auren-research/cyber-sec huggingface dataset:
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--73691708-ffb5-4e29-906d-f485f6fa7089
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0017
external_id: DS0017
source_name: Confluence Linux Command Line
description: Confluence Support. (2021, September 8). How to enable command line audit logging in linux. Retrieved September 23, 2021.
url: https://confluence.atlassian.com/confkb/how-to-enable-command-line-audit-logging-in-linux-956166545.html
source_name: Audit OSX
description: Gagliardi, R. (n.d.). Audit in a OS X System. Retrieved September 23, 2021.
url: https://www.scip.ch/en/?labs.20150108
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Command
description: A directive given to a computer program, acting as an interpreter of some kind, in order to perform a specific task(Citation: Confluence Linux Command Line)(Citation: Audit OSX)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Containers
Linux
Network Devices
Windows
macOS
Android
iOS
ESXi
x_mitre_deprecated: yes
x_mitre_domains: ics-attack
mobile-attack
enterprise-attack
x_mitre_version: 1.2
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
Austin Clark, @c2defense
x_mitre_collection_layers: Container
Host
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--8765a845-dea1-4cd1-a56f-f54939b7ab9e
created: 2021-10-20T15:05:19.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0008
external_id: DS0008
source_name: STIG Audit Kernel Modules
description: Unified Compliance Framework. (2016, December 20). The audit system must be configured to audit the loading and unloading of dynamic kernel modules.. Retrieved September 28, 2021.
url: https://www.stigviewer.com/stig/oracle_linux_5/2016-12-20/finding/V-22383
source_name: Init Man Page
description: Kerrisk, M. (2021, March 22). INIT_MODULE(2). Retrieved September 28, 2021.
url: https://man7.org/linux/man-pages/man2/init_module.2.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Kernel
description: A computer program, at the core of a computer OS, that resides in memory and facilitates interactions between hardware and software components(Citation: STIG Audit Kernel Modules)(Citation: Init Man Page)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
macOS
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_collection_layers: Host
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--9ec8c0d7-6137-456f-b829-c5f8b96ba054
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0027
external_id: DS0027
source_name: IOKit Fundamentals
description: Apple. (2014, April 9). What Is the I/O Kit?. Retrieved September 24, 2021.
url: https://developer.apple.com/library/archive/documentation/DeviceDrivers/Conceptual/IOKitFundamentals/Features/Features.html
source_name: Windows Getting Started Drivers
description: Viviano, A. (2021, August 17). Getting started with Windows drivers: User mode and kernel mode. Retrieved September 24, 2021.
url: https://docs.microsoft.com/en-us/windows-hardware/drivers/gettingstarted/user-mode-and-kernel-mode
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Driver
description: A computer program that operates or controls a particular type of device that is attached to a computer. Provides a software interface to hardware devices, enabling operating systems and other computer programs to access hardware functions without needing to know precise details about the hardware being used(Citation: IOKit Fundamentals)(Citation: Windows Getting Started Drivers)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
Windows
macOS
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_collection_layers: Host
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--b0b6d26f-3747-4444-ac7a-239a6ff80cb5
created: 2021-10-20T15:05:19.275Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0034
external_id: DS0034
source_name: Amazon S3
description: Amazon. (n.d.). Amazon S3. Retrieved October 13, 2021.
url: https://aws.amazon.com/s3/
source_name: Google Cloud Storage
description: Google. (n.d.). Cloud Storage. Retrieved October 13, 2021.
url: https://cloud.google.com/storage
source_name: Azure Blob Storage
description: Microsoft. (n.d.). Azure Blob Storage. Retrieved November 17, 2024.
url: https://azure.microsoft.com/en-us/products/storage/blobs/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Volume
description: Block object storage hosted on-premise or by third-party providers, typically made available to resources as virtualized hard drives(Citation: Amazon S3)(Citation: Azure Blob Storage)(Citation: Google Cloud Storage)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: IaaS
Linux
Windows
macOS
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_collection_layers: Cloud Control Plane
Host
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--b1ddede4-cafe-4955-ac4c-14b33ac3f647
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0025
external_id: DS0025
source_name: Amazon AWS
description: Amazon. (n.d.). Start Building on AWS Today. Retrieved October 13, 2021.
url: https://aws.amazon.com
source_name: Azure Products
description: Microsoft. (n.d.). Azure products. Retrieved November 17, 2024.
url: https://azure.microsoft.com/en-us/products/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Cloud Service
description: Infrastructure, platforms, or software that are hosted on-premise or by third-party providers, made available to users through network connections and/or APIs(Citation: Amazon AWS)(Citation: Azure Products)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: IaaS
SaaS
Office Suite
Identity Provider
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_collection_layers: Cloud Control Plane
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--b86d9b40-5fbe-4ef1-8dc3-263eff26f495
created: 2021-10-20T15:05:19.271Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0004
external_id: DS0004
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Malware Repository
description: Information obtained (via shared or submitted samples) regarding malicious software (droppers, backdoors, etc.) used by adversaries
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: PRE
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_collection_layers: OSINT
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--ba27545a-9c32-47ea-ba6a-cce50f1b326e
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0033
external_id: DS0033
source_name: Microsoft NFS Overview
description: Microsoft. (2018, July 9). Network File System overview. Retrieved September 28, 2021.
