Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: WannaCry enumerates current remote desktop sessions and tries to execute the malware on each session.

Output: Technique=T1563.002: RDP Hijacking | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: zwShell can obtain the victim IP address.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ajax Security Team has used FireMalv custom-developed malware, which collected passwords from the Firefox browser storage.

Output: Technique=T1555.003: Credentials from Web Browsers | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: OceanSalt has been executed via malicious macros.

Output: Technique=T1064: Scripting | Tactic=TA0005 ; TA0002: Defense Evasion ; Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Turla has used fsutil fsinfo drives to list connected drives.

Output: Technique=T1120: Peripheral Device Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Diavol has Base64 encoded the RSA public key used for encrypting files.

Output: Technique=T1027: Obfuscated Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Aquatic Panda used rundll32.exe to proxy execution of a malicious DLL file identified as a keylogging binary.

Output: Technique=T1218.011: Rundll32 | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During C0015, PowerView's file share enumeration results were stored in the file `c:\ProgramData\found_shares.txt`.

Output: Technique=T1074.001: Local Data Staging | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: OSX_OCEANLOTUS.D uses file naming conventions with associated executable locations to blend in with the macOS TimeMachine and OpenSSL services. Such as, naming a LaunchAgent plist file `com.apple.openssl.plist` which executes OSX_OCEANLOTUS.D from the user's `~/Library/OpenSSL/` folder upon user login.

Output: Technique=T1036.004: Masquerade Task or Service | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: S-Type has deleted accounts it has created.

Output: Technique=T1070.009: Clear Persistence | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Raspberry Robin uses msiexec.exe for post-installation communication to command and control infrastructure. Msiexec.exe is executed referencing a remote resource for second-stage payload retrieval and execution.

Output: Technique=T1218.007: Msiexec | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Uroburos can use implants on multiple compromised machines to proxy communications through its worldwide P2P network.

Output: Technique=T1090.003: Multi-hop Proxy | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HTTPBrowser's code may be obfuscated through structured exception handling and return-oriented programming.

Output: Technique=T1027: Obfuscated Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious attachment.

Output: Technique=T1204.002: Malicious File | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RCSession can identify processes based on PID.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: MacMa can dump credentials from the macOS keychain.

Output: Technique=T1555.001: Keychain | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Valak has returned C2 data as encoded ASCII.

Output: Technique=T1132.001: Standard Encoding | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RATANKBA uses port 443 for C2.

Output: Technique=T1043: Commonly Used Port | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Tor encapsulates traffic in multiple layers of encryption, using TLS by default.

Output: Technique=T1573.002: Asymmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Linfo creates a backdoor through which remote attackers can retrieve a list of running processes.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RedCurl has used pcalua.exe to obfuscate binary execution and remote connections.

Output: Technique=T1202: Indirect Command Execution | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PoisonIvy contains a keylogger.

Output: Technique=T1056.001: Keylogging | Tactic=TA0009 ; TA0006: Collection ; Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Silence has used RDP for lateral movement.

Output: Technique=T1021.001: Remote Desktop Protocol | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Daggerfly has used signed, but not notarized, malicious files for execution in macOS environments.

Output: Technique=T1553.002: Code Signing | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Frankenstein has deobfuscated base64-encoded commands following the execution of a malicious script, which revealed a small script designed to obtain an additional payload.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: DustySky captures PNG screenshots of the main screen.

Output: Technique=T1113: Screen Capture | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SynAck gathers computer names, OS version info, and also checks installed keyboard layouts to estimate if it has been launched from a certain list of countries.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Rising Sun has collected data and files from a compromised host.

Output: Technique=T1005: Data from Local System | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: REvil can exfiltrate host and malware information to C2 servers.

Output: Technique=T1041: Exfiltration Over C2 Channel | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Empire includes various modules for finding files of interest on hosts and network shares.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Winter Vivern used adversary-owned and -controlled servers to host web vulnerability scanning applications.

Output: Technique=T1583.003: Virtual Private Server | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During the SolarWinds Compromise, APT29 used different compromised credentials for remote access and to move laterally.

Output: Technique=T1078: Valid Accounts | Tactic=TA0005 ; TA0003 ; TA0004 ; TA0001: Defense Evasion ; Persistence ; Privilege Escalation ; Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cobalt Strike can start a VNC-based remote desktop server and tunnel the connection through the already established C2 channel.

