madox81/Adema_ATTACK_DS huggingface dataset:
Input: SILENTTRINITY can remove artifacts from the compromised host, including created Registry keys.

Tactics: TA0005
Techniques: T1070
Input: Enforce registration and execution of only legitimately signed service drivers where possible.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: GravityRAT has been delivered via Word documents using DDE for execution.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: AutoFocus customers may learn more from the DarkHydrus tag  IOC Related SHA256 Hashes Payloads cec36e8ed65ac6f250c05b4a17c09f58bb80c19b73169aaf40fa15c8d3a9a6a1 ac7f9c536153780ccbec949f23b86f3d16e3105a5f14bb667df752aa815b0dc4 a547a02eb4fcb8f446da9b50838503de0d46f9bb2fd197c9ff63021243ea6d88 d428d79f58425d831c2ee0a73f04749715e8c4dd30ccd81d92fe17485e6dfcda dd2625388bb2d2b02b6c10d4ee78f68a918b25ddd712a0862bcf92fa64284ffa b2571e3b4afbce56da8faa726b726eb465f2e5e5ed74cf3b172b5dd80460ad81 c8b3d4b6acce6b6655e17255ef7a214651b7fc4e43f9964df24556343393a1a3 ce84b3c7986e6a48ca3171e703e7083e769e9ced1bbdd7edf8f3eab7ce20fd00 99541ab28fc3328e25723607df4b0d9ea0a1af31b58e2da07eff9f15c4e6565c Delivery documents d393349a4ad00902e3d415b622cf27987a0170a786ca3a1f991a521bff645318 8063c3f134f4413b793dfc05f035b6480aa1636996e8ac4b94646292a5f87fde 9eac37a5c675cd1750cd50b01fc05085ce0092a19ba97026292a60b11b45bf49 cf9b2b40ac621aaf3241ff570bd7a238f6402102c29e4fbba3c5ce0cb8bc25f9 0a3d5b2a8ed60e0d96d5f0d9d6e00cd6ab882863afbb951f10c395a3d991fbc1 0b1d5e17443f0896c959d22fa15dadcae5ab083a35b3ff6cb48c7f967649ec82 870c8b29be2b596cc2e33045ec48c80251e668abd736cef9c5449df16cf2d3b8 ff0b59f23630f4a854448b82f1f0cd66bc4b1124a3f49f0aecaca28309673cb0 01fd7992aa71f4dca3a3766c438fbabe9aea78ca5812ab75b5371b48bd2625e2 6dcb3492a45a08127f9816a1b9e195de2bb7e0731c4e7168392d0e8068adae7a 47b8ad55b66cdcd78d972d6df5338b2e32c91af0a666531baf1621d2786e7870 776c056096f0e73898723c0807269bc299ae3bbd8e9542f0a1cbba0fd3470cb4 cf7863e023475d695c6f72c471d314b8b1781c6e9087ff4d70118b30205da5f0 e88045931b9d99511ce71cc94f2e3d1159581e5eb26d4e05146749e1620dc678 26e641a9149ff86759c317b57229f59ac48c5968846813cafb3c4e87c774e245 b5cfaac25d87a6e8ebabc918facce491788863f120371c9d00009d78b6a8c350 ad3fd1571277c7ce93dfbd58cee3b3bec84eeaf6bb29a279ecb6a656028f771c Related Domains maccaffe[.]com cisc0[.]net 0utl00k[.]net msdncss[.]com 0ffice[.]com 0ffiice[.]com micrrosoft[.]net anyconnect[.]stream bigip[.]stream  fortiweb[.]download  kaspersky[.]science  microtik[.]stream  owa365[.]bid  symanteclive[.]download  windowsdefender[.]win allexa[.]net kaspersky[.]host hotmai1[.]com 0utlook[.]bid

Tactics: TA0007
Techniques: T1087
Input: Imminent Monitor has leveraged CreateProcessW() call to execute the debugger.

Tactics: TA0002
Techniques: T1106
Input: Adversaries may utilize many different protocols, including those used for web browsing, transferring files, electronic mail, or DNS.