url: https://docs.microsoft.com/en-us/windows-server/storage/nfs/nfs-overview
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Network Share
description: A storage resource (typically a folder or drive) made available from one host to others using network protocols, such as Server Message Block (SMB) or Network File System (NFS)(Citation: Microsoft NFS Overview)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
Windows
macOS
x_mitre_deprecated: yes
x_mitre_domains: ics-attack
enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_collection_layers: Host
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--c000cd5c-bbb3-4606-af6f-6c6d9de0bbe3
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0029
external_id: DS0029
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Network Traffic
description: Data transmitted across a network (ex: Web, DNS, Mail, File, etc.), that is either summarized (ex: Netflow) and/or captured as raw data in an analyzable format (ex: PCAP)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: IaaS
Linux
Windows
macOS
Android
iOS
ESXi
x_mitre_deprecated: yes
x_mitre_domains: ics-attack
mobile-attack
enterprise-attack
x_mitre_version: 1.2
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
ExtraHop
x_mitre_collection_layers: Cloud Control Plane
Host
Network
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--c3af32ff-65c5-4ea8-912a-fb4a85197239
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0031
external_id: DS0031
source_name: Kube Cluster Admin
description: kubernetes. (2021, January 16). Cluster Administration. Retrieved October 13, 2021.
url: https://kubernetes.io/docs/concepts/cluster-administration/
source_name: Kube Cluster Info
description: kubernetes. (n.d.). cluster-info. Retrieved October 13, 2021.
url: https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#cluster-info
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-18T15:23:44.367Z
name: Cluster
description: A set of containerized computing resources that are managed together but have separate nodes to execute various tasks and/or applications(Citation: Kube Cluster Admin)(Citation: Kube Cluster Info)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Containers
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_collection_layers: Container
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--c9ddfb51-eb45-4e22-b614-44ac1caa7883
created: 2021-10-20T15:05:19.271Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0003
external_id: DS0003
source_name: Microsoft Tasks
description: Microsoft. (2018, May 31). Tasks. Retrieved September 28, 2021.
url: https://docs.microsoft.com/en-us/windows/win32/taskschd/tasks
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Scheduled Job
description: Automated tasks that can be executed at a specific time or on a recurring schedule running in the background (ex: Cron daemon, task scheduler, BITS)(Citation: Microsoft Tasks)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Containers
Linux
Windows
macOS
ESXi
x_mitre_deprecated: yes
x_mitre_domains: ics-attack
enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_collection_layers: Container
Host
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--ca1cb239-ff6d-4f64-b9d7-41c8556a8b4f
created: 2021-10-20T15:05:19.265Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0001
external_id: DS0001
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Firmware
description: Computer software that provides low-level control for the hardware and device(s) of a host, such as BIOS or UEFI/EFI
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
Windows
macOS
x_mitre_deprecated: yes
x_mitre_domains: ics-attack
enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_collection_layers: Host
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--d6188aac-17db-4861-845f-57c369f9b4c8
created: 2021-10-20T15:05:19.274Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0026
external_id: DS0026
source_name: Microsoft AD DS Getting Started
description: Foulds, I. et al. (2018, August 7). AD DS Getting Started. Retrieved September 23, 2021.
url: https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/ad-ds-getting-started
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Active Directory
description: A database and set of services that allows administrators to manage permissions, access to network resources, and stored data objects (user, group, application, or devices)(Citation: Microsoft AD DS Getting Started)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Windows
Identity Provider
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_collection_layers: Cloud Control Plane
Host
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--d710099e-df94-4be4-bf85-cabd30e912bb
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0019
external_id: DS0019
source_name: Microsoft Services
description: Microsoft. (2017, March 30). Introduction to Windows Service Applications. Retrieved September 28, 2021.
url: https://docs.microsoft.com/en-us/dotnet/framework/windows-services/introduction-to-windows-service-applications
source_name: Linux Services Run Levels
description: The Linux Foundation. (2006, January 11). An introduction to services, runlevels, and rc.d scripts. Retrieved September 28, 2021.