Output: Technique=T1021.001: Remote Desktop Protocol | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: NanHaiShu collects the username from the victim.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT32 has collected the OS version and computer name from victims. One of the group's backdoors can also query the Windows Registry to gather system information, and another macOS backdoor performs a fingerprint of the machine on its first connection to the C&C server. APT32 executed shellcode to identify the name of the infected host.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Gamaredon Group has used an Outlook VBA module on infected systems to send phishing emails with malicious attachments to other employees within the organization.

Output: Technique=T1534: Internal Spearphishing | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: KONNI has the capability to perform keylogging.

Output: Technique=T1056.001: Keylogging | Tactic=TA0009 ; TA0006: Collection ; Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Kazuar uploads files from a specified directory to the C2 server.

Output: Technique=T1005: Data from Local System | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FIN13 has gathered stolen credentials, sensitive data such as point-of-sale (POS), and ATM data from a compromised network before exfiltration.

Output: Technique=T1005: Data from Local System | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Stuxnet can propagate via removable media using an autorun.inf file or the CVE-2010-2568 LNK vulnerability.

Output: Technique=T1091: Replication Through Removable Media | Tactic=TA0008 ; TA0001: Lateral Movement ; Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TrickBot searches the system for all of the following file extensions: .avi, .mov, .mkv, .mpeg, .mpeg4, .mp4, .mp3, .wav, .ogg, .jpeg, .jpg, .png, .bmp, .gif, .tiff, .ico, .xlsx, and .zip. It can also obtain browsing history, cookies, and plug-in information.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Skidmap has installed itself via crontab.

Output: Technique=T1053.003: Cron | Tactic=TA0002 ; TA0003 ; TA0004: Execution ; Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: MacMa decrypts a downloaded file using AES-128-EBC with a custom delta.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT38 has used CHM files to move concealed payloads.

Output: Technique=T1218.001: Compiled HTML File | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RedLeaves can obtain information about the logged on user both locally and for Remote Desktop sessions.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Winnti for Windows can communicate using custom TCP.

Output: Technique=T1095: Non-Application Layer Protocol | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Flagpro can download malicious files with a .tmp extension and append them with .exe prior to execution.

Output: Technique=T1036: Masquerading | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: The initial beacon packet for Misdat contains the operating system version of the victim.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: DUSTTRAP can perform keylogging operations.

Output: Technique=T1056.001: Keylogging | Tactic=TA0009 ; TA0006: Collection ; Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: QuasarRAT can gather system information from the victim’s machine including the OS type.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: DarkGate will retrieved encrypted commands from its command and control server for follow-on actions such as cryptocurrency mining.

Output: Technique=T1001: Data Obfuscation | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Cutting Edge, threat actors exploited CVE-2023-46805 and CVE-2024-21887 in Ivanti Connect Secure VPN appliances to enable authentication bypass and command injection. A server-side request forgery (SSRF) vulnerability, CVE-2024-21893, was identified later and used to bypass mitigations for the initial two vulnerabilities by chaining with CVE-2024-21887.

Output: Technique=T1190: Exploit Public-Facing Application | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Blue Mockingbird has made their XMRIG payloads persistent as a Windows Service.

Output: Technique=T1543.003: Windows Service | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Indrik Spider has created email accounts to communicate with their ransomware victims, to include providing payment and decryption details.

Output: Technique=T1585.002: Email Accounts | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Kimsuky has used `ipconfig/all` and web beacons sent via email to gather network configuration information.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HEXANE has identified specific potential victims at targeted organizations.

Output: Technique=T1589: Gather Victim Identity Information | Tactic=TA0043: Reconnaissance


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TAINTEDSCRIBE can execute GetLocalTime for time discovery.

Output: Technique=T1124: System Time Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SpeakUp uses the arp -a command.

Output: Technique=T1049: System Network Connections Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT1 used the commands net localgroup,net user, and net group to find accounts on the system.

Output: Technique=T1087.001: Local Account | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: For Operation Dust Storm, the threat actors established domains as part of their operational infrastructure.

Output: Technique=T1583.001: Domains | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cinnamon Tempest has used SMBexec for lateral movement.

Output: Technique=T1021.002: SMB/Windows Admin Shares | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Bumblebee can compress data stolen from the Registry and volume shadow copies prior to exfiltration.

Output: Technique=T1560: Archive Collected Data | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: FlawedAmmyy has used PowerShell to execute commands.

Output: Technique=T1059.001: PowerShell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During C0026, the threat actors re-registered a ClouDNS dynamic DNS subdomain which was previously used by ANDROMEDA.