Tactics: TA0011
Techniques: T1071
Input: Have a strict approval policy for use of deployment systems.

Tactics: TA0002, TA0008
Techniques: T1072
Input: BabyShark has used dir to search for "programfiles" and "appdata".

Tactics: TA0007
Techniques: T1083
Input: BLUELIGHT can collect a list of anti-virus products installed on a machine.

Tactics: TA0007
Techniques: T1518.001, T1518
Input: The function will return a copy of the new session's access token and the adversary can use SetThreadToken to assign the token to a thread.

Tactics: TA0004, TA0005
Techniques: T1134.003, T1134
Input: Monitor executed commands and arguments that may attempt to exfiltrate data via a physical medium, such as a removable drive.

Tactics: TA0010
Techniques: T1052
Input: Lokibot has utilized multiple techniques to bypass UAC.

Tactics: TA0004, TA0005
Techniques: T1548.002, T1548
Input: CORALDECK has created password-protected RAR, WinImage, and zip archives to be exfiltrated.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Pasam creates a backdoor through which remote attackers can retrieve lists of files.

Tactics: TA0007
Techniques: T1083
Input: Adversaries may take advantage of these features to repeatedly execute malicious code and establish persistence.

Tactics: TA0003, TA0004
Techniques: T1547.004, T1547
Input: Monitor for executed commands and arguments that may attempt to find cloud groups and permission settings.

Tactics: TA0007
Techniques: T1069, T1069.003
Input: Adversaries may establish persistence by modifying RC scripts which are executed during a Unix-like system’s startup.

Tactics: TA0003, TA0004
Techniques: T1037.004, T1037
Input: T9000 uses the Skype API to record audio and video calls.

Tactics: TA0009
Techniques: T1125, T1123
Input: Ke3chang is known to use 7Zip and RAR with passwords to encrypt data prior to exfiltration.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Monitor executed commands and arguments for actions that may attempt to access detailed information about the password policy used within an enterprise network or cloud environment.

Tactics: TA0007
Techniques: T1201
Input: XCSSET uses ps aux with the grep command to enumerate common browsers and system processes potentially impacting XCSSET's exfiltration capabilities.

Tactics: TA0007
Techniques: T1518
Input: Domains  http://mdzz2019.noip[.]cn:19931 http://mdzz2019.noip[.]cn:3654/  From my analyses, I was able to identify http://mdzz2019.noip[.]cn:19931 as its main C2 url.  This is a dynamic DNS, meaning the actual IP changes quite frequently

Tactics: TA0011
Techniques: T1071
Input: Winnti Group has registered domains for C2 that mimicked sites of their intended targets.

Tactics: TA0042
Techniques: T1583.001, T1583
Input: TrickBot uses web injects and browser redirection to trick the user into providing their login credentials on a fake or modified web page.

Tactics: TA0009
Techniques: T1185
Input: Monitor for third-party application logging, messaging, and/or other artifacts that may deface systems internal to an organization in an attempt to intimidate or mislead users.

Tactics: TA0040
Techniques: T1491.001, T1491
Input: Specific storage locations vary based on platform and/or application, but browser bookmarks are typically stored in local files/databases.

Tactics: TA0007
Techniques: T1217
Input: The command handle looks for the following command strings in Table 3:    Command Description   $fileDownload Uploads the contents of a specified file to C2   $importModule Adds a specified PowerShell module to the current script   $screenshot Executes the contents of the command, which should be the string ‘$screenshot’

Tactics: TA0009
Techniques: T1113
Input: wevtutil cl system

Tactics: TA0005
Techniques: T1070, T1070.001
Input: Peirates can query the query AWS and GCP metadata APIs for secrets.

Tactics: TA0006
Techniques: T1552, T1552.005
Input: Bxaki obfuscated function

Tactics: TA0005
Techniques: T1027
Input: Also known as public-key cryptography, this requires pairs of cryptographic keys that can encrypt/decrypt data from the corresponding key.

Tactics: TA0010
Techniques: T1048.002, T1048
Input: Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise.

