auren-research/cyber-sec huggingface dataset:
type: attack-pattern
spec_version: 2.1
id: attack-pattern--63220765-d418-44de-8fae-694b3912317d
created: 2020-01-24T14:17:43.906Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1546/005
external_id: T1546.005
source_name: Trap Manual
description: ss64. (n.d.). trap. Retrieved May 21, 2019.
url: https://ss64.com/bash/trap.html
source_name: Cyberciti Trap Statements
description: Cyberciti. (2016, March 29). Trap statement. Retrieved May 21, 2019.
url: https://bash.cyberciti.biz/guide/Trap_statement
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:51.725Z
name: Trap
description: Adversaries may establish persistence by executing malicious content triggered by an interrupt signal. The trap command allows programs and shells to specify commands that will be executed upon receiving interrupt signals. A common situation is a script allowing for graceful termination and handling of common keyboard interrupts like ctrl+c and ctrl+d.

Adversaries can use this to register code to be executed when the shell encounters specific interrupts as a persistence mechanism. Trap commands are of the following format trap 'command list' signals where "command list" will be executed when "signals" are received.(Citation: Trap Manual)(Citation: Cyberciti Trap Statements)
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: privilege-escalation
kill_chain_name: mitre-attack
phase_name: persistence
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: macOS
Linux
x_mitre_version: 1.1
type: attack-pattern
spec_version: 2.1
id: attack-pattern--635cbe30-392d-4e27-978e-66774357c762
created: 2020-01-28T13:50:22.506Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1136/001
external_id: T1136.001
source_name: cisco_username_cmd
description: Cisco. (2023, March 6). username - Cisco IOS Security Command Reference: Commands S to Z. Retrieved July 13, 2022.
url: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/s1/sec-s1-cr-book/sec-cr-t2.html#wp1047035630
source_name: Cyber Security News
description: Kaaviya. (n.d.). SuperBlack Actors Exploiting Two Fortinet Vulnerabilities to Deploy Ransomware. Retrieved September 22, 2025.
url: https://cybersecuritynews.com/superblack-actors-exploiting-two-fortinet-vulnerabilities/
source_name: Kubernetes Service Accounts Security
description: Kubernetes. (n.d.). Service Accounts. Retrieved July 14, 2023.
url: https://kubernetes.io/docs/concepts/security/service-accounts/
source_name: Microsoft User Creation Event
description: Lich, B., Miroshnikov, A. (2017, April 5). 4720(S): A user account was created. Retrieved June 30, 2017.
url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4720
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:51.903Z
name: Local Account
description: Adversaries may create a local account to maintain access to victim systems. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. 

For example, with a sufficient level of access, the Windows net user /add command can be used to create a local account. In Linux, the `useradd` command can be used, while on macOS systems, the dscl -create command can be used. Local accounts may also be added to network devices, often via common [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) commands such as username, to ESXi servers via `esxcli system account add`, or to Kubernetes clusters using the `kubectl` utility.(Citation: cisco_username_cmd)(Citation: Kubernetes Service Accounts Security)

Adversaries may also create new local accounts on network firewall management consoles – for example, by exploiting a vulnerable firewall management system, threat actors may be able to establish super-admin accounts that could be used to modify firewall rules and gain further access to the network.(Citation: Cyber Security News)

Such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: persistence
x_mitre_attack_spec_version: 3.3.0
x_mitre_contributors: Austin Clark, @c2defense
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
macOS
Windows
Network Devices
Containers
ESXi
x_mitre_version: 1.5
type: attack-pattern
spec_version: 2.1
id: attack-pattern--63b24abc-5702-4745-b1e4-ac70b20a43f2
created: 2025-09-26T15:42:30.468Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1681
external_id: T1681
source_name: Sentinel One Contagious Interview ClickFix September 2025
description: Aleksandar Milenkoski, Sreekar Madabushi, Kenneth Kinion. (2025, September 4). Contagious Interview | North Korean Threat Actors Reveal Plans and Ops by Abusing Cyber Intel Platforms. Retrieved October 20, 2025.
url: https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/
source_name: Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023
description: Alexander Marvi, Brad Slaybaugh, Ron Craft, and Rufus Brown. (2023, June 13). VMware ESXi Zero-Day Used by Chinese Espionage Actor to Perform Privileged Guest Operations on Compromised Hypervisors. Retrieved March 26, 2025.
url: https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:51.996Z
name: Search Threat Vendor Data
description: Threat actors may seek information/indicators from closed or open threat intelligence sources gathered about their own campaigns, as well as those conducted by other adversaries that may align with their target industries, capabilities/objectives, or other operational concerns. These reports may include descriptions of behavior, detailed breakdowns of attacks, atomic indicators such as malware hashes or IP addresses, timelines of a group’s activity, and more. Adversaries may change their behavior when planning their future operations. 