Output: Technique=T1568: Dynamic Resolution | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: COATHANGER will query running process information to determine subsequent program execution flow.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: DanBot can download additional files to a targeted system.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: AsyncRAT can create a scheduled task to maintain persistence on system start-up.

Output: Technique=T1053.005: Scheduled Task | Tactic=TA0002 ; TA0003 ; TA0004: Execution ; Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Elise communicates over HTTP or HTTPS for C2.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BLINDINGCAN has collected the victim machine's local IP address information and MAC address.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: DOGCALL is capable of logging keystrokes.

Output: Technique=T1056.001: Keylogging | Tactic=TA0009 ; TA0006: Collection ; Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ShimRat can sleep when instructed to do so by the C2.

Output: Technique=T1029: Scheduled Transfer | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Shark can query `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid` to retrieve the machine GUID.

Output: Technique=T1012: Query Registry | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: GravityRAT uses port 46769 for C2.

Output: Technique=T1065: Uncommonly Used Port | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Pteranodon copies itself to the Startup folder to establish persistence.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ember Bear has stolen legitimate certificates to sign malicious payloads.

Output: Technique=T1588.003: Code Signing Certificates | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TrickBot used COM to setup scheduled task for persistence.

Output: Technique=T1559.001: Component Object Model | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: StreamEx establishes persistence by installing a new service pointing to its DLL and setting the service to auto-start.

Output: Technique=T1543.003: Windows Service | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Remsec has a plugin that can perform ARP scanning as well as port scanning.

Output: Technique=T1046: Network Service Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Rclone can list files and directories with the `ls`, `lsd`, and `lsl` commands.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Samurai can query `SOFTWARE\Microsoft\.NETFramework\policy\v2.0` for discovery.

Output: Technique=T1012: Query Registry | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Attor can obtain application window titles and then determines which windows to perform Screen Capture on.

Output: Technique=T1010: Application Window Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Bazar can use TLS in C2 communications.

Output: Technique=T1573.002: Asymmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HOPLIGHT has injected into running processes.

Output: Technique=T1055: Process Injection | Tactic=TA0005 ; TA0004: Defense Evasion ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Seasalt uses HTTP for C2 communications.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ZxShell has a command to perform video device spying.

Output: Technique=T1125: Video Capture | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ferocious can run GET.WORKSPACE in Microsoft Excel to check if a mouse is present.

Output: Technique=T1120: Peripheral Device Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: UNC2452 obtained information about the configured Exchange virtual directory using Get-WebServicesVirtualDirectory.

Output: Technique=T1083: File and Directory Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cobalt Strike uses a custom command and control protocol that communicates over commonly used ports. The C2 protocol is encapsulated in common application layer protocols.

Output: Technique=T1043: Commonly Used Port | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HiddenWasp uses a cipher to implement a decoding function.

Output: Technique=T1140: Deobfuscate/Decode Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Operation Sharpshooter, additional payloads were downloaded after a target was infected with a first-stage downloader.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ShimRat has registered two registry keys for shim databases.

Output: Technique=T1112: Modify Registry | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During Cutting Edge, threat actors used the Unix socket and a reverse TCP shell for C2 communications.

Output: Technique=T1095: Non-Application Layer Protocol | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Dragonfly has dropped and executed SecretsDump to dump password hashes. They also obtained ntds.dit from domain controllers.

Output: Technique=T1003.003: NTDS | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BLINDINGCAN has executed commands via cmd.exe.

Output: Technique=T1059.003: Windows Command Shell | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Silence has used RAdmin, a remote software tool used to remotely control workstations and ATMs.

Output: Technique=T1072: Software Deployment Tools | Tactic=TA0002 ; TA0008: Execution ; Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: AuditCred can utilize proxy for communications.

Output: Technique=T1090: Proxy | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: RegDuke can store its encryption key in the Registry.

Output: Technique=T1027.011: Fileless Storage | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: yty collects the victim’s username.

Output: Technique=T1033: System Owner/User Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: TA577 has sent thread hijacked messages from compromised emails.

Output: Technique=T1586.002: Email Accounts | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Maze has checked the language of the infected system using the "GetUSerDefaultUILanguage" function.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: HotCroissant has the ability to identify the IP address of the compromised machine.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Milan has received files from C2 and stored them in log folders beginning with the character sequence `a9850d2f`.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Woody RAT can use multiple native APIs, including `WriteProcessMemory`, `CreateProcess`, and `CreateRemoteThread` for process injection.

Output: Technique=T1106: Native API | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Spica has the ability to steal cookies from Chrome, Firefox, Opera, and Edge browsers.