Tactics: TA0001
Techniques: T1195, T1195.002
Input: WarzoneRAT can send collected victim data to its C2 server.

Tactics: TA0010
Techniques: T1041
Input: Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start.

Tactics: TA0003, TA0004
Techniques: T1547.002, T1547
Input: Denis performed process hollowing through the API calls CreateRemoteThread, ResumeThread, and Wow64SetThreadContext.

Tactics: TA0004, TA0005
Techniques: T1055.012, T1055
Input: The Trojan will respond to the C2 to notify it of a successful upload by sending a URL structured as follows:http://<c2 domain>/resp?<hex(Environment.UserName/Environment.MachineName)>AAZ<hex(“File Uploaded”)> The download command (3) reads the contents of a specified file and sends the data to the C2 server

Tactics: TA0011
Techniques: T1071, T1105
Input: Monitor for the creation/modification to Registry keys associated with Windows logon scrips, nameley HKCU\Environment\UserInitMprLogonScript.

Tactics: TA0003, TA0004
Techniques: T1037.001, T1037
Input: Monitor for unexpected deletion of a virtual machine image (ex: Azure Compute Service Images DELETE)

Tactics: TA0040
Techniques: T1485
Input: DarkComet can open an active screen of the victim’s machine and take control of the mouse and keyboard.

Tactics: TA0008
Techniques: T1021.001, T1021
Input: InvisiMole uses variations of a simple XOR encryption routine for C&C communications.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: DarkComet can list active processes running on the victim’s machine.

Tactics: TA0007
Techniques: T1057
Input: Similar to Input Capture, keylogging activity can take various forms but can may be detected via installation of a driver.

Tactics: TA0006
Techniques: T1111
Input: For malicious code served up through ads, adblockers can help prevent that code from executing in the first place.

Tactics: TA0001, TA0002
Techniques: T1189, T1059.007, T1059.005, T1059
Input: Monitor network data for uncommon data flows.

Tactics: TA0043, TA0001, TA0003, TA0005, TA0006, TA0007, TA0008, TA0011, TA0010, TA0040
Techniques: T1599, T1505.003, T1499.002, T1219, T1599.001, T1041, T1499, T1003.006, T1572, T1598.001, T1595.001, T1498, T1033, T1003, T1563.002, T1568, T1499.003, T1102.001, T1102.002, T1598.002, T1104, T1048.002, T1048.003, T1498.002, T1563, T1046, T1090.001, T1090.003, T1566.003, T1048, T1566, T1566.002, T1595, T1102.003, T1499.001, T1566.001, T1567.001, T1563.001, T1505, T1598, T1534, T1567.002, T1090, T1090.002, T1567, T1095, T1598.003, T1102, T1498.001, T1048.001, T1496, T1499.004, T1595.002
Input: /etc/passwd

Tactics: TA0007
Techniques: T1087
Input: These requests are encrypted using the RC4 algorithm

Tactics: TA0005
Techniques: T1027
Input: BBSRAT can start, stop, or delete services.

Tactics: TA0002
Techniques: T1569.002, T1569
Input: RogueRobin has a command named $screenshot that may be responsible for taking screenshots of the victim machine.

Tactics: TA0009
Techniques: T1113
Input: The primary difference was that this sample was encrypted and password protected, requiring the victim to enter in a password which was likely provided by the adversary to view the document

Tactics: TA0007
Techniques: T1018
Input: Zebrocy can obtain the current execution path as well as perform drive enumeration.

Tactics: TA0007
Techniques: T1083
Input: Linfo creates a backdoor through which remote attackers can change C2 servers.

Tactics: TA0011
Techniques: T1008
Input: Remote access tools with built-in features may interact directly with the Windows API, such as calling GetLocaleInfoW() to gather system location information.

Tactics: TA0004
Techniques: T1611
Input: Monitor newly executed processes that may attempt to find local system groups and permission settings.

Tactics: TA0007
Techniques: T1069.001, T1069
Input: Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.

Tactics: TA0006
Techniques: T1003, T1003.005
Input: Adversaries may attempt to discover information about the services enabled throughout the environment.

