QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: FinFisher has used the "KernelCallbackTable" to hijack the execution flow of a process by replacing the "__fnDWORD" function with the address of a created Asynchronous Procedure Call stub routine.
MITRE ATT&CK techniques:
T1574.013
Threat description: During Operation Honeybee, threat actors registered domains for C2.
MITRE ATT&CK techniques:
T1583.001
Threat description: EXOTIC LILY has registered domains to spoof targeted organizations by changing the top-level domain (TLD) to “.us”, “.co” or “.biz”.
MITRE ATT&CK techniques:
T1583.001
Threat description: For C0011, Transparent Tribe registered domains likely designed to appear relevant to student targets in India.
MITRE ATT&CK techniques:
T1583.001
Threat description: For FunnyDream, the threat actors registered a variety of domains.
MITRE ATT&CK techniques:
T1583.001
Threat description: LazyScripter has used dynamic DNS providers to create legitimate-looking subdomains for C2.
MITRE ATT&CK techniques:
T1583.001
Threat description: Winnti Group has registered domains for C2 that mimicked sites of their intended targets.
MITRE ATT&CK techniques:
T1583.001
Threat description: During Night Dragon, threat actors purchased hosted services to use for C2.
MITRE ATT&CK techniques:
T1583.004
Threat description: For Operation Wocao, the threat actors purchased servers with Bitcoin to use during the operation.
MITRE ATT&CK techniques:
T1583.004
Threat description: Gelsemium has established infrastructure through renting servers at multiple providers worldwide.
MITRE ATT&CK techniques:
T1583.004
Threat description: Confucius has obtained cloud storage service accounts to host stolen data.
MITRE ATT&CK techniques:
T1583.006
Threat description: Kimsuky has hosted content used for targeting efforts via web services such as Blogspot.
MITRE ATT&CK techniques:
T1583.006
Threat description: During C0010, UNC3890 actors likely compromised the domain of a legitimate Israeli shipping company.
MITRE ATT&CK techniques:
T1584.001
Threat description: For Operation Sharpshooter, the threat actors compromised a server they used as part of the campaign's infrastructure.
MITRE ATT&CK techniques:
T1584.004
Threat description: Earth Lusca has compromised Google Drive repositories.
MITRE ATT&CK techniques:
T1584.006
Threat description: EXOTIC LILY has established social media profiles to mimic employees of targeted companies.
MITRE ATT&CK techniques:
T1585.001
Threat description: Leviathan has created new social media accounts for targeting efforts.
MITRE ATT&CK techniques:
T1585.001
Threat description: Magic Hound has created fake LinkedIn and other social media accounts to contact targets and convince them--through messages and voice communications--to open malicious links.
MITRE ATT&CK techniques:
T1585.001
Threat description: For Operation Dust Storm, the threat actors established email addresses to register domains for their operations.
MITRE ATT&CK techniques:
T1585.002
Threat description: For Operation Wocao, the threat actors registered email accounts to use during the campaign.
MITRE ATT&CK techniques:
T1585.002
Threat description: Lazarus Group has created new email accounts for spearphishing operations.
MITRE ATT&CK techniques:
T1585.002
Threat description: Silent Librarian has established e-mail accounts to receive e-mails forwarded from compromised accounts.
MITRE ATT&CK techniques:
T1585.002
Threat description: For C0010, UNC3890 actors used unique malware, including SUGARUSH and SUGARDUMP.
MITRE ATT&CK techniques:
T1587.001
Threat description: Kimsuky has developed its own unique malware such as MailFetch.py for use in operations.
MITRE ATT&CK techniques:
T1587.001
Threat description: Lazarus Group has developed custom malware for use in their operations.
MITRE ATT&CK techniques:
T1587.001
Threat description: Aquatic Panda has acquired and used njRAT in its operations.
MITRE ATT&CK techniques:
T1588.001
Threat description: BackdoorDiplomacy has obtained and used leaked malware, including DoublePulsar, EternalBlue, EternalRocks, and EternalSynergy, in its operations.
MITRE ATT&CK techniques:
T1588.001
Threat description: APT41 has obtained and used tools such as Mimikatz, pwdump, PowerSploit, and Windows Credential Editor.
MITRE ATT&CK techniques:
T1588.002
Threat description: Blue Mockingbird has obtained and used tools such as Mimikatz.
MITRE ATT&CK techniques:
T1588.002
Threat description: Chimera has obtained and used tools such as BloodHound, Cobalt Strike, Mimikatz, and PsExec.
MITRE ATT&CK techniques:
T1588.002
Threat description: Cleaver has obtained and used open-source tools such as PsExec, Windows Credential Editor, and Mimikatz.
MITRE ATT&CK techniques:
T1588.002
Threat description: DarkVishnya has obtained and used tools such as Impacket, Winexe, and PsExec.
MITRE ATT&CK techniques:
T1588.002
Threat description: During Night Dragon, threat actors obtained and used tools such as gsecdump.
MITRE ATT&CK techniques:
T1588.002
Threat description: For Operation CuckooBees, the threat actors obtained publicly-available JSP code that was used to deploy a webshell onto a compromised server.