Adversaries have been observed replacing atomic indicators mentioned in blog posts in under a week.(Citation: Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023) Adversaries have also been seen searching for their own domain names in threat vendor data and then taking them down, likely to avoid seizure or further investigation.(Citation: Sentinel One Contagious Interview ClickFix September 2025)

This technique is distinct from [Threat Intel Vendors](https://attack.mitre.org/techniques/T1597/001) in that it describes threat actors performing reconnaissance on their own activity, not in search of victim information. 
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: reconnaissance
x_mitre_attack_spec_version: 3.3.0
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: PRE
x_mitre_version: 1.0
type: attack-pattern
spec_version: 2.1
id: attack-pattern--63e3d25c-d57d-407d-8e6a-2cecd71f90be
created: 2025-03-27T18:14:06.330Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1674
external_id: T1674
source_name: BleepingComputer BackSwap
description: Catalin Cimpanu. (2018, May 25). BackSwap Banking Trojan Uses Never-Before-Seen Techniques. Retrieved March 27, 2025.
url: https://www.bleepingcomputer.com/news/security/backswap-banking-trojan-uses-never-before-seen-techniques/
source_name: BleepingComputer USB
description: Ionut Ilascu. (2020, March 27). FBI: Hackers Sending Malicious USB Drives & Teddy Bears via USPS. Retrieved March 27, 2025.
url: https://www.bleepingcomputer.com/news/security/fbi-hackers-sending-malicious-usb-drives-and-teddy-bears-via-usps/
source_name: welivesecurity BackSwap
description: Michal Poslušný. (2018, May 25). BackSwap malware finds innovative ways to empty bank accounts. Retrieved March 27, 2025.
url: https://www.welivesecurity.com/2018/05/25/backswap-malware-empty-bank-accounts/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-15T19:58:36.409Z
name: Input Injection
description: Adversaries may simulate keystrokes on a victim’s computer by various means to perform any type of action on behalf of the user, such as launching the command interpreter using keyboard shortcuts, typing an inline script to be executed, or interacting directly with a GUI-based application. These actions can be preprogrammed into adversary tooling or executed through physical devices such as Human Interface Devices (HIDs).

For example, adversaries have used tooling that monitors the Windows message loop to detect when a user visits bank-specific URLs. If detected, the tool then simulates keystrokes to open the developer console or select the address bar, pastes malicious JavaScript from the clipboard, and executes it - enabling manipulation of content within the browser, such as replacing bank account numbers during transactions.(Citation: BleepingComputer BackSwap)(Citation: welivesecurity BackSwap)