Tactics: TA0007
Techniques: T1526
Input: LitePower can take system screenshots and save them to %AppData%.

Tactics: TA0009
Techniques: T1113
Input: ComRAT has used encryption and base64 to obfuscate its orchestrator code in the Registry.

Tactics: TA0005
Techniques: T1027
Input: GoldenSpy has exfiltrated host environment information to an external C2 domain via port 9006.

Tactics: TA0010
Techniques: T1041
Input: Cobalt Group obfuscated several scriptlets and code used on the victim’s machine, including through use of XOR and RC4.

Tactics: TA0005
Techniques: T1027
Input: admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about the OS: ver >> %temp%\download systeminfo >> %temp%\download

Tactics: TA0007
Techniques: T1082
Input: BLUELIGHT can use different cloud providers for its C2.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: TA551 has used cmd.exe to execute commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Attor can set attributes of log files and directories to HIDDEN, SYSTEM, ARCHIVE, or a combination of those.

Tactics: TA0005
Techniques: T1564, T1564.001
Input: It has also accessed network diagram files useful for understanding how a host's network was configured.

Tactics: TA0007
Techniques: T1049
Input: Phishing may also involve social engineering techniques, such as posing as a trusted source.

Tactics: TA0001
Techniques: T1566
Input: nltest /domain_trusts

Tactics: TA0007
Techniques: T1482
Input: The file, named Microsoft.Win32.TaskScheduler.dll, is digitally signed by a certificate from AirVPN

Tactics: TA0005
Techniques: T1553, T1553.002
Input: Penquin can encrypt communications using the BlowFish algorithm and a symmetric key exchanged with Diffie Hellman.

Tactics: TA0011
Techniques: T1573, T1573.002
Input: Monitor for an attempt by a user to gain access to a network or computing resource, often by providing credentials

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.001
Input: USBStealer searches victim drives for files matching certain extensions (".skr",".pkr" or ".key") or names.

Tactics: TA0007
Techniques: T1083
Input: Turian can use VMProtect for obfuscation.

Tactics: TA0005
Techniques: T1027
Input: Higaisa sent the victim computer identifier in a User-Agent string back to the C2 server every 10 minutes.

Tactics: TA0010
Techniques: T1029
Input: Siloscape checks for Kubernetes node permissions.

Tactics: TA0007
Techniques: T1069
Input: Adversaries may attempt to remove such artifacts.

Tactics: TA0005
Techniques: T1553, T1553.006
Input: Display Managers are not anchored to specific distributions and may be changed by a user or adversary.

Tactics: TA0005
Techniques: T1564.002, T1564
Input: FIN4 has used HTTP POST requests to transmit data.

Tactics: TA0011
Techniques: T1071, T1071.001
Input: If an adversary is able to access the database and key, the credential cache Kerberos blob can be extracted and converted into a usable Kerberos ccache file that adversaries may use for Pass the Ticket.

Tactics: TA0006
Techniques: T1558
Input: Tonto Team has used EternalBlue exploits for lateral movement.

Tactics: TA0008
Techniques: T1210
Input: Also look for behavior on the system that might indicate successful compromise, such as abnormal behavior of processes.

Tactics: TA0005, TA0006
Techniques: T1211, T1212
Input: Leviathan has utilized OLE as a method to insert malicious content inside various phishing documents.

Tactics: TA0002
Techniques: T1559, T1559.002
Input: Grandoreiro has used malicious links to gain execution on victim machines.

Tactics: TA0002
Techniques: T1204, T1204.001
Input: For instance, the following data exists within a resource: fb 70 b0 c9 bd c5 8a d4 0c 54 fd 4c 6d bb f0 0f By multiplying each byte with -1, we obtain the following data: 05 90 50 37 43 3b 76 2c f4 ac 03 b4 93 45 10 f1 After using RC4 and the key 14331d289e737093994395d3fc412afc, the following cleartext data appears: \x00\x00\x00\x00FlashRun.vbs We do not see the payload using this FlashRun.vbs filename, instead it uses a temporary file name to store an embedded VBScript file, such as %Temp%\4.tmp\5.vbs

Tactics: TA0002, TA0005, TA0009
Techniques: T1036, T1560, T1059
Input: LOWBALL uses the Dropbox cloud storage service for command and control.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: Adversaries can modify these values to continually execute arbitrary commands.

