | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Bisonal has renamed malicious code to `msacm32.dll` to hide within a legitimate library; earlier versions were disguised as `winhelp`.

Output: Technique=T1036.005: Match Legitimate Name or Location | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Night Dragon, threat actors used a DLL that included an XOR-encoded section.

Output: Technique=T1027.013: Encrypted/Encoded File | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BRONZE BUTLER has incorporated code into several tools that attempts to terminate anti-virus processes.

Output: Technique=T1562.001: Disable or Modify Tools | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: DCSrv has a function to sleep for two hours before rebooting the system.

Output: Technique=T1529: System Shutdown/Reboot | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Lazarus Group has exfiltrated data and files over a C2 channel through its various tools and malware.

Output: Technique=T1041: Exfiltration Over C2 Channel | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT39 has used the post exploitation tool CrackMapExec to enumerate network shares.

Output: Technique=T1135: Network Share Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: OutSteel can identify running processes on a compromised host.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Lazarus Group has used VBScript to gather information about a victim machine.

Output: Technique=T1059.005: Visual Basic | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Winexe installs a service on the remote system, executes the command, then uninstalls the service.

Output: Technique=T1569.002: Service Execution | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cardinal RAT is downloaded using HTTP over port 443.

Output: Technique=T1043: Commonly Used Port | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Rancor has used cmd.exe to execute commmands.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HOMEFRY can perform credential dumping.

Output: Technique=T1003: OS Credential Dumping | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BITTER has exploited Microsoft Office vulnerabilities CVE-2012-0158, CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802.

Output: Technique=T1203: Exploitation for Client Execution | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BPFDoor uses BPF bytecode to attach a filter to a network socket to view ICMP, UDP, or TCP packets coming through ports 22 (ssh), 80 (http), and 443 (https). When BPFDoor finds a packet containing its “magic” bytes, it parses out two fields and forks itself. The parent process continues to monitor filtered traffic while the child process executes the instructions from the parsed fields.

Output: Technique=T1205.002: Socket Filters | Tactic=TA0005 ; TA0003 ; TA0011: Defense Evasion ; Persistence ; Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Attor's dispatcher can modify the Run registry key.

Output: Technique=T1112: Modify Registry | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Clambling has the ability to use TCP and UDP for communication.

Output: Technique=T1095: Non-Application Layer Protocol | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SILENTTRINITY can collect start time information from a compromised host.

Output: Technique=T1124: System Time Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Helminth has checked the local administrators group.

Output: Technique=T1069.001: Local Groups | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PipeMon can use parent PID spoofing to elevate privileges.

Output: Technique=T1134.004: Parent PID Spoofing | Tactic=TA0005 ; TA0004: Defense Evasion ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Uroburos can decrypt command parameters sent through C2 and use unpacking code to extract its packed executable.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HEXANE has used remote desktop sessions for lateral movement.

Output: Technique=T1021.001: Remote Desktop Protocol | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RTM has been delivered as archived Windows executable files masquerading as PDF documents.

Output: Technique=T1036: Masquerading | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Keydnap uses a Launch Agent to persist.

Output: Technique=T1159: Launch Agent | Tactic=TA0003: Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SUNBURST dynamically resolved C2 infrastructure for randomly-generated subdomains within a parent domain.

Output: Technique=T1568: Dynamic Resolution | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: MoonWind obtains the victim IP address.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Operation Wocao has deleted Windows Event Logs to hinder forensic investigation.

Output: Technique=T1070.001: Clear Windows Event Logs | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PACEMAKER can use PTRACE to attach to a targeted process to read process memory.

Output: Technique=T1055.008: Ptrace System Calls | Tactic=TA0005 ; TA0004: Defense Evasion ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: InvisiMole can obtain a list of running processes.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SLOTHFULMEDIA has created a service on victim machines named "TaskFrame" to establish persistence.

Output: Technique=T1543.003: Windows Service | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Small Sieve can obtain the IP address of a victim host.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT38 has used a custom secure delete function to make deleted files unrecoverable.

Output: Technique=T1485: Data Destruction | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: LAPSUS$ has gathered user identities and credentials to gain initial access to a victim's organization; the group has also called an organization's help desk to reset a target's credentials.

Output: Technique=T1589.001: Credentials | Tactic=TA0043: Reconnaissance


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: XTunnel has been used to execute remote commands.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: IPsec Helper exfiltrates specific files through its command and control framework.

Output: Technique=T1041: Exfiltration Over C2 Channel | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: yty runs ipconfig /all and collects the domain name.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: DUSTTRAP can exfiltrate collected data over C2 channels.

Output: Technique=T1041: Exfiltration Over C2 Channel | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Latrodectus has used multiple Windows API post exploitation including `GetAdaptersInfo`, `CreateToolhelp32Snapshot`, and `CreateProcessW`.

Output: Technique=T1106: Native API | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Moonstone Sleet used spearphishing messages containing items such as tracking pixels to determine if users interacted with malicious messages.

Output: Technique=T1598.003: Spearphishing Link | Tactic=TA0043: Reconnaissance


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: DEADWOOD opens and writes zeroes to the first 512 bytes of each drive, deleting the MBR. DEADWOOD then sends the control code IOCTL_DISK_DELETE_DRIVE_LAYOUT to ensure the MBR is removed from the drive.

Output: Technique=T1561.002: Disk Structure Wipe | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT32 has used malicious links to direct users to web pages designed to harvest credentials.