Adversaries have also used malicious USB devices to emulate keystrokes that launch PowerShell, leading to the download and execution of malware from adversary-controlled servers.(Citation: BleepingComputer USB)
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: execution
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Alexey Kleymenov
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
macOS
Linux
x_mitre_version: 1.0
type: attack-pattern
spec_version: 2.1
id: attack-pattern--64196062-5210-42c3-9a02-563a0d1797ef
created: 2017-05-31T21:31:09.379Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1092
external_id: T1092
source_name: ESET Sednit USBStealer 2014
description: Calvet, J. (2014, November 11). Sednit Espionage Group Attacking Air-Gapped Networks. Retrieved January 4, 2017.
url: http://www.welivesecurity.com/2014/11/11/sednit-espionage-group-attacking-air-gapped-networks/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:52.106Z
name: Communication Through Removable Media
description: Adversaries can perform command and control between compromised hosts on potentially disconnected networks using removable media to transfer commands from system to system.(Citation: ESET Sednit USBStealer 2014) Both systems would need to be compromised, with the likelihood that an Internet-connected system was compromised first and the second through lateral movement by [Replication Through Removable Media](https://attack.mitre.org/techniques/T1091). Commands and files would be relayed from the disconnected system to the Internet-connected system to which the adversary has direct access.
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: command-and-control
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
macOS
Windows
x_mitre_version: 1.0
type: attack-pattern
spec_version: 2.1
id: attack-pattern--6495ae23-3ab4-43c5-a94f-5638a2c31fd2
created: 2020-01-28T17:05:14.707Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1070/001
external_id: T1070.001
source_name: disable_win_evt_logging
description: Heiligenstein, L. (n.d.). REP-25: Disable Windows Event Logging. Retrieved April 7, 2022.
url: https://ptylu.github.io/content/report/report.html?report=25
source_name: Microsoft Clear-EventLog
description: Microsoft. (n.d.). Clear-EventLog. Retrieved July 2, 2018.
url: https://docs.microsoft.com/powershell/module/microsoft.powershell.management/clear-eventlog
source_name: Microsoft EventLog.Clear
description: Microsoft. (n.d.). EventLog.Clear Method (). Retrieved July 2, 2018.
url: https://msdn.microsoft.com/library/system.diagnostics.eventlog.clear.aspx
source_name: Microsoft wevtutil Oct 2017
description: Plett, C. et al.. (2017, October 16). wevtutil. Retrieved July 2, 2018.
url: https://docs.microsoft.com/windows-server/administration/windows-commands/wevtutil
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:52.287Z
name: Clear Windows Event Logs
description: Adversaries may clear Windows Event Logs to hide the activity of an intrusion. Windows Event Logs are a record of a computer's alerts and notifications. There are three system-defined sources of events: System, Application, and Security, with five event types: Error, Warning, Information, Success Audit, and Failure Audit.


With administrator privileges, the event logs can be cleared with the following utility commands:

* wevtutil cl system
* wevtutil cl application
* wevtutil cl security

These logs may also be cleared through other mechanisms, such as the event viewer GUI or [PowerShell](https://attack.mitre.org/techniques/T1059/001). For example, adversaries may use the PowerShell command Remove-EventLog -LogName Security to delete the Security EventLog and after reboot, disable future logging. Note: events may still be generated and logged in the .evtx file between the time the command is run and the reboot.(Citation: disable_win_evt_logging)

Adversaries may also attempt to clear logs by directly deleting the stored log files within `C:\Windows\System32\winevt\logs\`.
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: defense-evasion
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Lucas Heiligenstein
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
x_mitre_version: 1.5
type: attack-pattern
spec_version: 2.1
id: attack-pattern--65013dd2-bc61-43e3-afb5-a14c4fa7437a
created: 2020-10-01T01:09:53.217Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1585/002
external_id: T1585.002
source_name: Trend Micro R980 2016
description: Antazo, F. and Yambao, M. (2016, August 10). R980 Ransomware Found Abusing Disposable Email Address Service. Retrieved October 13, 2020.
url: https://blog.trendmicro.com/trendlabs-security-intelligence/r980-ransomware-disposable-email-service/
source_name: Free Trial PurpleUrchin
description: Gamazo, William. Quist, Nathaniel.. (2023, January 5). PurpleUrchin Bypasses CAPTCHA and Steals Cloud Platform Resources. Retrieved February 28, 2024.
url: https://unit42.paloaltonetworks.com/purpleurchin-steals-cloud-resources/
source_name: Mandiant APT1
description: Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.
url: https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:52.378Z
name: Email Accounts
description: Adversaries may create email accounts that can be used during targeting. Adversaries can use accounts created with email providers to further their operations, such as leveraging them to conduct [Phishing for Information](https://attack.mitre.org/techniques/T1598) or [Phishing](https://attack.mitre.org/techniques/T1566).(Citation: Mandiant APT1) Establishing email accounts may also allow adversaries to abuse free services – such as trial periods – to [Acquire Infrastructure](https://attack.mitre.org/techniques/T1583) for follow-on purposes.(Citation: Free Trial PurpleUrchin)

Adversaries may also take steps to cultivate a persona around the email account, such as through use of [Social Media Accounts](https://attack.mitre.org/techniques/T1585/001), to increase the chance of success of follow-on behaviors. Created email accounts can also be used in the acquisition of infrastructure (ex: [Domains](https://attack.mitre.org/techniques/T1583/001)).(Citation: Mandiant APT1)