Tactics: TA0003, TA0004
Techniques: T1546, T1546.001
Input: Ke3chang backdoor RoyalDNS established persistence through adding a service called Nwsapagent.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Daserf can download remote files.

Tactics: TA0011
Techniques: T1105
Input: Uploading malware or tools to a location accessible to a victim network to enable Ingress Tool Transfer.

Tactics: TA0042
Techniques: T1608
Input: An adversary may Create Snapshot of one or more volumes in an account, create a new instance, mount the snapshots, and then apply a less restrictive security policy to collect Data from Local System or for Remote Data Staging.

Tactics: TA0005
Techniques: T1578.002, T1578
Input: One of Dtrack can hide in replicas of legitimate programs like OllyDbg, 7-Zip, and FileZilla.

Tactics: TA0005
Techniques: T1036.005, T1036
Input: For example, the GCP Command Center can be used to view all assets, findings of potential security risks, and to run additional queries, such as finding public IP addresses and open ports.

Tactics: TA0007
Techniques: T1538
Input: Monitor newly executed processes that may downgrade or use a version of system features that may be outdated, vulnerable, and/or does not support updated security controls such as logging.

Tactics: TA0005
Techniques: T1562.010, T1562
Input: For example, in Windows 10 and Windows Server 2016 and above, Windows Defender Application Control (WDAC) policy rules may be applied to block the msbuild.exe application and to prevent abuse.

Tactics: TA0005
Techniques: T1127.001, T1127
Input: Umbreon creates valid local users to provide access to the system.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.003
Input: Information may also be acquired through Windows system management tools such as PowerShell.

Tactics: TA0007
Techniques: T1482
Input: Adversaries may abuse the cron utility to perform task scheduling for initial or recurring execution of malicious code.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053, T1053.003
Input: PlugX checks if VMware tools is running in the background by searching for any process named "vmtoolsd".

Tactics: TA0005, TA0007
Techniques: T1497, T1497.001
Input: Detection efforts may be focused on closely related adversary behaviors, such as Modify System Image and Network Device CLI.

Tactics: TA0005
Techniques: T1600.001, T1600, T1600.002
Input: The .iqy files take advantage of Excel’s willingness to download and include the contents from a remote server in a spreadsheet

Tactics: TA0011
Techniques: T1105
Input: A directory share pivot is a variation on this technique that uses several other techniques to propagate malware when users access a shared network directory.

Tactics: TA0008
Techniques: T1080
Input: Protocol Tunneling may also be abused by adversaries during Dynamic Resolution.

Tactics: TA0011
Techniques: T1572
Input: NOKKI can collect data from the victim and stage it in LOCALAPPDATA%\MicroSoft Updatea\uplog.tmp.

Tactics: TA0009
Techniques: T1074.001, T1074
Input: RegDuke can use Dropbox as its C2 server.

Tactics: TA0011
Techniques: T1102.002, T1102
Input: APT41 created a RAR archive of targeted files for exfiltration.

Tactics: TA0009
Techniques: T1560.001, T1560
Input: Adversaries may create a new process with a different token to escalate privileges and bypass access controls.

Tactics: TA0004, TA0005
Techniques: T1134.002, T1134
Input: Flagpro has the ability to wait for a specified time interval between communicating with and executing commands from C2.

Tactics: TA0010
Techniques: T1029
Input: Depending on the security settings, the browser may not allow the user to establish a connection to the website.

Tactics: TA0005
Techniques: T1553, T1553.004
Input: APT29 used scheduler and schtasks to create new tasks on remote hosts as part of lateral movement.

Tactics: TA0002, TA0003, TA0004
Techniques: T1053.005, T1053
Input: MuddyWater has used malware that has the capability to execute malicious code via COM, DCOM, and Outlook.