url: https://www.linux.com/news/introduction-services-runlevels-and-rcd-scripts/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Service
description: A computer process that is configured to execute continuously in the background and perform system tasks, in some cases before any user has logged in(Citation: Microsoft Services)(Citation: Linux Services Run Levels)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
Windows
macOS
ESXi
x_mitre_deprecated: yes
x_mitre_domains: ics-attack
enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_collection_layers: Host
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--dd75f457-8dc0-4a24-9ae5-4b61c33af866
created: 2021-10-20T15:05:19.275Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0038
external_id: DS0038
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Domain Name
description: Information obtained (commonly through registration or activity logs) regarding one or more IP addresses registered with human readable names (ex: mitre.org)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: PRE
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_collection_layers: OSINT
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--e8b8ede7-337b-4c0c-8c32-5c7872c1ee22
created: 2021-10-20T15:05:19.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0009
external_id: DS0009
source_name: Microsoft Processes and Threads
description: Microsoft. (2018, May 31). Processes and Threads. Retrieved September 28, 2021.
url: https://docs.microsoft.com/en-us/windows/win32/procthread/processes-and-threads
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Process
description: Instances of computer programs that are being executed by at least one thread. Processes have memory space for process executables, loaded modules (DLLs or shared libraries), and allocated memory regions containing everything from user input to application-specific data structures(Citation: Microsoft Processes and Threads)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
Windows
macOS
Android
iOS
ESXi
x_mitre_deprecated: yes
x_mitre_domains: ics-attack
mobile-attack
enterprise-attack
x_mitre_version: 1.2
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_collection_layers: Host
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--f2f4f4bd-3455-400f-b2ee-104004df0f5b
created: 2021-10-20T15:05:19.273Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0018
external_id: DS0018
source_name: AWS Sec Groups VPC
description: Amazon. (n.d.). Security groups for your VPC. Retrieved October 13, 2021.
url: https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Firewall
description: A network security system, running locally on an endpoint or remotely as a service (ex: cloud environment), that monitors and controls incoming/outgoing network traffic based on predefined rules(Citation: AWS Sec Groups VPC)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: IaaS
Linux
SaaS
Windows
macOS
Office Suite
Identity Provider
ESXi
x_mitre_deprecated: yes
x_mitre_domains: enterprise-attack
x_mitre_version: 1.1
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_collection_layers: Cloud Control Plane
Host
type: x-mitre-data-source
spec_version: 2.1
id: x-mitre-data-source--f424e4b4-a8a4-4c58-a4ae-4f53bfd08563
created: 2021-10-20T15:05:19.272Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datasources/DS0011
external_id: DS0011
source_name: Microsoft LoadLibrary
description: Microsoft. (2018, December 5). LoadLibraryA function (libloaderapi.h). Retrieved September 28, 2021.
url: https://docs.microsoft.com/en-us/windows/win32/api/libloaderapi/nf-libloaderapi-loadlibrarya
source_name: Microsoft Module Class
description: Microsoft. (n.d.). Module Class. Retrieved September 28, 2021.
url: https://docs.microsoft.com/en-us/dotnet/api/system.reflection.module
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-21T15:10:28.402Z
name: Module
description: Executable files consisting of one or more shared classes and interfaces, such as portable executable (PE) format binaries/dynamic link libraries (DLL), executable and linkable format (ELF) binaries/shared libraries, and Mach-O format binaries/shared libraries(Citation: Microsoft LoadLibrary)(Citation: Microsoft Module Class)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Linux
Windows
macOS
x_mitre_deprecated: yes
x_mitre_domains: ics-attack
enterprise-attack
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Center for Threat-Informed Defense (CTID)
x_mitre_collection_layers: Host
type: campaign
spec_version: 2.1
id: campaign--df74f7ad-b10d-431c-9f1d-a2bc18dadefa
created: 2023-06-30T19:28:30.616Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/campaigns/C0027
external_id: C0027
source_name: Crowdstrike TELCO BPO Campaign December 2022
description: Parisi, T. (2022, December 2). Not a SIMulation: CrowdStrike Investigations Reveal Intrusion Campaign Targeting Telco and BPO Companies. Retrieved June 30, 2023.
url: https://www.crowdstrike.com/blog/analysis-of-intrusion-campaign-targeting-telecom-and-bpo-companies/
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-04-16T20:37:45.650Z
name: C0027
description: [C0027](https://attack.mitre.org/campaigns/C0027) was a financially-motivated campaign linked to [Scattered Spider](https://attack.mitre.org/groups/G1015) that targeted telecommunications and business process outsourcing (BPO) companies from at least June through December of 2022. During [C0027](https://attack.mitre.org/campaigns/C0027) [Scattered Spider](https://attack.mitre.org/groups/G1015) used various forms of social engineering, performed SIM swapping, and attempted to leverage access from victim environments to mobile carrier networks.(Citation: Crowdstrike TELCO BPO Campaign December 2022)

aliases: C0027
first_seen: 2022-06-01T04:00:00.000Z
last_seen: 2022-12-01T05:00:00.000Z
x_mitre_first_seen_citation: (Citation: Crowdstrike TELCO BPO Campaign December 2022)
x_mitre_last_seen_citation: (Citation: Crowdstrike TELCO BPO Campaign December 2022)
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_version: 1.0
x_mitre_attack_spec_version: 3.2.0
x_mitre_domains: enterprise-attack