sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
LAPSUS$ has spammed target users with MFA prompts in the hope that the legitimate user will grant necessary approval.
Technique: T1621 Multi-Factor Authentication Request Generation, Tactic: TA0006 Credential Access
Scattered Spider has used multifactor authentication (MFA) fatigue by sending repeated MFA authentication requests to targets.
Technique: T1621 Multi-Factor Authentication Request Generation, Tactic: TA0006 Credential Access
During Operation Dream Job, Lazarus Group used tools that used the `IsDebuggerPresent` call to detect debuggers.
Technique: T1622 Debugger Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
AsyncRAT can use the `CheckRemoteDebuggerPresent` function to detect the presence of a debugger.
Technique: T1622 Debugger Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
The Black Basta dropper can check system flags, CPU registers, CPU instructions, process timing, system libraries, and APIs to determine if a debugger is present.
Technique: T1622 Debugger Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Bumblebee can search for tools used in static analysis.
Technique: T1622 Debugger Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
DRATzarus can use `IsDebuggerPresent` to detect whether a debugger is present on a victim.
Technique: T1622 Debugger Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
DarkGate checks the `BeingDebugged` flag in the PEB structure during execution to identify if the malware is being debugged.
Technique: T1622 Debugger Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
DarkTortilla can detect debuggers by using functions such as `DebuggerIsAttached` and `DebuggerIsLogging`. DarkTortilla can also detect profilers by verifying the `COR_ENABLE_PROFILING` environment variable is present and active.
Technique: T1622 Debugger Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Mafalda can search for debugging tools on a compromised host.
Technique: T1622 Debugger Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
ROKRAT can check for debugging tools.
Technique: T1622 Debugger Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
Saint Bot has used `is_debugger_present` as part of its environmental checks.
Technique: T1622 Debugger Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
ThiefQuest uses a function named `is_debugging` to perform anti-debugging logic. The function invokes `sysctl` checking the returned value of `P_TRACED`. ThiefQuest also calls `ptrace` with the `PTRACE_DENY_ATTACH` flag to prevent debugging.
Technique: T1622 Debugger Evasion, Tactic: TA0005 Defense Evasion TA0007 Discovery
XCSSET uses the `plutil` command to modify the `LSUIElement`, `DFBundleDisplayName`, and `CFBundleIdentifier` keys in the `/Contents/Info.plist` file to change how XCSSET is visible on the system.
Technique: T1647 Plist File Modification, Tactic: TA0005 Defense Evasion
Pacu can create malicious Lambda functions.
Technique: T1648 Serverless Execution, Tactic: TA0002 Execution
APT29 has abused misconfigured AD CS certificate templates to impersonate admin users and create additional authentication certificates.
Technique: T1649 Steal or Forge Authentication Certificates, Tactic: TA0006 Credential Access
AADInternals can create and export various authentication certificates, including those associated with Azure AD joined/registered devices.
Technique: T1649 Steal or Forge Authentication Certificates, Tactic: TA0006 Credential Access
Mimikatz's `CRYPTO` module can create and export various types of authentication certificates.
Technique: T1649 Steal or Forge Authentication Certificates, Tactic: TA0006 Credential Access
APT29 has used Azure Run Command and Azure Admin-on-Behalf-of (AOBO) to execute code on virtual machines.
Technique: T1651 Cloud Administration Command, Tactic: TA0002 Execution
AADInternals can execute commands on Azure virtual machines using the VM agent.
Technique: T1651 Cloud Administration Command, Tactic: TA0002 Execution
Pacu can run commands on EC2 instances using AWS Systems Manager Run Command.
Technique: T1651 Cloud Administration Command, Tactic: TA0002 Execution
HOPLIGHT can enumerate device drivers located in the registry at `HKLM\Software\WBEM\WDM`.
Technique: T1652 Device Driver Discovery, Tactic: TA0007 Discovery
Remsec has a plugin to detect active drivers of some security products.
Technique: T1652 Device Driver Discovery, Tactic: TA0007 Discovery
APT5 has used the BLOODMINE utility to parse and extract information from Pulse Secure Connect logs.
