auren-research/cyber-sec huggingface dataset:
type: attack-pattern
spec_version: 2.1
id: attack-pattern--791481f8-e96a-41be-b089-a088763083d4
created: 2019-12-19T20:21:21.669Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1542/002
external_id: T1542.002
source_name: ITWorld Hard Disk Health Dec 2014
description: Pinola, M. (2014, December 14). 3 tools to check your hard drive's health and make sure it's not already dying on you. Retrieved November 17, 2024.
url: https://www.computerworld.com/article/1484887/3-tools-to-check-your-hard-drives-health-and-make-sure-its-not-already-dying-on-you.html
source_name: SanDisk SMART
description: SanDisk. (n.d.). Self-Monitoring, Analysis and Reporting Technology (S.M.A.R.T.). Retrieved October 2, 2018.
source_name: SmartMontools
description: smartmontools. (n.d.). smartmontools. Retrieved October 2, 2018.
url: https://www.smartmontools.org/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:59.147Z
name: Component Firmware
description: Adversaries may modify component firmware to persist on systems. Some adversaries may employ sophisticated means to compromise computer components and install malicious firmware that will execute adversary code outside of the operating system and main system firmware or BIOS. This technique may be similar to [System Firmware](https://attack.mitre.org/techniques/T1542/001) but conducted upon other system components/devices that may not have the same capability or level of integrity checking.

Malicious component firmware could provide both a persistent level of access to systems despite potential typical failures to maintain access and hard disk re-images, as well as a way to evade host software-based defenses and integrity checks.
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: persistence
kill_chain_name: mitre-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
Linux
macOS
x_mitre_version: 1.2
type: attack-pattern
spec_version: 2.1
id: attack-pattern--799ace7f-e227-4411-baa0-8868704f2a69
created: 2017-05-31T21:30:55.892Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1070
external_id: T1070
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:59.237Z
name: Indicator Removal
description: Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.

Removal of these indicators may interfere with event collection, reporting, or other processes used to detect intrusion activity. This may compromise the integrity of security solutions by causing notable events to go unreported. This activity may also impede forensic analysis and incident response, due to lack of sufficient data to determine what occurred.
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Brad Geesaman, @bradgeesaman
Ed Williams, Trustwave, SpiderLabs
Blake Strom, Microsoft 365 Defender
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Containers
ESXi
Linux
macOS
Network Devices
Office Suite
Windows
x_mitre_version: 2.4
type: attack-pattern
spec_version: 2.1
id: attack-pattern--79a4052e-1a89-4b09-aea6-51f1d11fe19c
created: 2020-03-15T15:30:42.378Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1048/001
external_id: T1048.001
source_name: University of Birmingham C2
description: Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
url: https://arxiv.org/ftp/arxiv/papers/1408/1408.1136.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:59.332Z
name: Exfiltration Over Symmetric Encrypted Non-C2 Protocol
description: Adversaries may steal data by exfiltrating it over a symmetrically encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. 

Symmetric encryption algorithms are those that use shared or the same keys/secrets on each end of the channel. This requires an exchange or pre-arranged agreement/possession of the value used to encrypt and decrypt data. 

