auren-research/cyber-sec huggingface dataset:
type: attack-pattern
spec_version: 2.1
id: attack-pattern--d3046a90-580c-4004-8208-66915bc29830
created: 2017-12-14T16:46:06.044Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1146
external_id: T1146
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:26.345Z
name: Clear Command History
description: In addition to clearing system logs, an adversary may clear the command history of a compromised account to conceal the actions undertaken during an intrusion. macOS and Linux both keep track of the commands users type in their terminal so that users can retrace what they've done. These logs can be accessed in a few different ways. While logged in, this command history is tracked in a file pointed to by the environment variable HISTFILE. When a user logs off a system, this information is flushed to a file in the user's home directory called ~/.bash_history. The benefit of this is that it allows users to go back to commands they've used before in different sessions. Since everything typed on the command-line is saved, passwords passed in on the command line are also saved. Adversaries can abuse this by searching these files for cleartext passwords. Additionally, adversaries can use a variety of methods to prevent their own commands from appear in these logs such as unset HISTFILE, export HISTFILESIZE=0, history -c, rm ~/.bash_history.
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
macOS
x_mitre_version: 1.1
type: attack-pattern
spec_version: 2.1
id: attack-pattern--d349c66e-18e1-4d8b-a2d7-65af7cbd2ba0
created: 2024-08-05T21:39:16.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1036/010
external_id: T1036.010
source_name: Elastic CUBA Ransomware 2022
description: Daniel Stepanic, Derek Ditch, Seth Goodwin, Salim Bitam, Andrew Pease. (2022, September 7). CUBA Ransomware Campaign Analysis. Retrieved August 5, 2024.
url: https://www.elastic.co/security-labs/cuba-ransomware-campaign-analysis
source_name: Invictus IR Cloud Ransomware 2024
description: Invictus IR. (2024, January 11). Ransomware in the cloud. Retrieved August 5, 2024.
url: https://www.invictus-ir.com/news/ransomware-in-the-cloud
source_name: Huntress MOVEit 2023
description: John Hammond. (2023, June 1). MOVEit Transfer Critical Vulnerability CVE-2023-34362 Rapid Response. Retrieved August 5, 2024.
url: https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response
source_name: Aquasec Kubernetes Attack 2023
description: Michael Katchinskiy, Assaf Morag. (2023, April 21). First-Ever Attack Leveraging Kubernetes RBAC to Backdoor Clusters. Retrieved July 14, 2023.
url: https://blog.aquasec.com/leveraging-kubernetes-rbac-to-backdoor-clusters
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-15T22:48:14.966Z
name: Masquerade Account Name
description: Adversaries may match or approximate the names of legitimate accounts to make newly created ones appear benign. This will typically occur during [Create Account](https://attack.mitre.org/techniques/T1136), although accounts may also be renamed at a later date. This may also coincide with [Account Access Removal](https://attack.mitre.org/techniques/T1531) if the actor first deletes an account before re-creating one with the same name.(Citation: Huntress MOVEit 2023)

Often, adversaries will attempt to masquerade as service accounts, such as those associated with legitimate software, data backups, or container cluster management.(Citation: Elastic CUBA Ransomware 2022)(Citation: Aquasec Kubernetes Attack 2023) They may also give accounts generic, trustworthy names, such as “admin”, “help”, or “root.”(Citation: Invictus IR Cloud Ransomware 2024) Sometimes adversaries may model account names off of those already existing in the system, as a follow-on behavior to [Account Discovery](https://attack.mitre.org/techniques/T1087). 

