QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: POWERSTATS encoded C2 traffic with base64.
MITRE ATT&CK techniques:
T1001
T1132.001
Threat description: menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.
MITRE ATT&CK techniques:
T1003.002
T1003.004
Threat description: The SMOKEDHAM source code is embedded in the dropper as an encrypted string.
MITRE ATT&CK techniques:
T1027.009
T1027
Threat description: PowerDuke has a command to write random data across a file and delete it.
MITRE ATT&CK techniques:
T1485
T1070.004
Threat description: SDelete deletes data in a way that makes it unrecoverable.
MITRE ATT&CK techniques:
T1485
T1070.004
Threat description: CookieMiner has checked for the presence of "Little Snitch", macOS network monitoring and application firewall software, stopping and exiting if it is found.
MITRE ATT&CK techniques:
T1562.004
T1518.001