Network protocols that use asymmetric encryption often utilize symmetric encryption once keys are exchanged, but adversaries may opt to manually share keys and implement symmetric cryptographic algorithms (ex: RC4, AES) vice using mechanisms that are baked into a protocol. This may result in multiple layers of encryption (in protocols that are natively encrypted such as HTTPS) or encryption in protocols that not typically encrypted (such as HTTP or FTP). 
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: exfiltration
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
macOS
Windows
ESXi
x_mitre_version: 1.1
type: attack-pattern
spec_version: 2.1
id: attack-pattern--79da0971-3147-4af6-a4f5-e8cd447cd795
created: 2020-10-01T00:44:23.935Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1583/003
external_id: T1583.003
source_name: Koczwara Beacon Hunting Sep 2021
description: Koczwara, M. (2021, September 7). Hunting Cobalt Strike C2 with Shodan. Retrieved October 12, 2021.
url: https://michaelkoczwara.medium.com/cobalt-strike-c2-hunting-with-shodan-c448d501a6e2
source_name: TrendmicroHideoutsLease
description: Max Goncharov. (2015, July 15). Criminal Hideouts for Lease: Bulletproof Hosting Services. Retrieved March 6, 2017.
url: https://documents.trendmicro.com/assets/wp/wp-criminal-hideouts-for-lease.pdf
source_name: Mandiant SCANdalous Jul 2020
description: Stephens, A. (2020, July 13). SCANdalous! (External Detection Using Network Scan Data and Automation). Retrieved November 17, 2024.
url: https://cloud.google.com/blog/topics/threat-intelligence/scandalous-external-detection-using-network-scan-data-and-automation/
source_name: ThreatConnect Infrastructure Dec 2020
description: ThreatConnect. (2020, December 15). Infrastructure Research and Hunting: Boiling the Domain Ocean. Retrieved October 12, 2021.
url: https://threatconnect.com/blog/infrastructure-research-hunting/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:59.607Z
name: Virtual Private Server
description: Adversaries may rent Virtual Private Servers (VPSs) that can be used during targeting. There exist a variety of cloud service providers that will sell virtual machines/containers as a service. By utilizing a VPS, adversaries can make it difficult to physically tie back operations to them. The use of cloud infrastructure can also make it easier for adversaries to rapidly provision, modify, and shut down their infrastructure.

Acquiring a VPS for use in later stages of the adversary lifecycle, such as Command and Control, can allow adversaries to benefit from the ubiquity and trust associated with higher reputation cloud service providers. Adversaries may also acquire infrastructure from VPS service providers that are known for renting VPSs with minimal registration information, allowing for more anonymous acquisitions of infrastructure.(Citation: TrendmicroHideoutsLease)
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: resource-development
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: PRE
x_mitre_version: 1.1
type: attack-pattern
spec_version: 2.1
id: attack-pattern--7ad38ef1-381a-406d-872a-38b136eb5ecc
created: 2020-02-14T13:09:51.004Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1213/001
external_id: T1213.001
source_name: Atlassian Confluence Logging
description: Atlassian. (2018, January 9). How to Enable User Access Logging. Retrieved April 4, 2018.
url: https://confluence.atlassian.com/confkb/how-to-enable-user-access-logging-182943.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:59.776Z
name: Confluence
description: 
Adversaries may leverage Confluence repositories to mine valuable information. Often found in development environments alongside Atlassian JIRA, Confluence is generally used to store development-related documentation, however, in general may contain more diverse categories of useful information, such as:

* Policies, procedures, and standards
* Physical / logical network diagrams
* System architecture diagrams
* Technical system documentation
* Testing / development credentials (i.e., [Unsecured Credentials](https://attack.mitre.org/techniques/T1552))
* Work / project schedules
* Source code snippets
* Links to network shares and other internal resources

kill_chain_phases: kill_chain_name: mitre-attack
phase_name: collection
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: SaaS
x_mitre_version: 1.1
type: attack-pattern
spec_version: 2.1
id: attack-pattern--7b50a1d3-4ca7-45d1-989d-a6503f04bfe1
created: 2021-03-29T16:39:26.183Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1609
external_id: T1609
source_name: Docker Exec
description: Docker. (n.d.). Docker Exec. Retrieved March 29, 2021.
url: https://docs.docker.com/engine/reference/commandline/exec/
source_name: Docker Entrypoint
description: Docker. (n.d.). Docker run reference. Retrieved March 29, 2021.
url: https://docs.docker.com/engine/reference/run/#entrypoint-default-command-to-execute-at-runtime
source_name: Docker Daemon CLI
description: Docker. (n.d.). DockerD CLI. Retrieved March 29, 2021.
url: https://docs.docker.com/engine/reference/commandline/dockerd/
source_name: Kubectl Exec Get Shell
description: The Kubernetes Authors. (n.d.). Get a Shell to a Running Container. Retrieved March 29, 2021.
url: https://kubernetes.io/docs/tasks/debug-application-cluster/get-shell-running-container/
source_name: Kubernetes Kubelet
description: The Kubernetes Authors. (n.d.). Kubelet. Retrieved March 29, 2021.
url: https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/
source_name: Kubernetes API
description: The Kubernetes Authors. (n.d.). The Kubernetes API. Retrieved March 29, 2021.
url: https://kubernetes.io/docs/concepts/overview/kubernetes-api/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:59.945Z
name: Container Administration Command
description: Adversaries may abuse a container administration service to execute commands within a container. A container administration service such as the Docker daemon, the Kubernetes API server, or the kubelet may allow remote management of containers within an environment.(Citation: Docker Daemon CLI)(Citation: Kubernetes API)(Citation: Kubernetes Kubelet)