Note that this is distinct from [Impersonation](https://attack.mitre.org/techniques/T1656), which describes impersonating specific trusted individuals or organizations, rather than user or service account names. 
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Menachem Goldstein
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
macOS
Windows
SaaS
IaaS
Containers
Office Suite
Identity Provider
x_mitre_version: 1.0
type: attack-pattern
spec_version: 2.1
id: attack-pattern--d376668f-b208-42de-b1f5-fdfe0ad4b753
created: 2019-09-19T14:07:11.734Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1519
external_id: T1519
source_name: xorrior emond Jan 2018
description: Ross, Chris. (2018, January 17). Leveraging Emond on macOS For Persistence. Retrieved September 10, 2019.
url: https://www.xorrior.com/emond-persistence/
source_name: magnusviri emond Apr 2016
description: Reynolds, James. (2016, April 7). What is emond?. Retrieved September 10, 2019.
url: http://www.magnusviri.com/Mac/what-is-emond.html
source_name: sentinelone macos persist Jun 2019
description: Stokes, Phil. (2019, June 17). HOW MALWARE PERSISTS ON MACOS. Retrieved September 10, 2019.
url: https://www.sentinelone.com/blog/how-malware-persists-on-macos/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:26.544Z
name: Emond
description: Adversaries may use Event Monitor Daemon (emond) to establish persistence by scheduling malicious commands to run on predictable event triggers. Emond is a [Launch Daemon](https://attack.mitre.org/techniques/T1160) that accepts events from various services, runs them through a simple rules engine, and takes action. The emond binary at /sbin/emond will load any rules from the /etc/emond.d/rules/ directory and take action once an explicitly defined event takes place. The rule files are in the plist format and define the name, event type, and action to take. Some examples of event types include system startup and user authentication. Examples of actions are to run a system command or send an email. The emond service will not launch if there is no file present in the QueueDirectories path /private/var/db/emondClients, specified in the [Launch Daemon](https://attack.mitre.org/techniques/T1160) configuration file at/System/Library/LaunchDaemons/com.apple.emond.plist.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019)

Adversaries may abuse this service by writing a rule to execute commands when a defined event occurs, such as system start up or user authentication.(Citation: xorrior emond Jan 2018)(Citation: magnusviri emond Apr 2016)(Citation: sentinelone macos persist Jun 2019) Adversaries may also be able to escalate privileges from administrator to root as the emond service is executed with root privileges by the [Launch Daemon](https://attack.mitre.org/techniques/T1160) service.
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: persistence
kill_chain_name: mitre-attack
phase_name: privilege-escalation
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Ivan Sinyakov
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: macOS
x_mitre_version: 1.1
type: attack-pattern
spec_version: 2.1
id: attack-pattern--d3df754e-997b-4cf9-97d4-70feb3120847
created: 2018-04-18T17:59:24.739Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1194
external_id: T1194
source_name: capec
url: https://capec.mitre.org/data/definitions/163.html
external_id: CAPEC-163
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:26.715Z
name: Spearphishing via Service
description: Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels. 

All forms of spearphishing are electronically delivered social engineering targeted at a specific individual, company, or industry. In this scenario, adversaries send messages through various social media services, personal webmail, and other non-enterprise controlled services. These services are more likely to have a less-strict security policy than an enterprise. As with most kinds of spearphishing, the goal is to generate rapport with the target or get the target's interest in some way. Adversaries will create fake social media accounts and message employees for potential job opportunities. Doing so allows a plausible reason for asking about services, policies, and software that's running in an environment. The adversary can then send malicious links or attachments through these services.

A common example is to build rapport with a target via social media, then send content to a personal webmail service that the target uses on their work computer. This allows an adversary to bypass some email restrictions on the work account, and the target is more likely to open the file since it's something they were expecting. If the payload doesn't work as expected, the adversary can continue normal communications and troubleshoot with the target on how to get it working.
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: initial-access
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
macOS
Linux
x_mitre_version: 1.1
type: attack-pattern
spec_version: 2.1
id: attack-pattern--d40239b3-05ff-46d8-9bdd-b46d13463ef9
created: 2018-04-18T17:59:24.739Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1200
external_id: T1200
source_name: Ossmann Star Feb 2011
description: Michael Ossmann. (2011, February 17). Throwing Star LAN Tap. Retrieved March 30, 2018.
url: https://ossmann.blogspot.com/2011/02/throwing-star-lan-tap.html
source_name: Aleks Weapons Nov 2015
description: Nick Aleks. (2015, November 7). Weapons of a Pentester - Understanding the virtual & physical tools used by white/black hat hackers. Retrieved March 30, 2018.
url: https://www.youtube.com/watch?v=lDvf4ScWbcQ
source_name: McMillan Pwn March 2012
description: Robert McMillan. (2012, March 3). The Pwn Plug is a little white box that can hack your network. Retrieved March 30, 2018.
url: https://arstechnica.com/information-technology/2012/03/the-pwn-plug-is-a-little-white-box-that-can-hack-your-network/
source_name: Frisk DMA August 2016
description: Ulf Frisk. (2016, August 5). Direct Memory Attack the Kernel. Retrieved March 30, 2018.
url: https://www.youtube.com/watch?v=fXthwl6ShOg
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:26.803Z
name: Hardware Additions
description: Adversaries may physically introduce computer accessories, networking hardware, or other computing devices into a system or network that can be used as a vector to gain access. Rather than just connecting and distributing payloads via removable storage (i.e. [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091)), more robust hardware additions can be used to introduce new functionalities and/or features into a system that can then be abused.

