Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During the 2015 Ukraine Electric Power Attack, Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Mongall has the ability to upload files from victim's machines.

Output: Technique=T1005: Data from Local System | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT3 has a tool that can detect the existence of remote systems.

Output: Technique=T1018: Remote System Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Akira uses legitimate utilities such as AnyDesk and PuTTy for maintaining remote access to victim environments.

Output: Technique=T1219: Remote Access Software | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Chimera has used HTTPS for C2 communications.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ember Bear has obtained and used open source scripts from GitHub.

Output: Technique=T1588.002: Tool | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: DarkGate relies on parent PID spoofing as part of its "rootkit-like" functionality to evade detection via Task Manager or Process Explorer.

Output: Technique=T1134.004: Parent PID Spoofing | Tactic=TA0005 ; TA0004: Defense Evasion ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TeamTNT has created local privileged users on victim machines.

Output: Technique=T1136.001: Local Account | Tactic=TA0003: Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ThiefQuest uses various API functions such as NSCreateObjectFileImageFromMemory to load and link in-memory payloads.

Output: Technique=T1620: Reflective Code Loading | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Dipsind encodes C2 traffic with base64.

Output: Technique=T1132.001: Standard Encoding | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FoggyWeb can configure custom listeners to passively monitor all incoming HTTP GET and POST requests sent to the AD FS server from the intranet/internet and intercept HTTP requests that match the custom URI patterns defined by the actor.

Output: Technique=T1040: Network Sniffing | Tactic=TA0006 ; TA0007: Credential Access ; Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Bisonal will delete its dropper and VBS scripts from the victim’s machine.

Output: Technique=T1070.004: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FunnyDream can stage collected information including screen captures and logged keystrokes locally.

Output: Technique=T1074.001: Local Data Staging | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT3 has used tools to compress data before exfilling it.

Output: Technique=T1560.001: Archive via Utility | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sibot checked if the compromised system is configured to use proxies.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Kwampirs downloads additional files from C2 servers.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BlackCat can determine if a user on a compromised host has domain admin privileges.

Output: Technique=T1069.002: Domain Groups | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sardonic has the ability to connect with actor-controlled C2 servers using a custom binary protocol over port 443.

Output: Technique=T1571: Non-Standard Port | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Operation CuckooBees, the threat actors leveraged a custom tool to dump OS credentials and used following commands: `reg save HKLM\\SYSTEM system.hiv`, `reg save HKLM\\SAM sam.hiv`, and `reg save HKLM\\SECURITY security.hiv`, to dump SAM, SYSTEM and SECURITY hives.

Output: Technique=T1003.002: Security Account Manager | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TajMahal has the ability to send collected files over its C2.

Output: Technique=T1041: Exfiltration Over C2 Channel | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Hi-Zor encrypts C2 traffic with TLS.

Output: Technique=T1573.002: Asymmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Operation Dream Job, Lazarus Group used PowerShell commands to explore the environment of compromised victims.

Output: Technique=T1059.001: PowerShell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Dragonfly has performed screen captures of victims.

Output: Technique=T1113: Screen Capture | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ConnectWise can take screenshots on remote hosts.

Output: Technique=T1113: Screen Capture | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Metamorfo has written process names to the Registry, disabled IE browser features, deleted Registry keys, and changed the ExtendedUIHoverTime key.

Output: Technique=T1112: Modify Registry | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During the 2022 Ukraine Electric Power Attack, Sandworm Team used a Group Policy Object (GPO) to copy CaddyWiper's executable `msserver.exe` from a staging server to a local hard drive before deployment.

Output: Technique=T1570: Lateral Tool Transfer | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HAWKBALL has downloaded additional files from the C2.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Clop can use msiexec.exe to disable security tools on the system.

Output: Technique=T1218.007: Msiexec | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Turla has obtained information on security software, including security logging information that may indicate whether their malware has been detected.

Output: Technique=T1518.001: Security Software Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Upon execution Spica can decode an embedded .pdf and write it to the desktop as a decoy document.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Crimson can determine when it has been installed on a host for at least 15 days before downloading the final payload.

Output: Technique=T1497.003: Time Based Evasion | Tactic=TA0005 ; TA0007: Defense Evasion ; Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: InvisiMole has used a custom implementation of DNS tunneling to embed C2 communications in DNS requests and replies.

Output: Technique=T1071.004: DNS | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RTM has used an RSS feed on Livejournal to update a list of encrypted C2 server names. RTM has also hidden Pony C2 server IP addresses within transactions on the Bitcoin and Namecoin blockchain.

Output: Technique=T1102.001: Dead Drop Resolver | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.

Output: Technique=T1070.006: Timestomp | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PowerLess can stage stolen browser data in `C:\\Windows\\Temp\\cup.tmp` and keylogger data in `C:\\Windows\\Temp\\Report.06E17A5A-7325-4325-8E5D-E172EBA7FC5BK`.

Output: Technique=T1074.001: Local Data Staging | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Silent Librarian has used collected lists of names and e-mail accounts to use in password spraying attacks against private sector targets.

Output: Technique=T1110.003: Password Spraying | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PcShare has been encrypted with XOR using different 32-long Base16 strings and compressed with LZW algorithm.

Output: Technique=T1027.013: Encrypted/Encoded File | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HEXANE has used password spraying attacks to obtain valid credentials.

Output: Technique=T1110.003: Password Spraying | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: For C0010, UNC3890 actors staged malware on their infrastructure for direct download onto a compromised system.

Output: Technique=T1608.001: Upload Malware | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During C0017, APT41 copied the local `SAM` and `SYSTEM` Registry hives to a staging directory.

Output: Technique=T1074.001: Local Data Staging | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Operation Wocao, threat actors used their own web shells, as well as those previously placed on target systems by other threat actors, for reconnaissance and lateral movement.