In Docker, adversaries may specify an entrypoint during container deployment that executes a script or command, or they may use a command such as docker exec to execute a command within a running container.(Citation: Docker Entrypoint)(Citation: Docker Exec) In Kubernetes, if an adversary has sufficient permissions, they may gain remote execution in a container in the cluster via interaction with the Kubernetes API server, the kubelet, or by running a command such as kubectl exec.(Citation: Kubectl Exec Get Shell)
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: execution
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Alfredo Oliveira, Trend Micro
David Fiser, @anu4is, Trend Micro
Brad Geesaman, @bradgeesaman
Center for Threat-Informed Defense (CTID)
Magno Logan, @magnologan, Trend Micro
Vishwas Manral, McAfee
Yossi Weizman, Azure Defender Research Team
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Containers
x_mitre_version: 1.3
type: attack-pattern
spec_version: 2.1
id: attack-pattern--7bc57495-ea59-4380-be31-a64af124ef18
created: 2017-05-31T21:31:04.710Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1083
external_id: T1083
source_name: Windows Commands JPCERT
description: Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.
url: https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html
source_name: US-CERT-TA18-106A
description: US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.
url: https://www.us-cert.gov/ncas/alerts/TA18-106A
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:00.036Z
name: File and Directory Discovery
description: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Many command shell utilities can be used to obtain this information. Examples include dir, tree, ls, find, and locate.(Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the [Native API](https://attack.mitre.org/techniques/T1106). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather file and directory information (e.g. dir, show flash, and/or nvram).(Citation: US-CERT-TA18-106A)

Some files and directories may require elevated or specific user permissions to access.
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: discovery
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Austin Clark, @c2defense
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: ESXi
Linux
macOS
Network Devices
Windows
x_mitre_version: 1.7
type: attack-pattern
spec_version: 2.1
id: attack-pattern--7bd9c723-2f78-4309-82c5-47cad406572b
created: 2020-03-10T17:28:11.747Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1568
external_id: T1568
source_name: Talos CCleanup 2017
description: Brumaghin, E. et al. (2017, September 18). CCleanup: A Vast Number of Machines at Risk. Retrieved March 9, 2018.
url: http://blog.talosintelligence.com/2017/09/avast-distributes-malware.html
source_name: FireEye POSHSPY April 2017
description: Dunwoody, M.. (2017, April 3). Dissecting One of APT29’s Fileless WMI and PowerShell Backdoors (POSHSPY). Retrieved April 5, 2017.
url: https://www.fireeye.com/blog/threat-research/2017/03/dissecting_one_ofap.html
source_name: ESET Sednit 2017 Activity
description: ESET. (2017, December 21). Sednit update: How Fancy Bear Spent the Year. Retrieved February 18, 2019.
url: https://www.welivesecurity.com/2017/12/21/sednit-update-fancy-bear-spent-year/
source_name: Data Driven Security DGA
description: Jacobs, J. (2014, October 2). Building a DGA Classifier: Part 2, Feature Engineering. Retrieved February 18, 2019.
url: https://datadrivensecurity.info/blog/posts/2014/Oct/dga-part2/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:00.128Z
name: Dynamic Resolution
description: Adversaries may dynamically establish connections to command and control infrastructure to evade common detections and remediations. This may be achieved by using malware that shares a common algorithm with the infrastructure the adversary uses to receive the malware's communications. These calculations can be used to dynamically adjust parameters such as the domain name, IP address, or port number the malware uses for command and control.