Output: Technique=T1539: Steal Web Session Cookie | Tactic=TA0006: Credential Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: During FunnyDream, the threat actors used Systeminfo to collect information on targeted hosts.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: The DustySky dropper uses Windows Management Instrumentation to extract information about the operating system and whether an anti-virus is active.

Output: Technique=T1047: Windows Management Instrumentation | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Netwalker can determine the system architecture it is running on to choose which version of the DLL to use.

Output: Technique=T1082: System Information Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: OilRig has exfiltrated data over FTP separately from its primary C2 channel over DNS.

Output: Technique=T1048.003: Exfiltration Over Unencrypted Non-C2 Protocol | Tactic=TA0010: Exfiltration


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT28 encrypted a .dll payload using RTL and a custom encryption algorithm. APT28 has also obfuscated payloads with base64, XOR, and RC4.

Output: Technique=T1027.013: Encrypted/Encoded File | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Gamaredon Group has deployed scripts on compromised systems that automatically scan for interesting documents.

Output: Technique=T1119: Automated Collection | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: gh0st RAT can execute its service if the Service key exists. If the key does not exist, gh0st RAT will create and run the service.

Output: Technique=T1569.002: Service Execution | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ChChes can encrypt C2 traffic with AES or RC4.

Output: Technique=T1573.001: Symmetric Cryptography | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Lazarus Group has used nmap from a router VM to scan ports on systems within the restricted segment of an enterprise network.

Output: Technique=T1046: Network Service Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: GeminiDuke collects information on local user accounts from the victim.

Output: Technique=T1087.001: Local Account | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Rocke has used Python-based malware to install and spread their coinminer.

Output: Technique=T1059.006: Python | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: NETWIRE can store its configuration information in the Registry under `HKCU:\Software\Netwire`.

Output: Technique=T1027.011: Fileless Storage | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: InvisiMole can obtain running services on the victim.

Output: Technique=T1007: System Service Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Havij is used to automate SQL injection.

Output: Technique=T1190: Exploit Public-Facing Application | Tactic=TA0001: Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: LoudMiner has encrypted DMG files.

Output: Technique=T1027.013: Encrypted/Encoded File | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: WhisperGate can download additional stages of malware from a Discord CDN channel.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: NotPetya can use valid credentials with PsExec or wmic to spread itself to remote systems.

Output: Technique=T1078.003: Local Accounts | Tactic=TA0005 ; TA0003 ; TA0004 ; TA0001: Defense Evasion ; Persistence ; Privilege Escalation ; Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cinnamon Tempest has used Impacket for lateral movement via WMI.

Output: Technique=T1047: Windows Management Instrumentation | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: If NETEAGLE does not detect a proxy configured on the infected machine, it will send beacons via UDP/6000. Also, after retrieving a C2 IP address and Port Number, NETEAGLE will initiate a TCP connection to this socket. The ensuing connection is a plaintext C2 channel in which commands are specified by DWORDs.

Output: Technique=T1094: Custom Command and Control Protocol | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Magic Hound has acquired Amazon S3 buckets to use in C2.

Output: Technique=T1583.006: Web Services | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: LAPSUS$ has used the AD Explorer tool to enumerate users on a victim's network.

Output: Technique=T1087.002: Domain Account | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Shark can delete files downloaded to the compromised host.

Output: Technique=T1070.004: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: AsyncRAT can record screen content on targeted systems.

Output: Technique=T1125: Video Capture | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ProLock can use WMIC to execute scripts on targeted hosts.

Output: Technique=T1047: Windows Management Instrumentation | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: IcedID has been executed through Word and Excel files with malicious embedded macros and through ISO and LNK files that execute the malicious DLL.

Output: Technique=T1204.002: Malicious File | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Crimson contains a command to retrieve files from its C2 server.

Output: Technique=T1105: Ingress Tool Transfer | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Bazar can create a scheduled task for persistence.

Output: Technique=T1053.005: Scheduled Task | Tactic=TA0002 ; TA0003 ; TA0004: Execution ; Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: ShadowPad has encrypted its payload, a virtual file system, and various files.

Output: Technique=T1027: Obfuscated Files or Information | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cobalt Strike can use Window admin shares (C$ and ADMIN$) for lateral movement.

Output: Technique=T1021.002: SMB/Windows Admin Shares | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Mythic supports DNS-based C2 profiles.

Output: Technique=T1071.004: DNS | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Earth Lusca has used the Fodhelper UAC bypass technique to gain elevated privileges.