Output: Technique=T1505.003: Web Shell | Tactic=TA0003: Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: down_new has the ability to detect anti-virus products and processes on a compromised host.

Output: Technique=T1518.001: Security Software Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Black Basta has set the desktop wallpaper on victims' machines to display a ransom note.

Output: Technique=T1491.001: Internal Defacement | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Kimsuky has checked for the presence of antivirus software with powershell Get-CimInstance -Namespace root/securityCenter2 – classname antivirusproduct.

Output: Technique=T1518.001: Security Software Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Pteranodon exfiltrates screenshot files to its C2 server.

Output: Technique=T1041: Exfiltration Over C2 Channel | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Inception has used PowerShell to execute malicious commands and payloads.

Output: Technique=T1059.001: PowerShell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sowbug has used keylogging tools.

Output: Technique=T1056.001: Keylogging | Tactic=TA0009 ; TA0006: Collection ; Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PoetRAT has the ability to overwrite scripts and delete itself if a sandbox environment is detected.

Output: Technique=T1070.004: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Exaramel for Windows specifies a path to store files scheduled for exfiltration.

Output: Technique=T1074.001: Local Data Staging | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: njRAT uses Base64 encoding for C2 traffic.

Output: Technique=T1132.001: Standard Encoding | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: MegaCortex can parse the available drives and directories to determine which files to encrypt.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During C0015, the threat actors obtained files and data from the compromised network.

Output: Technique=T1005: Data from Local System | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During C0021, the threat actors sent phishing emails with unique malicious links, likely for tracking victim clicks.

Output: Technique=T1566.002: Spearphishing Link | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: menuPass has used a script (atexec.py) to execute a command on a target machine via Task Scheduler.

Output: Technique=T1053.005: Scheduled Task | Tactic=TA0002 ; TA0003 ; TA0004: Execution ; Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HELLOKITTY can enumerate logical drives on a target system.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BLUELIGHT has captured a screenshot of the display every 30 seconds for the first 5 minutes after initiating a C2 loop, and then once every five minutes thereafter.

Output: Technique=T1113: Screen Capture | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During HomeLand Justice, threat actors added the `ApplicationImpersonation` management role to accounts under their control to impersonate users and take ownership of targeted mailboxes.

Output: Technique=T1098.002: Additional Email Delegate Permissions | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: GrimAgent can use a hardcoded server public RSA key to encrypt the first request to C2.

Output: Technique=T1573.002: Asymmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: T9000 gathers and beacons the system time during installation.

Output: Technique=T1124: System Time Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Bundlore can use AppleScript to inject malicious JavaScript into a browser.

Output: Technique=T1059.002: AppleScript | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: After encrypting C2 data, BADNEWS converts it into a hexadecimal representation and then encodes it into base64.

Output: Technique=T1132: Data Encoding | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Babuk can use “WNetOpenEnumW” and “WNetEnumResourceW” to enumerate files in network resources for encryption.

Output: Technique=T1049: System Network Connections Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Netwalker can add the following registry entry: HKEY_CURRENT_USER\SOFTWARE\{8 random characters}.

Output: Technique=T1112: Modify Registry | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Power Loader overwrites Explorer’s Shell_TrayWnd extra window memory to redirect execution to a NTDLL function that is abused to assemble and execute a return-oriented programming (ROP) chain and create a malicious thread within Explorer.exe.

Output: Technique=T1055.011: Extra Window Memory Injection | Tactic=TA0005 ; TA0004: Defense Evasion ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Comnie encrypts command and control communications with RC4.

Output: Technique=T1573.001: Symmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: WellMess can execute command line scripts received from C2.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: menuPass has used a modified version of pentesting script wmiexec.vbs, which logs into a remote machine using WMI.

Output: Technique=T1047: Windows Management Instrumentation | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FIN7 used SQL scripts to help perform tasks on the victim's machine.

Output: Technique=T1059: Command and Scripting Interpreter | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Anchor has used ICMP in C2 communications.

Output: Technique=T1095: Non-Application Layer Protocol | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Lazarus Group malware IndiaIndia obtains and sends to its C2 server information about the first network interface card’s configuration, including IP address, gateways, subnet mask, DHCP information, and whether WINS is available.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: OilRig has used PowerShell scripts for execution, including use of a macro to run a PowerShell command to decode file contents.

Output: Technique=T1059.001: PowerShell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Rocke has used uname -m to collect the name and information about the infected system's kernel.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Operation Wocao, threat actors used Impacket's smbexec.py as well as accessing the C$ and IPC$ shares to move laterally.

Output: Technique=T1021.002: SMB/Windows Admin Shares | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Janicab captured screenshots and sent them out to a C2 server.

Output: Technique=T1113: Screen Capture | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PinchDuke steals credentials from compromised hosts. PinchDuke's credential stealing functionality is believed to be based on the source code of the Pinch credential stealing malware (also known as LdPinch). Credentials targeted by PinchDuke include ones associated many sources such as WinInet Credential Cache, and Lightweight Directory Access Protocol (LDAP).

Output: Technique=T1003: OS Credential Dumping | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SpeakUp uses the cat /proc/cpuinfo | grep -c “cpu family” 2>&1 command to gather system information.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cobalt Strike can install a new service.

Output: Technique=T1543.003: Windows Service | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT18 obfuscates strings in the payload.

Output: Technique=T1027.013: Encrypted/Encoded File | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: LightNeuron has used AES and XOR to decrypt configuration files and commands.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Operation Wocao has collected a list of open connections on the infected system using netstat and checks whether it has an internet connection.