Output: Technique=T1598.003: Spearphishing Link | Tactic=TA0043: Reconnaissance


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Transparent Tribe has used dynamic DNS services to set up C2.

Output: Technique=T1568: Dynamic Resolution | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Frankenstein, the threat actors established persistence through a scheduled task using the command: `/Create /F /SC DAILY /ST 09:00 /TN WinUpdate /TR`, named "WinUpdate"

Output: Technique=T1053.005: Scheduled Task | Tactic=TA0002 ; TA0003 ; TA0004: Execution ; Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Mosquito stores configuration values under the Registry key HKCU\Software\Microsoft\[dllname].

Output: Technique=T1027.011: Fileless Storage | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FALLCHILL can delete malware and associated artifacts from the victim.

Output: Technique=T1070.004: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Woody RAT has suppressed all error reporting by calling `SetErrorMode` with 0x8007 as a parameter.

Output: Technique=T1562.006: Indicator Blocking | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Volgmer executes payloads using the Windows API call CreateProcessW().

Output: Technique=T1106: Native API | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FlawedAmmyy has collected information and files from a compromised machine.

Output: Technique=T1005: Data from Local System | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: LiteDuke can securely delete files by first writing random data to the file.

Output: Technique=T1070.004: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During C0015, the threat actors used `wmic` and `rundll32` to load Cobalt Strike onto a target host.

Output: Technique=T1047: Windows Management Instrumentation | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: LuminousMoth has obtained an ARP spoofing tool from GitHub.

Output: Technique=T1588.002: Tool | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT41 used scheduled tasks created via Group Policy Objects (GPOs) to deploy ransomware.

Output: Technique=T1484.001: Group Policy Modification | Tactic=TA0005 ; TA0004: Defense Evasion ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: KGH_SPY can enumerate files and directories on a compromised host.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Dragonfly has commonly created Web shells on victims' publicly accessible email and web servers, which they used to maintain access to a victim network and download additional malicious files.

Output: Technique=T1505.003: Web Shell | Tactic=TA0003: Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ADVSTORESHELL can enumerate registry keys.

Output: Technique=T1012: Query Registry | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: LoudMiner used plists to execute shell scripts and maintain persistence on boot. LoudMiner also added plist files in <code>/Library/LaunchDaemons</code> with KeepAlive set to true, which would restart the process if stopped.

Output: Technique=T1547.011: Plist Modification | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PoetRAT has added a registry key in the <RUN> hive for persistence.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Kessel can RC4-encrypt credentials before sending to the C2.

Output: Technique=T1560: Archive Collected Data | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: WarzoneRAT can add itself to the `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and `HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\UIF2IS20VK` Registry keys.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Frankenstein, the threat actors used Empire to enumerate hosts and gather username, machine name, and administrative permissions information.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: DarkVishnya created new services for shellcode loaders distribution.

Output: Technique=T1543.003: Windows Service | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Grandoreiro has infected victims via malicious attachments.

Output: Technique=T1204.002: Malicious File | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: CreepySnail can execute `getUsername` on compromised systems.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ZxShell has used HTTP for C2 connections.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Clop can encrypt files using AES, RSA, and RC4 and will add the ".clop" extension to encrypted files.

Output: Technique=T1486: Data Encrypted for Impact | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BOOTRASH has used unallocated disk space between partitions for a hidden file system that stores components of the Nemesis bootkit.

Output: Technique=T1564.005: Hidden File System | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Valak has the ability to identify the domain and the MAC and IP addresses of an infected machine.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BONDUPDATER uses a DGA to communicate with command and control servers.

Output: Technique=T1568.002: Domain Generation Algorithms | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: DarkWatchman can execute PowerShell commands and has used PowerShell to execute a keylogger.

Output: Technique=T1059.001: PowerShell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Dragonfly 2.0 created accounts on victims, including administrator accounts, some of which appeared to be tailored to each individual staging target.

Output: Technique=T1136.001: Local Account | Tactic=TA0003: Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BloodHound has the ability to map domain trusts and identify misconfigurations for potential abuse.

Output: Technique=T1482: Domain Trust Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Akira verifies the deletion of volume shadow copies by checking for the existence of the process ID related to the process created to delete these items.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: The Komplex trojan creates a persistent launch agent called with $HOME/Library/LaunchAgents/com.apple.updates.plist with launchctl load -w ~/Library/LaunchAgents/com.apple.updates.plist.

Output: Technique=T1543.001: Launch Agent | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Lazarus Group malware SierraCharlie uses RDP for propagation.

Output: Technique=T1021.001: Remote Desktop Protocol | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: CreepyDrive can use HTTPS for C2 using the Microsoft Graph API.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Akira encrypts victim filesystems for financial extortion purposes.

Output: Technique=T1486: Data Encrypted for Impact | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SHUTTERSPEED can collect system information.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Conficker uses the current UTC victim system date for domain generation and connects to time servers to determine the current date.

Output: Technique=T1124: System Time Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Stuxnet uses HTTP to communicate with a command and control server.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TinyTurla has mimicked an existing Windows service by being installed as Windows Time Service.

Output: Technique=T1036.004: Masquerade Task or Service | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Leafminer used Microsoft’s Sysinternals tools to gather detailed information about remote systems.

Output: Technique=T1018: Remote System Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ComRAT can check the victim's default browser to determine which process to inject its communications module into.

Output: Technique=T1518: Software Discovery | Tactic=TA0007: Discovery