Adversaries may use dynamic resolution for the purpose of [Fallback Channels](https://attack.mitre.org/techniques/T1008). When contact is lost with the primary command and control server malware may employ dynamic resolution as a means to reestablishing command and control.(Citation: Talos CCleanup 2017)(Citation: FireEye POSHSPY April 2017)(Citation: ESET Sednit 2017 Activity)
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: command-and-control
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Chris Roffe
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
macOS
Windows
ESXi
x_mitre_version: 1.1
type: attack-pattern
spec_version: 2.1
id: attack-pattern--7bdca9d5-d500-4d7d-8c52-5fd47baf4c0c
created: 2020-02-10T20:30:07.426Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1036/004
external_id: T1036.004
source_name: Fysbis Dr Web Analysis
description: Doctor Web. (2014, November 21). Linux.BackDoor.Fysbis.1. Retrieved December 7, 2017.
url: https://vms.drweb.com/virus/?i=4276269
source_name: Palo Alto Shamoon Nov 2016
description: Falcone, R.. (2016, November 30). Shamoon 2: Return of the Disttrack Wiper. Retrieved January 11, 2017.
url: http://researchcenter.paloaltonetworks.com/2016/11/unit42-shamoon-2-return-disttrack-wiper/
source_name: Systemd Service Units
description: Freedesktop.org. (n.d.). systemd.service — Service unit configuration. Retrieved March 16, 2020.
url: https://www.freedesktop.org/software/systemd/man/systemd.service.html
source_name: TechNet Schtasks
description: Microsoft. (n.d.). Schtasks. Retrieved April 28, 2016.
url: https://technet.microsoft.com/en-us/library/bb490996.aspx
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:00.215Z
name: Masquerade Task or Service
description: Adversaries may attempt to manipulate the name of a task or service to make it appear legitimate or benign. Tasks/services executed by the Task Scheduler or systemd will typically be given a name and/or description.(Citation: TechNet Schtasks)(Citation: Systemd Service Units) Windows services will have a service name as well as a display name. Many benign tasks and services exist that have commonly associated names. Adversaries may give tasks or services names that are similar or identical to those of legitimate ones.

Tasks or services contain other fields, such as a description, that adversaries may attempt to make appear legitimate.(Citation: Palo Alto Shamoon Nov 2016)(Citation: Fysbis Dr Web Analysis)
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
macOS
Windows
x_mitre_version: 1.2
type: attack-pattern
spec_version: 2.1
id: attack-pattern--7d20fff9-8751-404e-badd-ccd71bda0236
created: 2022-04-09T15:06:32.458Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1647
external_id: T1647
source_name: eset_osx_flashback
description: ESET. (2012, January 1). OSX/Flashback. Retrieved April 19, 2022.
url: https://www.welivesecurity.com/wp-content/uploads/200x/white-papers/osx_flashback.pdf
source_name: fileinfo plist file description
description: FileInfo.com team. (2019, November 26). .PLIST File Extension. Retrieved October 12, 2021.
url: https://fileinfo.com/extension/plist
source_name: wardle chp2 persistence
description: Patrick Wardle. (2022, January 1). The Art of Mac Malware Volume 0x1:Analysis. Retrieved April 19, 2022.
url: https://taomm.org/PDFs/vol1/CH%200x02%20Persistence.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:00.573Z
name: Plist File Modification
description: Adversaries may modify property list files (plist files) to enable other malicious activity, while also potentially evading and bypassing system defenses. macOS applications use plist files, such as the info.plist file, to store properties and configuration settings that inform the operating system how to handle the application at runtime. Plist files are structured metadata in key-value pairs formatted in XML based on Apple's Core Foundation DTD. Plist files can be saved in text or binary format.(Citation: fileinfo plist file description) 

Adversaries can modify key-value pairs in plist files to influence system behaviors, such as hiding the execution of an application (i.e. [Hidden Window](https://attack.mitre.org/techniques/T1564/003)) or running additional commands for persistence (ex: [Launch Agent](https://attack.mitre.org/techniques/T1543/001)/[Launch Daemon](https://attack.mitre.org/techniques/T1543/004) or [Re-opened Applications](https://attack.mitre.org/techniques/T1547/007)).

For example, adversaries can add a malicious application path to the `~/Library/Preferences/com.apple.dock.plist` file, which controls apps that appear in the Dock. Adversaries can also modify the LSUIElement key in an application’s info.plist file to run the app in the background. Adversaries can also insert key-value pairs to insert environment variables, such as LSEnvironment, to enable persistence via [Dynamic Linker Hijacking](https://attack.mitre.org/techniques/T1574/006).(Citation: wardle chp2 persistence)(Citation: eset_osx_flashback)
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: macOS
x_mitre_version: 1.0