Output: Technique=T1049: System Network Connections Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT28 has used legitimate credentials to gain initial access, maintain access, and exfiltrate data from a victim network. The group has specifically used credentials stolen through a spearphishing email to login to the DCCC network. The group has also leveraged default manufacturer's passwords to gain initial access to corporate networks via IoT devices such as a VOIP phone, printer, and video decoder.

Output: Technique=T1078: Valid Accounts | Tactic=TA0005 ; TA0003 ; TA0004 ; TA0001: Defense Evasion ; Persistence ; Privilege Escalation ; Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: S-Type may create a .lnk file to itself that is saved in the Start menu folder. It may also create the Registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ IMJPMIJ8.1{3 characters of Unique Identifier}.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: WEBC2 can download and execute a file.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: down_new has the ability to identify the system volume information of a compromised host.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Clambling has the ability to enumerate Registry keys, including KEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt\strDataDir to search for a bitcoin wallet.

Output: Technique=T1012: Query Registry | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: QakBot can use net share to identify network shares for use in lateral movement.

Output: Technique=T1135: Network Share Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Versa Director Zero Day Exploitation used a non-standard TCP session to initialize communication prior to establishing HTTPS command and control.

Output: Technique=T1095: Non-Application Layer Protocol | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PipeMon can decrypt password-protected executables.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PoisonIvy creates a backdoor through which remote attackers can open a command-line interface.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Gamaredon Group has registered multiple domains to facilitate payload staging and C2.

Output: Technique=T1583.001: Domains | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: zwShell can launch command-line shells.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Smoke Loader downloads a new version of itself once it has installed. It also downloads additional plugins.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT32 used Net to use Windows' hidden network shares to copy their tools to remote machines for execution.

Output: Technique=T1021.002: SMB/Windows Admin Shares | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Chaes has collected the username and UID from the infected machine.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PULSECHECK can check HTTP request headers for a specific backdoor key and if found will output the result of the command in the variable `HTTP_X_CMD.`

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BADNEWS has a command to take a screenshot and send it to the C2 server.

Output: Technique=T1113: Screen Capture | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Grandoreiro can use SSL in C2 communication.

Output: Technique=T1573.002: Asymmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Turla has used spearphishing emails to deliver BrainTest as a malicious attachment.

Output: Technique=T1566.001: Spearphishing Attachment | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cobalt Strike can query HKEY_CURRENT_USER\Software\Microsoft\Office\<Excel Version>\Excel\Security\AccessVBOM\ to determine if the security setting for restricting default programmatic access is enabled.

Output: Technique=T1012: Query Registry | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: MechaFlounder uses a python-based payload.

Output: Technique=T1059.006: Python | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SharpStage can use WMI for execution.

Output: Technique=T1047: Windows Management Instrumentation | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Cutting Edge, threat actors used multiple web shells to maintain presence on compromised Connect Secure appliances such as WIREFIRE, GLASSTOKEN, BUSHWALK, LIGHTWIRE, and FRAMESTING.

Output: Technique=T1505.003: Web Shell | Tactic=TA0003: Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Saint Bot has been distributed as malicious attachments within spearphishing emails.

Output: Technique=T1566.001: Spearphishing Attachment | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Raspberry Robin will execute a legitimate process, then suspend it to inject code for a Tor client into the process, followed by resumption of the process to enable Tor client execution.

Output: Technique=T1055.012: Process Hollowing | Tactic=TA0005 ; TA0004: Defense Evasion ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: WINERACK can gather information on the victim username.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ninja has the ability to enumerate directory content.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Honeybee adds collected files to a temp.zip file saved in the %temp% folder, then base64 encodes it and uploads it to control server.

Output: Technique=T1022: Data Encrypted | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: After creating a new service for persistence, TDTESS sets the file creation time for the service to the creation time of the victim's legitimate svchost.exe file.

Output: Technique=T1070.006: Timestomp | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Operation Wocao, threat actors proxied traffic through multiple infected systems.

Output: Technique=T1090.001: Internal Proxy | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HermeticWizard can copy files to other machines on a compromised network.

Output: Technique=T1570: Lateral Tool Transfer | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Molerats used executables to download malicious files from different sources.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: The initial beacon packet for Mis-Type contains the operating system version and file system of the victim.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: WhisperGate has the ability to enumerate fixed logical drives on a targeted system.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Operation Dream Job, Lazarus Group digitally signed their own malware to evade detection.

Output: Technique=T1553.002: Code Signing | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: NativeZone has checked if Vmware or VirtualBox VM is running on a compromised host.

Output: Technique=T1497.001: System Checks | Tactic=TA0005 ; TA0007: Defense Evasion ; Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Neoichor can upload files from a victim's machine.

Output: Technique=T1005: Data from Local System | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: InnaputRAT has a command to delete files.

Output: Technique=T1070.004: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT5 has used PowerShell to accomplish tasks within targeted environments.

Output: Technique=T1059.001: PowerShell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PingPull can collect data from a compromised host.

Output: Technique=T1005: Data from Local System | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: The CozyCar dropper copies the system file rundll32.exe to the install location for the malware, then uses the copy of rundll32.exe to load and execute the main CozyCar component.

Output: Technique=T1218.011: Rundll32 | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SUNBURST had commands to enumerate files and directories.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT18 can collect system information from the victim’s machine.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Mis-Type has temporarily stored collected information to the files `“%AppData%\{Unique Identifier}\HOSTRURKLSR”` and `“%AppData%\{Unique Identifier}\NEWERSSEMP”`.

Output: Technique=T1074.001: Local Data Staging | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: VPNFilter has the capability to wipe a portion of an infected device's firmware.

Output: Technique=T1561.001: Disk Content Wipe | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ragnar Locker can delete volume shadow copies using vssadmin delete shadows /all /quiet.

Output: Technique=T1490: Inhibit System Recovery | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Operation Wocao, threat actors used PowerSploit's `Invoke-Kerberoast` module to request encrypted service tickets and bruteforce the passwords of Windows service accounts offline.