To decrease the chance of physically tying back operations to themselves, adversaries may make use of disposable email services.(Citation: Trend Micro R980 2016) 
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: resource-development
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: PRE
x_mitre_version: 1.1
type: attack-pattern
spec_version: 2.1
id: attack-pattern--6636bc83-0611-45a6-b74f-1f3daf635b8e
created: 2019-12-03T12:59:36.749Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: yes
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1053/001
external_id: T1053.001
source_name: rowland linux at 2019
description: Craig Rowland. (2019, July 25). Getting an Attacker IP Address from a Malicious Linux At Job. Retrieved October 15, 2021.
url: https://www.linkedin.com/pulse/getting-attacker-ip-address-from-malicious-linux-job-craig-rowland/
source_name: GTFObins at
description: Emilio Pinna, Andrea Cardaci. (n.d.). gtfobins at. Retrieved September 28, 2021.
url: https://gtfobins.github.io/gtfobins/at/
source_name: Kifarunix - Task Scheduling in Linux
description: Koromicha. (2019, September 7). Scheduling tasks using at command in Linux. Retrieved December 3, 2019.
url: https://kifarunix.com/scheduling-tasks-using-at-command-in-linux/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:52.747Z
name: At (Linux)
description: Adversaries may abuse the [at](https://attack.mitre.org/software/S0110) utility to perform task scheduling for initial, recurring, or future execution of malicious code. The [at](https://attack.mitre.org/software/S0110) command within Linux operating systems enables administrators to schedule tasks.(Citation: Kifarunix - Task Scheduling in Linux)

An adversary may use [at](https://attack.mitre.org/software/S0110) in Linux environments to execute programs at system startup or on a scheduled basis for persistence. [at](https://attack.mitre.org/software/S0110) can also be abused to conduct remote Execution as part of Lateral Movement and or to run a process under the context of a specified account.

Adversaries may also abuse [at](https://attack.mitre.org/software/S0110) to break out of restricted environments by using a task to spawn an interactive system shell or to run system commands. Similarly, [at](https://attack.mitre.org/software/S0110) may also be used for [Privilege Escalation](https://attack.mitre.org/tactics/TA0004) if the binary is allowed to run as superuser via sudo.(Citation: GTFObins at)
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: execution
kill_chain_name: mitre-attack
phase_name: persistence
kill_chain_name: mitre-attack
phase_name: privilege-escalation
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: yes
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
x_mitre_version: 1.2
type: attack-pattern
spec_version: 2.1
id: attack-pattern--67073dde-d720-45ae-83da-b12d5e73ca3b
created: 2020-10-02T16:53:16.526Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1595
external_id: T1595
source_name: Botnet Scan
description: Dainotti, A. et al. (2012). Analysis of a “/0” Stealth Scan from a Botnet. Retrieved October 20, 2020.
url: https://www.caida.org/publications/papers/2012/analysis_slash_zero/analysis_slash_zero.pdf
source_name: OWASP Fingerprinting
description: OWASP Wiki. (2018, February 16). OAT-004 Fingerprinting. Retrieved October 20, 2020.
url: https://wiki.owasp.org/index.php/OAT-004_Fingerprinting
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:48:53.018Z
name: Active Scanning
description: Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction.

Adversaries may perform different forms of active scanning depending on what information they seek to gather. These scans can also be performed in various ways, including using native features of network protocols such as ICMP.(Citation: Botnet Scan)(Citation: OWASP Fingerprinting) Information from these scans may reveal opportunities for other forms of reconnaissance (ex: [Search Open Websites/Domains](https://attack.mitre.org/techniques/T1593) or [Search Open Technical Databases](https://attack.mitre.org/techniques/T1596)), establishing operational resources (ex: [Develop Capabilities](https://attack.mitre.org/techniques/T1587) or [Obtain Capabilities](https://attack.mitre.org/techniques/T1588)), and/or initial access (ex: [External Remote Services](https://attack.mitre.org/techniques/T1133) or [Exploit Public-Facing Application](https://attack.mitre.org/techniques/T1190)).
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: reconnaissance
x_mitre_attack_spec_version: 3.2.0
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: PRE
x_mitre_version: 1.0