Output: Technique=T1548.002: Bypass User Account Control | Tactic=TA0004 ; TA0005: Privilege Escalation ; Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Lizar can migrate the loader into another process.

Output: Technique=T1055: Process Injection | Tactic=TA0005 ; TA0004: Defense Evasion ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Winnti for Windows can delete the DLLs for its various components from a compromised host.

Output: Technique=T1070.004: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Leviathan has used stolen code signing certificates to sign malware.

Output: Technique=T1553.002: Code Signing | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Star Blizzard has bypassed multi-factor authentication on victim email accounts by using session cookies stolen using EvilGinx.

Output: Technique=T1550.004: Web Session Cookie | Tactic=TA0005 ; TA0008: Defense Evasion ; Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Chaes has used VBscript to execute malicious code.

Output: Technique=T1059.005: Visual Basic | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: PolyglotDuke can store encrypted JSON configuration files in the Registry.

Output: Technique=T1027.011: Fileless Storage | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: MacSpy deletes any temporary files it creates

Output: Technique=T1070.004: File Deletion | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SHIPSHAPE achieves persistence by creating a shortcut in the Startup folder.

Output: Technique=T1547.001: Registry Run Keys / Startup Folder | Tactic=TA0003 ; TA0004: Persistence ; Privilege Escalation


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: GoldenSpy can execute remote commands in the Windows command shell using the WinExec() API.

Output: Technique=T1106: Native API | Tactic=TA0002: Execution


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Zox has the ability to list processes.

Output: Technique=T1057: Process Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: APT41 leverages various tools and frameworks to brute-force directories on web servers.

Output: Technique=T1595.003: Wordlist Scanning | Tactic=TA0043: Reconnaissance


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Ramsay can use UACMe for privilege escalation.

Output: Technique=T1548.002: Bypass User Account Control | Tactic=TA0004 ; TA0005: Privilege Escalation ; Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Cobalt Strike can deliver "beacon" payloads for lateral movement by leveraging remote COM execution.

Output: Technique=T1021.003: Distributed Component Object Model | Tactic=TA0008: Lateral Movement


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SILENTTRINITY can bypass ScriptBlock logging to execute unmanaged PowerShell code from memory.

Output: Technique=T1562.003: Impair Command History Logging | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Exaramel for Linux can execute commands with high privileges via a specific binary with setuid functionality.

Output: Technique=T1548.001: Setuid and Setgid | Tactic=TA0004 ; TA0005: Privilege Escalation ; Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: For early Gazer versions, the compilation timestamp was faked.

Output: Technique=T1070.006: Timestomp | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Fox Kitten has used valid credentials with various services during lateral movement.

Output: Technique=T1078: Valid Accounts | Tactic=TA0005 ; TA0003 ; TA0004 ; TA0001: Defense Evasion ; Persistence ; Privilege Escalation ; Initial Access


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: SUGARDUMP's scheduled task has been named `MicrosoftInternetExplorerCrashRepoeterTaskMachineUA` or `MicrosoftEdgeCrashRepoeterTaskMachineUA`, depending on the Windows OS version.

Output: Technique=T1036.004: Masquerade Task or Service | Tactic=TA0005: Defense Evasion


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: BackdoorDiplomacy has obtained a variety of open-source reconnaissance and red team tools for discovery and lateral movement.

Output: Technique=T1588.002: Tool | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Penquin can report the IP of the compromised host to attacker controlled infrastructure.

Output: Technique=T1016: System Network Configuration Discovery | Tactic=TA0007: Discovery


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: DustySky can compress files via RAR while staging data to be exfiltrated.

Output: Technique=T1560.001: Archive via Utility | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: WIREFIRE can respond to specific HTTP `POST` requests to `/api/v1/cav/client/visits`.

Output: Technique=T1071.001: Web Protocols | Tactic=TA0011: Command and Control


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: CHIMNEYSWEEP can store captured screenshots to disk including to a covert store named `APPX.%x%x%x%x%x.tmp` where `%x` is a random value.

Output: Technique=T1074.001: Local Data Staging | Tactic=TA0009: Collection


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Kimsuky created and used a mailing toolkit to use in spearphishing attacks.

Output: Technique=T1587: Develop Capabilities | Tactic=TA0042: Resource Development


Instruction: Which MITRE ATT&CK technique and tactic does this activity demonstrate?

Input: Activity: Mythic supports scripting of file downloads from agents.

Output: Technique=T1119: Automated Collection | Tactic=TA0009: Collection