Output: Technique=T1558.003: Kerberoasting | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: InvisiMole has installed legitimate but vulnerable Total Video Player software and wdigest.dll library drivers on compromised hosts to exploit stack overflow and input validation vulnerabilities for code execution.

Output: Technique=T1203: Exploitation for Client Execution | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Carbon uses HTTP to send data to the C2 server.

Output: Technique=T1048.003: Exfiltration Over Unencrypted Non-C2 Protocol | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Tropic Trooper has used JPG files with encrypted payloads to mask their backdoor routines and evade detection.

Output: Technique=T1027.003: Steganography | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: UPPERCUT has the capability to gather the victim's proxy information.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Valak has the ability to take screenshots on a compromised host.

Output: Technique=T1113: Screen Capture | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HOPLIGHT has been observed collecting system time from victim machines.

Output: Technique=T1124: System Time Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: LookBack can list running processes.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: P.A.S. Webshell can use a decryption mechanism to process a user supplied password and allow execution.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SDBbot has the ability to record video on a compromised host.

Output: Technique=T1125: Video Capture | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT28 has been known to specifically look for Firefox passwords on the file system

Output: Technique=T1081: Credentials in Files | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Wizard Spider has obtained code signing certificates signed by DigiCert, GlobalSign, and COMOOD for malware payloads.

Output: Technique=T1588.003: Code Signing Certificates | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TA578 has filled out contact forms on victims' websites to direct them to adversary-controlled URLs.

Output: Technique=T1594: Search Victim-Owned Websites | Tactic=TA0043: Reconnaissance


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: UNC2452 exploited CVE-2020-0688 against the Microsoft Exchange Control Panel to regain access to a network.

Output: Technique=T1190: Exploit Public-Facing Application | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: STARWHALE can gather the username from an infected host.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Agent Tesla exploits CVE-2017-11882 in Microsoft’s Equation Editor to execute a process.

Output: Technique=T1203: Exploitation for Client Execution | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: OilRig has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning.

Output: Technique=T1046: Network Service Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ANDROMEDA has the ability to make GET requests to download files from C2.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TeamTNT has created system services to execute cryptocurrency mining software.

Output: Technique=T1569: System Services | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Valak has the ability to store information regarding the C2 server and downloads in the Registry key HKCU\Software\ApplicationContainer\Appsw64.

Output: Technique=T1027.011: Fileless Storage | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: DarkGate can masquerade as pirated media content for initial delivery to victims.

Output: Technique=T1036: Masquerading | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SideCopy has identified the country location of a compromised host.

Output: Technique=T1614: System Location Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT37 executes shellcode and a VBA script to decode Base64 strings.

Output: Technique=T1059.005: Visual Basic | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cobalt Group has sent malicious Word OLE compound documents to victims.

Output: Technique=T1559.002: Dynamic Data Exchange | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Kimsuky has used a file injector DLL to spawn a benign process on the victim's system and inject the malicious payload into it via process hollowing.

Output: Technique=T1055.012: Process Hollowing | Tactic=TA0005 ; TA0004: Defense Evasion ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: YAHOYAH uses HTTP for C2.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During HomeLand Justice, threat actors initiated a process named Mellona.exe to spread the ROADSWEEP file encryptor and a persistence script to a list of internal machines.

Output: Technique=T1570: Lateral Tool Transfer | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Mivast has the capability to open a remote shell and run basic commands.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Operation CuckooBees, the threat actors used the `net user` command to gather account information.

Output: Technique=T1087.001: Local Account | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TeamTNT has disguised their scripts with docker-related file names.

Output: Technique=T1036: Masquerading | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: OSInfo enumerates local and domain users

Output: Technique=T1087.001: Local Account | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Calisto uses the zip -r command to compress the data collected on the local system.

Output: Technique=T1560.001: Archive via Utility | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Peppy can use HTTP to communicate with C2.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FunnyDream can connect to HTTP proxies via TCP to create a tunnel to C2.

Output: Technique=T1572: Protocol Tunneling | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HOPLIGHT can use WMI event subscriptions to create persistence.

Output: Technique=T1546.003: Windows Management Instrumentation Event Subscription | Tactic=TA0004 ; TA0003: Privilege Escalation ; Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HermeticWiper has the ability to receive a command parameter to sleep prior to carrying out destructive actions on a targeted host.

Output: Technique=T1497.003: Time Based Evasion | Tactic=TA0005 ; TA0007: Defense Evasion ; Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: AppleJeus has required user execution of a malicious MSI installer.

Output: Technique=T1204.002: Malicious File | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FIN6 has renamed the "psexec" service name to "mstdc" to masquerade as a legitimate Windows service.

Output: Technique=T1036.004: Masquerade Task or Service | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Saint Bear has, in addition to email-based phishing attachments, used malicious websites masquerading as legitimate entities to host links to malicious files for user execution.

Output: Technique=T1204.001: Malicious Link | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Wingbird side loads a malicious file, sspisrv.dll, in part of a spoofed lssas.exe service.

Output: Technique=T1574.002: DLL Side-Loading | Tactic=TA0003 ; TA0004 ; TA0005: Persistence ; Privilege Escalation ; Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: StrongPity can download files to specified targets.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT28 has used CVE-2015-4902 to bypass security features.

Output: Technique=T1211: Exploitation for Defense Evasion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Chimera has used net user for account discovery.

Output: Technique=T1087.001: Local Account | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Skidmap has checked for the existence of specific files including /usr/sbin/setenforce and  /etc/selinux/config. It also has the ability to monitor the cryptocurrency miner file and process.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During the SolarWinds Compromise, APT29 obtained information about the configured Exchange virtual directory using `Get-WebServicesVirtualDirectory`.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: InnaputRAT launches a shell to execute commands on the victim’s machine.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: QakBot has been delivered in ZIP files via HTML smuggling.