While public references of usage by threat actors are scarce, many red teams/penetration testers leverage hardware additions for initial access. Commercial and open source products can be leveraged with capabilities such as passive network tapping, network traffic modification (i.e. [Adversary-in-the-Middle](https://attack.mitre.org/techniques/T1557)), keystroke injection, kernel memory reading via DMA, addition of new wireless access points to an existing network, and others.(Citation: Ossmann Star Feb 2011)(Citation: Aleks Weapons Nov 2015)(Citation: Frisk DMA August 2016)(Citation: McMillan Pwn March 2012)
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: initial-access
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
Linux
macOS
x_mitre_version: 1.7
type: attack-pattern
spec_version: 2.1
id: attack-pattern--d4287702-e2f7-4946-bdfa-2c7f5aaa5032
created: 2025-03-24T22:24:47.684Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1219/002
external_id: T1219.002
source_name: CrowdStrike 2015 Global Threat Report
description: CrowdStrike Intelligence. (2016). 2015 Global Threat Report. Retrieved April 11, 2018.
url: https://go.crowdstrike.com/rs/281-OBQ-266/images/15GlobalThreatReport.pdf
source_name: CrySyS Blog TeamSpy
description: CrySyS Lab. (2013, March 20). TeamSpy – Obshie manevri. Ispolzovat’ tolko s razreshenija S-a. Retrieved April 11, 2018.
url: https://blog.crysys.hu/2013/03/teamspy/
source_name: Google Chrome Remote Desktop
description: Google. (n.d.). Retrieved March 14, 2024.
url: https://support.google.com/chrome/answer/1649523
source_name: Chrome Remote Desktop
description: Huntress. (n.d.). Retrieved March 14, 2024.
url: https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708
source_name: Symantec Living off the Land
description: Wueest, C., Anand, H. (2017, July). Living off the land and fileless attack techniques. Retrieved April 10, 2018.
url: https://www.symantec.com/content/dam/symantec/docs/security-center/white-papers/istr-living-off-the-land-and-fileless-attack-techniques-en.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T16:42:15.226Z
name: Remote Desktop Software
description: An adversary may use legitimate desktop support software to establish an interactive command and control channel to target systems within networks. Desktop support software provides a graphical interface for remotely controlling another computer, transmitting the display output, keyboard input, and mouse control between devices using various protocols. Desktop support software, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.(Citation: Symantec Living off the Land)(Citation: CrowdStrike 2015 Global Threat Report)(Citation: CrySyS Blog TeamSpy) 
 