MITRE ATT&CK techniques:
T1588.002
Threat description: HEXANE has acquired, and sometimes customized, open source tools such as Mimikatz, Empire, VNC remote access software, and DIG.net.
MITRE ATT&CK techniques:
T1588.002
Threat description: Ke3chang has obtained and used tools such as Mimikatz.
MITRE ATT&CK techniques:
T1588.002
Threat description: Lazarus Group has obtained a variety of tools for their operations, including Responder, PuTTy PSCP, Wake-On-Lan, ChromePass, and dbxcli.
MITRE ATT&CK techniques:
T1588.002
Threat description: Magic Hound has obtained and used open-source penetration testing tools like Havij, sqlmap, Metasploit, and Mimikatz.
MITRE ATT&CK techniques:
T1588.002
Threat description: Silence has obtained and modified versions of publicly-available tools like Empire and PsExec.
MITRE ATT&CK techniques:
T1588.002
Threat description: Thrip has obtained and used tools such as Mimikatz and PsExec.
MITRE ATT&CK techniques:
T1588.002
Threat description: BlackTech has used stolen code-signing certificates for its malicious payloads.
MITRE ATT&CK techniques:
T1588.003
Threat description: For Operation Honeybee, the threat actors stole a digital signature from Adobe Systems to use with their MaoCheng dropper.
MITRE ATT&CK techniques:
T1588.004
Threat description: Lazarus Group has obtained SSL certificates for their C2 domains.
MITRE ATT&CK techniques:
T1588.004
Threat description: Silent Librarian has obtained free Let's Encrypt SSL certificates for use on their phishing pages.
MITRE ATT&CK techniques:
T1588.004
Threat description: During Operation Wocao, threat actors targeted people based on their organizational roles and privileges.
MITRE ATT&CK techniques:
T1589
Threat description: Magic Hound has acquired mobile phone numbers of potential targets, possibly for mobile malware or additional phishing operations.
MITRE ATT&CK techniques:
T1589
Threat description: Leviathan has collected compromised credentials to use for targeting efforts.
MITRE ATT&CK techniques:
T1589.001
Threat description: LAPSUS$ has gathered employee email addresses, including personal accounts, for social engineering and initial access efforts.
MITRE ATT&CK techniques:
T1589.002
Threat description: Magic Hound has acquired the personal email addresses of some individuals they intend to target.
MITRE ATT&CK techniques:
T1589.002
Threat description: HAFNIUM gathered the fully qualified domain names (FQDNs) for targeted Exchange servers in the victim's environment.
MITRE ATT&CK techniques:
T1590
Threat description: Silent Librarian has searched victim's websites to identify the interests and academic areas of targeted individuals and to scrape source code, branding, and organizational contact information for phishing pages.
MITRE ATT&CK techniques:
T1594
Threat description: Dragonfly has scanned targeted systems for vulnerable Citrix and Microsoft Exchange services.
MITRE ATT&CK techniques:
T1595.002
Threat description: UNC2452 bypassed MFA set on OWA accounts by generating a cookie value from a previously stolen secret key.
MITRE ATT&CK techniques:
T1606.001
Threat description: For C0010, UNC3890 actors staged malware on their infrastructure for direct download onto a compromised system.
MITRE ATT&CK techniques:
T1608.001
Threat description: TeamTNT executed Hildegard through the kubelet API run command and by executing commands on running containers.
MITRE ATT&CK techniques:
T1609
Threat description: Doki was run through a deployed container.
MITRE ATT&CK techniques:
T1610
Threat description: Siloscape maps the host’s C drive to the container by creating a global symbolic link to the host through the calling of "NtSetInformationSymbolicLink".
MITRE ATT&CK techniques:
T1611
Threat description: Peirates can enumerate Kubernetes pods in a given namespace.
MITRE ATT&CK techniques:
T1613
Threat description: Amadey does not run any tasks or install additional malware if the victim machine is based in Russia.
MITRE ATT&CK techniques:
T1614
Threat description: MarkiRAT can use the "GetKeyboardLayout" API to check if a compromised host's keyboard is set to Persian.
MITRE ATT&CK techniques:
T1614.001
Threat description: S-Type has attempted to determine if a compromised system was using a Japanese keyboard via the `GetKeyboardType` API call.
MITRE ATT&CK techniques:
T1614.001
Threat description: SynAck lists all the keyboard layouts installed on the victim’s system using "GetKeyboardLayoutList" API and checks against a hardcoded language code list. If a match if found, SynAck sleeps for 300 seconds and then exits without encrypting files.
MITRE ATT&CK techniques:
T1614.001
Threat description: BloodHound has the ability to collect local admin information via GPO.
MITRE ATT&CK techniques:
T1615
Threat description: Lokibot has reflectively loaded the decoded DLL into memory.
MITRE ATT&CK techniques:
T1620
Threat description: Bumblebee can search for tools used in static analysis.
MITRE ATT&CK techniques:
T1622
Threat description: DRATzarus can use `IsDebuggerPresent` to detect whether a debugger is present on a victim.
MITRE ATT&CK techniques:
T1622