Output: Technique=T1027.006: HTML Smuggling | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Aria-body has the ability to gather metadata from a file and to search for file and directory names.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FIN6 has targeted victims with e-mails containing malicious attachments.

Output: Technique=T1566.001: Spearphishing Attachment | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Koadic can open an interactive command-shell to perform command line functions on victim machines. Koadic performs most of its operations using Windows Script Host (Jscript) and to run arbitrary shellcode.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Gelsemium has named malicious binaries `serv.exe`, `winprint.dll`, and `chrome_elf.dll` and has set its persistence in the Registry with the key value Chrome Update to appear legitimate.

Output: Technique=T1036.005: Match Legitimate Name or Location | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Bandook has used PowerShell loaders as part of execution.

Output: Technique=T1059.001: PowerShell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TeamTNT has used a script that decodes a Base64-encoded version of WeaveWorks Scope.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: CURIUM used malicious links to adversary-controlled resources for credential harvesting.

Output: Technique=T1598.003: Spearphishing Link | Tactic=TA0043: Reconnaissance


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Andariel has conducted spearphishing campaigns that included malicious Word or Excel attachments.

Output: Technique=T1566.001: Spearphishing Attachment | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Rundll32.exe is used as a way of executing Flame at the command-line.

Output: Technique=T1218.011: Rundll32 | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Lazarus Group has used fake job advertisements sent via LinkedIn to spearphish victims.

Output: Technique=T1566.003: Spearphishing via Service | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PowerSploit has modules such as Get-NetDomainTrust and Get-NetForestTrust to enumerate domain and forest trusts.

Output: Technique=T1482: Domain Trust Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cuba can query service status using QueryServiceStatusEx function.

Output: Technique=T1007: System Service Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HAFNIUM has checked for network connectivity from a compromised host using `ping`, including attempts to contact `google[.]com`.

Output: Technique=T1016.001: Internet Connection Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SVCReady can create a scheduled task named `RecoveryExTask` to gain persistence.

Output: Technique=T1053.005: Scheduled Task | Tactic=TA0002 ; TA0003 ; TA0004: Execution ; Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Stuxnet enumerates user accounts of the domain.

Output: Technique=T1087.002: Domain Account | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: The TAINTEDSCRIBE main executable has disguised itself as Microsoft’s Narrator.

Output: Technique=T1036.005: Match Legitimate Name or Location | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Smoke Loader adds a Visual Basic script in the Startup folder to deploy the payload.

Output: Technique=T1059.005: Visual Basic | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Frankenstein has used MSbuild to execute an actor-created file.

Output: Technique=T1127.001: MSBuild | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Waterbear can hook the ZwOpenProcess and GetExtendedTcpTable APIs called by the process of a security product to hide PIDs and TCP records from detection.

Output: Technique=T1562.006: Indicator Blocking | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: QUADAGENT uses cmd.exe to execute scripts and commands on the victim’s machine.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SILENTTRINITY can take a screenshot of the current desktop.

Output: Technique=T1113: Screen Capture | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During the SolarWinds Compromise, APT29 modified timestamps of backdoors to match legitimate Windows files.

Output: Technique=T1070.006: Timestomp | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Emotet has reflectively loaded payloads into memory.

Output: Technique=T1620: Reflective Code Loading | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: EnvyScout can call window.location.pathname to ensure that embedded files are being executed from the C: drive, and will terminate if they are not.

Output: Technique=T1480: Execution Guardrails | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Empire can utilize Invoke-DCOM to leverage remote COM execution for lateral movement.

Output: Technique=T1021.003: Distributed Component Object Model | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sandworm Team's CredRaptor tool can collect saved passwords from various internet browsers.

Output: Technique=T1555.003: Credentials from Web Browsers | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: The QakBot payload has been disguised as a PNG file and hidden within LNK files using a Microsoft File Explorer icon.

Output: Technique=T1036.008: Masquerade File Type | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Winnti for Linux can encode its configuration file with single-byte XOR encoding.

Output: Technique=T1027.013: Encrypted/Encoded File | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: gh0st RAT is able to open a remote shell to execute commands.

Output: Technique=T1059: Command and Scripting Interpreter | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Cutting Edge, threat actors modified the JavaScript loaded by the Ivanti Connect Secure login page to capture credentials entered.

Output: Technique=T1056.003: Web Portal Capture | Tactic=TA0009 ; TA0006: Collection ; Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FoggyWeb can allow abuse of a compromised AD FS server's SAML token.

Output: Technique=T1550: Use Alternate Authentication Material | Tactic=TA0005 ; TA0008: Defense Evasion ; Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BLINDINGCAN can search, read, write, move, and execute files.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TrickBot collects local files and information from the victim’s local machine.

Output: Technique=T1005: Data from Local System | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cuba has a packed payload when delivered.

Output: Technique=T1027.002: Software Packing | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Melcoz has the ability to download additional files to a compromised host.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: captures window titles.

Output: Technique=T1010: Application Window Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: DownPaper collects the victim host name and serial number, and then sends the information to the C2 server.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Bankshot exfiltrates data over its C2 channel.

Output: Technique=T1041: Exfiltration Over C2 Channel | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Grandoreiro can use run keys and create link files in the startup folder for persistence.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: China Chopper's client component is packed with UPX.

Output: Technique=T1027.002: Software Packing | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During FunnyDream, the threat actors used ipconfig for discovery on remote systems.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: EXOTIC LILY has used malicious documents containing exploits for CVE-2021-40444 affecting Microsoft MSHTML.

Output: Technique=T1203: Exploitation for Client Execution | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BabyShark has used dir to search for "programfiles" and "appdata".