Technique: T1654 Log Enumeration, Tactic: TA0007 Discovery
Volt Typhoon has used `wevtutil.exe` and the PowerShell command `Get-EventLog security` to enumerate Windows logs to search for successful logons.
Technique: T1654 Log Enumeration, Tactic: TA0007 Discovery
Pacu can collect CloudTrail event histories and CloudWatch logs.
Technique: T1654 Log Enumeration, Tactic: TA0007 Discovery
During C0027, Scattered Spider impersonated legitimate IT personnel in phone calls and text messages either to direct victims to a credential harvesting site or getting victims to run commercial remote monitoring and management (RMM) tools.
Technique: T1656 Impersonation, Tactic: TA0005 Defense Evasion
During Operation Dream Job, Lazarus Group impersonated HR hiring personnel through LinkedIn messages and conducted interviews with victims in order to deceive them into downloading malware.
Technique: T1656 Impersonation, Tactic: TA0005 Defense Evasion
LAPSUS$ has called victims' help desk and impersonated legitimate users with previously gathered information in order to gain access to privileged accounts.
Technique: T1656 Impersonation, Tactic: TA0005 Defense Evasion
During C0027, Scattered Spider impersonated legitimate IT personnel in phone calls and text messages either to direct victims to a credential harvesting site or getting victims to run commercial remote monitoring and management (RMM) tools.

Scattered Spider utilized social engineering to compel IT help desk personnel to reset passwords and MFA tokens.
Technique: T1656 Impersonation, Tactic: TA0005 Defense Evasion
Akira engages in double-extortion ransomware, exfiltrating files then encrypting them, in order to prompt victims to pay a ransom.
Technique: T1657 Financial Theft, Tactic: TA0040 Impact
Cinnamon Tempest has maintained leak sites for exfiltrated data in attempt to extort victims into paying a ransom.
Technique: T1657 Financial Theft, Tactic: TA0040 Impact
FIN13 has observed the victim's software and infrastructure over several months to understand the technical process of legitimate financial transactions, prior to attempting to conduct fraudulent transactions.
Technique: T1657 Financial Theft, Tactic: TA0040 Impact
Malteiro targets organizations in a wide variety of sectors via the use of Mispadu banking trojan with the goal of financial theft.
Technique: T1657 Financial Theft, Tactic: TA0040 Impact
Scattered Spider has deployed ransomware on compromised hosts for financial gain.
Technique: T1657 Financial Theft, Tactic: TA0040 Impact
SilverTerrier targets organizations in high technology, higher education, and manufacturing for business email compromise (BEC) campaigns with the goal of financial theft.
Technique: T1657 Financial Theft, Tactic: TA0040 Impact
DarkGate can deploy payloads capable of capturing credentials related to cryptocurrency wallets.
Technique: T1657 Financial Theft, Tactic: TA0040 Impact
MoustachedBouncer has injected content into DNS, HTTP, and SMB replies to redirect specifically-targeted victims to a fake Windows Update page to download malware.
Technique: T1659 Content Injection, Tactic: TA0011 Command and Control TA0001 Initial Access
Disco has achieved initial access and execution through content injection into DNS,  HTTP, and SMB replies to targeted hosts that redirect them to download malicious files.
Technique: T1659 Content Injection, Tactic: TA0011 Command and Control TA0001 Initial Access
During the SolarWinds Compromise, APT29 set the hostnames of their C2 infrastructure to match legitimate hostnames in the victim environment. They also used IP addresses originating from the same country as the victim for their VPN infrastructure.
Technique: T1665 Hide Infrastructure, Tactic: TA0011 Command and Control
APT29 uses compromised residential endpoints, typically within the same ISP IP address range, as proxies to hide the true source of C2 traffic.
Technique: T1665 Hide Infrastructure, Tactic: TA0011 Command and Control
DarkGate command and control includes hard-coded domains in the malware masquerading as legitimate services such as Akamai CDN or Amazon Web Services.
Technique: T1665 Hide Infrastructure, Tactic: TA0011 Command and Control