Remote access modules/features may also exist as part of otherwise existing software such as Zoom or Google Chrome’s Remote Desktop.(Citation: Google Chrome Remote Desktop)(Citation: Chrome Remote Desktop) 
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: command-and-control
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
macOS
Windows
x_mitre_version: 1.0
type: attack-pattern
spec_version: 2.1
id: attack-pattern--d456de47-a16f-4e46-8980-e67478a12dcb
created: 2019-06-28T17:52:07.296Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1505
external_id: T1505
source_name: volexity_0day_sophos_FW
description: Adair, S., Lancaster, T., Volexity Threat Research. (2022, June 15). DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach. Retrieved July 1, 2022.
url: https://www.volexity.com/blog/2022/06/15/driftingcloud-zero-day-sophos-firewall-exploitation-and-an-insidious-breach/
source_name: US-CERT Alert TA15-314A Web Shells
description: US-CERT. (2015, November 13). Compromised Web Servers and Web Shells - Threat Awareness and Guidance. Retrieved June 8, 2016.
url: https://www.us-cert.gov/ncas/alerts/TA15-314A
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:27.065Z
name: Server Software Component
description: Adversaries may abuse legitimate extensible development features of servers to establish persistent access to systems. Enterprise server applications may include features that allow developers to write and install software or scripts to extend the functionality of the main application. Adversaries may install malicious components to extend and abuse server applications.(Citation: volexity_0day_sophos_FW)
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: persistence
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
Linux
macOS
Network Devices
ESXi
x_mitre_version: 1.5
type: attack-pattern
spec_version: 2.1
id: attack-pattern--d467bc38-284b-4a00-96ac-125f447799fc
created: 2020-03-14T23:39:50.117Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1132/002
external_id: T1132.002
source_name: University of Birmingham C2
description: Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
source_name: Wikipedia Binary-to-text Encoding
description: Wikipedia. (2016, December 26). Binary-to-text encoding. Retrieved March 1, 2017.
url: https://en.wikipedia.org/wiki/Binary-to-text_encoding
source_name: Wikipedia Character Encoding
description: Wikipedia. (2017, February 19). Character Encoding. Retrieved March 1, 2017.
url: https://en.wikipedia.org/wiki/Character_encoding
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:27.237Z
name: Non-Standard Encoding
description: Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a non-standard data encoding system that diverges from existing protocol specifications. Non-standard data encoding schemes may be based on or related to standard data encoding schemes, such as a modified Base64 encoding for the message body of an HTTP request.(Citation: Wikipedia Binary-to-text Encoding) (Citation: Wikipedia Character Encoding) 
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: command-and-control
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: ESXi
Linux
macOS
Windows
x_mitre_version: 1.1
type: attack-pattern
spec_version: 2.1
id: attack-pattern--d4b96d2c-1032-4b22-9235-2b5b649d0605
created: 2020-02-11T19:05:02.399Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1556/001
external_id: T1556.001
source_name: Dell Skeleton
description: Dell SecureWorks. (2015, January 12). Skeleton Key Malware Analysis. Retrieved April 8, 2019.
url: https://www.secureworks.com/research/skeleton-key-malware-analysis
source_name: TechNet Audit Policy
description: Microsoft. (2016, April 15). Audit Policy Recommendations. Retrieved June 3, 2016.
url: https://technet.microsoft.com/en-us/library/dn487457.aspx
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:27.324Z
name: Domain Controller Authentication
description: Adversaries may patch the authentication process on a domain controller to bypass the typical authentication mechanisms and enable access to accounts. 

Malware may be used to inject false credentials into the authentication process on a domain controller with the intent of creating a backdoor used to access any user’s account and/or credentials (ex: [Skeleton Key](https://attack.mitre.org/software/S0007)). Skeleton key works through a patch on an enterprise domain controller authentication process (LSASS) with credentials that adversaries may use to bypass the standard authentication system. Once patched, an adversary can use the injected password to successfully authenticate as any domain user account (until the the skeleton key is erased from memory by a reboot of the domain controller). Authenticated access may enable unfettered access to hosts and/or resources within single-factor authentication environments.(Citation: Dell Skeleton)
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: credential-access
kill_chain_name: mitre-attack
phase_name: defense-evasion
kill_chain_name: mitre-attack
phase_name: persistence
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_version: 2.1
type: attack-pattern
spec_version: 2.1
id: attack-pattern--d54416bd-0803-41ca-870a-ce1af7c05638
created: 2017-05-31T21:30:30.260Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1022
external_id: T1022
source_name: Zhang 2013
description: Zhang, H., Papadopoulos, C., & Massey, D. (2013, April). Detecting encrypted botnet traffic. Retrieved August 19, 2015.
url: http://www.netsec.colostate.edu/~zhang/DetectingEncryptedBotnetTraffic.pdf
source_name: Wikipedia File Header Signatures
description: Wikipedia. (2016, March 31). List of file signatures. Retrieved April 22, 2016.
url: https://en.wikipedia.org/wiki/List_of_file_signatures
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:27.757Z
name: Data Encrypted
description: Data is encrypted before being exfiltrated in order to hide the information that is being exfiltrated from detection or to make the exfiltration less conspicuous upon inspection by a defender. The encryption is performed by a utility, programming library, or custom algorithm on the data itself and is considered separate from any encryption performed by the command and control or file transfer protocol. Common file archive formats that can encrypt files are RAR and zip.

Other exfiltration techniques likely apply as well to transfer the information out of the network, such as [Exfiltration Over C2 Channel](https://attack.mitre.org/techniques/T1041) and [Exfiltration Over Alternative Protocol](https://attack.mitre.org/techniques/T1048)
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: exfiltration
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
macOS
Windows
x_mitre_version: 1.1