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Indrik Spider has served fake updates via legitimate websites that have been compromised.

Output: Technique=T1584.004: Server | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Daggerfly created a local account on victim machines to maintain access.

Output: Technique=T1136.001: Local Account | Tactic=TA0003: Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: QakBot has placed its payload in hidden subdirectories.

Output: Technique=T1564.001: Hidden Files and Directories | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Calisto uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration.

Output: Technique=T1564.001: Hidden Files and Directories | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Stuxnet used WMI with an explorer.exe token to execute on a remote share.

Output: Technique=T1047: Windows Management Instrumentation | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Bazar can delete its loader using a batch file in the Windows temporary folder.

Output: Technique=T1070.004: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: AcidRain reboots the target system once the various wiping processes are complete.

Output: Technique=T1529: System Shutdown/Reboot | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Bad Rabbit drops a file named infpub.datinto the Windows directory and is executed through SCManager and rundll.exe.

Output: Technique=T1569.002: Service Execution | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FunnyDream can collect information about hosts on the victim network.

Output: Technique=T1018: Remote System Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FunnyDream has the ability to gather user information from the targeted system using `whoami/upn&whoami/fqdn&whoami/logonid&whoami/all`.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: A Lazarus Group custom backdoor implant included a custom PE loader named "Security Package" that was added into the lsass.exe process via registry key.

Output: Technique=T1036.004: Masquerade Task or Service | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Versa Director Zero Day Exploitation used compromised small office/home office (SOHO) devices to interact with vulnerable Versa Director servers.

Output: Technique=T1584.008: Network Devices | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Zeus Panda can hook GetClipboardData function to watch for clipboard pastes to collect.

Output: Technique=T1115: Clipboard Data | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: dsquery can be used to gather information on domain trusts with dsquery * -filter "(objectClass=trustedDomain)" -attr *.

Output: Technique=T1482: Domain Trust Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: MechaFlounder has the ability to use base16 encoded strings in C2.

Output: Technique=T1132.001: Standard Encoding | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: A Patchwork file stealer can run a TaskScheduler DLL to add persistence.

Output: Technique=T1053.005: Scheduled Task | Tactic=TA0002 ; TA0003 ; TA0004: Execution ; Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT29 has used various forms of spearphishing attempting to get a user to open attachments, including, but not limited to, malicious Microsoft Word documents, .pdf, and .lnk files.

Output: Technique=T1204.002: Malicious File | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: CHIMNEYSWEEP has been dropped by a self-extracting archive signed with a valid digital certificate.

Output: Technique=T1553.002: Code Signing | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BadPatch collects the OS system, OS version, MAC address, and the computer name from the victim’s machine.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Frankenstein has enumerated hosts, looking to obtain a list of all currently running processes.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BADNEWS copies documents under 15MB found on the victim system to is the user's <code>%temp%\SMB\</code> folder. It also copies files from USB devices to a predefined directory.

Output: Technique=T1074.001: Local Data Staging | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SideTwist has the ability to download additional files.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cobalt Strike can spawn processes with alternate PPIDs.

Output: Technique=T1134.004: Parent PID Spoofing | Tactic=TA0005 ; TA0004: Defense Evasion ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FoggyWeb can remotely exfiltrate sensitive information from a compromised AD FS server.

Output: Technique=T1041: Exfiltration Over C2 Channel | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: EvilBunny's dropper has checked the number of processes and the length and strings of its own file name to identify if the malware is in a sandbox environment.

Output: Technique=T1497.001: System Checks | Tactic=TA0005 ; TA0007: Defense Evasion ; Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SDBbot can enumerate a list of running processes on a compromised machine.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: MuddyWater maintains persistence on victim networks through side-loading dlls to trick legitimate programs into running malware.

Output: Technique=T1574.002: DLL Side-Loading | Tactic=TA0003 ; TA0004 ; TA0005: Persistence ; Privilege Escalation ; Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: CHIMNEYSWEEP can invoke the PowerShell command `[Reflection.Assembly]::LoadFile(\"%s\")\n$i=\"\"\n$r=[%s]::%s(\"%s\",[ref] $i)\necho $r,$i\n` to execute secondary payloads.

Output: Technique=T1059.001: PowerShell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Mustang Panda has created the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\AdobelmdyU to maintain persistence.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: EVILNUM has changed the creation date of files.

Output: Technique=T1070.006: Timestomp | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Lazarus Group has used Powershell to download malicious payloads.

Output: Technique=T1059.001: PowerShell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Volt Typhoon has gained initial access by exploiting privilege escalation vulnerabilities in the operating system or network services.

Output: Technique=T1068: Exploitation for Privilege Escalation | Tactic=TA0004: Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Turla has used a custom .NET tool to collect documents from an organization's internal central database.

Output: Technique=T1213: Data from Information Repositories | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Green Lambert can add Login Items to establish persistence.

Output: Technique=T1547.015: Login Items | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Operation CuckooBees, the threat actors exploited multiple vulnerabilities in externally facing servers.

Output: Technique=T1190: Exploit Public-Facing Application | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TrickBot collects a list of install programs and services on the system’s machine.

Output: Technique=T1007: System Service Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Comnie uses HTTP for C2 communication.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Gamaredon Group tools can delete files used during an operation.

Output: Technique=T1070.004: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Wizard Spider has used batch scripts that utilizes WMIC to execute a BITSAdmin transfer of a ransomware payload to each compromised machine.

Output: Technique=T1197: BITS Jobs | Tactic=TA0005 ; TA0003: Defense Evasion ; Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Operation Wocao has accessed and collected credentials from password managers.

Output: Technique=T1555.005: Password Managers | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Carbanak performs desktop video recording and captures screenshots of the desktop and sends it to the C2 server.