Tactics: TA0002
Techniques: T1559, T1559.001
Input: Malicious rules commonly filter out emails based on key words (such as malware, suspicious, phish, and hack) found in message bodies and subject lines.

Tactics: TA0005
Techniques: T1564, T1564.008
Input: BLINDINGCAN has deleted itself and associated artifacts from victim machines.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: BLUELIGHT has collected the computer name and OS version from victim machines.

Tactics: TA0007
Techniques: T1082
Input: Ensure proper permissions are set for Registry hives to prevent users from modifying keys associated with COR_PROFILER.

Tactics: TA0003, TA0004, TA0005
Techniques: T1574.012, T1574
Input: Emotet has used HTTP over ports such as 20, 22, 7080, and 50000, in addition to using ports commonly associated with HTTP/S.

Tactics: TA0011
Techniques: T1571
Input: DarkComet has the option to compress its payload using UPX or MPRESS.

Tactics: TA0005
Techniques: T1027.002, T1027
Input: Verclsid.exe is known as the Extension CLSID Verification Host and is responsible for verifying each shell extension before they are used by Windows Explorer or the Windows Shell.

Tactics: TA0005
Techniques: T1218, T1218.012
Input: If the document is opened with a Graphical User Interface (GUI) the malicious p-code is decompiled and may be viewed.

Tactics: TA0005
Techniques: T1564, T1564.007
Input: Volgmer can list directories on a victim.

Tactics: TA0007
Techniques: T1083
Input: Some Sakula samples use cmd.exe to delete temporary files.

Tactics: TA0005
Techniques: T1070, T1070.004
Input: Cobian RAT has a feature to access the webcam on the victim’s machine.

Tactics: TA0009
Techniques: T1125
Input: In order for this change to be reflected, the malware also issued killall Terminal.

Tactics: TA0004, TA0005
Techniques: T1548.003, T1548
Input: The base templates within the application are used each time an application starts.

Tactics: TA0003
Techniques: T1137, T1137.001
Input: Sandworm Team has used intercepter-NG to sniff passwords in network traffic.

Tactics: TA0006, TA0007
Techniques: T1040
Input: Monitor for newly executed processes that may attempt to gather information about attached peripheral devices and components connected to a computer system.

Tactics: TA0007
Techniques: T1120
Input: TrickBot establishes persistence by creating an autostart service that allows it to run whenever the machine boots.

Tactics: TA0003, TA0004
Techniques: T1543.003, T1543
Input: Sandworm Team has pushed additional malicious tools onto an infected system to steal user credentials, move laterally, and destroy data.

Tactics: TA0011
Techniques: T1105
Input: Sowbug has used command line during its intrusions.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: These events cannot start applications remotely (they can start them locally), but they can interact with applications if they're already running remotely.

Tactics: TA0002
Techniques: T1059.002, T1059
Input: NETWIRE can use AES encryption for C2 data transferred.

Tactics: TA0011
Techniques: T1573, T1573.001
Input: Mofang has compressed the ShimRat executable within malicious email attachments.

Tactics: TA0005
Techniques: T1027
Input: Cobalt Group has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands.

Tactics: TA0002
Techniques: T1059.003, T1059
Input: Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems.

Tactics: TA0001, TA0003, TA0004, TA0005
Techniques: T1078, T1078.001
Input: If infrastructure or patterns in the malicious web content utilized to deliver a Drive-by Compromise have been previously identified, internet scanning may uncover when an adversary has staged web content for use in a strategic web compromise.Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult.

Tactics: TA0042
Techniques: T1608.004, T1608
Input: Kinsing has created and run a Bitcoin cryptocurrency miner.

Tactics: TA0040
Techniques: T1496
Input: BLINDINGCAN has been signed with code-signing certificates such as CodeRipper.

Tactics: TA0005
Techniques: T1553, T1553.002
Input: TinyTurla can go through a list of C2 server IPs and will try to register with each until one responds.

Tactics: TA0011
Techniques: T1008
Input: Machete can download additional files for execution on the victim’s machine.

Tactics: TA0011
Techniques: T1105