Output: Technique=T1113: Screen Capture | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PowerShower has added a registry key so future powershell.exe instances are spawned with coordinates for a window position off-screen by default.

Output: Technique=T1564.003: Hidden Window | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Elise executes systeminfo after initial communication is made to the remote server.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PLEAD can use `ShellExecute` to execute applications.

Output: Technique=T1106: Native API | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Turian can download additional files and tools from its C2.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Indrik Spider has searched files to obtain and exfiltrate credentials.

Output: Technique=T1552.001: Credentials In Files | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: A JPIN variant downloads the backdoor payload via the BITS service.

Output: Technique=T1197: BITS Jobs | Tactic=TA0005 ; TA0003: Defense Evasion ; Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Valak has downloaded a variety of modules and payloads to the compromised host, including IcedID and NetSupport Manager RAT-based malware.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Melcoz can use VBS scripts to execute malicious DLLs.

Output: Technique=T1059.005: Visual Basic | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT32 used Mimikatz and customized versions of Windows Credential Dumper to harvest credentials.

Output: Technique=T1003.001: LSASS Memory | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Confucius has lured victims to execute malicious attachments included in crafted spearphishing emails related to current topics.

Output: Technique=T1204.002: Malicious File | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HermeticWiper can create system services to aid in executing the payload.

Output: Technique=T1569.002: Service Execution | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: xCaon has used the GetAdaptersInfo() API call to get the victim's MAC address.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ninja has used legitimate looking filenames for its loader including update.dll and x64.dll.

Output: Technique=T1036.005: Match Legitimate Name or Location | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Rancor has used msiexec to download and execute malicious installer files over HTTP.

Output: Technique=T1218.007: Msiexec | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Transparent Tribe has crafted malicious files to exploit CVE-2012-0158 and CVE-2010-3333 for execution.

Output: Technique=T1203: Exploitation for Client Execution | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ruler can be used to automate the abuse of Outlook Rules, Forms, and Home Pages to establish persistence.

Output: Technique=T1137: Office Application Startup | Tactic=TA0003: Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ramsay can scan for network drives which may contain documents for collection.

Output: Technique=T1135: Network Share Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: AppleJeus has been installed via MSI installer.

Output: Technique=T1218.007: Msiexec | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Empire can enumerate Security Support Providers (SSPs) as well as utilize PowerSploit's Install-SSP and Invoke-Mimikatz to install malicious SSPs and log authentication events.

Output: Technique=T1547.005: Security Support Provider | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT32 has moved and renamed pubprn.vbs to a .txt file to avoid detection.

Output: Technique=T1036.003: Rename System Utilities | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: EnvyScout contains JavaScript code that can extract an encoded blob from its HTML body and write it to disk.

Output: Technique=T1027.006: HTML Smuggling | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: GRIFFON has used a reconnaissance module that can be used to retrieve Windows domain membership information.

Output: Technique=T1069.002: Domain Groups | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SMOKEDHAM has created user accounts.

Output: Technique=T1136.001: Local Account | Tactic=TA0003: Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Carberp can capture display screenshots with the screens_dll.dll plugin.

Output: Technique=T1113: Screen Capture | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FinFisher performs UAC bypass.

Output: Technique=T1548.002: Bypass User Account Control | Tactic=TA0004 ; TA0005: Privilege Escalation ; Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Zeus Panda searches for specific directories on the victim’s machine.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During the SolarWinds Compromise, APT29 used a compromised O365 administrator account to create a new Service Principal.

Output: Technique=T1078.004: Cloud Accounts | Tactic=TA0005 ; TA0003 ; TA0004 ; TA0001: Defense Evasion ; Persistence ; Privilege Escalation ; Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Some Backdoor.Oldrea samples use standard Base64 + bzip2, and some use standard Base64 + reverse XOR + RSA-2048 to decrypt data received from C2 servers.

Output: Technique=T1132.001: Standard Encoding | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Fysbis has masqueraded as trusted software rsyncd and dbus-inotifier.

Output: Technique=T1036.005: Match Legitimate Name or Location | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ComRAT has used PowerShell to load itself every time a user logs in to the system. ComRAT can execute PowerShell scripts loaded into memory or from the file system.

Output: Technique=T1059.001: PowerShell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Threat Group-3390 has deployed backup web shells and obtained OWA account credentials during intrusions that it subsequently used to attempt to regain access when evicted from a victim network.

Output: Technique=T1108: Redundant Access | Tactic=TA0005 ; TA0003: Defense Evasion ; Persistence


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: QakBot can maintain persistence by creating an auto-run Registry key.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sykipot may use ipconfig /all to gather system network configuration details.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PITSTOP has the ability to communicate over TLS.

Output: Technique=T1573.002: Asymmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Carbon uses the net view command.

Output: Technique=T1018: Remote System Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Kinsing has searched for private keys.

Output: Technique=T1552.004: Private Keys | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Sandworm Team has sent system information to its C2 server using HTTP.

Output: Technique=T1041: Exfiltration Over C2 Channel | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using rundll32.exe.

Output: Technique=T1218.011: Rundll32 | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Avaddon checks for specific keyboard layouts and OS languages to avoid targeting Commonwealth of Independent States (CIS) entities.

Output: Technique=T1614.001: System Language Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Taidoor can perform DLL loading.

Output: Technique=T1055.001: Dynamic-link Library Injection | Tactic=TA0005 ; TA0004: Defense Evasion ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Latrodectus has the ability to restart compromised hosts.

Output: Technique=T1529: System Shutdown/Reboot | Tactic=TA0040: Impact


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BONDUPDATER can download or upload files from its C2 server.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT3 enables the Remote Desktop Protocol for persistence. APT3 has also interacted with compromised systems to browse and copy files through RDP sessions.

Output: Technique=T1021.001: Remote Desktop Protocol | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Mustang Panda has encrypted documents with RC4 prior to exfiltration.

Output: Technique=T1560.003: Archive via Custom Method | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Bankshot gathers domain and account names/information through process monitoring.

Output: Technique=T1087.001: Local Account | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RATANKBA uses cmd.exe to execute commands.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Bundlore has attempted to get users to execute a malicious .app file that looks like a Flash Player update.

Output: Technique=T1204.002: Malicious File | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ToddyCat has used locally mounted network shares for lateral movement through targated environments.

Output: Technique=T1021.002: SMB/Windows Admin Shares | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cannon can take a screenshot of the desktop.

Output: Technique=T1113: Screen Capture | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Royal establishes a TCP socket for C2 communication using the API `WSASocketW`.

Output: Technique=T1095: Non-Application Layer Protocol | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Rising Sun has identified the OS product name from a compromised host by searching the registry for `SOFTWARE\MICROSOFT\Windows NT\ CurrentVersion | ProductName`.

Output: Technique=T1012: Query Registry | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: GoldMax can spawn a command shell, and execute native commands.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SoreFang can decode and decrypt exfiltrated data sent to C2.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: In the Triton Safety Instrumented System Attack, TEMP.Veles used cryptcat binaries to encrypt their traffic.

Output: Technique=T1573: Encrypted Channel | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: QakBot can use netstat to enumerate current network connections.

Output: Technique=T1049: System Network Connections Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: MgBot includes modules for identifying local users and administrators on victim machines.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Gold Dragon establishes persistence in the Startup folder.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: INC Ransom has enumerated domain groups on targeted hosts.

Output: Technique=T1069.002: Domain Groups | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: GLASSTOKEN can use PowerShell for command execution.

Output: Technique=T1059.001: PowerShell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: LAPSUS$ has gathered detailed information of target employees to enhance their social engineering lures.

Output: Technique=T1589: Gather Victim Identity Information | Tactic=TA0043: Reconnaissance


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: S-Type may save itself as a file named `msdtc.exe`, which is also the name of the legitimate Microsoft Distributed Transaction Coordinator service binary.

Output: Technique=T1036.005: Match Legitimate Name or Location | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RogueRobin establishes persistence by creating a shortcut (.LNK file) in the Windows startup folder to run a script each time the user logs in.

Output: Technique=T1547.009: Shortcut Modification | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SpeakUp downloads and executes additional files from a remote server.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: LightNeuron can be configured to automatically exfiltrate files under a specified directory.

Output: Technique=T1020: Automated Exfiltration | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT41 impersonated an employee at a video game developer company to send phishing emails.

Output: Technique=T1656: Impersonation | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: OSX_OCEANLOTUS.D can collect the network interface MAC address on the infected host.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Operation Wocao, threat actors used PowerShell to add and delete rules in the Windows firewall.

Output: Technique=T1562.004: Disable or Modify System Firewall | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: njRAT has been observed communicating over uncommon TCP ports, including 1177 and 8282.

Output: Technique=T1065: Uncommonly Used Port | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: For C0011, Transparent Tribe hosted malicious documents on domains registered by the group.

Output: Technique=T1608.001: Upload Malware | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BlackCat can enumerate files for encryption.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Carbon encrypts configuration files and tasks for the malware to complete using CAST-128 algorithm.

Output: Technique=T1027: Obfuscated Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Elise enumerates processes via the tasklist command.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Derusbi gathers the name of the local host, version of GNU Compiler Collection (GCC), and the system information about the CPU, machine, and operating system.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SoreFang can gain persistence through use of scheduled tasks.

Output: Technique=T1053.005: Scheduled Task | Tactic=TA0002 ; TA0003 ; TA0004: Execution ; Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: OSX_OCEANLOTUS.D uses a decode routine combining bit shifting and XOR operations with a variable key that depends on the length of the string that was encoded. If the computation for the variable XOR key turns out to be 0, the default XOR key of 0x1B is used. This routine is also referenced as the `rotate` function in reporting.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: DUSTTRAP reads the infected system's current time and writes it to a log file during execution.

Output: Technique=T1124: System Time Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: LunarWeb can retrieve output from arbitrary processes and shell commands via a pipe.

Output: Technique=T1559: Inter-Process Communication | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SeaDuke is capable of uploading and downloading files.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cuba has used several built-in API functions for discovery like GetIpNetTable and NetShareEnum.

Output: Technique=T1106: Native API | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT18 can upload a file to the victim’s machine.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Indrik Spider has used the win32_service WMI class to retrieve a list of services from the system.

Output: Technique=T1007: System Service Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Gallmaker sent emails with malicious Microsoft Office documents attached.

Output: Technique=T1566.001: Spearphishing Attachment | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: GravityRAT lists the running processes on the system.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Empire contains modules that can discover and exploit various path interception opportunities.

Output: Technique=T1034: Path Interception | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PingPull can enumerate storage volumes and folder contents of a compromised host.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Aoqin Dragon has used a dropper that employs a worm infection strategy using a removable device to breach a secure network environment.

Output: Technique=T1091: Replication Through Removable Media | Tactic=TA0008 ; TA0001: Lateral Movement ; Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ABK has the ability to download files from C2.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SUGARDUMP has been named `CrashReporter.exe` to appear as a legitimate Mozilla executable.

Output: Technique=T1036.005: Match Legitimate Name or Location | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: DarkTortilla can use `cmd.exe` to add registry keys for persistence.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FIN8 has deleted Registry keys during post compromise cleanup activities.

Output: Technique=T1112: Modify Registry | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: More_eggs's payload has been encrypted with a key that has the hostname and processor family information appended to the end.

Output: Technique=T1027.013: Encrypted/Encoded File | Tactic=TA0005: Defense Evasion